xref: /titanic_52/usr/src/uts/common/inet/ip/ip_if.c (revision 87a231a8a0b46f6811b92bbde98c6a52284a0c1f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 /* Copyright (c) 1990 Mentat Inc. */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * This file contains the interface control functions for IP.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/stream.h>
35 #include <sys/dlpi.h>
36 #include <sys/stropts.h>
37 #include <sys/strsun.h>
38 #include <sys/sysmacros.h>
39 #include <sys/strlog.h>
40 #include <sys/ddi.h>
41 #include <sys/sunddi.h>
42 #include <sys/cmn_err.h>
43 #include <sys/kstat.h>
44 #include <sys/debug.h>
45 #include <sys/zone.h>
46 
47 #include <sys/kmem.h>
48 #include <sys/systm.h>
49 #include <sys/param.h>
50 #include <sys/socket.h>
51 #include <sys/isa_defs.h>
52 #include <net/if.h>
53 #include <net/if_arp.h>
54 #include <net/if_types.h>
55 #include <net/if_dl.h>
56 #include <net/route.h>
57 #include <sys/sockio.h>
58 #include <netinet/in.h>
59 #include <netinet/ip6.h>
60 #include <netinet/icmp6.h>
61 #include <netinet/igmp_var.h>
62 #include <sys/strsun.h>
63 #include <sys/policy.h>
64 #include <sys/ethernet.h>
65 
66 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
67 #include <inet/mi.h>
68 #include <inet/nd.h>
69 #include <inet/arp.h>
70 #include <inet/mib2.h>
71 #include <inet/ip.h>
72 #include <inet/ip6.h>
73 #include <inet/ip6_asp.h>
74 #include <inet/tcp.h>
75 #include <inet/ip_multi.h>
76 #include <inet/ip_ire.h>
77 #include <inet/ip_ftable.h>
78 #include <inet/ip_rts.h>
79 #include <inet/ip_ndp.h>
80 #include <inet/ip_if.h>
81 #include <inet/ip_impl.h>
82 #include <inet/tun.h>
83 #include <inet/sctp_ip.h>
84 #include <inet/ip_netinfo.h>
85 
86 #include <net/pfkeyv2.h>
87 #include <inet/ipsec_info.h>
88 #include <inet/sadb.h>
89 #include <inet/ipsec_impl.h>
90 #include <sys/iphada.h>
91 
92 
93 #include <netinet/igmp.h>
94 #include <inet/ip_listutils.h>
95 #include <inet/ipclassifier.h>
96 #include <sys/mac.h>
97 
98 #include <sys/systeminfo.h>
99 #include <sys/bootconf.h>
100 
101 #include <sys/tsol/tndb.h>
102 #include <sys/tsol/tnet.h>
103 
104 /* The character which tells where the ill_name ends */
105 #define	IPIF_SEPARATOR_CHAR	':'
106 
107 /* IP ioctl function table entry */
108 typedef struct ipft_s {
109 	int	ipft_cmd;
110 	pfi_t	ipft_pfi;
111 	int	ipft_min_size;
112 	int	ipft_flags;
113 } ipft_t;
114 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
115 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
116 
117 typedef struct ip_sock_ar_s {
118 	union {
119 		area_t	ip_sock_area;
120 		ared_t	ip_sock_ared;
121 		areq_t	ip_sock_areq;
122 	} ip_sock_ar_u;
123 	queue_t	*ip_sock_ar_q;
124 } ip_sock_ar_t;
125 
126 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
127 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
128 		    char *value, caddr_t cp, cred_t *ioc_cr);
129 
130 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
131 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
132 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
133     mblk_t *mp, boolean_t need_up);
134 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
135     mblk_t *mp, boolean_t need_up);
136 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
137     queue_t *q, mblk_t *mp, boolean_t need_up);
138 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
139     mblk_t *mp, boolean_t need_up);
140 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
141     mblk_t *mp);
142 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
143     queue_t *q, mblk_t *mp, boolean_t need_up);
144 static int	ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp,
145     sin_t *sin, boolean_t x_arp_ioctl, boolean_t if_arp_ioctl);
146 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **);
147 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
148 static void	ipsq_flush(ill_t *ill);
149 static void	ipsq_clean_all(ill_t *ill);
150 static void	ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring);
151 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
152     queue_t *q, mblk_t *mp, boolean_t need_up);
153 static void	ipsq_delete(ipsq_t *);
154 
155 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
156 		    boolean_t initialize);
157 static void	ipif_check_bcast_ires(ipif_t *test_ipif);
158 static void	ipif_down_delete_ire(ire_t *ire, char *ipif);
159 static void	ipif_delete_cache_ire(ire_t *, char *);
160 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
161 static void	ipif_free(ipif_t *ipif);
162 static void	ipif_free_tail(ipif_t *ipif);
163 static void	ipif_mtu_change(ire_t *ire, char *ipif_arg);
164 static void	ipif_multicast_down(ipif_t *ipif);
165 static void	ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif);
166 static void	ipif_set_default(ipif_t *ipif);
167 static int	ipif_set_values(queue_t *q, mblk_t *mp,
168     char *interf_name, uint_t *ppa);
169 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
170     queue_t *q);
171 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
172     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
173     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error);
174 static int	ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp);
175 static void	ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp);
176 
177 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
178 static int	ill_arp_off(ill_t *ill);
179 static int	ill_arp_on(ill_t *ill);
180 static void	ill_delete_interface_type(ill_if_t *);
181 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
182 static void	ill_dl_down(ill_t *ill);
183 static void	ill_down(ill_t *ill);
184 static void	ill_downi(ire_t *ire, char *ill_arg);
185 static void	ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg);
186 static void	ill_down_tail(ill_t *ill);
187 static void	ill_free_mib(ill_t *ill);
188 static void	ill_glist_delete(ill_t *);
189 static boolean_t ill_has_usable_ipif(ill_t *);
190 static int	ill_lock_ipsq_ills(ipsq_t *sq, ill_t **list, int);
191 static void	ill_nominate_bcast_rcv(ill_group_t *illgrp);
192 static void	ill_phyint_free(ill_t *ill);
193 static void	ill_phyint_reinit(ill_t *ill);
194 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
195 static void	ill_signal_ipsq_ills(ipsq_t *, boolean_t);
196 static boolean_t ill_split_ipsq(ipsq_t *cur_sq);
197 static void	ill_stq_cache_delete(ire_t *, char *);
198 
199 static boolean_t ip_ether_v6intfid(uint_t, uint8_t *, in6_addr_t *);
200 static boolean_t ip_nodef_v6intfid(uint_t, uint8_t *, in6_addr_t *);
201 static boolean_t ip_ether_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
202     in6_addr_t *);
203 static boolean_t ip_ether_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
204     ipaddr_t *);
205 static boolean_t ip_ib_v6intfid(uint_t, uint8_t *, in6_addr_t *);
206 static boolean_t ip_ib_v6mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
207     in6_addr_t *);
208 static boolean_t ip_ib_v4mapinfo(uint_t, uint8_t *, uint8_t *, uint32_t *,
209     ipaddr_t *);
210 
211 static void	ipif_save_ire(ipif_t *, ire_t *);
212 static void	ipif_remove_ire(ipif_t *, ire_t *);
213 static void 	ip_cgtp_bcast_add(ire_t *, ire_t *);
214 static void 	ip_cgtp_bcast_delete(ire_t *);
215 
216 /*
217  * Per-ill IPsec capabilities management.
218  */
219 static ill_ipsec_capab_t *ill_ipsec_capab_alloc(void);
220 static void	ill_ipsec_capab_free(ill_ipsec_capab_t *);
221 static void	ill_ipsec_capab_add(ill_t *, uint_t, boolean_t);
222 static void	ill_ipsec_capab_delete(ill_t *, uint_t);
223 static boolean_t ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *, int);
224 static void ill_capability_proto(ill_t *, int, mblk_t *);
225 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *,
226     boolean_t);
227 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
228 static void ill_capability_mdt_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
229 static void ill_capability_mdt_reset(ill_t *, mblk_t **);
230 static void ill_capability_ipsec_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
231 static void ill_capability_ipsec_reset(ill_t *, mblk_t **);
232 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
233 static void ill_capability_hcksum_reset(ill_t *, mblk_t **);
234 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
235     dl_capability_sub_t *);
236 static void ill_capability_zerocopy_reset(ill_t *, mblk_t **);
237 
238 static void ill_capability_dls_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
239 static mac_resource_handle_t ill_ring_add(void *, mac_resource_t *);
240 static void ill_capability_dls_reset(ill_t *, mblk_t **);
241 static void ill_capability_dls_disable(ill_t *);
242 
243 static void	illgrp_cache_delete(ire_t *, char *);
244 static void	illgrp_delete(ill_t *ill);
245 static void	illgrp_reset_schednext(ill_t *ill);
246 
247 static ill_t	*ill_prev_usesrc(ill_t *);
248 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
249 static void	ill_disband_usesrc_group(ill_t *);
250 
251 static void	conn_cleanup_stale_ire(conn_t *, caddr_t);
252 
253 /*
254  * if we go over the memory footprint limit more than once in this msec
255  * interval, we'll start pruning aggressively.
256  */
257 int ip_min_frag_prune_time = 0;
258 
259 /*
260  * max # of IPsec algorithms supported.  Limited to 1 byte by PF_KEY
261  * and the IPsec DOI
262  */
263 #define	MAX_IPSEC_ALGS	256
264 
265 #define	BITSPERBYTE	8
266 #define	BITS(type)	(BITSPERBYTE * (long)sizeof (type))
267 
268 #define	IPSEC_ALG_ENABLE(algs, algid) \
269 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] |= \
270 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
271 
272 #define	IPSEC_ALG_IS_ENABLED(algid, algs) \
273 		((algs)[(algid) / BITS(ipsec_capab_elem_t)] & \
274 		(1 << ((algid) % BITS(ipsec_capab_elem_t))))
275 
276 typedef uint8_t ipsec_capab_elem_t;
277 
278 /*
279  * Per-algorithm parameters.  Note that at present, only encryption
280  * algorithms have variable keysize (IKE does not provide a way to negotiate
281  * auth algorithm keysize).
282  *
283  * All sizes here are in bits.
284  */
285 typedef struct
286 {
287 	uint16_t	minkeylen;
288 	uint16_t	maxkeylen;
289 } ipsec_capab_algparm_t;
290 
291 /*
292  * Per-ill capabilities.
293  */
294 struct ill_ipsec_capab_s {
295 	ipsec_capab_elem_t *encr_hw_algs;
296 	ipsec_capab_elem_t *auth_hw_algs;
297 	uint32_t algs_size;	/* size of _hw_algs in bytes */
298 	/* algorithm key lengths */
299 	ipsec_capab_algparm_t *encr_algparm;
300 	uint32_t encr_algparm_size;
301 	uint32_t encr_algparm_end;
302 };
303 
304 /*
305  * List of AH and ESP IPsec acceleration capable ills
306  */
307 typedef struct ipsec_capab_ill_s {
308 	uint_t ill_index;
309 	boolean_t ill_isv6;
310 	struct ipsec_capab_ill_s *next;
311 } ipsec_capab_ill_t;
312 
313 static ipsec_capab_ill_t *ipsec_capab_ills_ah;
314 static ipsec_capab_ill_t *ipsec_capab_ills_esp;
315 krwlock_t ipsec_capab_ills_lock;
316 
317 /*
318  * The field values are larger than strictly necessary for simple
319  * AR_ENTRY_ADDs but the padding lets us accomodate the socket ioctls.
320  */
321 static area_t	ip_area_template = {
322 	AR_ENTRY_ADD,			/* area_cmd */
323 	sizeof (ip_sock_ar_t) + (IP_ADDR_LEN*2) + sizeof (struct sockaddr_dl),
324 					/* area_name_offset */
325 	/* area_name_length temporarily holds this structure length */
326 	sizeof (area_t),			/* area_name_length */
327 	IP_ARP_PROTO_TYPE,		/* area_proto */
328 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
329 	IP_ADDR_LEN,			/* area_proto_addr_length */
330 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN,
331 					/* area_proto_mask_offset */
332 	0,				/* area_flags */
333 	sizeof (ip_sock_ar_t) + IP_ADDR_LEN + IP_ADDR_LEN,
334 					/* area_hw_addr_offset */
335 	/* Zero length hw_addr_length means 'use your idea of the address' */
336 	0				/* area_hw_addr_length */
337 };
338 
339 /*
340  * AR_ENTRY_ADD/DELETE templates have been added for IPv6 external resolver
341  * support
342  */
343 static area_t	ip6_area_template = {
344 	AR_ENTRY_ADD,			/* area_cmd */
345 	sizeof (ip_sock_ar_t) + (IPV6_ADDR_LEN*2) + sizeof (sin6_t),
346 					/* area_name_offset */
347 	/* area_name_length temporarily holds this structure length */
348 	sizeof (area_t),			/* area_name_length */
349 	IP_ARP_PROTO_TYPE,		/* area_proto */
350 	sizeof (ip_sock_ar_t),		/* area_proto_addr_offset */
351 	IPV6_ADDR_LEN,			/* area_proto_addr_length */
352 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN,
353 					/* area_proto_mask_offset */
354 	0,				/* area_flags */
355 	sizeof (ip_sock_ar_t) + IPV6_ADDR_LEN + IPV6_ADDR_LEN,
356 					/* area_hw_addr_offset */
357 	/* Zero length hw_addr_length means 'use your idea of the address' */
358 	0				/* area_hw_addr_length */
359 };
360 
361 static ared_t	ip_ared_template = {
362 	AR_ENTRY_DELETE,
363 	sizeof (ared_t) + IP_ADDR_LEN,
364 	sizeof (ared_t),
365 	IP_ARP_PROTO_TYPE,
366 	sizeof (ared_t),
367 	IP_ADDR_LEN
368 };
369 
370 static ared_t	ip6_ared_template = {
371 	AR_ENTRY_DELETE,
372 	sizeof (ared_t) + IPV6_ADDR_LEN,
373 	sizeof (ared_t),
374 	IP_ARP_PROTO_TYPE,
375 	sizeof (ared_t),
376 	IPV6_ADDR_LEN
377 };
378 
379 /*
380  * A template for an IPv6 AR_ENTRY_QUERY template has not been created, as
381  * as the areq doesn't include an IP address in ill_dl_up() (the only place a
382  * areq is used).
383  */
384 static areq_t	ip_areq_template = {
385 	AR_ENTRY_QUERY,			/* cmd */
386 	sizeof (areq_t)+(2*IP_ADDR_LEN),	/* name offset */
387 	sizeof (areq_t),	/* name len (filled by ill_arp_alloc) */
388 	IP_ARP_PROTO_TYPE,		/* protocol, from arps perspective */
389 	sizeof (areq_t),			/* target addr offset */
390 	IP_ADDR_LEN,			/* target addr_length */
391 	0,				/* flags */
392 	sizeof (areq_t) + IP_ADDR_LEN,	/* sender addr offset */
393 	IP_ADDR_LEN,			/* sender addr length */
394 	6,				/* xmit_count */
395 	1000,				/* (re)xmit_interval in milliseconds */
396 	4				/* max # of requests to buffer */
397 	/* anything else filled in by the code */
398 };
399 
400 static arc_t	ip_aru_template = {
401 	AR_INTERFACE_UP,
402 	sizeof (arc_t),		/* Name offset */
403 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
404 };
405 
406 static arc_t	ip_ard_template = {
407 	AR_INTERFACE_DOWN,
408 	sizeof (arc_t),		/* Name offset */
409 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
410 };
411 
412 static arc_t	ip_aron_template = {
413 	AR_INTERFACE_ON,
414 	sizeof (arc_t),		/* Name offset */
415 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
416 };
417 
418 static arc_t	ip_aroff_template = {
419 	AR_INTERFACE_OFF,
420 	sizeof (arc_t),		/* Name offset */
421 	sizeof (arc_t)		/* Name length (set by ill_arp_alloc) */
422 };
423 
424 
425 static arma_t	ip_arma_multi_template = {
426 	AR_MAPPING_ADD,
427 	sizeof (arma_t) + 3*IP_ADDR_LEN + IP_MAX_HW_LEN,
428 				/* Name offset */
429 	sizeof (arma_t),	/* Name length (set by ill_arp_alloc) */
430 	IP_ARP_PROTO_TYPE,
431 	sizeof (arma_t),			/* proto_addr_offset */
432 	IP_ADDR_LEN,				/* proto_addr_length */
433 	sizeof (arma_t) + IP_ADDR_LEN,		/* proto_mask_offset */
434 	sizeof (arma_t) + 2*IP_ADDR_LEN,	/* proto_extract_mask_offset */
435 	ACE_F_PERMANENT | ACE_F_MAPPING,	/* flags */
436 	sizeof (arma_t) + 3*IP_ADDR_LEN,	/* hw_addr_offset */
437 	IP_MAX_HW_LEN,				/* hw_addr_length */
438 	0,					/* hw_mapping_start */
439 };
440 
441 static ipft_t	ip_ioctl_ftbl[] = {
442 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
443 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
444 		IPFT_F_NO_REPLY },
445 	{ IP_IOC_IRE_ADVISE_NO_REPLY, ip_ire_advise, sizeof (ipic_t),
446 		IPFT_F_NO_REPLY },
447 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
448 	{ 0 }
449 };
450 
451 /* Simple ICMP IP Header Template */
452 static ipha_t icmp_ipha = {
453 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
454 };
455 
456 /* Flag descriptors for ip_ipif_report */
457 static nv_t	ipif_nv_tbl[] = {
458 	{ IPIF_UP,		"UP" },
459 	{ IPIF_BROADCAST,	"BROADCAST" },
460 	{ ILLF_DEBUG,		"DEBUG" },
461 	{ PHYI_LOOPBACK,	"LOOPBACK" },
462 	{ IPIF_POINTOPOINT,	"POINTOPOINT" },
463 	{ ILLF_NOTRAILERS,	"NOTRAILERS" },
464 	{ PHYI_RUNNING,		"RUNNING" },
465 	{ ILLF_NOARP,		"NOARP" },
466 	{ PHYI_PROMISC,		"PROMISC" },
467 	{ PHYI_ALLMULTI,	"ALLMULTI" },
468 	{ PHYI_INTELLIGENT,	"INTELLIGENT" },
469 	{ ILLF_MULTICAST,	"MULTICAST" },
470 	{ PHYI_MULTI_BCAST,	"MULTI_BCAST" },
471 	{ IPIF_UNNUMBERED,	"UNNUMBERED" },
472 	{ IPIF_DHCPRUNNING,	"DHCP" },
473 	{ IPIF_PRIVATE,		"PRIVATE" },
474 	{ IPIF_NOXMIT,		"NOXMIT" },
475 	{ IPIF_NOLOCAL,		"NOLOCAL" },
476 	{ IPIF_DEPRECATED,	"DEPRECATED" },
477 	{ IPIF_PREFERRED,	"PREFERRED" },
478 	{ IPIF_TEMPORARY,	"TEMPORARY" },
479 	{ IPIF_ADDRCONF,	"ADDRCONF" },
480 	{ PHYI_VIRTUAL,		"VIRTUAL" },
481 	{ ILLF_ROUTER,		"ROUTER" },
482 	{ ILLF_NONUD,		"NONUD" },
483 	{ IPIF_ANYCAST,		"ANYCAST" },
484 	{ ILLF_NORTEXCH,	"NORTEXCH" },
485 	{ ILLF_IPV4,		"IPV4" },
486 	{ ILLF_IPV6,		"IPV6" },
487 	{ IPIF_MIPRUNNING,	"MIP" },
488 	{ IPIF_NOFAILOVER,	"NOFAILOVER" },
489 	{ PHYI_FAILED,		"FAILED" },
490 	{ PHYI_STANDBY,		"STANDBY" },
491 	{ PHYI_INACTIVE,	"INACTIVE" },
492 	{ PHYI_OFFLINE,		"OFFLINE" },
493 };
494 
495 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
496 
497 static ip_m_t	ip_m_tbl[] = {
498 	{ DL_ETHER, IFT_ETHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
499 	    ip_ether_v6intfid },
500 	{ DL_CSMACD, IFT_ISO88023, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
501 	    ip_nodef_v6intfid },
502 	{ DL_TPB, IFT_ISO88024, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
503 	    ip_nodef_v6intfid },
504 	{ DL_TPR, IFT_ISO88025, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
505 	    ip_nodef_v6intfid },
506 	{ DL_FDDI, IFT_FDDI, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
507 	    ip_ether_v6intfid },
508 	{ DL_IB, IFT_IB, ip_ib_v4mapinfo, ip_ib_v6mapinfo,
509 	    ip_ib_v6intfid },
510 	{ SUNW_DL_VNI, IFT_OTHER, NULL, NULL, NULL},
511 	{ DL_OTHER, IFT_OTHER, ip_ether_v4mapinfo, ip_ether_v6mapinfo,
512 	    ip_nodef_v6intfid }
513 };
514 
515 static ill_t	ill_null;		/* Empty ILL for init. */
516 char	ipif_loopback_name[] = "lo0";
517 static char *ipv4_forward_suffix = ":ip_forwarding";
518 static char *ipv6_forward_suffix = ":ip6_forwarding";
519 static kstat_t *loopback_ksp = NULL;
520 static	sin6_t	sin6_null;	/* Zero address for quick clears */
521 static	sin_t	sin_null;	/* Zero address for quick clears */
522 static	uint_t	ill_index = 1;	/* Used to assign interface indicies */
523 /* When set search for unused index */
524 static boolean_t ill_index_wrap = B_FALSE;
525 /* When set search for unused ipif_seqid */
526 static ipif_t	ipif_zero;
527 uint_t	ipif_src_random;
528 
529 /*
530  * For details on the protection offered by these locks please refer
531  * to the notes under the Synchronization section at the start of ip.c
532  */
533 krwlock_t	ill_g_lock;		/* The global ill_g_lock */
534 kmutex_t	ip_addr_avail_lock;	/* Address availability check lock */
535 ipsq_t		*ipsq_g_head;		/* List of all ipsq's on the system */
536 
537 krwlock_t	ill_g_usesrc_lock;	/* Protects usesrc related fields */
538 
539 /*
540  * illgrp_head/ifgrp_head is protected by IP's perimeter.
541  */
542 static  ill_group_t *illgrp_head_v4;	/* Head of IPv4 ill groups */
543 ill_group_t *illgrp_head_v6;		/* Head of IPv6 ill groups */
544 
545 ill_g_head_t	ill_g_heads[MAX_G_HEADS];   /* ILL List Head */
546 
547 /*
548  * ppa arena is created after these many
549  * interfaces have been plumbed.
550  */
551 uint_t	ill_no_arena = 12;
552 
553 #pragma align CACHE_ALIGN_SIZE(phyint_g_list)
554 static phyint_list_t phyint_g_list;	/* start of phyint list */
555 
556 /*
557  * Reflects value of FAILBACK variable in IPMP config file
558  * /etc/default/mpathd. Default value is B_TRUE.
559  * Set to B_FALSE if user disabled failback by configuring "FAILBACK=no"
560  * in.mpathd uses SIOCSIPMPFAILBACK ioctl to pass this information to kernel.
561  */
562 static boolean_t ipmp_enable_failback = B_TRUE;
563 
564 /*
565  * Enable soft rings if ip_squeue_soft_ring or ip_squeue_fanout
566  * is set and ip_soft_rings_cnt > 0. ip_squeue_soft_ring is
567  * set through platform specific code (Niagara/Ontario).
568  */
569 #define	SOFT_RINGS_ENABLED()	(ip_soft_rings_cnt ? \
570 		(ip_squeue_soft_ring || ip_squeue_fanout) : B_FALSE)
571 
572 #define	ILL_CAPAB_DLS	(ILL_CAPAB_SOFT_RING | ILL_CAPAB_POLL)
573 
574 static uint_t
575 ipif_rand(void)
576 {
577 	ipif_src_random = ipif_src_random * 1103515245 + 12345;
578 	return ((ipif_src_random >> 16) & 0x7fff);
579 }
580 
581 /*
582  * Allocate per-interface mibs. Only used for ipv6.
583  * Returns true if ok. False otherwise.
584  *  ipsq  may not yet be allocated (loopback case ).
585  */
586 static boolean_t
587 ill_allocate_mibs(ill_t *ill)
588 {
589 	ASSERT(ill->ill_isv6);
590 
591 	/* Already allocated? */
592 	if (ill->ill_ip6_mib != NULL) {
593 		ASSERT(ill->ill_icmp6_mib != NULL);
594 		return (B_TRUE);
595 	}
596 
597 	ill->ill_ip6_mib = kmem_zalloc(sizeof (*ill->ill_ip6_mib),
598 	    KM_NOSLEEP);
599 	if (ill->ill_ip6_mib == NULL) {
600 		return (B_FALSE);
601 	}
602 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
603 	    KM_NOSLEEP);
604 	if (ill->ill_icmp6_mib == NULL) {
605 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
606 		ill->ill_ip6_mib = NULL;
607 		return (B_FALSE);
608 	}
609 	/*
610 	 * The ipv6Ifindex and ipv6IfIcmpIndex will be assigned later
611 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
612 	 * -> ill_phyint_reinit
613 	 */
614 	return (B_TRUE);
615 }
616 
617 /*
618  * Common code for preparation of ARP commands.  Two points to remember:
619  * 	1) The ill_name is tacked on at the end of the allocated space so
620  *	   the templates name_offset field must contain the total space
621  *	   to allocate less the name length.
622  *
623  *	2) The templates name_length field should contain the *template*
624  *	   length.  We use it as a parameter to bcopy() and then write
625  *	   the real ill_name_length into the name_length field of the copy.
626  * (Always called as writer.)
627  */
628 mblk_t *
629 ill_arp_alloc(ill_t *ill, uchar_t *template, caddr_t addr)
630 {
631 	arc_t	*arc = (arc_t *)template;
632 	char	*cp;
633 	int	len;
634 	mblk_t	*mp;
635 	uint_t	name_length = ill->ill_name_length;
636 	uint_t	template_len = arc->arc_name_length;
637 
638 	len = arc->arc_name_offset + name_length;
639 	mp = allocb(len, BPRI_HI);
640 	if (mp == NULL)
641 		return (NULL);
642 	cp = (char *)mp->b_rptr;
643 	mp->b_wptr = (uchar_t *)&cp[len];
644 	if (template_len)
645 		bcopy(template, cp, template_len);
646 	if (len > template_len)
647 		bzero(&cp[template_len], len - template_len);
648 	mp->b_datap->db_type = M_PROTO;
649 
650 	arc = (arc_t *)cp;
651 	arc->arc_name_length = name_length;
652 	cp = (char *)arc + arc->arc_name_offset;
653 	bcopy(ill->ill_name, cp, name_length);
654 
655 	if (addr) {
656 		area_t	*area = (area_t *)mp->b_rptr;
657 
658 		cp = (char *)area + area->area_proto_addr_offset;
659 		bcopy(addr, cp, area->area_proto_addr_length);
660 		if (area->area_cmd == AR_ENTRY_ADD) {
661 			cp = (char *)area;
662 			len = area->area_proto_addr_length;
663 			if (area->area_proto_mask_offset)
664 				cp += area->area_proto_mask_offset;
665 			else
666 				cp += area->area_proto_addr_offset + len;
667 			while (len-- > 0)
668 				*cp++ = (char)~0;
669 		}
670 	}
671 	return (mp);
672 }
673 
674 mblk_t *
675 ipif_area_alloc(ipif_t *ipif)
676 {
677 	return (ill_arp_alloc(ipif->ipif_ill, (uchar_t *)&ip_area_template,
678 	    (char *)&ipif->ipif_lcl_addr));
679 }
680 
681 mblk_t *
682 ipif_ared_alloc(ipif_t *ipif)
683 {
684 	return (ill_arp_alloc(ipif->ipif_ill, (uchar_t *)&ip_ared_template,
685 	    (char *)&ipif->ipif_lcl_addr));
686 }
687 
688 mblk_t *
689 ill_ared_alloc(ill_t *ill, ipaddr_t addr)
690 {
691 	return (ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
692 	    (char *)&addr));
693 }
694 
695 /*
696  * Completely vaporize a lower level tap and all associated interfaces.
697  * ill_delete is called only out of ip_close when the device control
698  * stream is being closed.
699  */
700 void
701 ill_delete(ill_t *ill)
702 {
703 	ipif_t	*ipif;
704 	ill_t	*prev_ill;
705 
706 	/*
707 	 * ill_delete may be forcibly entering the ipsq. The previous
708 	 * ioctl may not have completed and may need to be aborted.
709 	 * ipsq_flush takes care of it. If we don't need to enter the
710 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
711 	 * ill_delete_tail is sufficient.
712 	 */
713 	ipsq_flush(ill);
714 
715 	/*
716 	 * Nuke all interfaces.  ipif_free will take down the interface,
717 	 * remove it from the list, and free the data structure.
718 	 * Walk down the ipif list and remove the logical interfaces
719 	 * first before removing the main ipif. We can't unplumb
720 	 * zeroth interface first in the case of IPv6 as reset_conn_ill
721 	 * -> ip_ll_delmulti_v6 de-references ill_ipif for checking
722 	 * POINTOPOINT.
723 	 *
724 	 * If ill_ipif was not properly initialized (i.e low on memory),
725 	 * then no interfaces to clean up. In this case just clean up the
726 	 * ill.
727 	 */
728 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
729 		ipif_free(ipif);
730 
731 	/*
732 	 * Used only by ill_arp_on and ill_arp_off, which are writers.
733 	 * So nobody can be using this mp now. Free the mp allocated for
734 	 * honoring ILLF_NOARP
735 	 */
736 	freemsg(ill->ill_arp_on_mp);
737 	ill->ill_arp_on_mp = NULL;
738 
739 	/* Clean up msgs on pending upcalls for mrouted */
740 	reset_mrt_ill(ill);
741 
742 	/*
743 	 * ipif_free -> reset_conn_ipif will remove all multicast
744 	 * references for IPv4. For IPv6, we need to do it here as
745 	 * it points only at ills.
746 	 */
747 	reset_conn_ill(ill);
748 
749 	/*
750 	 * ill_down will arrange to blow off any IRE's dependent on this
751 	 * ILL, and shut down fragmentation reassembly.
752 	 */
753 	ill_down(ill);
754 
755 	/* Let SCTP know, so that it can remove this from its list. */
756 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
757 
758 	/*
759 	 * If an address on this ILL is being used as a source address then
760 	 * clear out the pointers in other ILLs that point to this ILL.
761 	 */
762 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
763 	if (ill->ill_usesrc_grp_next != NULL) {
764 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
765 			ill_disband_usesrc_group(ill);
766 		} else {	/* consumer of the usesrc ILL */
767 			prev_ill = ill_prev_usesrc(ill);
768 			prev_ill->ill_usesrc_grp_next =
769 			    ill->ill_usesrc_grp_next;
770 		}
771 	}
772 	rw_exit(&ill_g_usesrc_lock);
773 }
774 
775 static void
776 ipif_non_duplicate(ipif_t *ipif)
777 {
778 	ill_t *ill = ipif->ipif_ill;
779 	mutex_enter(&ill->ill_lock);
780 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
781 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
782 		ASSERT(ill->ill_ipif_dup_count > 0);
783 		ill->ill_ipif_dup_count--;
784 	}
785 	mutex_exit(&ill->ill_lock);
786 }
787 
788 /*
789  * ill_delete_tail is called from ip_modclose after all references
790  * to the closing ill are gone. The wait is done in ip_modclose
791  */
792 void
793 ill_delete_tail(ill_t *ill)
794 {
795 	mblk_t	**mpp;
796 	ipif_t	*ipif;
797 
798 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
799 		ipif_non_duplicate(ipif);
800 		ipif_down_tail(ipif);
801 	}
802 
803 	ASSERT(ill->ill_ipif_dup_count == 0 &&
804 	    ill->ill_arp_down_mp == NULL &&
805 	    ill->ill_arp_del_mapping_mp == NULL);
806 
807 	/*
808 	 * If polling capability is enabled (which signifies direct
809 	 * upcall into IP and driver has ill saved as a handle),
810 	 * we need to make sure that unbind has completed before we
811 	 * let the ill disappear and driver no longer has any reference
812 	 * to this ill.
813 	 */
814 	mutex_enter(&ill->ill_lock);
815 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
816 		cv_wait(&ill->ill_cv, &ill->ill_lock);
817 	mutex_exit(&ill->ill_lock);
818 
819 	/*
820 	 * Clean up polling and soft ring capabilities
821 	 */
822 	if (ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING))
823 		ill_capability_dls_disable(ill);
824 
825 	/*
826 	 * Send the detach if there's one to send (i.e., if we're above a
827 	 * style 2 DLPI driver).
828 	 */
829 	if (ill->ill_detach_mp != NULL) {
830 		ill_dlpi_send(ill, ill->ill_detach_mp);
831 		ill->ill_detach_mp = NULL;
832 	}
833 
834 	if (ill->ill_net_type != IRE_LOOPBACK)
835 		qprocsoff(ill->ill_rq);
836 
837 	/*
838 	 * We do an ipsq_flush once again now. New messages could have
839 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
840 	 * could also have landed up if an ioctl thread had looked up
841 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
842 	 * enqueued the ioctl when we did the ipsq_flush last time.
843 	 */
844 	ipsq_flush(ill);
845 
846 	/*
847 	 * Free capabilities.
848 	 */
849 	if (ill->ill_ipsec_capab_ah != NULL) {
850 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_AH);
851 		ill_ipsec_capab_free(ill->ill_ipsec_capab_ah);
852 		ill->ill_ipsec_capab_ah = NULL;
853 	}
854 
855 	if (ill->ill_ipsec_capab_esp != NULL) {
856 		ill_ipsec_capab_delete(ill, DL_CAPAB_IPSEC_ESP);
857 		ill_ipsec_capab_free(ill->ill_ipsec_capab_esp);
858 		ill->ill_ipsec_capab_esp = NULL;
859 	}
860 
861 	if (ill->ill_mdt_capab != NULL) {
862 		kmem_free(ill->ill_mdt_capab, sizeof (ill_mdt_capab_t));
863 		ill->ill_mdt_capab = NULL;
864 	}
865 
866 	if (ill->ill_hcksum_capab != NULL) {
867 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
868 		ill->ill_hcksum_capab = NULL;
869 	}
870 
871 	if (ill->ill_zerocopy_capab != NULL) {
872 		kmem_free(ill->ill_zerocopy_capab,
873 		    sizeof (ill_zerocopy_capab_t));
874 		ill->ill_zerocopy_capab = NULL;
875 	}
876 
877 	if (ill->ill_dls_capab != NULL) {
878 		CONN_DEC_REF(ill->ill_dls_capab->ill_unbind_conn);
879 		ill->ill_dls_capab->ill_unbind_conn = NULL;
880 		kmem_free(ill->ill_dls_capab,
881 		    sizeof (ill_dls_capab_t) +
882 		    (sizeof (ill_rx_ring_t) * ILL_MAX_RINGS));
883 		ill->ill_dls_capab = NULL;
884 	}
885 
886 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_POLL));
887 
888 	while (ill->ill_ipif != NULL)
889 		ipif_free_tail(ill->ill_ipif);
890 
891 	ill_down_tail(ill);
892 
893 	/*
894 	 * We have removed all references to ilm from conn and the ones joined
895 	 * within the kernel.
896 	 *
897 	 * We don't walk conns, mrts and ires because
898 	 *
899 	 * 1) reset_conn_ill and reset_mrt_ill cleans up conns and mrts.
900 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
901 	 *    ill references.
902 	 */
903 	ASSERT(ilm_walk_ill(ill) == 0);
904 	/*
905 	 * Take us out of the list of ILLs. ill_glist_delete -> ill_phyint_free
906 	 * could free the phyint. No more reference to the phyint after this
907 	 * point.
908 	 */
909 	(void) ill_glist_delete(ill);
910 
911 	rw_enter(&ip_g_nd_lock, RW_WRITER);
912 	if (ill->ill_ndd_name != NULL)
913 		nd_unload(&ip_g_nd, ill->ill_ndd_name);
914 	rw_exit(&ip_g_nd_lock);
915 
916 
917 	if (ill->ill_frag_ptr != NULL) {
918 		uint_t count;
919 
920 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
921 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
922 		}
923 		mi_free(ill->ill_frag_ptr);
924 		ill->ill_frag_ptr = NULL;
925 		ill->ill_frag_hash_tbl = NULL;
926 	}
927 	if (ill->ill_nd_lla_mp != NULL)
928 		freemsg(ill->ill_nd_lla_mp);
929 	/* Free all retained control messages. */
930 	mpp = &ill->ill_first_mp_to_free;
931 	do {
932 		while (mpp[0]) {
933 			mblk_t  *mp;
934 			mblk_t  *mp1;
935 
936 			mp = mpp[0];
937 			mpp[0] = mp->b_next;
938 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
939 				mp1->b_next = NULL;
940 				mp1->b_prev = NULL;
941 			}
942 			freemsg(mp);
943 		}
944 	} while (mpp++ != &ill->ill_last_mp_to_free);
945 
946 	ill_free_mib(ill);
947 	ILL_TRACE_CLEANUP(ill);
948 }
949 
950 static void
951 ill_free_mib(ill_t *ill)
952 {
953 	if (ill->ill_ip6_mib != NULL) {
954 		kmem_free(ill->ill_ip6_mib, sizeof (*ill->ill_ip6_mib));
955 		ill->ill_ip6_mib = NULL;
956 	}
957 	if (ill->ill_icmp6_mib != NULL) {
958 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
959 		ill->ill_icmp6_mib = NULL;
960 	}
961 }
962 
963 /*
964  * Concatenate together a physical address and a sap.
965  *
966  * Sap_lengths are interpreted as follows:
967  *   sap_length == 0	==>	no sap
968  *   sap_length > 0	==>	sap is at the head of the dlpi address
969  *   sap_length < 0	==>	sap is at the tail of the dlpi address
970  */
971 static void
972 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
973     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
974 {
975 	uint16_t sap_addr = (uint16_t)sap_src;
976 
977 	if (sap_length == 0) {
978 		if (phys_src == NULL)
979 			bzero(dst, phys_length);
980 		else
981 			bcopy(phys_src, dst, phys_length);
982 	} else if (sap_length < 0) {
983 		if (phys_src == NULL)
984 			bzero(dst, phys_length);
985 		else
986 			bcopy(phys_src, dst, phys_length);
987 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
988 	} else {
989 		bcopy(&sap_addr, dst, sizeof (sap_addr));
990 		if (phys_src == NULL)
991 			bzero((char *)dst + sap_length, phys_length);
992 		else
993 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
994 	}
995 }
996 
997 /*
998  * Generate a dl_unitdata_req mblk for the device and address given.
999  * addr_length is the length of the physical portion of the address.
1000  * If addr is NULL include an all zero address of the specified length.
1001  * TRUE? In any case, addr_length is taken to be the entire length of the
1002  * dlpi address, including the absolute value of sap_length.
1003  */
1004 mblk_t *
1005 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
1006 		t_scalar_t sap_length)
1007 {
1008 	dl_unitdata_req_t *dlur;
1009 	mblk_t	*mp;
1010 	t_scalar_t	abs_sap_length;		/* absolute value */
1011 
1012 	abs_sap_length = ABS(sap_length);
1013 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
1014 		DL_UNITDATA_REQ);
1015 	if (mp == NULL)
1016 		return (NULL);
1017 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
1018 	/* HACK: accomodate incompatible DLPI drivers */
1019 	if (addr_length == 8)
1020 		addr_length = 6;
1021 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
1022 	dlur->dl_dest_addr_offset = sizeof (*dlur);
1023 	dlur->dl_priority.dl_min = 0;
1024 	dlur->dl_priority.dl_max = 0;
1025 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
1026 	    (uchar_t *)&dlur[1]);
1027 	return (mp);
1028 }
1029 
1030 /*
1031  * Add the 'mp' to the list of pending mp's headed by ill_pending_mp
1032  * Return an error if we already have 1 or more ioctls in progress.
1033  * This is used only for non-exclusive ioctls. Currently this is used
1034  * for SIOC*ARP and SIOCGTUNPARAM ioctls. Most set ioctls are exclusive
1035  * and thus need to use ipsq_pending_mp_add.
1036  */
1037 boolean_t
1038 ill_pending_mp_add(ill_t *ill, conn_t *connp, mblk_t *add_mp)
1039 {
1040 	ASSERT(MUTEX_HELD(&ill->ill_lock));
1041 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1042 	/*
1043 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls.
1044 	 */
1045 	ASSERT((add_mp->b_datap->db_type == M_IOCDATA) ||
1046 	    (add_mp->b_datap->db_type == M_IOCTL));
1047 
1048 	ASSERT(MUTEX_HELD(&connp->conn_lock));
1049 	/*
1050 	 * Return error if the conn has started closing. The conn
1051 	 * could have finished cleaning up the pending mp list,
1052 	 * If so we should not add another mp to the list negating
1053 	 * the cleanup.
1054 	 */
1055 	if (connp->conn_state_flags & CONN_CLOSING)
1056 		return (B_FALSE);
1057 	/*
1058 	 * Add the pending mp to the head of the list, chained by b_next.
1059 	 * Note down the conn on which the ioctl request came, in b_prev.
1060 	 * This will be used to later get the conn, when we get a response
1061 	 * on the ill queue, from some other module (typically arp)
1062 	 */
1063 	add_mp->b_next = (void *)ill->ill_pending_mp;
1064 	add_mp->b_queue = CONNP_TO_WQ(connp);
1065 	ill->ill_pending_mp = add_mp;
1066 	if (connp != NULL)
1067 		connp->conn_oper_pending_ill = ill;
1068 	return (B_TRUE);
1069 }
1070 
1071 /*
1072  * Retrieve the ill_pending_mp and return it. We have to walk the list
1073  * of mblks starting at ill_pending_mp, and match based on the ioc_id.
1074  */
1075 mblk_t *
1076 ill_pending_mp_get(ill_t *ill, conn_t **connpp, uint_t ioc_id)
1077 {
1078 	mblk_t	*prev = NULL;
1079 	mblk_t	*curr = NULL;
1080 	uint_t	id;
1081 	conn_t	*connp;
1082 
1083 	/*
1084 	 * When the conn closes, conn_ioctl_cleanup needs to clean
1085 	 * up the pending mp, but it does not know the ioc_id and
1086 	 * passes in a zero for it.
1087 	 */
1088 	mutex_enter(&ill->ill_lock);
1089 	if (ioc_id != 0)
1090 		*connpp = NULL;
1091 
1092 	/* Search the list for the appropriate ioctl based on ioc_id */
1093 	for (prev = NULL, curr = ill->ill_pending_mp; curr != NULL;
1094 	    prev = curr, curr = curr->b_next) {
1095 		id = ((struct iocblk *)curr->b_rptr)->ioc_id;
1096 		connp = Q_TO_CONN(curr->b_queue);
1097 		/* Match based on the ioc_id or based on the conn */
1098 		if ((id == ioc_id) || (ioc_id == 0 && connp == *connpp))
1099 			break;
1100 	}
1101 
1102 	if (curr != NULL) {
1103 		/* Unlink the mblk from the pending mp list */
1104 		if (prev != NULL) {
1105 			prev->b_next = curr->b_next;
1106 		} else {
1107 			ASSERT(ill->ill_pending_mp == curr);
1108 			ill->ill_pending_mp = curr->b_next;
1109 		}
1110 
1111 		/*
1112 		 * conn refcnt must have been bumped up at the start of
1113 		 * the ioctl. So we can safely access the conn.
1114 		 */
1115 		ASSERT(CONN_Q(curr->b_queue));
1116 		*connpp = Q_TO_CONN(curr->b_queue);
1117 		curr->b_next = NULL;
1118 		curr->b_queue = NULL;
1119 	}
1120 
1121 	mutex_exit(&ill->ill_lock);
1122 
1123 	return (curr);
1124 }
1125 
1126 /*
1127  * Add the pending mp to the list. There can be only 1 pending mp
1128  * in the list. Any exclusive ioctl that needs to wait for a response
1129  * from another module or driver needs to use this function to set
1130  * the ipsq_pending_mp to the ioctl mblk and wait for the response from
1131  * the other module/driver. This is also used while waiting for the
1132  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
1133  */
1134 boolean_t
1135 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
1136     int waitfor)
1137 {
1138 	ipsq_t	*ipsq;
1139 
1140 	ASSERT(IAM_WRITER_IPIF(ipif));
1141 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
1142 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
1143 	/*
1144 	 * M_IOCDATA from ioctls, M_IOCTL from tunnel ioctls,
1145 	 * M_ERROR/M_HANGUP from driver
1146 	 */
1147 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_IOCTL) ||
1148 	    (DB_TYPE(add_mp) == M_ERROR) || (DB_TYPE(add_mp) == M_HANGUP));
1149 
1150 	ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
1151 	if (connp != NULL) {
1152 		ASSERT(MUTEX_HELD(&connp->conn_lock));
1153 		/*
1154 		 * Return error if the conn has started closing. The conn
1155 		 * could have finished cleaning up the pending mp list,
1156 		 * If so we should not add another mp to the list negating
1157 		 * the cleanup.
1158 		 */
1159 		if (connp->conn_state_flags & CONN_CLOSING)
1160 			return (B_FALSE);
1161 	}
1162 	mutex_enter(&ipsq->ipsq_lock);
1163 	ipsq->ipsq_pending_ipif = ipif;
1164 	/*
1165 	 * Note down the queue in b_queue. This will be returned by
1166 	 * ipsq_pending_mp_get. Caller will then use these values to restart
1167 	 * the processing
1168 	 */
1169 	add_mp->b_next = NULL;
1170 	add_mp->b_queue = q;
1171 	ipsq->ipsq_pending_mp = add_mp;
1172 	ipsq->ipsq_waitfor = waitfor;
1173 	/*
1174 	 * ipsq_current_ipif is needed to restart the operation from
1175 	 * ipif_ill_refrele_tail when the last reference to the ipi/ill
1176 	 * is gone. Since this is not an ioctl ipsq_current_ipif has not
1177 	 * been set until now.
1178 	 */
1179 	if (DB_TYPE(add_mp) == M_ERROR || DB_TYPE(add_mp) == M_HANGUP) {
1180 		ASSERT(ipsq->ipsq_current_ipif == NULL);
1181 		ipsq->ipsq_current_ipif = ipif;
1182 		ipsq->ipsq_last_cmd = DB_TYPE(add_mp);
1183 	}
1184 	if (connp != NULL)
1185 		connp->conn_oper_pending_ill = ipif->ipif_ill;
1186 	mutex_exit(&ipsq->ipsq_lock);
1187 	return (B_TRUE);
1188 }
1189 
1190 /*
1191  * Retrieve the ipsq_pending_mp and return it. There can be only 1 mp
1192  * queued in the list.
1193  */
1194 mblk_t *
1195 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
1196 {
1197 	mblk_t	*curr = NULL;
1198 
1199 	mutex_enter(&ipsq->ipsq_lock);
1200 	*connpp = NULL;
1201 	if (ipsq->ipsq_pending_mp == NULL) {
1202 		mutex_exit(&ipsq->ipsq_lock);
1203 		return (NULL);
1204 	}
1205 
1206 	/* There can be only 1 such excl message */
1207 	curr = ipsq->ipsq_pending_mp;
1208 	ASSERT(curr != NULL && curr->b_next == NULL);
1209 	ipsq->ipsq_pending_ipif = NULL;
1210 	ipsq->ipsq_pending_mp = NULL;
1211 	ipsq->ipsq_waitfor = 0;
1212 	mutex_exit(&ipsq->ipsq_lock);
1213 
1214 	if (CONN_Q(curr->b_queue)) {
1215 		/*
1216 		 * This mp did a refhold on the conn, at the start of the ioctl.
1217 		 * So we can safely return a pointer to the conn to the caller.
1218 		 */
1219 		*connpp = Q_TO_CONN(curr->b_queue);
1220 	} else {
1221 		*connpp = NULL;
1222 	}
1223 	curr->b_next = NULL;
1224 	curr->b_prev = NULL;
1225 	return (curr);
1226 }
1227 
1228 /*
1229  * Cleanup the ioctl mp queued in ipsq_pending_mp
1230  * - Called in the ill_delete path
1231  * - Called in the M_ERROR or M_HANGUP path on the ill.
1232  * - Called in the conn close path.
1233  */
1234 boolean_t
1235 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
1236 {
1237 	mblk_t	*mp;
1238 	ipsq_t	*ipsq;
1239 	queue_t	*q;
1240 	ipif_t	*ipif;
1241 
1242 	ASSERT(IAM_WRITER_ILL(ill));
1243 	ipsq = ill->ill_phyint->phyint_ipsq;
1244 	mutex_enter(&ipsq->ipsq_lock);
1245 	/*
1246 	 * If connp is null, unconditionally clean up the ipsq_pending_mp.
1247 	 * This happens in M_ERROR/M_HANGUP. We need to abort the current ioctl
1248 	 * even if it is meant for another ill, since we have to enqueue
1249 	 * a new mp now in ipsq_pending_mp to complete the ipif_down.
1250 	 * If connp is non-null we are called from the conn close path.
1251 	 */
1252 	mp = ipsq->ipsq_pending_mp;
1253 	if (mp == NULL || (connp != NULL &&
1254 	    mp->b_queue != CONNP_TO_WQ(connp))) {
1255 		mutex_exit(&ipsq->ipsq_lock);
1256 		return (B_FALSE);
1257 	}
1258 	/* Now remove from the ipsq_pending_mp */
1259 	ipsq->ipsq_pending_mp = NULL;
1260 	q = mp->b_queue;
1261 	mp->b_next = NULL;
1262 	mp->b_prev = NULL;
1263 	mp->b_queue = NULL;
1264 
1265 	/* If MOVE was in progress, clear the move_in_progress fields also. */
1266 	ill = ipsq->ipsq_pending_ipif->ipif_ill;
1267 	if (ill->ill_move_in_progress) {
1268 		ILL_CLEAR_MOVE(ill);
1269 	} else if (ill->ill_up_ipifs) {
1270 		ill_group_cleanup(ill);
1271 	}
1272 
1273 	ipif = ipsq->ipsq_pending_ipif;
1274 	ipsq->ipsq_pending_ipif = NULL;
1275 	ipsq->ipsq_waitfor = 0;
1276 	ipsq->ipsq_current_ipif = NULL;
1277 	mutex_exit(&ipsq->ipsq_lock);
1278 
1279 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
1280 		ip_ioctl_finish(q, mp, ENXIO, connp != NULL ? CONN_CLOSE :
1281 		    NO_COPYOUT, connp != NULL ? ipif : NULL, NULL);
1282 	} else {
1283 		/*
1284 		 * IP-MT XXX In the case of TLI/XTI bind / optmgmt this can't
1285 		 * be just inet_freemsg. we have to restart it
1286 		 * otherwise the thread will be stuck.
1287 		 */
1288 		inet_freemsg(mp);
1289 	}
1290 	return (B_TRUE);
1291 }
1292 
1293 /*
1294  * The ill is closing. Cleanup all the pending mps. Called exclusively
1295  * towards the end of ill_delete. The refcount has gone to 0. So nobody
1296  * knows this ill, and hence nobody can add an mp to this list
1297  */
1298 static void
1299 ill_pending_mp_cleanup(ill_t *ill)
1300 {
1301 	mblk_t	*mp;
1302 	queue_t	*q;
1303 
1304 	ASSERT(IAM_WRITER_ILL(ill));
1305 
1306 	mutex_enter(&ill->ill_lock);
1307 	/*
1308 	 * Every mp on the pending mp list originating from an ioctl
1309 	 * added 1 to the conn refcnt, at the start of the ioctl.
1310 	 * So bump it down now.  See comments in ip_wput_nondata()
1311 	 */
1312 	while (ill->ill_pending_mp != NULL) {
1313 		mp = ill->ill_pending_mp;
1314 		ill->ill_pending_mp = mp->b_next;
1315 		mutex_exit(&ill->ill_lock);
1316 
1317 		q = mp->b_queue;
1318 		ASSERT(CONN_Q(q));
1319 		mp->b_next = NULL;
1320 		mp->b_prev = NULL;
1321 		mp->b_queue = NULL;
1322 		ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL, NULL);
1323 		mutex_enter(&ill->ill_lock);
1324 	}
1325 	ill->ill_pending_ipif = NULL;
1326 
1327 	mutex_exit(&ill->ill_lock);
1328 }
1329 
1330 /*
1331  * Called in the conn close path and ill delete path
1332  */
1333 static void
1334 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
1335 {
1336 	ipsq_t	*ipsq;
1337 	mblk_t	*prev;
1338 	mblk_t	*curr;
1339 	mblk_t	*next;
1340 	queue_t	*q;
1341 	mblk_t	*tmp_list = NULL;
1342 
1343 	ASSERT(IAM_WRITER_ILL(ill));
1344 	if (connp != NULL)
1345 		q = CONNP_TO_WQ(connp);
1346 	else
1347 		q = ill->ill_wq;
1348 
1349 	ipsq = ill->ill_phyint->phyint_ipsq;
1350 	/*
1351 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
1352 	 * In the case of ioctl from a conn, there can be only 1 mp
1353 	 * queued on the ipsq. If an ill is being unplumbed, only messages
1354 	 * related to this ill are flushed, like M_ERROR or M_HANGUP message.
1355 	 * ioctls meant for this ill form conn's are not flushed. They will
1356 	 * be processed during ipsq_exit and will not find the ill and will
1357 	 * return error.
1358 	 */
1359 	mutex_enter(&ipsq->ipsq_lock);
1360 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
1361 	    curr = next) {
1362 		next = curr->b_next;
1363 		if (curr->b_queue == q || curr->b_queue == RD(q)) {
1364 			/* Unlink the mblk from the pending mp list */
1365 			if (prev != NULL) {
1366 				prev->b_next = curr->b_next;
1367 			} else {
1368 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
1369 				ipsq->ipsq_xopq_mphead = curr->b_next;
1370 			}
1371 			if (ipsq->ipsq_xopq_mptail == curr)
1372 				ipsq->ipsq_xopq_mptail = prev;
1373 			/*
1374 			 * Create a temporary list and release the ipsq lock
1375 			 * New elements are added to the head of the tmp_list
1376 			 */
1377 			curr->b_next = tmp_list;
1378 			tmp_list = curr;
1379 		} else {
1380 			prev = curr;
1381 		}
1382 	}
1383 	mutex_exit(&ipsq->ipsq_lock);
1384 
1385 	while (tmp_list != NULL) {
1386 		curr = tmp_list;
1387 		tmp_list = curr->b_next;
1388 		curr->b_next = NULL;
1389 		curr->b_prev = NULL;
1390 		curr->b_queue = NULL;
1391 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1392 			ip_ioctl_finish(q, curr, ENXIO, connp != NULL ?
1393 			    CONN_CLOSE : NO_COPYOUT, NULL, NULL);
1394 		} else {
1395 			/*
1396 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1397 			 * this can't be just inet_freemsg. we have to
1398 			 * restart it otherwise the thread will be stuck.
1399 			 */
1400 			inet_freemsg(curr);
1401 		}
1402 	}
1403 }
1404 
1405 /*
1406  * This conn has started closing. Cleanup any pending ioctl from this conn.
1407  * STREAMS ensures that there can be at most 1 ioctl pending on a stream.
1408  */
1409 void
1410 conn_ioctl_cleanup(conn_t *connp)
1411 {
1412 	mblk_t *curr;
1413 	ipsq_t	*ipsq;
1414 	ill_t	*ill;
1415 	boolean_t refheld;
1416 
1417 	/*
1418 	 * Is any exclusive ioctl pending ? If so clean it up. If the
1419 	 * ioctl has not yet started, the mp is pending in the list headed by
1420 	 * ipsq_xopq_head. If the ioctl has started the mp could be present in
1421 	 * ipsq_pending_mp. If the ioctl timed out in the streamhead but
1422 	 * is currently executing now the mp is not queued anywhere but
1423 	 * conn_oper_pending_ill is null. The conn close will wait
1424 	 * till the conn_ref drops to zero.
1425 	 */
1426 	mutex_enter(&connp->conn_lock);
1427 	ill = connp->conn_oper_pending_ill;
1428 	if (ill == NULL) {
1429 		mutex_exit(&connp->conn_lock);
1430 		return;
1431 	}
1432 
1433 	curr = ill_pending_mp_get(ill, &connp, 0);
1434 	if (curr != NULL) {
1435 		mutex_exit(&connp->conn_lock);
1436 		CONN_DEC_REF(connp);
1437 		inet_freemsg(curr);
1438 		return;
1439 	}
1440 	/*
1441 	 * We may not be able to refhold the ill if the ill/ipif
1442 	 * is changing. But we need to make sure that the ill will
1443 	 * not vanish. So we just bump up the ill_waiter count.
1444 	 */
1445 	refheld = ill_waiter_inc(ill);
1446 	mutex_exit(&connp->conn_lock);
1447 	if (refheld) {
1448 		if (ipsq_enter(ill, B_TRUE)) {
1449 			ill_waiter_dcr(ill);
1450 			/*
1451 			 * Check whether this ioctl has started and is
1452 			 * pending now in ipsq_pending_mp. If it is not
1453 			 * found there then check whether this ioctl has
1454 			 * not even started and is in the ipsq_xopq list.
1455 			 */
1456 			if (!ipsq_pending_mp_cleanup(ill, connp))
1457 				ipsq_xopq_mp_cleanup(ill, connp);
1458 			ipsq = ill->ill_phyint->phyint_ipsq;
1459 			ipsq_exit(ipsq, B_TRUE, B_TRUE);
1460 			return;
1461 		}
1462 	}
1463 
1464 	/*
1465 	 * The ill is also closing and we could not bump up the
1466 	 * ill_waiter_count or we could not enter the ipsq. Leave
1467 	 * the cleanup to ill_delete
1468 	 */
1469 	mutex_enter(&connp->conn_lock);
1470 	while (connp->conn_oper_pending_ill != NULL)
1471 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1472 	mutex_exit(&connp->conn_lock);
1473 	if (refheld)
1474 		ill_waiter_dcr(ill);
1475 }
1476 
1477 /*
1478  * ipcl_walk function for cleaning up conn_*_ill fields.
1479  */
1480 static void
1481 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1482 {
1483 	ill_t	*ill = (ill_t *)arg;
1484 	ire_t	*ire;
1485 
1486 	mutex_enter(&connp->conn_lock);
1487 	if (connp->conn_multicast_ill == ill) {
1488 		/* Revert to late binding */
1489 		connp->conn_multicast_ill = NULL;
1490 		connp->conn_orig_multicast_ifindex = 0;
1491 	}
1492 	if (connp->conn_incoming_ill == ill)
1493 		connp->conn_incoming_ill = NULL;
1494 	if (connp->conn_outgoing_ill == ill)
1495 		connp->conn_outgoing_ill = NULL;
1496 	if (connp->conn_outgoing_pill == ill)
1497 		connp->conn_outgoing_pill = NULL;
1498 	if (connp->conn_nofailover_ill == ill)
1499 		connp->conn_nofailover_ill = NULL;
1500 	if (connp->conn_xmit_if_ill == ill)
1501 		connp->conn_xmit_if_ill = NULL;
1502 	if (connp->conn_ire_cache != NULL) {
1503 		ire = connp->conn_ire_cache;
1504 		/*
1505 		 * ip_newroute creates IRE_CACHE with ire_stq coming from
1506 		 * interface X and ipif coming from interface Y, if interface
1507 		 * X and Y are part of the same IPMPgroup. Thus whenever
1508 		 * interface X goes down, remove all references to it by
1509 		 * checking both on ire_ipif and ire_stq.
1510 		 */
1511 		if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1512 		    (ire->ire_type == IRE_CACHE &&
1513 		    ire->ire_stq == ill->ill_wq)) {
1514 			connp->conn_ire_cache = NULL;
1515 			mutex_exit(&connp->conn_lock);
1516 			ire_refrele_notr(ire);
1517 			return;
1518 		}
1519 	}
1520 	mutex_exit(&connp->conn_lock);
1521 
1522 }
1523 
1524 /* ARGSUSED */
1525 void
1526 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1527 {
1528 	ill_t	*ill = q->q_ptr;
1529 	ipif_t	*ipif;
1530 
1531 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1532 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1533 		ipif_non_duplicate(ipif);
1534 		ipif_down_tail(ipif);
1535 	}
1536 	ill_down_tail(ill);
1537 	freemsg(mp);
1538 	ipsq->ipsq_current_ipif = NULL;
1539 }
1540 
1541 /*
1542  * ill_down_start is called when we want to down this ill and bring it up again
1543  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1544  * all interfaces, but don't tear down any plumbing.
1545  */
1546 boolean_t
1547 ill_down_start(queue_t *q, mblk_t *mp)
1548 {
1549 	ill_t	*ill;
1550 	ipif_t	*ipif;
1551 
1552 	ill = q->q_ptr;
1553 
1554 	ASSERT(IAM_WRITER_ILL(ill));
1555 
1556 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1557 		(void) ipif_down(ipif, NULL, NULL);
1558 
1559 	ill_down(ill);
1560 
1561 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1562 	mutex_enter(&ill->ill_lock);
1563 	/*
1564 	 * Atomically test and add the pending mp if references are
1565 	 * still active.
1566 	 */
1567 	if (!ill_is_quiescent(ill)) {
1568 		/*
1569 		 * Get rid of any pending mps and cleanup. Call will
1570 		 * not fail since we are passing a null connp.
1571 		 */
1572 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1573 		    mp, ILL_DOWN);
1574 		mutex_exit(&ill->ill_lock);
1575 		return (B_FALSE);
1576 	}
1577 	mutex_exit(&ill->ill_lock);
1578 	return (B_TRUE);
1579 }
1580 
1581 static void
1582 ill_down(ill_t *ill)
1583 {
1584 	/* Blow off any IREs dependent on this ILL. */
1585 	ire_walk(ill_downi, (char *)ill);
1586 
1587 	mutex_enter(&ire_mrtun_lock);
1588 	if (ire_mrtun_count != 0) {
1589 		mutex_exit(&ire_mrtun_lock);
1590 		ire_walk_ill_mrtun(0, 0, ill_downi_mrtun_srcif,
1591 		    (char *)ill, NULL);
1592 	} else {
1593 		mutex_exit(&ire_mrtun_lock);
1594 	}
1595 
1596 	/*
1597 	 * If any interface based forwarding table exists
1598 	 * Blow off the ires there dependent on this ill
1599 	 */
1600 	mutex_enter(&ire_srcif_table_lock);
1601 	if (ire_srcif_table_count > 0) {
1602 		mutex_exit(&ire_srcif_table_lock);
1603 		ire_walk_srcif_table_v4(ill_downi_mrtun_srcif, (char *)ill);
1604 	} else {
1605 		mutex_exit(&ire_srcif_table_lock);
1606 	}
1607 
1608 	/* Remove any conn_*_ill depending on this ill */
1609 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill);
1610 
1611 	if (ill->ill_group != NULL) {
1612 		illgrp_delete(ill);
1613 	}
1614 
1615 }
1616 
1617 static void
1618 ill_down_tail(ill_t *ill)
1619 {
1620 	int	i;
1621 
1622 	/* Destroy ill_srcif_table if it exists */
1623 	/* Lock not reqd really because nobody should be able to access */
1624 	mutex_enter(&ill->ill_lock);
1625 	if (ill->ill_srcif_table != NULL) {
1626 		ill->ill_srcif_refcnt = 0;
1627 		for (i = 0; i < IP_SRCIF_TABLE_SIZE; i++) {
1628 			rw_destroy(&ill->ill_srcif_table[i].irb_lock);
1629 		}
1630 		kmem_free(ill->ill_srcif_table,
1631 		    IP_SRCIF_TABLE_SIZE * sizeof (irb_t));
1632 		ill->ill_srcif_table = NULL;
1633 		ill->ill_srcif_refcnt = 0;
1634 		ill->ill_mrtun_refcnt = 0;
1635 	}
1636 	mutex_exit(&ill->ill_lock);
1637 }
1638 
1639 /*
1640  * ire_walk routine used to delete every IRE that depends on queues
1641  * associated with 'ill'.  (Always called as writer.)
1642  */
1643 static void
1644 ill_downi(ire_t *ire, char *ill_arg)
1645 {
1646 	ill_t	*ill = (ill_t *)ill_arg;
1647 
1648 	/*
1649 	 * ip_newroute creates IRE_CACHE with ire_stq coming from
1650 	 * interface X and ipif coming from interface Y, if interface
1651 	 * X and Y are part of the same IPMP group. Thus whenever interface
1652 	 * X goes down, remove all references to it by checking both
1653 	 * on ire_ipif and ire_stq.
1654 	 */
1655 	if ((ire->ire_ipif != NULL && ire->ire_ipif->ipif_ill == ill) ||
1656 	    (ire->ire_type == IRE_CACHE && ire->ire_stq == ill->ill_wq)) {
1657 		ire_delete(ire);
1658 	}
1659 }
1660 
1661 /*
1662  * A seperate routine for deleting revtun and srcif based routes
1663  * are needed because the ires only deleted when the interface
1664  * is unplumbed. Also these ires have ire_in_ill non-null as well.
1665  * we want to keep mobile IP specific code separate.
1666  */
1667 static void
1668 ill_downi_mrtun_srcif(ire_t *ire, char *ill_arg)
1669 {
1670 	ill_t   *ill = (ill_t *)ill_arg;
1671 
1672 	ASSERT(ire->ire_in_ill != NULL);
1673 
1674 	if ((ire->ire_in_ill != NULL && ire->ire_in_ill == ill) ||
1675 	    (ire->ire_stq == ill->ill_wq) || (ire->ire_stq == ill->ill_rq)) {
1676 		ire_delete(ire);
1677 	}
1678 }
1679 
1680 /*
1681  * Remove ire/nce from the fastpath list.
1682  */
1683 void
1684 ill_fastpath_nack(ill_t *ill)
1685 {
1686 	if (ill->ill_isv6) {
1687 		nce_fastpath_list_dispatch(ill, NULL, NULL);
1688 	} else {
1689 		ire_fastpath_list_dispatch(ill, NULL, NULL);
1690 	}
1691 }
1692 
1693 /* Consume an M_IOCACK of the fastpath probe. */
1694 void
1695 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1696 {
1697 	mblk_t	*mp1 = mp;
1698 
1699 	/*
1700 	 * If this was the first attempt turn on the fastpath probing.
1701 	 */
1702 	mutex_enter(&ill->ill_lock);
1703 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1704 		ill->ill_dlpi_fastpath_state = IDS_OK;
1705 	mutex_exit(&ill->ill_lock);
1706 
1707 	/* Free the M_IOCACK mblk, hold on to the data */
1708 	mp = mp->b_cont;
1709 	freeb(mp1);
1710 	if (mp == NULL)
1711 		return;
1712 	if (mp->b_cont != NULL) {
1713 		/*
1714 		 * Update all IRE's or NCE's that are waiting for
1715 		 * fastpath update.
1716 		 */
1717 		if (ill->ill_isv6) {
1718 			/*
1719 			 * update nce's in the fastpath list.
1720 			 */
1721 			nce_fastpath_list_dispatch(ill,
1722 			    ndp_fastpath_update, mp);
1723 		} else {
1724 
1725 			/*
1726 			 * update ire's in the fastpath list.
1727 			 */
1728 			ire_fastpath_list_dispatch(ill,
1729 			    ire_fastpath_update, mp);
1730 			/*
1731 			 * Check if we need to traverse reverse tunnel table.
1732 			 * Since there is only single ire_type (IRE_MIPRTUN)
1733 			 * in the table, we don't need to match on ire_type.
1734 			 * We have to check ire_mrtun_count and not the
1735 			 * ill_mrtun_refcnt since ill_mrtun_refcnt is set
1736 			 * on the incoming ill and here we are dealing with
1737 			 * outgoing ill.
1738 			 */
1739 			mutex_enter(&ire_mrtun_lock);
1740 			if (ire_mrtun_count != 0) {
1741 				mutex_exit(&ire_mrtun_lock);
1742 				ire_walk_ill_mrtun(MATCH_IRE_WQ, IRE_MIPRTUN,
1743 				    (void (*)(ire_t *, void *))
1744 					ire_fastpath_update, mp, ill);
1745 			} else {
1746 				mutex_exit(&ire_mrtun_lock);
1747 			}
1748 		}
1749 		mp1 = mp->b_cont;
1750 		freeb(mp);
1751 		mp = mp1;
1752 	} else {
1753 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1754 	}
1755 
1756 	freeb(mp);
1757 }
1758 
1759 /*
1760  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1761  * The data portion of the request is a dl_unitdata_req_t template for
1762  * what we would send downstream in the absence of a fastpath confirmation.
1763  */
1764 int
1765 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1766 {
1767 	struct iocblk	*ioc;
1768 	mblk_t	*mp;
1769 
1770 	if (dlur_mp == NULL)
1771 		return (EINVAL);
1772 
1773 	mutex_enter(&ill->ill_lock);
1774 	switch (ill->ill_dlpi_fastpath_state) {
1775 	case IDS_FAILED:
1776 		/*
1777 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1778 		 * support it.
1779 		 */
1780 		mutex_exit(&ill->ill_lock);
1781 		return (ENOTSUP);
1782 	case IDS_UNKNOWN:
1783 		/* This is the first probe */
1784 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1785 		break;
1786 	default:
1787 		break;
1788 	}
1789 	mutex_exit(&ill->ill_lock);
1790 
1791 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1792 		return (EAGAIN);
1793 
1794 	mp->b_cont = copyb(dlur_mp);
1795 	if (mp->b_cont == NULL) {
1796 		freeb(mp);
1797 		return (EAGAIN);
1798 	}
1799 
1800 	ioc = (struct iocblk *)mp->b_rptr;
1801 	ioc->ioc_count = msgdsize(mp->b_cont);
1802 
1803 	putnext(ill->ill_wq, mp);
1804 	return (0);
1805 }
1806 
1807 void
1808 ill_capability_probe(ill_t *ill)
1809 {
1810 	/*
1811 	 * Do so only if negotiation is enabled, capabilities are unknown,
1812 	 * and a capability negotiation is not already in progress.
1813 	 */
1814 	if (ill->ill_dlpi_capab_state != IDS_UNKNOWN &&
1815 	    ill->ill_dlpi_capab_state != IDS_RENEG)
1816 		return;
1817 
1818 	ill->ill_dlpi_capab_state = IDS_INPROGRESS;
1819 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1820 	ill_capability_proto(ill, DL_CAPABILITY_REQ, NULL);
1821 }
1822 
1823 void
1824 ill_capability_reset(ill_t *ill)
1825 {
1826 	mblk_t *sc_mp = NULL;
1827 	mblk_t *tmp;
1828 
1829 	/*
1830 	 * Note here that we reset the state to UNKNOWN, and later send
1831 	 * down the DL_CAPABILITY_REQ without first setting the state to
1832 	 * INPROGRESS.  We do this in order to distinguish the
1833 	 * DL_CAPABILITY_ACK response which may come back in response to
1834 	 * a "reset" apart from the "probe" DL_CAPABILITY_REQ.  This would
1835 	 * also handle the case where the driver doesn't send us back
1836 	 * a DL_CAPABILITY_ACK in response, since the "probe" routine
1837 	 * requires the state to be in UNKNOWN anyway.  In any case, all
1838 	 * features are turned off until the state reaches IDS_OK.
1839 	 */
1840 	ill->ill_dlpi_capab_state = IDS_UNKNOWN;
1841 
1842 	/*
1843 	 * Disable sub-capabilities and request a list of sub-capability
1844 	 * messages which will be sent down to the driver.  Each handler
1845 	 * allocates the corresponding dl_capability_sub_t inside an
1846 	 * mblk, and links it to the existing sc_mp mblk, or return it
1847 	 * as sc_mp if it's the first sub-capability (the passed in
1848 	 * sc_mp is NULL).  Upon returning from all capability handlers,
1849 	 * sc_mp will be pulled-up, before passing it downstream.
1850 	 */
1851 	ill_capability_mdt_reset(ill, &sc_mp);
1852 	ill_capability_hcksum_reset(ill, &sc_mp);
1853 	ill_capability_zerocopy_reset(ill, &sc_mp);
1854 	ill_capability_ipsec_reset(ill, &sc_mp);
1855 	ill_capability_dls_reset(ill, &sc_mp);
1856 
1857 	/* Nothing to send down in order to disable the capabilities? */
1858 	if (sc_mp == NULL)
1859 		return;
1860 
1861 	tmp = msgpullup(sc_mp, -1);
1862 	freemsg(sc_mp);
1863 	if ((sc_mp = tmp) == NULL) {
1864 		cmn_err(CE_WARN, "ill_capability_reset: unable to send down "
1865 		    "DL_CAPABILITY_REQ (ENOMEM)\n");
1866 		return;
1867 	}
1868 
1869 	ip1dbg(("ill_capability_reset: resetting negotiated capabilities\n"));
1870 	ill_capability_proto(ill, DL_CAPABILITY_REQ, sc_mp);
1871 }
1872 
1873 /*
1874  * Request or set new-style hardware capabilities supported by DLS provider.
1875  */
1876 static void
1877 ill_capability_proto(ill_t *ill, int type, mblk_t *reqp)
1878 {
1879 	mblk_t *mp;
1880 	dl_capability_req_t *capb;
1881 	size_t size = 0;
1882 	uint8_t *ptr;
1883 
1884 	if (reqp != NULL)
1885 		size = MBLKL(reqp);
1886 
1887 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t) + size, type);
1888 	if (mp == NULL) {
1889 		freemsg(reqp);
1890 		return;
1891 	}
1892 	ptr = mp->b_rptr;
1893 
1894 	capb = (dl_capability_req_t *)ptr;
1895 	ptr += sizeof (dl_capability_req_t);
1896 
1897 	if (reqp != NULL) {
1898 		capb->dl_sub_offset = sizeof (dl_capability_req_t);
1899 		capb->dl_sub_length = size;
1900 		bcopy(reqp->b_rptr, ptr, size);
1901 		ptr += size;
1902 		mp->b_cont = reqp->b_cont;
1903 		freeb(reqp);
1904 	}
1905 	ASSERT(ptr == mp->b_wptr);
1906 
1907 	ill_dlpi_send(ill, mp);
1908 }
1909 
1910 static void
1911 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1912 {
1913 	dl_capab_id_t *id_ic;
1914 	uint_t sub_dl_cap = outers->dl_cap;
1915 	dl_capability_sub_t *inners;
1916 	uint8_t *capend;
1917 
1918 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1919 
1920 	/*
1921 	 * Note: range checks here are not absolutely sufficient to
1922 	 * make us robust against malformed messages sent by drivers;
1923 	 * this is in keeping with the rest of IP's dlpi handling.
1924 	 * (Remember, it's coming from something else in the kernel
1925 	 * address space)
1926 	 */
1927 
1928 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1929 	if (capend > mp->b_wptr) {
1930 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1931 		    "malformed sub-capability too long for mblk");
1932 		return;
1933 	}
1934 
1935 	id_ic = (dl_capab_id_t *)(outers + 1);
1936 
1937 	if (outers->dl_length < sizeof (*id_ic) ||
1938 	    (inners = &id_ic->id_subcap,
1939 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1940 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1941 		    "encapsulated capab type %d too long for mblk",
1942 		    inners->dl_cap);
1943 		return;
1944 	}
1945 
1946 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1947 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1948 		    "isn't as expected; pass-thru module(s) detected, "
1949 		    "discarding capability\n", inners->dl_cap));
1950 		return;
1951 	}
1952 
1953 	/* Process the encapsulated sub-capability */
1954 	ill_capability_dispatch(ill, mp, inners, B_TRUE);
1955 }
1956 
1957 /*
1958  * Process Multidata Transmit capability negotiation ack received from a
1959  * DLS Provider.  isub must point to the sub-capability (DL_CAPAB_MDT) of a
1960  * DL_CAPABILITY_ACK message.
1961  */
1962 static void
1963 ill_capability_mdt_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1964 {
1965 	mblk_t *nmp = NULL;
1966 	dl_capability_req_t *oc;
1967 	dl_capab_mdt_t *mdt_ic, *mdt_oc;
1968 	ill_mdt_capab_t **ill_mdt_capab;
1969 	uint_t sub_dl_cap = isub->dl_cap;
1970 	uint8_t *capend;
1971 
1972 	ASSERT(sub_dl_cap == DL_CAPAB_MDT);
1973 
1974 	ill_mdt_capab = (ill_mdt_capab_t **)&ill->ill_mdt_capab;
1975 
1976 	/*
1977 	 * Note: range checks here are not absolutely sufficient to
1978 	 * make us robust against malformed messages sent by drivers;
1979 	 * this is in keeping with the rest of IP's dlpi handling.
1980 	 * (Remember, it's coming from something else in the kernel
1981 	 * address space)
1982 	 */
1983 
1984 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1985 	if (capend > mp->b_wptr) {
1986 		cmn_err(CE_WARN, "ill_capability_mdt_ack: "
1987 		    "malformed sub-capability too long for mblk");
1988 		return;
1989 	}
1990 
1991 	mdt_ic = (dl_capab_mdt_t *)(isub + 1);
1992 
1993 	if (mdt_ic->mdt_version != MDT_VERSION_2) {
1994 		cmn_err(CE_CONT, "ill_capability_mdt_ack: "
1995 		    "unsupported MDT sub-capability (version %d, expected %d)",
1996 		    mdt_ic->mdt_version, MDT_VERSION_2);
1997 		return;
1998 	}
1999 
2000 	if (!dlcapabcheckqid(&mdt_ic->mdt_mid, ill->ill_lmod_rq)) {
2001 		ip1dbg(("ill_capability_mdt_ack: mid token for MDT "
2002 		    "capability isn't as expected; pass-thru module(s) "
2003 		    "detected, discarding capability\n"));
2004 		return;
2005 	}
2006 
2007 	if (mdt_ic->mdt_flags & DL_CAPAB_MDT_ENABLE) {
2008 
2009 		if (*ill_mdt_capab == NULL) {
2010 			*ill_mdt_capab = kmem_zalloc(sizeof (ill_mdt_capab_t),
2011 			    KM_NOSLEEP);
2012 
2013 			if (*ill_mdt_capab == NULL) {
2014 				cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2015 				    "could not enable MDT version %d "
2016 				    "for %s (ENOMEM)\n", MDT_VERSION_2,
2017 				    ill->ill_name);
2018 				return;
2019 			}
2020 		}
2021 
2022 		ip1dbg(("ill_capability_mdt_ack: interface %s supports "
2023 		    "MDT version %d (%d bytes leading, %d bytes trailing "
2024 		    "header spaces, %d max pld bufs, %d span limit)\n",
2025 		    ill->ill_name, MDT_VERSION_2,
2026 		    mdt_ic->mdt_hdr_head, mdt_ic->mdt_hdr_tail,
2027 		    mdt_ic->mdt_max_pld, mdt_ic->mdt_span_limit));
2028 
2029 		(*ill_mdt_capab)->ill_mdt_version = MDT_VERSION_2;
2030 		(*ill_mdt_capab)->ill_mdt_on = 1;
2031 		/*
2032 		 * Round the following values to the nearest 32-bit; ULP
2033 		 * may further adjust them to accomodate for additional
2034 		 * protocol headers.  We pass these values to ULP during
2035 		 * bind time.
2036 		 */
2037 		(*ill_mdt_capab)->ill_mdt_hdr_head =
2038 		    roundup(mdt_ic->mdt_hdr_head, 4);
2039 		(*ill_mdt_capab)->ill_mdt_hdr_tail =
2040 		    roundup(mdt_ic->mdt_hdr_tail, 4);
2041 		(*ill_mdt_capab)->ill_mdt_max_pld = mdt_ic->mdt_max_pld;
2042 		(*ill_mdt_capab)->ill_mdt_span_limit = mdt_ic->mdt_span_limit;
2043 
2044 		ill->ill_capabilities |= ILL_CAPAB_MDT;
2045 	} else {
2046 		uint_t size;
2047 		uchar_t *rptr;
2048 
2049 		size = sizeof (dl_capability_req_t) +
2050 		    sizeof (dl_capability_sub_t) + sizeof (dl_capab_mdt_t);
2051 
2052 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2053 			cmn_err(CE_WARN, "ill_capability_mdt_ack: "
2054 			    "could not enable MDT for %s (ENOMEM)\n",
2055 			    ill->ill_name);
2056 			return;
2057 		}
2058 
2059 		rptr = nmp->b_rptr;
2060 		/* initialize dl_capability_req_t */
2061 		oc = (dl_capability_req_t *)nmp->b_rptr;
2062 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
2063 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
2064 		    sizeof (dl_capab_mdt_t);
2065 		nmp->b_rptr += sizeof (dl_capability_req_t);
2066 
2067 		/* initialize dl_capability_sub_t */
2068 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
2069 		nmp->b_rptr += sizeof (*isub);
2070 
2071 		/* initialize dl_capab_mdt_t */
2072 		mdt_oc = (dl_capab_mdt_t *)nmp->b_rptr;
2073 		bcopy(mdt_ic, mdt_oc, sizeof (*mdt_ic));
2074 
2075 		nmp->b_rptr = rptr;
2076 
2077 		ip1dbg(("ill_capability_mdt_ack: asking interface %s "
2078 		    "to enable MDT version %d\n", ill->ill_name,
2079 		    MDT_VERSION_2));
2080 
2081 		/* set ENABLE flag */
2082 		mdt_oc->mdt_flags |= DL_CAPAB_MDT_ENABLE;
2083 
2084 		/* nmp points to a DL_CAPABILITY_REQ message to enable MDT */
2085 		ill_dlpi_send(ill, nmp);
2086 	}
2087 }
2088 
2089 static void
2090 ill_capability_mdt_reset(ill_t *ill, mblk_t **sc_mp)
2091 {
2092 	mblk_t *mp;
2093 	dl_capab_mdt_t *mdt_subcap;
2094 	dl_capability_sub_t *dl_subcap;
2095 	int size;
2096 
2097 	if (!ILL_MDT_CAPABLE(ill))
2098 		return;
2099 
2100 	ASSERT(ill->ill_mdt_capab != NULL);
2101 	/*
2102 	 * Clear the capability flag for MDT but retain the ill_mdt_capab
2103 	 * structure since it's possible that another thread is still
2104 	 * referring to it.  The structure only gets deallocated when
2105 	 * we destroy the ill.
2106 	 */
2107 	ill->ill_capabilities &= ~ILL_CAPAB_MDT;
2108 
2109 	size = sizeof (*dl_subcap) + sizeof (*mdt_subcap);
2110 
2111 	mp = allocb(size, BPRI_HI);
2112 	if (mp == NULL) {
2113 		ip1dbg(("ill_capability_mdt_reset: unable to allocate "
2114 		    "request to disable MDT\n"));
2115 		return;
2116 	}
2117 
2118 	mp->b_wptr = mp->b_rptr + size;
2119 
2120 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2121 	dl_subcap->dl_cap = DL_CAPAB_MDT;
2122 	dl_subcap->dl_length = sizeof (*mdt_subcap);
2123 
2124 	mdt_subcap = (dl_capab_mdt_t *)(dl_subcap + 1);
2125 	mdt_subcap->mdt_version = ill->ill_mdt_capab->ill_mdt_version;
2126 	mdt_subcap->mdt_flags = 0;
2127 	mdt_subcap->mdt_hdr_head = 0;
2128 	mdt_subcap->mdt_hdr_tail = 0;
2129 
2130 	if (*sc_mp != NULL)
2131 		linkb(*sc_mp, mp);
2132 	else
2133 		*sc_mp = mp;
2134 }
2135 
2136 /*
2137  * Send a DL_NOTIFY_REQ to the specified ill to enable
2138  * DL_NOTE_PROMISC_ON/OFF_PHYS notifications.
2139  * Invoked by ill_capability_ipsec_ack() before enabling IPsec hardware
2140  * acceleration.
2141  * Returns B_TRUE on success, B_FALSE if the message could not be sent.
2142  */
2143 static boolean_t
2144 ill_enable_promisc_notify(ill_t *ill)
2145 {
2146 	mblk_t *mp;
2147 	dl_notify_req_t *req;
2148 
2149 	IPSECHW_DEBUG(IPSECHW_PKT, ("ill_enable_promisc_notify:\n"));
2150 
2151 	mp = ip_dlpi_alloc(sizeof (dl_notify_req_t), DL_NOTIFY_REQ);
2152 	if (mp == NULL)
2153 		return (B_FALSE);
2154 
2155 	req = (dl_notify_req_t *)mp->b_rptr;
2156 	req->dl_notifications = DL_NOTE_PROMISC_ON_PHYS |
2157 	    DL_NOTE_PROMISC_OFF_PHYS;
2158 
2159 	ill_dlpi_send(ill, mp);
2160 
2161 	return (B_TRUE);
2162 }
2163 
2164 
2165 /*
2166  * Allocate an IPsec capability request which will be filled by our
2167  * caller to turn on support for one or more algorithms.
2168  */
2169 static mblk_t *
2170 ill_alloc_ipsec_cap_req(ill_t *ill, dl_capability_sub_t *isub)
2171 {
2172 	mblk_t *nmp;
2173 	dl_capability_req_t	*ocap;
2174 	dl_capab_ipsec_t	*ocip;
2175 	dl_capab_ipsec_t	*icip;
2176 	uint8_t			*ptr;
2177 	icip = (dl_capab_ipsec_t *)(isub + 1);
2178 
2179 	/*
2180 	 * The first time around, we send a DL_NOTIFY_REQ to enable
2181 	 * PROMISC_ON/OFF notification from the provider. We need to
2182 	 * do this before enabling the algorithms to avoid leakage of
2183 	 * cleartext packets.
2184 	 */
2185 
2186 	if (!ill_enable_promisc_notify(ill))
2187 		return (NULL);
2188 
2189 	/*
2190 	 * Allocate new mblk which will contain a new capability
2191 	 * request to enable the capabilities.
2192 	 */
2193 
2194 	nmp = ip_dlpi_alloc(sizeof (dl_capability_req_t) +
2195 	    sizeof (dl_capability_sub_t) + isub->dl_length, DL_CAPABILITY_REQ);
2196 	if (nmp == NULL)
2197 		return (NULL);
2198 
2199 	ptr = nmp->b_rptr;
2200 
2201 	/* initialize dl_capability_req_t */
2202 	ocap = (dl_capability_req_t *)ptr;
2203 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2204 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2205 	ptr += sizeof (dl_capability_req_t);
2206 
2207 	/* initialize dl_capability_sub_t */
2208 	bcopy(isub, ptr, sizeof (*isub));
2209 	ptr += sizeof (*isub);
2210 
2211 	/* initialize dl_capab_ipsec_t */
2212 	ocip = (dl_capab_ipsec_t *)ptr;
2213 	bcopy(icip, ocip, sizeof (*icip));
2214 
2215 	nmp->b_wptr = (uchar_t *)(&ocip->cip_data[0]);
2216 	return (nmp);
2217 }
2218 
2219 /*
2220  * Process an IPsec capability negotiation ack received from a DLS Provider.
2221  * isub must point to the sub-capability (DL_CAPAB_IPSEC_AH or
2222  * DL_CAPAB_IPSEC_ESP) of a DL_CAPABILITY_ACK message.
2223  */
2224 static void
2225 ill_capability_ipsec_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
2226 {
2227 	dl_capab_ipsec_t	*icip;
2228 	dl_capab_ipsec_alg_t	*ialg;	/* ptr to input alg spec. */
2229 	dl_capab_ipsec_alg_t	*oalg;	/* ptr to output alg spec. */
2230 	uint_t cipher, nciphers;
2231 	mblk_t *nmp;
2232 	uint_t alg_len;
2233 	boolean_t need_sadb_dump;
2234 	uint_t sub_dl_cap = isub->dl_cap;
2235 	ill_ipsec_capab_t **ill_capab;
2236 	uint64_t ill_capab_flag;
2237 	uint8_t *capend, *ciphend;
2238 	boolean_t sadb_resync;
2239 
2240 	ASSERT(sub_dl_cap == DL_CAPAB_IPSEC_AH ||
2241 	    sub_dl_cap == DL_CAPAB_IPSEC_ESP);
2242 
2243 	if (sub_dl_cap == DL_CAPAB_IPSEC_AH) {
2244 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_ah;
2245 		ill_capab_flag = ILL_CAPAB_AH;
2246 	} else {
2247 		ill_capab = (ill_ipsec_capab_t **)&ill->ill_ipsec_capab_esp;
2248 		ill_capab_flag = ILL_CAPAB_ESP;
2249 	}
2250 
2251 	/*
2252 	 * If the ill capability structure exists, then this incoming
2253 	 * DL_CAPABILITY_ACK is a response to a "renegotiation" cycle.
2254 	 * If this is so, then we'd need to resynchronize the SADB
2255 	 * after re-enabling the offloaded ciphers.
2256 	 */
2257 	sadb_resync = (*ill_capab != NULL);
2258 
2259 	/*
2260 	 * Note: range checks here are not absolutely sufficient to
2261 	 * make us robust against malformed messages sent by drivers;
2262 	 * this is in keeping with the rest of IP's dlpi handling.
2263 	 * (Remember, it's coming from something else in the kernel
2264 	 * address space)
2265 	 */
2266 
2267 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
2268 	if (capend > mp->b_wptr) {
2269 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2270 		    "malformed sub-capability too long for mblk");
2271 		return;
2272 	}
2273 
2274 	/*
2275 	 * There are two types of acks we process here:
2276 	 * 1. acks in reply to a (first form) generic capability req
2277 	 *    (no ENABLE flag set)
2278 	 * 2. acks in reply to a ENABLE capability req.
2279 	 *    (ENABLE flag set)
2280 	 *
2281 	 * We process the subcapability passed as argument as follows:
2282 	 * 1 do initializations
2283 	 *   1.1 initialize nmp = NULL
2284 	 *   1.2 set need_sadb_dump to B_FALSE
2285 	 * 2 for each cipher in subcapability:
2286 	 *   2.1 if ENABLE flag is set:
2287 	 *	2.1.1 update per-ill ipsec capabilities info
2288 	 *	2.1.2 set need_sadb_dump to B_TRUE
2289 	 *   2.2 if ENABLE flag is not set:
2290 	 *	2.2.1 if nmp is NULL:
2291 	 *		2.2.1.1 allocate and initialize nmp
2292 	 *		2.2.1.2 init current pos in nmp
2293 	 *	2.2.2 copy current cipher to current pos in nmp
2294 	 *	2.2.3 set ENABLE flag in nmp
2295 	 *	2.2.4 update current pos
2296 	 * 3 if nmp is not equal to NULL, send enable request
2297 	 *   3.1 send capability request
2298 	 * 4 if need_sadb_dump is B_TRUE
2299 	 *   4.1 enable promiscuous on/off notifications
2300 	 *   4.2 call ill_dlpi_send(isub->dlcap) to send all
2301 	 *	AH or ESP SA's to interface.
2302 	 */
2303 
2304 	nmp = NULL;
2305 	oalg = NULL;
2306 	need_sadb_dump = B_FALSE;
2307 	icip = (dl_capab_ipsec_t *)(isub + 1);
2308 	ialg = (dl_capab_ipsec_alg_t *)(&icip->cip_data[0]);
2309 
2310 	nciphers = icip->cip_nciphers;
2311 	ciphend = (uint8_t *)(ialg + icip->cip_nciphers);
2312 
2313 	if (ciphend > capend) {
2314 		cmn_err(CE_WARN, "ill_capability_ipsec_ack: "
2315 		    "too many ciphers for sub-capability len");
2316 		return;
2317 	}
2318 
2319 	for (cipher = 0; cipher < nciphers; cipher++) {
2320 		alg_len = sizeof (dl_capab_ipsec_alg_t);
2321 
2322 		if (ialg->alg_flag & DL_CAPAB_ALG_ENABLE) {
2323 			/*
2324 			 * TBD: when we provide a way to disable capabilities
2325 			 * from above, need to manage the request-pending state
2326 			 * and fail if we were not expecting this ACK.
2327 			 */
2328 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2329 			    ("ill_capability_ipsec_ack: got ENABLE ACK\n"));
2330 
2331 			/*
2332 			 * Update IPsec capabilities for this ill
2333 			 */
2334 
2335 			if (*ill_capab == NULL) {
2336 				IPSECHW_DEBUG(IPSECHW_CAPAB,
2337 				    ("ill_capability_ipsec_ack: "
2338 					"allocating ipsec_capab for ill\n"));
2339 				*ill_capab = ill_ipsec_capab_alloc();
2340 
2341 				if (*ill_capab == NULL) {
2342 					cmn_err(CE_WARN,
2343 					    "ill_capability_ipsec_ack: "
2344 					    "could not enable IPsec Hardware "
2345 					    "acceleration for %s (ENOMEM)\n",
2346 					    ill->ill_name);
2347 					return;
2348 				}
2349 			}
2350 
2351 			ASSERT(ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH ||
2352 			    ialg->alg_type == DL_CAPAB_IPSEC_ALG_ENCR);
2353 
2354 			if (ialg->alg_prim >= MAX_IPSEC_ALGS) {
2355 				cmn_err(CE_WARN,
2356 				    "ill_capability_ipsec_ack: "
2357 				    "malformed IPsec algorithm id %d",
2358 				    ialg->alg_prim);
2359 				continue;
2360 			}
2361 
2362 			if (ialg->alg_type == DL_CAPAB_IPSEC_ALG_AUTH) {
2363 				IPSEC_ALG_ENABLE((*ill_capab)->auth_hw_algs,
2364 				    ialg->alg_prim);
2365 			} else {
2366 				ipsec_capab_algparm_t *alp;
2367 
2368 				IPSEC_ALG_ENABLE((*ill_capab)->encr_hw_algs,
2369 				    ialg->alg_prim);
2370 				if (!ill_ipsec_capab_resize_algparm(*ill_capab,
2371 				    ialg->alg_prim)) {
2372 					cmn_err(CE_WARN,
2373 					    "ill_capability_ipsec_ack: "
2374 					    "no space for IPsec alg id %d",
2375 					    ialg->alg_prim);
2376 					continue;
2377 				}
2378 				alp = &((*ill_capab)->encr_algparm[
2379 						ialg->alg_prim]);
2380 				alp->minkeylen = ialg->alg_minbits;
2381 				alp->maxkeylen = ialg->alg_maxbits;
2382 			}
2383 			ill->ill_capabilities |= ill_capab_flag;
2384 			/*
2385 			 * indicate that a capability was enabled, which
2386 			 * will be used below to kick off a SADB dump
2387 			 * to the ill.
2388 			 */
2389 			need_sadb_dump = B_TRUE;
2390 		} else {
2391 			IPSECHW_DEBUG(IPSECHW_CAPAB,
2392 			    ("ill_capability_ipsec_ack: enabling alg 0x%x\n",
2393 				ialg->alg_prim));
2394 
2395 			if (nmp == NULL) {
2396 				nmp = ill_alloc_ipsec_cap_req(ill, isub);
2397 				if (nmp == NULL) {
2398 					/*
2399 					 * Sending the PROMISC_ON/OFF
2400 					 * notification request failed.
2401 					 * We cannot enable the algorithms
2402 					 * since the Provider will not
2403 					 * notify IP of promiscous mode
2404 					 * changes, which could lead
2405 					 * to leakage of packets.
2406 					 */
2407 					cmn_err(CE_WARN,
2408 					    "ill_capability_ipsec_ack: "
2409 					    "could not enable IPsec Hardware "
2410 					    "acceleration for %s (ENOMEM)\n",
2411 					    ill->ill_name);
2412 					return;
2413 				}
2414 				/* ptr to current output alg specifier */
2415 				oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2416 			}
2417 
2418 			/*
2419 			 * Copy current alg specifier, set ENABLE
2420 			 * flag, and advance to next output alg.
2421 			 * For now we enable all IPsec capabilities.
2422 			 */
2423 			ASSERT(oalg != NULL);
2424 			bcopy(ialg, oalg, alg_len);
2425 			oalg->alg_flag |= DL_CAPAB_ALG_ENABLE;
2426 			nmp->b_wptr += alg_len;
2427 			oalg = (dl_capab_ipsec_alg_t *)nmp->b_wptr;
2428 		}
2429 
2430 		/* move to next input algorithm specifier */
2431 		ialg = (dl_capab_ipsec_alg_t *)
2432 		    ((char *)ialg + alg_len);
2433 	}
2434 
2435 	if (nmp != NULL)
2436 		/*
2437 		 * nmp points to a DL_CAPABILITY_REQ message to enable
2438 		 * IPsec hardware acceleration.
2439 		 */
2440 		ill_dlpi_send(ill, nmp);
2441 
2442 	if (need_sadb_dump)
2443 		/*
2444 		 * An acknowledgement corresponding to a request to
2445 		 * enable acceleration was received, notify SADB.
2446 		 */
2447 		ill_ipsec_capab_add(ill, sub_dl_cap, sadb_resync);
2448 }
2449 
2450 /*
2451  * Given an mblk with enough space in it, create sub-capability entries for
2452  * DL_CAPAB_IPSEC_{AH,ESP} types which consist of previously-advertised
2453  * offloaded ciphers (both AUTH and ENCR) with their enable flags cleared,
2454  * in preparation for the reset the DL_CAPABILITY_REQ message.
2455  */
2456 static void
2457 ill_fill_ipsec_reset(uint_t nciphers, int stype, uint_t slen,
2458     ill_ipsec_capab_t *ill_cap, mblk_t *mp)
2459 {
2460 	dl_capab_ipsec_t *oipsec;
2461 	dl_capab_ipsec_alg_t *oalg;
2462 	dl_capability_sub_t *dl_subcap;
2463 	int i, k;
2464 
2465 	ASSERT(nciphers > 0);
2466 	ASSERT(ill_cap != NULL);
2467 	ASSERT(mp != NULL);
2468 	ASSERT(MBLKTAIL(mp) >= sizeof (*dl_subcap) + sizeof (*oipsec) + slen);
2469 
2470 	/* dl_capability_sub_t for "stype" */
2471 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
2472 	dl_subcap->dl_cap = stype;
2473 	dl_subcap->dl_length = sizeof (dl_capab_ipsec_t) + slen;
2474 	mp->b_wptr += sizeof (dl_capability_sub_t);
2475 
2476 	/* dl_capab_ipsec_t for "stype" */
2477 	oipsec = (dl_capab_ipsec_t *)mp->b_wptr;
2478 	oipsec->cip_version = 1;
2479 	oipsec->cip_nciphers = nciphers;
2480 	mp->b_wptr = (uchar_t *)&oipsec->cip_data[0];
2481 
2482 	/* create entries for "stype" AUTH ciphers */
2483 	for (i = 0; i < ill_cap->algs_size; i++) {
2484 		for (k = 0; k < BITSPERBYTE; k++) {
2485 			if ((ill_cap->auth_hw_algs[i] & (1 << k)) == 0)
2486 				continue;
2487 
2488 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2489 			bzero((void *)oalg, sizeof (*oalg));
2490 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_AUTH;
2491 			oalg->alg_prim = k + (BITSPERBYTE * i);
2492 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2493 		}
2494 	}
2495 	/* create entries for "stype" ENCR ciphers */
2496 	for (i = 0; i < ill_cap->algs_size; i++) {
2497 		for (k = 0; k < BITSPERBYTE; k++) {
2498 			if ((ill_cap->encr_hw_algs[i] & (1 << k)) == 0)
2499 				continue;
2500 
2501 			oalg = (dl_capab_ipsec_alg_t *)mp->b_wptr;
2502 			bzero((void *)oalg, sizeof (*oalg));
2503 			oalg->alg_type = DL_CAPAB_IPSEC_ALG_ENCR;
2504 			oalg->alg_prim = k + (BITSPERBYTE * i);
2505 			mp->b_wptr += sizeof (dl_capab_ipsec_alg_t);
2506 		}
2507 	}
2508 }
2509 
2510 /*
2511  * Macro to count number of 1s in a byte (8-bit word).  The total count is
2512  * accumulated into the passed-in argument (sum).  We could use SPARCv9's
2513  * POPC instruction, but our macro is more flexible for an arbitrary length
2514  * of bytes, such as {auth,encr}_hw_algs.  These variables are currently
2515  * 256-bits long (MAX_IPSEC_ALGS), so if we know for sure that the length
2516  * stays that way, we can reduce the number of iterations required.
2517  */
2518 #define	COUNT_1S(val, sum) {					\
2519 	uint8_t x = val & 0xff;					\
2520 	x = (x & 0x55) + ((x >> 1) & 0x55);			\
2521 	x = (x & 0x33) + ((x >> 2) & 0x33);			\
2522 	sum += (x & 0xf) + ((x >> 4) & 0xf);			\
2523 }
2524 
2525 /* ARGSUSED */
2526 static void
2527 ill_capability_ipsec_reset(ill_t *ill, mblk_t **sc_mp)
2528 {
2529 	mblk_t *mp;
2530 	ill_ipsec_capab_t *cap_ah = ill->ill_ipsec_capab_ah;
2531 	ill_ipsec_capab_t *cap_esp = ill->ill_ipsec_capab_esp;
2532 	uint64_t ill_capabilities = ill->ill_capabilities;
2533 	int ah_cnt = 0, esp_cnt = 0;
2534 	int ah_len = 0, esp_len = 0;
2535 	int i, size = 0;
2536 
2537 	if (!(ill_capabilities & (ILL_CAPAB_AH | ILL_CAPAB_ESP)))
2538 		return;
2539 
2540 	ASSERT(cap_ah != NULL || !(ill_capabilities & ILL_CAPAB_AH));
2541 	ASSERT(cap_esp != NULL || !(ill_capabilities & ILL_CAPAB_ESP));
2542 
2543 	/* Find out the number of ciphers for AH */
2544 	if (cap_ah != NULL) {
2545 		for (i = 0; i < cap_ah->algs_size; i++) {
2546 			COUNT_1S(cap_ah->auth_hw_algs[i], ah_cnt);
2547 			COUNT_1S(cap_ah->encr_hw_algs[i], ah_cnt);
2548 		}
2549 		if (ah_cnt > 0) {
2550 			size += sizeof (dl_capability_sub_t) +
2551 			    sizeof (dl_capab_ipsec_t);
2552 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2553 			ah_len = (ah_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2554 			size += ah_len;
2555 		}
2556 	}
2557 
2558 	/* Find out the number of ciphers for ESP */
2559 	if (cap_esp != NULL) {
2560 		for (i = 0; i < cap_esp->algs_size; i++) {
2561 			COUNT_1S(cap_esp->auth_hw_algs[i], esp_cnt);
2562 			COUNT_1S(cap_esp->encr_hw_algs[i], esp_cnt);
2563 		}
2564 		if (esp_cnt > 0) {
2565 			size += sizeof (dl_capability_sub_t) +
2566 			    sizeof (dl_capab_ipsec_t);
2567 			/* dl_capab_ipsec_t contains one dl_capab_ipsec_alg_t */
2568 			esp_len = (esp_cnt - 1) * sizeof (dl_capab_ipsec_alg_t);
2569 			size += esp_len;
2570 		}
2571 	}
2572 
2573 	if (size == 0) {
2574 		ip1dbg(("ill_capability_ipsec_reset: capabilities exist but "
2575 		    "there's nothing to reset\n"));
2576 		return;
2577 	}
2578 
2579 	mp = allocb(size, BPRI_HI);
2580 	if (mp == NULL) {
2581 		ip1dbg(("ill_capability_ipsec_reset: unable to allocate "
2582 		    "request to disable IPSEC Hardware Acceleration\n"));
2583 		return;
2584 	}
2585 
2586 	/*
2587 	 * Clear the capability flags for IPSec HA but retain the ill
2588 	 * capability structures since it's possible that another thread
2589 	 * is still referring to them.  The structures only get deallocated
2590 	 * when we destroy the ill.
2591 	 *
2592 	 * Various places check the flags to see if the ill is capable of
2593 	 * hardware acceleration, and by clearing them we ensure that new
2594 	 * outbound IPSec packets are sent down encrypted.
2595 	 */
2596 	ill->ill_capabilities &= ~(ILL_CAPAB_AH | ILL_CAPAB_ESP);
2597 
2598 	/* Fill in DL_CAPAB_IPSEC_AH sub-capability entries */
2599 	if (ah_cnt > 0) {
2600 		ill_fill_ipsec_reset(ah_cnt, DL_CAPAB_IPSEC_AH, ah_len,
2601 		    cap_ah, mp);
2602 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2603 	}
2604 
2605 	/* Fill in DL_CAPAB_IPSEC_ESP sub-capability entries */
2606 	if (esp_cnt > 0) {
2607 		ill_fill_ipsec_reset(esp_cnt, DL_CAPAB_IPSEC_ESP, esp_len,
2608 		    cap_esp, mp);
2609 		ASSERT(mp->b_rptr + size >= mp->b_wptr);
2610 	}
2611 
2612 	/*
2613 	 * At this point we've composed a bunch of sub-capabilities to be
2614 	 * encapsulated in a DL_CAPABILITY_REQ and later sent downstream
2615 	 * by the caller.  Upon receiving this reset message, the driver
2616 	 * must stop inbound decryption (by destroying all inbound SAs)
2617 	 * and let the corresponding packets come in encrypted.
2618 	 */
2619 
2620 	if (*sc_mp != NULL)
2621 		linkb(*sc_mp, mp);
2622 	else
2623 		*sc_mp = mp;
2624 }
2625 
2626 static void
2627 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp,
2628     boolean_t encapsulated)
2629 {
2630 	boolean_t legacy = B_FALSE;
2631 
2632 	/*
2633 	 * If this DL_CAPABILITY_ACK came in as a response to our "reset"
2634 	 * DL_CAPABILITY_REQ, ignore it during this cycle.  We've just
2635 	 * instructed the driver to disable its advertised capabilities,
2636 	 * so there's no point in accepting any response at this moment.
2637 	 */
2638 	if (ill->ill_dlpi_capab_state == IDS_UNKNOWN)
2639 		return;
2640 
2641 	/*
2642 	 * Note that only the following two sub-capabilities may be
2643 	 * considered as "legacy", since their original definitions
2644 	 * do not incorporate the dl_mid_t module ID token, and hence
2645 	 * may require the use of the wrapper sub-capability.
2646 	 */
2647 	switch (subp->dl_cap) {
2648 	case DL_CAPAB_IPSEC_AH:
2649 	case DL_CAPAB_IPSEC_ESP:
2650 		legacy = B_TRUE;
2651 		break;
2652 	}
2653 
2654 	/*
2655 	 * For legacy sub-capabilities which don't incorporate a queue_t
2656 	 * pointer in their structures, discard them if we detect that
2657 	 * there are intermediate modules in between IP and the driver.
2658 	 */
2659 	if (!encapsulated && legacy && ill->ill_lmod_cnt > 1) {
2660 		ip1dbg(("ill_capability_dispatch: unencapsulated capab type "
2661 		    "%d discarded; %d module(s) present below IP\n",
2662 		    subp->dl_cap, ill->ill_lmod_cnt));
2663 		return;
2664 	}
2665 
2666 	switch (subp->dl_cap) {
2667 	case DL_CAPAB_IPSEC_AH:
2668 	case DL_CAPAB_IPSEC_ESP:
2669 		ill_capability_ipsec_ack(ill, mp, subp);
2670 		break;
2671 	case DL_CAPAB_MDT:
2672 		ill_capability_mdt_ack(ill, mp, subp);
2673 		break;
2674 	case DL_CAPAB_HCKSUM:
2675 		ill_capability_hcksum_ack(ill, mp, subp);
2676 		break;
2677 	case DL_CAPAB_ZEROCOPY:
2678 		ill_capability_zerocopy_ack(ill, mp, subp);
2679 		break;
2680 	case DL_CAPAB_POLL:
2681 		if (!SOFT_RINGS_ENABLED())
2682 			ill_capability_dls_ack(ill, mp, subp);
2683 		break;
2684 	case DL_CAPAB_SOFT_RING:
2685 		if (SOFT_RINGS_ENABLED())
2686 			ill_capability_dls_ack(ill, mp, subp);
2687 		break;
2688 	default:
2689 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
2690 		    subp->dl_cap));
2691 	}
2692 }
2693 
2694 /*
2695  * As part of negotiating polling capability, the driver tells us
2696  * the default (or normal) blanking interval and packet threshold
2697  * (the receive timer fires if blanking interval is reached or
2698  * the packet threshold is reached).
2699  *
2700  * As part of manipulating the polling interval, we always use our
2701  * estimated interval (avg service time * number of packets queued
2702  * on the squeue) but we try to blank for a minimum of
2703  * rr_normal_blank_time * rr_max_blank_ratio. We disable the
2704  * packet threshold during this time. When we are not in polling mode
2705  * we set the blank interval typically lower, rr_normal_pkt_cnt *
2706  * rr_min_blank_ratio but up the packet cnt by a ratio of
2707  * rr_min_pkt_cnt_ratio so that we are still getting chains if
2708  * possible although for a shorter interval.
2709  */
2710 #define	RR_MAX_BLANK_RATIO	20
2711 #define	RR_MIN_BLANK_RATIO	10
2712 #define	RR_MAX_PKT_CNT_RATIO	3
2713 #define	RR_MIN_PKT_CNT_RATIO	3
2714 
2715 /*
2716  * These can be tuned via /etc/system.
2717  */
2718 int rr_max_blank_ratio = RR_MAX_BLANK_RATIO;
2719 int rr_min_blank_ratio = RR_MIN_BLANK_RATIO;
2720 int rr_max_pkt_cnt_ratio = RR_MAX_PKT_CNT_RATIO;
2721 int rr_min_pkt_cnt_ratio = RR_MIN_PKT_CNT_RATIO;
2722 
2723 static mac_resource_handle_t
2724 ill_ring_add(void *arg, mac_resource_t *mrp)
2725 {
2726 	ill_t			*ill = (ill_t *)arg;
2727 	mac_rx_fifo_t		*mrfp = (mac_rx_fifo_t *)mrp;
2728 	ill_rx_ring_t		*rx_ring;
2729 	int			ip_rx_index;
2730 
2731 	ASSERT(mrp != NULL);
2732 	if (mrp->mr_type != MAC_RX_FIFO) {
2733 		return (NULL);
2734 	}
2735 	ASSERT(ill != NULL);
2736 	ASSERT(ill->ill_dls_capab != NULL);
2737 
2738 	mutex_enter(&ill->ill_lock);
2739 	for (ip_rx_index = 0; ip_rx_index < ILL_MAX_RINGS; ip_rx_index++) {
2740 		rx_ring = &ill->ill_dls_capab->ill_ring_tbl[ip_rx_index];
2741 		ASSERT(rx_ring != NULL);
2742 
2743 		if (rx_ring->rr_ring_state == ILL_RING_FREE) {
2744 			time_t normal_blank_time =
2745 			    mrfp->mrf_normal_blank_time;
2746 			uint_t normal_pkt_cnt =
2747 			    mrfp->mrf_normal_pkt_count;
2748 
2749 			bzero(rx_ring, sizeof (ill_rx_ring_t));
2750 
2751 			rx_ring->rr_blank = mrfp->mrf_blank;
2752 			rx_ring->rr_handle = mrfp->mrf_arg;
2753 			rx_ring->rr_ill = ill;
2754 			rx_ring->rr_normal_blank_time = normal_blank_time;
2755 			rx_ring->rr_normal_pkt_cnt = normal_pkt_cnt;
2756 
2757 			rx_ring->rr_max_blank_time =
2758 			    normal_blank_time * rr_max_blank_ratio;
2759 			rx_ring->rr_min_blank_time =
2760 			    normal_blank_time * rr_min_blank_ratio;
2761 			rx_ring->rr_max_pkt_cnt =
2762 			    normal_pkt_cnt * rr_max_pkt_cnt_ratio;
2763 			rx_ring->rr_min_pkt_cnt =
2764 			    normal_pkt_cnt * rr_min_pkt_cnt_ratio;
2765 
2766 			rx_ring->rr_ring_state = ILL_RING_INUSE;
2767 			mutex_exit(&ill->ill_lock);
2768 
2769 			DTRACE_PROBE2(ill__ring__add, (void *), ill,
2770 			    (int), ip_rx_index);
2771 			return ((mac_resource_handle_t)rx_ring);
2772 		}
2773 	}
2774 
2775 	/*
2776 	 * We ran out of ILL_MAX_RINGS worth rx_ring structures. If
2777 	 * we have devices which can overwhelm this limit, ILL_MAX_RING
2778 	 * should be made configurable. Meanwhile it cause no panic because
2779 	 * driver will pass ip_input a NULL handle which will make
2780 	 * IP allocate the default squeue and Polling mode will not
2781 	 * be used for this ring.
2782 	 */
2783 	cmn_err(CE_NOTE, "Reached maximum number of receiving rings (%d) "
2784 	    "for %s\n", ILL_MAX_RINGS, ill->ill_name);
2785 
2786 	mutex_exit(&ill->ill_lock);
2787 	return (NULL);
2788 }
2789 
2790 static boolean_t
2791 ill_capability_dls_init(ill_t *ill)
2792 {
2793 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2794 	conn_t 			*connp;
2795 	size_t			sz;
2796 
2797 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING) {
2798 		if (ill_dls == NULL) {
2799 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2800 			    "soft_ring enabled for ill=%s (%p) but data "
2801 			    "structs uninitialized\n", ill->ill_name,
2802 			    (void *)ill);
2803 		}
2804 		return (B_TRUE);
2805 	} else if (ill->ill_capabilities & ILL_CAPAB_POLL) {
2806 		if (ill_dls == NULL) {
2807 			cmn_err(CE_PANIC, "ill_capability_dls_init: "
2808 			    "polling enabled for ill=%s (%p) but data "
2809 			    "structs uninitialized\n", ill->ill_name,
2810 			(void *)ill);
2811 		}
2812 		return (B_TRUE);
2813 	}
2814 
2815 	if (ill_dls != NULL) {
2816 		ill_rx_ring_t 	*rx_ring = ill_dls->ill_ring_tbl;
2817 		/* Soft_Ring or polling is being re-enabled */
2818 
2819 		connp = ill_dls->ill_unbind_conn;
2820 		ASSERT(rx_ring != NULL);
2821 		bzero((void *)ill_dls, sizeof (ill_dls_capab_t));
2822 		bzero((void *)rx_ring,
2823 		    sizeof (ill_rx_ring_t) * ILL_MAX_RINGS);
2824 		ill_dls->ill_ring_tbl = rx_ring;
2825 		ill_dls->ill_unbind_conn = connp;
2826 		return (B_TRUE);
2827 	}
2828 
2829 	if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL)
2830 		return (B_FALSE);
2831 
2832 	sz = sizeof (ill_dls_capab_t);
2833 	sz += sizeof (ill_rx_ring_t) * ILL_MAX_RINGS;
2834 
2835 	ill_dls = kmem_zalloc(sz, KM_NOSLEEP);
2836 	if (ill_dls == NULL) {
2837 		cmn_err(CE_WARN, "ill_capability_dls_init: could not "
2838 		    "allocate dls_capab for %s (%p)\n", ill->ill_name,
2839 		    (void *)ill);
2840 		CONN_DEC_REF(connp);
2841 		return (B_FALSE);
2842 	}
2843 
2844 	/* Allocate space to hold ring table */
2845 	ill_dls->ill_ring_tbl = (ill_rx_ring_t *)&ill_dls[1];
2846 	ill->ill_dls_capab = ill_dls;
2847 	ill_dls->ill_unbind_conn = connp;
2848 	return (B_TRUE);
2849 }
2850 
2851 /*
2852  * ill_capability_dls_disable: disable soft_ring and/or polling
2853  * capability. Since any of the rings might already be in use, need
2854  * to call ipsq_clean_all() which gets behind the squeue to disable
2855  * direct calls if necessary.
2856  */
2857 static void
2858 ill_capability_dls_disable(ill_t *ill)
2859 {
2860 	ill_dls_capab_t	*ill_dls = ill->ill_dls_capab;
2861 
2862 	if (ill->ill_capabilities & ILL_CAPAB_DLS) {
2863 		ipsq_clean_all(ill);
2864 		ill_dls->ill_tx = NULL;
2865 		ill_dls->ill_tx_handle = NULL;
2866 		ill_dls->ill_dls_change_status = NULL;
2867 		ill_dls->ill_dls_bind = NULL;
2868 		ill_dls->ill_dls_unbind = NULL;
2869 	}
2870 
2871 	ASSERT(!(ill->ill_capabilities & ILL_CAPAB_DLS));
2872 }
2873 
2874 static void
2875 ill_capability_dls_capable(ill_t *ill, dl_capab_dls_t *idls,
2876     dl_capability_sub_t *isub)
2877 {
2878 	uint_t			size;
2879 	uchar_t			*rptr;
2880 	dl_capab_dls_t	dls, *odls;
2881 	ill_dls_capab_t	*ill_dls;
2882 	mblk_t			*nmp = NULL;
2883 	dl_capability_req_t	*ocap;
2884 	uint_t			sub_dl_cap = isub->dl_cap;
2885 
2886 	if (!ill_capability_dls_init(ill))
2887 		return;
2888 	ill_dls = ill->ill_dls_capab;
2889 
2890 	/* Copy locally to get the members aligned */
2891 	bcopy((void *)idls, (void *)&dls,
2892 	    sizeof (dl_capab_dls_t));
2893 
2894 	/* Get the tx function and handle from dld */
2895 	ill_dls->ill_tx = (ip_dld_tx_t)dls.dls_tx;
2896 	ill_dls->ill_tx_handle = (void *)dls.dls_tx_handle;
2897 
2898 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2899 		ill_dls->ill_dls_change_status =
2900 		    (ip_dls_chg_soft_ring_t)dls.dls_ring_change_status;
2901 		ill_dls->ill_dls_bind = (ip_dls_bind_t)dls.dls_ring_bind;
2902 		ill_dls->ill_dls_unbind =
2903 		    (ip_dls_unbind_t)dls.dls_ring_unbind;
2904 		ill_dls->ill_dls_soft_ring_cnt = ip_soft_rings_cnt;
2905 	}
2906 
2907 	size = sizeof (dl_capability_req_t) + sizeof (dl_capability_sub_t) +
2908 	    isub->dl_length;
2909 
2910 	if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
2911 		cmn_err(CE_WARN, "ill_capability_dls_capable: could "
2912 		    "not allocate memory for CAPAB_REQ for %s (%p)\n",
2913 		    ill->ill_name, (void *)ill);
2914 		return;
2915 	}
2916 
2917 	/* initialize dl_capability_req_t */
2918 	rptr = nmp->b_rptr;
2919 	ocap = (dl_capability_req_t *)rptr;
2920 	ocap->dl_sub_offset = sizeof (dl_capability_req_t);
2921 	ocap->dl_sub_length = sizeof (dl_capability_sub_t) + isub->dl_length;
2922 	rptr += sizeof (dl_capability_req_t);
2923 
2924 	/* initialize dl_capability_sub_t */
2925 	bcopy(isub, rptr, sizeof (*isub));
2926 	rptr += sizeof (*isub);
2927 
2928 	odls = (dl_capab_dls_t *)rptr;
2929 	rptr += sizeof (dl_capab_dls_t);
2930 
2931 	/* initialize dl_capab_dls_t to be sent down */
2932 	dls.dls_rx_handle = (uintptr_t)ill;
2933 	dls.dls_rx = (uintptr_t)ip_input;
2934 	dls.dls_ring_add = (uintptr_t)ill_ring_add;
2935 
2936 	if (sub_dl_cap == DL_CAPAB_SOFT_RING) {
2937 		dls.dls_ring_cnt = ip_soft_rings_cnt;
2938 		dls.dls_ring_assign = (uintptr_t)ip_soft_ring_assignment;
2939 		dls.dls_flags = SOFT_RING_ENABLE;
2940 	} else {
2941 		dls.dls_flags = POLL_ENABLE;
2942 		ip1dbg(("ill_capability_dls_capable: asking interface %s "
2943 		    "to enable polling\n", ill->ill_name));
2944 	}
2945 	bcopy((void *)&dls, (void *)odls,
2946 	    sizeof (dl_capab_dls_t));
2947 	ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
2948 	/*
2949 	 * nmp points to a DL_CAPABILITY_REQ message to
2950 	 * enable either soft_ring or polling
2951 	 */
2952 	ill_dlpi_send(ill, nmp);
2953 }
2954 
2955 static void
2956 ill_capability_dls_reset(ill_t *ill, mblk_t **sc_mp)
2957 {
2958 	mblk_t *mp;
2959 	dl_capab_dls_t *idls;
2960 	dl_capability_sub_t *dl_subcap;
2961 	int size;
2962 
2963 	if (!(ill->ill_capabilities & ILL_CAPAB_DLS))
2964 		return;
2965 
2966 	ASSERT(ill->ill_dls_capab != NULL);
2967 
2968 	size = sizeof (*dl_subcap) + sizeof (*idls);
2969 
2970 	mp = allocb(size, BPRI_HI);
2971 	if (mp == NULL) {
2972 		ip1dbg(("ill_capability_dls_reset: unable to allocate "
2973 		    "request to disable soft_ring\n"));
2974 		return;
2975 	}
2976 
2977 	mp->b_wptr = mp->b_rptr + size;
2978 
2979 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
2980 	dl_subcap->dl_length = sizeof (*idls);
2981 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
2982 		dl_subcap->dl_cap = DL_CAPAB_SOFT_RING;
2983 	else
2984 		dl_subcap->dl_cap = DL_CAPAB_POLL;
2985 
2986 	idls = (dl_capab_dls_t *)(dl_subcap + 1);
2987 	if (ill->ill_capabilities & ILL_CAPAB_SOFT_RING)
2988 		idls->dls_flags = SOFT_RING_DISABLE;
2989 	else
2990 		idls->dls_flags = POLL_DISABLE;
2991 
2992 	if (*sc_mp != NULL)
2993 		linkb(*sc_mp, mp);
2994 	else
2995 		*sc_mp = mp;
2996 }
2997 
2998 /*
2999  * Process a soft_ring/poll capability negotiation ack received
3000  * from a DLS Provider.isub must point to the sub-capability
3001  * (DL_CAPAB_SOFT_RING/DL_CAPAB_POLL) of a DL_CAPABILITY_ACK message.
3002  */
3003 static void
3004 ill_capability_dls_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3005 {
3006 	dl_capab_dls_t		*idls;
3007 	uint_t			sub_dl_cap = isub->dl_cap;
3008 	uint8_t			*capend;
3009 
3010 	ASSERT(sub_dl_cap == DL_CAPAB_SOFT_RING ||
3011 	    sub_dl_cap == DL_CAPAB_POLL);
3012 
3013 	if (ill->ill_isv6)
3014 		return;
3015 
3016 	/*
3017 	 * Note: range checks here are not absolutely sufficient to
3018 	 * make us robust against malformed messages sent by drivers;
3019 	 * this is in keeping with the rest of IP's dlpi handling.
3020 	 * (Remember, it's coming from something else in the kernel
3021 	 * address space)
3022 	 */
3023 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3024 	if (capend > mp->b_wptr) {
3025 		cmn_err(CE_WARN, "ill_capability_dls_ack: "
3026 		    "malformed sub-capability too long for mblk");
3027 		return;
3028 	}
3029 
3030 	/*
3031 	 * There are two types of acks we process here:
3032 	 * 1. acks in reply to a (first form) generic capability req
3033 	 *    (dls_flag will be set to SOFT_RING_CAPABLE or POLL_CAPABLE)
3034 	 * 2. acks in reply to a SOFT_RING_ENABLE or POLL_ENABLE
3035 	 *    capability req.
3036 	 */
3037 	idls = (dl_capab_dls_t *)(isub + 1);
3038 
3039 	if (!dlcapabcheckqid(&idls->dls_mid, ill->ill_lmod_rq)) {
3040 		ip1dbg(("ill_capability_dls_ack: mid token for dls "
3041 		    "capability isn't as expected; pass-thru "
3042 		    "module(s) detected, discarding capability\n"));
3043 		if (ill->ill_capabilities & ILL_CAPAB_DLS) {
3044 			/*
3045 			 * This is a capability renegotitation case.
3046 			 * The interface better be unusable at this
3047 			 * point other wise bad things will happen
3048 			 * if we disable direct calls on a running
3049 			 * and up interface.
3050 			 */
3051 			ill_capability_dls_disable(ill);
3052 		}
3053 		return;
3054 	}
3055 
3056 	switch (idls->dls_flags) {
3057 	default:
3058 		/* Disable if unknown flag */
3059 	case SOFT_RING_DISABLE:
3060 	case POLL_DISABLE:
3061 		ill_capability_dls_disable(ill);
3062 		break;
3063 	case SOFT_RING_CAPABLE:
3064 	case POLL_CAPABLE:
3065 		/*
3066 		 * If the capability was already enabled, its safe
3067 		 * to disable it first to get rid of stale information
3068 		 * and then start enabling it again.
3069 		 */
3070 		ill_capability_dls_disable(ill);
3071 		ill_capability_dls_capable(ill, idls, isub);
3072 		break;
3073 	case SOFT_RING_ENABLE:
3074 	case POLL_ENABLE:
3075 		mutex_enter(&ill->ill_lock);
3076 		if (sub_dl_cap == DL_CAPAB_SOFT_RING &&
3077 		    !(ill->ill_capabilities & ILL_CAPAB_SOFT_RING)) {
3078 			ASSERT(ill->ill_dls_capab != NULL);
3079 			ill->ill_capabilities |= ILL_CAPAB_SOFT_RING;
3080 		}
3081 		if (sub_dl_cap == DL_CAPAB_POLL &&
3082 		    !(ill->ill_capabilities & ILL_CAPAB_POLL)) {
3083 			ASSERT(ill->ill_dls_capab != NULL);
3084 			ill->ill_capabilities |= ILL_CAPAB_POLL;
3085 			ip1dbg(("ill_capability_dls_ack: interface %s "
3086 			    "has enabled polling\n", ill->ill_name));
3087 		}
3088 		mutex_exit(&ill->ill_lock);
3089 		break;
3090 	}
3091 }
3092 
3093 /*
3094  * Process a hardware checksum offload capability negotiation ack received
3095  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
3096  * of a DL_CAPABILITY_ACK message.
3097  */
3098 static void
3099 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3100 {
3101 	dl_capability_req_t	*ocap;
3102 	dl_capab_hcksum_t	*ihck, *ohck;
3103 	ill_hcksum_capab_t	**ill_hcksum;
3104 	mblk_t			*nmp = NULL;
3105 	uint_t			sub_dl_cap = isub->dl_cap;
3106 	uint8_t			*capend;
3107 
3108 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
3109 
3110 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
3111 
3112 	/*
3113 	 * Note: range checks here are not absolutely sufficient to
3114 	 * make us robust against malformed messages sent by drivers;
3115 	 * this is in keeping with the rest of IP's dlpi handling.
3116 	 * (Remember, it's coming from something else in the kernel
3117 	 * address space)
3118 	 */
3119 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3120 	if (capend > mp->b_wptr) {
3121 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3122 		    "malformed sub-capability too long for mblk");
3123 		return;
3124 	}
3125 
3126 	/*
3127 	 * There are two types of acks we process here:
3128 	 * 1. acks in reply to a (first form) generic capability req
3129 	 *    (no ENABLE flag set)
3130 	 * 2. acks in reply to a ENABLE capability req.
3131 	 *    (ENABLE flag set)
3132 	 */
3133 	ihck = (dl_capab_hcksum_t *)(isub + 1);
3134 
3135 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
3136 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
3137 		    "unsupported hardware checksum "
3138 		    "sub-capability (version %d, expected %d)",
3139 		    ihck->hcksum_version, HCKSUM_VERSION_1);
3140 		return;
3141 	}
3142 
3143 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
3144 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
3145 		    "checksum capability isn't as expected; pass-thru "
3146 		    "module(s) detected, discarding capability\n"));
3147 		return;
3148 	}
3149 
3150 #define	CURR_HCKSUM_CAPAB				\
3151 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
3152 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
3153 
3154 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
3155 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
3156 		/* do ENABLE processing */
3157 		if (*ill_hcksum == NULL) {
3158 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
3159 			    KM_NOSLEEP);
3160 
3161 			if (*ill_hcksum == NULL) {
3162 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3163 				    "could not enable hcksum version %d "
3164 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
3165 				    ill->ill_name);
3166 				return;
3167 			}
3168 		}
3169 
3170 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
3171 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
3172 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
3173 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
3174 		    "has enabled hardware checksumming\n ",
3175 		    ill->ill_name));
3176 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
3177 		/*
3178 		 * Enabling hardware checksum offload
3179 		 * Currently IP supports {TCP,UDP}/IPv4
3180 		 * partial and full cksum offload and
3181 		 * IPv4 header checksum offload.
3182 		 * Allocate new mblk which will
3183 		 * contain a new capability request
3184 		 * to enable hardware checksum offload.
3185 		 */
3186 		uint_t	size;
3187 		uchar_t	*rptr;
3188 
3189 		size = sizeof (dl_capability_req_t) +
3190 		    sizeof (dl_capability_sub_t) + isub->dl_length;
3191 
3192 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3193 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
3194 			    "could not enable hardware cksum for %s (ENOMEM)\n",
3195 			    ill->ill_name);
3196 			return;
3197 		}
3198 
3199 		rptr = nmp->b_rptr;
3200 		/* initialize dl_capability_req_t */
3201 		ocap = (dl_capability_req_t *)nmp->b_rptr;
3202 		ocap->dl_sub_offset =
3203 		    sizeof (dl_capability_req_t);
3204 		ocap->dl_sub_length =
3205 		    sizeof (dl_capability_sub_t) +
3206 		    isub->dl_length;
3207 		nmp->b_rptr += sizeof (dl_capability_req_t);
3208 
3209 		/* initialize dl_capability_sub_t */
3210 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
3211 		nmp->b_rptr += sizeof (*isub);
3212 
3213 		/* initialize dl_capab_hcksum_t */
3214 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
3215 		bcopy(ihck, ohck, sizeof (*ihck));
3216 
3217 		nmp->b_rptr = rptr;
3218 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
3219 
3220 		/* Set ENABLE flag */
3221 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
3222 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
3223 
3224 		/*
3225 		 * nmp points to a DL_CAPABILITY_REQ message to enable
3226 		 * hardware checksum acceleration.
3227 		 */
3228 		ill_dlpi_send(ill, nmp);
3229 	} else {
3230 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
3231 		    "advertised %x hardware checksum capability flags\n",
3232 		    ill->ill_name, ihck->hcksum_txflags));
3233 	}
3234 }
3235 
3236 static void
3237 ill_capability_hcksum_reset(ill_t *ill, mblk_t **sc_mp)
3238 {
3239 	mblk_t *mp;
3240 	dl_capab_hcksum_t *hck_subcap;
3241 	dl_capability_sub_t *dl_subcap;
3242 	int size;
3243 
3244 	if (!ILL_HCKSUM_CAPABLE(ill))
3245 		return;
3246 
3247 	ASSERT(ill->ill_hcksum_capab != NULL);
3248 	/*
3249 	 * Clear the capability flag for hardware checksum offload but
3250 	 * retain the ill_hcksum_capab structure since it's possible that
3251 	 * another thread is still referring to it.  The structure only
3252 	 * gets deallocated when we destroy the ill.
3253 	 */
3254 	ill->ill_capabilities &= ~ILL_CAPAB_HCKSUM;
3255 
3256 	size = sizeof (*dl_subcap) + sizeof (*hck_subcap);
3257 
3258 	mp = allocb(size, BPRI_HI);
3259 	if (mp == NULL) {
3260 		ip1dbg(("ill_capability_hcksum_reset: unable to allocate "
3261 		    "request to disable hardware checksum offload\n"));
3262 		return;
3263 	}
3264 
3265 	mp->b_wptr = mp->b_rptr + size;
3266 
3267 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3268 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
3269 	dl_subcap->dl_length = sizeof (*hck_subcap);
3270 
3271 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
3272 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
3273 	hck_subcap->hcksum_txflags = 0;
3274 
3275 	if (*sc_mp != NULL)
3276 		linkb(*sc_mp, mp);
3277 	else
3278 		*sc_mp = mp;
3279 }
3280 
3281 static void
3282 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
3283 {
3284 	mblk_t *nmp = NULL;
3285 	dl_capability_req_t *oc;
3286 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
3287 	ill_zerocopy_capab_t **ill_zerocopy_capab;
3288 	uint_t sub_dl_cap = isub->dl_cap;
3289 	uint8_t *capend;
3290 
3291 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
3292 
3293 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
3294 
3295 	/*
3296 	 * Note: range checks here are not absolutely sufficient to
3297 	 * make us robust against malformed messages sent by drivers;
3298 	 * this is in keeping with the rest of IP's dlpi handling.
3299 	 * (Remember, it's coming from something else in the kernel
3300 	 * address space)
3301 	 */
3302 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
3303 	if (capend > mp->b_wptr) {
3304 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3305 		    "malformed sub-capability too long for mblk");
3306 		return;
3307 	}
3308 
3309 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
3310 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
3311 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
3312 		    "unsupported ZEROCOPY sub-capability (version %d, "
3313 		    "expected %d)", zc_ic->zerocopy_version,
3314 		    ZEROCOPY_VERSION_1);
3315 		return;
3316 	}
3317 
3318 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
3319 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
3320 		    "capability isn't as expected; pass-thru module(s) "
3321 		    "detected, discarding capability\n"));
3322 		return;
3323 	}
3324 
3325 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
3326 		if (*ill_zerocopy_capab == NULL) {
3327 			*ill_zerocopy_capab =
3328 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
3329 			    KM_NOSLEEP);
3330 
3331 			if (*ill_zerocopy_capab == NULL) {
3332 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3333 				    "could not enable Zero-copy version %d "
3334 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
3335 				    ill->ill_name);
3336 				return;
3337 			}
3338 		}
3339 
3340 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
3341 		    "supports Zero-copy version %d\n", ill->ill_name,
3342 		    ZEROCOPY_VERSION_1));
3343 
3344 		(*ill_zerocopy_capab)->ill_zerocopy_version =
3345 		    zc_ic->zerocopy_version;
3346 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
3347 		    zc_ic->zerocopy_flags;
3348 
3349 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
3350 	} else {
3351 		uint_t size;
3352 		uchar_t *rptr;
3353 
3354 		size = sizeof (dl_capability_req_t) +
3355 		    sizeof (dl_capability_sub_t) +
3356 		    sizeof (dl_capab_zerocopy_t);
3357 
3358 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
3359 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
3360 			    "could not enable zerocopy for %s (ENOMEM)\n",
3361 			    ill->ill_name);
3362 			return;
3363 		}
3364 
3365 		rptr = nmp->b_rptr;
3366 		/* initialize dl_capability_req_t */
3367 		oc = (dl_capability_req_t *)rptr;
3368 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
3369 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
3370 		    sizeof (dl_capab_zerocopy_t);
3371 		rptr += sizeof (dl_capability_req_t);
3372 
3373 		/* initialize dl_capability_sub_t */
3374 		bcopy(isub, rptr, sizeof (*isub));
3375 		rptr += sizeof (*isub);
3376 
3377 		/* initialize dl_capab_zerocopy_t */
3378 		zc_oc = (dl_capab_zerocopy_t *)rptr;
3379 		*zc_oc = *zc_ic;
3380 
3381 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
3382 		    "to enable zero-copy version %d\n", ill->ill_name,
3383 		    ZEROCOPY_VERSION_1));
3384 
3385 		/* set VMSAFE_MEM flag */
3386 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
3387 
3388 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
3389 		ill_dlpi_send(ill, nmp);
3390 	}
3391 }
3392 
3393 static void
3394 ill_capability_zerocopy_reset(ill_t *ill, mblk_t **sc_mp)
3395 {
3396 	mblk_t *mp;
3397 	dl_capab_zerocopy_t *zerocopy_subcap;
3398 	dl_capability_sub_t *dl_subcap;
3399 	int size;
3400 
3401 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
3402 		return;
3403 
3404 	ASSERT(ill->ill_zerocopy_capab != NULL);
3405 	/*
3406 	 * Clear the capability flag for Zero-copy but retain the
3407 	 * ill_zerocopy_capab structure since it's possible that another
3408 	 * thread is still referring to it.  The structure only gets
3409 	 * deallocated when we destroy the ill.
3410 	 */
3411 	ill->ill_capabilities &= ~ILL_CAPAB_ZEROCOPY;
3412 
3413 	size = sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
3414 
3415 	mp = allocb(size, BPRI_HI);
3416 	if (mp == NULL) {
3417 		ip1dbg(("ill_capability_zerocopy_reset: unable to allocate "
3418 		    "request to disable Zero-copy\n"));
3419 		return;
3420 	}
3421 
3422 	mp->b_wptr = mp->b_rptr + size;
3423 
3424 	dl_subcap = (dl_capability_sub_t *)mp->b_rptr;
3425 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
3426 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
3427 
3428 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
3429 	zerocopy_subcap->zerocopy_version =
3430 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
3431 	zerocopy_subcap->zerocopy_flags = 0;
3432 
3433 	if (*sc_mp != NULL)
3434 		linkb(*sc_mp, mp);
3435 	else
3436 		*sc_mp = mp;
3437 }
3438 
3439 /*
3440  * Consume a new-style hardware capabilities negotiation ack.
3441  * Called from ip_rput_dlpi_writer().
3442  */
3443 void
3444 ill_capability_ack(ill_t *ill, mblk_t *mp)
3445 {
3446 	dl_capability_ack_t *capp;
3447 	dl_capability_sub_t *subp, *endp;
3448 
3449 	if (ill->ill_dlpi_capab_state == IDS_INPROGRESS)
3450 		ill->ill_dlpi_capab_state = IDS_OK;
3451 
3452 	capp = (dl_capability_ack_t *)mp->b_rptr;
3453 
3454 	if (capp->dl_sub_length == 0)
3455 		/* no new-style capabilities */
3456 		return;
3457 
3458 	/* make sure the driver supplied correct dl_sub_length */
3459 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
3460 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
3461 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
3462 		return;
3463 	}
3464 
3465 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
3466 	/*
3467 	 * There are sub-capabilities. Process the ones we know about.
3468 	 * Loop until we don't have room for another sub-cap header..
3469 	 */
3470 	for (subp = SC(capp, capp->dl_sub_offset),
3471 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
3472 	    subp <= endp;
3473 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
3474 
3475 		switch (subp->dl_cap) {
3476 		case DL_CAPAB_ID_WRAPPER:
3477 			ill_capability_id_ack(ill, mp, subp);
3478 			break;
3479 		default:
3480 			ill_capability_dispatch(ill, mp, subp, B_FALSE);
3481 			break;
3482 		}
3483 	}
3484 #undef SC
3485 }
3486 
3487 /*
3488  * This routine is called to scan the fragmentation reassembly table for
3489  * the specified ILL for any packets that are starting to smell.
3490  * dead_interval is the maximum time in seconds that will be tolerated.  It
3491  * will either be the value specified in ip_g_frag_timeout, or zero if the
3492  * ILL is shutting down and it is time to blow everything off.
3493  *
3494  * It returns the number of seconds (as a time_t) that the next frag timer
3495  * should be scheduled for, 0 meaning that the timer doesn't need to be
3496  * re-started.  Note that the method of calculating next_timeout isn't
3497  * entirely accurate since time will flow between the time we grab
3498  * current_time and the time we schedule the next timeout.  This isn't a
3499  * big problem since this is the timer for sending an ICMP reassembly time
3500  * exceeded messages, and it doesn't have to be exactly accurate.
3501  *
3502  * This function is
3503  * sometimes called as writer, although this is not required.
3504  */
3505 time_t
3506 ill_frag_timeout(ill_t *ill, time_t dead_interval)
3507 {
3508 	ipfb_t	*ipfb;
3509 	ipfb_t	*endp;
3510 	ipf_t	*ipf;
3511 	ipf_t	*ipfnext;
3512 	mblk_t	*mp;
3513 	time_t	current_time = gethrestime_sec();
3514 	time_t	next_timeout = 0;
3515 	uint32_t	hdr_length;
3516 	mblk_t	*send_icmp_head;
3517 	mblk_t	*send_icmp_head_v6;
3518 	zoneid_t zoneid;
3519 
3520 	ipfb = ill->ill_frag_hash_tbl;
3521 	if (ipfb == NULL)
3522 		return (B_FALSE);
3523 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
3524 	/* Walk the frag hash table. */
3525 	for (; ipfb < endp; ipfb++) {
3526 		send_icmp_head = NULL;
3527 		send_icmp_head_v6 = NULL;
3528 		mutex_enter(&ipfb->ipfb_lock);
3529 		while ((ipf = ipfb->ipfb_ipf) != 0) {
3530 			time_t frag_time = current_time - ipf->ipf_timestamp;
3531 			time_t frag_timeout;
3532 
3533 			if (frag_time < dead_interval) {
3534 				/*
3535 				 * There are some outstanding fragments
3536 				 * that will timeout later.  Make note of
3537 				 * the time so that we can reschedule the
3538 				 * next timeout appropriately.
3539 				 */
3540 				frag_timeout = dead_interval - frag_time;
3541 				if (next_timeout == 0 ||
3542 				    frag_timeout < next_timeout) {
3543 					next_timeout = frag_timeout;
3544 				}
3545 				break;
3546 			}
3547 			/* Time's up.  Get it out of here. */
3548 			hdr_length = ipf->ipf_nf_hdr_len;
3549 			ipfnext = ipf->ipf_hash_next;
3550 			if (ipfnext)
3551 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
3552 			*ipf->ipf_ptphn = ipfnext;
3553 			mp = ipf->ipf_mp->b_cont;
3554 			for (; mp; mp = mp->b_cont) {
3555 				/* Extra points for neatness. */
3556 				IP_REASS_SET_START(mp, 0);
3557 				IP_REASS_SET_END(mp, 0);
3558 			}
3559 			mp = ipf->ipf_mp->b_cont;
3560 			ill->ill_frag_count -= ipf->ipf_count;
3561 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
3562 			ipfb->ipfb_count -= ipf->ipf_count;
3563 			ASSERT(ipfb->ipfb_frag_pkts > 0);
3564 			ipfb->ipfb_frag_pkts--;
3565 			/*
3566 			 * We do not send any icmp message from here because
3567 			 * we currently are holding the ipfb_lock for this
3568 			 * hash chain. If we try and send any icmp messages
3569 			 * from here we may end up via a put back into ip
3570 			 * trying to get the same lock, causing a recursive
3571 			 * mutex panic. Instead we build a list and send all
3572 			 * the icmp messages after we have dropped the lock.
3573 			 */
3574 			if (ill->ill_isv6) {
3575 				BUMP_MIB(ill->ill_ip6_mib, ipv6ReasmFails);
3576 				if (hdr_length != 0) {
3577 					mp->b_next = send_icmp_head_v6;
3578 					send_icmp_head_v6 = mp;
3579 				} else {
3580 					freemsg(mp);
3581 				}
3582 			} else {
3583 				BUMP_MIB(&ip_mib, ipReasmFails);
3584 				if (hdr_length != 0) {
3585 					mp->b_next = send_icmp_head;
3586 					send_icmp_head = mp;
3587 				} else {
3588 					freemsg(mp);
3589 				}
3590 			}
3591 			freeb(ipf->ipf_mp);
3592 		}
3593 		mutex_exit(&ipfb->ipfb_lock);
3594 		/*
3595 		 * Now need to send any icmp messages that we delayed from
3596 		 * above.
3597 		 */
3598 		while (send_icmp_head_v6 != NULL) {
3599 			ip6_t *ip6h;
3600 
3601 			mp = send_icmp_head_v6;
3602 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
3603 			mp->b_next = NULL;
3604 			if (mp->b_datap->db_type == M_CTL)
3605 				ip6h = (ip6_t *)mp->b_cont->b_rptr;
3606 			else
3607 				ip6h = (ip6_t *)mp->b_rptr;
3608 			zoneid = ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
3609 			    ill);
3610 			if (zoneid == ALL_ZONES) {
3611 				freemsg(mp);
3612 			} else {
3613 				icmp_time_exceeded_v6(ill->ill_wq, mp,
3614 				    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
3615 				    B_FALSE, zoneid);
3616 			}
3617 		}
3618 		while (send_icmp_head != NULL) {
3619 			ipaddr_t dst;
3620 
3621 			mp = send_icmp_head;
3622 			send_icmp_head = send_icmp_head->b_next;
3623 			mp->b_next = NULL;
3624 
3625 			if (mp->b_datap->db_type == M_CTL)
3626 				dst = ((ipha_t *)mp->b_cont->b_rptr)->ipha_dst;
3627 			else
3628 				dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
3629 
3630 			zoneid = ipif_lookup_addr_zoneid(dst, ill);
3631 			if (zoneid == ALL_ZONES) {
3632 				freemsg(mp);
3633 			} else {
3634 				icmp_time_exceeded(ill->ill_wq, mp,
3635 				    ICMP_REASSEMBLY_TIME_EXCEEDED, zoneid);
3636 			}
3637 		}
3638 	}
3639 	/*
3640 	 * A non-dying ILL will use the return value to decide whether to
3641 	 * restart the frag timer, and for how long.
3642 	 */
3643 	return (next_timeout);
3644 }
3645 
3646 /*
3647  * This routine is called when the approximate count of mblk memory used
3648  * for the specified ILL has exceeded max_count.
3649  */
3650 void
3651 ill_frag_prune(ill_t *ill, uint_t max_count)
3652 {
3653 	ipfb_t	*ipfb;
3654 	ipf_t	*ipf;
3655 	size_t	count;
3656 
3657 	/*
3658 	 * If we are here within ip_min_frag_prune_time msecs remove
3659 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
3660 	 * ill_frag_free_num_pkts.
3661 	 */
3662 	mutex_enter(&ill->ill_lock);
3663 	if (TICK_TO_MSEC(lbolt - ill->ill_last_frag_clean_time) <=
3664 	    (ip_min_frag_prune_time != 0 ?
3665 	    ip_min_frag_prune_time : msec_per_tick)) {
3666 
3667 		ill->ill_frag_free_num_pkts++;
3668 
3669 	} else {
3670 		ill->ill_frag_free_num_pkts = 0;
3671 	}
3672 	ill->ill_last_frag_clean_time = lbolt;
3673 	mutex_exit(&ill->ill_lock);
3674 
3675 	/*
3676 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
3677 	 */
3678 	if (ill->ill_frag_free_num_pkts != 0) {
3679 		int ix;
3680 
3681 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3682 			ipfb = &ill->ill_frag_hash_tbl[ix];
3683 			mutex_enter(&ipfb->ipfb_lock);
3684 			if (ipfb->ipfb_ipf != NULL) {
3685 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
3686 				    ill->ill_frag_free_num_pkts);
3687 			}
3688 			mutex_exit(&ipfb->ipfb_lock);
3689 		}
3690 	}
3691 	/*
3692 	 * While the reassembly list for this ILL is too big, prune a fragment
3693 	 * queue by age, oldest first.  Note that the per ILL count is
3694 	 * approximate, while the per frag hash bucket counts are accurate.
3695 	 */
3696 	while (ill->ill_frag_count > max_count) {
3697 		int	ix;
3698 		ipfb_t	*oipfb = NULL;
3699 		uint_t	oldest = UINT_MAX;
3700 
3701 		count = 0;
3702 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
3703 			ipfb = &ill->ill_frag_hash_tbl[ix];
3704 			mutex_enter(&ipfb->ipfb_lock);
3705 			ipf = ipfb->ipfb_ipf;
3706 			if (ipf != NULL && ipf->ipf_gen < oldest) {
3707 				oldest = ipf->ipf_gen;
3708 				oipfb = ipfb;
3709 			}
3710 			count += ipfb->ipfb_count;
3711 			mutex_exit(&ipfb->ipfb_lock);
3712 		}
3713 		/* Refresh the per ILL count */
3714 		ill->ill_frag_count = count;
3715 		if (oipfb == NULL) {
3716 			ill->ill_frag_count = 0;
3717 			break;
3718 		}
3719 		if (count <= max_count)
3720 			return;	/* Somebody beat us to it, nothing to do */
3721 		mutex_enter(&oipfb->ipfb_lock);
3722 		ipf = oipfb->ipfb_ipf;
3723 		if (ipf != NULL) {
3724 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
3725 		}
3726 		mutex_exit(&oipfb->ipfb_lock);
3727 	}
3728 }
3729 
3730 /*
3731  * free 'free_cnt' fragmented packets starting at ipf.
3732  */
3733 void
3734 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
3735 {
3736 	size_t	count;
3737 	mblk_t	*mp;
3738 	mblk_t	*tmp;
3739 	ipf_t **ipfp = ipf->ipf_ptphn;
3740 
3741 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
3742 	ASSERT(ipfp != NULL);
3743 	ASSERT(ipf != NULL);
3744 
3745 	while (ipf != NULL && free_cnt-- > 0) {
3746 		count = ipf->ipf_count;
3747 		mp = ipf->ipf_mp;
3748 		ipf = ipf->ipf_hash_next;
3749 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
3750 			IP_REASS_SET_START(tmp, 0);
3751 			IP_REASS_SET_END(tmp, 0);
3752 		}
3753 		ill->ill_frag_count -= count;
3754 		ASSERT(ipfb->ipfb_count >= count);
3755 		ipfb->ipfb_count -= count;
3756 		ASSERT(ipfb->ipfb_frag_pkts > 0);
3757 		ipfb->ipfb_frag_pkts--;
3758 		freemsg(mp);
3759 		BUMP_MIB(&ip_mib, ipReasmFails);
3760 	}
3761 
3762 	if (ipf)
3763 		ipf->ipf_ptphn = ipfp;
3764 	ipfp[0] = ipf;
3765 }
3766 
3767 #define	ND_FORWARD_WARNING	"The <if>:ip*_forwarding ndd variables are " \
3768 	"obsolete and may be removed in a future release of Solaris.  Use " \
3769 	"ifconfig(1M) to manipulate the forwarding status of an interface."
3770 
3771 /*
3772  * For obsolete per-interface forwarding configuration;
3773  * called in response to ND_GET.
3774  */
3775 /* ARGSUSED */
3776 static int
3777 nd_ill_forward_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *ioc_cr)
3778 {
3779 	ill_t *ill = (ill_t *)cp;
3780 
3781 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3782 
3783 	(void) mi_mpprintf(mp, "%d", (ill->ill_flags & ILLF_ROUTER) != 0);
3784 	return (0);
3785 }
3786 
3787 /*
3788  * For obsolete per-interface forwarding configuration;
3789  * called in response to ND_SET.
3790  */
3791 /* ARGSUSED */
3792 static int
3793 nd_ill_forward_set(queue_t *q, mblk_t *mp, char *valuestr, caddr_t cp,
3794     cred_t *ioc_cr)
3795 {
3796 	long value;
3797 	int retval;
3798 
3799 	cmn_err(CE_WARN, ND_FORWARD_WARNING);
3800 
3801 	if (ddi_strtol(valuestr, NULL, 10, &value) != 0 ||
3802 	    value < 0 || value > 1) {
3803 		return (EINVAL);
3804 	}
3805 
3806 	rw_enter(&ill_g_lock, RW_READER);
3807 	retval = ill_forward_set(q, mp, (value != 0), cp);
3808 	rw_exit(&ill_g_lock);
3809 	return (retval);
3810 }
3811 
3812 /*
3813  * Set an ill's ILLF_ROUTER flag appropriately.  If the ill is part of an
3814  * IPMP group, make sure all ill's in the group adopt the new policy.  Send
3815  * up RTS_IFINFO routing socket messages for each interface whose flags we
3816  * change.
3817  */
3818 /* ARGSUSED */
3819 int
3820 ill_forward_set(queue_t *q, mblk_t *mp, boolean_t enable, caddr_t cp)
3821 {
3822 	ill_t *ill = (ill_t *)cp;
3823 	ill_group_t *illgrp;
3824 
3825 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ill_g_lock));
3826 
3827 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
3828 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)) ||
3829 	    (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK))
3830 		return (EINVAL);
3831 
3832 	/*
3833 	 * If the ill is in an IPMP group, set the forwarding policy on all
3834 	 * members of the group to the same value.
3835 	 */
3836 	illgrp = ill->ill_group;
3837 	if (illgrp != NULL) {
3838 		ill_t *tmp_ill;
3839 
3840 		for (tmp_ill = illgrp->illgrp_ill; tmp_ill != NULL;
3841 		    tmp_ill = tmp_ill->ill_group_next) {
3842 			ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3843 			    (enable ? "Enabling" : "Disabling"),
3844 			    (tmp_ill->ill_isv6 ? "IPv6" : "IPv4"),
3845 			    tmp_ill->ill_name));
3846 			mutex_enter(&tmp_ill->ill_lock);
3847 			if (enable)
3848 				tmp_ill->ill_flags |= ILLF_ROUTER;
3849 			else
3850 				tmp_ill->ill_flags &= ~ILLF_ROUTER;
3851 			mutex_exit(&tmp_ill->ill_lock);
3852 			if (tmp_ill->ill_isv6)
3853 				ill_set_nce_router_flags(tmp_ill, enable);
3854 			/* Notify routing socket listeners of this change. */
3855 			ip_rts_ifmsg(tmp_ill->ill_ipif);
3856 		}
3857 	} else {
3858 		ip1dbg(("ill_forward_set: %s %s forwarding on %s",
3859 		    (enable ? "Enabling" : "Disabling"),
3860 		    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
3861 		mutex_enter(&ill->ill_lock);
3862 		if (enable)
3863 			ill->ill_flags |= ILLF_ROUTER;
3864 		else
3865 			ill->ill_flags &= ~ILLF_ROUTER;
3866 		mutex_exit(&ill->ill_lock);
3867 		if (ill->ill_isv6)
3868 			ill_set_nce_router_flags(ill, enable);
3869 		/* Notify routing socket listeners of this change. */
3870 		ip_rts_ifmsg(ill->ill_ipif);
3871 	}
3872 
3873 	return (0);
3874 }
3875 
3876 /*
3877  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
3878  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
3879  * set or clear.
3880  */
3881 static void
3882 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
3883 {
3884 	ipif_t *ipif;
3885 	nce_t *nce;
3886 
3887 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
3888 		nce = ndp_lookup_v6(ill, &ipif->ipif_v6lcl_addr, B_FALSE);
3889 		if (nce != NULL) {
3890 			mutex_enter(&nce->nce_lock);
3891 			if (enable)
3892 				nce->nce_flags |= NCE_F_ISROUTER;
3893 			else
3894 				nce->nce_flags &= ~NCE_F_ISROUTER;
3895 			mutex_exit(&nce->nce_lock);
3896 			NCE_REFRELE(nce);
3897 		}
3898 	}
3899 }
3900 
3901 /*
3902  * Given an ill with a _valid_ name, add the ip_forwarding ndd variable
3903  * for this ill.  Make sure the v6/v4 question has been answered about this
3904  * ill.  The creation of this ndd variable is only for backwards compatibility.
3905  * The preferred way to control per-interface IP forwarding is through the
3906  * ILLF_ROUTER interface flag.
3907  */
3908 static int
3909 ill_set_ndd_name(ill_t *ill)
3910 {
3911 	char *suffix;
3912 
3913 	ASSERT(IAM_WRITER_ILL(ill));
3914 
3915 	if (ill->ill_isv6)
3916 		suffix = ipv6_forward_suffix;
3917 	else
3918 		suffix = ipv4_forward_suffix;
3919 
3920 	ill->ill_ndd_name = ill->ill_name + ill->ill_name_length;
3921 	bcopy(ill->ill_name, ill->ill_ndd_name, ill->ill_name_length - 1);
3922 	/*
3923 	 * Copies over the '\0'.
3924 	 * Note that strlen(suffix) is always bounded.
3925 	 */
3926 	bcopy(suffix, ill->ill_ndd_name + ill->ill_name_length - 1,
3927 	    strlen(suffix) + 1);
3928 
3929 	/*
3930 	 * Use of the nd table requires holding the reader lock.
3931 	 * Modifying the nd table thru nd_load/nd_unload requires
3932 	 * the writer lock.
3933 	 */
3934 	rw_enter(&ip_g_nd_lock, RW_WRITER);
3935 	if (!nd_load(&ip_g_nd, ill->ill_ndd_name, nd_ill_forward_get,
3936 	    nd_ill_forward_set, (caddr_t)ill)) {
3937 		/*
3938 		 * If the nd_load failed, it only meant that it could not
3939 		 * allocate a new bunch of room for further NDD expansion.
3940 		 * Because of that, the ill_ndd_name will be set to 0, and
3941 		 * this interface is at the mercy of the global ip_forwarding
3942 		 * variable.
3943 		 */
3944 		rw_exit(&ip_g_nd_lock);
3945 		ill->ill_ndd_name = NULL;
3946 		return (ENOMEM);
3947 	}
3948 	rw_exit(&ip_g_nd_lock);
3949 	return (0);
3950 }
3951 
3952 /*
3953  * Intializes the context structure and returns the first ill in the list
3954  * cuurently start_list and end_list can have values:
3955  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
3956  * IP_V4_G_HEAD		Traverse IPV4 list only.
3957  * IP_V6_G_HEAD		Traverse IPV6 list only.
3958  */
3959 
3960 /*
3961  * We don't check for CONDEMNED ills here. Caller must do that if
3962  * necessary under the ill lock.
3963  */
3964 ill_t *
3965 ill_first(int start_list, int end_list, ill_walk_context_t *ctx)
3966 {
3967 	ill_if_t *ifp;
3968 	ill_t *ill;
3969 	avl_tree_t *avl_tree;
3970 
3971 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
3972 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
3973 
3974 	/*
3975 	 * setup the lists to search
3976 	 */
3977 	if (end_list != MAX_G_HEADS) {
3978 		ctx->ctx_current_list = start_list;
3979 		ctx->ctx_last_list = end_list;
3980 	} else {
3981 		ctx->ctx_last_list = MAX_G_HEADS - 1;
3982 		ctx->ctx_current_list = 0;
3983 	}
3984 
3985 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
3986 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
3987 		if (ifp != (ill_if_t *)
3988 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
3989 			avl_tree = &ifp->illif_avl_by_ppa;
3990 			ill = avl_first(avl_tree);
3991 			/*
3992 			 * ill is guaranteed to be non NULL or ifp should have
3993 			 * not existed.
3994 			 */
3995 			ASSERT(ill != NULL);
3996 			return (ill);
3997 		}
3998 		ctx->ctx_current_list++;
3999 	}
4000 
4001 	return (NULL);
4002 }
4003 
4004 /*
4005  * returns the next ill in the list. ill_first() must have been called
4006  * before calling ill_next() or bad things will happen.
4007  */
4008 
4009 /*
4010  * We don't check for CONDEMNED ills here. Caller must do that if
4011  * necessary under the ill lock.
4012  */
4013 ill_t *
4014 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
4015 {
4016 	ill_if_t *ifp;
4017 	ill_t *ill;
4018 
4019 
4020 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
4021 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
4022 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list));
4023 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
4024 	    AVL_AFTER)) != NULL) {
4025 		return (ill);
4026 	}
4027 
4028 	/* goto next ill_ifp in the list. */
4029 	ifp = lastill->ill_ifptr->illif_next;
4030 
4031 	/* make sure not at end of circular list */
4032 	while (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list)) {
4033 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
4034 			return (NULL);
4035 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list);
4036 	}
4037 
4038 	return (avl_first(&ifp->illif_avl_by_ppa));
4039 }
4040 
4041 /*
4042  * Check interface name for correct format which is name+ppa.
4043  * name can contain characters and digits, the right most digits
4044  * make up the ppa number. use of octal is not allowed, name must contain
4045  * a ppa, return pointer to the start of ppa.
4046  * In case of error return NULL.
4047  */
4048 static char *
4049 ill_get_ppa_ptr(char *name)
4050 {
4051 	int namelen = mi_strlen(name);
4052 
4053 	int len = namelen;
4054 
4055 	name += len;
4056 	while (len > 0) {
4057 		name--;
4058 		if (*name < '0' || *name > '9')
4059 			break;
4060 		len--;
4061 	}
4062 
4063 	/* empty string, all digits, or no trailing digits */
4064 	if (len == 0 || len == (int)namelen)
4065 		return (NULL);
4066 
4067 	name++;
4068 	/* check for attempted use of octal */
4069 	if (*name == '0' && len != (int)namelen - 1)
4070 		return (NULL);
4071 	return (name);
4072 }
4073 
4074 /*
4075  * use avl tree to locate the ill.
4076  */
4077 static ill_t *
4078 ill_find_by_name(char *name, boolean_t isv6, queue_t *q, mblk_t *mp,
4079     ipsq_func_t func, int *error)
4080 {
4081 	char *ppa_ptr = NULL;
4082 	int len;
4083 	uint_t ppa;
4084 	ill_t *ill = NULL;
4085 	ill_if_t *ifp;
4086 	int list;
4087 	ipsq_t *ipsq;
4088 
4089 	if (error != NULL)
4090 		*error = 0;
4091 
4092 	/*
4093 	 * get ppa ptr
4094 	 */
4095 	if (isv6)
4096 		list = IP_V6_G_HEAD;
4097 	else
4098 		list = IP_V4_G_HEAD;
4099 
4100 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
4101 		if (error != NULL)
4102 			*error = ENXIO;
4103 		return (NULL);
4104 	}
4105 
4106 	len = ppa_ptr - name + 1;
4107 
4108 	ppa = stoi(&ppa_ptr);
4109 
4110 	ifp = IP_VX_ILL_G_LIST(list);
4111 
4112 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4113 		/*
4114 		 * match is done on len - 1 as the name is not null
4115 		 * terminated it contains ppa in addition to the interface
4116 		 * name.
4117 		 */
4118 		if ((ifp->illif_name_len == len) &&
4119 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
4120 			break;
4121 		} else {
4122 			ifp = ifp->illif_next;
4123 		}
4124 	}
4125 
4126 
4127 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list)) {
4128 		/*
4129 		 * Even the interface type does not exist.
4130 		 */
4131 		if (error != NULL)
4132 			*error = ENXIO;
4133 		return (NULL);
4134 	}
4135 
4136 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
4137 	if (ill != NULL) {
4138 		/*
4139 		 * The block comment at the start of ipif_down
4140 		 * explains the use of the macros used below
4141 		 */
4142 		GRAB_CONN_LOCK(q);
4143 		mutex_enter(&ill->ill_lock);
4144 		if (ILL_CAN_LOOKUP(ill)) {
4145 			ill_refhold_locked(ill);
4146 			mutex_exit(&ill->ill_lock);
4147 			RELEASE_CONN_LOCK(q);
4148 			return (ill);
4149 		} else if (ILL_CAN_WAIT(ill, q)) {
4150 			ipsq = ill->ill_phyint->phyint_ipsq;
4151 			mutex_enter(&ipsq->ipsq_lock);
4152 			mutex_exit(&ill->ill_lock);
4153 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
4154 			mutex_exit(&ipsq->ipsq_lock);
4155 			RELEASE_CONN_LOCK(q);
4156 			*error = EINPROGRESS;
4157 			return (NULL);
4158 		}
4159 		mutex_exit(&ill->ill_lock);
4160 		RELEASE_CONN_LOCK(q);
4161 	}
4162 	if (error != NULL)
4163 		*error = ENXIO;
4164 	return (NULL);
4165 }
4166 
4167 /*
4168  * comparison function for use with avl.
4169  */
4170 static int
4171 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
4172 {
4173 	uint_t ppa;
4174 	uint_t ill_ppa;
4175 
4176 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
4177 
4178 	ppa = *((uint_t *)ppa_ptr);
4179 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
4180 	/*
4181 	 * We want the ill with the lowest ppa to be on the
4182 	 * top.
4183 	 */
4184 	if (ill_ppa < ppa)
4185 		return (1);
4186 	if (ill_ppa > ppa)
4187 		return (-1);
4188 	return (0);
4189 }
4190 
4191 /*
4192  * remove an interface type from the global list.
4193  */
4194 static void
4195 ill_delete_interface_type(ill_if_t *interface)
4196 {
4197 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4198 
4199 	ASSERT(interface != NULL);
4200 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
4201 
4202 	avl_destroy(&interface->illif_avl_by_ppa);
4203 	if (interface->illif_ppa_arena != NULL)
4204 		vmem_destroy(interface->illif_ppa_arena);
4205 
4206 	remque(interface);
4207 
4208 	mi_free(interface);
4209 }
4210 
4211 /* Defined in ip_netinfo.c */
4212 extern ddi_taskq_t	*eventq_queue_nic;
4213 
4214 /*
4215  * remove ill from the global list.
4216  */
4217 static void
4218 ill_glist_delete(ill_t *ill)
4219 {
4220 	char *nicname;
4221 	size_t nicnamelen;
4222 	hook_nic_event_t *info;
4223 
4224 	if (ill == NULL)
4225 		return;
4226 
4227 	rw_enter(&ill_g_lock, RW_WRITER);
4228 
4229 	if (ill->ill_name != NULL) {
4230 		nicname = kmem_alloc(ill->ill_name_length, KM_NOSLEEP);
4231 		if (nicname != NULL) {
4232 			bcopy(ill->ill_name, nicname, ill->ill_name_length);
4233 			nicnamelen = ill->ill_name_length;
4234 		}
4235 	} else {
4236 		nicname = NULL;
4237 		nicnamelen = 0;
4238 	}
4239 
4240 	/*
4241 	 * If the ill was never inserted into the AVL tree
4242 	 * we skip the if branch.
4243 	 */
4244 	if (ill->ill_ifptr != NULL) {
4245 		/*
4246 		 * remove from AVL tree and free ppa number
4247 		 */
4248 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
4249 
4250 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
4251 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
4252 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4253 		}
4254 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
4255 			ill_delete_interface_type(ill->ill_ifptr);
4256 		}
4257 
4258 		/*
4259 		 * Indicate ill is no longer in the list.
4260 		 */
4261 		ill->ill_ifptr = NULL;
4262 		ill->ill_name_length = 0;
4263 		ill->ill_name[0] = '\0';
4264 		ill->ill_ppa = UINT_MAX;
4265 	}
4266 
4267 	/*
4268 	 * Run the unplumb hook after the NIC has disappeared from being
4269 	 * visible so that attempts to revalidate its existance will fail.
4270 	 *
4271 	 * This needs to be run inside the ill_g_lock perimeter to ensure
4272 	 * that the ordering of delivered events to listeners matches the
4273 	 * order of them in the kernel.
4274 	 */
4275 	if ((info = ill->ill_nic_event_info) != NULL) {
4276 		if (info->hne_event != NE_DOWN) {
4277 			ip2dbg(("ill_glist_delete: unexpected nic event %d "
4278 			    "attached for %s\n", info->hne_event,
4279 			    ill->ill_name));
4280 			if (info->hne_data != NULL)
4281 				kmem_free(info->hne_data, info->hne_datalen);
4282 			kmem_free(info, sizeof (hook_nic_event_t));
4283 		} else {
4284 			if (ddi_taskq_dispatch(eventq_queue_nic,
4285 			    ip_ne_queue_func, (void *)info, DDI_SLEEP)
4286 			    == DDI_FAILURE) {
4287 				ip2dbg(("ill_glist_delete: ddi_taskq_dispatch "
4288 				    "failed\n"));
4289 				if (info->hne_data != NULL)
4290 					kmem_free(info->hne_data,
4291 					    info->hne_datalen);
4292 				kmem_free(info, sizeof (hook_nic_event_t));
4293 			}
4294 		}
4295 	}
4296 
4297 	info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP);
4298 	if (info != NULL) {
4299 		info->hne_nic = ill->ill_phyint->phyint_ifindex;
4300 		info->hne_lif = 0;
4301 		info->hne_event = NE_UNPLUMB;
4302 		info->hne_data = nicname;
4303 		info->hne_datalen = nicnamelen;
4304 		info->hne_family = ill->ill_isv6 ? ipv6 : ipv4;
4305 	} else {
4306 		ip2dbg(("ill_glist_delete: could not attach UNPLUMB nic event "
4307 		    "information for %s (ENOMEM)\n", ill->ill_name));
4308 		if (nicname != NULL)
4309 			kmem_free(nicname, nicnamelen);
4310 	}
4311 
4312 	ill->ill_nic_event_info = info;
4313 
4314 	ill_phyint_free(ill);
4315 
4316 	rw_exit(&ill_g_lock);
4317 }
4318 
4319 /*
4320  * allocate a ppa, if the number of plumbed interfaces of this type are
4321  * less than ill_no_arena do a linear search to find a unused ppa.
4322  * When the number goes beyond ill_no_arena switch to using an arena.
4323  * Note: ppa value of zero cannot be allocated from vmem_arena as it
4324  * is the return value for an error condition, so allocation starts at one
4325  * and is decremented by one.
4326  */
4327 static int
4328 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
4329 {
4330 	ill_t *tmp_ill;
4331 	uint_t start, end;
4332 	int ppa;
4333 
4334 	if (ifp->illif_ppa_arena == NULL &&
4335 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
4336 		/*
4337 		 * Create an arena.
4338 		 */
4339 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
4340 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
4341 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
4342 			/* allocate what has already been assigned */
4343 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
4344 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
4345 		    tmp_ill, AVL_AFTER)) {
4346 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4347 			    1,		/* size */
4348 			    1,		/* align/quantum */
4349 			    0,		/* phase */
4350 			    0,		/* nocross */
4351 		(void *)((uintptr_t)tmp_ill->ill_ppa + 1), /* minaddr */
4352 		(void *)((uintptr_t)tmp_ill->ill_ppa + 2), /* maxaddr */
4353 			    VM_NOSLEEP|VM_FIRSTFIT);
4354 			if (ppa == 0) {
4355 				ip1dbg(("ill_alloc_ppa: ppa allocation"
4356 				    " failed while switching"));
4357 				vmem_destroy(ifp->illif_ppa_arena);
4358 				ifp->illif_ppa_arena = NULL;
4359 				break;
4360 			}
4361 		}
4362 	}
4363 
4364 	if (ifp->illif_ppa_arena != NULL) {
4365 		if (ill->ill_ppa == UINT_MAX) {
4366 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
4367 			    1, VM_NOSLEEP|VM_FIRSTFIT);
4368 			if (ppa == 0)
4369 				return (EAGAIN);
4370 			ill->ill_ppa = --ppa;
4371 		} else {
4372 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
4373 			    1, 		/* size */
4374 			    1, 		/* align/quantum */
4375 			    0, 		/* phase */
4376 			    0, 		/* nocross */
4377 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
4378 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
4379 			    VM_NOSLEEP|VM_FIRSTFIT);
4380 			/*
4381 			 * Most likely the allocation failed because
4382 			 * the requested ppa was in use.
4383 			 */
4384 			if (ppa == 0)
4385 				return (EEXIST);
4386 		}
4387 		return (0);
4388 	}
4389 
4390 	/*
4391 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
4392 	 * been plumbed to create one. Do a linear search to get a unused ppa.
4393 	 */
4394 	if (ill->ill_ppa == UINT_MAX) {
4395 		end = UINT_MAX - 1;
4396 		start = 0;
4397 	} else {
4398 		end = start = ill->ill_ppa;
4399 	}
4400 
4401 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
4402 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
4403 		if (start++ >= end) {
4404 			if (ill->ill_ppa == UINT_MAX)
4405 				return (EAGAIN);
4406 			else
4407 				return (EEXIST);
4408 		}
4409 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
4410 	}
4411 	ill->ill_ppa = start;
4412 	return (0);
4413 }
4414 
4415 /*
4416  * Insert ill into the list of configured ill's. Once this function completes,
4417  * the ill is globally visible and is available through lookups. More precisely
4418  * this happens after the caller drops the ill_g_lock.
4419  */
4420 static int
4421 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
4422 {
4423 	ill_if_t *ill_interface;
4424 	avl_index_t where = 0;
4425 	int error;
4426 	int name_length;
4427 	int index;
4428 	boolean_t check_length = B_FALSE;
4429 
4430 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
4431 
4432 	name_length = mi_strlen(name) + 1;
4433 
4434 	if (isv6)
4435 		index = IP_V6_G_HEAD;
4436 	else
4437 		index = IP_V4_G_HEAD;
4438 
4439 	ill_interface = IP_VX_ILL_G_LIST(index);
4440 	/*
4441 	 * Search for interface type based on name
4442 	 */
4443 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4444 		if ((ill_interface->illif_name_len == name_length) &&
4445 		    (strcmp(ill_interface->illif_name, name) == 0)) {
4446 			break;
4447 		}
4448 		ill_interface = ill_interface->illif_next;
4449 	}
4450 
4451 	/*
4452 	 * Interface type not found, create one.
4453 	 */
4454 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index)) {
4455 
4456 		ill_g_head_t ghead;
4457 
4458 		/*
4459 		 * allocate ill_if_t structure
4460 		 */
4461 
4462 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
4463 		if (ill_interface == NULL) {
4464 			return (ENOMEM);
4465 		}
4466 
4467 
4468 
4469 		(void) strcpy(ill_interface->illif_name, name);
4470 		ill_interface->illif_name_len = name_length;
4471 
4472 		avl_create(&ill_interface->illif_avl_by_ppa,
4473 		    ill_compare_ppa, sizeof (ill_t),
4474 		    offsetof(struct ill_s, ill_avl_byppa));
4475 
4476 		/*
4477 		 * link the structure in the back to maintain order
4478 		 * of configuration for ifconfig output.
4479 		 */
4480 		ghead = ill_g_heads[index];
4481 		insque(ill_interface, ghead.ill_g_list_tail);
4482 
4483 	}
4484 
4485 	if (ill->ill_ppa == UINT_MAX)
4486 		check_length = B_TRUE;
4487 
4488 	error = ill_alloc_ppa(ill_interface, ill);
4489 	if (error != 0) {
4490 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
4491 			ill_delete_interface_type(ill->ill_ifptr);
4492 		return (error);
4493 	}
4494 
4495 	/*
4496 	 * When the ppa is choosen by the system, check that there is
4497 	 * enough space to insert ppa. if a specific ppa was passed in this
4498 	 * check is not required as the interface name passed in will have
4499 	 * the right ppa in it.
4500 	 */
4501 	if (check_length) {
4502 		/*
4503 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
4504 		 */
4505 		char buf[sizeof (uint_t) * 3];
4506 
4507 		/*
4508 		 * convert ppa to string to calculate the amount of space
4509 		 * required for it in the name.
4510 		 */
4511 		numtos(ill->ill_ppa, buf);
4512 
4513 		/* Do we have enough space to insert ppa ? */
4514 
4515 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
4516 			/* Free ppa and interface type struct */
4517 			if (ill_interface->illif_ppa_arena != NULL) {
4518 				vmem_free(ill_interface->illif_ppa_arena,
4519 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
4520 			}
4521 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) ==
4522 			    0) {
4523 				ill_delete_interface_type(ill->ill_ifptr);
4524 			}
4525 
4526 			return (EINVAL);
4527 		}
4528 	}
4529 
4530 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
4531 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
4532 
4533 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
4534 	    &where);
4535 	ill->ill_ifptr = ill_interface;
4536 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
4537 
4538 	ill_phyint_reinit(ill);
4539 	return (0);
4540 }
4541 
4542 /* Initialize the per phyint (per IPMP group) ipsq used for serialization */
4543 static boolean_t
4544 ipsq_init(ill_t *ill)
4545 {
4546 	ipsq_t  *ipsq;
4547 
4548 	/* Init the ipsq and impicitly enter as writer */
4549 	ill->ill_phyint->phyint_ipsq =
4550 	    kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
4551 	if (ill->ill_phyint->phyint_ipsq == NULL)
4552 		return (B_FALSE);
4553 	ipsq = ill->ill_phyint->phyint_ipsq;
4554 	ipsq->ipsq_phyint_list = ill->ill_phyint;
4555 	ill->ill_phyint->phyint_ipsq_next = NULL;
4556 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
4557 	ipsq->ipsq_refs = 1;
4558 	ipsq->ipsq_writer = curthread;
4559 	ipsq->ipsq_reentry_cnt = 1;
4560 #ifdef ILL_DEBUG
4561 	ipsq->ipsq_depth = getpcstack((pc_t *)ipsq->ipsq_stack, IP_STACK_DEPTH);
4562 #endif
4563 	(void) strcpy(ipsq->ipsq_name, ill->ill_name);
4564 	return (B_TRUE);
4565 }
4566 
4567 /*
4568  * ill_init is called by ip_open when a device control stream is opened.
4569  * It does a few initializations, and shoots a DL_INFO_REQ message down
4570  * to the driver.  The response is later picked up in ip_rput_dlpi and
4571  * used to set up default mechanisms for talking to the driver.  (Always
4572  * called as writer.)
4573  *
4574  * If this function returns error, ip_open will call ip_close which in
4575  * turn will call ill_delete to clean up any memory allocated here that
4576  * is not yet freed.
4577  */
4578 int
4579 ill_init(queue_t *q, ill_t *ill)
4580 {
4581 	int	count;
4582 	dl_info_req_t	*dlir;
4583 	mblk_t	*info_mp;
4584 	uchar_t *frag_ptr;
4585 
4586 	/*
4587 	 * The ill is initialized to zero by mi_alloc*(). In addition
4588 	 * some fields already contain valid values, initialized in
4589 	 * ip_open(), before we reach here.
4590 	 */
4591 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
4592 
4593 	ill->ill_rq = q;
4594 	ill->ill_wq = WR(q);
4595 
4596 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
4597 	    BPRI_HI);
4598 	if (info_mp == NULL)
4599 		return (ENOMEM);
4600 
4601 	/*
4602 	 * Allocate sufficient space to contain our fragment hash table and
4603 	 * the device name.
4604 	 */
4605 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE +
4606 	    2 * LIFNAMSIZ + 5 + strlen(ipv6_forward_suffix));
4607 	if (frag_ptr == NULL) {
4608 		freemsg(info_mp);
4609 		return (ENOMEM);
4610 	}
4611 	ill->ill_frag_ptr = frag_ptr;
4612 	ill->ill_frag_free_num_pkts = 0;
4613 	ill->ill_last_frag_clean_time = 0;
4614 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
4615 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
4616 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
4617 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
4618 		    NULL, MUTEX_DEFAULT, NULL);
4619 	}
4620 
4621 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4622 	if (ill->ill_phyint == NULL) {
4623 		freemsg(info_mp);
4624 		mi_free(frag_ptr);
4625 		return (ENOMEM);
4626 	}
4627 
4628 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4629 	/*
4630 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
4631 	 * at this point because of the following reason. If we can't
4632 	 * enter the ipsq at some point and cv_wait, the writer that
4633 	 * wakes us up tries to locate us using the list of all phyints
4634 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
4635 	 * If we don't set it now, we risk a missed wakeup.
4636 	 */
4637 	ill->ill_phyint->phyint_illv4 = ill;
4638 	ill->ill_ppa = UINT_MAX;
4639 	ill->ill_fastpath_list = &ill->ill_fastpath_list;
4640 
4641 	if (!ipsq_init(ill)) {
4642 		freemsg(info_mp);
4643 		mi_free(frag_ptr);
4644 		mi_free(ill->ill_phyint);
4645 		return (ENOMEM);
4646 	}
4647 
4648 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
4649 
4650 
4651 	/* Frag queue limit stuff */
4652 	ill->ill_frag_count = 0;
4653 	ill->ill_ipf_gen = 0;
4654 
4655 	ill->ill_global_timer = INFINITY;
4656 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4657 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4658 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4659 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4660 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4661 
4662 	/*
4663 	 * Initialize IPv6 configuration variables.  The IP module is always
4664 	 * opened as an IPv4 module.  Instead tracking down the cases where
4665 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
4666 	 * here for convenience, this has no effect until the ill is set to do
4667 	 * IPv6.
4668 	 */
4669 	ill->ill_reachable_time = ND_REACHABLE_TIME;
4670 	ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
4671 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
4672 	ill->ill_max_buf = ND_MAX_Q;
4673 	ill->ill_refcnt = 0;
4674 
4675 	/* Send down the Info Request to the driver. */
4676 	info_mp->b_datap->db_type = M_PCPROTO;
4677 	dlir = (dl_info_req_t *)info_mp->b_rptr;
4678 	info_mp->b_wptr = (uchar_t *)&dlir[1];
4679 	dlir->dl_primitive = DL_INFO_REQ;
4680 
4681 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
4682 
4683 	qprocson(q);
4684 	ill_dlpi_send(ill, info_mp);
4685 
4686 	return (0);
4687 }
4688 
4689 /*
4690  * ill_dls_info
4691  * creates datalink socket info from the device.
4692  */
4693 int
4694 ill_dls_info(struct sockaddr_dl *sdl, const ipif_t *ipif)
4695 {
4696 	size_t	length;
4697 	ill_t	*ill = ipif->ipif_ill;
4698 
4699 	sdl->sdl_family = AF_LINK;
4700 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4701 	sdl->sdl_type = ipif->ipif_type;
4702 	(void) ipif_get_name(ipif, sdl->sdl_data, sizeof (sdl->sdl_data));
4703 	length = mi_strlen(sdl->sdl_data);
4704 	ASSERT(length < 256);
4705 	sdl->sdl_nlen = (uchar_t)length;
4706 	sdl->sdl_alen = ill->ill_phys_addr_length;
4707 	mutex_enter(&ill->ill_lock);
4708 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL) {
4709 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[length],
4710 		    ill->ill_phys_addr_length);
4711 	}
4712 	mutex_exit(&ill->ill_lock);
4713 	sdl->sdl_slen = 0;
4714 	return (sizeof (struct sockaddr_dl));
4715 }
4716 
4717 /*
4718  * ill_xarp_info
4719  * creates xarp info from the device.
4720  */
4721 static int
4722 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
4723 {
4724 	sdl->sdl_family = AF_LINK;
4725 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
4726 	sdl->sdl_type = ill->ill_type;
4727 	(void) ipif_get_name(ill->ill_ipif, sdl->sdl_data,
4728 	    sizeof (sdl->sdl_data));
4729 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
4730 	sdl->sdl_alen = ill->ill_phys_addr_length;
4731 	sdl->sdl_slen = 0;
4732 	return (sdl->sdl_nlen);
4733 }
4734 
4735 static int
4736 loopback_kstat_update(kstat_t *ksp, int rw)
4737 {
4738 	kstat_named_t *kn = KSTAT_NAMED_PTR(ksp);
4739 
4740 	if (rw == KSTAT_WRITE)
4741 		return (EACCES);
4742 	kn[0].value.ui32 = loopback_packets;
4743 	kn[1].value.ui32 = loopback_packets;
4744 	return (0);
4745 }
4746 
4747 
4748 /*
4749  * Has ifindex been plumbed already.
4750  */
4751 static boolean_t
4752 phyint_exists(uint_t index)
4753 {
4754 	phyint_t *phyi;
4755 
4756 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
4757 	/*
4758 	 * Indexes are stored in the phyint - a common structure
4759 	 * to both IPv4 and IPv6.
4760 	 */
4761 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
4762 	    (void *) &index, NULL);
4763 	return (phyi != NULL);
4764 }
4765 
4766 /*
4767  * Assign a unique interface index for the phyint.
4768  */
4769 static boolean_t
4770 phyint_assign_ifindex(phyint_t *phyi)
4771 {
4772 	uint_t starting_index;
4773 
4774 	ASSERT(phyi->phyint_ifindex == 0);
4775 	if (!ill_index_wrap) {
4776 		phyi->phyint_ifindex = ill_index++;
4777 		if (ill_index == 0) {
4778 			/* Reached the uint_t limit Next time wrap  */
4779 			ill_index_wrap = B_TRUE;
4780 		}
4781 		return (B_TRUE);
4782 	}
4783 
4784 	/*
4785 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
4786 	 * at this point and don't want to call any function that attempts
4787 	 * to get the lock again.
4788 	 */
4789 	starting_index = ill_index++;
4790 	for (; ill_index != starting_index; ill_index++) {
4791 		if (ill_index != 0 && !phyint_exists(ill_index)) {
4792 			/* found unused index - use it */
4793 			phyi->phyint_ifindex = ill_index;
4794 			return (B_TRUE);
4795 		}
4796 	}
4797 
4798 	/*
4799 	 * all interface indicies are inuse.
4800 	 */
4801 	return (B_FALSE);
4802 }
4803 
4804 /*
4805  * Return a pointer to the ill which matches the supplied name.  Note that
4806  * the ill name length includes the null termination character.  (May be
4807  * called as writer.)
4808  * If do_alloc and the interface is "lo0" it will be automatically created.
4809  * Cannot bump up reference on condemned ills. So dup detect can't be done
4810  * using this func.
4811  */
4812 ill_t *
4813 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
4814     queue_t *q, mblk_t *mp, ipsq_func_t func, int *error, boolean_t *did_alloc)
4815 {
4816 	ill_t	*ill;
4817 	ipif_t	*ipif;
4818 	kstat_named_t	*kn;
4819 	boolean_t isloopback;
4820 	ipsq_t *old_ipsq;
4821 
4822 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
4823 
4824 	rw_enter(&ill_g_lock, RW_READER);
4825 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
4826 	rw_exit(&ill_g_lock);
4827 	if (ill != NULL || (error != NULL && *error == EINPROGRESS))
4828 		return (ill);
4829 
4830 	/*
4831 	 * Couldn't find it.  Does this happen to be a lookup for the
4832 	 * loopback device and are we allowed to allocate it?
4833 	 */
4834 	if (!isloopback || !do_alloc)
4835 		return (NULL);
4836 
4837 	rw_enter(&ill_g_lock, RW_WRITER);
4838 
4839 	ill = ill_find_by_name(name, isv6, q, mp, func, error);
4840 	if (ill != NULL || (error != NULL && *error == EINPROGRESS)) {
4841 		rw_exit(&ill_g_lock);
4842 		return (ill);
4843 	}
4844 
4845 	/* Create the loopback device on demand */
4846 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
4847 	    sizeof (ipif_loopback_name), BPRI_MED));
4848 	if (ill == NULL)
4849 		goto done;
4850 
4851 	*ill = ill_null;
4852 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
4853 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
4854 	if (ill->ill_phyint == NULL)
4855 		goto done;
4856 
4857 	if (isv6)
4858 		ill->ill_phyint->phyint_illv6 = ill;
4859 	else
4860 		ill->ill_phyint->phyint_illv4 = ill;
4861 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
4862 	ill->ill_max_frag = IP_LOOPBACK_MTU;
4863 	/* Add room for tcp+ip headers */
4864 	if (isv6) {
4865 		ill->ill_isv6 = B_TRUE;
4866 		ill->ill_max_frag += IPV6_HDR_LEN + 20;	/* for TCP */
4867 		if (!ill_allocate_mibs(ill))
4868 			goto done;
4869 	} else {
4870 		ill->ill_max_frag += IP_SIMPLE_HDR_LENGTH + 20;
4871 	}
4872 	ill->ill_max_mtu = ill->ill_max_frag;
4873 	/*
4874 	 * ipif_loopback_name can't be pointed at directly because its used
4875 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
4876 	 * from the glist, ill_glist_delete() sets the first character of
4877 	 * ill_name to '\0'.
4878 	 */
4879 	ill->ill_name = (char *)ill + sizeof (*ill);
4880 	(void) strcpy(ill->ill_name, ipif_loopback_name);
4881 	ill->ill_name_length = sizeof (ipif_loopback_name);
4882 	/* Set ill_name_set for ill_phyint_reinit to work properly */
4883 
4884 	ill->ill_global_timer = INFINITY;
4885 	ill->ill_mcast_type = IGMP_V3_ROUTER;	/* == MLD_V2_ROUTER */
4886 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
4887 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
4888 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
4889 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
4890 
4891 	/* No resolver here. */
4892 	ill->ill_net_type = IRE_LOOPBACK;
4893 
4894 	/* Initialize the ipsq */
4895 	if (!ipsq_init(ill))
4896 		goto done;
4897 
4898 	ill->ill_phyint->phyint_ipsq->ipsq_writer = NULL;
4899 	ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt--;
4900 	ASSERT(ill->ill_phyint->phyint_ipsq->ipsq_reentry_cnt == 0);
4901 #ifdef ILL_DEBUG
4902 	ill->ill_phyint->phyint_ipsq->ipsq_depth = 0;
4903 #endif
4904 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE);
4905 	if (ipif == NULL)
4906 		goto done;
4907 
4908 	ill->ill_flags = ILLF_MULTICAST;
4909 
4910 	/* Set up default loopback address and mask. */
4911 	if (!isv6) {
4912 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
4913 
4914 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
4915 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4916 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
4917 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4918 		    ipif->ipif_v6subnet);
4919 		ill->ill_flags |= ILLF_IPV4;
4920 	} else {
4921 		ipif->ipif_v6lcl_addr = ipv6_loopback;
4922 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
4923 		ipif->ipif_v6net_mask = ipv6_all_ones;
4924 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
4925 		    ipif->ipif_v6subnet);
4926 		ill->ill_flags |= ILLF_IPV6;
4927 	}
4928 
4929 	/*
4930 	 * Chain us in at the end of the ill list. hold the ill
4931 	 * before we make it globally visible. 1 for the lookup.
4932 	 */
4933 	ill->ill_refcnt = 0;
4934 	ill_refhold(ill);
4935 
4936 	ill->ill_frag_count = 0;
4937 	ill->ill_frag_free_num_pkts = 0;
4938 	ill->ill_last_frag_clean_time = 0;
4939 
4940 	old_ipsq = ill->ill_phyint->phyint_ipsq;
4941 
4942 	if (ill_glist_insert(ill, "lo", isv6) != 0)
4943 		cmn_err(CE_PANIC, "cannot insert loopback interface");
4944 
4945 	/* Let SCTP know so that it can add this to its list */
4946 	sctp_update_ill(ill, SCTP_ILL_INSERT);
4947 
4948 	/* Let SCTP know about this IPIF, so that it can add it to its list */
4949 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
4950 
4951 	/*
4952 	 * If the ipsq was changed in ill_phyint_reinit free the old ipsq.
4953 	 */
4954 	if (old_ipsq != ill->ill_phyint->phyint_ipsq) {
4955 		/* Loopback ills aren't in any IPMP group */
4956 		ASSERT(!(old_ipsq->ipsq_flags & IPSQ_GROUP));
4957 		ipsq_delete(old_ipsq);
4958 	}
4959 
4960 	/*
4961 	 * Delay this till the ipif is allocated as ipif_allocate
4962 	 * de-references ill_phyint for getting the ifindex. We
4963 	 * can't do this before ipif_allocate because ill_phyint_reinit
4964 	 * -> phyint_assign_ifindex expects ipif to be present.
4965 	 */
4966 	mutex_enter(&ill->ill_phyint->phyint_lock);
4967 	ill->ill_phyint->phyint_flags |= PHYI_LOOPBACK | PHYI_VIRTUAL;
4968 	mutex_exit(&ill->ill_phyint->phyint_lock);
4969 
4970 	if (loopback_ksp == NULL) {
4971 		/* Export loopback interface statistics */
4972 		loopback_ksp = kstat_create("lo", 0, ipif_loopback_name, "net",
4973 		    KSTAT_TYPE_NAMED, 2, 0);
4974 		if (loopback_ksp != NULL) {
4975 			loopback_ksp->ks_update = loopback_kstat_update;
4976 			kn = KSTAT_NAMED_PTR(loopback_ksp);
4977 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
4978 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
4979 			kstat_install(loopback_ksp);
4980 		}
4981 	}
4982 
4983 	if (error != NULL)
4984 		*error = 0;
4985 	*did_alloc = B_TRUE;
4986 	rw_exit(&ill_g_lock);
4987 	return (ill);
4988 done:
4989 	if (ill != NULL) {
4990 		if (ill->ill_phyint != NULL) {
4991 			ipsq_t	*ipsq;
4992 
4993 			ipsq = ill->ill_phyint->phyint_ipsq;
4994 			if (ipsq != NULL)
4995 				kmem_free(ipsq, sizeof (ipsq_t));
4996 			mi_free(ill->ill_phyint);
4997 		}
4998 		ill_free_mib(ill);
4999 		mi_free(ill);
5000 	}
5001 	rw_exit(&ill_g_lock);
5002 	if (error != NULL)
5003 		*error = ENOMEM;
5004 	return (NULL);
5005 }
5006 
5007 /*
5008  * Return a pointer to the ill which matches the index and IP version type.
5009  */
5010 ill_t *
5011 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, queue_t *q, mblk_t *mp,
5012     ipsq_func_t func, int *err)
5013 {
5014 	ill_t	*ill;
5015 	ipsq_t  *ipsq;
5016 	phyint_t *phyi;
5017 
5018 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
5019 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
5020 
5021 	if (err != NULL)
5022 		*err = 0;
5023 
5024 	/*
5025 	 * Indexes are stored in the phyint - a common structure
5026 	 * to both IPv4 and IPv6.
5027 	 */
5028 	rw_enter(&ill_g_lock, RW_READER);
5029 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
5030 	    (void *) &index, NULL);
5031 	if (phyi != NULL) {
5032 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
5033 		if (ill != NULL) {
5034 			/*
5035 			 * The block comment at the start of ipif_down
5036 			 * explains the use of the macros used below
5037 			 */
5038 			GRAB_CONN_LOCK(q);
5039 			mutex_enter(&ill->ill_lock);
5040 			if (ILL_CAN_LOOKUP(ill)) {
5041 				ill_refhold_locked(ill);
5042 				mutex_exit(&ill->ill_lock);
5043 				RELEASE_CONN_LOCK(q);
5044 				rw_exit(&ill_g_lock);
5045 				return (ill);
5046 			} else if (ILL_CAN_WAIT(ill, q)) {
5047 				ipsq = ill->ill_phyint->phyint_ipsq;
5048 				mutex_enter(&ipsq->ipsq_lock);
5049 				rw_exit(&ill_g_lock);
5050 				mutex_exit(&ill->ill_lock);
5051 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
5052 				mutex_exit(&ipsq->ipsq_lock);
5053 				RELEASE_CONN_LOCK(q);
5054 				*err = EINPROGRESS;
5055 				return (NULL);
5056 			}
5057 			RELEASE_CONN_LOCK(q);
5058 			mutex_exit(&ill->ill_lock);
5059 		}
5060 	}
5061 	rw_exit(&ill_g_lock);
5062 	if (err != NULL)
5063 		*err = ENXIO;
5064 	return (NULL);
5065 }
5066 
5067 /*
5068  * Return the ifindex next in sequence after the passed in ifindex.
5069  * If there is no next ifindex for the given protocol, return 0.
5070  */
5071 uint_t
5072 ill_get_next_ifindex(uint_t index, boolean_t isv6)
5073 {
5074 	phyint_t *phyi;
5075 	phyint_t *phyi_initial;
5076 	uint_t   ifindex;
5077 
5078 	rw_enter(&ill_g_lock, RW_READER);
5079 
5080 	if (index == 0) {
5081 		phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
5082 	} else {
5083 		phyi = phyi_initial = avl_find(
5084 		    &phyint_g_list.phyint_list_avl_by_index,
5085 		    (void *) &index, NULL);
5086 	}
5087 
5088 	for (; phyi != NULL;
5089 	    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
5090 	    phyi, AVL_AFTER)) {
5091 		/*
5092 		 * If we're not returning the first interface in the tree
5093 		 * and we still haven't moved past the phyint_t that
5094 		 * corresponds to index, avl_walk needs to be called again
5095 		 */
5096 		if (!((index != 0) && (phyi == phyi_initial))) {
5097 			if (isv6) {
5098 				if ((phyi->phyint_illv6) &&
5099 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
5100 				    (phyi->phyint_illv6->ill_isv6 == 1))
5101 					break;
5102 			} else {
5103 				if ((phyi->phyint_illv4) &&
5104 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
5105 				    (phyi->phyint_illv4->ill_isv6 == 0))
5106 					break;
5107 			}
5108 		}
5109 	}
5110 
5111 	rw_exit(&ill_g_lock);
5112 
5113 	if (phyi != NULL)
5114 		ifindex = phyi->phyint_ifindex;
5115 	else
5116 		ifindex = 0;
5117 
5118 	return (ifindex);
5119 }
5120 
5121 
5122 /*
5123  * Return the ifindex for the named interface.
5124  * If there is no next ifindex for the interface, return 0.
5125  */
5126 uint_t
5127 ill_get_ifindex_by_name(char *name)
5128 {
5129 	phyint_t	*phyi;
5130 	avl_index_t	where = 0;
5131 	uint_t		ifindex;
5132 
5133 	rw_enter(&ill_g_lock, RW_READER);
5134 
5135 	if ((phyi = avl_find(&phyint_g_list.phyint_list_avl_by_name,
5136 	    name, &where)) == NULL) {
5137 		rw_exit(&ill_g_lock);
5138 		return (0);
5139 	}
5140 
5141 	ifindex = phyi->phyint_ifindex;
5142 
5143 	rw_exit(&ill_g_lock);
5144 
5145 	return (ifindex);
5146 }
5147 
5148 
5149 /*
5150  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
5151  * that gives a running thread a reference to the ill. This reference must be
5152  * released by the thread when it is done accessing the ill and related
5153  * objects. ill_refcnt can not be used to account for static references
5154  * such as other structures pointing to an ill. Callers must generally
5155  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
5156  * or be sure that the ill is not being deleted or changing state before
5157  * calling the refhold functions. A non-zero ill_refcnt ensures that the
5158  * ill won't change any of its critical state such as address, netmask etc.
5159  */
5160 void
5161 ill_refhold(ill_t *ill)
5162 {
5163 	mutex_enter(&ill->ill_lock);
5164 	ill->ill_refcnt++;
5165 	ILL_TRACE_REF(ill);
5166 	mutex_exit(&ill->ill_lock);
5167 }
5168 
5169 void
5170 ill_refhold_locked(ill_t *ill)
5171 {
5172 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5173 	ill->ill_refcnt++;
5174 	ILL_TRACE_REF(ill);
5175 }
5176 
5177 int
5178 ill_check_and_refhold(ill_t *ill)
5179 {
5180 	mutex_enter(&ill->ill_lock);
5181 	if (ILL_CAN_LOOKUP(ill)) {
5182 		ill_refhold_locked(ill);
5183 		mutex_exit(&ill->ill_lock);
5184 		return (0);
5185 	}
5186 	mutex_exit(&ill->ill_lock);
5187 	return (ILL_LOOKUP_FAILED);
5188 }
5189 
5190 /*
5191  * Must not be called while holding any locks. Otherwise if this is
5192  * the last reference to be released, there is a chance of recursive mutex
5193  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5194  * to restart an ioctl.
5195  */
5196 void
5197 ill_refrele(ill_t *ill)
5198 {
5199 	mutex_enter(&ill->ill_lock);
5200 	ASSERT(ill->ill_refcnt != 0);
5201 	ill->ill_refcnt--;
5202 	ILL_UNTRACE_REF(ill);
5203 	if (ill->ill_refcnt != 0) {
5204 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
5205 		mutex_exit(&ill->ill_lock);
5206 		return;
5207 	}
5208 
5209 	/* Drops the ill_lock */
5210 	ipif_ill_refrele_tail(ill);
5211 }
5212 
5213 /*
5214  * Obtain a weak reference count on the ill. This reference ensures the
5215  * ill won't be freed, but the ill may change any of its critical state
5216  * such as netmask, address etc. Returns an error if the ill has started
5217  * closing.
5218  */
5219 boolean_t
5220 ill_waiter_inc(ill_t *ill)
5221 {
5222 	mutex_enter(&ill->ill_lock);
5223 	if (ill->ill_state_flags & ILL_CONDEMNED) {
5224 		mutex_exit(&ill->ill_lock);
5225 		return (B_FALSE);
5226 	}
5227 	ill->ill_waiters++;
5228 	mutex_exit(&ill->ill_lock);
5229 	return (B_TRUE);
5230 }
5231 
5232 void
5233 ill_waiter_dcr(ill_t *ill)
5234 {
5235 	mutex_enter(&ill->ill_lock);
5236 	ill->ill_waiters--;
5237 	if (ill->ill_waiters == 0)
5238 		cv_broadcast(&ill->ill_cv);
5239 	mutex_exit(&ill->ill_lock);
5240 }
5241 
5242 /*
5243  * Named Dispatch routine to produce a formatted report on all ILLs.
5244  * This report is accessed by using the ndd utility to "get" ND variable
5245  * "ip_ill_status".
5246  */
5247 /* ARGSUSED */
5248 int
5249 ip_ill_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5250 {
5251 	ill_t		*ill;
5252 	ill_walk_context_t ctx;
5253 
5254 	(void) mi_mpprintf(mp,
5255 	    "ILL      " MI_COL_HDRPAD_STR
5256 	/*   01234567[89ABCDEF] */
5257 	    "rq       " MI_COL_HDRPAD_STR
5258 	/*   01234567[89ABCDEF] */
5259 	    "wq       " MI_COL_HDRPAD_STR
5260 	/*   01234567[89ABCDEF] */
5261 	    "upcnt mxfrg err name");
5262 	/*   12345 12345 123 xxxxxxxx  */
5263 
5264 	rw_enter(&ill_g_lock, RW_READER);
5265 	ill = ILL_START_WALK_ALL(&ctx);
5266 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5267 		(void) mi_mpprintf(mp,
5268 		    MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR MI_COL_PTRFMT_STR
5269 		    "%05u %05u %03d %s",
5270 		    (void *)ill, (void *)ill->ill_rq, (void *)ill->ill_wq,
5271 		    ill->ill_ipif_up_count,
5272 		    ill->ill_max_frag, ill->ill_error, ill->ill_name);
5273 	}
5274 	rw_exit(&ill_g_lock);
5275 
5276 	return (0);
5277 }
5278 
5279 /*
5280  * Named Dispatch routine to produce a formatted report on all IPIFs.
5281  * This report is accessed by using the ndd utility to "get" ND variable
5282  * "ip_ipif_status".
5283  */
5284 /* ARGSUSED */
5285 int
5286 ip_ipif_report(queue_t *q, mblk_t *mp, caddr_t arg, cred_t *ioc_cr)
5287 {
5288 	char	buf1[INET6_ADDRSTRLEN];
5289 	char	buf2[INET6_ADDRSTRLEN];
5290 	char	buf3[INET6_ADDRSTRLEN];
5291 	char	buf4[INET6_ADDRSTRLEN];
5292 	char	buf5[INET6_ADDRSTRLEN];
5293 	char	buf6[INET6_ADDRSTRLEN];
5294 	char	buf[LIFNAMSIZ];
5295 	ill_t	*ill;
5296 	ipif_t	*ipif;
5297 	nv_t	*nvp;
5298 	uint64_t flags;
5299 	zoneid_t zoneid;
5300 	ill_walk_context_t ctx;
5301 
5302 	(void) mi_mpprintf(mp,
5303 	    "IPIF metric mtu in/out/forward name zone flags...\n"
5304 	    "\tlocal address\n"
5305 	    "\tsrc address\n"
5306 	    "\tsubnet\n"
5307 	    "\tmask\n"
5308 	    "\tbroadcast\n"
5309 	    "\tp-p-dst");
5310 
5311 	ASSERT(q->q_next == NULL);
5312 	zoneid = Q_TO_CONN(q)->conn_zoneid;	/* IP is a driver */
5313 
5314 	rw_enter(&ill_g_lock, RW_READER);
5315 	ill = ILL_START_WALK_ALL(&ctx);
5316 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5317 		for (ipif = ill->ill_ipif; ipif != NULL;
5318 		    ipif = ipif->ipif_next) {
5319 			if (zoneid != GLOBAL_ZONEID &&
5320 			    zoneid != ipif->ipif_zoneid &&
5321 			    ipif->ipif_zoneid != ALL_ZONES)
5322 				continue;
5323 			(void) mi_mpprintf(mp,
5324 			    MI_COL_PTRFMT_STR
5325 			    "%04u %05u %u/%u/%u %s %d",
5326 			    (void *)ipif,
5327 			    ipif->ipif_metric, ipif->ipif_mtu,
5328 			    ipif->ipif_ib_pkt_count,
5329 			    ipif->ipif_ob_pkt_count,
5330 			    ipif->ipif_fo_pkt_count,
5331 			    ipif_get_name(ipif, buf, sizeof (buf)),
5332 			    ipif->ipif_zoneid);
5333 
5334 		flags = ipif->ipif_flags | ipif->ipif_ill->ill_flags |
5335 		    ipif->ipif_ill->ill_phyint->phyint_flags;
5336 
5337 		/* Tack on text strings for any flags. */
5338 		nvp = ipif_nv_tbl;
5339 		for (; nvp < A_END(ipif_nv_tbl); nvp++) {
5340 			if (nvp->nv_value & flags)
5341 				(void) mi_mpprintf_nr(mp, " %s",
5342 				    nvp->nv_name);
5343 		}
5344 		(void) mi_mpprintf(mp,
5345 		    "\t%s\n\t%s\n\t%s\n\t%s\n\t%s\n\t%s",
5346 		    inet_ntop(AF_INET6,
5347 			&ipif->ipif_v6lcl_addr, buf1, sizeof (buf1)),
5348 		    inet_ntop(AF_INET6,
5349 			&ipif->ipif_v6src_addr, buf2, sizeof (buf2)),
5350 		    inet_ntop(AF_INET6,
5351 			&ipif->ipif_v6subnet, buf3, sizeof (buf3)),
5352 		    inet_ntop(AF_INET6,
5353 			&ipif->ipif_v6net_mask, buf4, sizeof (buf4)),
5354 		    inet_ntop(AF_INET6,
5355 			&ipif->ipif_v6brd_addr, buf5, sizeof (buf5)),
5356 		    inet_ntop(AF_INET6,
5357 			&ipif->ipif_v6pp_dst_addr,
5358 			buf6, sizeof (buf6)));
5359 		}
5360 	}
5361 	rw_exit(&ill_g_lock);
5362 	return (0);
5363 }
5364 
5365 /*
5366  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
5367  * driver.  We construct best guess defaults for lower level information that
5368  * we need.  If an interface is brought up without injection of any overriding
5369  * information from outside, we have to be ready to go with these defaults.
5370  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
5371  * we primarely want the dl_provider_style.
5372  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
5373  * at which point we assume the other part of the information is valid.
5374  */
5375 void
5376 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
5377 {
5378 	uchar_t		*brdcst_addr;
5379 	uint_t		brdcst_addr_length, phys_addr_length;
5380 	t_scalar_t	sap_length;
5381 	dl_info_ack_t	*dlia;
5382 	ip_m_t		*ipm;
5383 	dl_qos_cl_sel1_t *sel1;
5384 
5385 	ASSERT(IAM_WRITER_ILL(ill));
5386 
5387 	/*
5388 	 * Till the ill is fully up ILL_CHANGING will be set and
5389 	 * the ill is not globally visible. So no need for a lock.
5390 	 */
5391 	dlia = (dl_info_ack_t *)mp->b_rptr;
5392 	ill->ill_mactype = dlia->dl_mac_type;
5393 
5394 	ipm = ip_m_lookup(dlia->dl_mac_type);
5395 	if (ipm == NULL) {
5396 		ipm = ip_m_lookup(DL_OTHER);
5397 		ASSERT(ipm != NULL);
5398 	}
5399 	ill->ill_media = ipm;
5400 
5401 	/*
5402 	 * When the new DLPI stuff is ready we'll pull lengths
5403 	 * from dlia.
5404 	 */
5405 	if (dlia->dl_version == DL_VERSION_2) {
5406 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
5407 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
5408 		    brdcst_addr_length);
5409 		if (brdcst_addr == NULL) {
5410 			brdcst_addr_length = 0;
5411 		}
5412 		sap_length = dlia->dl_sap_length;
5413 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
5414 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
5415 		    brdcst_addr_length, sap_length, phys_addr_length));
5416 	} else {
5417 		brdcst_addr_length = 6;
5418 		brdcst_addr = ip_six_byte_all_ones;
5419 		sap_length = -2;
5420 		phys_addr_length = brdcst_addr_length;
5421 	}
5422 
5423 	ill->ill_bcast_addr_length = brdcst_addr_length;
5424 	ill->ill_phys_addr_length = phys_addr_length;
5425 	ill->ill_sap_length = sap_length;
5426 	ill->ill_max_frag = dlia->dl_max_sdu;
5427 	ill->ill_max_mtu = ill->ill_max_frag;
5428 
5429 	ill->ill_type = ipm->ip_m_type;
5430 
5431 	if (!ill->ill_dlpi_style_set) {
5432 		if (dlia->dl_provider_style == DL_STYLE2)
5433 			ill->ill_needs_attach = 1;
5434 
5435 		/*
5436 		 * Allocate the first ipif on this ill. We don't delay it
5437 		 * further as ioctl handling assumes atleast one ipif to
5438 		 * be present.
5439 		 *
5440 		 * At this point we don't know whether the ill is v4 or v6.
5441 		 * We will know this whan the SIOCSLIFNAME happens and
5442 		 * the correct value for ill_isv6 will be assigned in
5443 		 * ipif_set_values(). We need to hold the ill lock and
5444 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
5445 		 * the wakeup.
5446 		 */
5447 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
5448 		    dlia->dl_provider_style == DL_STYLE2 ? B_FALSE : B_TRUE);
5449 		mutex_enter(&ill->ill_lock);
5450 		ASSERT(ill->ill_dlpi_style_set == 0);
5451 		ill->ill_dlpi_style_set = 1;
5452 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
5453 		cv_broadcast(&ill->ill_cv);
5454 		mutex_exit(&ill->ill_lock);
5455 		freemsg(mp);
5456 		return;
5457 	}
5458 	ASSERT(ill->ill_ipif != NULL);
5459 	/*
5460 	 * We know whether it is IPv4 or IPv6 now, as this is the
5461 	 * second DL_INFO_ACK we are recieving in response to the
5462 	 * DL_INFO_REQ sent in ipif_set_values.
5463 	 */
5464 	if (ill->ill_isv6)
5465 		ill->ill_sap = IP6_DL_SAP;
5466 	else
5467 		ill->ill_sap = IP_DL_SAP;
5468 	/*
5469 	 * Set ipif_mtu which is used to set the IRE's
5470 	 * ire_max_frag value. The driver could have sent
5471 	 * a different mtu from what it sent last time. No
5472 	 * need to call ipif_mtu_change because IREs have
5473 	 * not yet been created.
5474 	 */
5475 	ill->ill_ipif->ipif_mtu = ill->ill_max_mtu;
5476 	/*
5477 	 * Clear all the flags that were set based on ill_bcast_addr_length
5478 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
5479 	 * changed now and we need to re-evaluate.
5480 	 */
5481 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
5482 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
5483 
5484 	/*
5485 	 * Free ill_resolver_mp and ill_bcast_mp as things could have
5486 	 * changed now.
5487 	 */
5488 	if (ill->ill_bcast_addr_length == 0) {
5489 		if (ill->ill_resolver_mp != NULL)
5490 			freemsg(ill->ill_resolver_mp);
5491 		if (ill->ill_bcast_mp != NULL)
5492 			freemsg(ill->ill_bcast_mp);
5493 		if (ill->ill_flags & ILLF_XRESOLV)
5494 			ill->ill_net_type = IRE_IF_RESOLVER;
5495 		else
5496 			ill->ill_net_type = IRE_IF_NORESOLVER;
5497 		ill->ill_resolver_mp = ill_dlur_gen(NULL,
5498 		    ill->ill_phys_addr_length,
5499 		    ill->ill_sap,
5500 		    ill->ill_sap_length);
5501 		ill->ill_bcast_mp = copymsg(ill->ill_resolver_mp);
5502 
5503 		if (ill->ill_isv6)
5504 			/*
5505 			 * Note: xresolv interfaces will eventually need NOARP
5506 			 * set here as well, but that will require those
5507 			 * external resolvers to have some knowledge of
5508 			 * that flag and act appropriately. Not to be changed
5509 			 * at present.
5510 			 */
5511 			ill->ill_flags |= ILLF_NONUD;
5512 		else
5513 			ill->ill_flags |= ILLF_NOARP;
5514 
5515 		if (ill->ill_phys_addr_length == 0) {
5516 			if (ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
5517 				ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
5518 				ill->ill_phyint->phyint_flags |= PHYI_VIRTUAL;
5519 			} else {
5520 				/* pt-pt supports multicast. */
5521 				ill->ill_flags |= ILLF_MULTICAST;
5522 				ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
5523 			}
5524 		}
5525 	} else {
5526 		ill->ill_net_type = IRE_IF_RESOLVER;
5527 		if (ill->ill_bcast_mp != NULL)
5528 			freemsg(ill->ill_bcast_mp);
5529 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
5530 		    ill->ill_bcast_addr_length, ill->ill_sap,
5531 		    ill->ill_sap_length);
5532 		/*
5533 		 * Later detect lack of DLPI driver multicast
5534 		 * capability by catching DL_ENABMULTI errors in
5535 		 * ip_rput_dlpi.
5536 		 */
5537 		ill->ill_flags |= ILLF_MULTICAST;
5538 		if (!ill->ill_isv6)
5539 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
5540 	}
5541 	/* By default an interface does not support any CoS marking */
5542 	ill->ill_flags &= ~ILLF_COS_ENABLED;
5543 
5544 	/*
5545 	 * If we get QoS information in DL_INFO_ACK, the device supports
5546 	 * some form of CoS marking, set ILLF_COS_ENABLED.
5547 	 */
5548 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
5549 	    dlia->dl_qos_length);
5550 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
5551 		ill->ill_flags |= ILLF_COS_ENABLED;
5552 	}
5553 
5554 	/* Clear any previous error indication. */
5555 	ill->ill_error = 0;
5556 	freemsg(mp);
5557 }
5558 
5559 /*
5560  * Perform various checks to verify that an address would make sense as a
5561  * local, remote, or subnet interface address.
5562  */
5563 static boolean_t
5564 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
5565 {
5566 	ipaddr_t	net_mask;
5567 
5568 	/*
5569 	 * Don't allow all zeroes, all ones or experimental address, but allow
5570 	 * all ones netmask.
5571 	 */
5572 	if ((net_mask = ip_net_mask(addr)) == 0)
5573 		return (B_FALSE);
5574 	/* A given netmask overrides the "guess" netmask */
5575 	if (subnet_mask != 0)
5576 		net_mask = subnet_mask;
5577 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
5578 	    (addr == (addr | ~net_mask)))) {
5579 		return (B_FALSE);
5580 	}
5581 	if (CLASSD(addr))
5582 		return (B_FALSE);
5583 
5584 	return (B_TRUE);
5585 }
5586 
5587 /*
5588  * ipif_lookup_group
5589  * Returns held ipif
5590  */
5591 ipif_t *
5592 ipif_lookup_group(ipaddr_t group, zoneid_t zoneid)
5593 {
5594 	ire_t	*ire;
5595 	ipif_t	*ipif;
5596 
5597 	ire = ire_lookup_multi(group, zoneid);
5598 	if (ire == NULL)
5599 		return (NULL);
5600 	ipif = ire->ire_ipif;
5601 	ipif_refhold(ipif);
5602 	ire_refrele(ire);
5603 	return (ipif);
5604 }
5605 
5606 /*
5607  * Look for an ipif with the specified interface address and destination.
5608  * The destination address is used only for matching point-to-point interfaces.
5609  */
5610 ipif_t *
5611 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, queue_t *q, mblk_t *mp,
5612     ipsq_func_t func, int *error)
5613 {
5614 	ipif_t	*ipif;
5615 	ill_t	*ill;
5616 	ill_walk_context_t ctx;
5617 	ipsq_t	*ipsq;
5618 
5619 	if (error != NULL)
5620 		*error = 0;
5621 
5622 	/*
5623 	 * First match all the point-to-point interfaces
5624 	 * before looking at non-point-to-point interfaces.
5625 	 * This is done to avoid returning non-point-to-point
5626 	 * ipif instead of unnumbered point-to-point ipif.
5627 	 */
5628 	rw_enter(&ill_g_lock, RW_READER);
5629 	ill = ILL_START_WALK_V4(&ctx);
5630 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5631 		GRAB_CONN_LOCK(q);
5632 		mutex_enter(&ill->ill_lock);
5633 		for (ipif = ill->ill_ipif; ipif != NULL;
5634 		    ipif = ipif->ipif_next) {
5635 			/* Allow the ipif to be down */
5636 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
5637 			    (ipif->ipif_lcl_addr == if_addr) &&
5638 			    (ipif->ipif_pp_dst_addr == dst)) {
5639 				/*
5640 				 * The block comment at the start of ipif_down
5641 				 * explains the use of the macros used below
5642 				 */
5643 				if (IPIF_CAN_LOOKUP(ipif)) {
5644 					ipif_refhold_locked(ipif);
5645 					mutex_exit(&ill->ill_lock);
5646 					RELEASE_CONN_LOCK(q);
5647 					rw_exit(&ill_g_lock);
5648 					return (ipif);
5649 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5650 					ipsq = ill->ill_phyint->phyint_ipsq;
5651 					mutex_enter(&ipsq->ipsq_lock);
5652 					mutex_exit(&ill->ill_lock);
5653 					rw_exit(&ill_g_lock);
5654 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5655 						ill);
5656 					mutex_exit(&ipsq->ipsq_lock);
5657 					RELEASE_CONN_LOCK(q);
5658 					*error = EINPROGRESS;
5659 					return (NULL);
5660 				}
5661 			}
5662 		}
5663 		mutex_exit(&ill->ill_lock);
5664 		RELEASE_CONN_LOCK(q);
5665 	}
5666 	rw_exit(&ill_g_lock);
5667 
5668 	/* lookup the ipif based on interface address */
5669 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, q, mp, func, error);
5670 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
5671 	return (ipif);
5672 }
5673 
5674 /*
5675  * Look for an ipif with the specified address. For point-point links
5676  * we look for matches on either the destination address and the local
5677  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
5678  * is set.
5679  * Matches on a specific ill if match_ill is set.
5680  */
5681 ipif_t *
5682 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid, queue_t *q,
5683     mblk_t *mp, ipsq_func_t func, int *error)
5684 {
5685 	ipif_t  *ipif;
5686 	ill_t   *ill;
5687 	boolean_t ptp = B_FALSE;
5688 	ipsq_t	*ipsq;
5689 	ill_walk_context_t	ctx;
5690 
5691 	if (error != NULL)
5692 		*error = 0;
5693 
5694 	rw_enter(&ill_g_lock, RW_READER);
5695 	/*
5696 	 * Repeat twice, first based on local addresses and
5697 	 * next time for pointopoint.
5698 	 */
5699 repeat:
5700 	ill = ILL_START_WALK_V4(&ctx);
5701 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5702 		if (match_ill != NULL && ill != match_ill) {
5703 			continue;
5704 		}
5705 		GRAB_CONN_LOCK(q);
5706 		mutex_enter(&ill->ill_lock);
5707 		for (ipif = ill->ill_ipif; ipif != NULL;
5708 		    ipif = ipif->ipif_next) {
5709 			if (zoneid != ALL_ZONES &&
5710 			    zoneid != ipif->ipif_zoneid &&
5711 			    ipif->ipif_zoneid != ALL_ZONES)
5712 				continue;
5713 			/* Allow the ipif to be down */
5714 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5715 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5716 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5717 			    (ipif->ipif_pp_dst_addr == addr))) {
5718 				/*
5719 				 * The block comment at the start of ipif_down
5720 				 * explains the use of the macros used below
5721 				 */
5722 				if (IPIF_CAN_LOOKUP(ipif)) {
5723 					ipif_refhold_locked(ipif);
5724 					mutex_exit(&ill->ill_lock);
5725 					RELEASE_CONN_LOCK(q);
5726 					rw_exit(&ill_g_lock);
5727 					return (ipif);
5728 				} else if (IPIF_CAN_WAIT(ipif, q)) {
5729 					ipsq = ill->ill_phyint->phyint_ipsq;
5730 					mutex_enter(&ipsq->ipsq_lock);
5731 					mutex_exit(&ill->ill_lock);
5732 					rw_exit(&ill_g_lock);
5733 					ipsq_enq(ipsq, q, mp, func, NEW_OP,
5734 						ill);
5735 					mutex_exit(&ipsq->ipsq_lock);
5736 					RELEASE_CONN_LOCK(q);
5737 					*error = EINPROGRESS;
5738 					return (NULL);
5739 				}
5740 			}
5741 		}
5742 		mutex_exit(&ill->ill_lock);
5743 		RELEASE_CONN_LOCK(q);
5744 	}
5745 
5746 	/* If we already did the ptp case, then we are done */
5747 	if (ptp) {
5748 		rw_exit(&ill_g_lock);
5749 		if (error != NULL)
5750 			*error = ENXIO;
5751 		return (NULL);
5752 	}
5753 	ptp = B_TRUE;
5754 	goto repeat;
5755 }
5756 
5757 /*
5758  * Look for an ipif with the specified address. For point-point links
5759  * we look for matches on either the destination address and the local
5760  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
5761  * is set.
5762  * Matches on a specific ill if match_ill is set.
5763  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
5764  */
5765 zoneid_t
5766 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill)
5767 {
5768 	zoneid_t zoneid;
5769 	ipif_t  *ipif;
5770 	ill_t   *ill;
5771 	boolean_t ptp = B_FALSE;
5772 	ill_walk_context_t	ctx;
5773 
5774 	rw_enter(&ill_g_lock, RW_READER);
5775 	/*
5776 	 * Repeat twice, first based on local addresses and
5777 	 * next time for pointopoint.
5778 	 */
5779 repeat:
5780 	ill = ILL_START_WALK_V4(&ctx);
5781 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
5782 		if (match_ill != NULL && ill != match_ill) {
5783 			continue;
5784 		}
5785 		mutex_enter(&ill->ill_lock);
5786 		for (ipif = ill->ill_ipif; ipif != NULL;
5787 		    ipif = ipif->ipif_next) {
5788 			/* Allow the ipif to be down */
5789 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
5790 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
5791 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
5792 			    (ipif->ipif_pp_dst_addr == addr)) &&
5793 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
5794 				zoneid = ipif->ipif_zoneid;
5795 				mutex_exit(&ill->ill_lock);
5796 				rw_exit(&ill_g_lock);
5797 				/*
5798 				 * If ipif_zoneid was ALL_ZONES then we have
5799 				 * a trusted extensions shared IP address.
5800 				 * In that case GLOBAL_ZONEID works to send.
5801 				 */
5802 				if (zoneid == ALL_ZONES)
5803 					zoneid = GLOBAL_ZONEID;
5804 				return (zoneid);
5805 			}
5806 		}
5807 		mutex_exit(&ill->ill_lock);
5808 	}
5809 
5810 	/* If we already did the ptp case, then we are done */
5811 	if (ptp) {
5812 		rw_exit(&ill_g_lock);
5813 		return (ALL_ZONES);
5814 	}
5815 	ptp = B_TRUE;
5816 	goto repeat;
5817 }
5818 
5819 /*
5820  * Look for an ipif that matches the specified remote address i.e. the
5821  * ipif that would receive the specified packet.
5822  * First look for directly connected interfaces and then do a recursive
5823  * IRE lookup and pick the first ipif corresponding to the source address in the
5824  * ire.
5825  * Returns: held ipif
5826  */
5827 ipif_t *
5828 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
5829 {
5830 	ipif_t	*ipif;
5831 	ire_t	*ire;
5832 
5833 	ASSERT(!ill->ill_isv6);
5834 
5835 	/*
5836 	 * Someone could be changing this ipif currently or change it
5837 	 * after we return this. Thus  a few packets could use the old
5838 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
5839 	 * will atomically be updated or cleaned up with the new value
5840 	 * Thus we don't need a lock to check the flags or other attrs below.
5841 	 */
5842 	mutex_enter(&ill->ill_lock);
5843 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5844 		if (!IPIF_CAN_LOOKUP(ipif))
5845 			continue;
5846 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
5847 		    ipif->ipif_zoneid != ALL_ZONES)
5848 			continue;
5849 		/* Allow the ipif to be down */
5850 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
5851 			if ((ipif->ipif_pp_dst_addr == addr) ||
5852 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
5853 			    ipif->ipif_lcl_addr == addr)) {
5854 				ipif_refhold_locked(ipif);
5855 				mutex_exit(&ill->ill_lock);
5856 				return (ipif);
5857 			}
5858 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
5859 			ipif_refhold_locked(ipif);
5860 			mutex_exit(&ill->ill_lock);
5861 			return (ipif);
5862 		}
5863 	}
5864 	mutex_exit(&ill->ill_lock);
5865 	ire = ire_route_lookup(addr, 0, 0, 0, NULL, NULL, zoneid,
5866 	    NULL, MATCH_IRE_RECURSIVE);
5867 	if (ire != NULL) {
5868 		/*
5869 		 * The callers of this function wants to know the
5870 		 * interface on which they have to send the replies
5871 		 * back. For IRE_CACHES that have ire_stq and ire_ipif
5872 		 * derived from different ills, we really don't care
5873 		 * what we return here.
5874 		 */
5875 		ipif = ire->ire_ipif;
5876 		if (ipif != NULL) {
5877 			ipif_refhold(ipif);
5878 			ire_refrele(ire);
5879 			return (ipif);
5880 		}
5881 		ire_refrele(ire);
5882 	}
5883 	/* Pick the first interface */
5884 	ipif = ipif_get_next_ipif(NULL, ill);
5885 	return (ipif);
5886 }
5887 
5888 /*
5889  * This func does not prevent refcnt from increasing. But if
5890  * the caller has taken steps to that effect, then this func
5891  * can be used to determine whether the ill has become quiescent
5892  */
5893 boolean_t
5894 ill_is_quiescent(ill_t *ill)
5895 {
5896 	ipif_t	*ipif;
5897 
5898 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5899 
5900 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5901 		if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
5902 			return (B_FALSE);
5903 		}
5904 	}
5905 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0 ||
5906 	    ill->ill_nce_cnt != 0 || ill->ill_srcif_refcnt != 0 ||
5907 	    ill->ill_mrtun_refcnt != 0) {
5908 		return (B_FALSE);
5909 	}
5910 	return (B_TRUE);
5911 }
5912 
5913 /*
5914  * This func does not prevent refcnt from increasing. But if
5915  * the caller has taken steps to that effect, then this func
5916  * can be used to determine whether the ipif has become quiescent
5917  */
5918 static boolean_t
5919 ipif_is_quiescent(ipif_t *ipif)
5920 {
5921 	ill_t *ill;
5922 
5923 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5924 
5925 	if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
5926 		return (B_FALSE);
5927 	}
5928 
5929 	ill = ipif->ipif_ill;
5930 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
5931 	    ill->ill_logical_down) {
5932 		return (B_TRUE);
5933 	}
5934 
5935 	/* This is the last ipif going down or being deleted on this ill */
5936 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0) {
5937 		return (B_FALSE);
5938 	}
5939 
5940 	return (B_TRUE);
5941 }
5942 
5943 /*
5944  * This func does not prevent refcnt from increasing. But if
5945  * the caller has taken steps to that effect, then this func
5946  * can be used to determine whether the ipifs marked with IPIF_MOVING
5947  * have become quiescent and can be moved in a failover/failback.
5948  */
5949 static ipif_t *
5950 ill_quiescent_to_move(ill_t *ill)
5951 {
5952 	ipif_t  *ipif;
5953 
5954 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5955 
5956 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
5957 		if (ipif->ipif_state_flags & IPIF_MOVING) {
5958 			if (ipif->ipif_refcnt != 0 || ipif->ipif_ire_cnt != 0) {
5959 				return (ipif);
5960 			}
5961 		}
5962 	}
5963 	return (NULL);
5964 }
5965 
5966 /*
5967  * The ipif/ill/ire has been refreled. Do the tail processing.
5968  * Determine if the ipif or ill in question has become quiescent and if so
5969  * wakeup close and/or restart any queued pending ioctl that is waiting
5970  * for the ipif_down (or ill_down)
5971  */
5972 void
5973 ipif_ill_refrele_tail(ill_t *ill)
5974 {
5975 	mblk_t	*mp;
5976 	conn_t	*connp;
5977 	ipsq_t	*ipsq;
5978 	ipif_t	*ipif;
5979 
5980 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5981 
5982 	if ((ill->ill_state_flags & ILL_CONDEMNED) &&
5983 	    ill_is_quiescent(ill)) {
5984 		/* ill_close may be waiting */
5985 		cv_broadcast(&ill->ill_cv);
5986 	}
5987 
5988 	/* ipsq can't change because ill_lock  is held */
5989 	ipsq = ill->ill_phyint->phyint_ipsq;
5990 	if (ipsq->ipsq_waitfor == 0) {
5991 		/* Not waiting for anything, just return. */
5992 		mutex_exit(&ill->ill_lock);
5993 		return;
5994 	}
5995 	ASSERT(ipsq->ipsq_pending_mp != NULL &&
5996 		ipsq->ipsq_pending_ipif != NULL);
5997 	/*
5998 	 * ipif->ipif_refcnt must go down to zero for restarting REMOVEIF.
5999 	 * Last ipif going down needs to down the ill, so ill_ire_cnt must
6000 	 * be zero for restarting an ioctl that ends up downing the ill.
6001 	 */
6002 	ipif = ipsq->ipsq_pending_ipif;
6003 	if (ipif->ipif_ill != ill) {
6004 		/* The ioctl is pending on some other ill. */
6005 		mutex_exit(&ill->ill_lock);
6006 		return;
6007 	}
6008 
6009 	switch (ipsq->ipsq_waitfor) {
6010 	case IPIF_DOWN:
6011 	case IPIF_FREE:
6012 		if (!ipif_is_quiescent(ipif)) {
6013 			mutex_exit(&ill->ill_lock);
6014 			return;
6015 		}
6016 		break;
6017 
6018 	case ILL_DOWN:
6019 	case ILL_FREE:
6020 		/*
6021 		 * case ILL_FREE arises only for loopback. otherwise ill_delete
6022 		 * waits synchronously in ip_close, and no message is queued in
6023 		 * ipsq_pending_mp at all in this case
6024 		 */
6025 		if (!ill_is_quiescent(ill)) {
6026 			mutex_exit(&ill->ill_lock);
6027 			return;
6028 		}
6029 
6030 		break;
6031 
6032 	case ILL_MOVE_OK:
6033 		if (ill_quiescent_to_move(ill) != NULL) {
6034 			mutex_exit(&ill->ill_lock);
6035 			return;
6036 		}
6037 
6038 		break;
6039 	default:
6040 		cmn_err(CE_PANIC, "ipsq: %p unknown ipsq_waitfor %d\n",
6041 		    (void *)ipsq, ipsq->ipsq_waitfor);
6042 	}
6043 
6044 	/*
6045 	 * Incr refcnt for the qwriter_ip call below which
6046 	 * does a refrele
6047 	 */
6048 	ill_refhold_locked(ill);
6049 	mutex_exit(&ill->ill_lock);
6050 
6051 	mp = ipsq_pending_mp_get(ipsq, &connp);
6052 	ASSERT(mp != NULL);
6053 
6054 	switch (mp->b_datap->db_type) {
6055 	case M_ERROR:
6056 	case M_HANGUP:
6057 		(void) qwriter_ip(NULL, ill, ill->ill_rq, mp,
6058 		    ipif_all_down_tail, CUR_OP, B_TRUE);
6059 		return;
6060 
6061 	case M_IOCTL:
6062 	case M_IOCDATA:
6063 		(void) qwriter_ip(NULL, ill,
6064 		    (connp != NULL ? CONNP_TO_WQ(connp) : ill->ill_wq), mp,
6065 		    ip_reprocess_ioctl, CUR_OP, B_TRUE);
6066 		return;
6067 
6068 	default:
6069 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
6070 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
6071 	}
6072 }
6073 
6074 #ifdef ILL_DEBUG
6075 /* Reuse trace buffer from beginning (if reached the end) and record trace */
6076 void
6077 th_trace_rrecord(th_trace_t *th_trace)
6078 {
6079 	tr_buf_t *tr_buf;
6080 	uint_t lastref;
6081 
6082 	lastref = th_trace->th_trace_lastref;
6083 	lastref++;
6084 	if (lastref == TR_BUF_MAX)
6085 		lastref = 0;
6086 	th_trace->th_trace_lastref = lastref;
6087 	tr_buf = &th_trace->th_trbuf[lastref];
6088 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, IP_STACK_DEPTH);
6089 }
6090 
6091 th_trace_t *
6092 th_trace_ipif_lookup(ipif_t *ipif)
6093 {
6094 	int bucket_id;
6095 	th_trace_t *th_trace;
6096 
6097 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6098 
6099 	bucket_id = IP_TR_HASH(curthread);
6100 	ASSERT(bucket_id < IP_TR_HASH_MAX);
6101 
6102 	for (th_trace = ipif->ipif_trace[bucket_id]; th_trace != NULL;
6103 	    th_trace = th_trace->th_next) {
6104 		if (th_trace->th_id == curthread)
6105 			return (th_trace);
6106 	}
6107 	return (NULL);
6108 }
6109 
6110 void
6111 ipif_trace_ref(ipif_t *ipif)
6112 {
6113 	int bucket_id;
6114 	th_trace_t *th_trace;
6115 
6116 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6117 
6118 	if (ipif->ipif_trace_disable)
6119 		return;
6120 
6121 	/*
6122 	 * Attempt to locate the trace buffer for the curthread.
6123 	 * If it does not exist, then allocate a new trace buffer
6124 	 * and link it in list of trace bufs for this ipif, at the head
6125 	 */
6126 	th_trace = th_trace_ipif_lookup(ipif);
6127 	if (th_trace == NULL) {
6128 		bucket_id = IP_TR_HASH(curthread);
6129 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
6130 		    KM_NOSLEEP);
6131 		if (th_trace == NULL) {
6132 			ipif->ipif_trace_disable = B_TRUE;
6133 			ipif_trace_cleanup(ipif);
6134 			return;
6135 		}
6136 		th_trace->th_id = curthread;
6137 		th_trace->th_next = ipif->ipif_trace[bucket_id];
6138 		th_trace->th_prev = &ipif->ipif_trace[bucket_id];
6139 		if (th_trace->th_next != NULL)
6140 			th_trace->th_next->th_prev = &th_trace->th_next;
6141 		ipif->ipif_trace[bucket_id] = th_trace;
6142 	}
6143 	ASSERT(th_trace->th_refcnt >= 0 &&
6144 		th_trace->th_refcnt < TR_BUF_MAX -1);
6145 	th_trace->th_refcnt++;
6146 	th_trace_rrecord(th_trace);
6147 }
6148 
6149 void
6150 ipif_untrace_ref(ipif_t *ipif)
6151 {
6152 	th_trace_t *th_trace;
6153 
6154 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6155 
6156 	if (ipif->ipif_trace_disable)
6157 		return;
6158 	th_trace = th_trace_ipif_lookup(ipif);
6159 	ASSERT(th_trace != NULL);
6160 	ASSERT(th_trace->th_refcnt > 0);
6161 
6162 	th_trace->th_refcnt--;
6163 	th_trace_rrecord(th_trace);
6164 }
6165 
6166 th_trace_t *
6167 th_trace_ill_lookup(ill_t *ill)
6168 {
6169 	th_trace_t *th_trace;
6170 	int bucket_id;
6171 
6172 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6173 
6174 	bucket_id = IP_TR_HASH(curthread);
6175 	ASSERT(bucket_id < IP_TR_HASH_MAX);
6176 
6177 	for (th_trace = ill->ill_trace[bucket_id]; th_trace != NULL;
6178 	    th_trace = th_trace->th_next) {
6179 		if (th_trace->th_id == curthread)
6180 			return (th_trace);
6181 	}
6182 	return (NULL);
6183 }
6184 
6185 void
6186 ill_trace_ref(ill_t *ill)
6187 {
6188 	int bucket_id;
6189 	th_trace_t *th_trace;
6190 
6191 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6192 	if (ill->ill_trace_disable)
6193 		return;
6194 	/*
6195 	 * Attempt to locate the trace buffer for the curthread.
6196 	 * If it does not exist, then allocate a new trace buffer
6197 	 * and link it in list of trace bufs for this ill, at the head
6198 	 */
6199 	th_trace = th_trace_ill_lookup(ill);
6200 	if (th_trace == NULL) {
6201 		bucket_id = IP_TR_HASH(curthread);
6202 		th_trace = (th_trace_t *)kmem_zalloc(sizeof (th_trace_t),
6203 		    KM_NOSLEEP);
6204 		if (th_trace == NULL) {
6205 			ill->ill_trace_disable = B_TRUE;
6206 			ill_trace_cleanup(ill);
6207 			return;
6208 		}
6209 		th_trace->th_id = curthread;
6210 		th_trace->th_next = ill->ill_trace[bucket_id];
6211 		th_trace->th_prev = &ill->ill_trace[bucket_id];
6212 		if (th_trace->th_next != NULL)
6213 			th_trace->th_next->th_prev = &th_trace->th_next;
6214 		ill->ill_trace[bucket_id] = th_trace;
6215 	}
6216 	ASSERT(th_trace->th_refcnt >= 0 &&
6217 		th_trace->th_refcnt < TR_BUF_MAX - 1);
6218 
6219 	th_trace->th_refcnt++;
6220 	th_trace_rrecord(th_trace);
6221 }
6222 
6223 void
6224 ill_untrace_ref(ill_t *ill)
6225 {
6226 	th_trace_t *th_trace;
6227 
6228 	ASSERT(MUTEX_HELD(&ill->ill_lock));
6229 
6230 	if (ill->ill_trace_disable)
6231 		return;
6232 	th_trace = th_trace_ill_lookup(ill);
6233 	ASSERT(th_trace != NULL);
6234 	ASSERT(th_trace->th_refcnt > 0);
6235 
6236 	th_trace->th_refcnt--;
6237 	th_trace_rrecord(th_trace);
6238 }
6239 
6240 /*
6241  * Verify that this thread has no refs to the ipif and free
6242  * the trace buffers
6243  */
6244 /* ARGSUSED */
6245 void
6246 ipif_thread_exit(ipif_t *ipif, void *dummy)
6247 {
6248 	th_trace_t *th_trace;
6249 
6250 	mutex_enter(&ipif->ipif_ill->ill_lock);
6251 
6252 	th_trace = th_trace_ipif_lookup(ipif);
6253 	if (th_trace == NULL) {
6254 		mutex_exit(&ipif->ipif_ill->ill_lock);
6255 		return;
6256 	}
6257 	ASSERT(th_trace->th_refcnt == 0);
6258 	/* unlink th_trace and free it */
6259 	*th_trace->th_prev = th_trace->th_next;
6260 	if (th_trace->th_next != NULL)
6261 		th_trace->th_next->th_prev = th_trace->th_prev;
6262 	th_trace->th_next = NULL;
6263 	th_trace->th_prev = NULL;
6264 	kmem_free(th_trace, sizeof (th_trace_t));
6265 
6266 	mutex_exit(&ipif->ipif_ill->ill_lock);
6267 }
6268 
6269 /*
6270  * Verify that this thread has no refs to the ill and free
6271  * the trace buffers
6272  */
6273 /* ARGSUSED */
6274 void
6275 ill_thread_exit(ill_t *ill, void *dummy)
6276 {
6277 	th_trace_t *th_trace;
6278 
6279 	mutex_enter(&ill->ill_lock);
6280 
6281 	th_trace = th_trace_ill_lookup(ill);
6282 	if (th_trace == NULL) {
6283 		mutex_exit(&ill->ill_lock);
6284 		return;
6285 	}
6286 	ASSERT(th_trace->th_refcnt == 0);
6287 	/* unlink th_trace and free it */
6288 	*th_trace->th_prev = th_trace->th_next;
6289 	if (th_trace->th_next != NULL)
6290 		th_trace->th_next->th_prev = th_trace->th_prev;
6291 	th_trace->th_next = NULL;
6292 	th_trace->th_prev = NULL;
6293 	kmem_free(th_trace, sizeof (th_trace_t));
6294 
6295 	mutex_exit(&ill->ill_lock);
6296 }
6297 #endif
6298 
6299 #ifdef ILL_DEBUG
6300 void
6301 ip_thread_exit(void)
6302 {
6303 	ill_t	*ill;
6304 	ipif_t	*ipif;
6305 	ill_walk_context_t	ctx;
6306 
6307 	rw_enter(&ill_g_lock, RW_READER);
6308 	ill = ILL_START_WALK_ALL(&ctx);
6309 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
6310 		for (ipif = ill->ill_ipif; ipif != NULL;
6311 		    ipif = ipif->ipif_next) {
6312 			ipif_thread_exit(ipif, NULL);
6313 		}
6314 		ill_thread_exit(ill, NULL);
6315 	}
6316 	rw_exit(&ill_g_lock);
6317 
6318 	ire_walk(ire_thread_exit, NULL);
6319 	ndp_walk_common(&ndp4, NULL, nce_thread_exit, NULL, B_FALSE);
6320 	ndp_walk_common(&ndp6, NULL, nce_thread_exit, NULL, B_FALSE);
6321 }
6322 
6323 /*
6324  * Called when ipif is unplumbed or when memory alloc fails
6325  */
6326 void
6327 ipif_trace_cleanup(ipif_t *ipif)
6328 {
6329 	int	i;
6330 	th_trace_t	*th_trace;
6331 	th_trace_t	*th_trace_next;
6332 
6333 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6334 		for (th_trace = ipif->ipif_trace[i]; th_trace != NULL;
6335 		    th_trace = th_trace_next) {
6336 			th_trace_next = th_trace->th_next;
6337 			kmem_free(th_trace, sizeof (th_trace_t));
6338 		}
6339 		ipif->ipif_trace[i] = NULL;
6340 	}
6341 }
6342 
6343 /*
6344  * Called when ill is unplumbed or when memory alloc fails
6345  */
6346 void
6347 ill_trace_cleanup(ill_t *ill)
6348 {
6349 	int	i;
6350 	th_trace_t	*th_trace;
6351 	th_trace_t	*th_trace_next;
6352 
6353 	for (i = 0; i < IP_TR_HASH_MAX; i++) {
6354 		for (th_trace = ill->ill_trace[i]; th_trace != NULL;
6355 		    th_trace = th_trace_next) {
6356 			th_trace_next = th_trace->th_next;
6357 			kmem_free(th_trace, sizeof (th_trace_t));
6358 		}
6359 		ill->ill_trace[i] = NULL;
6360 	}
6361 }
6362 
6363 #else
6364 void ip_thread_exit(void) {}
6365 #endif
6366 
6367 void
6368 ipif_refhold_locked(ipif_t *ipif)
6369 {
6370 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6371 	ipif->ipif_refcnt++;
6372 	IPIF_TRACE_REF(ipif);
6373 }
6374 
6375 void
6376 ipif_refhold(ipif_t *ipif)
6377 {
6378 	ill_t	*ill;
6379 
6380 	ill = ipif->ipif_ill;
6381 	mutex_enter(&ill->ill_lock);
6382 	ipif->ipif_refcnt++;
6383 	IPIF_TRACE_REF(ipif);
6384 	mutex_exit(&ill->ill_lock);
6385 }
6386 
6387 /*
6388  * Must not be called while holding any locks. Otherwise if this is
6389  * the last reference to be released there is a chance of recursive mutex
6390  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
6391  * to restart an ioctl.
6392  */
6393 void
6394 ipif_refrele(ipif_t *ipif)
6395 {
6396 	ill_t	*ill;
6397 
6398 	ill = ipif->ipif_ill;
6399 
6400 	mutex_enter(&ill->ill_lock);
6401 	ASSERT(ipif->ipif_refcnt != 0);
6402 	ipif->ipif_refcnt--;
6403 	IPIF_UNTRACE_REF(ipif);
6404 	if (ipif->ipif_refcnt != 0) {
6405 		mutex_exit(&ill->ill_lock);
6406 		return;
6407 	}
6408 
6409 	/* Drops the ill_lock */
6410 	ipif_ill_refrele_tail(ill);
6411 }
6412 
6413 ipif_t *
6414 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
6415 {
6416 	ipif_t	*ipif;
6417 
6418 	mutex_enter(&ill->ill_lock);
6419 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
6420 	    ipif != NULL; ipif = ipif->ipif_next) {
6421 		if (!IPIF_CAN_LOOKUP(ipif))
6422 			continue;
6423 		ipif_refhold_locked(ipif);
6424 		mutex_exit(&ill->ill_lock);
6425 		return (ipif);
6426 	}
6427 	mutex_exit(&ill->ill_lock);
6428 	return (NULL);
6429 }
6430 
6431 /*
6432  * TODO: make this table extendible at run time
6433  * Return a pointer to the mac type info for 'mac_type'
6434  */
6435 static ip_m_t *
6436 ip_m_lookup(t_uscalar_t mac_type)
6437 {
6438 	ip_m_t	*ipm;
6439 
6440 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
6441 		if (ipm->ip_m_mac_type == mac_type)
6442 			return (ipm);
6443 	return (NULL);
6444 }
6445 
6446 /*
6447  * ip_rt_add is called to add an IPv4 route to the forwarding table.
6448  * ipif_arg is passed in to associate it with the correct interface.
6449  * We may need to restart this operation if the ipif cannot be looked up
6450  * due to an exclusive operation that is currently in progress. The restart
6451  * entry point is specified by 'func'
6452  */
6453 int
6454 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
6455     ipaddr_t src_addr, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
6456     ire_t **ire_arg, boolean_t ioctl_msg, queue_t *q, mblk_t *mp,
6457     ipsq_func_t func, struct rtsa_s *sp)
6458 {
6459 	ire_t	*ire;
6460 	ire_t	*gw_ire = NULL;
6461 	ipif_t	*ipif = NULL;
6462 	boolean_t ipif_refheld = B_FALSE;
6463 	uint_t	type;
6464 	int	match_flags = MATCH_IRE_TYPE;
6465 	int	error;
6466 	tsol_gc_t *gc = NULL;
6467 	tsol_gcgrp_t *gcgrp = NULL;
6468 	boolean_t gcgrp_xtraref = B_FALSE;
6469 
6470 	ip1dbg(("ip_rt_add:"));
6471 
6472 	if (ire_arg != NULL)
6473 		*ire_arg = NULL;
6474 
6475 	/*
6476 	 * If this is the case of RTF_HOST being set, then we set the netmask
6477 	 * to all ones (regardless if one was supplied).
6478 	 */
6479 	if (flags & RTF_HOST)
6480 		mask = IP_HOST_MASK;
6481 
6482 	/*
6483 	 * Prevent routes with a zero gateway from being created (since
6484 	 * interfaces can currently be plumbed and brought up no assigned
6485 	 * address).
6486 	 * For routes with RTA_SRCIFP, the gateway address can be 0.0.0.0.
6487 	 */
6488 	if (gw_addr == 0 && src_ipif == NULL)
6489 		return (ENETUNREACH);
6490 	/*
6491 	 * Get the ipif, if any, corresponding to the gw_addr
6492 	 */
6493 	if (gw_addr != 0) {
6494 		ipif = ipif_lookup_interface(gw_addr, dst_addr, q, mp, func,
6495 		    &error);
6496 		if (ipif != NULL) {
6497 			if (IS_VNI(ipif->ipif_ill)) {
6498 				ipif_refrele(ipif);
6499 				return (EINVAL);
6500 			}
6501 			ipif_refheld = B_TRUE;
6502 		} else if (error == EINPROGRESS) {
6503 			ip1dbg(("ip_rt_add: null and EINPROGRESS"));
6504 			return (EINPROGRESS);
6505 		} else {
6506 			error = 0;
6507 		}
6508 	}
6509 
6510 	if (ipif != NULL) {
6511 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif nonnull"));
6512 		ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
6513 	} else {
6514 		ip1dbg(("ip_rt_add: ipif_lookup_interface done ipif is null"));
6515 	}
6516 
6517 	/*
6518 	 * GateD will attempt to create routes with a loopback interface
6519 	 * address as the gateway and with RTF_GATEWAY set.  We allow
6520 	 * these routes to be added, but create them as interface routes
6521 	 * since the gateway is an interface address.
6522 	 */
6523 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
6524 		flags &= ~RTF_GATEWAY;
6525 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
6526 		    mask == IP_HOST_MASK) {
6527 			ire = ire_ctable_lookup(dst_addr, 0, IRE_LOOPBACK, ipif,
6528 			    ALL_ZONES, NULL, match_flags);
6529 			if (ire != NULL) {
6530 				ire_refrele(ire);
6531 				if (ipif_refheld)
6532 					ipif_refrele(ipif);
6533 				return (EEXIST);
6534 			}
6535 			ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x"
6536 			    "for 0x%x\n", (void *)ipif,
6537 			    ipif->ipif_ire_type,
6538 			    ntohl(ipif->ipif_lcl_addr)));
6539 			ire = ire_create(
6540 			    (uchar_t *)&dst_addr,	/* dest address */
6541 			    (uchar_t *)&mask,		/* mask */
6542 			    (uchar_t *)&ipif->ipif_src_addr,
6543 			    NULL,			/* no gateway */
6544 			    NULL,
6545 			    &ipif->ipif_mtu,
6546 			    NULL,
6547 			    ipif->ipif_rq,		/* recv-from queue */
6548 			    NULL,			/* no send-to queue */
6549 			    ipif->ipif_ire_type,	/* LOOPBACK */
6550 			    NULL,
6551 			    ipif,
6552 			    NULL,
6553 			    0,
6554 			    0,
6555 			    0,
6556 			    (ipif->ipif_flags & IPIF_PRIVATE) ?
6557 			    RTF_PRIVATE : 0,
6558 			    &ire_uinfo_null,
6559 			    NULL,
6560 			    NULL);
6561 
6562 			if (ire == NULL) {
6563 				if (ipif_refheld)
6564 					ipif_refrele(ipif);
6565 				return (ENOMEM);
6566 			}
6567 			error = ire_add(&ire, q, mp, func, B_FALSE);
6568 			if (error == 0)
6569 				goto save_ire;
6570 			if (ipif_refheld)
6571 				ipif_refrele(ipif);
6572 			return (error);
6573 
6574 		}
6575 	}
6576 
6577 	/*
6578 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
6579 	 * and the gateway address provided is one of the system's interface
6580 	 * addresses.  By using the routing socket interface and supplying an
6581 	 * RTA_IFP sockaddr with an interface index, an alternate method of
6582 	 * specifying an interface route to be created is available which uses
6583 	 * the interface index that specifies the outgoing interface rather than
6584 	 * the address of an outgoing interface (which may not be able to
6585 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
6586 	 * flag, routes can be specified which not only specify the next-hop to
6587 	 * be used when routing to a certain prefix, but also which outgoing
6588 	 * interface should be used.
6589 	 *
6590 	 * Previously, interfaces would have unique addresses assigned to them
6591 	 * and so the address assigned to a particular interface could be used
6592 	 * to identify a particular interface.  One exception to this was the
6593 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
6594 	 *
6595 	 * With the advent of IPv6 and its link-local addresses, this
6596 	 * restriction was relaxed and interfaces could share addresses between
6597 	 * themselves.  In fact, typically all of the link-local interfaces on
6598 	 * an IPv6 node or router will have the same link-local address.  In
6599 	 * order to differentiate between these interfaces, the use of an
6600 	 * interface index is necessary and this index can be carried inside a
6601 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
6602 	 * of using the interface index, however, is that all of the ipif's that
6603 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
6604 	 * cannot be used to differentiate between ipif's (or logical
6605 	 * interfaces) that belong to the same ill (physical interface).
6606 	 *
6607 	 * For example, in the following case involving IPv4 interfaces and
6608 	 * logical interfaces
6609 	 *
6610 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
6611 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0:1
6612 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0:2
6613 	 *
6614 	 * the ipif's corresponding to each of these interface routes can be
6615 	 * uniquely identified by the "gateway" (actually interface address).
6616 	 *
6617 	 * In this case involving multiple IPv6 default routes to a particular
6618 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
6619 	 * default route is of interest:
6620 	 *
6621 	 *	default		fe80::123:4567:89ab:cdef	U	if0
6622 	 *	default		fe80::123:4567:89ab:cdef	U	if1
6623 	 */
6624 
6625 	/* RTF_GATEWAY not set */
6626 	if (!(flags & RTF_GATEWAY)) {
6627 		queue_t	*stq;
6628 		queue_t	*rfq = NULL;
6629 		ill_t	*in_ill = NULL;
6630 
6631 		if (sp != NULL) {
6632 			ip2dbg(("ip_rt_add: gateway security attributes "
6633 			    "cannot be set with interface route\n"));
6634 			if (ipif_refheld)
6635 				ipif_refrele(ipif);
6636 			return (EINVAL);
6637 		}
6638 
6639 		/*
6640 		 * As the interface index specified with the RTA_IFP sockaddr is
6641 		 * the same for all ipif's off of an ill, the matching logic
6642 		 * below uses MATCH_IRE_ILL if such an index was specified.
6643 		 * This means that routes sharing the same prefix when added
6644 		 * using a RTA_IFP sockaddr must have distinct interface
6645 		 * indices (namely, they must be on distinct ill's).
6646 		 *
6647 		 * On the other hand, since the gateway address will usually be
6648 		 * different for each ipif on the system, the matching logic
6649 		 * uses MATCH_IRE_IPIF in the case of a traditional interface
6650 		 * route.  This means that interface routes for the same prefix
6651 		 * can be created if they belong to distinct ipif's and if a
6652 		 * RTA_IFP sockaddr is not present.
6653 		 */
6654 		if (ipif_arg != NULL) {
6655 			if (ipif_refheld)  {
6656 				ipif_refrele(ipif);
6657 				ipif_refheld = B_FALSE;
6658 			}
6659 			ipif = ipif_arg;
6660 			match_flags |= MATCH_IRE_ILL;
6661 		} else {
6662 			/*
6663 			 * Check the ipif corresponding to the gw_addr
6664 			 */
6665 			if (ipif == NULL)
6666 				return (ENETUNREACH);
6667 			match_flags |= MATCH_IRE_IPIF;
6668 		}
6669 		ASSERT(ipif != NULL);
6670 		/*
6671 		 * If src_ipif is not NULL, we have to create
6672 		 * an ire with non-null ire_in_ill value
6673 		 */
6674 		if (src_ipif != NULL) {
6675 			in_ill = src_ipif->ipif_ill;
6676 		}
6677 
6678 		/*
6679 		 * We check for an existing entry at this point.
6680 		 *
6681 		 * Since a netmask isn't passed in via the ioctl interface
6682 		 * (SIOCADDRT), we don't check for a matching netmask in that
6683 		 * case.
6684 		 */
6685 		if (!ioctl_msg)
6686 			match_flags |= MATCH_IRE_MASK;
6687 		if (src_ipif != NULL) {
6688 			/* Look up in the special table */
6689 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
6690 			    ipif, src_ipif->ipif_ill, match_flags);
6691 		} else {
6692 			ire = ire_ftable_lookup(dst_addr, mask, 0,
6693 			    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
6694 			    NULL, match_flags);
6695 		}
6696 		if (ire != NULL) {
6697 			ire_refrele(ire);
6698 			if (ipif_refheld)
6699 				ipif_refrele(ipif);
6700 			return (EEXIST);
6701 		}
6702 
6703 		if (src_ipif != NULL) {
6704 			/*
6705 			 * Create the special ire for the IRE table
6706 			 * which hangs out of ire_in_ill. This ire
6707 			 * is in-between IRE_CACHE and IRE_INTERFACE.
6708 			 * Thus rfq is non-NULL.
6709 			 */
6710 			rfq = ipif->ipif_rq;
6711 		}
6712 		/* Create the usual interface ires */
6713 
6714 		stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
6715 		    ? ipif->ipif_rq : ipif->ipif_wq;
6716 
6717 		/*
6718 		 * Create a copy of the IRE_LOOPBACK,
6719 		 * IRE_IF_NORESOLVER or IRE_IF_RESOLVER with
6720 		 * the modified address and netmask.
6721 		 */
6722 		ire = ire_create(
6723 		    (uchar_t *)&dst_addr,
6724 		    (uint8_t *)&mask,
6725 		    (uint8_t *)&ipif->ipif_src_addr,
6726 		    NULL,
6727 		    NULL,
6728 		    &ipif->ipif_mtu,
6729 		    NULL,
6730 		    rfq,
6731 		    stq,
6732 		    ipif->ipif_net_type,
6733 		    ipif->ipif_resolver_mp,
6734 		    ipif,
6735 		    in_ill,
6736 		    0,
6737 		    0,
6738 		    0,
6739 		    flags,
6740 		    &ire_uinfo_null,
6741 		    NULL,
6742 		    NULL);
6743 		if (ire == NULL) {
6744 			if (ipif_refheld)
6745 				ipif_refrele(ipif);
6746 			return (ENOMEM);
6747 		}
6748 
6749 		/*
6750 		 * Some software (for example, GateD and Sun Cluster) attempts
6751 		 * to create (what amount to) IRE_PREFIX routes with the
6752 		 * loopback address as the gateway.  This is primarily done to
6753 		 * set up prefixes with the RTF_REJECT flag set (for example,
6754 		 * when generating aggregate routes.)
6755 		 *
6756 		 * If the IRE type (as defined by ipif->ipif_net_type) is
6757 		 * IRE_LOOPBACK, then we map the request into a
6758 		 * IRE_IF_NORESOLVER.
6759 		 *
6760 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
6761 		 * routine, but rather using ire_create() directly.
6762 		 *
6763 		 */
6764 		if (ipif->ipif_net_type == IRE_LOOPBACK)
6765 			ire->ire_type = IRE_IF_NORESOLVER;
6766 
6767 		error = ire_add(&ire, q, mp, func, B_FALSE);
6768 		if (error == 0)
6769 			goto save_ire;
6770 
6771 		/*
6772 		 * In the result of failure, ire_add() will have already
6773 		 * deleted the ire in question, so there is no need to
6774 		 * do that here.
6775 		 */
6776 		if (ipif_refheld)
6777 			ipif_refrele(ipif);
6778 		return (error);
6779 	}
6780 	if (ipif_refheld) {
6781 		ipif_refrele(ipif);
6782 		ipif_refheld = B_FALSE;
6783 	}
6784 
6785 	if (src_ipif != NULL) {
6786 		/* RTA_SRCIFP is not supported on RTF_GATEWAY */
6787 		ip2dbg(("ip_rt_add: SRCIF cannot be set with gateway route\n"));
6788 		return (EINVAL);
6789 	}
6790 	/*
6791 	 * Get an interface IRE for the specified gateway.
6792 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
6793 	 * gateway, it is currently unreachable and we fail the request
6794 	 * accordingly.
6795 	 */
6796 	ipif = ipif_arg;
6797 	if (ipif_arg != NULL)
6798 		match_flags |= MATCH_IRE_ILL;
6799 	gw_ire = ire_ftable_lookup(gw_addr, 0, 0, IRE_INTERFACE, ipif_arg, NULL,
6800 	    ALL_ZONES, 0, NULL, match_flags);
6801 	if (gw_ire == NULL)
6802 		return (ENETUNREACH);
6803 
6804 	/*
6805 	 * We create one of three types of IREs as a result of this request
6806 	 * based on the netmask.  A netmask of all ones (which is automatically
6807 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
6808 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
6809 	 * created.  Otherwise, an IRE_PREFIX route is created for the
6810 	 * destination prefix.
6811 	 */
6812 	if (mask == IP_HOST_MASK)
6813 		type = IRE_HOST;
6814 	else if (mask == 0)
6815 		type = IRE_DEFAULT;
6816 	else
6817 		type = IRE_PREFIX;
6818 
6819 	/* check for a duplicate entry */
6820 	ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type, ipif_arg,
6821 	    NULL, ALL_ZONES, 0, NULL,
6822 	    match_flags | MATCH_IRE_MASK | MATCH_IRE_GW);
6823 	if (ire != NULL) {
6824 		ire_refrele(gw_ire);
6825 		ire_refrele(ire);
6826 		return (EEXIST);
6827 	}
6828 
6829 	/* Security attribute exists */
6830 	if (sp != NULL) {
6831 		tsol_gcgrp_addr_t ga;
6832 
6833 		/* find or create the gateway credentials group */
6834 		ga.ga_af = AF_INET;
6835 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
6836 
6837 		/* we hold reference to it upon success */
6838 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
6839 		if (gcgrp == NULL) {
6840 			ire_refrele(gw_ire);
6841 			return (ENOMEM);
6842 		}
6843 
6844 		/*
6845 		 * Create and add the security attribute to the group; a
6846 		 * reference to the group is made upon allocating a new
6847 		 * entry successfully.  If it finds an already-existing
6848 		 * entry for the security attribute in the group, it simply
6849 		 * returns it and no new reference is made to the group.
6850 		 */
6851 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
6852 		if (gc == NULL) {
6853 			/* release reference held by gcgrp_lookup */
6854 			GCGRP_REFRELE(gcgrp);
6855 			ire_refrele(gw_ire);
6856 			return (ENOMEM);
6857 		}
6858 	}
6859 
6860 	/* Create the IRE. */
6861 	ire = ire_create(
6862 	    (uchar_t *)&dst_addr,		/* dest address */
6863 	    (uchar_t *)&mask,			/* mask */
6864 	    /* src address assigned by the caller? */
6865 	    (uchar_t *)(((src_addr != INADDR_ANY) &&
6866 		(flags & RTF_SETSRC)) ?  &src_addr : NULL),
6867 	    (uchar_t *)&gw_addr,		/* gateway address */
6868 	    NULL,				/* no in-srcaddress */
6869 	    &gw_ire->ire_max_frag,
6870 	    NULL,				/* no Fast Path header */
6871 	    NULL,				/* no recv-from queue */
6872 	    NULL,				/* no send-to queue */
6873 	    (ushort_t)type,			/* IRE type */
6874 	    NULL,
6875 	    ipif_arg,
6876 	    NULL,
6877 	    0,
6878 	    0,
6879 	    0,
6880 	    flags,
6881 	    &gw_ire->ire_uinfo,			/* Inherit ULP info from gw */
6882 	    gc,					/* security attribute */
6883 	    NULL);
6884 	/*
6885 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
6886 	 * reference to the 'gcgrp'. We can now release the extra reference
6887 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
6888 	 */
6889 	if (gcgrp_xtraref)
6890 		GCGRP_REFRELE(gcgrp);
6891 	if (ire == NULL) {
6892 		if (gc != NULL)
6893 			GC_REFRELE(gc);
6894 		ire_refrele(gw_ire);
6895 		return (ENOMEM);
6896 	}
6897 
6898 	/*
6899 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
6900 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
6901 	 */
6902 
6903 	/* Add the new IRE. */
6904 	error = ire_add(&ire, q, mp, func, B_FALSE);
6905 	if (error != 0) {
6906 		/*
6907 		 * In the result of failure, ire_add() will have already
6908 		 * deleted the ire in question, so there is no need to
6909 		 * do that here.
6910 		 */
6911 		ire_refrele(gw_ire);
6912 		return (error);
6913 	}
6914 
6915 	if (flags & RTF_MULTIRT) {
6916 		/*
6917 		 * Invoke the CGTP (multirouting) filtering module
6918 		 * to add the dst address in the filtering database.
6919 		 * Replicated inbound packets coming from that address
6920 		 * will be filtered to discard the duplicates.
6921 		 * It is not necessary to call the CGTP filter hook
6922 		 * when the dst address is a broadcast or multicast,
6923 		 * because an IP source address cannot be a broadcast
6924 		 * or a multicast.
6925 		 */
6926 		ire_t *ire_dst = ire_ctable_lookup(ire->ire_addr, 0,
6927 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
6928 		if (ire_dst != NULL) {
6929 			ip_cgtp_bcast_add(ire, ire_dst);
6930 			ire_refrele(ire_dst);
6931 			goto save_ire;
6932 		}
6933 		if ((ip_cgtp_filter_ops != NULL) && !CLASSD(ire->ire_addr)) {
6934 			int res = ip_cgtp_filter_ops->cfo_add_dest_v4(
6935 			    ire->ire_addr,
6936 			    ire->ire_gateway_addr,
6937 			    ire->ire_src_addr,
6938 			    gw_ire->ire_src_addr);
6939 			if (res != 0) {
6940 				ire_refrele(gw_ire);
6941 				ire_delete(ire);
6942 				return (res);
6943 			}
6944 		}
6945 	}
6946 
6947 	/*
6948 	 * Now that the prefix IRE entry has been created, delete any
6949 	 * existing gateway IRE cache entries as well as any IRE caches
6950 	 * using the gateway, and force them to be created through
6951 	 * ip_newroute.
6952 	 */
6953 	if (gc != NULL) {
6954 		ASSERT(gcgrp != NULL);
6955 		ire_clookup_delete_cache_gw(gw_addr, ALL_ZONES);
6956 	}
6957 
6958 save_ire:
6959 	if (gw_ire != NULL) {
6960 		ire_refrele(gw_ire);
6961 	}
6962 	/*
6963 	 * We do not do save_ire for the routes added with RTA_SRCIFP
6964 	 * flag. This route is only added and deleted by mipagent.
6965 	 * So, for simplicity of design, we refrain from saving
6966 	 * ires that are created with srcif value. This may change
6967 	 * in future if we find more usage of srcifp feature.
6968 	 */
6969 	if (ipif != NULL && src_ipif == NULL) {
6970 		/*
6971 		 * Save enough information so that we can recreate the IRE if
6972 		 * the interface goes down and then up.  The metrics associated
6973 		 * with the route will be saved as well when rts_setmetrics() is
6974 		 * called after the IRE has been created.  In the case where
6975 		 * memory cannot be allocated, none of this information will be
6976 		 * saved.
6977 		 */
6978 		ipif_save_ire(ipif, ire);
6979 	}
6980 	if (ioctl_msg)
6981 		ip_rts_rtmsg(RTM_OLDADD, ire, 0);
6982 	if (ire_arg != NULL) {
6983 		/*
6984 		 * Store the ire that was successfully added into where ire_arg
6985 		 * points to so that callers don't have to look it up
6986 		 * themselves (but they are responsible for ire_refrele()ing
6987 		 * the ire when they are finished with it).
6988 		 */
6989 		*ire_arg = ire;
6990 	} else {
6991 		ire_refrele(ire);		/* Held in ire_add */
6992 	}
6993 	if (ipif_refheld)
6994 		ipif_refrele(ipif);
6995 	return (0);
6996 }
6997 
6998 /*
6999  * ip_rt_delete is called to delete an IPv4 route.
7000  * ipif_arg is passed in to associate it with the correct interface.
7001  * src_ipif is passed to associate the incoming interface of the packet.
7002  * We may need to restart this operation if the ipif cannot be looked up
7003  * due to an exclusive operation that is currently in progress. The restart
7004  * entry point is specified by 'func'
7005  */
7006 /* ARGSUSED4 */
7007 int
7008 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
7009     uint_t rtm_addrs, int flags, ipif_t *ipif_arg, ipif_t *src_ipif,
7010     boolean_t ioctl_msg, queue_t *q, mblk_t *mp, ipsq_func_t func)
7011 {
7012 	ire_t	*ire = NULL;
7013 	ipif_t	*ipif;
7014 	boolean_t ipif_refheld = B_FALSE;
7015 	uint_t	type;
7016 	uint_t	match_flags = MATCH_IRE_TYPE;
7017 	int	err = 0;
7018 
7019 	ip1dbg(("ip_rt_delete:"));
7020 	/*
7021 	 * If this is the case of RTF_HOST being set, then we set the netmask
7022 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
7023 	 */
7024 	if (flags & RTF_HOST) {
7025 		mask = IP_HOST_MASK;
7026 		match_flags |= MATCH_IRE_MASK;
7027 	} else if (rtm_addrs & RTA_NETMASK) {
7028 		match_flags |= MATCH_IRE_MASK;
7029 	}
7030 
7031 	/*
7032 	 * Note that RTF_GATEWAY is never set on a delete, therefore
7033 	 * we check if the gateway address is one of our interfaces first,
7034 	 * and fall back on RTF_GATEWAY routes.
7035 	 *
7036 	 * This makes it possible to delete an original
7037 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
7038 	 *
7039 	 * As the interface index specified with the RTA_IFP sockaddr is the
7040 	 * same for all ipif's off of an ill, the matching logic below uses
7041 	 * MATCH_IRE_ILL if such an index was specified.  This means a route
7042 	 * sharing the same prefix and interface index as the the route
7043 	 * intended to be deleted might be deleted instead if a RTA_IFP sockaddr
7044 	 * is specified in the request.
7045 	 *
7046 	 * On the other hand, since the gateway address will usually be
7047 	 * different for each ipif on the system, the matching logic
7048 	 * uses MATCH_IRE_IPIF in the case of a traditional interface
7049 	 * route.  This means that interface routes for the same prefix can be
7050 	 * uniquely identified if they belong to distinct ipif's and if a
7051 	 * RTA_IFP sockaddr is not present.
7052 	 *
7053 	 * For more detail on specifying routes by gateway address and by
7054 	 * interface index, see the comments in ip_rt_add().
7055 	 * gw_addr could be zero in some cases when both RTA_SRCIFP and
7056 	 * RTA_IFP are specified. If RTA_SRCIFP is specified and  both
7057 	 * RTA_IFP and gateway_addr are NULL/zero, then delete will not
7058 	 * succeed.
7059 	 */
7060 	if (src_ipif != NULL) {
7061 		if (ipif_arg == NULL && gw_addr != 0) {
7062 			ipif_arg = ipif_lookup_interface(gw_addr, dst_addr,
7063 			    q, mp, func, &err);
7064 			if (ipif_arg != NULL)
7065 				ipif_refheld = B_TRUE;
7066 		}
7067 		if (ipif_arg == NULL) {
7068 			err = (err == EINPROGRESS) ? err : ESRCH;
7069 			return (err);
7070 		}
7071 		ipif = ipif_arg;
7072 	} else {
7073 		ipif = ipif_lookup_interface(gw_addr, dst_addr,
7074 			    q, mp, func, &err);
7075 		if (ipif != NULL)
7076 			ipif_refheld = B_TRUE;
7077 		else if (err == EINPROGRESS)
7078 			return (err);
7079 		else
7080 			err = 0;
7081 	}
7082 	if (ipif != NULL) {
7083 		if (ipif_arg != NULL) {
7084 			if (ipif_refheld) {
7085 				ipif_refrele(ipif);
7086 				ipif_refheld = B_FALSE;
7087 			}
7088 			ipif = ipif_arg;
7089 			match_flags |= MATCH_IRE_ILL;
7090 		} else {
7091 			match_flags |= MATCH_IRE_IPIF;
7092 		}
7093 		if (src_ipif != NULL) {
7094 			ire = ire_srcif_table_lookup(dst_addr, IRE_INTERFACE,
7095 			    ipif, src_ipif->ipif_ill, match_flags);
7096 		} else {
7097 			if (ipif->ipif_ire_type == IRE_LOOPBACK) {
7098 				ire = ire_ctable_lookup(dst_addr, 0,
7099 				    IRE_LOOPBACK, ipif, ALL_ZONES, NULL,
7100 				    match_flags);
7101 			}
7102 			if (ire == NULL) {
7103 				ire = ire_ftable_lookup(dst_addr, mask, 0,
7104 				    IRE_INTERFACE, ipif, NULL, ALL_ZONES, 0,
7105 				    NULL, match_flags);
7106 			}
7107 		}
7108 	}
7109 
7110 	if (ire == NULL) {
7111 		/*
7112 		 * At this point, the gateway address is not one of our own
7113 		 * addresses or a matching interface route was not found.  We
7114 		 * set the IRE type to lookup based on whether
7115 		 * this is a host route, a default route or just a prefix.
7116 		 *
7117 		 * If an ipif_arg was passed in, then the lookup is based on an
7118 		 * interface index so MATCH_IRE_ILL is added to match_flags.
7119 		 * In any case, MATCH_IRE_IPIF is cleared and MATCH_IRE_GW is
7120 		 * set as the route being looked up is not a traditional
7121 		 * interface route.
7122 		 * Since we do not add gateway route with srcipif, we don't
7123 		 * expect to find it either.
7124 		 */
7125 		if (src_ipif != NULL) {
7126 			if (ipif_refheld)
7127 				ipif_refrele(ipif);
7128 			return (ESRCH);
7129 		} else {
7130 			match_flags &= ~MATCH_IRE_IPIF;
7131 			match_flags |= MATCH_IRE_GW;
7132 			if (ipif_arg != NULL)
7133 				match_flags |= MATCH_IRE_ILL;
7134 			if (mask == IP_HOST_MASK)
7135 				type = IRE_HOST;
7136 			else if (mask == 0)
7137 				type = IRE_DEFAULT;
7138 			else
7139 				type = IRE_PREFIX;
7140 			ire = ire_ftable_lookup(dst_addr, mask, gw_addr, type,
7141 			    ipif_arg, NULL, ALL_ZONES, 0, NULL, match_flags);
7142 			if (ire == NULL && type == IRE_HOST) {
7143 				ire = ire_ftable_lookup(dst_addr, mask, gw_addr,
7144 				    IRE_HOST_REDIRECT, ipif_arg, NULL,
7145 				    ALL_ZONES, 0, NULL, match_flags);
7146 			}
7147 		}
7148 	}
7149 
7150 	if (ipif_refheld)
7151 		ipif_refrele(ipif);
7152 
7153 	/* ipif is not refheld anymore */
7154 	if (ire == NULL)
7155 		return (ESRCH);
7156 
7157 	if (ire->ire_flags & RTF_MULTIRT) {
7158 		/*
7159 		 * Invoke the CGTP (multirouting) filtering module
7160 		 * to remove the dst address from the filtering database.
7161 		 * Packets coming from that address will no longer be
7162 		 * filtered to remove duplicates.
7163 		 */
7164 		if (ip_cgtp_filter_ops != NULL) {
7165 			err = ip_cgtp_filter_ops->cfo_del_dest_v4(ire->ire_addr,
7166 			    ire->ire_gateway_addr);
7167 		}
7168 		ip_cgtp_bcast_delete(ire);
7169 	}
7170 
7171 	ipif = ire->ire_ipif;
7172 	/*
7173 	 * Removing from ipif_saved_ire_mp is not necessary
7174 	 * when src_ipif being non-NULL. ip_rt_add does not
7175 	 * save the ires which src_ipif being non-NULL.
7176 	 */
7177 	if (ipif != NULL && src_ipif == NULL) {
7178 		ipif_remove_ire(ipif, ire);
7179 	}
7180 	if (ioctl_msg)
7181 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0);
7182 	ire_delete(ire);
7183 	ire_refrele(ire);
7184 	return (err);
7185 }
7186 
7187 /*
7188  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
7189  */
7190 /* ARGSUSED */
7191 int
7192 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7193     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7194 {
7195 	ipaddr_t dst_addr;
7196 	ipaddr_t gw_addr;
7197 	ipaddr_t mask;
7198 	int error = 0;
7199 	mblk_t *mp1;
7200 	struct rtentry *rt;
7201 	ipif_t *ipif = NULL;
7202 
7203 	ip1dbg(("ip_siocaddrt:"));
7204 	/* Existence of mp1 verified in ip_wput_nondata */
7205 	mp1 = mp->b_cont->b_cont;
7206 	rt = (struct rtentry *)mp1->b_rptr;
7207 
7208 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7209 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7210 
7211 	/*
7212 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
7213 	 * to a particular host address.  In this case, we set the netmask to
7214 	 * all ones for the particular destination address.  Otherwise,
7215 	 * determine the netmask to be used based on dst_addr and the interfaces
7216 	 * in use.
7217 	 */
7218 	if (rt->rt_flags & RTF_HOST) {
7219 		mask = IP_HOST_MASK;
7220 	} else {
7221 		/*
7222 		 * Note that ip_subnet_mask returns a zero mask in the case of
7223 		 * default (an all-zeroes address).
7224 		 */
7225 		mask = ip_subnet_mask(dst_addr, &ipif);
7226 	}
7227 
7228 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
7229 	    NULL, B_TRUE, q, mp, ip_process_ioctl, NULL);
7230 	if (ipif != NULL)
7231 		ipif_refrele(ipif);
7232 	return (error);
7233 }
7234 
7235 /*
7236  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
7237  */
7238 /* ARGSUSED */
7239 int
7240 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
7241     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
7242 {
7243 	ipaddr_t dst_addr;
7244 	ipaddr_t gw_addr;
7245 	ipaddr_t mask;
7246 	int error;
7247 	mblk_t *mp1;
7248 	struct rtentry *rt;
7249 	ipif_t *ipif = NULL;
7250 
7251 	ip1dbg(("ip_siocdelrt:"));
7252 	/* Existence of mp1 verified in ip_wput_nondata */
7253 	mp1 = mp->b_cont->b_cont;
7254 	rt = (struct rtentry *)mp1->b_rptr;
7255 
7256 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
7257 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
7258 
7259 	/*
7260 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
7261 	 * to a particular host address.  In this case, we set the netmask to
7262 	 * all ones for the particular destination address.  Otherwise,
7263 	 * determine the netmask to be used based on dst_addr and the interfaces
7264 	 * in use.
7265 	 */
7266 	if (rt->rt_flags & RTF_HOST) {
7267 		mask = IP_HOST_MASK;
7268 	} else {
7269 		/*
7270 		 * Note that ip_subnet_mask returns a zero mask in the case of
7271 		 * default (an all-zeroes address).
7272 		 */
7273 		mask = ip_subnet_mask(dst_addr, &ipif);
7274 	}
7275 
7276 	error = ip_rt_delete(dst_addr, mask, gw_addr,
7277 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, NULL,
7278 	    B_TRUE, q, mp, ip_process_ioctl);
7279 	if (ipif != NULL)
7280 		ipif_refrele(ipif);
7281 	return (error);
7282 }
7283 
7284 /*
7285  * Enqueue the mp onto the ipsq, chained by b_next.
7286  * b_prev stores the function to be executed later, and b_queue the queue
7287  * where this mp originated.
7288  */
7289 void
7290 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
7291     ill_t *pending_ill)
7292 {
7293 	conn_t	*connp = NULL;
7294 
7295 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7296 	ASSERT(func != NULL);
7297 
7298 	mp->b_queue = q;
7299 	mp->b_prev = (void *)func;
7300 	mp->b_next = NULL;
7301 
7302 	switch (type) {
7303 	case CUR_OP:
7304 		if (ipsq->ipsq_mptail != NULL) {
7305 			ASSERT(ipsq->ipsq_mphead != NULL);
7306 			ipsq->ipsq_mptail->b_next = mp;
7307 		} else {
7308 			ASSERT(ipsq->ipsq_mphead == NULL);
7309 			ipsq->ipsq_mphead = mp;
7310 		}
7311 		ipsq->ipsq_mptail = mp;
7312 		break;
7313 
7314 	case NEW_OP:
7315 		if (ipsq->ipsq_xopq_mptail != NULL) {
7316 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
7317 			ipsq->ipsq_xopq_mptail->b_next = mp;
7318 		} else {
7319 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
7320 			ipsq->ipsq_xopq_mphead = mp;
7321 		}
7322 		ipsq->ipsq_xopq_mptail = mp;
7323 		break;
7324 	default:
7325 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
7326 	}
7327 
7328 	if (CONN_Q(q) && pending_ill != NULL) {
7329 		connp = Q_TO_CONN(q);
7330 
7331 		ASSERT(MUTEX_HELD(&connp->conn_lock));
7332 		connp->conn_oper_pending_ill = pending_ill;
7333 	}
7334 }
7335 
7336 /*
7337  * Return the mp at the head of the ipsq. After emptying the ipsq
7338  * look at the next ioctl, if this ioctl is complete. Otherwise
7339  * return, we will resume when we complete the current ioctl.
7340  * The current ioctl will wait till it gets a response from the
7341  * driver below.
7342  */
7343 static mblk_t *
7344 ipsq_dq(ipsq_t *ipsq)
7345 {
7346 	mblk_t	*mp;
7347 
7348 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
7349 
7350 	mp = ipsq->ipsq_mphead;
7351 	if (mp != NULL) {
7352 		ipsq->ipsq_mphead = mp->b_next;
7353 		if (ipsq->ipsq_mphead == NULL)
7354 			ipsq->ipsq_mptail = NULL;
7355 		mp->b_next = NULL;
7356 		return (mp);
7357 	}
7358 	if (ipsq->ipsq_current_ipif != NULL)
7359 		return (NULL);
7360 	mp = ipsq->ipsq_xopq_mphead;
7361 	if (mp != NULL) {
7362 		ipsq->ipsq_xopq_mphead = mp->b_next;
7363 		if (ipsq->ipsq_xopq_mphead == NULL)
7364 			ipsq->ipsq_xopq_mptail = NULL;
7365 		mp->b_next = NULL;
7366 		return (mp);
7367 	}
7368 	return (NULL);
7369 }
7370 
7371 /*
7372  * Enter the ipsq corresponding to ill, by waiting synchronously till
7373  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
7374  * will have to drain completely before ipsq_enter returns success.
7375  * ipsq_current_ipif will be set if some exclusive ioctl is in progress,
7376  * and the ipsq_exit logic will start the next enqueued ioctl after
7377  * completion of the current ioctl. If 'force' is used, we don't wait
7378  * for the enqueued ioctls. This is needed when a conn_close wants to
7379  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
7380  * of an ill can also use this option. But we dont' use it currently.
7381  */
7382 #define	ENTER_SQ_WAIT_TICKS 100
7383 boolean_t
7384 ipsq_enter(ill_t *ill, boolean_t force)
7385 {
7386 	ipsq_t	*ipsq;
7387 	boolean_t waited_enough = B_FALSE;
7388 
7389 	/*
7390 	 * Holding the ill_lock prevents <ill-ipsq> assocs from changing.
7391 	 * Since the <ill-ipsq> assocs could change while we wait for the
7392 	 * writer, it is easier to wait on a fixed global rather than try to
7393 	 * cv_wait on a changing ipsq.
7394 	 */
7395 	mutex_enter(&ill->ill_lock);
7396 	for (;;) {
7397 		if (ill->ill_state_flags & ILL_CONDEMNED) {
7398 			mutex_exit(&ill->ill_lock);
7399 			return (B_FALSE);
7400 		}
7401 
7402 		ipsq = ill->ill_phyint->phyint_ipsq;
7403 		mutex_enter(&ipsq->ipsq_lock);
7404 		if (ipsq->ipsq_writer == NULL &&
7405 		    (ipsq->ipsq_current_ipif == NULL || waited_enough)) {
7406 			break;
7407 		} else if (ipsq->ipsq_writer != NULL) {
7408 			mutex_exit(&ipsq->ipsq_lock);
7409 			cv_wait(&ill->ill_cv, &ill->ill_lock);
7410 		} else {
7411 			mutex_exit(&ipsq->ipsq_lock);
7412 			if (force) {
7413 				(void) cv_timedwait(&ill->ill_cv,
7414 				    &ill->ill_lock,
7415 				    lbolt + ENTER_SQ_WAIT_TICKS);
7416 				waited_enough = B_TRUE;
7417 				continue;
7418 			} else {
7419 				cv_wait(&ill->ill_cv, &ill->ill_lock);
7420 			}
7421 		}
7422 	}
7423 
7424 	ASSERT(ipsq->ipsq_mphead == NULL && ipsq->ipsq_mptail == NULL);
7425 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7426 	ipsq->ipsq_writer = curthread;
7427 	ipsq->ipsq_reentry_cnt++;
7428 #ifdef ILL_DEBUG
7429 	ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7430 #endif
7431 	mutex_exit(&ipsq->ipsq_lock);
7432 	mutex_exit(&ill->ill_lock);
7433 	return (B_TRUE);
7434 }
7435 
7436 /*
7437  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
7438  * certain critical operations like plumbing (i.e. most set ioctls),
7439  * multicast joins, igmp/mld timers, IPMP operations etc. On a non-IPMP
7440  * system there is 1 ipsq per phyint. On an IPMP system there is 1 ipsq per
7441  * IPMP group. The ipsq serializes exclusive ioctls issued by applications
7442  * on a per ipsq basis in ipsq_xopq_mphead. It also protects against multiple
7443  * threads executing in the ipsq. Responses from the driver pertain to the
7444  * current ioctl (say a DL_BIND_ACK in response to a DL_BIND_REQUEST initiated
7445  * as part of bringing up the interface) and are enqueued in ipsq_mphead.
7446  *
7447  * If a thread does not want to reenter the ipsq when it is already writer,
7448  * it must make sure that the specified reentry point to be called later
7449  * when the ipsq is empty, nor any code path starting from the specified reentry
7450  * point must never ever try to enter the ipsq again. Otherwise it can lead
7451  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
7452  * When the thread that is currently exclusive finishes, it (ipsq_exit)
7453  * dequeues the requests waiting to become exclusive in ipsq_mphead and calls
7454  * the reentry point. When the list at ipsq_mphead becomes empty ipsq_exit
7455  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
7456  * ioctl if the current ioctl has completed. If the current ioctl is still
7457  * in progress it simply returns. The current ioctl could be waiting for
7458  * a response from another module (arp_ or the driver or could be waiting for
7459  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipsq_pending_mp
7460  * and ipsq_pending_ipif are set. ipsq_current_ipif is set throughout the
7461  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
7462  * ipsq_current_ipif is clear which happens only on ioctl completion.
7463  */
7464 
7465 /*
7466  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7467  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7468  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7469  * completion.
7470  */
7471 ipsq_t *
7472 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7473     ipsq_func_t func, int type, boolean_t reentry_ok)
7474 {
7475 	ipsq_t	*ipsq;
7476 
7477 	/* Only 1 of ipif or ill can be specified */
7478 	ASSERT((ipif != NULL) ^ (ill != NULL));
7479 	if (ipif != NULL)
7480 		ill = ipif->ipif_ill;
7481 
7482 	/*
7483 	 * lock ordering ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock
7484 	 * ipsq of an ill can't change when ill_lock is held.
7485 	 */
7486 	GRAB_CONN_LOCK(q);
7487 	mutex_enter(&ill->ill_lock);
7488 	ipsq = ill->ill_phyint->phyint_ipsq;
7489 	mutex_enter(&ipsq->ipsq_lock);
7490 
7491 	/*
7492 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
7493 	 *    (Note: If the caller does not specify reentry_ok then neither
7494 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
7495 	 *    again. Otherwise it can lead to an infinite loop
7496 	 * 2. Enter the ipsq if there is no current writer and this attempted
7497 	 *    entry is part of the current ioctl or operation
7498 	 * 3. Enter the ipsq if there is no current writer and this is a new
7499 	 *    ioctl (or operation) and the ioctl (or operation) queue is
7500 	 *    empty and there is no ioctl (or operation) currently in progress
7501 	 */
7502 	if ((ipsq->ipsq_writer == NULL && ((type == CUR_OP) ||
7503 	    (type == NEW_OP && ipsq->ipsq_xopq_mphead == NULL &&
7504 	    ipsq->ipsq_current_ipif == NULL))) ||
7505 	    (ipsq->ipsq_writer == curthread && reentry_ok)) {
7506 		/* Success. */
7507 		ipsq->ipsq_reentry_cnt++;
7508 		ipsq->ipsq_writer = curthread;
7509 		mutex_exit(&ipsq->ipsq_lock);
7510 		mutex_exit(&ill->ill_lock);
7511 		RELEASE_CONN_LOCK(q);
7512 #ifdef ILL_DEBUG
7513 		ipsq->ipsq_depth = getpcstack(ipsq->ipsq_stack, IP_STACK_DEPTH);
7514 #endif
7515 		return (ipsq);
7516 	}
7517 
7518 	ipsq_enq(ipsq, q, mp, func, type, ill);
7519 
7520 	mutex_exit(&ipsq->ipsq_lock);
7521 	mutex_exit(&ill->ill_lock);
7522 	RELEASE_CONN_LOCK(q);
7523 	return (NULL);
7524 }
7525 
7526 /*
7527  * Try to enter the ipsq exclusively, corresponding to ipif or ill. (only 1 of
7528  * ipif or ill can be specified). The caller ensures ipif or ill is valid by
7529  * ref-holding it if necessary. If the ipsq cannot be entered, the mp is queued
7530  * completion.
7531  *
7532  * This function does a refrele on the ipif/ill.
7533  */
7534 void
7535 qwriter_ip(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
7536     ipsq_func_t func, int type, boolean_t reentry_ok)
7537 {
7538 	ipsq_t	*ipsq;
7539 
7540 	ipsq = ipsq_try_enter(ipif, ill, q, mp, func, type, reentry_ok);
7541 	/*
7542 	 * Caller must have done a refhold on the ipif. ipif_refrele
7543 	 * happens on the passed ipif. We can do this since we are
7544 	 * already exclusive, or we won't access ipif henceforth, Both
7545 	 * this func and caller will just return if we ipsq_try_enter
7546 	 * fails above. This is needed because func needs to
7547 	 * see the correct refcount. Eg. removeif can work only then.
7548 	 */
7549 	if (ipif != NULL)
7550 		ipif_refrele(ipif);
7551 	else
7552 		ill_refrele(ill);
7553 	if (ipsq != NULL) {
7554 		(*func)(ipsq, q, mp, NULL);
7555 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
7556 	}
7557 }
7558 
7559 /*
7560  * If there are more than ILL_GRP_CNT ills in a group,
7561  * we use kmem alloc'd buffers, else use the stack
7562  */
7563 #define	ILL_GRP_CNT	14
7564 /*
7565  * Drain the ipsq, if there are messages on it, and then leave the ipsq.
7566  * Called by a thread that is currently exclusive on this ipsq.
7567  */
7568 void
7569 ipsq_exit(ipsq_t *ipsq, boolean_t start_igmp_timer, boolean_t start_mld_timer)
7570 {
7571 	queue_t	*q;
7572 	mblk_t	*mp;
7573 	ipsq_func_t	func;
7574 	int	next;
7575 	ill_t	**ill_list = NULL;
7576 	size_t	ill_list_size = 0;
7577 	int	cnt = 0;
7578 	boolean_t need_ipsq_free = B_FALSE;
7579 
7580 	ASSERT(IAM_WRITER_IPSQ(ipsq));
7581 	mutex_enter(&ipsq->ipsq_lock);
7582 	ASSERT(ipsq->ipsq_reentry_cnt >= 1);
7583 	if (ipsq->ipsq_reentry_cnt != 1) {
7584 		ipsq->ipsq_reentry_cnt--;
7585 		mutex_exit(&ipsq->ipsq_lock);
7586 		return;
7587 	}
7588 
7589 	mp = ipsq_dq(ipsq);
7590 	while (mp != NULL) {
7591 again:
7592 		mutex_exit(&ipsq->ipsq_lock);
7593 		func = (ipsq_func_t)mp->b_prev;
7594 		q = (queue_t *)mp->b_queue;
7595 		mp->b_prev = NULL;
7596 		mp->b_queue = NULL;
7597 
7598 		/*
7599 		 * If 'q' is an conn queue, it is valid, since we did a
7600 		 * a refhold on the connp, at the start of the ioctl.
7601 		 * If 'q' is an ill queue, it is valid, since close of an
7602 		 * ill will clean up the 'ipsq'.
7603 		 */
7604 		(*func)(ipsq, q, mp, NULL);
7605 
7606 		mutex_enter(&ipsq->ipsq_lock);
7607 		mp = ipsq_dq(ipsq);
7608 	}
7609 
7610 	mutex_exit(&ipsq->ipsq_lock);
7611 
7612 	/*
7613 	 * Need to grab the locks in the right order. Need to
7614 	 * atomically check (under ipsq_lock) that there are no
7615 	 * messages before relinquishing the ipsq. Also need to
7616 	 * atomically wakeup waiters on ill_cv while holding ill_lock.
7617 	 * Holding ill_g_lock ensures that ipsq list of ills is stable.
7618 	 * If we need to call ill_split_ipsq and change <ill-ipsq> we need
7619 	 * to grab ill_g_lock as writer.
7620 	 */
7621 	rw_enter(&ill_g_lock, ipsq->ipsq_split ? RW_WRITER : RW_READER);
7622 
7623 	/* ipsq_refs can't change while ill_g_lock is held as reader */
7624 	if (ipsq->ipsq_refs != 0) {
7625 		/* At most 2 ills v4/v6 per phyint */
7626 		cnt = ipsq->ipsq_refs << 1;
7627 		ill_list_size = cnt * sizeof (ill_t *);
7628 		/*
7629 		 * If memory allocation fails, we will do the split
7630 		 * the next time ipsq_exit is called for whatever reason.
7631 		 * As long as the ipsq_split flag is set the need to
7632 		 * split is remembered.
7633 		 */
7634 		ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
7635 		if (ill_list != NULL)
7636 			cnt = ill_lock_ipsq_ills(ipsq, ill_list, cnt);
7637 	}
7638 	mutex_enter(&ipsq->ipsq_lock);
7639 	mp = ipsq_dq(ipsq);
7640 	if (mp != NULL) {
7641 		/* oops, some message has landed up, we can't get out */
7642 		if (ill_list != NULL)
7643 			ill_unlock_ills(ill_list, cnt);
7644 		rw_exit(&ill_g_lock);
7645 		if (ill_list != NULL)
7646 			kmem_free(ill_list, ill_list_size);
7647 		ill_list = NULL;
7648 		ill_list_size = 0;
7649 		cnt = 0;
7650 		goto again;
7651 	}
7652 
7653 	/*
7654 	 * Split only if no ioctl is pending and if memory alloc succeeded
7655 	 * above.
7656 	 */
7657 	if (ipsq->ipsq_split && ipsq->ipsq_current_ipif == NULL &&
7658 		ill_list != NULL) {
7659 		/*
7660 		 * No new ill can join this ipsq since we are holding the
7661 		 * ill_g_lock. Hence ill_split_ipsq can safely traverse the
7662 		 * ipsq. ill_split_ipsq may fail due to memory shortage.
7663 		 * If so we will retry on the next ipsq_exit.
7664 		 */
7665 		ipsq->ipsq_split = ill_split_ipsq(ipsq);
7666 	}
7667 
7668 	/*
7669 	 * We are holding the ipsq lock, hence no new messages can
7670 	 * land up on the ipsq, and there are no messages currently.
7671 	 * Now safe to get out. Wake up waiters and relinquish ipsq
7672 	 * atomically while holding ill locks.
7673 	 */
7674 	ipsq->ipsq_writer = NULL;
7675 	ipsq->ipsq_reentry_cnt--;
7676 	ASSERT(ipsq->ipsq_reentry_cnt == 0);
7677 #ifdef ILL_DEBUG
7678 	ipsq->ipsq_depth = 0;
7679 #endif
7680 	mutex_exit(&ipsq->ipsq_lock);
7681 	/*
7682 	 * For IPMP this should wake up all ills in this ipsq.
7683 	 * We need to hold the ill_lock while waking up waiters to
7684 	 * avoid missed wakeups. But there is no need to acquire all
7685 	 * the ill locks and then wakeup. If we have not acquired all
7686 	 * the locks (due to memory failure above) ill_signal_ipsq_ills
7687 	 * wakes up ills one at a time after getting the right ill_lock
7688 	 */
7689 	ill_signal_ipsq_ills(ipsq, ill_list != NULL);
7690 	if (ill_list != NULL)
7691 		ill_unlock_ills(ill_list, cnt);
7692 	if (ipsq->ipsq_refs == 0)
7693 		need_ipsq_free = B_TRUE;
7694 	rw_exit(&ill_g_lock);
7695 	if (ill_list != 0)
7696 		kmem_free(ill_list, ill_list_size);
7697 
7698 	if (need_ipsq_free) {
7699 		/*
7700 		 * Free the ipsq. ipsq_refs can't increase because ipsq can't be
7701 		 * looked up. ipsq can be looked up only thru ill or phyint
7702 		 * and there are no ills/phyint on this ipsq.
7703 		 */
7704 		ipsq_delete(ipsq);
7705 	}
7706 	/*
7707 	 * Now start any igmp or mld timers that could not be started
7708 	 * while inside the ipsq. The timers can't be started while inside
7709 	 * the ipsq, since igmp_start_timers may need to call untimeout()
7710 	 * which can't be done while holding a lock i.e. the ipsq. Otherwise
7711 	 * there could be a deadlock since the timeout handlers
7712 	 * mld_timeout_handler / igmp_timeout_handler also synchronously
7713 	 * wait in ipsq_enter() trying to get the ipsq.
7714 	 *
7715 	 * However there is one exception to the above. If this thread is
7716 	 * itself the igmp/mld timeout handler thread, then we don't want
7717 	 * to start any new timer until the current handler is done. The
7718 	 * handler thread passes in B_FALSE for start_igmp/mld_timers, while
7719 	 * all others pass B_TRUE.
7720 	 */
7721 	if (start_igmp_timer) {
7722 		mutex_enter(&igmp_timer_lock);
7723 		next = igmp_deferred_next;
7724 		igmp_deferred_next = INFINITY;
7725 		mutex_exit(&igmp_timer_lock);
7726 
7727 		if (next != INFINITY)
7728 			igmp_start_timers(next);
7729 	}
7730 
7731 	if (start_mld_timer) {
7732 		mutex_enter(&mld_timer_lock);
7733 		next = mld_deferred_next;
7734 		mld_deferred_next = INFINITY;
7735 		mutex_exit(&mld_timer_lock);
7736 
7737 		if (next != INFINITY)
7738 			mld_start_timers(next);
7739 	}
7740 }
7741 
7742 /*
7743  * The ill is closing. Flush all messages on the ipsq that originated
7744  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
7745  * for this ill since ipsq_enter could not have entered until then.
7746  * New messages can't be queued since the CONDEMNED flag is set.
7747  */
7748 static void
7749 ipsq_flush(ill_t *ill)
7750 {
7751 	queue_t	*q;
7752 	mblk_t	*prev;
7753 	mblk_t	*mp;
7754 	mblk_t	*mp_next;
7755 	ipsq_t	*ipsq;
7756 
7757 	ASSERT(IAM_WRITER_ILL(ill));
7758 	ipsq = ill->ill_phyint->phyint_ipsq;
7759 	/*
7760 	 * Flush any messages sent up by the driver.
7761 	 */
7762 	mutex_enter(&ipsq->ipsq_lock);
7763 	for (prev = NULL, mp = ipsq->ipsq_mphead; mp != NULL; mp = mp_next) {
7764 		mp_next = mp->b_next;
7765 		q = mp->b_queue;
7766 		if (q == ill->ill_rq || q == ill->ill_wq) {
7767 			/* Remove the mp from the ipsq */
7768 			if (prev == NULL)
7769 				ipsq->ipsq_mphead = mp->b_next;
7770 			else
7771 				prev->b_next = mp->b_next;
7772 			if (ipsq->ipsq_mptail == mp) {
7773 				ASSERT(mp_next == NULL);
7774 				ipsq->ipsq_mptail = prev;
7775 			}
7776 			inet_freemsg(mp);
7777 		} else {
7778 			prev = mp;
7779 		}
7780 	}
7781 	mutex_exit(&ipsq->ipsq_lock);
7782 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7783 	ipsq_xopq_mp_cleanup(ill, NULL);
7784 	ill_pending_mp_cleanup(ill);
7785 }
7786 
7787 /*
7788  * Clean up one squeue element. ill_inuse_ref is protected by ill_lock.
7789  * The real cleanup happens behind the squeue via ip_squeue_clean function but
7790  * we need to protect ourselfs from 2 threads trying to cleanup at the same
7791  * time (possible with one port going down for aggr and someone tearing down the
7792  * entire aggr simultaneously. So we use ill_inuse_ref protected by ill_lock
7793  * to indicate when the cleanup has started (1 ref) and when the cleanup
7794  * is done (0 ref). When a new ring gets assigned to squeue, we start by
7795  * putting 2 ref on ill_inuse_ref.
7796  */
7797 static void
7798 ipsq_clean_ring(ill_t *ill, ill_rx_ring_t *rx_ring)
7799 {
7800 	conn_t *connp;
7801 	squeue_t *sqp;
7802 	mblk_t *mp;
7803 
7804 	ASSERT(rx_ring != NULL);
7805 
7806 	/* Just clean one squeue */
7807 	mutex_enter(&ill->ill_lock);
7808 	/*
7809 	 * Reset the ILL_SOFT_RING_ASSIGN bit so that
7810 	 * ip_squeue_soft_ring_affinty() will not go
7811 	 * ahead with assigning rings.
7812 	 */
7813 	ill->ill_state_flags &= ~ILL_SOFT_RING_ASSIGN;
7814 	while (rx_ring->rr_ring_state == ILL_RING_INPROC)
7815 		/* Some operations pending on the ring. Wait */
7816 		cv_wait(&ill->ill_cv, &ill->ill_lock);
7817 
7818 	if (rx_ring->rr_ring_state != ILL_RING_INUSE) {
7819 		/*
7820 		 * Someone already trying to clean
7821 		 * this squeue or its already been cleaned.
7822 		 */
7823 		mutex_exit(&ill->ill_lock);
7824 		return;
7825 	}
7826 	sqp = rx_ring->rr_sqp;
7827 
7828 	if (sqp == NULL) {
7829 		/*
7830 		 * The rx_ring never had a squeue assigned to it.
7831 		 * We are under ill_lock so we can clean it up
7832 		 * here itself since no one can get to it.
7833 		 */
7834 		rx_ring->rr_blank = NULL;
7835 		rx_ring->rr_handle = NULL;
7836 		rx_ring->rr_sqp = NULL;
7837 		rx_ring->rr_ring_state = ILL_RING_FREE;
7838 		mutex_exit(&ill->ill_lock);
7839 		return;
7840 	}
7841 
7842 	/* Set the state that its being cleaned */
7843 	rx_ring->rr_ring_state = ILL_RING_BEING_FREED;
7844 	ASSERT(sqp != NULL);
7845 	mutex_exit(&ill->ill_lock);
7846 
7847 	/*
7848 	 * Use the preallocated ill_unbind_conn for this purpose
7849 	 */
7850 	connp = ill->ill_dls_capab->ill_unbind_conn;
7851 	mp = &connp->conn_tcp->tcp_closemp;
7852 	CONN_INC_REF(connp);
7853 	squeue_enter(sqp, mp, ip_squeue_clean, connp, NULL);
7854 
7855 	mutex_enter(&ill->ill_lock);
7856 	while (rx_ring->rr_ring_state != ILL_RING_FREE)
7857 		cv_wait(&ill->ill_cv, &ill->ill_lock);
7858 
7859 	mutex_exit(&ill->ill_lock);
7860 }
7861 
7862 static void
7863 ipsq_clean_all(ill_t *ill)
7864 {
7865 	int idx;
7866 
7867 	/*
7868 	 * No need to clean if poll_capab isn't set for this ill
7869 	 */
7870 	if (!(ill->ill_capabilities & (ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING)))
7871 		return;
7872 
7873 	for (idx = 0; idx < ILL_MAX_RINGS; idx++) {
7874 		ill_rx_ring_t *ipr = &ill->ill_dls_capab->ill_ring_tbl[idx];
7875 		ipsq_clean_ring(ill, ipr);
7876 	}
7877 
7878 	ill->ill_capabilities &= ~(ILL_CAPAB_POLL|ILL_CAPAB_SOFT_RING);
7879 }
7880 
7881 /* ARGSUSED */
7882 int
7883 ip_sioctl_slifoindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
7884     ip_ioctl_cmd_t *ipip, void *ifreq)
7885 {
7886 	ill_t	*ill;
7887 	struct lifreq	*lifr = (struct lifreq *)ifreq;
7888 	boolean_t isv6;
7889 	conn_t	*connp;
7890 
7891 	connp = Q_TO_CONN(q);
7892 	isv6 = connp->conn_af_isv6;
7893 	/*
7894 	 * Set original index.
7895 	 * Failover and failback move logical interfaces
7896 	 * from one physical interface to another.  The
7897 	 * original index indicates the parent of a logical
7898 	 * interface, in other words, the physical interface
7899 	 * the logical interface will be moved back to on
7900 	 * failback.
7901 	 */
7902 
7903 	/*
7904 	 * Don't allow the original index to be changed
7905 	 * for non-failover addresses, autoconfigured
7906 	 * addresses, or IPv6 link local addresses.
7907 	 */
7908 	if (((ipif->ipif_flags & (IPIF_NOFAILOVER | IPIF_ADDRCONF)) != NULL) ||
7909 	    (isv6 && IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr))) {
7910 		return (EINVAL);
7911 	}
7912 	/*
7913 	 * The new original index must be in use by some
7914 	 * physical interface.
7915 	 */
7916 	ill = ill_lookup_on_ifindex(lifr->lifr_index, isv6, NULL, NULL,
7917 	    NULL, NULL);
7918 	if (ill == NULL)
7919 		return (ENXIO);
7920 	ill_refrele(ill);
7921 
7922 	ipif->ipif_orig_ifindex = lifr->lifr_index;
7923 	/*
7924 	 * When this ipif gets failed back, don't
7925 	 * preserve the original id, as it is no
7926 	 * longer applicable.
7927 	 */
7928 	ipif->ipif_orig_ipifid = 0;
7929 	/*
7930 	 * For IPv4, change the original index of any
7931 	 * multicast addresses associated with the
7932 	 * ipif to the new value.
7933 	 */
7934 	if (!isv6) {
7935 		ilm_t *ilm;
7936 
7937 		mutex_enter(&ipif->ipif_ill->ill_lock);
7938 		for (ilm = ipif->ipif_ill->ill_ilm; ilm != NULL;
7939 		    ilm = ilm->ilm_next) {
7940 			if (ilm->ilm_ipif == ipif) {
7941 				ilm->ilm_orig_ifindex = lifr->lifr_index;
7942 			}
7943 		}
7944 		mutex_exit(&ipif->ipif_ill->ill_lock);
7945 	}
7946 	return (0);
7947 }
7948 
7949 /* ARGSUSED */
7950 int
7951 ip_sioctl_get_oindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
7952     ip_ioctl_cmd_t *ipip, void *ifreq)
7953 {
7954 	struct lifreq *lifr = (struct lifreq *)ifreq;
7955 
7956 	/*
7957 	 * Get the original interface index i.e the one
7958 	 * before FAILOVER if it ever happened.
7959 	 */
7960 	lifr->lifr_index = ipif->ipif_orig_ifindex;
7961 	return (0);
7962 }
7963 
7964 /*
7965  * Parse an iftun_req structure coming down SIOC[GS]TUNPARAM ioctls,
7966  * refhold and return the associated ipif
7967  */
7968 int
7969 ip_extract_tunreq(queue_t *q, mblk_t *mp, ipif_t **ipifp, ipsq_func_t func)
7970 {
7971 	boolean_t exists;
7972 	struct iftun_req *ta;
7973 	ipif_t	*ipif;
7974 	ill_t	*ill;
7975 	boolean_t isv6;
7976 	mblk_t	*mp1;
7977 	int	error;
7978 	conn_t	*connp;
7979 
7980 	/* Existence verified in ip_wput_nondata */
7981 	mp1 = mp->b_cont->b_cont;
7982 	ta = (struct iftun_req *)mp1->b_rptr;
7983 	/*
7984 	 * Null terminate the string to protect against buffer
7985 	 * overrun. String was generated by user code and may not
7986 	 * be trusted.
7987 	 */
7988 	ta->ifta_lifr_name[LIFNAMSIZ - 1] = '\0';
7989 
7990 	connp = Q_TO_CONN(q);
7991 	isv6 = connp->conn_af_isv6;
7992 
7993 	/* Disallows implicit create */
7994 	ipif = ipif_lookup_on_name(ta->ifta_lifr_name,
7995 	    mi_strlen(ta->ifta_lifr_name), B_FALSE, &exists, isv6,
7996 	    connp->conn_zoneid, CONNP_TO_WQ(connp), mp, func, &error);
7997 	if (ipif == NULL)
7998 		return (error);
7999 
8000 	if (ipif->ipif_id != 0) {
8001 		/*
8002 		 * We really don't want to set/get tunnel parameters
8003 		 * on virtual tunnel interfaces.  Only allow the
8004 		 * base tunnel to do these.
8005 		 */
8006 		ipif_refrele(ipif);
8007 		return (EINVAL);
8008 	}
8009 
8010 	/*
8011 	 * Send down to tunnel mod for ioctl processing.
8012 	 * Will finish ioctl in ip_rput_other().
8013 	 */
8014 	ill = ipif->ipif_ill;
8015 	if (ill->ill_net_type == IRE_LOOPBACK) {
8016 		ipif_refrele(ipif);
8017 		return (EOPNOTSUPP);
8018 	}
8019 
8020 	if (ill->ill_wq == NULL) {
8021 		ipif_refrele(ipif);
8022 		return (ENXIO);
8023 	}
8024 	/*
8025 	 * Mark the ioctl as coming from an IPv6 interface for
8026 	 * tun's convenience.
8027 	 */
8028 	if (ill->ill_isv6)
8029 		ta->ifta_flags |= 0x80000000;
8030 	*ipifp = ipif;
8031 	return (0);
8032 }
8033 
8034 /*
8035  * Parse an ifreq or lifreq struct coming down ioctls and refhold
8036  * and return the associated ipif.
8037  * Return value:
8038  *	Non zero: An error has occurred. ci may not be filled out.
8039  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
8040  *	a held ipif in ci.ci_ipif.
8041  */
8042 int
8043 ip_extract_lifreq_cmn(queue_t *q, mblk_t *mp, int cmd_type, int flags,
8044     cmd_info_t *ci, ipsq_func_t func)
8045 {
8046 	sin_t		*sin;
8047 	sin6_t		*sin6;
8048 	char		*name;
8049 	struct ifreq    *ifr;
8050 	struct lifreq    *lifr;
8051 	ipif_t		*ipif = NULL;
8052 	ill_t		*ill;
8053 	conn_t		*connp;
8054 	boolean_t	isv6;
8055 	struct iocblk   *iocp = (struct iocblk *)mp->b_rptr;
8056 	boolean_t	exists;
8057 	int		err;
8058 	mblk_t		*mp1;
8059 	zoneid_t	zoneid;
8060 
8061 	if (q->q_next != NULL) {
8062 		ill = (ill_t *)q->q_ptr;
8063 		isv6 = ill->ill_isv6;
8064 		connp = NULL;
8065 		zoneid = ALL_ZONES;
8066 	} else {
8067 		ill = NULL;
8068 		connp = Q_TO_CONN(q);
8069 		isv6 = connp->conn_af_isv6;
8070 		zoneid = connp->conn_zoneid;
8071 		if (zoneid == GLOBAL_ZONEID) {
8072 			/* global zone can access ipifs in all zones */
8073 			zoneid = ALL_ZONES;
8074 		}
8075 	}
8076 
8077 	/* Has been checked in ip_wput_nondata */
8078 	mp1 = mp->b_cont->b_cont;
8079 
8080 
8081 	if (cmd_type == IF_CMD) {
8082 		/* This a old style SIOC[GS]IF* command */
8083 		ifr = (struct ifreq *)mp1->b_rptr;
8084 		/*
8085 		 * Null terminate the string to protect against buffer
8086 		 * overrun. String was generated by user code and may not
8087 		 * be trusted.
8088 		 */
8089 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
8090 		sin = (sin_t *)&ifr->ifr_addr;
8091 		name = ifr->ifr_name;
8092 		ci->ci_sin = sin;
8093 		ci->ci_sin6 = NULL;
8094 		ci->ci_lifr = (struct lifreq *)ifr;
8095 	} else {
8096 		/* This a new style SIOC[GS]LIF* command */
8097 		ASSERT(cmd_type == LIF_CMD);
8098 		lifr = (struct lifreq *)mp1->b_rptr;
8099 		/*
8100 		 * Null terminate the string to protect against buffer
8101 		 * overrun. String was generated by user code and may not
8102 		 * be trusted.
8103 		 */
8104 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
8105 		name = lifr->lifr_name;
8106 		sin = (sin_t *)&lifr->lifr_addr;
8107 		sin6 = (sin6_t *)&lifr->lifr_addr;
8108 		if (iocp->ioc_cmd == SIOCSLIFGROUPNAME) {
8109 			(void) strncpy(ci->ci_groupname, lifr->lifr_groupname,
8110 			    LIFNAMSIZ);
8111 		}
8112 		ci->ci_sin = sin;
8113 		ci->ci_sin6 = sin6;
8114 		ci->ci_lifr = lifr;
8115 	}
8116 
8117 
8118 	if (iocp->ioc_cmd == SIOCSLIFNAME) {
8119 		/*
8120 		 * The ioctl will be failed if the ioctl comes down
8121 		 * an conn stream
8122 		 */
8123 		if (ill == NULL) {
8124 			/*
8125 			 * Not an ill queue, return EINVAL same as the
8126 			 * old error code.
8127 			 */
8128 			return (ENXIO);
8129 		}
8130 		ipif = ill->ill_ipif;
8131 		ipif_refhold(ipif);
8132 	} else {
8133 		ipif = ipif_lookup_on_name(name, mi_strlen(name), B_FALSE,
8134 		    &exists, isv6, zoneid,
8135 		    (connp == NULL) ? q : CONNP_TO_WQ(connp), mp, func, &err);
8136 		if (ipif == NULL) {
8137 			if (err == EINPROGRESS)
8138 				return (err);
8139 			if (iocp->ioc_cmd == SIOCLIFFAILOVER ||
8140 			    iocp->ioc_cmd == SIOCLIFFAILBACK) {
8141 				/*
8142 				 * Need to try both v4 and v6 since this
8143 				 * ioctl can come down either v4 or v6
8144 				 * socket. The lifreq.lifr_family passed
8145 				 * down by this ioctl is AF_UNSPEC.
8146 				 */
8147 				ipif = ipif_lookup_on_name(name,
8148 				    mi_strlen(name), B_FALSE, &exists, !isv6,
8149 				    zoneid, (connp == NULL) ? q :
8150 				    CONNP_TO_WQ(connp), mp, func, &err);
8151 				if (err == EINPROGRESS)
8152 					return (err);
8153 			}
8154 			err = 0;	/* Ensure we don't use it below */
8155 		}
8156 	}
8157 
8158 	/*
8159 	 * Old style [GS]IFCMD does not admit IPv6 ipif
8160 	 */
8161 	if (ipif != NULL && ipif->ipif_isv6 && cmd_type == IF_CMD) {
8162 		ipif_refrele(ipif);
8163 		return (ENXIO);
8164 	}
8165 
8166 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
8167 	    name[0] == '\0') {
8168 		/*
8169 		 * Handle a or a SIOC?IF* with a null name
8170 		 * during plumb (on the ill queue before the I_PLINK).
8171 		 */
8172 		ipif = ill->ill_ipif;
8173 		ipif_refhold(ipif);
8174 	}
8175 
8176 	if (ipif == NULL)
8177 		return (ENXIO);
8178 
8179 	/*
8180 	 * Allow only GET operations if this ipif has been created
8181 	 * temporarily due to a MOVE operation.
8182 	 */
8183 	if (ipif->ipif_replace_zero && !(flags & IPI_REPL)) {
8184 		ipif_refrele(ipif);
8185 		return (EINVAL);
8186 	}
8187 
8188 	ci->ci_ipif = ipif;
8189 	return (0);
8190 }
8191 
8192 /*
8193  * Return the total number of ipifs.
8194  */
8195 static uint_t
8196 ip_get_numifs(zoneid_t zoneid)
8197 {
8198 	uint_t numifs = 0;
8199 	ill_t	*ill;
8200 	ill_walk_context_t	ctx;
8201 	ipif_t	*ipif;
8202 
8203 	rw_enter(&ill_g_lock, RW_READER);
8204 	ill = ILL_START_WALK_V4(&ctx);
8205 
8206 	while (ill != NULL) {
8207 		for (ipif = ill->ill_ipif; ipif != NULL;
8208 		    ipif = ipif->ipif_next) {
8209 			if (ipif->ipif_zoneid == zoneid ||
8210 			    ipif->ipif_zoneid == ALL_ZONES)
8211 				numifs++;
8212 		}
8213 		ill = ill_next(&ctx, ill);
8214 	}
8215 	rw_exit(&ill_g_lock);
8216 	return (numifs);
8217 }
8218 
8219 /*
8220  * Return the total number of ipifs.
8221  */
8222 static uint_t
8223 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid)
8224 {
8225 	uint_t numifs = 0;
8226 	ill_t	*ill;
8227 	ipif_t	*ipif;
8228 	ill_walk_context_t	ctx;
8229 
8230 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
8231 
8232 	rw_enter(&ill_g_lock, RW_READER);
8233 	if (family == AF_INET)
8234 		ill = ILL_START_WALK_V4(&ctx);
8235 	else if (family == AF_INET6)
8236 		ill = ILL_START_WALK_V6(&ctx);
8237 	else
8238 		ill = ILL_START_WALK_ALL(&ctx);
8239 
8240 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8241 		for (ipif = ill->ill_ipif; ipif != NULL;
8242 		    ipif = ipif->ipif_next) {
8243 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8244 			    !(lifn_flags & LIFC_NOXMIT))
8245 				continue;
8246 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8247 			    !(lifn_flags & LIFC_TEMPORARY))
8248 				continue;
8249 			if (((ipif->ipif_flags &
8250 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8251 			    IPIF_DEPRECATED)) ||
8252 			    (ill->ill_phyint->phyint_flags &
8253 			    PHYI_LOOPBACK) ||
8254 			    !(ipif->ipif_flags & IPIF_UP)) &&
8255 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
8256 				continue;
8257 
8258 			if (zoneid != ipif->ipif_zoneid &&
8259 			    ipif->ipif_zoneid != ALL_ZONES &&
8260 			    (zoneid != GLOBAL_ZONEID ||
8261 			    !(lifn_flags & LIFC_ALLZONES)))
8262 				continue;
8263 
8264 			numifs++;
8265 		}
8266 	}
8267 	rw_exit(&ill_g_lock);
8268 	return (numifs);
8269 }
8270 
8271 uint_t
8272 ip_get_lifsrcofnum(ill_t *ill)
8273 {
8274 	uint_t numifs = 0;
8275 	ill_t	*ill_head = ill;
8276 
8277 	/*
8278 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
8279 	 * other thread may be trying to relink the ILLs in this usesrc group
8280 	 * and adjusting the ill_usesrc_grp_next pointers
8281 	 */
8282 	rw_enter(&ill_g_usesrc_lock, RW_READER);
8283 	if ((ill->ill_usesrc_ifindex == 0) &&
8284 	    (ill->ill_usesrc_grp_next != NULL)) {
8285 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
8286 		    ill = ill->ill_usesrc_grp_next)
8287 			numifs++;
8288 	}
8289 	rw_exit(&ill_g_usesrc_lock);
8290 
8291 	return (numifs);
8292 }
8293 
8294 /* Null values are passed in for ipif, sin, and ifreq */
8295 /* ARGSUSED */
8296 int
8297 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8298     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8299 {
8300 	int *nump;
8301 
8302 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8303 
8304 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8305 	nump = (int *)mp->b_cont->b_cont->b_rptr;
8306 
8307 	*nump = ip_get_numifs(Q_TO_CONN(q)->conn_zoneid);
8308 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
8309 	return (0);
8310 }
8311 
8312 /* Null values are passed in for ipif, sin, and ifreq */
8313 /* ARGSUSED */
8314 int
8315 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
8316     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8317 {
8318 	struct lifnum *lifn;
8319 	mblk_t	*mp1;
8320 
8321 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
8322 
8323 	/* Existence checked in ip_wput_nondata */
8324 	mp1 = mp->b_cont->b_cont;
8325 
8326 	lifn = (struct lifnum *)mp1->b_rptr;
8327 	switch (lifn->lifn_family) {
8328 	case AF_UNSPEC:
8329 	case AF_INET:
8330 	case AF_INET6:
8331 		break;
8332 	default:
8333 		return (EAFNOSUPPORT);
8334 	}
8335 
8336 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
8337 	    Q_TO_CONN(q)->conn_zoneid);
8338 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
8339 	return (0);
8340 }
8341 
8342 /* ARGSUSED */
8343 int
8344 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8345     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8346 {
8347 	STRUCT_HANDLE(ifconf, ifc);
8348 	mblk_t *mp1;
8349 	struct iocblk *iocp;
8350 	struct ifreq *ifr;
8351 	ill_walk_context_t	ctx;
8352 	ill_t	*ill;
8353 	ipif_t	*ipif;
8354 	struct sockaddr_in *sin;
8355 	int32_t	ifclen;
8356 	zoneid_t zoneid;
8357 
8358 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
8359 
8360 	ip1dbg(("ip_sioctl_get_ifconf"));
8361 	/* Existence verified in ip_wput_nondata */
8362 	mp1 = mp->b_cont->b_cont;
8363 	iocp = (struct iocblk *)mp->b_rptr;
8364 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8365 
8366 	/*
8367 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
8368 	 * the user buffer address and length into which the list of struct
8369 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
8370 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
8371 	 * the SIOCGIFCONF operation was redefined to simply provide
8372 	 * a large output buffer into which we are supposed to jam the ifreq
8373 	 * array.  The same ioctl command code was used, despite the fact that
8374 	 * both the applications and the kernel code had to change, thus making
8375 	 * it impossible to support both interfaces.
8376 	 *
8377 	 * For reasons not good enough to try to explain, the following
8378 	 * algorithm is used for deciding what to do with one of these:
8379 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
8380 	 * form with the output buffer coming down as the continuation message.
8381 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
8382 	 * and we have to copy in the ifconf structure to find out how big the
8383 	 * output buffer is and where to copy out to.  Sure no problem...
8384 	 *
8385 	 */
8386 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
8387 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
8388 		int numifs = 0;
8389 		size_t ifc_bufsize;
8390 
8391 		/*
8392 		 * Must be (better be!) continuation of a TRANSPARENT
8393 		 * IOCTL.  We just copied in the ifconf structure.
8394 		 */
8395 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
8396 		    (struct ifconf *)mp1->b_rptr);
8397 
8398 		/*
8399 		 * Allocate a buffer to hold requested information.
8400 		 *
8401 		 * If ifc_len is larger than what is needed, we only
8402 		 * allocate what we will use.
8403 		 *
8404 		 * If ifc_len is smaller than what is needed, return
8405 		 * EINVAL.
8406 		 *
8407 		 * XXX: the ill_t structure can hava 2 counters, for
8408 		 * v4 and v6 (not just ill_ipif_up_count) to store the
8409 		 * number of interfaces for a device, so we don't need
8410 		 * to count them here...
8411 		 */
8412 		numifs = ip_get_numifs(zoneid);
8413 
8414 		ifclen = STRUCT_FGET(ifc, ifc_len);
8415 		ifc_bufsize = numifs * sizeof (struct ifreq);
8416 		if (ifc_bufsize > ifclen) {
8417 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8418 				/* old behaviour */
8419 				return (EINVAL);
8420 			} else {
8421 				ifc_bufsize = ifclen;
8422 			}
8423 		}
8424 
8425 		mp1 = mi_copyout_alloc(q, mp,
8426 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
8427 		if (mp1 == NULL)
8428 			return (ENOMEM);
8429 
8430 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
8431 	}
8432 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8433 	/*
8434 	 * the SIOCGIFCONF ioctl only knows about
8435 	 * IPv4 addresses, so don't try to tell
8436 	 * it about interfaces with IPv6-only
8437 	 * addresses. (Last parm 'isv6' is B_FALSE)
8438 	 */
8439 
8440 	ifr = (struct ifreq *)mp1->b_rptr;
8441 
8442 	rw_enter(&ill_g_lock, RW_READER);
8443 	ill = ILL_START_WALK_V4(&ctx);
8444 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8445 		for (ipif = ill->ill_ipif; ipif != NULL;
8446 		    ipif = ipif->ipif_next) {
8447 			if (zoneid != ipif->ipif_zoneid &&
8448 			    ipif->ipif_zoneid != ALL_ZONES)
8449 				continue;
8450 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
8451 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
8452 					/* old behaviour */
8453 					rw_exit(&ill_g_lock);
8454 					return (EINVAL);
8455 				} else {
8456 					goto if_copydone;
8457 				}
8458 			}
8459 			(void) ipif_get_name(ipif,
8460 			    ifr->ifr_name,
8461 			    sizeof (ifr->ifr_name));
8462 			sin = (sin_t *)&ifr->ifr_addr;
8463 			*sin = sin_null;
8464 			sin->sin_family = AF_INET;
8465 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8466 			ifr++;
8467 		}
8468 	}
8469 if_copydone:
8470 	rw_exit(&ill_g_lock);
8471 	mp1->b_wptr = (uchar_t *)ifr;
8472 
8473 	if (STRUCT_BUF(ifc) != NULL) {
8474 		STRUCT_FSET(ifc, ifc_len,
8475 			(int)((uchar_t *)ifr - mp1->b_rptr));
8476 	}
8477 	return (0);
8478 }
8479 
8480 /*
8481  * Get the interfaces using the address hosted on the interface passed in,
8482  * as a source adddress
8483  */
8484 /* ARGSUSED */
8485 int
8486 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8487     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8488 {
8489 	mblk_t *mp1;
8490 	ill_t	*ill, *ill_head;
8491 	ipif_t	*ipif, *orig_ipif;
8492 	int	numlifs = 0;
8493 	size_t	lifs_bufsize, lifsmaxlen;
8494 	struct	lifreq *lifr;
8495 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8496 	uint_t	ifindex;
8497 	zoneid_t zoneid;
8498 	int err = 0;
8499 	boolean_t isv6 = B_FALSE;
8500 	struct	sockaddr_in	*sin;
8501 	struct	sockaddr_in6	*sin6;
8502 
8503 	STRUCT_HANDLE(lifsrcof, lifs);
8504 
8505 	ASSERT(q->q_next == NULL);
8506 
8507 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8508 
8509 	/* Existence verified in ip_wput_nondata */
8510 	mp1 = mp->b_cont->b_cont;
8511 
8512 	/*
8513 	 * Must be (better be!) continuation of a TRANSPARENT
8514 	 * IOCTL.  We just copied in the lifsrcof structure.
8515 	 */
8516 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
8517 	    (struct lifsrcof *)mp1->b_rptr);
8518 
8519 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
8520 		return (EINVAL);
8521 
8522 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
8523 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
8524 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, q, mp,
8525 	    ip_process_ioctl, &err);
8526 	if (ipif == NULL) {
8527 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
8528 		    ifindex));
8529 		return (err);
8530 	}
8531 
8532 
8533 	/* Allocate a buffer to hold requested information */
8534 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
8535 	lifs_bufsize = numlifs * sizeof (struct lifreq);
8536 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
8537 	/* The actual size needed is always returned in lifs_len */
8538 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
8539 
8540 	/* If the amount we need is more than what is passed in, abort */
8541 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
8542 		ipif_refrele(ipif);
8543 		return (0);
8544 	}
8545 
8546 	mp1 = mi_copyout_alloc(q, mp,
8547 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
8548 	if (mp1 == NULL) {
8549 		ipif_refrele(ipif);
8550 		return (ENOMEM);
8551 	}
8552 
8553 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
8554 	bzero(mp1->b_rptr, lifs_bufsize);
8555 
8556 	lifr = (struct lifreq *)mp1->b_rptr;
8557 
8558 	ill = ill_head = ipif->ipif_ill;
8559 	orig_ipif = ipif;
8560 
8561 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
8562 	rw_enter(&ill_g_usesrc_lock, RW_READER);
8563 	rw_enter(&ill_g_lock, RW_READER);
8564 
8565 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
8566 	for (; (ill != NULL) && (ill != ill_head);
8567 	    ill = ill->ill_usesrc_grp_next) {
8568 
8569 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
8570 			break;
8571 
8572 		ipif = ill->ill_ipif;
8573 		(void) ipif_get_name(ipif,
8574 		    lifr->lifr_name, sizeof (lifr->lifr_name));
8575 		if (ipif->ipif_isv6) {
8576 			sin6 = (sin6_t *)&lifr->lifr_addr;
8577 			*sin6 = sin6_null;
8578 			sin6->sin6_family = AF_INET6;
8579 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
8580 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
8581 			    &ipif->ipif_v6net_mask);
8582 		} else {
8583 			sin = (sin_t *)&lifr->lifr_addr;
8584 			*sin = sin_null;
8585 			sin->sin_family = AF_INET;
8586 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
8587 			lifr->lifr_addrlen = ip_mask_to_plen(
8588 			    ipif->ipif_net_mask);
8589 		}
8590 		lifr++;
8591 	}
8592 	rw_exit(&ill_g_usesrc_lock);
8593 	rw_exit(&ill_g_lock);
8594 	ipif_refrele(orig_ipif);
8595 	mp1->b_wptr = (uchar_t *)lifr;
8596 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
8597 
8598 	return (0);
8599 }
8600 
8601 /* ARGSUSED */
8602 int
8603 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
8604     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8605 {
8606 	mblk_t *mp1;
8607 	int	list;
8608 	ill_t	*ill;
8609 	ipif_t	*ipif;
8610 	int	flags;
8611 	int	numlifs = 0;
8612 	size_t	lifc_bufsize;
8613 	struct	lifreq *lifr;
8614 	sa_family_t	family;
8615 	struct	sockaddr_in	*sin;
8616 	struct	sockaddr_in6	*sin6;
8617 	ill_walk_context_t	ctx;
8618 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8619 	int32_t	lifclen;
8620 	zoneid_t zoneid;
8621 	STRUCT_HANDLE(lifconf, lifc);
8622 
8623 	ip1dbg(("ip_sioctl_get_lifconf"));
8624 
8625 	ASSERT(q->q_next == NULL);
8626 
8627 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8628 
8629 	/* Existence verified in ip_wput_nondata */
8630 	mp1 = mp->b_cont->b_cont;
8631 
8632 	/*
8633 	 * An extended version of SIOCGIFCONF that takes an
8634 	 * additional address family and flags field.
8635 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
8636 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
8637 	 * interfaces are omitted.
8638 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
8639 	 * unless LIFC_TEMPORARY is specified.
8640 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
8641 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
8642 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
8643 	 * has priority over LIFC_NOXMIT.
8644 	 */
8645 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
8646 
8647 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
8648 		return (EINVAL);
8649 
8650 	/*
8651 	 * Must be (better be!) continuation of a TRANSPARENT
8652 	 * IOCTL.  We just copied in the lifconf structure.
8653 	 */
8654 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
8655 
8656 	family = STRUCT_FGET(lifc, lifc_family);
8657 	flags = STRUCT_FGET(lifc, lifc_flags);
8658 
8659 	switch (family) {
8660 	case AF_UNSPEC:
8661 		/*
8662 		 * walk all ILL's.
8663 		 */
8664 		list = MAX_G_HEADS;
8665 		break;
8666 	case AF_INET:
8667 		/*
8668 		 * walk only IPV4 ILL's.
8669 		 */
8670 		list = IP_V4_G_HEAD;
8671 		break;
8672 	case AF_INET6:
8673 		/*
8674 		 * walk only IPV6 ILL's.
8675 		 */
8676 		list = IP_V6_G_HEAD;
8677 		break;
8678 	default:
8679 		return (EAFNOSUPPORT);
8680 	}
8681 
8682 	/*
8683 	 * Allocate a buffer to hold requested information.
8684 	 *
8685 	 * If lifc_len is larger than what is needed, we only
8686 	 * allocate what we will use.
8687 	 *
8688 	 * If lifc_len is smaller than what is needed, return
8689 	 * EINVAL.
8690 	 */
8691 	numlifs = ip_get_numlifs(family, flags, zoneid);
8692 	lifc_bufsize = numlifs * sizeof (struct lifreq);
8693 	lifclen = STRUCT_FGET(lifc, lifc_len);
8694 	if (lifc_bufsize > lifclen) {
8695 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
8696 			return (EINVAL);
8697 		else
8698 			lifc_bufsize = lifclen;
8699 	}
8700 
8701 	mp1 = mi_copyout_alloc(q, mp,
8702 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
8703 	if (mp1 == NULL)
8704 		return (ENOMEM);
8705 
8706 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
8707 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
8708 
8709 	lifr = (struct lifreq *)mp1->b_rptr;
8710 
8711 	rw_enter(&ill_g_lock, RW_READER);
8712 	ill = ill_first(list, list, &ctx);
8713 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
8714 		for (ipif = ill->ill_ipif; ipif != NULL;
8715 		    ipif = ipif->ipif_next) {
8716 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
8717 			    !(flags & LIFC_NOXMIT))
8718 				continue;
8719 
8720 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
8721 			    !(flags & LIFC_TEMPORARY))
8722 				continue;
8723 
8724 			if (((ipif->ipif_flags &
8725 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
8726 			    IPIF_DEPRECATED)) ||
8727 			    (ill->ill_phyint->phyint_flags &
8728 			    PHYI_LOOPBACK) ||
8729 			    !(ipif->ipif_flags & IPIF_UP)) &&
8730 			    (flags & LIFC_EXTERNAL_SOURCE))
8731 				continue;
8732 
8733 			if (zoneid != ipif->ipif_zoneid &&
8734 			    ipif->ipif_zoneid != ALL_ZONES &&
8735 			    (zoneid != GLOBAL_ZONEID ||
8736 			    !(flags & LIFC_ALLZONES)))
8737 				continue;
8738 
8739 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
8740 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
8741 					rw_exit(&ill_g_lock);
8742 					return (EINVAL);
8743 				} else {
8744 					goto lif_copydone;
8745 				}
8746 			}
8747 
8748 			(void) ipif_get_name(ipif,
8749 				lifr->lifr_name,
8750 				sizeof (lifr->lifr_name));
8751 			if (ipif->ipif_isv6) {
8752 				sin6 = (sin6_t *)&lifr->lifr_addr;
8753 				*sin6 = sin6_null;
8754 				sin6->sin6_family = AF_INET6;
8755 				sin6->sin6_addr =
8756 				ipif->ipif_v6lcl_addr;
8757 				lifr->lifr_addrlen =
8758 				ip_mask_to_plen_v6(
8759 				    &ipif->ipif_v6net_mask);
8760 			} else {
8761 				sin = (sin_t *)&lifr->lifr_addr;
8762 				*sin = sin_null;
8763 				sin->sin_family = AF_INET;
8764 				sin->sin_addr.s_addr =
8765 				    ipif->ipif_lcl_addr;
8766 				lifr->lifr_addrlen =
8767 				    ip_mask_to_plen(
8768 				    ipif->ipif_net_mask);
8769 			}
8770 			lifr++;
8771 		}
8772 	}
8773 lif_copydone:
8774 	rw_exit(&ill_g_lock);
8775 
8776 	mp1->b_wptr = (uchar_t *)lifr;
8777 	if (STRUCT_BUF(lifc) != NULL) {
8778 		STRUCT_FSET(lifc, lifc_len,
8779 			(int)((uchar_t *)lifr - mp1->b_rptr));
8780 	}
8781 	return (0);
8782 }
8783 
8784 /* ARGSUSED */
8785 int
8786 ip_sioctl_set_ipmpfailback(ipif_t *dummy_ipif, sin_t *dummy_sin,
8787     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
8788 {
8789 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
8790 	ipmp_enable_failback = *(int *)mp->b_cont->b_cont->b_rptr;
8791 	return (0);
8792 }
8793 
8794 static void
8795 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
8796 {
8797 	ip6_asp_t *table;
8798 	size_t table_size;
8799 	mblk_t *data_mp;
8800 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8801 
8802 	/* These two ioctls are I_STR only */
8803 	if (iocp->ioc_count == TRANSPARENT) {
8804 		miocnak(q, mp, 0, EINVAL);
8805 		return;
8806 	}
8807 
8808 	data_mp = mp->b_cont;
8809 	if (data_mp == NULL) {
8810 		/* The user passed us a NULL argument */
8811 		table = NULL;
8812 		table_size = iocp->ioc_count;
8813 	} else {
8814 		/*
8815 		 * The user provided a table.  The stream head
8816 		 * may have copied in the user data in chunks,
8817 		 * so make sure everything is pulled up
8818 		 * properly.
8819 		 */
8820 		if (MBLKL(data_mp) < iocp->ioc_count) {
8821 			mblk_t *new_data_mp;
8822 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
8823 			    NULL) {
8824 				miocnak(q, mp, 0, ENOMEM);
8825 				return;
8826 			}
8827 			freemsg(data_mp);
8828 			data_mp = new_data_mp;
8829 			mp->b_cont = data_mp;
8830 		}
8831 		table = (ip6_asp_t *)data_mp->b_rptr;
8832 		table_size = iocp->ioc_count;
8833 	}
8834 
8835 	switch (iocp->ioc_cmd) {
8836 	case SIOCGIP6ADDRPOLICY:
8837 		iocp->ioc_rval = ip6_asp_get(table, table_size);
8838 		if (iocp->ioc_rval == -1)
8839 			iocp->ioc_error = EINVAL;
8840 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8841 		else if (table != NULL &&
8842 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
8843 			ip6_asp_t *src = table;
8844 			ip6_asp32_t *dst = (void *)table;
8845 			int count = table_size / sizeof (ip6_asp_t);
8846 			int i;
8847 
8848 			/*
8849 			 * We need to do an in-place shrink of the array
8850 			 * to match the alignment attributes of the
8851 			 * 32-bit ABI looking at it.
8852 			 */
8853 			/* LINTED: logical expression always true: op "||" */
8854 			ASSERT(sizeof (*src) > sizeof (*dst));
8855 			for (i = 1; i < count; i++)
8856 				bcopy(src + i, dst + i, sizeof (*dst));
8857 		}
8858 #endif
8859 		break;
8860 
8861 	case SIOCSIP6ADDRPOLICY:
8862 		ASSERT(mp->b_prev == NULL);
8863 		mp->b_prev = (void *)q;
8864 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
8865 		/*
8866 		 * We pass in the datamodel here so that the ip6_asp_replace()
8867 		 * routine can handle converting from 32-bit to native formats
8868 		 * where necessary.
8869 		 *
8870 		 * A better way to handle this might be to convert the inbound
8871 		 * data structure here, and hang it off a new 'mp'; thus the
8872 		 * ip6_asp_replace() logic would always be dealing with native
8873 		 * format data structures..
8874 		 *
8875 		 * (An even simpler way to handle these ioctls is to just
8876 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
8877 		 * and just recompile everything that depends on it.)
8878 		 */
8879 #endif
8880 		ip6_asp_replace(mp, table, table_size, B_FALSE,
8881 		    iocp->ioc_flag & IOC_MODELS);
8882 		return;
8883 	}
8884 
8885 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
8886 	qreply(q, mp);
8887 }
8888 
8889 static void
8890 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
8891 {
8892 	mblk_t 		*data_mp;
8893 	struct dstinforeq	*dir;
8894 	uint8_t		*end, *cur;
8895 	in6_addr_t	*daddr, *saddr;
8896 	ipaddr_t	v4daddr;
8897 	ire_t		*ire;
8898 	char		*slabel, *dlabel;
8899 	boolean_t	isipv4;
8900 	int		match_ire;
8901 	ill_t		*dst_ill;
8902 	ipif_t		*src_ipif, *ire_ipif;
8903 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
8904 	zoneid_t	zoneid;
8905 
8906 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8907 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8908 
8909 	/*
8910 	 * This ioctl is I_STR only, and must have a
8911 	 * data mblk following the M_IOCTL mblk.
8912 	 */
8913 	data_mp = mp->b_cont;
8914 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
8915 		miocnak(q, mp, 0, EINVAL);
8916 		return;
8917 	}
8918 
8919 	if (MBLKL(data_mp) < iocp->ioc_count) {
8920 		mblk_t *new_data_mp;
8921 
8922 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
8923 			miocnak(q, mp, 0, ENOMEM);
8924 			return;
8925 		}
8926 		freemsg(data_mp);
8927 		data_mp = new_data_mp;
8928 		mp->b_cont = data_mp;
8929 	}
8930 	match_ire = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_PARENT;
8931 
8932 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
8933 	    end - cur >= sizeof (struct dstinforeq);
8934 	    cur += sizeof (struct dstinforeq)) {
8935 		dir = (struct dstinforeq *)cur;
8936 		daddr = &dir->dir_daddr;
8937 		saddr = &dir->dir_saddr;
8938 
8939 		/*
8940 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
8941 		 * v4 mapped addresses; ire_ftable_lookup[_v6]()
8942 		 * and ipif_select_source[_v6]() do not.
8943 		 */
8944 		dir->dir_dscope = ip_addr_scope_v6(daddr);
8945 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence);
8946 
8947 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
8948 		if (isipv4) {
8949 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
8950 			ire = ire_ftable_lookup(v4daddr, NULL, NULL,
8951 			    0, NULL, NULL, zoneid, 0, NULL, match_ire);
8952 		} else {
8953 			ire = ire_ftable_lookup_v6(daddr, NULL, NULL,
8954 			    0, NULL, NULL, zoneid, 0, NULL, match_ire);
8955 		}
8956 		if (ire == NULL) {
8957 			dir->dir_dreachable = 0;
8958 
8959 			/* move on to next dst addr */
8960 			continue;
8961 		}
8962 		dir->dir_dreachable = 1;
8963 
8964 		ire_ipif = ire->ire_ipif;
8965 		if (ire_ipif == NULL)
8966 			goto next_dst;
8967 
8968 		/*
8969 		 * We expect to get back an interface ire or a
8970 		 * gateway ire cache entry.  For both types, the
8971 		 * output interface is ire_ipif->ipif_ill.
8972 		 */
8973 		dst_ill = ire_ipif->ipif_ill;
8974 		dir->dir_dmactype = dst_ill->ill_mactype;
8975 
8976 		if (isipv4) {
8977 			src_ipif = ipif_select_source(dst_ill, v4daddr, zoneid);
8978 		} else {
8979 			src_ipif = ipif_select_source_v6(dst_ill,
8980 			    daddr, RESTRICT_TO_NONE, IPV6_PREFER_SRC_DEFAULT,
8981 			    zoneid);
8982 		}
8983 		if (src_ipif == NULL)
8984 			goto next_dst;
8985 
8986 		*saddr = src_ipif->ipif_v6lcl_addr;
8987 		dir->dir_sscope = ip_addr_scope_v6(saddr);
8988 		slabel = ip6_asp_lookup(saddr, NULL);
8989 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
8990 		dir->dir_sdeprecated =
8991 		    (src_ipif->ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
8992 		ipif_refrele(src_ipif);
8993 next_dst:
8994 		ire_refrele(ire);
8995 	}
8996 	miocack(q, mp, iocp->ioc_count, 0);
8997 }
8998 
8999 
9000 /*
9001  * Check if this is an address assigned to this machine.
9002  * Skips interfaces that are down by using ire checks.
9003  * Translates mapped addresses to v4 addresses and then
9004  * treats them as such, returning true if the v4 address
9005  * associated with this mapped address is configured.
9006  * Note: Applications will have to be careful what they do
9007  * with the response; use of mapped addresses limits
9008  * what can be done with the socket, especially with
9009  * respect to socket options and ioctls - neither IPv4
9010  * options nor IPv6 sticky options/ancillary data options
9011  * may be used.
9012  */
9013 /* ARGSUSED */
9014 int
9015 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9016     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9017 {
9018 	struct sioc_addrreq *sia;
9019 	sin_t *sin;
9020 	ire_t *ire;
9021 	mblk_t *mp1;
9022 	zoneid_t zoneid;
9023 
9024 	ip1dbg(("ip_sioctl_tmyaddr"));
9025 
9026 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9027 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9028 
9029 	/* Existence verified in ip_wput_nondata */
9030 	mp1 = mp->b_cont->b_cont;
9031 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9032 	sin = (sin_t *)&sia->sa_addr;
9033 	switch (sin->sin_family) {
9034 	case AF_INET6: {
9035 		sin6_t *sin6 = (sin6_t *)sin;
9036 
9037 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9038 			ipaddr_t v4_addr;
9039 
9040 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9041 			    v4_addr);
9042 			ire = ire_ctable_lookup(v4_addr, 0,
9043 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9044 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
9045 		} else {
9046 			in6_addr_t v6addr;
9047 
9048 			v6addr = sin6->sin6_addr;
9049 			ire = ire_ctable_lookup_v6(&v6addr, 0,
9050 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9051 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
9052 		}
9053 		break;
9054 	}
9055 	case AF_INET: {
9056 		ipaddr_t v4addr;
9057 
9058 		v4addr = sin->sin_addr.s_addr;
9059 		ire = ire_ctable_lookup(v4addr, 0,
9060 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
9061 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY);
9062 		break;
9063 	}
9064 	default:
9065 		return (EAFNOSUPPORT);
9066 	}
9067 	if (ire != NULL) {
9068 		sia->sa_res = 1;
9069 		ire_refrele(ire);
9070 	} else {
9071 		sia->sa_res = 0;
9072 	}
9073 	return (0);
9074 }
9075 
9076 /*
9077  * Check if this is an address assigned on-link i.e. neighbor,
9078  * and makes sure it's reachable from the current zone.
9079  * Returns true for my addresses as well.
9080  * Translates mapped addresses to v4 addresses and then
9081  * treats them as such, returning true if the v4 address
9082  * associated with this mapped address is configured.
9083  * Note: Applications will have to be careful what they do
9084  * with the response; use of mapped addresses limits
9085  * what can be done with the socket, especially with
9086  * respect to socket options and ioctls - neither IPv4
9087  * options nor IPv6 sticky options/ancillary data options
9088  * may be used.
9089  */
9090 /* ARGSUSED */
9091 int
9092 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9093     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
9094 {
9095 	struct sioc_addrreq *sia;
9096 	sin_t *sin;
9097 	mblk_t	*mp1;
9098 	ire_t *ire = NULL;
9099 	zoneid_t zoneid;
9100 
9101 	ip1dbg(("ip_sioctl_tonlink"));
9102 
9103 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
9104 	zoneid = Q_TO_CONN(q)->conn_zoneid;
9105 
9106 	/* Existence verified in ip_wput_nondata */
9107 	mp1 = mp->b_cont->b_cont;
9108 	sia = (struct sioc_addrreq *)mp1->b_rptr;
9109 	sin = (sin_t *)&sia->sa_addr;
9110 
9111 	/*
9112 	 * Match addresses with a zero gateway field to avoid
9113 	 * routes going through a router.
9114 	 * Exclude broadcast and multicast addresses.
9115 	 */
9116 	switch (sin->sin_family) {
9117 	case AF_INET6: {
9118 		sin6_t *sin6 = (sin6_t *)sin;
9119 
9120 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
9121 			ipaddr_t v4_addr;
9122 
9123 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
9124 			    v4_addr);
9125 			if (!CLASSD(v4_addr)) {
9126 				ire = ire_route_lookup(v4_addr, 0, 0, 0,
9127 				    NULL, NULL, zoneid, NULL,
9128 				    MATCH_IRE_GW);
9129 			}
9130 		} else {
9131 			in6_addr_t v6addr;
9132 			in6_addr_t v6gw;
9133 
9134 			v6addr = sin6->sin6_addr;
9135 			v6gw = ipv6_all_zeros;
9136 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
9137 				ire = ire_route_lookup_v6(&v6addr, 0,
9138 				    &v6gw, 0, NULL, NULL, zoneid,
9139 				    NULL, MATCH_IRE_GW);
9140 			}
9141 		}
9142 		break;
9143 	}
9144 	case AF_INET: {
9145 		ipaddr_t v4addr;
9146 
9147 		v4addr = sin->sin_addr.s_addr;
9148 		if (!CLASSD(v4addr)) {
9149 			ire = ire_route_lookup(v4addr, 0, 0, 0,
9150 			    NULL, NULL, zoneid, NULL,
9151 			    MATCH_IRE_GW);
9152 		}
9153 		break;
9154 	}
9155 	default:
9156 		return (EAFNOSUPPORT);
9157 	}
9158 	sia->sa_res = 0;
9159 	if (ire != NULL) {
9160 		if (ire->ire_type & (IRE_INTERFACE|IRE_CACHE|
9161 		    IRE_LOCAL|IRE_LOOPBACK)) {
9162 			sia->sa_res = 1;
9163 		}
9164 		ire_refrele(ire);
9165 	}
9166 	return (0);
9167 }
9168 
9169 /*
9170  * TBD: implement when kernel maintaines a list of site prefixes.
9171  */
9172 /* ARGSUSED */
9173 int
9174 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9175     ip_ioctl_cmd_t *ipip, void *ifreq)
9176 {
9177 	return (ENXIO);
9178 }
9179 
9180 /* ARGSUSED */
9181 int
9182 ip_sioctl_tunparam(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9183     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9184 {
9185 	ill_t  		*ill;
9186 	mblk_t		*mp1;
9187 	conn_t		*connp;
9188 	boolean_t	success;
9189 
9190 	ip1dbg(("ip_sioctl_tunparam(%s:%u %p)\n",
9191 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9192 	/* ioctl comes down on an conn */
9193 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9194 	connp = Q_TO_CONN(q);
9195 
9196 	mp->b_datap->db_type = M_IOCTL;
9197 
9198 	/*
9199 	 * Send down a copy. (copymsg does not copy b_next/b_prev).
9200 	 * The original mp contains contaminated b_next values due to 'mi',
9201 	 * which is needed to do the mi_copy_done. Unfortunately if we
9202 	 * send down the original mblk itself and if we are popped due to an
9203 	 * an unplumb before the response comes back from tunnel,
9204 	 * the streamhead (which does a freemsg) will see this contaminated
9205 	 * message and the assertion in freemsg about non-null b_next/b_prev
9206 	 * will panic a DEBUG kernel.
9207 	 */
9208 	mp1 = copymsg(mp);
9209 	if (mp1 == NULL)
9210 		return (ENOMEM);
9211 
9212 	ill = ipif->ipif_ill;
9213 	mutex_enter(&connp->conn_lock);
9214 	mutex_enter(&ill->ill_lock);
9215 	if (ipip->ipi_cmd == SIOCSTUNPARAM || ipip->ipi_cmd == OSIOCSTUNPARAM) {
9216 		success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp),
9217 		    mp, 0);
9218 	} else {
9219 		success = ill_pending_mp_add(ill, connp, mp);
9220 	}
9221 	mutex_exit(&ill->ill_lock);
9222 	mutex_exit(&connp->conn_lock);
9223 
9224 	if (success) {
9225 		ip1dbg(("sending down tunparam request "));
9226 		putnext(ill->ill_wq, mp1);
9227 		return (EINPROGRESS);
9228 	} else {
9229 		/* The conn has started closing */
9230 		freemsg(mp1);
9231 		return (EINTR);
9232 	}
9233 }
9234 
9235 static int
9236 ip_sioctl_arp_common(ill_t *ill, queue_t *q, mblk_t *mp, sin_t *sin,
9237     boolean_t x_arp_ioctl, boolean_t if_arp_ioctl)
9238 {
9239 	mblk_t *mp1;
9240 	mblk_t *mp2;
9241 	mblk_t *pending_mp;
9242 	ipaddr_t ipaddr;
9243 	area_t *area;
9244 	struct iocblk *iocp;
9245 	conn_t *connp;
9246 	struct arpreq *ar;
9247 	struct xarpreq *xar;
9248 	boolean_t success;
9249 	int flags, alength;
9250 	char *lladdr;
9251 
9252 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9253 	connp = Q_TO_CONN(q);
9254 
9255 	iocp = (struct iocblk *)mp->b_rptr;
9256 	/*
9257 	 * ill has already been set depending on whether
9258 	 * bsd style or interface style ioctl.
9259 	 */
9260 	ASSERT(ill != NULL);
9261 
9262 	/*
9263 	 * Is this one of the new SIOC*XARP ioctls?
9264 	 */
9265 	if (x_arp_ioctl) {
9266 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
9267 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
9268 		ar = NULL;
9269 
9270 		flags = xar->xarp_flags;
9271 		lladdr = LLADDR(&xar->xarp_ha);
9272 		/*
9273 		 * Validate against user's link layer address length
9274 		 * input and name and addr length limits.
9275 		 */
9276 		alength = ill->ill_phys_addr_length;
9277 		if (iocp->ioc_cmd == SIOCSXARP) {
9278 			if (alength != xar->xarp_ha.sdl_alen ||
9279 			    (alength + xar->xarp_ha.sdl_nlen >
9280 			    sizeof (xar->xarp_ha.sdl_data)))
9281 				return (EINVAL);
9282 		}
9283 	} else {
9284 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
9285 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
9286 		xar = NULL;
9287 
9288 		flags = ar->arp_flags;
9289 		lladdr = ar->arp_ha.sa_data;
9290 		/*
9291 		 * Theoretically, the sa_family could tell us what link
9292 		 * layer type this operation is trying to deal with. By
9293 		 * common usage AF_UNSPEC means ethernet. We'll assume
9294 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
9295 		 * for now. Our new SIOC*XARP ioctls can be used more
9296 		 * generally.
9297 		 *
9298 		 * If the underlying media happens to have a non 6 byte
9299 		 * address, arp module will fail set/get, but the del
9300 		 * operation will succeed.
9301 		 */
9302 		alength = 6;
9303 		if ((iocp->ioc_cmd != SIOCDARP) &&
9304 		    (alength != ill->ill_phys_addr_length)) {
9305 			return (EINVAL);
9306 		}
9307 	}
9308 
9309 	/*
9310 	 * We are going to pass up to ARP a packet chain that looks
9311 	 * like:
9312 	 *
9313 	 * M_IOCTL-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
9314 	 *
9315 	 * Get a copy of the original IOCTL mblk to head the chain,
9316 	 * to be sent up (in mp1). Also get another copy to store
9317 	 * in the ill_pending_mp list, for matching the response
9318 	 * when it comes back from ARP.
9319 	 */
9320 	mp1 = copyb(mp);
9321 	pending_mp = copymsg(mp);
9322 	if (mp1 == NULL || pending_mp == NULL) {
9323 		if (mp1 != NULL)
9324 			freeb(mp1);
9325 		if (pending_mp != NULL)
9326 			inet_freemsg(pending_mp);
9327 		return (ENOMEM);
9328 	}
9329 
9330 	ipaddr = sin->sin_addr.s_addr;
9331 
9332 	mp2 = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
9333 	    (caddr_t)&ipaddr);
9334 	if (mp2 == NULL) {
9335 		freeb(mp1);
9336 		inet_freemsg(pending_mp);
9337 		return (ENOMEM);
9338 	}
9339 	/* Put together the chain. */
9340 	mp1->b_cont = mp2;
9341 	mp1->b_datap->db_type = M_IOCTL;
9342 	mp2->b_cont = mp;
9343 	mp2->b_datap->db_type = M_DATA;
9344 
9345 	iocp = (struct iocblk *)mp1->b_rptr;
9346 
9347 	/*
9348 	 * An M_IOCDATA's payload (struct copyresp) is mostly the same as an
9349 	 * M_IOCTL's payload (struct iocblk), but 'struct copyresp' has a
9350 	 * cp_private field (or cp_rval on 32-bit systems) in place of the
9351 	 * ioc_count field; set ioc_count to be correct.
9352 	 */
9353 	iocp->ioc_count = MBLKL(mp1->b_cont);
9354 
9355 	/*
9356 	 * Set the proper command in the ARP message.
9357 	 * Convert the SIOC{G|S|D}ARP calls into our
9358 	 * AR_ENTRY_xxx calls.
9359 	 */
9360 	area = (area_t *)mp2->b_rptr;
9361 	switch (iocp->ioc_cmd) {
9362 	case SIOCDARP:
9363 	case SIOCDXARP:
9364 		/*
9365 		 * We defer deleting the corresponding IRE until
9366 		 * we return from arp.
9367 		 */
9368 		area->area_cmd = AR_ENTRY_DELETE;
9369 		area->area_proto_mask_offset = 0;
9370 		break;
9371 	case SIOCGARP:
9372 	case SIOCGXARP:
9373 		area->area_cmd = AR_ENTRY_SQUERY;
9374 		area->area_proto_mask_offset = 0;
9375 		break;
9376 	case SIOCSARP:
9377 	case SIOCSXARP: {
9378 		/*
9379 		 * Delete the corresponding ire to make sure IP will
9380 		 * pick up any change from arp.
9381 		 */
9382 		if (!if_arp_ioctl) {
9383 			(void) ip_ire_clookup_and_delete(ipaddr, NULL);
9384 			break;
9385 		} else {
9386 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
9387 			if (ipif != NULL) {
9388 				(void) ip_ire_clookup_and_delete(ipaddr, ipif);
9389 				ipif_refrele(ipif);
9390 			}
9391 			break;
9392 		}
9393 	}
9394 	}
9395 	iocp->ioc_cmd = area->area_cmd;
9396 
9397 	/*
9398 	 * Before sending 'mp' to ARP, we have to clear the b_next
9399 	 * and b_prev. Otherwise if STREAMS encounters such a message
9400 	 * in freemsg(), (because ARP can close any time) it can cause
9401 	 * a panic. But mi code needs the b_next and b_prev values of
9402 	 * mp->b_cont, to complete the ioctl. So we store it here
9403 	 * in pending_mp->bcont, and restore it in ip_sioctl_iocack()
9404 	 * when the response comes down from ARP.
9405 	 */
9406 	pending_mp->b_cont->b_next = mp->b_cont->b_next;
9407 	pending_mp->b_cont->b_prev = mp->b_cont->b_prev;
9408 	mp->b_cont->b_next = NULL;
9409 	mp->b_cont->b_prev = NULL;
9410 
9411 	mutex_enter(&connp->conn_lock);
9412 	mutex_enter(&ill->ill_lock);
9413 	/* conn has not yet started closing, hence this can't fail */
9414 	success = ill_pending_mp_add(ill, connp, pending_mp);
9415 	ASSERT(success);
9416 	mutex_exit(&ill->ill_lock);
9417 	mutex_exit(&connp->conn_lock);
9418 
9419 	/*
9420 	 * Fill in the rest of the ARP operation fields.
9421 	 */
9422 	area->area_hw_addr_length = alength;
9423 	bcopy(lladdr,
9424 	    (char *)area + area->area_hw_addr_offset,
9425 	    area->area_hw_addr_length);
9426 	/* Translate the flags. */
9427 	if (flags & ATF_PERM)
9428 		area->area_flags |= ACE_F_PERMANENT;
9429 	if (flags & ATF_PUBL)
9430 		area->area_flags |= ACE_F_PUBLISH;
9431 	if (flags & ATF_AUTHORITY)
9432 		area->area_flags |= ACE_F_AUTHORITY;
9433 
9434 	/*
9435 	 * Up to ARP it goes.  The response will come
9436 	 * back in ip_wput as an M_IOCACK message, and
9437 	 * will be handed to ip_sioctl_iocack for
9438 	 * completion.
9439 	 */
9440 	putnext(ill->ill_rq, mp1);
9441 	return (EINPROGRESS);
9442 }
9443 
9444 /* ARGSUSED */
9445 int
9446 ip_sioctl_xarp(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9447     ip_ioctl_cmd_t *ipip, void *ifreq)
9448 {
9449 	struct xarpreq *xar;
9450 	boolean_t isv6;
9451 	mblk_t	*mp1;
9452 	int	err;
9453 	conn_t	*connp;
9454 	int ifnamelen;
9455 	ire_t	*ire = NULL;
9456 	ill_t	*ill = NULL;
9457 	struct sockaddr_in *sin;
9458 	boolean_t if_arp_ioctl = B_FALSE;
9459 
9460 	/* ioctl comes down on an conn */
9461 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9462 	connp = Q_TO_CONN(q);
9463 	isv6 = connp->conn_af_isv6;
9464 
9465 	/* Existance verified in ip_wput_nondata */
9466 	mp1 = mp->b_cont->b_cont;
9467 
9468 	ASSERT(MBLKL(mp1) >= sizeof (*xar));
9469 	xar = (struct xarpreq *)mp1->b_rptr;
9470 	sin = (sin_t *)&xar->xarp_pa;
9471 
9472 	if (isv6 || (xar->xarp_ha.sdl_family != AF_LINK) ||
9473 	    (xar->xarp_pa.ss_family != AF_INET))
9474 		return (ENXIO);
9475 
9476 	ifnamelen = xar->xarp_ha.sdl_nlen;
9477 	if (ifnamelen != 0) {
9478 		char	*cptr, cval;
9479 
9480 		if (ifnamelen >= LIFNAMSIZ)
9481 			return (EINVAL);
9482 
9483 		/*
9484 		 * Instead of bcopying a bunch of bytes,
9485 		 * null-terminate the string in-situ.
9486 		 */
9487 		cptr = xar->xarp_ha.sdl_data + ifnamelen;
9488 		cval = *cptr;
9489 		*cptr = '\0';
9490 		ill = ill_lookup_on_name(xar->xarp_ha.sdl_data,
9491 		    B_FALSE, isv6, CONNP_TO_WQ(connp), mp, ip_process_ioctl,
9492 		    &err, NULL);
9493 		*cptr = cval;
9494 		if (ill == NULL)
9495 			return (err);
9496 		if (ill->ill_net_type != IRE_IF_RESOLVER) {
9497 			ill_refrele(ill);
9498 			return (ENXIO);
9499 		}
9500 
9501 		if_arp_ioctl = B_TRUE;
9502 	} else {
9503 		/*
9504 		 * PSARC 2003/088 states that if sdl_nlen == 0, it behaves
9505 		 * as an extended BSD ioctl. The kernel uses the IP address
9506 		 * to figure out the network interface.
9507 		 */
9508 		ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES, NULL);
9509 		if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9510 		    ((ill = ire_to_ill(ire)) == NULL) ||
9511 		    (ill->ill_net_type != IRE_IF_RESOLVER)) {
9512 			if (ire != NULL)
9513 				ire_refrele(ire);
9514 			ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9515 			    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9516 			    NULL, MATCH_IRE_TYPE);
9517 			if ((ire == NULL) ||
9518 			    ((ill = ire_to_ill(ire)) == NULL)) {
9519 				if (ire != NULL)
9520 					ire_refrele(ire);
9521 				return (ENXIO);
9522 			}
9523 		}
9524 		ASSERT(ire != NULL && ill != NULL);
9525 	}
9526 
9527 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_TRUE, if_arp_ioctl);
9528 	if (if_arp_ioctl)
9529 		ill_refrele(ill);
9530 	if (ire != NULL)
9531 		ire_refrele(ire);
9532 
9533 	return (err);
9534 }
9535 
9536 /*
9537  * ARP IOCTLs.
9538  * How does IP get in the business of fronting ARP configuration/queries?
9539  * Well its like this, the Berkeley ARP IOCTLs (SIOCGARP, SIOCDARP, SIOCSARP)
9540  * are by tradition passed in through a datagram socket.  That lands in IP.
9541  * As it happens, this is just as well since the interface is quite crude in
9542  * that it passes in no information about protocol or hardware types, or
9543  * interface association.  After making the protocol assumption, IP is in
9544  * the position to look up the name of the ILL, which ARP will need, and
9545  * format a request that can be handled by ARP.	 The request is passed up
9546  * stream to ARP, and the original IOCTL is completed by IP when ARP passes
9547  * back a response.  ARP supports its own set of more general IOCTLs, in
9548  * case anyone is interested.
9549  */
9550 /* ARGSUSED */
9551 int
9552 ip_sioctl_arp(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9553     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
9554 {
9555 	struct arpreq *ar;
9556 	struct sockaddr_in *sin;
9557 	ire_t	*ire;
9558 	boolean_t isv6;
9559 	mblk_t	*mp1;
9560 	int	err;
9561 	conn_t	*connp;
9562 	ill_t	*ill;
9563 
9564 	/* ioctl comes down on an conn */
9565 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
9566 	connp = Q_TO_CONN(q);
9567 	isv6 = connp->conn_af_isv6;
9568 	if (isv6)
9569 		return (ENXIO);
9570 
9571 	/* Existance verified in ip_wput_nondata */
9572 	mp1 = mp->b_cont->b_cont;
9573 
9574 	ar = (struct arpreq *)mp1->b_rptr;
9575 	sin = (sin_t *)&ar->arp_pa;
9576 
9577 	/*
9578 	 * We need to let ARP know on which interface the IP
9579 	 * address has an ARP mapping. In the IPMP case, a
9580 	 * simple forwarding table lookup will return the
9581 	 * IRE_IF_RESOLVER for the first interface in the group,
9582 	 * which might not be the interface on which the
9583 	 * requested IP address was resolved due to the ill
9584 	 * selection algorithm (see ip_newroute_get_dst_ill()).
9585 	 * So we do a cache table lookup first: if the IRE cache
9586 	 * entry for the IP address is still there, it will
9587 	 * contain the ill pointer for the right interface, so
9588 	 * we use that. If the cache entry has been flushed, we
9589 	 * fall back to the forwarding table lookup. This should
9590 	 * be rare enough since IRE cache entries have a longer
9591 	 * life expectancy than ARP cache entries.
9592 	 */
9593 	ire = ire_cache_lookup(sin->sin_addr.s_addr, ALL_ZONES, NULL);
9594 	if ((ire == NULL) || (ire->ire_type == IRE_LOOPBACK) ||
9595 	    ((ill = ire_to_ill(ire)) == NULL)) {
9596 		if (ire != NULL)
9597 			ire_refrele(ire);
9598 		ire = ire_ftable_lookup(sin->sin_addr.s_addr,
9599 		    0, 0, IRE_IF_RESOLVER, NULL, NULL, ALL_ZONES, 0,
9600 		    NULL, MATCH_IRE_TYPE);
9601 		if ((ire == NULL) || ((ill = ire_to_ill(ire)) == NULL)) {
9602 			if (ire != NULL)
9603 				ire_refrele(ire);
9604 			return (ENXIO);
9605 		}
9606 	}
9607 	ASSERT(ire != NULL && ill != NULL);
9608 
9609 	err = ip_sioctl_arp_common(ill, q, mp, sin, B_FALSE, B_FALSE);
9610 	ire_refrele(ire);
9611 	return (err);
9612 }
9613 
9614 /*
9615  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
9616  * atomically set/clear the muxids. Also complete the ioctl by acking or
9617  * naking it.  Note that the code is structured such that the link type,
9618  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
9619  * its clones use the persistent link, while pppd(1M) and perhaps many
9620  * other daemons may use non-persistent link.  When combined with some
9621  * ill_t states, linking and unlinking lower streams may be used as
9622  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
9623  */
9624 /* ARGSUSED */
9625 void
9626 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
9627 {
9628 	mblk_t *mp1;
9629 	mblk_t *mp2;
9630 	struct linkblk *li;
9631 	queue_t	*ipwq;
9632 	char	*name;
9633 	struct qinit *qinfo;
9634 	struct ipmx_s *ipmxp;
9635 	ill_t	*ill = NULL;
9636 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9637 	int	err = 0;
9638 	boolean_t	entered_ipsq = B_FALSE;
9639 	boolean_t islink;
9640 	queue_t *dwq = NULL;
9641 
9642 	ASSERT(iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_PUNLINK ||
9643 	    iocp->ioc_cmd == I_LINK || iocp->ioc_cmd == I_UNLINK);
9644 
9645 	islink = (iocp->ioc_cmd == I_PLINK || iocp->ioc_cmd == I_LINK) ?
9646 	    B_TRUE : B_FALSE;
9647 
9648 	mp1 = mp->b_cont;	/* This is the linkblk info */
9649 	li = (struct linkblk *)mp1->b_rptr;
9650 
9651 	/*
9652 	 * ARP has added this special mblk, and the utility is asking us
9653 	 * to perform consistency checks, and also atomically set the
9654 	 * muxid. Ifconfig is an example.  It achieves this by using
9655 	 * /dev/arp as the mux to plink the arp stream, and pushes arp on
9656 	 * to /dev/udp[6] stream for use as the mux when plinking the IP
9657 	 * stream. SIOCSLIFMUXID is not required.  See ifconfig.c, arp.c
9658 	 * and other comments in this routine for more details.
9659 	 */
9660 	mp2 = mp1->b_cont;	/* This is added by ARP */
9661 
9662 	/*
9663 	 * If I_{P}LINK/I_{P}UNLINK is issued by a utility other than
9664 	 * ifconfig which didn't push ARP on top of the dummy mux, we won't
9665 	 * get the special mblk above.  For backward compatibility, we just
9666 	 * return success.  The utility will use SIOCSLIFMUXID to store
9667 	 * the muxids.  This is not atomic, and can leave the streams
9668 	 * unplumbable if the utility is interrrupted, before it does the
9669 	 * SIOCSLIFMUXID.
9670 	 */
9671 	if (mp2 == NULL) {
9672 		/*
9673 		 * At this point we don't know whether or not this is the
9674 		 * IP module stream or the ARP device stream.  We need to
9675 		 * walk the lower stream in order to find this out, since
9676 		 * the capability negotiation is done only on the IP module
9677 		 * stream.  IP module instance is identified by the module
9678 		 * name IP, non-null q_next, and it's wput not being ip_lwput.
9679 		 * STREAMS ensures that the lower stream (l_qbot) will not
9680 		 * vanish until this ioctl completes. So we can safely walk
9681 		 * the stream or refer to the q_ptr.
9682 		 */
9683 		ipwq = li->l_qbot;
9684 		while (ipwq != NULL) {
9685 			qinfo = ipwq->q_qinfo;
9686 			name = qinfo->qi_minfo->mi_idname;
9687 			if (name != NULL && name[0] != NULL &&
9688 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9689 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9690 			    (ipwq->q_next != NULL)) {
9691 				break;
9692 			}
9693 			ipwq = ipwq->q_next;
9694 		}
9695 		/*
9696 		 * This looks like an IP module stream, so trigger
9697 		 * the capability reset or re-negotiation if necessary.
9698 		 */
9699 		if (ipwq != NULL) {
9700 			ill = ipwq->q_ptr;
9701 			ASSERT(ill != NULL);
9702 
9703 			if (ipsq == NULL) {
9704 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9705 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9706 				if (ipsq == NULL)
9707 					return;
9708 				entered_ipsq = B_TRUE;
9709 			}
9710 			ASSERT(IAM_WRITER_ILL(ill));
9711 			/*
9712 			 * Store the upper read queue of the module
9713 			 * immediately below IP, and count the total
9714 			 * number of lower modules.  Do this only
9715 			 * for I_PLINK or I_LINK event.
9716 			 */
9717 			ill->ill_lmod_rq = NULL;
9718 			ill->ill_lmod_cnt = 0;
9719 			if (islink && (dwq = ipwq->q_next) != NULL) {
9720 				ill->ill_lmod_rq = RD(dwq);
9721 
9722 				while (dwq != NULL) {
9723 					ill->ill_lmod_cnt++;
9724 					dwq = dwq->q_next;
9725 				}
9726 			}
9727 			/*
9728 			 * There's no point in resetting or re-negotiating if
9729 			 * we are not bound to the driver, so only do this if
9730 			 * the DLPI state is idle (up); we assume such state
9731 			 * since ill_ipif_up_count gets incremented in
9732 			 * ipif_up_done(), which is after we are bound to the
9733 			 * driver.  Note that in the case of logical
9734 			 * interfaces, IP won't rebind to the driver unless
9735 			 * the ill_ipif_up_count is 0, meaning that all other
9736 			 * IP interfaces (including the main ipif) are in the
9737 			 * down state.  Because of this, we use such counter
9738 			 * as an indicator, instead of relying on the IPIF_UP
9739 			 * flag, which is per ipif instance.
9740 			 */
9741 			if (ill->ill_ipif_up_count > 0) {
9742 				if (islink)
9743 					ill_capability_probe(ill);
9744 				else
9745 					ill_capability_reset(ill);
9746 			}
9747 		}
9748 		goto done;
9749 	}
9750 
9751 	/*
9752 	 * This is an I_{P}LINK sent down by ifconfig on
9753 	 * /dev/arp. ARP has appended this last (3rd) mblk,
9754 	 * giving more info. STREAMS ensures that the lower
9755 	 * stream (l_qbot) will not vanish until this ioctl
9756 	 * completes. So we can safely walk the stream or refer
9757 	 * to the q_ptr.
9758 	 */
9759 	ipmxp = (struct ipmx_s *)mp2->b_rptr;
9760 	if (ipmxp->ipmx_arpdev_stream) {
9761 		/*
9762 		 * The operation is occuring on the arp-device
9763 		 * stream.
9764 		 */
9765 		ill = ill_lookup_on_name(ipmxp->ipmx_name, B_FALSE, B_FALSE,
9766 		    q, mp, ip_sioctl_plink, &err, NULL);
9767 		if (ill == NULL) {
9768 			if (err == EINPROGRESS) {
9769 				return;
9770 			} else {
9771 				err = EINVAL;
9772 				goto done;
9773 			}
9774 		}
9775 
9776 		if (ipsq == NULL) {
9777 			ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
9778 			    NEW_OP, B_TRUE);
9779 			if (ipsq == NULL) {
9780 				ill_refrele(ill);
9781 				return;
9782 			}
9783 			entered_ipsq = B_TRUE;
9784 		}
9785 		ASSERT(IAM_WRITER_ILL(ill));
9786 		ill_refrele(ill);
9787 		/*
9788 		 * To ensure consistency between IP and ARP,
9789 		 * the following LIFO scheme is used in
9790 		 * plink/punlink. (IP first, ARP last).
9791 		 * This is because the muxid's are stored
9792 		 * in the IP stream on the ill.
9793 		 *
9794 		 * I_{P}LINK: ifconfig plinks the IP stream before
9795 		 * plinking the ARP stream. On an arp-dev
9796 		 * stream, IP checks that it is not yet
9797 		 * plinked, and it also checks that the
9798 		 * corresponding IP stream is already plinked.
9799 		 *
9800 		 * I_{P}UNLINK: ifconfig punlinks the ARP stream
9801 		 * before punlinking the IP stream. IP does
9802 		 * not allow punlink of the IP stream unless
9803 		 * the arp stream has been punlinked.
9804 		 *
9805 		 */
9806 		if ((islink &&
9807 		    (ill->ill_arp_muxid != 0 || ill->ill_ip_muxid == 0)) ||
9808 		    (!islink &&
9809 		    ill->ill_arp_muxid != li->l_index)) {
9810 			err = EINVAL;
9811 			goto done;
9812 		}
9813 		if (islink) {
9814 			ill->ill_arp_muxid = li->l_index;
9815 		} else {
9816 			ill->ill_arp_muxid = 0;
9817 		}
9818 	} else {
9819 		/*
9820 		 * This must be the IP module stream with or
9821 		 * without arp. Walk the stream and locate the
9822 		 * IP module. An IP module instance is
9823 		 * identified by the module name IP, non-null
9824 		 * q_next, and it's wput not being ip_lwput.
9825 		 */
9826 		ipwq = li->l_qbot;
9827 		while (ipwq != NULL) {
9828 			qinfo = ipwq->q_qinfo;
9829 			name = qinfo->qi_minfo->mi_idname;
9830 			if (name != NULL && name[0] != NULL &&
9831 			    (strcmp(name, ip_mod_info.mi_idname) == 0) &&
9832 			    ((void *)(qinfo->qi_putp) != (void *)ip_lwput) &&
9833 			    (ipwq->q_next != NULL)) {
9834 				break;
9835 			}
9836 			ipwq = ipwq->q_next;
9837 		}
9838 		if (ipwq != NULL) {
9839 			ill = ipwq->q_ptr;
9840 			ASSERT(ill != NULL);
9841 
9842 			if (ipsq == NULL) {
9843 				ipsq = ipsq_try_enter(NULL, ill, q, mp,
9844 				    ip_sioctl_plink, NEW_OP, B_TRUE);
9845 				if (ipsq == NULL)
9846 					return;
9847 				entered_ipsq = B_TRUE;
9848 			}
9849 			ASSERT(IAM_WRITER_ILL(ill));
9850 			/*
9851 			 * Return error if the ip_mux_id is
9852 			 * non-zero and command is I_{P}LINK.
9853 			 * If command is I_{P}UNLINK, return
9854 			 * error if the arp-devstr is not
9855 			 * yet punlinked.
9856 			 */
9857 			if ((islink && ill->ill_ip_muxid != 0) ||
9858 			    (!islink && ill->ill_arp_muxid != 0)) {
9859 				err = EINVAL;
9860 				goto done;
9861 			}
9862 			ill->ill_lmod_rq = NULL;
9863 			ill->ill_lmod_cnt = 0;
9864 			if (islink) {
9865 				/*
9866 				 * Store the upper read queue of the module
9867 				 * immediately below IP, and count the total
9868 				 * number of lower modules.
9869 				 */
9870 				if ((dwq = ipwq->q_next) != NULL) {
9871 					ill->ill_lmod_rq = RD(dwq);
9872 
9873 					while (dwq != NULL) {
9874 						ill->ill_lmod_cnt++;
9875 						dwq = dwq->q_next;
9876 					}
9877 				}
9878 				ill->ill_ip_muxid = li->l_index;
9879 			} else {
9880 				ill->ill_ip_muxid = 0;
9881 			}
9882 
9883 			/*
9884 			 * See comments above about resetting/re-
9885 			 * negotiating driver sub-capabilities.
9886 			 */
9887 			if (ill->ill_ipif_up_count > 0) {
9888 				if (islink)
9889 					ill_capability_probe(ill);
9890 				else
9891 					ill_capability_reset(ill);
9892 			}
9893 		}
9894 	}
9895 done:
9896 	iocp->ioc_count = 0;
9897 	iocp->ioc_error = err;
9898 	if (err == 0)
9899 		mp->b_datap->db_type = M_IOCACK;
9900 	else
9901 		mp->b_datap->db_type = M_IOCNAK;
9902 	qreply(q, mp);
9903 
9904 	/* Conn was refheld in ip_sioctl_copyin_setup */
9905 	if (CONN_Q(q))
9906 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
9907 	if (entered_ipsq)
9908 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
9909 }
9910 
9911 /*
9912  * Search the ioctl command in the ioctl tables and return a pointer
9913  * to the ioctl command information. The ioctl command tables are
9914  * static and fully populated at compile time.
9915  */
9916 ip_ioctl_cmd_t *
9917 ip_sioctl_lookup(int ioc_cmd)
9918 {
9919 	int index;
9920 	ip_ioctl_cmd_t *ipip;
9921 	ip_ioctl_cmd_t *ipip_end;
9922 
9923 	if (ioc_cmd == IPI_DONTCARE)
9924 		return (NULL);
9925 
9926 	/*
9927 	 * Do a 2 step search. First search the indexed table
9928 	 * based on the least significant byte of the ioctl cmd.
9929 	 * If we don't find a match, then search the misc table
9930 	 * serially.
9931 	 */
9932 	index = ioc_cmd & 0xFF;
9933 	if (index < ip_ndx_ioctl_count) {
9934 		ipip = &ip_ndx_ioctl_table[index];
9935 		if (ipip->ipi_cmd == ioc_cmd) {
9936 			/* Found a match in the ndx table */
9937 			return (ipip);
9938 		}
9939 	}
9940 
9941 	/* Search the misc table */
9942 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
9943 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
9944 		if (ipip->ipi_cmd == ioc_cmd)
9945 			/* Found a match in the misc table */
9946 			return (ipip);
9947 	}
9948 
9949 	return (NULL);
9950 }
9951 
9952 /*
9953  * Wrapper function for resuming deferred ioctl processing
9954  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9955  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9956  */
9957 /* ARGSUSED */
9958 void
9959 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9960     void *dummy_arg)
9961 {
9962 	ip_sioctl_copyin_setup(q, mp);
9963 }
9964 
9965 /*
9966  * ip_sioctl_copyin_setup is called by ip_wput with any M_IOCTL message
9967  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9968  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9969  * We establish here the size of the block to be copied in.  mi_copyin
9970  * arranges for this to happen, an processing continues in ip_wput with
9971  * an M_IOCDATA message.
9972  */
9973 void
9974 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9975 {
9976 	int	copyin_size;
9977 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9978 	ip_ioctl_cmd_t *ipip;
9979 	cred_t *cr;
9980 
9981 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9982 	if (ipip == NULL) {
9983 		/*
9984 		 * The ioctl is not one we understand or own.
9985 		 * Pass it along to be processed down stream,
9986 		 * if this is a module instance of IP, else nak
9987 		 * the ioctl.
9988 		 */
9989 		if (q->q_next == NULL) {
9990 			goto nak;
9991 		} else {
9992 			putnext(q, mp);
9993 			return;
9994 		}
9995 	}
9996 
9997 	/*
9998 	 * If this is deferred, then we will do all the checks when we
9999 	 * come back.
10000 	 */
10001 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
10002 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup()) {
10003 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
10004 		return;
10005 	}
10006 
10007 	/*
10008 	 * Only allow a very small subset of IP ioctls on this stream if
10009 	 * IP is a module and not a driver. Allowing ioctls to be processed
10010 	 * in this case may cause assert failures or data corruption.
10011 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
10012 	 * ioctls allowed on an IP module stream, after which this stream
10013 	 * normally becomes a multiplexor (at which time the stream head
10014 	 * will fail all ioctls).
10015 	 */
10016 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
10017 		if (ipip->ipi_flags & IPI_PASS_DOWN) {
10018 			/*
10019 			 * Pass common Streams ioctls which the IP
10020 			 * module does not own or consume along to
10021 			 * be processed down stream.
10022 			 */
10023 			putnext(q, mp);
10024 			return;
10025 		} else {
10026 			goto nak;
10027 		}
10028 	}
10029 
10030 	/* Make sure we have ioctl data to process. */
10031 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
10032 		goto nak;
10033 
10034 	/*
10035 	 * Prefer dblk credential over ioctl credential; some synthesized
10036 	 * ioctls have kcred set because there's no way to crhold()
10037 	 * a credential in some contexts.  (ioc_cr is not crfree() by
10038 	 * the framework; the caller of ioctl needs to hold the reference
10039 	 * for the duration of the call).
10040 	 */
10041 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
10042 
10043 	/* Make sure normal users don't send down privileged ioctls */
10044 	if ((ipip->ipi_flags & IPI_PRIV) &&
10045 	    (cr != NULL) && secpolicy_net_config(cr, B_TRUE) != 0) {
10046 		/* We checked the privilege earlier but log it here */
10047 		miocnak(q, mp, 0, secpolicy_net_config(cr, B_FALSE));
10048 		return;
10049 	}
10050 
10051 	/*
10052 	 * The ioctl command tables can only encode fixed length
10053 	 * ioctl data. If the length is variable, the table will
10054 	 * encode the length as zero. Such special cases are handled
10055 	 * below in the switch.
10056 	 */
10057 	if (ipip->ipi_copyin_size != 0) {
10058 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
10059 		return;
10060 	}
10061 
10062 	switch (iocp->ioc_cmd) {
10063 	case O_SIOCGIFCONF:
10064 	case SIOCGIFCONF:
10065 		/*
10066 		 * This IOCTL is hilarious.  See comments in
10067 		 * ip_sioctl_get_ifconf for the story.
10068 		 */
10069 		if (iocp->ioc_count == TRANSPARENT)
10070 			copyin_size = SIZEOF_STRUCT(ifconf,
10071 			    iocp->ioc_flag);
10072 		else
10073 			copyin_size = iocp->ioc_count;
10074 		mi_copyin(q, mp, NULL, copyin_size);
10075 		return;
10076 
10077 	case O_SIOCGLIFCONF:
10078 	case SIOCGLIFCONF:
10079 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
10080 		mi_copyin(q, mp, NULL, copyin_size);
10081 		return;
10082 
10083 	case SIOCGLIFSRCOF:
10084 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
10085 		mi_copyin(q, mp, NULL, copyin_size);
10086 		return;
10087 	case SIOCGIP6ADDRPOLICY:
10088 		ip_sioctl_ip6addrpolicy(q, mp);
10089 		ip6_asp_table_refrele();
10090 		return;
10091 
10092 	case SIOCSIP6ADDRPOLICY:
10093 		ip_sioctl_ip6addrpolicy(q, mp);
10094 		return;
10095 
10096 	case SIOCGDSTINFO:
10097 		ip_sioctl_dstinfo(q, mp);
10098 		ip6_asp_table_refrele();
10099 		return;
10100 
10101 	case I_PLINK:
10102 	case I_PUNLINK:
10103 	case I_LINK:
10104 	case I_UNLINK:
10105 		/*
10106 		 * We treat non-persistent link similarly as the persistent
10107 		 * link case, in terms of plumbing/unplumbing, as well as
10108 		 * dynamic re-plumbing events indicator.  See comments
10109 		 * in ip_sioctl_plink() for more.
10110 		 *
10111 		 * Request can be enqueued in the 'ipsq' while waiting
10112 		 * to become exclusive. So bump up the conn ref.
10113 		 */
10114 		if (CONN_Q(q))
10115 			CONN_INC_REF(Q_TO_CONN(q));
10116 		ip_sioctl_plink(NULL, q, mp, NULL);
10117 		return;
10118 
10119 	case ND_GET:
10120 	case ND_SET:
10121 		/*
10122 		 * Use of the nd table requires holding the reader lock.
10123 		 * Modifying the nd table thru nd_load/nd_unload requires
10124 		 * the writer lock.
10125 		 */
10126 		rw_enter(&ip_g_nd_lock, RW_READER);
10127 		if (nd_getset(q, ip_g_nd, mp)) {
10128 			rw_exit(&ip_g_nd_lock);
10129 
10130 			if (iocp->ioc_error)
10131 				iocp->ioc_count = 0;
10132 			mp->b_datap->db_type = M_IOCACK;
10133 			qreply(q, mp);
10134 			return;
10135 		}
10136 		rw_exit(&ip_g_nd_lock);
10137 		/*
10138 		 * We don't understand this subioctl of ND_GET / ND_SET.
10139 		 * Maybe intended for some driver / module below us
10140 		 */
10141 		if (q->q_next) {
10142 			putnext(q, mp);
10143 		} else {
10144 			iocp->ioc_error = ENOENT;
10145 			mp->b_datap->db_type = M_IOCNAK;
10146 			iocp->ioc_count = 0;
10147 			qreply(q, mp);
10148 		}
10149 		return;
10150 
10151 	case IP_IOCTL:
10152 		ip_wput_ioctl(q, mp);
10153 		return;
10154 	default:
10155 		cmn_err(CE_PANIC, "should not happen ");
10156 	}
10157 nak:
10158 	if (mp->b_cont != NULL) {
10159 		freemsg(mp->b_cont);
10160 		mp->b_cont = NULL;
10161 	}
10162 	iocp->ioc_error = EINVAL;
10163 	mp->b_datap->db_type = M_IOCNAK;
10164 	iocp->ioc_count = 0;
10165 	qreply(q, mp);
10166 }
10167 
10168 /* ip_wput hands off ARP IOCTL responses to us */
10169 void
10170 ip_sioctl_iocack(queue_t *q, mblk_t *mp)
10171 {
10172 	struct arpreq *ar;
10173 	struct xarpreq *xar;
10174 	area_t	*area;
10175 	mblk_t	*area_mp;
10176 	struct iocblk *iocp;
10177 	mblk_t	*orig_ioc_mp, *tmp;
10178 	struct iocblk	*orig_iocp;
10179 	ill_t *ill;
10180 	conn_t *connp = NULL;
10181 	uint_t ioc_id;
10182 	mblk_t *pending_mp;
10183 	int x_arp_ioctl = B_FALSE, ifx_arp_ioctl = B_FALSE;
10184 	int *flagsp;
10185 	char *storage = NULL;
10186 	sin_t *sin;
10187 	ipaddr_t addr;
10188 	int err;
10189 
10190 	ill = q->q_ptr;
10191 	ASSERT(ill != NULL);
10192 
10193 	/*
10194 	 * We should get back from ARP a packet chain that looks like:
10195 	 * M_IOCACK-->ARP_op_MBLK-->ORIG_M_IOCTL-->MI_COPY_MBLK-->[X]ARPREQ_MBLK
10196 	 */
10197 	if (!(area_mp = mp->b_cont) ||
10198 	    (area_mp->b_wptr - area_mp->b_rptr) < sizeof (ip_sock_ar_t) ||
10199 	    !(orig_ioc_mp = area_mp->b_cont) ||
10200 	    !orig_ioc_mp->b_cont || !orig_ioc_mp->b_cont->b_cont) {
10201 		freemsg(mp);
10202 		return;
10203 	}
10204 
10205 	orig_iocp = (struct iocblk *)orig_ioc_mp->b_rptr;
10206 
10207 	tmp = (orig_ioc_mp->b_cont)->b_cont;
10208 	if ((orig_iocp->ioc_cmd == SIOCGXARP) ||
10209 	    (orig_iocp->ioc_cmd == SIOCSXARP) ||
10210 	    (orig_iocp->ioc_cmd == SIOCDXARP)) {
10211 		x_arp_ioctl = B_TRUE;
10212 		xar = (struct xarpreq *)tmp->b_rptr;
10213 		sin = (sin_t *)&xar->xarp_pa;
10214 		flagsp = &xar->xarp_flags;
10215 		storage = xar->xarp_ha.sdl_data;
10216 		if (xar->xarp_ha.sdl_nlen != 0)
10217 			ifx_arp_ioctl = B_TRUE;
10218 	} else {
10219 		ar = (struct arpreq *)tmp->b_rptr;
10220 		sin = (sin_t *)&ar->arp_pa;
10221 		flagsp = &ar->arp_flags;
10222 		storage = ar->arp_ha.sa_data;
10223 	}
10224 
10225 	iocp = (struct iocblk *)mp->b_rptr;
10226 
10227 	/*
10228 	 * Pick out the originating queue based on the ioc_id.
10229 	 */
10230 	ioc_id = iocp->ioc_id;
10231 	pending_mp = ill_pending_mp_get(ill, &connp, ioc_id);
10232 	if (pending_mp == NULL) {
10233 		ASSERT(connp == NULL);
10234 		inet_freemsg(mp);
10235 		return;
10236 	}
10237 	ASSERT(connp != NULL);
10238 	q = CONNP_TO_WQ(connp);
10239 
10240 	/* Uncouple the internally generated IOCTL from the original one */
10241 	area = (area_t *)area_mp->b_rptr;
10242 	area_mp->b_cont = NULL;
10243 
10244 	/*
10245 	 * Restore the b_next and b_prev used by mi code. This is needed
10246 	 * to complete the ioctl using mi* functions. We stored them in
10247 	 * the pending mp prior to sending the request to ARP.
10248 	 */
10249 	orig_ioc_mp->b_cont->b_next = pending_mp->b_cont->b_next;
10250 	orig_ioc_mp->b_cont->b_prev = pending_mp->b_cont->b_prev;
10251 	inet_freemsg(pending_mp);
10252 
10253 	/*
10254 	 * We're done if there was an error or if this is not an SIOCG{X}ARP
10255 	 * Catch the case where there is an IRE_CACHE by no entry in the
10256 	 * arp table.
10257 	 */
10258 	addr = sin->sin_addr.s_addr;
10259 	if (iocp->ioc_error && iocp->ioc_cmd == AR_ENTRY_SQUERY) {
10260 		ire_t			*ire;
10261 		dl_unitdata_req_t	*dlup;
10262 		mblk_t			*llmp;
10263 		int			addr_len;
10264 		ill_t			*ipsqill = NULL;
10265 
10266 		if (ifx_arp_ioctl) {
10267 			/*
10268 			 * There's no need to lookup the ill, since
10269 			 * we've already done that when we started
10270 			 * processing the ioctl and sent the message
10271 			 * to ARP on that ill.  So use the ill that
10272 			 * is stored in q->q_ptr.
10273 			 */
10274 			ipsqill = ill;
10275 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10276 			    ipsqill->ill_ipif, ALL_ZONES,
10277 			    NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
10278 		} else {
10279 			ire = ire_ctable_lookup(addr, 0, IRE_CACHE,
10280 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
10281 			if (ire != NULL)
10282 				ipsqill = ire_to_ill(ire);
10283 		}
10284 
10285 		if ((x_arp_ioctl) && (ipsqill != NULL))
10286 			storage += ill_xarp_info(&xar->xarp_ha, ipsqill);
10287 
10288 		if (ire != NULL) {
10289 			/*
10290 			 * Since the ire obtained from cachetable is used for
10291 			 * mac addr copying below, treat an incomplete ire as if
10292 			 * as if we never found it.
10293 			 */
10294 			if (ire->ire_nce != NULL &&
10295 			    ire->ire_nce->nce_state != ND_REACHABLE) {
10296 				ire_refrele(ire);
10297 				ire = NULL;
10298 				ipsqill = NULL;
10299 				goto errack;
10300 			}
10301 			*flagsp = ATF_INUSE;
10302 			llmp = (ire->ire_nce != NULL ?
10303 			    ire->ire_nce->nce_res_mp : NULL);
10304 			if (llmp != NULL && ipsqill != NULL) {
10305 				uchar_t *macaddr;
10306 
10307 				addr_len = ipsqill->ill_phys_addr_length;
10308 				if (x_arp_ioctl && ((addr_len +
10309 				    ipsqill->ill_name_length) >
10310 				    sizeof (xar->xarp_ha.sdl_data))) {
10311 					ire_refrele(ire);
10312 					freemsg(mp);
10313 					ip_ioctl_finish(q, orig_ioc_mp,
10314 					    EINVAL, NO_COPYOUT, NULL, NULL);
10315 					return;
10316 				}
10317 				*flagsp |= ATF_COM;
10318 				dlup = (dl_unitdata_req_t *)llmp->b_rptr;
10319 				if (ipsqill->ill_sap_length < 0)
10320 					macaddr = llmp->b_rptr +
10321 					    dlup->dl_dest_addr_offset;
10322 				else
10323 					macaddr = llmp->b_rptr +
10324 					    dlup->dl_dest_addr_offset +
10325 					    ipsqill->ill_sap_length;
10326 				/*
10327 				 * For SIOCGARP, MAC address length
10328 				 * validation has already been done
10329 				 * before the ioctl was issued to ARP to
10330 				 * allow it to progress only on 6 byte
10331 				 * addressable (ethernet like) media. Thus
10332 				 * the mac address copying can not overwrite
10333 				 * the sa_data area below.
10334 				 */
10335 				bcopy(macaddr, storage, addr_len);
10336 			}
10337 			/* Ditch the internal IOCTL. */
10338 			freemsg(mp);
10339 			ire_refrele(ire);
10340 			ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
10341 			return;
10342 		}
10343 	}
10344 
10345 	/*
10346 	 * Delete the coresponding IRE_CACHE if any.
10347 	 * Reset the error if there was one (in case there was no entry
10348 	 * in arp.)
10349 	 */
10350 	if (iocp->ioc_cmd == AR_ENTRY_DELETE) {
10351 		ipif_t *ipintf = NULL;
10352 
10353 		if (ifx_arp_ioctl) {
10354 			/*
10355 			 * There's no need to lookup the ill, since
10356 			 * we've already done that when we started
10357 			 * processing the ioctl and sent the message
10358 			 * to ARP on that ill.  So use the ill that
10359 			 * is stored in q->q_ptr.
10360 			 */
10361 			ipintf = ill->ill_ipif;
10362 		}
10363 		if (ip_ire_clookup_and_delete(addr, ipintf)) {
10364 			/*
10365 			 * The address in "addr" may be an entry for a
10366 			 * router. If that's true, then any off-net
10367 			 * IRE_CACHE entries that go through the router
10368 			 * with address "addr" must be clobbered. Use
10369 			 * ire_walk to achieve this goal.
10370 			 */
10371 			if (ifx_arp_ioctl)
10372 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
10373 				    ire_delete_cache_gw, (char *)&addr, ill);
10374 			else
10375 				ire_walk_v4(ire_delete_cache_gw, (char *)&addr,
10376 				    ALL_ZONES);
10377 			iocp->ioc_error = 0;
10378 		}
10379 	}
10380 errack:
10381 	if (iocp->ioc_error || iocp->ioc_cmd != AR_ENTRY_SQUERY) {
10382 		err = iocp->ioc_error;
10383 		freemsg(mp);
10384 		ip_ioctl_finish(q, orig_ioc_mp, err, NO_COPYOUT, NULL, NULL);
10385 		return;
10386 	}
10387 
10388 	/*
10389 	 * Completion of an SIOCG{X}ARP.  Translate the information from
10390 	 * the area_t into the struct {x}arpreq.
10391 	 */
10392 	if (x_arp_ioctl) {
10393 		storage += ill_xarp_info(&xar->xarp_ha, ill);
10394 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
10395 		    sizeof (xar->xarp_ha.sdl_data)) {
10396 			freemsg(mp);
10397 			ip_ioctl_finish(q, orig_ioc_mp, EINVAL,
10398 			    NO_COPYOUT, NULL, NULL);
10399 			return;
10400 		}
10401 	}
10402 	*flagsp = ATF_INUSE;
10403 	if (area->area_flags & ACE_F_PERMANENT)
10404 		*flagsp |= ATF_PERM;
10405 	if (area->area_flags & ACE_F_PUBLISH)
10406 		*flagsp |= ATF_PUBL;
10407 	if (area->area_flags & ACE_F_AUTHORITY)
10408 		*flagsp |= ATF_AUTHORITY;
10409 	if (area->area_hw_addr_length != 0) {
10410 		*flagsp |= ATF_COM;
10411 		/*
10412 		 * For SIOCGARP, MAC address length validation has
10413 		 * already been done before the ioctl was issued to ARP
10414 		 * to allow it to progress only on 6 byte addressable
10415 		 * (ethernet like) media. Thus the mac address copying
10416 		 * can not overwrite the sa_data area below.
10417 		 */
10418 		bcopy((char *)area + area->area_hw_addr_offset,
10419 		    storage, area->area_hw_addr_length);
10420 	}
10421 
10422 	/* Ditch the internal IOCTL. */
10423 	freemsg(mp);
10424 	/* Complete the original. */
10425 	ip_ioctl_finish(q, orig_ioc_mp, 0, COPYOUT, NULL, NULL);
10426 }
10427 
10428 /*
10429  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
10430  * interface) create the next available logical interface for this
10431  * physical interface.
10432  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
10433  * ipif with the specified name.
10434  *
10435  * If the address family is not AF_UNSPEC then set the address as well.
10436  *
10437  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
10438  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
10439  *
10440  * Executed as a writer on the ill or ill group.
10441  * So no lock is needed to traverse the ipif chain, or examine the
10442  * phyint flags.
10443  */
10444 /* ARGSUSED */
10445 int
10446 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
10447     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10448 {
10449 	mblk_t	*mp1;
10450 	struct lifreq *lifr;
10451 	boolean_t	isv6;
10452 	boolean_t	exists;
10453 	char 	*name;
10454 	char	*endp;
10455 	char	*cp;
10456 	int	namelen;
10457 	ipif_t	*ipif;
10458 	long	id;
10459 	ipsq_t	*ipsq;
10460 	ill_t	*ill;
10461 	sin_t	*sin;
10462 	int	err = 0;
10463 	boolean_t found_sep = B_FALSE;
10464 	conn_t	*connp;
10465 	zoneid_t zoneid;
10466 	int	orig_ifindex = 0;
10467 
10468 	ip1dbg(("ip_sioctl_addif\n"));
10469 	/* Existence of mp1 has been checked in ip_wput_nondata */
10470 	mp1 = mp->b_cont->b_cont;
10471 	/*
10472 	 * Null terminate the string to protect against buffer
10473 	 * overrun. String was generated by user code and may not
10474 	 * be trusted.
10475 	 */
10476 	lifr = (struct lifreq *)mp1->b_rptr;
10477 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
10478 	name = lifr->lifr_name;
10479 	ASSERT(CONN_Q(q));
10480 	connp = Q_TO_CONN(q);
10481 	isv6 = connp->conn_af_isv6;
10482 	zoneid = connp->conn_zoneid;
10483 	namelen = mi_strlen(name);
10484 	if (namelen == 0)
10485 		return (EINVAL);
10486 
10487 	exists = B_FALSE;
10488 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
10489 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
10490 		/*
10491 		 * Allow creating lo0 using SIOCLIFADDIF.
10492 		 * can't be any other writer thread. So can pass null below
10493 		 * for the last 4 args to ipif_lookup_name.
10494 		 */
10495 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen,
10496 		    B_TRUE, &exists, isv6, zoneid, NULL, NULL, NULL, NULL);
10497 		/* Prevent any further action */
10498 		if (ipif == NULL) {
10499 			return (ENOBUFS);
10500 		} else if (!exists) {
10501 			/* We created the ipif now and as writer */
10502 			ipif_refrele(ipif);
10503 			return (0);
10504 		} else {
10505 			ill = ipif->ipif_ill;
10506 			ill_refhold(ill);
10507 			ipif_refrele(ipif);
10508 		}
10509 	} else {
10510 		/* Look for a colon in the name. */
10511 		endp = &name[namelen];
10512 		for (cp = endp; --cp > name; ) {
10513 			if (*cp == IPIF_SEPARATOR_CHAR) {
10514 				found_sep = B_TRUE;
10515 				/*
10516 				 * Reject any non-decimal aliases for plumbing
10517 				 * of logical interfaces. Aliases with leading
10518 				 * zeroes are also rejected as they introduce
10519 				 * ambiguity in the naming of the interfaces.
10520 				 * Comparing with "0" takes care of all such
10521 				 * cases.
10522 				 */
10523 				if ((strncmp("0", cp+1, 1)) == 0)
10524 					return (EINVAL);
10525 
10526 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
10527 				    id <= 0 || *endp != '\0') {
10528 					return (EINVAL);
10529 				}
10530 				*cp = '\0';
10531 				break;
10532 			}
10533 		}
10534 		ill = ill_lookup_on_name(name, B_FALSE, isv6,
10535 		    CONNP_TO_WQ(connp), mp, ip_process_ioctl, &err, NULL);
10536 		if (found_sep)
10537 			*cp = IPIF_SEPARATOR_CHAR;
10538 		if (ill == NULL)
10539 			return (err);
10540 	}
10541 
10542 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
10543 	    B_TRUE);
10544 
10545 	/*
10546 	 * Release the refhold due to the lookup, now that we are excl
10547 	 * or we are just returning
10548 	 */
10549 	ill_refrele(ill);
10550 
10551 	if (ipsq == NULL)
10552 		return (EINPROGRESS);
10553 
10554 	/*
10555 	 * If the interface is failed, inactive or offlined, look for a working
10556 	 * interface in the ill group and create the ipif there. If we can't
10557 	 * find a good interface, create the ipif anyway so that in.mpathd can
10558 	 * move it to the first repaired interface.
10559 	 */
10560 	if ((ill->ill_phyint->phyint_flags &
10561 	    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10562 	    ill->ill_phyint->phyint_groupname_len != 0) {
10563 		phyint_t *phyi;
10564 		char *groupname = ill->ill_phyint->phyint_groupname;
10565 
10566 		/*
10567 		 * We're looking for a working interface, but it doesn't matter
10568 		 * if it's up or down; so instead of following the group lists,
10569 		 * we look at each physical interface and compare the groupname.
10570 		 * We're only interested in interfaces with IPv4 (resp. IPv6)
10571 		 * plumbed when we're adding an IPv4 (resp. IPv6) ipif.
10572 		 * Otherwise we create the ipif on the failed interface.
10573 		 */
10574 		rw_enter(&ill_g_lock, RW_READER);
10575 		phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
10576 		for (; phyi != NULL;
10577 		    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
10578 		    phyi, AVL_AFTER)) {
10579 			if (phyi->phyint_groupname_len == 0)
10580 				continue;
10581 			ASSERT(phyi->phyint_groupname != NULL);
10582 			if (mi_strcmp(groupname, phyi->phyint_groupname) == 0 &&
10583 			    !(phyi->phyint_flags &
10584 			    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
10585 			    (ill->ill_isv6 ? (phyi->phyint_illv6 != NULL) :
10586 			    (phyi->phyint_illv4 != NULL))) {
10587 				break;
10588 			}
10589 		}
10590 		rw_exit(&ill_g_lock);
10591 
10592 		if (phyi != NULL) {
10593 			orig_ifindex = ill->ill_phyint->phyint_ifindex;
10594 			ill = (ill->ill_isv6 ? phyi->phyint_illv6 :
10595 			    phyi->phyint_illv4);
10596 		}
10597 	}
10598 
10599 	/*
10600 	 * We are now exclusive on the ipsq, so an ill move will be serialized
10601 	 * before or after us.
10602 	 */
10603 	ASSERT(IAM_WRITER_ILL(ill));
10604 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10605 
10606 	if (found_sep && orig_ifindex == 0) {
10607 		/* Now see if there is an IPIF with this unit number. */
10608 		for (ipif = ill->ill_ipif; ipif != NULL;
10609 		    ipif = ipif->ipif_next) {
10610 			if (ipif->ipif_id == id) {
10611 				err = EEXIST;
10612 				goto done;
10613 			}
10614 		}
10615 	}
10616 
10617 	/*
10618 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
10619 	 * of lo0. We never come here when we plumb lo0:0. It
10620 	 * happens in ipif_lookup_on_name.
10621 	 * The specified unit number is ignored when we create the ipif on a
10622 	 * different interface. However, we save it in ipif_orig_ipifid below so
10623 	 * that the ipif fails back to the right position.
10624 	 */
10625 	if ((ipif = ipif_allocate(ill, (found_sep && orig_ifindex == 0) ?
10626 	    id : -1, IRE_LOCAL, B_TRUE)) == NULL) {
10627 		err = ENOBUFS;
10628 		goto done;
10629 	}
10630 
10631 	/* Return created name with ioctl */
10632 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
10633 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
10634 	ip1dbg(("created %s\n", lifr->lifr_name));
10635 
10636 	/* Set address */
10637 	sin = (sin_t *)&lifr->lifr_addr;
10638 	if (sin->sin_family != AF_UNSPEC) {
10639 		err = ip_sioctl_addr(ipif, sin, q, mp,
10640 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
10641 	}
10642 
10643 	/* Set ifindex and unit number for failback */
10644 	if (err == 0 && orig_ifindex != 0) {
10645 		ipif->ipif_orig_ifindex = orig_ifindex;
10646 		if (found_sep) {
10647 			ipif->ipif_orig_ipifid = id;
10648 		}
10649 	}
10650 
10651 done:
10652 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
10653 	return (err);
10654 }
10655 
10656 /*
10657  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
10658  * interface) delete it based on the IP address (on this physical interface).
10659  * Otherwise delete it based on the ipif_id.
10660  * Also, special handling to allow a removeif of lo0.
10661  */
10662 /* ARGSUSED */
10663 int
10664 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10665     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10666 {
10667 	conn_t		*connp;
10668 	ill_t		*ill = ipif->ipif_ill;
10669 	boolean_t	 success;
10670 
10671 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
10672 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10673 	ASSERT(IAM_WRITER_IPIF(ipif));
10674 
10675 	connp = Q_TO_CONN(q);
10676 	/*
10677 	 * Special case for unplumbing lo0 (the loopback physical interface).
10678 	 * If unplumbing lo0, the incoming address structure has been
10679 	 * initialized to all zeros. When unplumbing lo0, all its logical
10680 	 * interfaces must be removed too.
10681 	 *
10682 	 * Note that this interface may be called to remove a specific
10683 	 * loopback logical interface (eg, lo0:1). But in that case
10684 	 * ipif->ipif_id != 0 so that the code path for that case is the
10685 	 * same as any other interface (meaning it skips the code directly
10686 	 * below).
10687 	 */
10688 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10689 		if (sin->sin_family == AF_UNSPEC &&
10690 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
10691 			/*
10692 			 * Mark it condemned. No new ref. will be made to ill.
10693 			 */
10694 			mutex_enter(&ill->ill_lock);
10695 			ill->ill_state_flags |= ILL_CONDEMNED;
10696 			for (ipif = ill->ill_ipif; ipif != NULL;
10697 			    ipif = ipif->ipif_next) {
10698 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
10699 			}
10700 			mutex_exit(&ill->ill_lock);
10701 
10702 			ipif = ill->ill_ipif;
10703 			/* unplumb the loopback interface */
10704 			ill_delete(ill);
10705 			mutex_enter(&connp->conn_lock);
10706 			mutex_enter(&ill->ill_lock);
10707 			ASSERT(ill->ill_group == NULL);
10708 
10709 			/* Are any references to this ill active */
10710 			if (ill_is_quiescent(ill)) {
10711 				mutex_exit(&ill->ill_lock);
10712 				mutex_exit(&connp->conn_lock);
10713 				ill_delete_tail(ill);
10714 				mi_free(ill);
10715 				return (0);
10716 			}
10717 			success = ipsq_pending_mp_add(connp, ipif,
10718 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
10719 			mutex_exit(&connp->conn_lock);
10720 			mutex_exit(&ill->ill_lock);
10721 			if (success)
10722 				return (EINPROGRESS);
10723 			else
10724 				return (EINTR);
10725 		}
10726 	}
10727 
10728 	/*
10729 	 * We are exclusive on the ipsq, so an ill move will be serialized
10730 	 * before or after us.
10731 	 */
10732 	ASSERT(ill->ill_move_in_progress == B_FALSE);
10733 
10734 	if (ipif->ipif_id == 0) {
10735 		/* Find based on address */
10736 		if (ipif->ipif_isv6) {
10737 			sin6_t *sin6;
10738 
10739 			if (sin->sin_family != AF_INET6)
10740 				return (EAFNOSUPPORT);
10741 
10742 			sin6 = (sin6_t *)sin;
10743 			/* We are a writer, so we should be able to lookup */
10744 			ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10745 			    ill, ALL_ZONES, NULL, NULL, NULL, NULL);
10746 			if (ipif == NULL) {
10747 				/*
10748 				 * Maybe the address in on another interface in
10749 				 * the same IPMP group? We check this below.
10750 				 */
10751 				ipif = ipif_lookup_addr_v6(&sin6->sin6_addr,
10752 				    NULL, ALL_ZONES, NULL, NULL, NULL, NULL);
10753 			}
10754 		} else {
10755 			ipaddr_t addr;
10756 
10757 			if (sin->sin_family != AF_INET)
10758 				return (EAFNOSUPPORT);
10759 
10760 			addr = sin->sin_addr.s_addr;
10761 			/* We are a writer, so we should be able to lookup */
10762 			ipif = ipif_lookup_addr(addr, ill, ALL_ZONES, NULL,
10763 			    NULL, NULL, NULL);
10764 			if (ipif == NULL) {
10765 				/*
10766 				 * Maybe the address in on another interface in
10767 				 * the same IPMP group? We check this below.
10768 				 */
10769 				ipif = ipif_lookup_addr(addr, NULL, ALL_ZONES,
10770 				    NULL, NULL, NULL, NULL);
10771 			}
10772 		}
10773 		if (ipif == NULL) {
10774 			return (EADDRNOTAVAIL);
10775 		}
10776 		/*
10777 		 * When the address to be removed is hosted on a different
10778 		 * interface, we check if the interface is in the same IPMP
10779 		 * group as the specified one; if so we proceed with the
10780 		 * removal.
10781 		 * ill->ill_group is NULL when the ill is down, so we have to
10782 		 * compare the group names instead.
10783 		 */
10784 		if (ipif->ipif_ill != ill &&
10785 		    (ipif->ipif_ill->ill_phyint->phyint_groupname_len == 0 ||
10786 		    ill->ill_phyint->phyint_groupname_len == 0 ||
10787 		    mi_strcmp(ipif->ipif_ill->ill_phyint->phyint_groupname,
10788 		    ill->ill_phyint->phyint_groupname) != 0)) {
10789 			ipif_refrele(ipif);
10790 			return (EADDRNOTAVAIL);
10791 		}
10792 
10793 		/* This is a writer */
10794 		ipif_refrele(ipif);
10795 	}
10796 
10797 	/*
10798 	 * Can not delete instance zero since it is tied to the ill.
10799 	 */
10800 	if (ipif->ipif_id == 0)
10801 		return (EBUSY);
10802 
10803 	mutex_enter(&ill->ill_lock);
10804 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
10805 	mutex_exit(&ill->ill_lock);
10806 
10807 	ipif_free(ipif);
10808 
10809 	mutex_enter(&connp->conn_lock);
10810 	mutex_enter(&ill->ill_lock);
10811 
10812 	/* Are any references to this ipif active */
10813 	if (ipif->ipif_refcnt == 0 && ipif->ipif_ire_cnt == 0) {
10814 		mutex_exit(&ill->ill_lock);
10815 		mutex_exit(&connp->conn_lock);
10816 		ipif_non_duplicate(ipif);
10817 		ipif_down_tail(ipif);
10818 		ipif_free_tail(ipif);
10819 		return (0);
10820 	}
10821 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
10822 	    IPIF_FREE);
10823 	mutex_exit(&ill->ill_lock);
10824 	mutex_exit(&connp->conn_lock);
10825 	if (success)
10826 		return (EINPROGRESS);
10827 	else
10828 		return (EINTR);
10829 }
10830 
10831 /*
10832  * Restart the removeif ioctl. The refcnt has gone down to 0.
10833  * The ipif is already condemned. So can't find it thru lookups.
10834  */
10835 /* ARGSUSED */
10836 int
10837 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
10838     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
10839 {
10840 	ill_t *ill;
10841 
10842 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
10843 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10844 	if (ipif->ipif_id == 0 && ipif->ipif_net_type == IRE_LOOPBACK) {
10845 		ill = ipif->ipif_ill;
10846 		ASSERT(IAM_WRITER_ILL(ill));
10847 		ASSERT((ipif->ipif_state_flags & IPIF_CONDEMNED) &&
10848 		    (ill->ill_state_flags & IPIF_CONDEMNED));
10849 		ill_delete_tail(ill);
10850 		mi_free(ill);
10851 		return (0);
10852 	}
10853 
10854 	ill = ipif->ipif_ill;
10855 	ASSERT(IAM_WRITER_IPIF(ipif));
10856 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
10857 
10858 	ipif_non_duplicate(ipif);
10859 	ipif_down_tail(ipif);
10860 	ipif_free_tail(ipif);
10861 
10862 	ILL_UNMARK_CHANGING(ill);
10863 	return (0);
10864 }
10865 
10866 /*
10867  * Set the local interface address.
10868  * Allow an address of all zero when the interface is down.
10869  */
10870 /* ARGSUSED */
10871 int
10872 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10873     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
10874 {
10875 	int err = 0;
10876 	in6_addr_t v6addr;
10877 	boolean_t need_up = B_FALSE;
10878 
10879 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
10880 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10881 
10882 	ASSERT(IAM_WRITER_IPIF(ipif));
10883 
10884 	if (ipif->ipif_isv6) {
10885 		sin6_t *sin6;
10886 		ill_t *ill;
10887 		phyint_t *phyi;
10888 
10889 		if (sin->sin_family != AF_INET6)
10890 			return (EAFNOSUPPORT);
10891 
10892 		sin6 = (sin6_t *)sin;
10893 		v6addr = sin6->sin6_addr;
10894 		ill = ipif->ipif_ill;
10895 		phyi = ill->ill_phyint;
10896 
10897 		/*
10898 		 * Enforce that true multicast interfaces have a link-local
10899 		 * address for logical unit 0.
10900 		 */
10901 		if (ipif->ipif_id == 0 &&
10902 		    (ill->ill_flags & ILLF_MULTICAST) &&
10903 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
10904 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
10905 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
10906 			return (EADDRNOTAVAIL);
10907 		}
10908 
10909 		/*
10910 		 * up interfaces shouldn't have the unspecified address
10911 		 * unless they also have the IPIF_NOLOCAL flags set and
10912 		 * have a subnet assigned.
10913 		 */
10914 		if ((ipif->ipif_flags & IPIF_UP) &&
10915 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
10916 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
10917 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
10918 			return (EADDRNOTAVAIL);
10919 		}
10920 
10921 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10922 			return (EADDRNOTAVAIL);
10923 	} else {
10924 		ipaddr_t addr;
10925 
10926 		if (sin->sin_family != AF_INET)
10927 			return (EAFNOSUPPORT);
10928 
10929 		addr = sin->sin_addr.s_addr;
10930 
10931 		/* Allow 0 as the local address. */
10932 		if (addr != 0 && !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
10933 			return (EADDRNOTAVAIL);
10934 
10935 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10936 	}
10937 
10938 
10939 	/*
10940 	 * Even if there is no change we redo things just to rerun
10941 	 * ipif_set_default.
10942 	 */
10943 	if (ipif->ipif_flags & IPIF_UP) {
10944 		/*
10945 		 * Setting a new local address, make sure
10946 		 * we have net and subnet bcast ire's for
10947 		 * the old address if we need them.
10948 		 */
10949 		if (!ipif->ipif_isv6)
10950 			ipif_check_bcast_ires(ipif);
10951 		/*
10952 		 * If the interface is already marked up,
10953 		 * we call ipif_down which will take care
10954 		 * of ditching any IREs that have been set
10955 		 * up based on the old interface address.
10956 		 */
10957 		err = ipif_logical_down(ipif, q, mp);
10958 		if (err == EINPROGRESS)
10959 			return (err);
10960 		ipif_down_tail(ipif);
10961 		need_up = 1;
10962 	}
10963 
10964 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
10965 	return (err);
10966 }
10967 
10968 int
10969 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10970     boolean_t need_up)
10971 {
10972 	in6_addr_t v6addr;
10973 	ipaddr_t addr;
10974 	sin6_t	*sin6;
10975 	int	sinlen;
10976 	int	err = 0;
10977 	ill_t	*ill = ipif->ipif_ill;
10978 	boolean_t need_dl_down;
10979 	boolean_t need_arp_down;
10980 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
10981 
10982 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
10983 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
10984 	ASSERT(IAM_WRITER_IPIF(ipif));
10985 
10986 	/* Must cancel any pending timer before taking the ill_lock */
10987 	if (ipif->ipif_recovery_id != 0)
10988 		(void) untimeout(ipif->ipif_recovery_id);
10989 	ipif->ipif_recovery_id = 0;
10990 
10991 	if (ipif->ipif_isv6) {
10992 		sin6 = (sin6_t *)sin;
10993 		v6addr = sin6->sin6_addr;
10994 		sinlen = sizeof (struct sockaddr_in6);
10995 	} else {
10996 		addr = sin->sin_addr.s_addr;
10997 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10998 		sinlen = sizeof (struct sockaddr_in);
10999 	}
11000 	mutex_enter(&ill->ill_lock);
11001 	ipif->ipif_v6lcl_addr = v6addr;
11002 	if (ipif->ipif_flags & (IPIF_ANYCAST | IPIF_NOLOCAL)) {
11003 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11004 	} else {
11005 		ipif->ipif_v6src_addr = v6addr;
11006 	}
11007 	ipif->ipif_addr_ready = 0;
11008 
11009 	/*
11010 	 * If the interface was previously marked as a duplicate, then since
11011 	 * we've now got a "new" address, it should no longer be considered a
11012 	 * duplicate -- even if the "new" address is the same as the old one.
11013 	 * Note that if all ipifs are down, we may have a pending ARP down
11014 	 * event to handle.  This is because we want to recover from duplicates
11015 	 * and thus delay tearing down ARP until the duplicates have been
11016 	 * removed or disabled.
11017 	 */
11018 	need_dl_down = need_arp_down = B_FALSE;
11019 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11020 		need_arp_down = !need_up;
11021 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11022 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11023 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11024 			need_dl_down = B_TRUE;
11025 		}
11026 	}
11027 
11028 	if (ipif->ipif_isv6 && IN6_IS_ADDR_6TO4(&v6addr) &&
11029 	    !ill->ill_is_6to4tun) {
11030 		queue_t *wqp = ill->ill_wq;
11031 
11032 		/*
11033 		 * The local address of this interface is a 6to4 address,
11034 		 * check if this interface is in fact a 6to4 tunnel or just
11035 		 * an interface configured with a 6to4 address.  We are only
11036 		 * interested in the former.
11037 		 */
11038 		if (wqp != NULL) {
11039 			while ((wqp->q_next != NULL) &&
11040 			    (wqp->q_next->q_qinfo != NULL) &&
11041 			    (wqp->q_next->q_qinfo->qi_minfo != NULL)) {
11042 
11043 				if (wqp->q_next->q_qinfo->qi_minfo->mi_idnum
11044 				    == TUN6TO4_MODID) {
11045 					/* set for use in IP */
11046 					ill->ill_is_6to4tun = 1;
11047 					break;
11048 				}
11049 				wqp = wqp->q_next;
11050 			}
11051 		}
11052 	}
11053 
11054 	ipif_set_default(ipif);
11055 
11056 	/*
11057 	 * When publishing an interface address change event, we only notify
11058 	 * the event listeners of the new address.  It is assumed that if they
11059 	 * actively care about the addresses assigned that they will have
11060 	 * already discovered the previous address assigned (if there was one.)
11061 	 *
11062 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
11063 	 */
11064 	if (iocp->ioc_cmd != SIOCLIFADDIF) {
11065 		hook_nic_event_t *info;
11066 		if ((info = ipif->ipif_ill->ill_nic_event_info) != NULL) {
11067 			ip2dbg(("ip_sioctl_addr_tail: unexpected nic event %d "
11068 			    "attached for %s\n", info->hne_event,
11069 			    ill->ill_name));
11070 			if (info->hne_data != NULL)
11071 				kmem_free(info->hne_data, info->hne_datalen);
11072 			kmem_free(info, sizeof (hook_nic_event_t));
11073 		}
11074 
11075 		info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP);
11076 		if (info != NULL) {
11077 			info->hne_nic =
11078 			    ipif->ipif_ill->ill_phyint->phyint_ifindex;
11079 			info->hne_lif = MAP_IPIF_ID(ipif->ipif_id);
11080 			info->hne_event = NE_ADDRESS_CHANGE;
11081 			info->hne_family = ipif->ipif_isv6 ? ipv6 : ipv4;
11082 			info->hne_data = kmem_alloc(sinlen, KM_NOSLEEP);
11083 			if (info->hne_data != NULL) {
11084 				info->hne_datalen = sinlen;
11085 				bcopy(sin, info->hne_data, sinlen);
11086 			} else {
11087 				ip2dbg(("ip_sioctl_addr_tail: could not attach "
11088 				    "address information for ADDRESS_CHANGE nic"
11089 				    " event of %s (ENOMEM)\n",
11090 				    ipif->ipif_ill->ill_name));
11091 				kmem_free(info, sizeof (hook_nic_event_t));
11092 			}
11093 		} else
11094 			ip2dbg(("ip_sioctl_addr_tail: could not attach "
11095 			    "ADDRESS_CHANGE nic event information for %s "
11096 			    "(ENOMEM)\n", ipif->ipif_ill->ill_name));
11097 
11098 		ipif->ipif_ill->ill_nic_event_info = info;
11099 	}
11100 
11101 	mutex_exit(&ipif->ipif_ill->ill_lock);
11102 
11103 	if (need_up) {
11104 		/*
11105 		 * Now bring the interface back up.  If this
11106 		 * is the only IPIF for the ILL, ipif_up
11107 		 * will have to re-bind to the device, so
11108 		 * we may get back EINPROGRESS, in which
11109 		 * case, this IOCTL will get completed in
11110 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11111 		 */
11112 		err = ipif_up(ipif, q, mp);
11113 	} else {
11114 		/*
11115 		 * Update the IPIF list in SCTP, ipif_up_done() will do it
11116 		 * if need_up is true.
11117 		 */
11118 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
11119 	}
11120 
11121 	if (need_dl_down)
11122 		ill_dl_down(ill);
11123 	if (need_arp_down)
11124 		ipif_arp_down(ipif);
11125 
11126 	return (err);
11127 }
11128 
11129 
11130 /*
11131  * Restart entry point to restart the address set operation after the
11132  * refcounts have dropped to zero.
11133  */
11134 /* ARGSUSED */
11135 int
11136 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11137     ip_ioctl_cmd_t *ipip, void *ifreq)
11138 {
11139 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
11140 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11141 	ASSERT(IAM_WRITER_IPIF(ipif));
11142 	ipif_down_tail(ipif);
11143 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
11144 }
11145 
11146 /* ARGSUSED */
11147 int
11148 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11149     ip_ioctl_cmd_t *ipip, void *if_req)
11150 {
11151 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
11152 	struct lifreq *lifr = (struct lifreq *)if_req;
11153 
11154 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
11155 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11156 	/*
11157 	 * The net mask and address can't change since we have a
11158 	 * reference to the ipif. So no lock is necessary.
11159 	 */
11160 	if (ipif->ipif_isv6) {
11161 		*sin6 = sin6_null;
11162 		sin6->sin6_family = AF_INET6;
11163 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
11164 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11165 		lifr->lifr_addrlen =
11166 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11167 	} else {
11168 		*sin = sin_null;
11169 		sin->sin_family = AF_INET;
11170 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
11171 		if (ipip->ipi_cmd_type == LIF_CMD) {
11172 			lifr->lifr_addrlen =
11173 			    ip_mask_to_plen(ipif->ipif_net_mask);
11174 		}
11175 	}
11176 	return (0);
11177 }
11178 
11179 /*
11180  * Set the destination address for a pt-pt interface.
11181  */
11182 /* ARGSUSED */
11183 int
11184 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11185     ip_ioctl_cmd_t *ipip, void *if_req)
11186 {
11187 	int err = 0;
11188 	in6_addr_t v6addr;
11189 	boolean_t need_up = B_FALSE;
11190 
11191 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
11192 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11193 	ASSERT(IAM_WRITER_IPIF(ipif));
11194 
11195 	if (ipif->ipif_isv6) {
11196 		sin6_t *sin6;
11197 
11198 		if (sin->sin_family != AF_INET6)
11199 			return (EAFNOSUPPORT);
11200 
11201 		sin6 = (sin6_t *)sin;
11202 		v6addr = sin6->sin6_addr;
11203 
11204 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
11205 			return (EADDRNOTAVAIL);
11206 	} else {
11207 		ipaddr_t addr;
11208 
11209 		if (sin->sin_family != AF_INET)
11210 			return (EAFNOSUPPORT);
11211 
11212 		addr = sin->sin_addr.s_addr;
11213 		if (!ip_addr_ok_v4(addr, ipif->ipif_net_mask))
11214 			return (EADDRNOTAVAIL);
11215 
11216 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11217 	}
11218 
11219 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
11220 		return (0);	/* No change */
11221 
11222 	if (ipif->ipif_flags & IPIF_UP) {
11223 		/*
11224 		 * If the interface is already marked up,
11225 		 * we call ipif_down which will take care
11226 		 * of ditching any IREs that have been set
11227 		 * up based on the old pp dst address.
11228 		 */
11229 		err = ipif_logical_down(ipif, q, mp);
11230 		if (err == EINPROGRESS)
11231 			return (err);
11232 		ipif_down_tail(ipif);
11233 		need_up = B_TRUE;
11234 	}
11235 	/*
11236 	 * could return EINPROGRESS. If so ioctl will complete in
11237 	 * ip_rput_dlpi_writer
11238 	 */
11239 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
11240 	return (err);
11241 }
11242 
11243 static int
11244 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11245     boolean_t need_up)
11246 {
11247 	in6_addr_t v6addr;
11248 	ill_t	*ill = ipif->ipif_ill;
11249 	int	err = 0;
11250 	boolean_t need_dl_down;
11251 	boolean_t need_arp_down;
11252 
11253 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
11254 	    ipif->ipif_id, (void *)ipif));
11255 
11256 	/* Must cancel any pending timer before taking the ill_lock */
11257 	if (ipif->ipif_recovery_id != 0)
11258 		(void) untimeout(ipif->ipif_recovery_id);
11259 	ipif->ipif_recovery_id = 0;
11260 
11261 	if (ipif->ipif_isv6) {
11262 		sin6_t *sin6;
11263 
11264 		sin6 = (sin6_t *)sin;
11265 		v6addr = sin6->sin6_addr;
11266 	} else {
11267 		ipaddr_t addr;
11268 
11269 		addr = sin->sin_addr.s_addr;
11270 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11271 	}
11272 	mutex_enter(&ill->ill_lock);
11273 	/* Set point to point destination address. */
11274 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11275 		/*
11276 		 * Allow this as a means of creating logical
11277 		 * pt-pt interfaces on top of e.g. an Ethernet.
11278 		 * XXX Undocumented HACK for testing.
11279 		 * pt-pt interfaces are created with NUD disabled.
11280 		 */
11281 		ipif->ipif_flags |= IPIF_POINTOPOINT;
11282 		ipif->ipif_flags &= ~IPIF_BROADCAST;
11283 		if (ipif->ipif_isv6)
11284 			ill->ill_flags |= ILLF_NONUD;
11285 	}
11286 
11287 	/*
11288 	 * If the interface was previously marked as a duplicate, then since
11289 	 * we've now got a "new" address, it should no longer be considered a
11290 	 * duplicate -- even if the "new" address is the same as the old one.
11291 	 * Note that if all ipifs are down, we may have a pending ARP down
11292 	 * event to handle.
11293 	 */
11294 	need_dl_down = need_arp_down = B_FALSE;
11295 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
11296 		need_arp_down = !need_up;
11297 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
11298 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
11299 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
11300 			need_dl_down = B_TRUE;
11301 		}
11302 	}
11303 
11304 	/* Set the new address. */
11305 	ipif->ipif_v6pp_dst_addr = v6addr;
11306 	/* Make sure subnet tracks pp_dst */
11307 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
11308 	mutex_exit(&ill->ill_lock);
11309 
11310 	if (need_up) {
11311 		/*
11312 		 * Now bring the interface back up.  If this
11313 		 * is the only IPIF for the ILL, ipif_up
11314 		 * will have to re-bind to the device, so
11315 		 * we may get back EINPROGRESS, in which
11316 		 * case, this IOCTL will get completed in
11317 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11318 		 */
11319 		err = ipif_up(ipif, q, mp);
11320 	}
11321 
11322 	if (need_dl_down)
11323 		ill_dl_down(ill);
11324 
11325 	if (need_arp_down)
11326 		ipif_arp_down(ipif);
11327 	return (err);
11328 }
11329 
11330 /*
11331  * Restart entry point to restart the dstaddress set operation after the
11332  * refcounts have dropped to zero.
11333  */
11334 /* ARGSUSED */
11335 int
11336 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11337     ip_ioctl_cmd_t *ipip, void *ifreq)
11338 {
11339 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
11340 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11341 	ipif_down_tail(ipif);
11342 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
11343 }
11344 
11345 /* ARGSUSED */
11346 int
11347 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11348     ip_ioctl_cmd_t *ipip, void *if_req)
11349 {
11350 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
11351 
11352 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
11353 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11354 	/*
11355 	 * Get point to point destination address. The addresses can't
11356 	 * change since we hold a reference to the ipif.
11357 	 */
11358 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
11359 		return (EADDRNOTAVAIL);
11360 
11361 	if (ipif->ipif_isv6) {
11362 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11363 		*sin6 = sin6_null;
11364 		sin6->sin6_family = AF_INET6;
11365 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
11366 	} else {
11367 		*sin = sin_null;
11368 		sin->sin_family = AF_INET;
11369 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
11370 	}
11371 	return (0);
11372 }
11373 
11374 /*
11375  * part of ipmp, make this func return the active/inactive state and
11376  * caller can set once atomically instead of multiple mutex_enter/mutex_exit
11377  */
11378 /*
11379  * This function either sets or clears the IFF_INACTIVE flag.
11380  *
11381  * As long as there are some addresses or multicast memberships on the
11382  * IPv4 or IPv6 interface of the "phyi" that does not belong in here, we
11383  * will consider it to be ACTIVE (clear IFF_INACTIVE) i.e the interface
11384  * will be used for outbound packets.
11385  *
11386  * Caller needs to verify the validity of setting IFF_INACTIVE.
11387  */
11388 static void
11389 phyint_inactive(phyint_t *phyi)
11390 {
11391 	ill_t *ill_v4;
11392 	ill_t *ill_v6;
11393 	ipif_t *ipif;
11394 	ilm_t *ilm;
11395 
11396 	ill_v4 = phyi->phyint_illv4;
11397 	ill_v6 = phyi->phyint_illv6;
11398 
11399 	/*
11400 	 * No need for a lock while traversing the list since iam
11401 	 * a writer
11402 	 */
11403 	if (ill_v4 != NULL) {
11404 		ASSERT(IAM_WRITER_ILL(ill_v4));
11405 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
11406 		    ipif = ipif->ipif_next) {
11407 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
11408 				mutex_enter(&phyi->phyint_lock);
11409 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11410 				mutex_exit(&phyi->phyint_lock);
11411 				return;
11412 			}
11413 		}
11414 		for (ilm = ill_v4->ill_ilm; ilm != NULL;
11415 		    ilm = ilm->ilm_next) {
11416 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
11417 				mutex_enter(&phyi->phyint_lock);
11418 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11419 				mutex_exit(&phyi->phyint_lock);
11420 				return;
11421 			}
11422 		}
11423 	}
11424 	if (ill_v6 != NULL) {
11425 		ill_v6 = phyi->phyint_illv6;
11426 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
11427 		    ipif = ipif->ipif_next) {
11428 			if (ipif->ipif_orig_ifindex != phyi->phyint_ifindex) {
11429 				mutex_enter(&phyi->phyint_lock);
11430 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11431 				mutex_exit(&phyi->phyint_lock);
11432 				return;
11433 			}
11434 		}
11435 		for (ilm = ill_v6->ill_ilm; ilm != NULL;
11436 		    ilm = ilm->ilm_next) {
11437 			if (ilm->ilm_orig_ifindex != phyi->phyint_ifindex) {
11438 				mutex_enter(&phyi->phyint_lock);
11439 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11440 				mutex_exit(&phyi->phyint_lock);
11441 				return;
11442 			}
11443 		}
11444 	}
11445 	mutex_enter(&phyi->phyint_lock);
11446 	phyi->phyint_flags |= PHYI_INACTIVE;
11447 	mutex_exit(&phyi->phyint_lock);
11448 }
11449 
11450 /*
11451  * This function is called only when the phyint flags change. Currently
11452  * called from ip_sioctl_flags. We re-do the broadcast nomination so
11453  * that we can select a good ill.
11454  */
11455 static void
11456 ip_redo_nomination(phyint_t *phyi)
11457 {
11458 	ill_t *ill_v4;
11459 
11460 	ill_v4 = phyi->phyint_illv4;
11461 
11462 	if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
11463 		ASSERT(IAM_WRITER_ILL(ill_v4));
11464 		if (ill_v4->ill_group->illgrp_ill_count > 1)
11465 			ill_nominate_bcast_rcv(ill_v4->ill_group);
11466 	}
11467 }
11468 
11469 /*
11470  * Heuristic to check if ill is INACTIVE.
11471  * Checks if ill has an ipif with an usable ip address.
11472  *
11473  * Return values:
11474  *	B_TRUE	- ill is INACTIVE; has no usable ipif
11475  *	B_FALSE - ill is not INACTIVE; ill has at least one usable ipif
11476  */
11477 static boolean_t
11478 ill_is_inactive(ill_t *ill)
11479 {
11480 	ipif_t *ipif;
11481 
11482 	/* Check whether it is in an IPMP group */
11483 	if (ill->ill_phyint->phyint_groupname == NULL)
11484 		return (B_FALSE);
11485 
11486 	if (ill->ill_ipif_up_count == 0)
11487 		return (B_TRUE);
11488 
11489 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
11490 		uint64_t flags = ipif->ipif_flags;
11491 
11492 		/*
11493 		 * This ipif is usable if it is IPIF_UP and not a
11494 		 * dedicated test address.  A dedicated test address
11495 		 * is marked IPIF_NOFAILOVER *and* IPIF_DEPRECATED
11496 		 * (note in particular that V6 test addresses are
11497 		 * link-local data addresses and thus are marked
11498 		 * IPIF_NOFAILOVER but not IPIF_DEPRECATED).
11499 		 */
11500 		if ((flags & IPIF_UP) &&
11501 		    ((flags & (IPIF_DEPRECATED|IPIF_NOFAILOVER)) !=
11502 		    (IPIF_DEPRECATED|IPIF_NOFAILOVER)))
11503 			return (B_FALSE);
11504 	}
11505 	return (B_TRUE);
11506 }
11507 
11508 /*
11509  * Set interface flags.
11510  * Need to do special action for IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT,
11511  * IPIF_NOLOCAL, ILLF_NONUD, ILLF_NOARP, IPIF_PRIVATE, IPIF_ANYCAST,
11512  * IPIF_PREFERRED, PHYI_STANDBY, PHYI_FAILED and PHYI_OFFLINE.
11513  *
11514  * NOTE : We really don't enforce that ipif_id zero should be used
11515  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
11516  *	  is because applications generally does SICGLIFFLAGS and
11517  *	  ORs in the new flags (that affects the logical) and does a
11518  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
11519  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
11520  *	  flags that will be turned on is correct with respect to
11521  *	  ipif_id 0. For backward compatibility reasons, it is not done.
11522  */
11523 /* ARGSUSED */
11524 int
11525 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11526     ip_ioctl_cmd_t *ipip, void *if_req)
11527 {
11528 	uint64_t turn_on;
11529 	uint64_t turn_off;
11530 	int	err;
11531 	boolean_t need_up = B_FALSE;
11532 	phyint_t *phyi;
11533 	ill_t *ill;
11534 	uint64_t intf_flags;
11535 	boolean_t phyint_flags_modified = B_FALSE;
11536 	uint64_t flags;
11537 	struct ifreq *ifr;
11538 	struct lifreq *lifr;
11539 	boolean_t set_linklocal = B_FALSE;
11540 	boolean_t zero_source = B_FALSE;
11541 
11542 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
11543 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11544 
11545 	ASSERT(IAM_WRITER_IPIF(ipif));
11546 
11547 	ill = ipif->ipif_ill;
11548 	phyi = ill->ill_phyint;
11549 
11550 	if (ipip->ipi_cmd_type == IF_CMD) {
11551 		ifr = (struct ifreq *)if_req;
11552 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
11553 	} else {
11554 		lifr = (struct lifreq *)if_req;
11555 		flags = lifr->lifr_flags;
11556 	}
11557 
11558 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11559 
11560 	/*
11561 	 * Has the flags been set correctly till now ?
11562 	 */
11563 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
11564 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
11565 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
11566 	/*
11567 	 * Compare the new flags to the old, and partition
11568 	 * into those coming on and those going off.
11569 	 * For the 16 bit command keep the bits above bit 16 unchanged.
11570 	 */
11571 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
11572 		flags |= intf_flags & ~0xFFFF;
11573 
11574 	/*
11575 	 * First check which bits will change and then which will
11576 	 * go on and off
11577 	 */
11578 	turn_on = (flags ^ intf_flags) & ~IFF_CANTCHANGE;
11579 	if (!turn_on)
11580 		return (0);	/* No change */
11581 
11582 	turn_off = intf_flags & turn_on;
11583 	turn_on ^= turn_off;
11584 	err = 0;
11585 
11586 	/*
11587 	 * Don't allow any bits belonging to the logical interface
11588 	 * to be set or cleared on the replacement ipif that was
11589 	 * created temporarily during a MOVE.
11590 	 */
11591 	if (ipif->ipif_replace_zero &&
11592 	    ((turn_on|turn_off) & IFF_LOGINT_FLAGS) != 0) {
11593 		return (EINVAL);
11594 	}
11595 
11596 	/*
11597 	 * Only allow the IFF_XRESOLV and IFF_TEMPORARY flags to be set on
11598 	 * IPv6 interfaces.
11599 	 */
11600 	if ((turn_on & (IFF_XRESOLV|IFF_TEMPORARY)) && !(ipif->ipif_isv6))
11601 		return (EINVAL);
11602 
11603 	/*
11604 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
11605 	 * interfaces.  It makes no sense in that context.
11606 	 */
11607 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
11608 		return (EINVAL);
11609 
11610 	if (flags & (IFF_NOLOCAL|IFF_ANYCAST))
11611 		zero_source = B_TRUE;
11612 
11613 	/*
11614 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
11615 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
11616 	 * If the link local address isn't set, and can be set, it will get
11617 	 * set later on in this function.
11618 	 */
11619 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
11620 	    (flags & IFF_UP) && !zero_source &&
11621 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
11622 		if (ipif_cant_setlinklocal(ipif))
11623 			return (EINVAL);
11624 		set_linklocal = B_TRUE;
11625 	}
11626 
11627 	/*
11628 	 * ILL cannot be part of a usesrc group and and IPMP group at the
11629 	 * same time. No need to grab ill_g_usesrc_lock here, see
11630 	 * synchronization notes in ip.c
11631 	 */
11632 	if (turn_on & PHYI_STANDBY &&
11633 	    ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
11634 		return (EINVAL);
11635 	}
11636 
11637 	/*
11638 	 * If we modify physical interface flags, we'll potentially need to
11639 	 * send up two routing socket messages for the changes (one for the
11640 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
11641 	 */
11642 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
11643 		phyint_flags_modified = B_TRUE;
11644 
11645 	/*
11646 	 * If we are setting or clearing FAILED or STANDBY or OFFLINE,
11647 	 * we need to flush the IRE_CACHES belonging to this ill.
11648 	 * We handle this case here without doing the DOWN/UP dance
11649 	 * like it is done for other flags. If some other flags are
11650 	 * being turned on/off with FAILED/STANDBY/OFFLINE, the code
11651 	 * below will handle it by bringing it down and then
11652 	 * bringing it UP.
11653 	 */
11654 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)) {
11655 		ill_t *ill_v4, *ill_v6;
11656 
11657 		ill_v4 = phyi->phyint_illv4;
11658 		ill_v6 = phyi->phyint_illv6;
11659 
11660 		/*
11661 		 * First set the INACTIVE flag if needed. Then delete the ires.
11662 		 * ire_add will atomically prevent creating new IRE_CACHEs
11663 		 * unless hidden flag is set.
11664 		 * PHYI_FAILED and PHYI_INACTIVE are exclusive
11665 		 */
11666 		if ((turn_on & PHYI_FAILED) &&
11667 		    ((intf_flags & PHYI_STANDBY) || !ipmp_enable_failback)) {
11668 			/* Reset PHYI_INACTIVE when PHYI_FAILED is being set */
11669 			phyi->phyint_flags &= ~PHYI_INACTIVE;
11670 		}
11671 		if ((turn_off & PHYI_FAILED) &&
11672 		    ((intf_flags & PHYI_STANDBY) ||
11673 		    (!ipmp_enable_failback && ill_is_inactive(ill)))) {
11674 			phyint_inactive(phyi);
11675 		}
11676 
11677 		if (turn_on & PHYI_STANDBY) {
11678 			/*
11679 			 * We implicitly set INACTIVE only when STANDBY is set.
11680 			 * INACTIVE is also set on non-STANDBY phyint when user
11681 			 * disables FAILBACK using configuration file.
11682 			 * Do not allow STANDBY to be set on such INACTIVE
11683 			 * phyint
11684 			 */
11685 			if (phyi->phyint_flags & PHYI_INACTIVE)
11686 				return (EINVAL);
11687 			if (!(phyi->phyint_flags & PHYI_FAILED))
11688 				phyint_inactive(phyi);
11689 		}
11690 		if (turn_off & PHYI_STANDBY) {
11691 			if (ipmp_enable_failback) {
11692 				/*
11693 				 * Reset PHYI_INACTIVE.
11694 				 */
11695 				phyi->phyint_flags &= ~PHYI_INACTIVE;
11696 			} else if (ill_is_inactive(ill) &&
11697 			    !(phyi->phyint_flags & PHYI_FAILED)) {
11698 				/*
11699 				 * Need to set INACTIVE, when user sets
11700 				 * STANDBY on a non-STANDBY phyint and
11701 				 * later resets STANDBY
11702 				 */
11703 				phyint_inactive(phyi);
11704 			}
11705 		}
11706 		/*
11707 		 * We should always send up a message so that the
11708 		 * daemons come to know of it. Note that the zeroth
11709 		 * interface can be down and the check below for IPIF_UP
11710 		 * will not make sense as we are actually setting
11711 		 * a phyint flag here. We assume that the ipif used
11712 		 * is always the zeroth ipif. (ip_rts_ifmsg does not
11713 		 * send up any message for non-zero ipifs).
11714 		 */
11715 		phyint_flags_modified = B_TRUE;
11716 
11717 		if (ill_v4 != NULL) {
11718 			ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11719 			    IRE_CACHE, ill_stq_cache_delete,
11720 			    (char *)ill_v4, ill_v4);
11721 			illgrp_reset_schednext(ill_v4);
11722 		}
11723 		if (ill_v6 != NULL) {
11724 			ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
11725 			    IRE_CACHE, ill_stq_cache_delete,
11726 			    (char *)ill_v6, ill_v6);
11727 			illgrp_reset_schednext(ill_v6);
11728 		}
11729 	}
11730 
11731 	/*
11732 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
11733 	 * status of the interface and, if the interface is part of an IPMP
11734 	 * group, all other interfaces that are part of the same IPMP
11735 	 * group.
11736 	 */
11737 	if ((turn_on | turn_off) & ILLF_ROUTER) {
11738 		(void) ill_forward_set(q, mp, ((turn_on & ILLF_ROUTER) != 0),
11739 		    (caddr_t)ill);
11740 	}
11741 
11742 	/*
11743 	 * If the interface is not UP and we are not going to
11744 	 * bring it UP, record the flags and return. When the
11745 	 * interface comes UP later, the right actions will be
11746 	 * taken.
11747 	 */
11748 	if (!(ipif->ipif_flags & IPIF_UP) &&
11749 	    !(turn_on & IPIF_UP)) {
11750 		/* Record new flags in their respective places. */
11751 		mutex_enter(&ill->ill_lock);
11752 		mutex_enter(&ill->ill_phyint->phyint_lock);
11753 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11754 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11755 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11756 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11757 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11758 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11759 		mutex_exit(&ill->ill_lock);
11760 		mutex_exit(&ill->ill_phyint->phyint_lock);
11761 
11762 		/*
11763 		 * We do the broadcast and nomination here rather
11764 		 * than waiting for a FAILOVER/FAILBACK to happen. In
11765 		 * the case of FAILBACK from INACTIVE standby to the
11766 		 * interface that has been repaired, PHYI_FAILED has not
11767 		 * been cleared yet. If there are only two interfaces in
11768 		 * that group, all we have is a FAILED and INACTIVE
11769 		 * interface. If we do the nomination soon after a failback,
11770 		 * the broadcast nomination code would select the
11771 		 * INACTIVE interface for receiving broadcasts as FAILED is
11772 		 * not yet cleared. As we don't want STANDBY/INACTIVE to
11773 		 * receive broadcast packets, we need to redo nomination
11774 		 * when the FAILED is cleared here. Thus, in general we
11775 		 * always do the nomination here for FAILED, STANDBY
11776 		 * and OFFLINE.
11777 		 */
11778 		if (((turn_on | turn_off) &
11779 		    (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))) {
11780 			ip_redo_nomination(phyi);
11781 		}
11782 		if (phyint_flags_modified) {
11783 			if (phyi->phyint_illv4 != NULL) {
11784 				ip_rts_ifmsg(phyi->phyint_illv4->
11785 				    ill_ipif);
11786 			}
11787 			if (phyi->phyint_illv6 != NULL) {
11788 				ip_rts_ifmsg(phyi->phyint_illv6->
11789 				    ill_ipif);
11790 			}
11791 		}
11792 		return (0);
11793 	} else if (set_linklocal || zero_source) {
11794 		mutex_enter(&ill->ill_lock);
11795 		if (set_linklocal)
11796 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
11797 		if (zero_source)
11798 			ipif->ipif_state_flags |= IPIF_ZERO_SOURCE;
11799 		mutex_exit(&ill->ill_lock);
11800 	}
11801 
11802 	/*
11803 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
11804 	 * or point-to-point interfaces with an unspecified destination. We do
11805 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
11806 	 * have a subnet assigned, which is how in.ndpd currently manages its
11807 	 * onlink prefix list when no addresses are configured with those
11808 	 * prefixes.
11809 	 */
11810 	if (ipif->ipif_isv6 &&
11811 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
11812 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
11813 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
11814 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11815 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
11816 		return (EINVAL);
11817 	}
11818 
11819 	/*
11820 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
11821 	 * from being brought up.
11822 	 */
11823 	if (!ipif->ipif_isv6 &&
11824 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
11825 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
11826 		return (EINVAL);
11827 	}
11828 
11829 	/*
11830 	 * The only flag changes that we currently take specific action on
11831 	 * is IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL,
11832 	 * ILLF_NOARP, ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, and
11833 	 * IPIF_PREFERRED.  This is done by bring the ipif down, changing
11834 	 * the flags and bringing it back up again.
11835 	 */
11836 	if ((turn_on|turn_off) &
11837 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
11838 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED)) {
11839 		/*
11840 		 * Taking this ipif down, make sure we have
11841 		 * valid net and subnet bcast ire's for other
11842 		 * logical interfaces, if we need them.
11843 		 */
11844 		if (!ipif->ipif_isv6)
11845 			ipif_check_bcast_ires(ipif);
11846 
11847 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
11848 		    !(turn_off & IPIF_UP)) {
11849 			need_up = B_TRUE;
11850 			if (ipif->ipif_flags & IPIF_UP)
11851 				ill->ill_logical_down = 1;
11852 			turn_on &= ~IPIF_UP;
11853 		}
11854 		err = ipif_down(ipif, q, mp);
11855 		ip1dbg(("ipif_down returns %d err ", err));
11856 		if (err == EINPROGRESS)
11857 			return (err);
11858 		ipif_down_tail(ipif);
11859 	}
11860 	return (ip_sioctl_flags_tail(ipif, flags, q, mp, need_up));
11861 }
11862 
11863 static int
11864 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp,
11865     boolean_t need_up)
11866 {
11867 	ill_t	*ill;
11868 	phyint_t *phyi;
11869 	uint64_t turn_on;
11870 	uint64_t turn_off;
11871 	uint64_t intf_flags;
11872 	boolean_t phyint_flags_modified = B_FALSE;
11873 	int	err = 0;
11874 	boolean_t set_linklocal = B_FALSE;
11875 	boolean_t zero_source = B_FALSE;
11876 
11877 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
11878 		ipif->ipif_ill->ill_name, ipif->ipif_id));
11879 
11880 	ASSERT(IAM_WRITER_IPIF(ipif));
11881 
11882 	ill = ipif->ipif_ill;
11883 	phyi = ill->ill_phyint;
11884 
11885 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
11886 	turn_on = (flags ^ intf_flags) & ~(IFF_CANTCHANGE | IFF_UP);
11887 
11888 	turn_off = intf_flags & turn_on;
11889 	turn_on ^= turn_off;
11890 
11891 	if ((turn_on|turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE))
11892 		phyint_flags_modified = B_TRUE;
11893 
11894 	/*
11895 	 * Now we change the flags. Track current value of
11896 	 * other flags in their respective places.
11897 	 */
11898 	mutex_enter(&ill->ill_lock);
11899 	mutex_enter(&phyi->phyint_lock);
11900 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
11901 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
11902 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
11903 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
11904 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
11905 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
11906 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
11907 		set_linklocal = B_TRUE;
11908 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
11909 	}
11910 	if (ipif->ipif_state_flags & IPIF_ZERO_SOURCE) {
11911 		zero_source = B_TRUE;
11912 		ipif->ipif_state_flags &= ~IPIF_ZERO_SOURCE;
11913 	}
11914 	mutex_exit(&ill->ill_lock);
11915 	mutex_exit(&phyi->phyint_lock);
11916 
11917 	if (((turn_on | turn_off) & (PHYI_FAILED|PHYI_STANDBY|PHYI_OFFLINE)))
11918 		ip_redo_nomination(phyi);
11919 
11920 	if (set_linklocal)
11921 		(void) ipif_setlinklocal(ipif);
11922 
11923 	if (zero_source)
11924 		ipif->ipif_v6src_addr = ipv6_all_zeros;
11925 	else
11926 		ipif->ipif_v6src_addr = ipif->ipif_v6lcl_addr;
11927 
11928 	if (need_up) {
11929 		/*
11930 		 * XXX ipif_up really does not know whether a phyint flags
11931 		 * was modified or not. So, it sends up information on
11932 		 * only one routing sockets message. As we don't bring up
11933 		 * the interface and also set STANDBY/FAILED simultaneously
11934 		 * it should be okay.
11935 		 */
11936 		err = ipif_up(ipif, q, mp);
11937 	} else {
11938 		/*
11939 		 * Make sure routing socket sees all changes to the flags.
11940 		 * ipif_up_done* handles this when we use ipif_up.
11941 		 */
11942 		if (phyint_flags_modified) {
11943 			if (phyi->phyint_illv4 != NULL) {
11944 				ip_rts_ifmsg(phyi->phyint_illv4->
11945 				    ill_ipif);
11946 			}
11947 			if (phyi->phyint_illv6 != NULL) {
11948 				ip_rts_ifmsg(phyi->phyint_illv6->
11949 				    ill_ipif);
11950 			}
11951 		} else {
11952 			ip_rts_ifmsg(ipif);
11953 		}
11954 	}
11955 	return (err);
11956 }
11957 
11958 /*
11959  * Restart entry point to restart the flags restart operation after the
11960  * refcounts have dropped to zero.
11961  */
11962 /* ARGSUSED */
11963 int
11964 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11965     ip_ioctl_cmd_t *ipip, void *if_req)
11966 {
11967 	int	err;
11968 	struct ifreq *ifr = (struct ifreq *)if_req;
11969 	struct lifreq *lifr = (struct lifreq *)if_req;
11970 
11971 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
11972 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11973 
11974 	ipif_down_tail(ipif);
11975 	if (ipip->ipi_cmd_type == IF_CMD) {
11976 		/*
11977 		 * Since ip_sioctl_flags expects an int and ifr_flags
11978 		 * is a short we need to cast ifr_flags into an int
11979 		 * to avoid having sign extension cause bits to get
11980 		 * set that should not be.
11981 		 */
11982 		err = ip_sioctl_flags_tail(ipif,
11983 		    (uint64_t)(ifr->ifr_flags & 0x0000ffff),
11984 		    q, mp, B_TRUE);
11985 	} else {
11986 		err = ip_sioctl_flags_tail(ipif, lifr->lifr_flags,
11987 		    q, mp, B_TRUE);
11988 	}
11989 	return (err);
11990 }
11991 
11992 /* ARGSUSED */
11993 int
11994 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11995     ip_ioctl_cmd_t *ipip, void *if_req)
11996 {
11997 	/*
11998 	 * Has the flags been set correctly till now ?
11999 	 */
12000 	ill_t *ill = ipif->ipif_ill;
12001 	phyint_t *phyi = ill->ill_phyint;
12002 
12003 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
12004 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12005 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
12006 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
12007 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
12008 
12009 	/*
12010 	 * Need a lock since some flags can be set even when there are
12011 	 * references to the ipif.
12012 	 */
12013 	mutex_enter(&ill->ill_lock);
12014 	if (ipip->ipi_cmd_type == IF_CMD) {
12015 		struct ifreq *ifr = (struct ifreq *)if_req;
12016 
12017 		/* Get interface flags (low 16 only). */
12018 		ifr->ifr_flags = ((ipif->ipif_flags |
12019 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
12020 	} else {
12021 		struct lifreq *lifr = (struct lifreq *)if_req;
12022 
12023 		/* Get interface flags. */
12024 		lifr->lifr_flags = ipif->ipif_flags |
12025 		    ill->ill_flags | phyi->phyint_flags;
12026 	}
12027 	mutex_exit(&ill->ill_lock);
12028 	return (0);
12029 }
12030 
12031 /* ARGSUSED */
12032 int
12033 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12034     ip_ioctl_cmd_t *ipip, void *if_req)
12035 {
12036 	int mtu;
12037 	int ip_min_mtu;
12038 	struct ifreq	*ifr;
12039 	struct lifreq *lifr;
12040 	ire_t	*ire;
12041 
12042 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
12043 	    ipif->ipif_id, (void *)ipif));
12044 	if (ipip->ipi_cmd_type == IF_CMD) {
12045 		ifr = (struct ifreq *)if_req;
12046 		mtu = ifr->ifr_metric;
12047 	} else {
12048 		lifr = (struct lifreq *)if_req;
12049 		mtu = lifr->lifr_mtu;
12050 	}
12051 
12052 	if (ipif->ipif_isv6)
12053 		ip_min_mtu = IPV6_MIN_MTU;
12054 	else
12055 		ip_min_mtu = IP_MIN_MTU;
12056 
12057 	if (mtu > ipif->ipif_ill->ill_max_frag || mtu < ip_min_mtu)
12058 		return (EINVAL);
12059 
12060 	/*
12061 	 * Change the MTU size in all relevant ire's.
12062 	 * Mtu change Vs. new ire creation - protocol below.
12063 	 * First change ipif_mtu and the ire_max_frag of the
12064 	 * interface ire. Then do an ire walk and change the
12065 	 * ire_max_frag of all affected ires. During ire_add
12066 	 * under the bucket lock, set the ire_max_frag of the
12067 	 * new ire being created from the ipif/ire from which
12068 	 * it is being derived. If an mtu change happens after
12069 	 * the ire is added, the new ire will be cleaned up.
12070 	 * Conversely if the mtu change happens before the ire
12071 	 * is added, ire_add will see the new value of the mtu.
12072 	 */
12073 	ipif->ipif_mtu = mtu;
12074 	ipif->ipif_flags |= IPIF_FIXEDMTU;
12075 
12076 	if (ipif->ipif_isv6)
12077 		ire = ipif_to_ire_v6(ipif);
12078 	else
12079 		ire = ipif_to_ire(ipif);
12080 	if (ire != NULL) {
12081 		ire->ire_max_frag = ipif->ipif_mtu;
12082 		ire_refrele(ire);
12083 	}
12084 	if (ipif->ipif_flags & IPIF_UP) {
12085 		if (ipif->ipif_isv6)
12086 			ire_walk_v6(ipif_mtu_change, (char *)ipif, ALL_ZONES);
12087 		else
12088 			ire_walk_v4(ipif_mtu_change, (char *)ipif, ALL_ZONES);
12089 	}
12090 	/* Update the MTU in SCTP's list */
12091 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
12092 	return (0);
12093 }
12094 
12095 /* Get interface MTU. */
12096 /* ARGSUSED */
12097 int
12098 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12099 	ip_ioctl_cmd_t *ipip, void *if_req)
12100 {
12101 	struct ifreq	*ifr;
12102 	struct lifreq	*lifr;
12103 
12104 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
12105 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12106 	if (ipip->ipi_cmd_type == IF_CMD) {
12107 		ifr = (struct ifreq *)if_req;
12108 		ifr->ifr_metric = ipif->ipif_mtu;
12109 	} else {
12110 		lifr = (struct lifreq *)if_req;
12111 		lifr->lifr_mtu = ipif->ipif_mtu;
12112 	}
12113 	return (0);
12114 }
12115 
12116 /* Set interface broadcast address. */
12117 /* ARGSUSED2 */
12118 int
12119 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12120 	ip_ioctl_cmd_t *ipip, void *if_req)
12121 {
12122 	ipaddr_t addr;
12123 	ire_t	*ire;
12124 
12125 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ipif->ipif_ill->ill_name,
12126 	    ipif->ipif_id));
12127 
12128 	ASSERT(IAM_WRITER_IPIF(ipif));
12129 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12130 		return (EADDRNOTAVAIL);
12131 
12132 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
12133 
12134 	if (sin->sin_family != AF_INET)
12135 		return (EAFNOSUPPORT);
12136 
12137 	addr = sin->sin_addr.s_addr;
12138 	if (ipif->ipif_flags & IPIF_UP) {
12139 		/*
12140 		 * If we are already up, make sure the new
12141 		 * broadcast address makes sense.  If it does,
12142 		 * there should be an IRE for it already.
12143 		 * Don't match on ipif, only on the ill
12144 		 * since we are sharing these now. Don't use
12145 		 * MATCH_IRE_ILL_GROUP as we are looking for
12146 		 * the broadcast ire on this ill and each ill
12147 		 * in the group has its own broadcast ire.
12148 		 */
12149 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST,
12150 		    ipif, ALL_ZONES, NULL,
12151 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE));
12152 		if (ire == NULL) {
12153 			return (EINVAL);
12154 		} else {
12155 			ire_refrele(ire);
12156 		}
12157 	}
12158 	/*
12159 	 * Changing the broadcast addr for this ipif.
12160 	 * Make sure we have valid net and subnet bcast
12161 	 * ire's for other logical interfaces, if needed.
12162 	 */
12163 	if (addr != ipif->ipif_brd_addr)
12164 		ipif_check_bcast_ires(ipif);
12165 	IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
12166 	return (0);
12167 }
12168 
12169 /* Get interface broadcast address. */
12170 /* ARGSUSED */
12171 int
12172 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12173     ip_ioctl_cmd_t *ipip, void *if_req)
12174 {
12175 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
12176 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12177 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
12178 		return (EADDRNOTAVAIL);
12179 
12180 	/* IPIF_BROADCAST not possible with IPv6 */
12181 	ASSERT(!ipif->ipif_isv6);
12182 	*sin = sin_null;
12183 	sin->sin_family = AF_INET;
12184 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
12185 	return (0);
12186 }
12187 
12188 /*
12189  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
12190  */
12191 /* ARGSUSED */
12192 int
12193 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12194     ip_ioctl_cmd_t *ipip, void *if_req)
12195 {
12196 	int err = 0;
12197 	in6_addr_t v6mask;
12198 
12199 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
12200 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12201 
12202 	ASSERT(IAM_WRITER_IPIF(ipif));
12203 
12204 	if (ipif->ipif_isv6) {
12205 		sin6_t *sin6;
12206 
12207 		if (sin->sin_family != AF_INET6)
12208 			return (EAFNOSUPPORT);
12209 
12210 		sin6 = (sin6_t *)sin;
12211 		v6mask = sin6->sin6_addr;
12212 	} else {
12213 		ipaddr_t mask;
12214 
12215 		if (sin->sin_family != AF_INET)
12216 			return (EAFNOSUPPORT);
12217 
12218 		mask = sin->sin_addr.s_addr;
12219 		V4MASK_TO_V6(mask, v6mask);
12220 	}
12221 
12222 	/*
12223 	 * No big deal if the interface isn't already up, or the mask
12224 	 * isn't really changing, or this is pt-pt.
12225 	 */
12226 	if (!(ipif->ipif_flags & IPIF_UP) ||
12227 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
12228 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
12229 		ipif->ipif_v6net_mask = v6mask;
12230 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12231 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
12232 			    ipif->ipif_v6net_mask,
12233 			    ipif->ipif_v6subnet);
12234 		}
12235 		return (0);
12236 	}
12237 	/*
12238 	 * Make sure we have valid net and subnet broadcast ire's
12239 	 * for the old netmask, if needed by other logical interfaces.
12240 	 */
12241 	if (!ipif->ipif_isv6)
12242 		ipif_check_bcast_ires(ipif);
12243 
12244 	err = ipif_logical_down(ipif, q, mp);
12245 	if (err == EINPROGRESS)
12246 		return (err);
12247 	ipif_down_tail(ipif);
12248 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
12249 	return (err);
12250 }
12251 
12252 static int
12253 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
12254 {
12255 	in6_addr_t v6mask;
12256 	int err = 0;
12257 
12258 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
12259 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12260 
12261 	if (ipif->ipif_isv6) {
12262 		sin6_t *sin6;
12263 
12264 		sin6 = (sin6_t *)sin;
12265 		v6mask = sin6->sin6_addr;
12266 	} else {
12267 		ipaddr_t mask;
12268 
12269 		mask = sin->sin_addr.s_addr;
12270 		V4MASK_TO_V6(mask, v6mask);
12271 	}
12272 
12273 	ipif->ipif_v6net_mask = v6mask;
12274 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12275 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
12276 		    ipif->ipif_v6subnet);
12277 	}
12278 	err = ipif_up(ipif, q, mp);
12279 
12280 	if (err == 0 || err == EINPROGRESS) {
12281 		/*
12282 		 * The interface must be DL_BOUND if this packet has to
12283 		 * go out on the wire. Since we only go through a logical
12284 		 * down and are bound with the driver during an internal
12285 		 * down/up that is satisfied.
12286 		 */
12287 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
12288 			/* Potentially broadcast an address mask reply. */
12289 			ipif_mask_reply(ipif);
12290 		}
12291 	}
12292 	return (err);
12293 }
12294 
12295 /* ARGSUSED */
12296 int
12297 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12298     ip_ioctl_cmd_t *ipip, void *if_req)
12299 {
12300 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
12301 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12302 	ipif_down_tail(ipif);
12303 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
12304 }
12305 
12306 /* Get interface net mask. */
12307 /* ARGSUSED */
12308 int
12309 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12310     ip_ioctl_cmd_t *ipip, void *if_req)
12311 {
12312 	struct lifreq *lifr = (struct lifreq *)if_req;
12313 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
12314 
12315 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
12316 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12317 
12318 	/*
12319 	 * net mask can't change since we have a reference to the ipif.
12320 	 */
12321 	if (ipif->ipif_isv6) {
12322 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12323 		*sin6 = sin6_null;
12324 		sin6->sin6_family = AF_INET6;
12325 		sin6->sin6_addr = ipif->ipif_v6net_mask;
12326 		lifr->lifr_addrlen =
12327 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12328 	} else {
12329 		*sin = sin_null;
12330 		sin->sin_family = AF_INET;
12331 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
12332 		if (ipip->ipi_cmd_type == LIF_CMD) {
12333 			lifr->lifr_addrlen =
12334 			    ip_mask_to_plen(ipif->ipif_net_mask);
12335 		}
12336 	}
12337 	return (0);
12338 }
12339 
12340 /* ARGSUSED */
12341 int
12342 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12343     ip_ioctl_cmd_t *ipip, void *if_req)
12344 {
12345 
12346 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
12347 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12348 	/*
12349 	 * Set interface metric.  We don't use this for
12350 	 * anything but we keep track of it in case it is
12351 	 * important to routing applications or such.
12352 	 */
12353 	if (ipip->ipi_cmd_type == IF_CMD) {
12354 		struct ifreq    *ifr;
12355 
12356 		ifr = (struct ifreq *)if_req;
12357 		ipif->ipif_metric = ifr->ifr_metric;
12358 	} else {
12359 		struct lifreq   *lifr;
12360 
12361 		lifr = (struct lifreq *)if_req;
12362 		ipif->ipif_metric = lifr->lifr_metric;
12363 	}
12364 	return (0);
12365 }
12366 
12367 
12368 /* ARGSUSED */
12369 int
12370 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12371     ip_ioctl_cmd_t *ipip, void *if_req)
12372 {
12373 
12374 	/* Get interface metric. */
12375 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
12376 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12377 	if (ipip->ipi_cmd_type == IF_CMD) {
12378 		struct ifreq    *ifr;
12379 
12380 		ifr = (struct ifreq *)if_req;
12381 		ifr->ifr_metric = ipif->ipif_metric;
12382 	} else {
12383 		struct lifreq   *lifr;
12384 
12385 		lifr = (struct lifreq *)if_req;
12386 		lifr->lifr_metric = ipif->ipif_metric;
12387 	}
12388 
12389 	return (0);
12390 }
12391 
12392 /* ARGSUSED */
12393 int
12394 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12395     ip_ioctl_cmd_t *ipip, void *if_req)
12396 {
12397 
12398 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
12399 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12400 	/*
12401 	 * Set the muxid returned from I_PLINK.
12402 	 */
12403 	if (ipip->ipi_cmd_type == IF_CMD) {
12404 		struct ifreq *ifr = (struct ifreq *)if_req;
12405 
12406 		ipif->ipif_ill->ill_ip_muxid = ifr->ifr_ip_muxid;
12407 		ipif->ipif_ill->ill_arp_muxid = ifr->ifr_arp_muxid;
12408 	} else {
12409 		struct lifreq *lifr = (struct lifreq *)if_req;
12410 
12411 		ipif->ipif_ill->ill_ip_muxid = lifr->lifr_ip_muxid;
12412 		ipif->ipif_ill->ill_arp_muxid = lifr->lifr_arp_muxid;
12413 	}
12414 	return (0);
12415 }
12416 
12417 /* ARGSUSED */
12418 int
12419 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12420     ip_ioctl_cmd_t *ipip, void *if_req)
12421 {
12422 
12423 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
12424 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12425 	/*
12426 	 * Get the muxid saved in ill for I_PUNLINK.
12427 	 */
12428 	if (ipip->ipi_cmd_type == IF_CMD) {
12429 		struct ifreq *ifr = (struct ifreq *)if_req;
12430 
12431 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12432 		ifr->ifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12433 	} else {
12434 		struct lifreq *lifr = (struct lifreq *)if_req;
12435 
12436 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_ip_muxid;
12437 		lifr->lifr_arp_muxid = ipif->ipif_ill->ill_arp_muxid;
12438 	}
12439 	return (0);
12440 }
12441 
12442 /*
12443  * Set the subnet prefix. Does not modify the broadcast address.
12444  */
12445 /* ARGSUSED */
12446 int
12447 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12448     ip_ioctl_cmd_t *ipip, void *if_req)
12449 {
12450 	int err = 0;
12451 	in6_addr_t v6addr;
12452 	in6_addr_t v6mask;
12453 	boolean_t need_up = B_FALSE;
12454 	int addrlen;
12455 
12456 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
12457 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12458 
12459 	ASSERT(IAM_WRITER_IPIF(ipif));
12460 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
12461 
12462 	if (ipif->ipif_isv6) {
12463 		sin6_t *sin6;
12464 
12465 		if (sin->sin_family != AF_INET6)
12466 			return (EAFNOSUPPORT);
12467 
12468 		sin6 = (sin6_t *)sin;
12469 		v6addr = sin6->sin6_addr;
12470 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
12471 			return (EADDRNOTAVAIL);
12472 	} else {
12473 		ipaddr_t addr;
12474 
12475 		if (sin->sin_family != AF_INET)
12476 			return (EAFNOSUPPORT);
12477 
12478 		addr = sin->sin_addr.s_addr;
12479 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
12480 			return (EADDRNOTAVAIL);
12481 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12482 		/* Add 96 bits */
12483 		addrlen += IPV6_ABITS - IP_ABITS;
12484 	}
12485 
12486 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
12487 		return (EINVAL);
12488 
12489 	/* Check if bits in the address is set past the mask */
12490 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
12491 		return (EINVAL);
12492 
12493 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
12494 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
12495 		return (0);	/* No change */
12496 
12497 	if (ipif->ipif_flags & IPIF_UP) {
12498 		/*
12499 		 * If the interface is already marked up,
12500 		 * we call ipif_down which will take care
12501 		 * of ditching any IREs that have been set
12502 		 * up based on the old interface address.
12503 		 */
12504 		err = ipif_logical_down(ipif, q, mp);
12505 		if (err == EINPROGRESS)
12506 			return (err);
12507 		ipif_down_tail(ipif);
12508 		need_up = B_TRUE;
12509 	}
12510 
12511 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
12512 	return (err);
12513 }
12514 
12515 static int
12516 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
12517     queue_t *q, mblk_t *mp, boolean_t need_up)
12518 {
12519 	ill_t	*ill = ipif->ipif_ill;
12520 	int	err = 0;
12521 
12522 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
12523 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12524 
12525 	/* Set the new address. */
12526 	mutex_enter(&ill->ill_lock);
12527 	ipif->ipif_v6net_mask = v6mask;
12528 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
12529 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
12530 		    ipif->ipif_v6subnet);
12531 	}
12532 	mutex_exit(&ill->ill_lock);
12533 
12534 	if (need_up) {
12535 		/*
12536 		 * Now bring the interface back up.  If this
12537 		 * is the only IPIF for the ILL, ipif_up
12538 		 * will have to re-bind to the device, so
12539 		 * we may get back EINPROGRESS, in which
12540 		 * case, this IOCTL will get completed in
12541 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12542 		 */
12543 		err = ipif_up(ipif, q, mp);
12544 		if (err == EINPROGRESS)
12545 			return (err);
12546 	}
12547 	return (err);
12548 }
12549 
12550 /* ARGSUSED */
12551 int
12552 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12553     ip_ioctl_cmd_t *ipip, void *if_req)
12554 {
12555 	int	addrlen;
12556 	in6_addr_t v6addr;
12557 	in6_addr_t v6mask;
12558 	struct lifreq *lifr = (struct lifreq *)if_req;
12559 
12560 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
12561 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12562 	ipif_down_tail(ipif);
12563 
12564 	addrlen = lifr->lifr_addrlen;
12565 	if (ipif->ipif_isv6) {
12566 		sin6_t *sin6;
12567 
12568 		sin6 = (sin6_t *)sin;
12569 		v6addr = sin6->sin6_addr;
12570 	} else {
12571 		ipaddr_t addr;
12572 
12573 		addr = sin->sin_addr.s_addr;
12574 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
12575 		addrlen += IPV6_ABITS - IP_ABITS;
12576 	}
12577 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
12578 
12579 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
12580 }
12581 
12582 /* ARGSUSED */
12583 int
12584 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12585     ip_ioctl_cmd_t *ipip, void *if_req)
12586 {
12587 	struct lifreq *lifr = (struct lifreq *)if_req;
12588 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
12589 
12590 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
12591 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12592 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
12593 
12594 	if (ipif->ipif_isv6) {
12595 		*sin6 = sin6_null;
12596 		sin6->sin6_family = AF_INET6;
12597 		sin6->sin6_addr = ipif->ipif_v6subnet;
12598 		lifr->lifr_addrlen =
12599 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
12600 	} else {
12601 		*sin = sin_null;
12602 		sin->sin_family = AF_INET;
12603 		sin->sin_addr.s_addr = ipif->ipif_subnet;
12604 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
12605 	}
12606 	return (0);
12607 }
12608 
12609 /*
12610  * Set the IPv6 address token.
12611  */
12612 /* ARGSUSED */
12613 int
12614 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12615     ip_ioctl_cmd_t *ipi, void *if_req)
12616 {
12617 	ill_t *ill = ipif->ipif_ill;
12618 	int err;
12619 	in6_addr_t v6addr;
12620 	in6_addr_t v6mask;
12621 	boolean_t need_up = B_FALSE;
12622 	int i;
12623 	sin6_t *sin6 = (sin6_t *)sin;
12624 	struct lifreq *lifr = (struct lifreq *)if_req;
12625 	int addrlen;
12626 
12627 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
12628 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12629 	ASSERT(IAM_WRITER_IPIF(ipif));
12630 
12631 	addrlen = lifr->lifr_addrlen;
12632 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12633 	if (ipif->ipif_id != 0)
12634 		return (EINVAL);
12635 
12636 	if (!ipif->ipif_isv6)
12637 		return (EINVAL);
12638 
12639 	if (addrlen > IPV6_ABITS)
12640 		return (EINVAL);
12641 
12642 	v6addr = sin6->sin6_addr;
12643 
12644 	/*
12645 	 * The length of the token is the length from the end.  To get
12646 	 * the proper mask for this, compute the mask of the bits not
12647 	 * in the token; ie. the prefix, and then xor to get the mask.
12648 	 */
12649 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
12650 		return (EINVAL);
12651 	for (i = 0; i < 4; i++) {
12652 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12653 	}
12654 
12655 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
12656 	    ill->ill_token_length == addrlen)
12657 		return (0);	/* No change */
12658 
12659 	if (ipif->ipif_flags & IPIF_UP) {
12660 		err = ipif_logical_down(ipif, q, mp);
12661 		if (err == EINPROGRESS)
12662 			return (err);
12663 		ipif_down_tail(ipif);
12664 		need_up = B_TRUE;
12665 	}
12666 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
12667 	return (err);
12668 }
12669 
12670 static int
12671 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
12672     mblk_t *mp, boolean_t need_up)
12673 {
12674 	in6_addr_t v6addr;
12675 	in6_addr_t v6mask;
12676 	ill_t	*ill = ipif->ipif_ill;
12677 	int	i;
12678 	int	err = 0;
12679 
12680 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
12681 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12682 	v6addr = sin6->sin6_addr;
12683 	/*
12684 	 * The length of the token is the length from the end.  To get
12685 	 * the proper mask for this, compute the mask of the bits not
12686 	 * in the token; ie. the prefix, and then xor to get the mask.
12687 	 */
12688 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
12689 	for (i = 0; i < 4; i++)
12690 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
12691 
12692 	mutex_enter(&ill->ill_lock);
12693 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
12694 	ill->ill_token_length = addrlen;
12695 	mutex_exit(&ill->ill_lock);
12696 
12697 	if (need_up) {
12698 		/*
12699 		 * Now bring the interface back up.  If this
12700 		 * is the only IPIF for the ILL, ipif_up
12701 		 * will have to re-bind to the device, so
12702 		 * we may get back EINPROGRESS, in which
12703 		 * case, this IOCTL will get completed in
12704 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
12705 		 */
12706 		err = ipif_up(ipif, q, mp);
12707 		if (err == EINPROGRESS)
12708 			return (err);
12709 	}
12710 	return (err);
12711 }
12712 
12713 /* ARGSUSED */
12714 int
12715 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12716     ip_ioctl_cmd_t *ipi, void *if_req)
12717 {
12718 	ill_t *ill;
12719 	sin6_t *sin6 = (sin6_t *)sin;
12720 	struct lifreq *lifr = (struct lifreq *)if_req;
12721 
12722 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
12723 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12724 	if (ipif->ipif_id != 0)
12725 		return (EINVAL);
12726 
12727 	ill = ipif->ipif_ill;
12728 	if (!ill->ill_isv6)
12729 		return (ENXIO);
12730 
12731 	*sin6 = sin6_null;
12732 	sin6->sin6_family = AF_INET6;
12733 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
12734 	sin6->sin6_addr = ill->ill_token;
12735 	lifr->lifr_addrlen = ill->ill_token_length;
12736 	return (0);
12737 }
12738 
12739 /*
12740  * Set (hardware) link specific information that might override
12741  * what was acquired through the DL_INFO_ACK.
12742  * The logic is as follows.
12743  *
12744  * become exclusive
12745  * set CHANGING flag
12746  * change mtu on affected IREs
12747  * clear CHANGING flag
12748  *
12749  * An ire add that occurs before the CHANGING flag is set will have its mtu
12750  * changed by the ip_sioctl_lnkinfo.
12751  *
12752  * During the time the CHANGING flag is set, no new ires will be added to the
12753  * bucket, and ire add will fail (due the CHANGING flag).
12754  *
12755  * An ire add that occurs after the CHANGING flag is set will have the right mtu
12756  * before it is added to the bucket.
12757  *
12758  * Obviously only 1 thread can set the CHANGING flag and we need to become
12759  * exclusive to set the flag.
12760  */
12761 /* ARGSUSED */
12762 int
12763 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12764     ip_ioctl_cmd_t *ipi, void *if_req)
12765 {
12766 	ill_t		*ill = ipif->ipif_ill;
12767 	ipif_t		*nipif;
12768 	int		ip_min_mtu;
12769 	boolean_t	mtu_walk = B_FALSE;
12770 	struct lifreq	*lifr = (struct lifreq *)if_req;
12771 	lif_ifinfo_req_t *lir;
12772 	ire_t		*ire;
12773 
12774 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
12775 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12776 	lir = &lifr->lifr_ifinfo;
12777 	ASSERT(IAM_WRITER_IPIF(ipif));
12778 
12779 	/* Only allow for logical unit zero i.e. not on "le0:17" */
12780 	if (ipif->ipif_id != 0)
12781 		return (EINVAL);
12782 
12783 	/* Set interface MTU. */
12784 	if (ipif->ipif_isv6)
12785 		ip_min_mtu = IPV6_MIN_MTU;
12786 	else
12787 		ip_min_mtu = IP_MIN_MTU;
12788 
12789 	/*
12790 	 * Verify values before we set anything. Allow zero to
12791 	 * mean unspecified.
12792 	 */
12793 	if (lir->lir_maxmtu != 0 &&
12794 	    (lir->lir_maxmtu > ill->ill_max_frag ||
12795 	    lir->lir_maxmtu < ip_min_mtu))
12796 		return (EINVAL);
12797 	if (lir->lir_reachtime != 0 &&
12798 	    lir->lir_reachtime > ND_MAX_REACHTIME)
12799 		return (EINVAL);
12800 	if (lir->lir_reachretrans != 0 &&
12801 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
12802 		return (EINVAL);
12803 
12804 	mutex_enter(&ill->ill_lock);
12805 	ill->ill_state_flags |= ILL_CHANGING;
12806 	for (nipif = ill->ill_ipif; nipif != NULL;
12807 	    nipif = nipif->ipif_next) {
12808 		nipif->ipif_state_flags |= IPIF_CHANGING;
12809 	}
12810 
12811 	mutex_exit(&ill->ill_lock);
12812 
12813 	if (lir->lir_maxmtu != 0) {
12814 		ill->ill_max_mtu = lir->lir_maxmtu;
12815 		ill->ill_mtu_userspecified = 1;
12816 		mtu_walk = B_TRUE;
12817 	}
12818 
12819 	if (lir->lir_reachtime != 0)
12820 		ill->ill_reachable_time = lir->lir_reachtime;
12821 
12822 	if (lir->lir_reachretrans != 0)
12823 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
12824 
12825 	ill->ill_max_hops = lir->lir_maxhops;
12826 
12827 	ill->ill_max_buf = ND_MAX_Q;
12828 
12829 	if (mtu_walk) {
12830 		/*
12831 		 * Set the MTU on all ipifs associated with this ill except
12832 		 * for those whose MTU was fixed via SIOCSLIFMTU.
12833 		 */
12834 		for (nipif = ill->ill_ipif; nipif != NULL;
12835 		    nipif = nipif->ipif_next) {
12836 			if (nipif->ipif_flags & IPIF_FIXEDMTU)
12837 				continue;
12838 
12839 			nipif->ipif_mtu = ill->ill_max_mtu;
12840 
12841 			if (!(nipif->ipif_flags & IPIF_UP))
12842 				continue;
12843 
12844 			if (nipif->ipif_isv6)
12845 				ire = ipif_to_ire_v6(nipif);
12846 			else
12847 				ire = ipif_to_ire(nipif);
12848 			if (ire != NULL) {
12849 				ire->ire_max_frag = ipif->ipif_mtu;
12850 				ire_refrele(ire);
12851 			}
12852 			if (ill->ill_isv6) {
12853 				ire_walk_ill_v6(MATCH_IRE_ILL, 0,
12854 				    ipif_mtu_change, (char *)nipif,
12855 				    ill);
12856 			} else {
12857 				ire_walk_ill_v4(MATCH_IRE_ILL, 0,
12858 				    ipif_mtu_change, (char *)nipif,
12859 				    ill);
12860 			}
12861 		}
12862 	}
12863 
12864 	mutex_enter(&ill->ill_lock);
12865 	for (nipif = ill->ill_ipif; nipif != NULL;
12866 	    nipif = nipif->ipif_next) {
12867 		nipif->ipif_state_flags &= ~IPIF_CHANGING;
12868 	}
12869 	ILL_UNMARK_CHANGING(ill);
12870 	mutex_exit(&ill->ill_lock);
12871 
12872 	return (0);
12873 }
12874 
12875 /* ARGSUSED */
12876 int
12877 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12878     ip_ioctl_cmd_t *ipi, void *if_req)
12879 {
12880 	struct lif_ifinfo_req *lir;
12881 	ill_t *ill = ipif->ipif_ill;
12882 
12883 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
12884 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
12885 	if (ipif->ipif_id != 0)
12886 		return (EINVAL);
12887 
12888 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
12889 	lir->lir_maxhops = ill->ill_max_hops;
12890 	lir->lir_reachtime = ill->ill_reachable_time;
12891 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
12892 	lir->lir_maxmtu = ill->ill_max_mtu;
12893 
12894 	return (0);
12895 }
12896 
12897 /*
12898  * Return best guess as to the subnet mask for the specified address.
12899  * Based on the subnet masks for all the configured interfaces.
12900  *
12901  * We end up returning a zero mask in the case of default, multicast or
12902  * experimental.
12903  */
12904 static ipaddr_t
12905 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp)
12906 {
12907 	ipaddr_t net_mask;
12908 	ill_t	*ill;
12909 	ipif_t	*ipif;
12910 	ill_walk_context_t ctx;
12911 	ipif_t	*fallback_ipif = NULL;
12912 
12913 	net_mask = ip_net_mask(addr);
12914 	if (net_mask == 0) {
12915 		*ipifp = NULL;
12916 		return (0);
12917 	}
12918 
12919 	/* Let's check to see if this is maybe a local subnet route. */
12920 	/* this function only applies to IPv4 interfaces */
12921 	rw_enter(&ill_g_lock, RW_READER);
12922 	ill = ILL_START_WALK_V4(&ctx);
12923 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
12924 		mutex_enter(&ill->ill_lock);
12925 		for (ipif = ill->ill_ipif; ipif != NULL;
12926 		    ipif = ipif->ipif_next) {
12927 			if (!IPIF_CAN_LOOKUP(ipif))
12928 				continue;
12929 			if (!(ipif->ipif_flags & IPIF_UP))
12930 				continue;
12931 			if ((ipif->ipif_subnet & net_mask) ==
12932 			    (addr & net_mask)) {
12933 				/*
12934 				 * Don't trust pt-pt interfaces if there are
12935 				 * other interfaces.
12936 				 */
12937 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
12938 					if (fallback_ipif == NULL) {
12939 						ipif_refhold_locked(ipif);
12940 						fallback_ipif = ipif;
12941 					}
12942 					continue;
12943 				}
12944 
12945 				/*
12946 				 * Fine. Just assume the same net mask as the
12947 				 * directly attached subnet interface is using.
12948 				 */
12949 				ipif_refhold_locked(ipif);
12950 				mutex_exit(&ill->ill_lock);
12951 				rw_exit(&ill_g_lock);
12952 				if (fallback_ipif != NULL)
12953 					ipif_refrele(fallback_ipif);
12954 				*ipifp = ipif;
12955 				return (ipif->ipif_net_mask);
12956 			}
12957 		}
12958 		mutex_exit(&ill->ill_lock);
12959 	}
12960 	rw_exit(&ill_g_lock);
12961 
12962 	*ipifp = fallback_ipif;
12963 	return ((fallback_ipif != NULL) ?
12964 	    fallback_ipif->ipif_net_mask : net_mask);
12965 }
12966 
12967 /*
12968  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
12969  */
12970 static void
12971 ip_wput_ioctl(queue_t *q, mblk_t *mp)
12972 {
12973 	IOCP	iocp;
12974 	ipft_t	*ipft;
12975 	ipllc_t	*ipllc;
12976 	mblk_t	*mp1;
12977 	cred_t	*cr;
12978 	int	error = 0;
12979 	conn_t	*connp;
12980 
12981 	ip1dbg(("ip_wput_ioctl"));
12982 	iocp = (IOCP)mp->b_rptr;
12983 	mp1 = mp->b_cont;
12984 	if (mp1 == NULL) {
12985 		iocp->ioc_error = EINVAL;
12986 		mp->b_datap->db_type = M_IOCNAK;
12987 		iocp->ioc_count = 0;
12988 		qreply(q, mp);
12989 		return;
12990 	}
12991 
12992 	/*
12993 	 * These IOCTLs provide various control capabilities to
12994 	 * upstream agents such as ULPs and processes.	There
12995 	 * are currently two such IOCTLs implemented.  They
12996 	 * are used by TCP to provide update information for
12997 	 * existing IREs and to forcibly delete an IRE for a
12998 	 * host that is not responding, thereby forcing an
12999 	 * attempt at a new route.
13000 	 */
13001 	iocp->ioc_error = EINVAL;
13002 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
13003 		goto done;
13004 
13005 	ipllc = (ipllc_t *)mp1->b_rptr;
13006 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
13007 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
13008 			break;
13009 	}
13010 	/*
13011 	 * prefer credential from mblk over ioctl;
13012 	 * see ip_sioctl_copyin_setup
13013 	 */
13014 	cr = DB_CREDDEF(mp, iocp->ioc_cr);
13015 
13016 	/*
13017 	 * Refhold the conn in case the request gets queued up in some lookup
13018 	 */
13019 	ASSERT(CONN_Q(q));
13020 	connp = Q_TO_CONN(q);
13021 	CONN_INC_REF(connp);
13022 	if (ipft->ipft_pfi &&
13023 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
13024 		pullupmsg(mp1, ipft->ipft_min_size))) {
13025 		error = (*ipft->ipft_pfi)(q,
13026 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
13027 	}
13028 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
13029 		/*
13030 		 * CONN_OPER_PENDING_DONE happens in the function called
13031 		 * through ipft_pfi above.
13032 		 */
13033 		return;
13034 	}
13035 
13036 	CONN_OPER_PENDING_DONE(connp);
13037 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
13038 		freemsg(mp);
13039 		return;
13040 	}
13041 	iocp->ioc_error = error;
13042 
13043 done:
13044 	mp->b_datap->db_type = M_IOCACK;
13045 	if (iocp->ioc_error)
13046 		iocp->ioc_count = 0;
13047 	qreply(q, mp);
13048 }
13049 
13050 /*
13051  * Lookup an ipif using the sequence id (ipif_seqid)
13052  */
13053 ipif_t *
13054 ipif_lookup_seqid(ill_t *ill, uint_t seqid)
13055 {
13056 	ipif_t *ipif;
13057 
13058 	ASSERT(MUTEX_HELD(&ill->ill_lock));
13059 
13060 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13061 		if (ipif->ipif_seqid == seqid && IPIF_CAN_LOOKUP(ipif))
13062 			return (ipif);
13063 	}
13064 	return (NULL);
13065 }
13066 
13067 uint64_t ipif_g_seqid;
13068 
13069 /*
13070  * Assign a unique id for the ipif. This is used later when we send
13071  * IRES to ARP for resolution where we initialize ire_ipif_seqid
13072  * to the value pointed by ire_ipif->ipif_seqid. Later when the
13073  * IRE is added, we verify that ipif has not disappeared.
13074  */
13075 
13076 static void
13077 ipif_assign_seqid(ipif_t *ipif)
13078 {
13079 	ipif->ipif_seqid = atomic_add_64_nv(&ipif_g_seqid, 1);
13080 }
13081 
13082 /*
13083  * Insert the ipif, so that the list of ipifs on the ill will be sorted
13084  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
13085  * be inserted into the first space available in the list. The value of
13086  * ipif_id will then be set to the appropriate value for its position.
13087  */
13088 static int
13089 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock, boolean_t acquire_ill_lock)
13090 {
13091 	ill_t *ill;
13092 	ipif_t *tipif;
13093 	ipif_t **tipifp;
13094 	int id;
13095 
13096 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
13097 	    IAM_WRITER_IPIF(ipif));
13098 
13099 	ill = ipif->ipif_ill;
13100 	ASSERT(ill != NULL);
13101 
13102 	/*
13103 	 * In the case of lo0:0 we already hold the ill_g_lock.
13104 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
13105 	 * ipif_insert. Another such caller is ipif_move.
13106 	 */
13107 	if (acquire_g_lock)
13108 		rw_enter(&ill_g_lock, RW_WRITER);
13109 	if (acquire_ill_lock)
13110 		mutex_enter(&ill->ill_lock);
13111 	id = ipif->ipif_id;
13112 	tipifp = &(ill->ill_ipif);
13113 	if (id == -1) {	/* need to find a real id */
13114 		id = 0;
13115 		while ((tipif = *tipifp) != NULL) {
13116 			ASSERT(tipif->ipif_id >= id);
13117 			if (tipif->ipif_id != id)
13118 				break; /* non-consecutive id */
13119 			id++;
13120 			tipifp = &(tipif->ipif_next);
13121 		}
13122 		/* limit number of logical interfaces */
13123 		if (id >= ip_addrs_per_if) {
13124 			if (acquire_ill_lock)
13125 				mutex_exit(&ill->ill_lock);
13126 			if (acquire_g_lock)
13127 				rw_exit(&ill_g_lock);
13128 			return (-1);
13129 		}
13130 		ipif->ipif_id = id; /* assign new id */
13131 	} else if (id < ip_addrs_per_if) {
13132 		/* we have a real id; insert ipif in the right place */
13133 		while ((tipif = *tipifp) != NULL) {
13134 			ASSERT(tipif->ipif_id != id);
13135 			if (tipif->ipif_id > id)
13136 				break; /* found correct location */
13137 			tipifp = &(tipif->ipif_next);
13138 		}
13139 	} else {
13140 		if (acquire_ill_lock)
13141 			mutex_exit(&ill->ill_lock);
13142 		if (acquire_g_lock)
13143 			rw_exit(&ill_g_lock);
13144 		return (-1);
13145 	}
13146 
13147 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
13148 
13149 	ipif->ipif_next = tipif;
13150 	*tipifp = ipif;
13151 	if (acquire_ill_lock)
13152 		mutex_exit(&ill->ill_lock);
13153 	if (acquire_g_lock)
13154 		rw_exit(&ill_g_lock);
13155 	return (0);
13156 }
13157 
13158 /*
13159  * Allocate and initialize a new interface control structure.  (Always
13160  * called as writer.)
13161  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
13162  * is not part of the global linked list of ills. ipif_seqid is unique
13163  * in the system and to preserve the uniqueness, it is assigned only
13164  * when ill becomes part of the global list. At that point ill will
13165  * have a name. If it doesn't get assigned here, it will get assigned
13166  * in ipif_set_values() as part of SIOCSLIFNAME processing.
13167  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
13168  * the interface flags or any other information from the DL_INFO_ACK for
13169  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
13170  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
13171  * second DL_INFO_ACK comes in from the driver.
13172  */
13173 static ipif_t *
13174 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize)
13175 {
13176 	ipif_t	*ipif;
13177 	phyint_t *phyi;
13178 
13179 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
13180 	    ill->ill_name, id, (void *)ill));
13181 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
13182 
13183 	if ((ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL)
13184 		return (NULL);
13185 	*ipif = ipif_zero;	/* start clean */
13186 
13187 	ipif->ipif_ill = ill;
13188 	ipif->ipif_id = id;	/* could be -1 */
13189 	ipif->ipif_zoneid = GLOBAL_ZONEID;
13190 
13191 	mutex_init(&ipif->ipif_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
13192 
13193 	ipif->ipif_refcnt = 0;
13194 	ipif->ipif_saved_ire_cnt = 0;
13195 
13196 	if (ipif_insert(ipif, ire_type != IRE_LOOPBACK, B_TRUE)) {
13197 		mi_free(ipif);
13198 		return (NULL);
13199 	}
13200 	/* -1 id should have been replaced by real id */
13201 	id = ipif->ipif_id;
13202 	ASSERT(id >= 0);
13203 
13204 	if (ill->ill_name[0] != '\0') {
13205 		ipif_assign_seqid(ipif);
13206 		if (ill->ill_phyint->phyint_ifindex != 0)
13207 			sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
13208 	}
13209 	/*
13210 	 * Keep a copy of original id in ipif_orig_ipifid.  Failback
13211 	 * will attempt to restore the original id.  The SIOCSLIFOINDEX
13212 	 * ioctl sets ipif_orig_ipifid to zero.
13213 	 */
13214 	ipif->ipif_orig_ipifid = id;
13215 
13216 	/*
13217 	 * We grab the ill_lock and phyint_lock to protect the flag changes.
13218 	 * The ipif is still not up and can't be looked up until the
13219 	 * ioctl completes and the IPIF_CHANGING flag is cleared.
13220 	 */
13221 	mutex_enter(&ill->ill_lock);
13222 	mutex_enter(&ill->ill_phyint->phyint_lock);
13223 	/*
13224 	 * Set the running flag when logical interface zero is created.
13225 	 * For subsequent logical interfaces, a DLPI link down
13226 	 * notification message may have cleared the running flag to
13227 	 * indicate the link is down, so we shouldn't just blindly set it.
13228 	 */
13229 	if (id == 0)
13230 		ill->ill_phyint->phyint_flags |= PHYI_RUNNING;
13231 	ipif->ipif_ire_type = ire_type;
13232 	phyi = ill->ill_phyint;
13233 	ipif->ipif_orig_ifindex = phyi->phyint_ifindex;
13234 
13235 	if (ipif->ipif_isv6) {
13236 		ill->ill_flags |= ILLF_IPV6;
13237 	} else {
13238 		ipaddr_t inaddr_any = INADDR_ANY;
13239 
13240 		ill->ill_flags |= ILLF_IPV4;
13241 
13242 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
13243 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13244 		    &ipif->ipif_v6lcl_addr);
13245 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13246 		    &ipif->ipif_v6src_addr);
13247 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13248 		    &ipif->ipif_v6subnet);
13249 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13250 		    &ipif->ipif_v6net_mask);
13251 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13252 		    &ipif->ipif_v6brd_addr);
13253 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
13254 		    &ipif->ipif_v6pp_dst_addr);
13255 	}
13256 
13257 	/*
13258 	 * Don't set the interface flags etc. now, will do it in
13259 	 * ip_ll_subnet_defaults.
13260 	 */
13261 	if (!initialize) {
13262 		mutex_exit(&ill->ill_lock);
13263 		mutex_exit(&ill->ill_phyint->phyint_lock);
13264 		return (ipif);
13265 	}
13266 	ipif->ipif_mtu = ill->ill_max_mtu;
13267 
13268 	if (ill->ill_bcast_addr_length != 0) {
13269 		/*
13270 		 * Later detect lack of DLPI driver multicast
13271 		 * capability by catching DL_ENABMULTI errors in
13272 		 * ip_rput_dlpi.
13273 		 */
13274 		ill->ill_flags |= ILLF_MULTICAST;
13275 		if (!ipif->ipif_isv6)
13276 			ipif->ipif_flags |= IPIF_BROADCAST;
13277 	} else {
13278 		if (ill->ill_net_type != IRE_LOOPBACK) {
13279 			if (ipif->ipif_isv6)
13280 				/*
13281 				 * Note: xresolv interfaces will eventually need
13282 				 * NOARP set here as well, but that will require
13283 				 * those external resolvers to have some
13284 				 * knowledge of that flag and act appropriately.
13285 				 * Not to be changed at present.
13286 				 */
13287 				ill->ill_flags |= ILLF_NONUD;
13288 			else
13289 				ill->ill_flags |= ILLF_NOARP;
13290 		}
13291 		if (ill->ill_phys_addr_length == 0) {
13292 			if (ill->ill_media &&
13293 			    ill->ill_media->ip_m_mac_type == SUNW_DL_VNI) {
13294 				ipif->ipif_flags |= IPIF_NOXMIT;
13295 				phyi->phyint_flags |= PHYI_VIRTUAL;
13296 			} else {
13297 				/* pt-pt supports multicast. */
13298 				ill->ill_flags |= ILLF_MULTICAST;
13299 				if (ill->ill_net_type == IRE_LOOPBACK) {
13300 					phyi->phyint_flags |=
13301 					    (PHYI_LOOPBACK | PHYI_VIRTUAL);
13302 				} else {
13303 					ipif->ipif_flags |= IPIF_POINTOPOINT;
13304 				}
13305 			}
13306 		}
13307 	}
13308 	mutex_exit(&ill->ill_lock);
13309 	mutex_exit(&ill->ill_phyint->phyint_lock);
13310 	return (ipif);
13311 }
13312 
13313 /*
13314  * If appropriate, send a message up to the resolver delete the entry
13315  * for the address of this interface which is going out of business.
13316  * (Always called as writer).
13317  *
13318  * NOTE : We need to check for NULL mps as some of the fields are
13319  *	  initialized only for some interface types. See ipif_resolver_up()
13320  *	  for details.
13321  */
13322 void
13323 ipif_arp_down(ipif_t *ipif)
13324 {
13325 	mblk_t	*mp;
13326 	ill_t	*ill = ipif->ipif_ill;
13327 
13328 	ip1dbg(("ipif_arp_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13329 	ASSERT(IAM_WRITER_IPIF(ipif));
13330 
13331 	/* Delete the mapping for the local address */
13332 	mp = ipif->ipif_arp_del_mp;
13333 	if (mp != NULL) {
13334 		ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13335 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13336 		putnext(ill->ill_rq, mp);
13337 		ipif->ipif_arp_del_mp = NULL;
13338 	}
13339 
13340 	/*
13341 	 * If this is the last ipif that is going down and there are no
13342 	 * duplicate addresses we may yet attempt to re-probe, then we need to
13343 	 * clean up ARP completely.
13344 	 */
13345 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0) {
13346 
13347 		/* Send up AR_INTERFACE_DOWN message */
13348 		mp = ill->ill_arp_down_mp;
13349 		if (mp != NULL) {
13350 			ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13351 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13352 			    ipif->ipif_id));
13353 			putnext(ill->ill_rq, mp);
13354 			ill->ill_arp_down_mp = NULL;
13355 		}
13356 
13357 		/* Tell ARP to delete the multicast mappings */
13358 		mp = ill->ill_arp_del_mapping_mp;
13359 		if (mp != NULL) {
13360 			ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13361 			    *(unsigned *)mp->b_rptr, ill->ill_name,
13362 			    ipif->ipif_id));
13363 			putnext(ill->ill_rq, mp);
13364 			ill->ill_arp_del_mapping_mp = NULL;
13365 		}
13366 	}
13367 }
13368 
13369 /*
13370  * This function sets up the multicast mappings in ARP. When ipif_resolver_up
13371  * calls this function, it passes a non-NULL arp_add_mapping_mp indicating
13372  * that it wants the add_mp allocated in this function to be returned
13373  * wihtout sending it to arp. When ip_rput_dlpi_writer calls this to
13374  * just re-do the multicast, it wants us to send the add_mp to ARP also.
13375  * ipif_resolver_up does not want us to do the "add" i.e sending to ARP,
13376  * as it does a ipif_arp_down after calling this function - which will
13377  * remove what we add here.
13378  *
13379  * Returns -1 on failures and 0 on success.
13380  */
13381 int
13382 ipif_arp_setup_multicast(ipif_t *ipif, mblk_t **arp_add_mapping_mp)
13383 {
13384 	mblk_t	*del_mp = NULL;
13385 	mblk_t *add_mp = NULL;
13386 	mblk_t *mp;
13387 	ill_t	*ill = ipif->ipif_ill;
13388 	phyint_t *phyi = ill->ill_phyint;
13389 	ipaddr_t addr, mask, extract_mask = 0;
13390 	arma_t	*arma;
13391 	uint8_t *maddr, *bphys_addr;
13392 	uint32_t hw_start;
13393 	dl_unitdata_req_t *dlur;
13394 
13395 	ASSERT(IAM_WRITER_IPIF(ipif));
13396 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13397 		return (0);
13398 
13399 	/*
13400 	 * Delete the existing mapping from ARP. Normally ipif_down
13401 	 * -> ipif_arp_down should send this up to ARP. The only
13402 	 * reason we would find this when we are switching from
13403 	 * Multicast to Broadcast where we did not do a down.
13404 	 */
13405 	mp = ill->ill_arp_del_mapping_mp;
13406 	if (mp != NULL) {
13407 		ip1dbg(("ipif_arp_down: arp cmd %x for %s:%u\n",
13408 		    *(unsigned *)mp->b_rptr, ill->ill_name, ipif->ipif_id));
13409 		putnext(ill->ill_rq, mp);
13410 		ill->ill_arp_del_mapping_mp = NULL;
13411 	}
13412 
13413 	if (arp_add_mapping_mp != NULL)
13414 		*arp_add_mapping_mp = NULL;
13415 
13416 	/*
13417 	 * Check that the address is not to long for the constant
13418 	 * length reserved in the template arma_t.
13419 	 */
13420 	if (ill->ill_phys_addr_length > IP_MAX_HW_LEN)
13421 		return (-1);
13422 
13423 	/* Add mapping mblk */
13424 	addr = (ipaddr_t)htonl(INADDR_UNSPEC_GROUP);
13425 	mask = (ipaddr_t)htonl(IN_CLASSD_NET);
13426 	add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_arma_multi_template,
13427 	    (caddr_t)&addr);
13428 	if (add_mp == NULL)
13429 		return (-1);
13430 	arma = (arma_t *)add_mp->b_rptr;
13431 	maddr = (uint8_t *)arma + arma->arma_hw_addr_offset;
13432 	bcopy(&mask, (char *)arma + arma->arma_proto_mask_offset, IP_ADDR_LEN);
13433 	arma->arma_hw_addr_length = ill->ill_phys_addr_length;
13434 
13435 	/*
13436 	 * Determine the broadcast address.
13437 	 */
13438 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
13439 	if (ill->ill_sap_length < 0)
13440 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
13441 	else
13442 		bphys_addr = (uchar_t *)dlur +
13443 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
13444 	/*
13445 	 * Check PHYI_MULTI_BCAST and length of physical
13446 	 * address to determine if we use the mapping or the
13447 	 * broadcast address.
13448 	 */
13449 	if (!(phyi->phyint_flags & PHYI_MULTI_BCAST))
13450 		if (!MEDIA_V4MINFO(ill->ill_media, ill->ill_phys_addr_length,
13451 		    bphys_addr, maddr, &hw_start, &extract_mask))
13452 			phyi->phyint_flags |= PHYI_MULTI_BCAST;
13453 
13454 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) ||
13455 	    (ill->ill_flags & ILLF_MULTICAST)) {
13456 		/* Make sure this will not match the "exact" entry. */
13457 		addr = (ipaddr_t)htonl(INADDR_ALLHOSTS_GROUP);
13458 		del_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ared_template,
13459 		    (caddr_t)&addr);
13460 		if (del_mp == NULL) {
13461 			freemsg(add_mp);
13462 			return (-1);
13463 		}
13464 		bcopy(&extract_mask, (char *)arma +
13465 		    arma->arma_proto_extract_mask_offset, IP_ADDR_LEN);
13466 		if (phyi->phyint_flags & PHYI_MULTI_BCAST) {
13467 			/* Use link-layer broadcast address for MULTI_BCAST */
13468 			bcopy(bphys_addr, maddr, ill->ill_phys_addr_length);
13469 			ip2dbg(("ipif_arp_setup_multicast: adding"
13470 			    " MULTI_BCAST ARP setup for %s\n", ill->ill_name));
13471 		} else {
13472 			arma->arma_hw_mapping_start = hw_start;
13473 			ip2dbg(("ipif_arp_setup_multicast: adding multicast"
13474 			    " ARP setup for %s\n", ill->ill_name));
13475 		}
13476 	} else {
13477 		freemsg(add_mp);
13478 		ASSERT(del_mp == NULL);
13479 		/* It is neither MULTICAST nor MULTI_BCAST */
13480 		return (0);
13481 	}
13482 	ASSERT(add_mp != NULL && del_mp != NULL);
13483 	ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13484 	ill->ill_arp_del_mapping_mp = del_mp;
13485 	if (arp_add_mapping_mp != NULL) {
13486 		/* The caller just wants the mblks allocated */
13487 		*arp_add_mapping_mp = add_mp;
13488 	} else {
13489 		/* The caller wants us to send it to arp */
13490 		putnext(ill->ill_rq, add_mp);
13491 	}
13492 	return (0);
13493 }
13494 
13495 /*
13496  * Get the resolver set up for a new interface address.
13497  * (Always called as writer.)
13498  * Called both for IPv4 and IPv6 interfaces,
13499  * though it only sets up the resolver for v6
13500  * if it's an xresolv interface (one using an external resolver).
13501  * Honors ILLF_NOARP.
13502  * The enumerated value res_act is used to tune the behavior.
13503  * If set to Res_act_initial, then we set up all the resolver
13504  * structures for a new interface.  If set to Res_act_move, then
13505  * we just send an AR_ENTRY_ADD message up to ARP for IPv4
13506  * interfaces; this is called by ip_rput_dlpi_writer() to handle
13507  * asynchronous hardware address change notification.  If set to
13508  * Res_act_defend, then we tell ARP that it needs to send a single
13509  * gratuitous message in defense of the address.
13510  * Returns error on failure.
13511  */
13512 int
13513 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
13514 {
13515 	caddr_t	addr;
13516 	mblk_t	*arp_up_mp = NULL;
13517 	mblk_t	*arp_down_mp = NULL;
13518 	mblk_t	*arp_add_mp = NULL;
13519 	mblk_t	*arp_del_mp = NULL;
13520 	mblk_t	*arp_add_mapping_mp = NULL;
13521 	mblk_t	*arp_del_mapping_mp = NULL;
13522 	ill_t	*ill = ipif->ipif_ill;
13523 	uchar_t	*area_p = NULL;
13524 	uchar_t	*ared_p = NULL;
13525 	int	err = ENOMEM;
13526 	boolean_t was_dup;
13527 
13528 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
13529 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
13530 	ASSERT(IAM_WRITER_IPIF(ipif));
13531 
13532 	was_dup = B_FALSE;
13533 	if (res_act == Res_act_initial) {
13534 		ipif->ipif_addr_ready = 0;
13535 		/*
13536 		 * We're bringing an interface up here.  There's no way that we
13537 		 * should need to shut down ARP now.
13538 		 */
13539 		mutex_enter(&ill->ill_lock);
13540 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
13541 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
13542 			ill->ill_ipif_dup_count--;
13543 			was_dup = B_TRUE;
13544 		}
13545 		mutex_exit(&ill->ill_lock);
13546 	}
13547 	if (ipif->ipif_recovery_id != 0)
13548 		(void) untimeout(ipif->ipif_recovery_id);
13549 	ipif->ipif_recovery_id = 0;
13550 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
13551 		ipif->ipif_addr_ready = 1;
13552 		return (0);
13553 	}
13554 	/* NDP will set the ipif_addr_ready flag when it's ready */
13555 	if (ill->ill_isv6 && !(ill->ill_flags & ILLF_XRESOLV))
13556 		return (0);
13557 
13558 	if (ill->ill_isv6) {
13559 		/*
13560 		 * External resolver for IPv6
13561 		 */
13562 		ASSERT(res_act == Res_act_initial);
13563 		if (!IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
13564 			addr = (caddr_t)&ipif->ipif_v6lcl_addr;
13565 			area_p = (uchar_t *)&ip6_area_template;
13566 			ared_p = (uchar_t *)&ip6_ared_template;
13567 		}
13568 	} else {
13569 		/*
13570 		 * IPv4 arp case. If the ARP stream has already started
13571 		 * closing, fail this request for ARP bringup. Else
13572 		 * record the fact that an ARP bringup is pending.
13573 		 */
13574 		mutex_enter(&ill->ill_lock);
13575 		if (ill->ill_arp_closing) {
13576 			mutex_exit(&ill->ill_lock);
13577 			err = EINVAL;
13578 			goto failed;
13579 		} else {
13580 			if (ill->ill_ipif_up_count == 0 &&
13581 			    ill->ill_ipif_dup_count == 0 && !was_dup)
13582 				ill->ill_arp_bringup_pending = 1;
13583 			mutex_exit(&ill->ill_lock);
13584 		}
13585 		if (ipif->ipif_lcl_addr != INADDR_ANY) {
13586 			addr = (caddr_t)&ipif->ipif_lcl_addr;
13587 			area_p = (uchar_t *)&ip_area_template;
13588 			ared_p = (uchar_t *)&ip_ared_template;
13589 		}
13590 	}
13591 
13592 	/*
13593 	 * Add an entry for the local address in ARP only if it
13594 	 * is not UNNUMBERED and the address is not INADDR_ANY.
13595 	 */
13596 	if (!(ipif->ipif_flags & IPIF_UNNUMBERED) && area_p != NULL) {
13597 		area_t *area;
13598 
13599 		/* Now ask ARP to publish our address. */
13600 		arp_add_mp = ill_arp_alloc(ill, area_p, addr);
13601 		if (arp_add_mp == NULL)
13602 			goto failed;
13603 		area = (area_t *)arp_add_mp->b_rptr;
13604 		if (res_act != Res_act_initial) {
13605 			/*
13606 			 * Copy the new hardware address and length into
13607 			 * arp_add_mp to be sent to ARP.
13608 			 */
13609 			area->area_hw_addr_length =
13610 			    ill->ill_phys_addr_length;
13611 			bcopy((char *)ill->ill_phys_addr,
13612 			    ((char *)area + area->area_hw_addr_offset),
13613 			    area->area_hw_addr_length);
13614 		}
13615 
13616 		area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH |
13617 		    ACE_F_MYADDR;
13618 
13619 		if (res_act == Res_act_defend) {
13620 			area->area_flags |= ACE_F_DEFEND;
13621 			/*
13622 			 * If we're just defending our address now, then
13623 			 * there's no need to set up ARP multicast mappings.
13624 			 * The publish command is enough.
13625 			 */
13626 			goto done;
13627 		}
13628 
13629 		if (res_act != Res_act_initial)
13630 			goto arp_setup_multicast;
13631 
13632 		/*
13633 		 * Allocate an ARP deletion message so we know we can tell ARP
13634 		 * when the interface goes down.
13635 		 */
13636 		arp_del_mp = ill_arp_alloc(ill, ared_p, addr);
13637 		if (arp_del_mp == NULL)
13638 			goto failed;
13639 
13640 	} else {
13641 		if (res_act != Res_act_initial)
13642 			goto done;
13643 	}
13644 	/*
13645 	 * Need to bring up ARP or setup multicast mapping only
13646 	 * when the first interface is coming UP.
13647 	 */
13648 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
13649 	    was_dup) {
13650 		goto done;
13651 	}
13652 
13653 	/*
13654 	 * Allocate an ARP down message (to be saved) and an ARP up
13655 	 * message.
13656 	 */
13657 	arp_down_mp = ill_arp_alloc(ill, (uchar_t *)&ip_ard_template, 0);
13658 	if (arp_down_mp == NULL)
13659 		goto failed;
13660 
13661 	arp_up_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aru_template, 0);
13662 	if (arp_up_mp == NULL)
13663 		goto failed;
13664 
13665 	if (ipif->ipif_flags & IPIF_POINTOPOINT)
13666 		goto done;
13667 
13668 arp_setup_multicast:
13669 	/*
13670 	 * Setup the multicast mappings. This function initializes
13671 	 * ill_arp_del_mapping_mp also. This does not need to be done for
13672 	 * IPv6.
13673 	 */
13674 	if (!ill->ill_isv6) {
13675 		err = ipif_arp_setup_multicast(ipif, &arp_add_mapping_mp);
13676 		if (err != 0)
13677 			goto failed;
13678 		ASSERT(ill->ill_arp_del_mapping_mp != NULL);
13679 		ASSERT(arp_add_mapping_mp != NULL);
13680 	}
13681 
13682 done:
13683 	if (arp_del_mp != NULL) {
13684 		ASSERT(ipif->ipif_arp_del_mp == NULL);
13685 		ipif->ipif_arp_del_mp = arp_del_mp;
13686 	}
13687 	if (arp_down_mp != NULL) {
13688 		ASSERT(ill->ill_arp_down_mp == NULL);
13689 		ill->ill_arp_down_mp = arp_down_mp;
13690 	}
13691 	if (arp_del_mapping_mp != NULL) {
13692 		ASSERT(ill->ill_arp_del_mapping_mp == NULL);
13693 		ill->ill_arp_del_mapping_mp = arp_del_mapping_mp;
13694 	}
13695 	if (arp_up_mp != NULL) {
13696 		ip1dbg(("ipif_resolver_up: ARP_UP for %s:%u\n",
13697 		    ill->ill_name, ipif->ipif_id));
13698 		putnext(ill->ill_rq, arp_up_mp);
13699 	}
13700 	if (arp_add_mp != NULL) {
13701 		ip1dbg(("ipif_resolver_up: ARP_ADD for %s:%u\n",
13702 		    ill->ill_name, ipif->ipif_id));
13703 		/*
13704 		 * If it's an extended ARP implementation, then we'll wait to
13705 		 * hear that DAD has finished before using the interface.
13706 		 */
13707 		if (!ill->ill_arp_extend)
13708 			ipif->ipif_addr_ready = 1;
13709 		putnext(ill->ill_rq, arp_add_mp);
13710 	} else {
13711 		ipif->ipif_addr_ready = 1;
13712 	}
13713 	if (arp_add_mapping_mp != NULL) {
13714 		ip1dbg(("ipif_resolver_up: MAPPING_ADD for %s:%u\n",
13715 		    ill->ill_name, ipif->ipif_id));
13716 		putnext(ill->ill_rq, arp_add_mapping_mp);
13717 	}
13718 	if (res_act != Res_act_initial)
13719 		return (0);
13720 
13721 	if (ill->ill_flags & ILLF_NOARP)
13722 		err = ill_arp_off(ill);
13723 	else
13724 		err = ill_arp_on(ill);
13725 	if (err != 0) {
13726 		ip0dbg(("ipif_resolver_up: arp_on/off failed %d\n", err));
13727 		freemsg(ipif->ipif_arp_del_mp);
13728 		freemsg(ill->ill_arp_down_mp);
13729 		freemsg(ill->ill_arp_del_mapping_mp);
13730 		ipif->ipif_arp_del_mp = NULL;
13731 		ill->ill_arp_down_mp = NULL;
13732 		ill->ill_arp_del_mapping_mp = NULL;
13733 		return (err);
13734 	}
13735 	return ((ill->ill_ipif_up_count != 0 || was_dup ||
13736 	    ill->ill_ipif_dup_count != 0) ? 0 : EINPROGRESS);
13737 
13738 failed:
13739 	ip1dbg(("ipif_resolver_up: FAILED\n"));
13740 	freemsg(arp_add_mp);
13741 	freemsg(arp_del_mp);
13742 	freemsg(arp_add_mapping_mp);
13743 	freemsg(arp_up_mp);
13744 	freemsg(arp_down_mp);
13745 	ill->ill_arp_bringup_pending = 0;
13746 	return (err);
13747 }
13748 
13749 /*
13750  * This routine restarts IPv4 duplicate address detection (DAD) when a link has
13751  * just gone back up.
13752  */
13753 static void
13754 ipif_arp_start_dad(ipif_t *ipif)
13755 {
13756 	ill_t *ill = ipif->ipif_ill;
13757 	mblk_t *arp_add_mp;
13758 	area_t *area;
13759 
13760 	if (ill->ill_net_type != IRE_IF_RESOLVER || ill->ill_arp_closing ||
13761 	    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
13762 	    ipif->ipif_lcl_addr == INADDR_ANY ||
13763 	    (arp_add_mp = ill_arp_alloc(ill, (uchar_t *)&ip_area_template,
13764 	    (char *)&ipif->ipif_lcl_addr)) == NULL) {
13765 		/*
13766 		 * If we can't contact ARP for some reason, that's not really a
13767 		 * problem.  Just send out the routing socket notification that
13768 		 * DAD completion would have done, and continue.
13769 		 */
13770 		ipif_mask_reply(ipif);
13771 		ip_rts_ifmsg(ipif);
13772 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
13773 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
13774 		ipif->ipif_addr_ready = 1;
13775 		return;
13776 	}
13777 
13778 	/* Setting the 'unverified' flag restarts DAD */
13779 	area = (area_t *)arp_add_mp->b_rptr;
13780 	area->area_flags = ACE_F_PERMANENT | ACE_F_PUBLISH | ACE_F_MYADDR |
13781 	    ACE_F_UNVERIFIED;
13782 	putnext(ill->ill_rq, arp_add_mp);
13783 }
13784 
13785 static void
13786 ipif_ndp_start_dad(ipif_t *ipif)
13787 {
13788 	nce_t *nce;
13789 
13790 	nce = ndp_lookup_v6(ipif->ipif_ill, &ipif->ipif_v6lcl_addr, B_FALSE);
13791 	if (nce == NULL)
13792 		return;
13793 
13794 	if (!ndp_restart_dad(nce)) {
13795 		/*
13796 		 * If we can't restart DAD for some reason, that's not really a
13797 		 * problem.  Just send out the routing socket notification that
13798 		 * DAD completion would have done, and continue.
13799 		 */
13800 		ip_rts_ifmsg(ipif);
13801 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
13802 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
13803 		ipif->ipif_addr_ready = 1;
13804 	}
13805 	NCE_REFRELE(nce);
13806 }
13807 
13808 /*
13809  * Restart duplicate address detection on all interfaces on the given ill.
13810  *
13811  * This is called when an interface transitions from down to up
13812  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
13813  *
13814  * Note that since the underlying physical link has transitioned, we must cause
13815  * at least one routing socket message to be sent here, either via DAD
13816  * completion or just by default on the first ipif.  (If we don't do this, then
13817  * in.mpathd will see long delays when doing link-based failure recovery.)
13818  */
13819 void
13820 ill_restart_dad(ill_t *ill, boolean_t went_up)
13821 {
13822 	ipif_t *ipif;
13823 
13824 	if (ill == NULL)
13825 		return;
13826 
13827 	/*
13828 	 * If layer two doesn't support duplicate address detection, then just
13829 	 * send the routing socket message now and be done with it.
13830 	 */
13831 	if ((ill->ill_isv6 && (ill->ill_flags & ILLF_XRESOLV)) ||
13832 	    (!ill->ill_isv6 && !ill->ill_arp_extend)) {
13833 		ip_rts_ifmsg(ill->ill_ipif);
13834 		return;
13835 	}
13836 
13837 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13838 		if (went_up) {
13839 			if (ipif->ipif_flags & IPIF_UP) {
13840 				if (ill->ill_isv6)
13841 					ipif_ndp_start_dad(ipif);
13842 				else
13843 					ipif_arp_start_dad(ipif);
13844 			} else if (ill->ill_isv6 &&
13845 			    (ipif->ipif_flags & IPIF_DUPLICATE)) {
13846 				/*
13847 				 * For IPv4, the ARP module itself will
13848 				 * automatically start the DAD process when it
13849 				 * sees DL_NOTE_LINK_UP.  We respond to the
13850 				 * AR_CN_READY at the completion of that task.
13851 				 * For IPv6, we must kick off the bring-up
13852 				 * process now.
13853 				 */
13854 				ndp_do_recovery(ipif);
13855 			} else {
13856 				/*
13857 				 * Unfortunately, the first ipif is "special"
13858 				 * and represents the underlying ill in the
13859 				 * routing socket messages.  Thus, when this
13860 				 * one ipif is down, we must still notify so
13861 				 * that the user knows the IFF_RUNNING status
13862 				 * change.  (If the first ipif is up, then
13863 				 * we'll handle eventual routing socket
13864 				 * notification via DAD completion.)
13865 				 */
13866 				if (ipif == ill->ill_ipif)
13867 					ip_rts_ifmsg(ill->ill_ipif);
13868 			}
13869 		} else {
13870 			/*
13871 			 * After link down, we'll need to send a new routing
13872 			 * message when the link comes back, so clear
13873 			 * ipif_addr_ready.
13874 			 */
13875 			ipif->ipif_addr_ready = 0;
13876 		}
13877 	}
13878 
13879 	/*
13880 	 * If we've torn down links, then notify the user right away.
13881 	 */
13882 	if (!went_up)
13883 		ip_rts_ifmsg(ill->ill_ipif);
13884 }
13885 
13886 /*
13887  * Wakeup all threads waiting to enter the ipsq, and sleeping
13888  * on any of the ills in this ipsq. The ill_lock of the ill
13889  * must be held so that waiters don't miss wakeups
13890  */
13891 static void
13892 ill_signal_ipsq_ills(ipsq_t *ipsq, boolean_t caller_holds_lock)
13893 {
13894 	phyint_t *phyint;
13895 
13896 	phyint = ipsq->ipsq_phyint_list;
13897 	while (phyint != NULL) {
13898 		if (phyint->phyint_illv4) {
13899 			if (!caller_holds_lock)
13900 				mutex_enter(&phyint->phyint_illv4->ill_lock);
13901 			ASSERT(MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
13902 			cv_broadcast(&phyint->phyint_illv4->ill_cv);
13903 			if (!caller_holds_lock)
13904 				mutex_exit(&phyint->phyint_illv4->ill_lock);
13905 		}
13906 		if (phyint->phyint_illv6) {
13907 			if (!caller_holds_lock)
13908 				mutex_enter(&phyint->phyint_illv6->ill_lock);
13909 			ASSERT(MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
13910 			cv_broadcast(&phyint->phyint_illv6->ill_cv);
13911 			if (!caller_holds_lock)
13912 				mutex_exit(&phyint->phyint_illv6->ill_lock);
13913 		}
13914 		phyint = phyint->phyint_ipsq_next;
13915 	}
13916 }
13917 
13918 static ipsq_t *
13919 ipsq_create(char *groupname)
13920 {
13921 	ipsq_t	*ipsq;
13922 
13923 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
13924 	ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP);
13925 	if (ipsq == NULL) {
13926 		return (NULL);
13927 	}
13928 
13929 	if (groupname != NULL)
13930 		(void) strcpy(ipsq->ipsq_name, groupname);
13931 	else
13932 		ipsq->ipsq_name[0] = '\0';
13933 
13934 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, NULL);
13935 	ipsq->ipsq_flags |= IPSQ_GROUP;
13936 	ipsq->ipsq_next = ipsq_g_head;
13937 	ipsq_g_head = ipsq;
13938 	return (ipsq);
13939 }
13940 
13941 /*
13942  * Return an ipsq correspoding to the groupname. If 'create' is true
13943  * allocate a new ipsq if one does not exist. Usually an ipsq is associated
13944  * uniquely with an IPMP group. However during IPMP groupname operations,
13945  * multiple IPMP groups may be associated with a single ipsq. But no
13946  * IPMP group can be associated with more than 1 ipsq at any time.
13947  * For example
13948  *	Interfaces		IPMP grpname	ipsq	ipsq_name      ipsq_refs
13949  * 	hme1, hme2		mpk17-84	ipsq1	mpk17-84	2
13950  *	hme3, hme4		mpk17-85	ipsq2	mpk17-85	2
13951  *
13952  * Now the command ifconfig hme3 group mpk17-84 results in the temporary
13953  * status shown below during the execution of the above command.
13954  * 	hme1, hme2, hme3, hme4	mpk17-84, mpk17-85	ipsq1	mpk17-84  4
13955  *
13956  * After the completion of the above groupname command we return to the stable
13957  * state shown below.
13958  * 	hme1, hme2, hme3	mpk17-84	ipsq1	mpk17-84	3
13959  *	hme4			mpk17-85	ipsq2	mpk17-85	1
13960  *
13961  * Because of the above, we don't search based on the ipsq_name since that
13962  * would miss the correct ipsq during certain windows as shown above.
13963  * The ipsq_name is only used during split of an ipsq to return the ipsq to its
13964  * natural state.
13965  */
13966 static ipsq_t *
13967 ip_ipsq_lookup(char *groupname, boolean_t create, ipsq_t *exclude_ipsq)
13968 {
13969 	ipsq_t	*ipsq;
13970 	int	group_len;
13971 	phyint_t *phyint;
13972 
13973 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
13974 
13975 	group_len = strlen(groupname);
13976 	ASSERT(group_len != 0);
13977 	group_len++;
13978 
13979 	for (ipsq = ipsq_g_head; ipsq != NULL; ipsq = ipsq->ipsq_next) {
13980 		/*
13981 		 * When an ipsq is being split, and ill_split_ipsq
13982 		 * calls this function, we exclude it from being considered.
13983 		 */
13984 		if (ipsq == exclude_ipsq)
13985 			continue;
13986 
13987 		/*
13988 		 * Compare against the ipsq_name. The groupname change happens
13989 		 * in 2 phases. The 1st phase merges the from group into
13990 		 * the to group's ipsq, by calling ill_merge_groups and restarts
13991 		 * the ioctl. The 2nd phase then locates the ipsq again thru
13992 		 * ipsq_name. At this point the phyint_groupname has not been
13993 		 * updated.
13994 		 */
13995 		if ((group_len == strlen(ipsq->ipsq_name) + 1) &&
13996 		    (bcmp(ipsq->ipsq_name, groupname, group_len) == 0)) {
13997 			/*
13998 			 * Verify that an ipmp groupname is exactly
13999 			 * part of 1 ipsq and is not found in any other
14000 			 * ipsq.
14001 			 */
14002 			ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq) ==
14003 			    NULL);
14004 			return (ipsq);
14005 		}
14006 
14007 		/*
14008 		 * Comparison against ipsq_name alone is not sufficient.
14009 		 * In the case when groups are currently being
14010 		 * merged, the ipsq could hold other IPMP groups temporarily.
14011 		 * so we walk the phyint list and compare against the
14012 		 * phyint_groupname as well.
14013 		 */
14014 		phyint = ipsq->ipsq_phyint_list;
14015 		while (phyint != NULL) {
14016 			if ((group_len == phyint->phyint_groupname_len) &&
14017 			    (bcmp(phyint->phyint_groupname, groupname,
14018 			    group_len) == 0)) {
14019 				/*
14020 				 * Verify that an ipmp groupname is exactly
14021 				 * part of 1 ipsq and is not found in any other
14022 				 * ipsq.
14023 				 */
14024 				ASSERT(ip_ipsq_lookup(groupname, B_FALSE, ipsq)
14025 					== NULL);
14026 				return (ipsq);
14027 			}
14028 			phyint = phyint->phyint_ipsq_next;
14029 		}
14030 	}
14031 	if (create)
14032 		ipsq = ipsq_create(groupname);
14033 	return (ipsq);
14034 }
14035 
14036 static void
14037 ipsq_delete(ipsq_t *ipsq)
14038 {
14039 	ipsq_t *nipsq;
14040 	ipsq_t *pipsq = NULL;
14041 
14042 	/*
14043 	 * We don't hold the ipsq lock, but we are sure no new
14044 	 * messages can land up, since the ipsq_refs is zero.
14045 	 * i.e. this ipsq is unnamed and no phyint or phyint group
14046 	 * is associated with this ipsq. (Lookups are based on ill_name
14047 	 * or phyint_group_name)
14048 	 */
14049 	ASSERT(ipsq->ipsq_refs == 0);
14050 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipsq->ipsq_mphead == NULL);
14051 	ASSERT(ipsq->ipsq_pending_mp == NULL);
14052 	if (!(ipsq->ipsq_flags & IPSQ_GROUP)) {
14053 		/*
14054 		 * This is not the ipsq of an IPMP group.
14055 		 */
14056 		kmem_free(ipsq, sizeof (ipsq_t));
14057 		return;
14058 	}
14059 
14060 	rw_enter(&ill_g_lock, RW_WRITER);
14061 
14062 	/*
14063 	 * Locate the ipsq  before we can remove it from
14064 	 * the singly linked list of ipsq's.
14065 	 */
14066 	for (nipsq = ipsq_g_head; nipsq != NULL; nipsq = nipsq->ipsq_next) {
14067 		if (nipsq == ipsq) {
14068 			break;
14069 		}
14070 		pipsq = nipsq;
14071 	}
14072 
14073 	ASSERT(nipsq == ipsq);
14074 
14075 	/* unlink ipsq from the list */
14076 	if (pipsq != NULL)
14077 		pipsq->ipsq_next = ipsq->ipsq_next;
14078 	else
14079 		ipsq_g_head = ipsq->ipsq_next;
14080 	kmem_free(ipsq, sizeof (ipsq_t));
14081 	rw_exit(&ill_g_lock);
14082 }
14083 
14084 static void
14085 ill_move_to_new_ipsq(ipsq_t *old_ipsq, ipsq_t *new_ipsq, mblk_t *current_mp,
14086     queue_t *q)
14087 
14088 {
14089 
14090 	ASSERT(MUTEX_HELD(&new_ipsq->ipsq_lock));
14091 	ASSERT(old_ipsq->ipsq_mphead == NULL && old_ipsq->ipsq_mptail == NULL);
14092 	ASSERT(old_ipsq->ipsq_pending_ipif == NULL);
14093 	ASSERT(old_ipsq->ipsq_pending_mp == NULL);
14094 	ASSERT(current_mp != NULL);
14095 
14096 	ipsq_enq(new_ipsq, q, current_mp, (ipsq_func_t)ip_process_ioctl,
14097 		NEW_OP, NULL);
14098 
14099 	ASSERT(new_ipsq->ipsq_xopq_mptail != NULL &&
14100 	    new_ipsq->ipsq_xopq_mphead != NULL);
14101 
14102 	/*
14103 	 * move from old ipsq to the new ipsq.
14104 	 */
14105 	new_ipsq->ipsq_xopq_mptail->b_next = old_ipsq->ipsq_xopq_mphead;
14106 	if (old_ipsq->ipsq_xopq_mphead != NULL)
14107 		new_ipsq->ipsq_xopq_mptail = old_ipsq->ipsq_xopq_mptail;
14108 
14109 	old_ipsq->ipsq_xopq_mphead = old_ipsq->ipsq_xopq_mptail = NULL;
14110 }
14111 
14112 void
14113 ill_group_cleanup(ill_t *ill)
14114 {
14115 	ill_t *ill_v4;
14116 	ill_t *ill_v6;
14117 	ipif_t *ipif;
14118 
14119 	ill_v4 = ill->ill_phyint->phyint_illv4;
14120 	ill_v6 = ill->ill_phyint->phyint_illv6;
14121 
14122 	if (ill_v4 != NULL) {
14123 		mutex_enter(&ill_v4->ill_lock);
14124 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
14125 		    ipif = ipif->ipif_next) {
14126 			IPIF_UNMARK_MOVING(ipif);
14127 		}
14128 		ill_v4->ill_up_ipifs = B_FALSE;
14129 		mutex_exit(&ill_v4->ill_lock);
14130 	}
14131 
14132 	if (ill_v6 != NULL) {
14133 		mutex_enter(&ill_v6->ill_lock);
14134 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
14135 		    ipif = ipif->ipif_next) {
14136 			IPIF_UNMARK_MOVING(ipif);
14137 		}
14138 		ill_v6->ill_up_ipifs = B_FALSE;
14139 		mutex_exit(&ill_v6->ill_lock);
14140 	}
14141 }
14142 /*
14143  * This function is called when an ill has had a change in its group status
14144  * to bring up all the ipifs that were up before the change.
14145  */
14146 int
14147 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
14148 {
14149 	ipif_t *ipif;
14150 	ill_t *ill_v4;
14151 	ill_t *ill_v6;
14152 	ill_t *from_ill;
14153 	int err = 0;
14154 
14155 
14156 	ASSERT(IAM_WRITER_ILL(ill));
14157 
14158 	/*
14159 	 * Except for ipif_state_flags and ill_state_flags the other
14160 	 * fields of the ipif/ill that are modified below are protected
14161 	 * implicitly since we are a writer. We would have tried to down
14162 	 * even an ipif that was already down, in ill_down_ipifs. So we
14163 	 * just blindly clear the IPIF_CHANGING flag here on all ipifs.
14164 	 */
14165 	ill_v4 = ill->ill_phyint->phyint_illv4;
14166 	ill_v6 = ill->ill_phyint->phyint_illv6;
14167 	if (ill_v4 != NULL) {
14168 		ill_v4->ill_up_ipifs = B_TRUE;
14169 		for (ipif = ill_v4->ill_ipif; ipif != NULL;
14170 		    ipif = ipif->ipif_next) {
14171 			mutex_enter(&ill_v4->ill_lock);
14172 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
14173 			IPIF_UNMARK_MOVING(ipif);
14174 			mutex_exit(&ill_v4->ill_lock);
14175 			if (ipif->ipif_was_up) {
14176 				if (!(ipif->ipif_flags & IPIF_UP))
14177 					err = ipif_up(ipif, q, mp);
14178 				ipif->ipif_was_up = B_FALSE;
14179 				if (err != 0) {
14180 					/*
14181 					 * Can there be any other error ?
14182 					 */
14183 					ASSERT(err == EINPROGRESS);
14184 					return (err);
14185 				}
14186 			}
14187 		}
14188 		mutex_enter(&ill_v4->ill_lock);
14189 		ill_v4->ill_state_flags &= ~ILL_CHANGING;
14190 		mutex_exit(&ill_v4->ill_lock);
14191 		ill_v4->ill_up_ipifs = B_FALSE;
14192 		if (ill_v4->ill_move_in_progress) {
14193 			ASSERT(ill_v4->ill_move_peer != NULL);
14194 			ill_v4->ill_move_in_progress = B_FALSE;
14195 			from_ill = ill_v4->ill_move_peer;
14196 			from_ill->ill_move_in_progress = B_FALSE;
14197 			from_ill->ill_move_peer = NULL;
14198 			mutex_enter(&from_ill->ill_lock);
14199 			from_ill->ill_state_flags &= ~ILL_CHANGING;
14200 			mutex_exit(&from_ill->ill_lock);
14201 			if (ill_v6 == NULL) {
14202 				if (from_ill->ill_phyint->phyint_flags &
14203 				    PHYI_STANDBY) {
14204 					phyint_inactive(from_ill->ill_phyint);
14205 				}
14206 				if (ill_v4->ill_phyint->phyint_flags &
14207 				    PHYI_STANDBY) {
14208 					phyint_inactive(ill_v4->ill_phyint);
14209 				}
14210 			}
14211 			ill_v4->ill_move_peer = NULL;
14212 		}
14213 	}
14214 
14215 	if (ill_v6 != NULL) {
14216 		ill_v6->ill_up_ipifs = B_TRUE;
14217 		for (ipif = ill_v6->ill_ipif; ipif != NULL;
14218 		    ipif = ipif->ipif_next) {
14219 			mutex_enter(&ill_v6->ill_lock);
14220 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
14221 			IPIF_UNMARK_MOVING(ipif);
14222 			mutex_exit(&ill_v6->ill_lock);
14223 			if (ipif->ipif_was_up) {
14224 				if (!(ipif->ipif_flags & IPIF_UP))
14225 					err = ipif_up(ipif, q, mp);
14226 				ipif->ipif_was_up = B_FALSE;
14227 				if (err != 0) {
14228 					/*
14229 					 * Can there be any other error ?
14230 					 */
14231 					ASSERT(err == EINPROGRESS);
14232 					return (err);
14233 				}
14234 			}
14235 		}
14236 		mutex_enter(&ill_v6->ill_lock);
14237 		ill_v6->ill_state_flags &= ~ILL_CHANGING;
14238 		mutex_exit(&ill_v6->ill_lock);
14239 		ill_v6->ill_up_ipifs = B_FALSE;
14240 		if (ill_v6->ill_move_in_progress) {
14241 			ASSERT(ill_v6->ill_move_peer != NULL);
14242 			ill_v6->ill_move_in_progress = B_FALSE;
14243 			from_ill = ill_v6->ill_move_peer;
14244 			from_ill->ill_move_in_progress = B_FALSE;
14245 			from_ill->ill_move_peer = NULL;
14246 			mutex_enter(&from_ill->ill_lock);
14247 			from_ill->ill_state_flags &= ~ILL_CHANGING;
14248 			mutex_exit(&from_ill->ill_lock);
14249 			if (from_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
14250 				phyint_inactive(from_ill->ill_phyint);
14251 			}
14252 			if (ill_v6->ill_phyint->phyint_flags & PHYI_STANDBY) {
14253 				phyint_inactive(ill_v6->ill_phyint);
14254 			}
14255 			ill_v6->ill_move_peer = NULL;
14256 		}
14257 	}
14258 	return (0);
14259 }
14260 
14261 /*
14262  * bring down all the approriate ipifs.
14263  */
14264 /* ARGSUSED */
14265 static void
14266 ill_down_ipifs(ill_t *ill, mblk_t *mp, int index, boolean_t chk_nofailover)
14267 {
14268 	ipif_t *ipif;
14269 
14270 	ASSERT(IAM_WRITER_ILL(ill));
14271 
14272 	/*
14273 	 * Except for ipif_state_flags the other fields of the ipif/ill that
14274 	 * are modified below are protected implicitly since we are a writer
14275 	 */
14276 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14277 		if (chk_nofailover && (ipif->ipif_flags & IPIF_NOFAILOVER))
14278 			continue;
14279 		if (index == 0 || index == ipif->ipif_orig_ifindex) {
14280 			/*
14281 			 * We go through the ipif_down logic even if the ipif
14282 			 * is already down, since routes can be added based
14283 			 * on down ipifs. Going through ipif_down once again
14284 			 * will delete any IREs created based on these routes.
14285 			 */
14286 			if (ipif->ipif_flags & IPIF_UP)
14287 				ipif->ipif_was_up = B_TRUE;
14288 			/*
14289 			 * If called with chk_nofailover true ipif is moving.
14290 			 */
14291 			mutex_enter(&ill->ill_lock);
14292 			if (chk_nofailover) {
14293 				ipif->ipif_state_flags |=
14294 					IPIF_MOVING | IPIF_CHANGING;
14295 			} else {
14296 				ipif->ipif_state_flags |= IPIF_CHANGING;
14297 			}
14298 			mutex_exit(&ill->ill_lock);
14299 			/*
14300 			 * Need to re-create net/subnet bcast ires if
14301 			 * they are dependent on ipif.
14302 			 */
14303 			if (!ipif->ipif_isv6)
14304 				ipif_check_bcast_ires(ipif);
14305 			(void) ipif_logical_down(ipif, NULL, NULL);
14306 			ipif_non_duplicate(ipif);
14307 			ipif_down_tail(ipif);
14308 			/*
14309 			 * We don't do ipif_multicast_down for IPv4 in
14310 			 * ipif_down. We need to set this so that
14311 			 * ipif_multicast_up will join the
14312 			 * ALLHOSTS_GROUP on to_ill.
14313 			 */
14314 			ipif->ipif_multicast_up = B_FALSE;
14315 		}
14316 	}
14317 }
14318 
14319 #define	IPSQ_INC_REF(ipsq)	{			\
14320 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
14321 	(ipsq)->ipsq_refs++;				\
14322 }
14323 
14324 #define	IPSQ_DEC_REF(ipsq)	{			\
14325 	ASSERT(RW_WRITE_HELD(&ill_g_lock));		\
14326 	(ipsq)->ipsq_refs--;				\
14327 	if ((ipsq)->ipsq_refs == 0)				\
14328 		(ipsq)->ipsq_name[0] = '\0'; 		\
14329 }
14330 
14331 /*
14332  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
14333  * new_ipsq.
14334  */
14335 static void
14336 ill_merge_ipsq(ipsq_t *cur_ipsq, ipsq_t *new_ipsq)
14337 {
14338 	phyint_t *phyint;
14339 	phyint_t *next_phyint;
14340 
14341 	/*
14342 	 * To change the ipsq of an ill, we need to hold the ill_g_lock as
14343 	 * writer and the ill_lock of the ill in question. Also the dest
14344 	 * ipsq can't vanish while we hold the ill_g_lock as writer.
14345 	 */
14346 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14347 
14348 	phyint = cur_ipsq->ipsq_phyint_list;
14349 	cur_ipsq->ipsq_phyint_list = NULL;
14350 	while (phyint != NULL) {
14351 		next_phyint = phyint->phyint_ipsq_next;
14352 		IPSQ_DEC_REF(cur_ipsq);
14353 		phyint->phyint_ipsq_next = new_ipsq->ipsq_phyint_list;
14354 		new_ipsq->ipsq_phyint_list = phyint;
14355 		IPSQ_INC_REF(new_ipsq);
14356 		phyint->phyint_ipsq = new_ipsq;
14357 		phyint = next_phyint;
14358 	}
14359 }
14360 
14361 #define	SPLIT_SUCCESS		0
14362 #define	SPLIT_NOT_NEEDED	1
14363 #define	SPLIT_FAILED		2
14364 
14365 int
14366 ill_split_to_grp_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq, boolean_t need_retry)
14367 {
14368 	ipsq_t *newipsq = NULL;
14369 
14370 	/*
14371 	 * Assertions denote pre-requisites for changing the ipsq of
14372 	 * a phyint
14373 	 */
14374 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14375 	/*
14376 	 * <ill-phyint> assocs can't change while ill_g_lock
14377 	 * is held as writer. See ill_phyint_reinit()
14378 	 */
14379 	ASSERT(phyint->phyint_illv4 == NULL ||
14380 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
14381 	ASSERT(phyint->phyint_illv6 == NULL ||
14382 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
14383 
14384 	if ((phyint->phyint_groupname_len !=
14385 	    (strlen(cur_ipsq->ipsq_name) + 1) ||
14386 	    bcmp(phyint->phyint_groupname, cur_ipsq->ipsq_name,
14387 	    phyint->phyint_groupname_len) != 0)) {
14388 		/*
14389 		 * Once we fail in creating a new ipsq due to memory shortage,
14390 		 * don't attempt to create new ipsq again, based on another
14391 		 * phyint, since we want all phyints belonging to an IPMP group
14392 		 * to be in the same ipsq even in the event of mem alloc fails.
14393 		 */
14394 		newipsq = ip_ipsq_lookup(phyint->phyint_groupname, !need_retry,
14395 		    cur_ipsq);
14396 		if (newipsq == NULL) {
14397 			/* Memory allocation failure */
14398 			return (SPLIT_FAILED);
14399 		} else {
14400 			/* ipsq_refs protected by ill_g_lock (writer) */
14401 			IPSQ_DEC_REF(cur_ipsq);
14402 			phyint->phyint_ipsq = newipsq;
14403 			phyint->phyint_ipsq_next = newipsq->ipsq_phyint_list;
14404 			newipsq->ipsq_phyint_list = phyint;
14405 			IPSQ_INC_REF(newipsq);
14406 			return (SPLIT_SUCCESS);
14407 		}
14408 	}
14409 	return (SPLIT_NOT_NEEDED);
14410 }
14411 
14412 /*
14413  * The ill locks of the phyint and the ill_g_lock (writer) must be held
14414  * to do this split
14415  */
14416 static int
14417 ill_split_to_own_ipsq(phyint_t *phyint, ipsq_t *cur_ipsq)
14418 {
14419 	ipsq_t *newipsq;
14420 
14421 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
14422 	/*
14423 	 * <ill-phyint> assocs can't change while ill_g_lock
14424 	 * is held as writer. See ill_phyint_reinit()
14425 	 */
14426 
14427 	ASSERT(phyint->phyint_illv4 == NULL ||
14428 	    MUTEX_HELD(&phyint->phyint_illv4->ill_lock));
14429 	ASSERT(phyint->phyint_illv6 == NULL ||
14430 	    MUTEX_HELD(&phyint->phyint_illv6->ill_lock));
14431 
14432 	if (!ipsq_init((phyint->phyint_illv4 != NULL) ?
14433 	    phyint->phyint_illv4: phyint->phyint_illv6)) {
14434 		/*
14435 		 * ipsq_init failed due to no memory
14436 		 * caller will use the same ipsq
14437 		 */
14438 		return (SPLIT_FAILED);
14439 	}
14440 
14441 	/* ipsq_ref is protected by ill_g_lock (writer) */
14442 	IPSQ_DEC_REF(cur_ipsq);
14443 
14444 	/*
14445 	 * This is a new ipsq that is unknown to the world.
14446 	 * So we don't need to hold ipsq_lock,
14447 	 */
14448 	newipsq = phyint->phyint_ipsq;
14449 	newipsq->ipsq_writer = NULL;
14450 	newipsq->ipsq_reentry_cnt--;
14451 	ASSERT(newipsq->ipsq_reentry_cnt == 0);
14452 #ifdef ILL_DEBUG
14453 	newipsq->ipsq_depth = 0;
14454 #endif
14455 
14456 	return (SPLIT_SUCCESS);
14457 }
14458 
14459 /*
14460  * Change the ipsq of all the ill's whose current ipsq is 'cur_ipsq' to
14461  * ipsq's representing their individual groups or themselves. Return
14462  * whether split needs to be retried again later.
14463  */
14464 static boolean_t
14465 ill_split_ipsq(ipsq_t *cur_ipsq)
14466 {
14467 	phyint_t *phyint;
14468 	phyint_t *next_phyint;
14469 	int	error;
14470 	boolean_t need_retry = B_FALSE;
14471 
14472 	phyint = cur_ipsq->ipsq_phyint_list;
14473 	cur_ipsq->ipsq_phyint_list = NULL;
14474 	while (phyint != NULL) {
14475 		next_phyint = phyint->phyint_ipsq_next;
14476 		/*
14477 		 * 'created' will tell us whether the callee actually
14478 		 * created an ipsq. Lack of memory may force the callee
14479 		 * to return without creating an ipsq.
14480 		 */
14481 		if (phyint->phyint_groupname == NULL) {
14482 			error = ill_split_to_own_ipsq(phyint, cur_ipsq);
14483 		} else {
14484 			error = ill_split_to_grp_ipsq(phyint, cur_ipsq,
14485 					need_retry);
14486 		}
14487 
14488 		switch (error) {
14489 		case SPLIT_FAILED:
14490 			need_retry = B_TRUE;
14491 			/* FALLTHRU */
14492 		case SPLIT_NOT_NEEDED:
14493 			/*
14494 			 * Keep it on the list.
14495 			 */
14496 			phyint->phyint_ipsq_next = cur_ipsq->ipsq_phyint_list;
14497 			cur_ipsq->ipsq_phyint_list = phyint;
14498 			break;
14499 		case SPLIT_SUCCESS:
14500 			break;
14501 		default:
14502 			ASSERT(0);
14503 		}
14504 
14505 		phyint = next_phyint;
14506 	}
14507 	return (need_retry);
14508 }
14509 
14510 /*
14511  * given an ipsq 'ipsq' lock all ills associated with this ipsq.
14512  * and return the ills in the list. This list will be
14513  * needed to unlock all the ills later on by the caller.
14514  * The <ill-ipsq> associations could change between the
14515  * lock and unlock. Hence the unlock can't traverse the
14516  * ipsq to get the list of ills.
14517  */
14518 static int
14519 ill_lock_ipsq_ills(ipsq_t *ipsq, ill_t **list, int list_max)
14520 {
14521 	int	cnt = 0;
14522 	phyint_t	*phyint;
14523 
14524 	/*
14525 	 * The caller holds ill_g_lock to ensure that the ill memberships
14526 	 * of the ipsq don't change
14527 	 */
14528 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
14529 
14530 	phyint = ipsq->ipsq_phyint_list;
14531 	while (phyint != NULL) {
14532 		if (phyint->phyint_illv4 != NULL) {
14533 			ASSERT(cnt < list_max);
14534 			list[cnt++] = phyint->phyint_illv4;
14535 		}
14536 		if (phyint->phyint_illv6 != NULL) {
14537 			ASSERT(cnt < list_max);
14538 			list[cnt++] = phyint->phyint_illv6;
14539 		}
14540 		phyint = phyint->phyint_ipsq_next;
14541 	}
14542 	ill_lock_ills(list, cnt);
14543 	return (cnt);
14544 }
14545 
14546 void
14547 ill_lock_ills(ill_t **list, int cnt)
14548 {
14549 	int	i;
14550 
14551 	if (cnt > 1) {
14552 		boolean_t try_again;
14553 		do {
14554 			try_again = B_FALSE;
14555 			for (i = 0; i < cnt - 1; i++) {
14556 				if (list[i] < list[i + 1]) {
14557 					ill_t	*tmp;
14558 
14559 					/* swap the elements */
14560 					tmp = list[i];
14561 					list[i] = list[i + 1];
14562 					list[i + 1] = tmp;
14563 					try_again = B_TRUE;
14564 				}
14565 			}
14566 		} while (try_again);
14567 	}
14568 
14569 	for (i = 0; i < cnt; i++) {
14570 		if (i == 0) {
14571 			if (list[i] != NULL)
14572 				mutex_enter(&list[i]->ill_lock);
14573 			else
14574 				return;
14575 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
14576 			mutex_enter(&list[i]->ill_lock);
14577 		}
14578 	}
14579 }
14580 
14581 void
14582 ill_unlock_ills(ill_t **list, int cnt)
14583 {
14584 	int	i;
14585 
14586 	for (i = 0; i < cnt; i++) {
14587 		if ((i == 0) && (list[i] != NULL)) {
14588 			mutex_exit(&list[i]->ill_lock);
14589 		} else if ((list[i-1] != list[i]) && (list[i] != NULL)) {
14590 			mutex_exit(&list[i]->ill_lock);
14591 		}
14592 	}
14593 }
14594 
14595 /*
14596  * Merge all the ills from 1 ipsq group into another ipsq group.
14597  * The source ipsq group is specified by the ipsq associated with
14598  * 'from_ill'. The destination ipsq group is specified by the ipsq
14599  * associated with 'to_ill' or 'groupname' respectively.
14600  * Note that ipsq itself does not have a reference count mechanism
14601  * and functions don't look up an ipsq and pass it around. Instead
14602  * functions pass around an ill or groupname, and the ipsq is looked
14603  * up from the ill or groupname and the required operation performed
14604  * atomically with the lookup on the ipsq.
14605  */
14606 static int
14607 ill_merge_groups(ill_t *from_ill, ill_t *to_ill, char *groupname, mblk_t *mp,
14608     queue_t *q)
14609 {
14610 	ipsq_t *old_ipsq;
14611 	ipsq_t *new_ipsq;
14612 	ill_t	**ill_list;
14613 	int	cnt;
14614 	size_t	ill_list_size;
14615 	boolean_t became_writer_on_new_sq = B_FALSE;
14616 
14617 	/* Exactly 1 of 'to_ill' and groupname can be specified. */
14618 	ASSERT((to_ill != NULL) ^ (groupname != NULL));
14619 
14620 	/*
14621 	 * Need to hold ill_g_lock as writer and also the ill_lock to
14622 	 * change the <ill-ipsq> assoc of an ill. Need to hold the
14623 	 * ipsq_lock to prevent new messages from landing on an ipsq.
14624 	 */
14625 	rw_enter(&ill_g_lock, RW_WRITER);
14626 
14627 	old_ipsq = from_ill->ill_phyint->phyint_ipsq;
14628 	if (groupname != NULL)
14629 		new_ipsq = ip_ipsq_lookup(groupname, B_TRUE, NULL);
14630 	else {
14631 		new_ipsq = to_ill->ill_phyint->phyint_ipsq;
14632 	}
14633 
14634 	ASSERT(old_ipsq != NULL && new_ipsq != NULL);
14635 
14636 	/*
14637 	 * both groups are on the same ipsq.
14638 	 */
14639 	if (old_ipsq == new_ipsq) {
14640 		rw_exit(&ill_g_lock);
14641 		return (0);
14642 	}
14643 
14644 	cnt = old_ipsq->ipsq_refs << 1;
14645 	ill_list_size = cnt * sizeof (ill_t *);
14646 	ill_list = kmem_zalloc(ill_list_size, KM_NOSLEEP);
14647 	if (ill_list == NULL) {
14648 		rw_exit(&ill_g_lock);
14649 		return (ENOMEM);
14650 	}
14651 	cnt = ill_lock_ipsq_ills(old_ipsq, ill_list, cnt);
14652 
14653 	/* Need ipsq lock to enque messages on new ipsq or to become writer */
14654 	mutex_enter(&new_ipsq->ipsq_lock);
14655 	if ((new_ipsq->ipsq_writer == NULL &&
14656 		new_ipsq->ipsq_current_ipif == NULL) ||
14657 	    (new_ipsq->ipsq_writer == curthread)) {
14658 		new_ipsq->ipsq_writer = curthread;
14659 		new_ipsq->ipsq_reentry_cnt++;
14660 		became_writer_on_new_sq = B_TRUE;
14661 	}
14662 
14663 	/*
14664 	 * We are holding ill_g_lock as writer and all the ill locks of
14665 	 * the old ipsq. So the old_ipsq can't be looked up, and hence no new
14666 	 * message can land up on the old ipsq even though we don't hold the
14667 	 * ipsq_lock of the old_ipsq. Now move all messages to the newipsq.
14668 	 */
14669 	ill_move_to_new_ipsq(old_ipsq, new_ipsq, mp, q);
14670 
14671 	/*
14672 	 * now change the ipsq of all ills in the 'old_ipsq' to 'new_ipsq'.
14673 	 * 'new_ipsq' has been looked up, and it can't change its <ill-ipsq>
14674 	 * assocs. till we release the ill_g_lock, and hence it can't vanish.
14675 	 */
14676 	ill_merge_ipsq(old_ipsq, new_ipsq);
14677 
14678 	/*
14679 	 * Mark the new ipsq as needing a split since it is currently
14680 	 * being shared by more than 1 IPMP group. The split will
14681 	 * occur at the end of ipsq_exit
14682 	 */
14683 	new_ipsq->ipsq_split = B_TRUE;
14684 
14685 	/* Now release all the locks */
14686 	mutex_exit(&new_ipsq->ipsq_lock);
14687 	ill_unlock_ills(ill_list, cnt);
14688 	rw_exit(&ill_g_lock);
14689 
14690 	kmem_free(ill_list, ill_list_size);
14691 
14692 	/*
14693 	 * If we succeeded in becoming writer on the new ipsq, then
14694 	 * drain the new ipsq and start processing  all enqueued messages
14695 	 * including the current ioctl we are processing which is either
14696 	 * a set groupname or failover/failback.
14697 	 */
14698 	if (became_writer_on_new_sq)
14699 		ipsq_exit(new_ipsq, B_TRUE, B_TRUE);
14700 
14701 	/*
14702 	 * syncq has been changed and all the messages have been moved.
14703 	 */
14704 	mutex_enter(&old_ipsq->ipsq_lock);
14705 	old_ipsq->ipsq_current_ipif = NULL;
14706 	mutex_exit(&old_ipsq->ipsq_lock);
14707 	return (EINPROGRESS);
14708 }
14709 
14710 /*
14711  * Delete and add the loopback copy and non-loopback copy of
14712  * the BROADCAST ire corresponding to ill and addr. Used to
14713  * group broadcast ires together when ill becomes part of
14714  * a group.
14715  *
14716  * This function is also called when ill is leaving the group
14717  * so that the ires belonging to the group gets re-grouped.
14718  */
14719 static void
14720 ill_bcast_delete_and_add(ill_t *ill, ipaddr_t addr)
14721 {
14722 	ire_t *ire, *nire, *nire_next, *ire_head = NULL;
14723 	ire_t **ire_ptpn = &ire_head;
14724 
14725 	/*
14726 	 * The loopback and non-loopback IREs are inserted in the order in which
14727 	 * they're found, on the basis that they are correctly ordered (loopback
14728 	 * first).
14729 	 */
14730 	for (;;) {
14731 		ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
14732 		    ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
14733 		if (ire == NULL)
14734 			break;
14735 
14736 		/*
14737 		 * we are passing in KM_SLEEP because it is not easy to
14738 		 * go back to a sane state in case of memory failure.
14739 		 */
14740 		nire = kmem_cache_alloc(ire_cache, KM_SLEEP);
14741 		ASSERT(nire != NULL);
14742 		bzero(nire, sizeof (ire_t));
14743 		/*
14744 		 * Don't use ire_max_frag directly since we don't
14745 		 * hold on to 'ire' until we add the new ire 'nire' and
14746 		 * we don't want the new ire to have a dangling reference
14747 		 * to 'ire'. The ire_max_frag of a broadcast ire must
14748 		 * be in sync with the ipif_mtu of the associate ipif.
14749 		 * For eg. this happens as a result of SIOCSLIFNAME,
14750 		 * SIOCSLIFLNKINFO or a DL_NOTE_SDU_SIZE inititated by
14751 		 * the driver. A change in ire_max_frag triggered as
14752 		 * as a result of path mtu discovery, or due to an
14753 		 * IP_IOC_IRE_ADVISE_NOREPLY from the transport or due a
14754 		 * route change -mtu command does not apply to broadcast ires.
14755 		 *
14756 		 * XXX We need a recovery strategy here if ire_init fails
14757 		 */
14758 		if (ire_init(nire,
14759 		    (uchar_t *)&ire->ire_addr,
14760 		    (uchar_t *)&ire->ire_mask,
14761 		    (uchar_t *)&ire->ire_src_addr,
14762 		    (uchar_t *)&ire->ire_gateway_addr,
14763 		    (uchar_t *)&ire->ire_in_src_addr,
14764 		    ire->ire_stq == NULL ? &ip_loopback_mtu :
14765 			&ire->ire_ipif->ipif_mtu,
14766 		    (ire->ire_nce != NULL ? ire->ire_nce->nce_fp_mp : NULL),
14767 		    ire->ire_rfq,
14768 		    ire->ire_stq,
14769 		    ire->ire_type,
14770 		    (ire->ire_nce != NULL? ire->ire_nce->nce_res_mp : NULL),
14771 		    ire->ire_ipif,
14772 		    ire->ire_in_ill,
14773 		    ire->ire_cmask,
14774 		    ire->ire_phandle,
14775 		    ire->ire_ihandle,
14776 		    ire->ire_flags,
14777 		    &ire->ire_uinfo,
14778 		    NULL,
14779 		    NULL) == NULL) {
14780 			cmn_err(CE_PANIC, "ire_init() failed");
14781 		}
14782 		ire_delete(ire);
14783 		ire_refrele(ire);
14784 
14785 		/*
14786 		 * The newly created IREs are inserted at the tail of the list
14787 		 * starting with ire_head. As we've just allocated them no one
14788 		 * knows about them so it's safe.
14789 		 */
14790 		*ire_ptpn = nire;
14791 		ire_ptpn = &nire->ire_next;
14792 	}
14793 
14794 	for (nire = ire_head; nire != NULL; nire = nire_next) {
14795 		int error;
14796 		ire_t *oire;
14797 		/* unlink the IRE from our list before calling ire_add() */
14798 		nire_next = nire->ire_next;
14799 		nire->ire_next = NULL;
14800 
14801 		/* ire_add adds the ire at the right place in the list */
14802 		oire = nire;
14803 		error = ire_add(&nire, NULL, NULL, NULL, B_FALSE);
14804 		ASSERT(error == 0);
14805 		ASSERT(oire == nire);
14806 		ire_refrele(nire);	/* Held in ire_add */
14807 	}
14808 }
14809 
14810 /*
14811  * This function is usually called when an ill is inserted in
14812  * a group and all the ipifs are already UP. As all the ipifs
14813  * are already UP, the broadcast ires have already been created
14814  * and been inserted. But, ire_add_v4 would not have grouped properly.
14815  * We need to re-group for the benefit of ip_wput_ire which
14816  * expects BROADCAST ires to be grouped properly to avoid sending
14817  * more than one copy of the broadcast packet per group.
14818  *
14819  * NOTE : We don't check for ill_ipif_up_count to be non-zero here
14820  *	  because when ipif_up_done ends up calling this, ires have
14821  *        already been added before illgrp_insert i.e before ill_group
14822  *	  has been initialized.
14823  */
14824 static void
14825 ill_group_bcast_for_xmit(ill_t *ill)
14826 {
14827 	ill_group_t *illgrp;
14828 	ipif_t *ipif;
14829 	ipaddr_t addr;
14830 	ipaddr_t net_mask;
14831 	ipaddr_t subnet_netmask;
14832 
14833 	illgrp = ill->ill_group;
14834 
14835 	/*
14836 	 * This function is called even when an ill is deleted from
14837 	 * the group. Hence, illgrp could be null.
14838 	 */
14839 	if (illgrp != NULL && illgrp->illgrp_ill_count == 1)
14840 		return;
14841 
14842 	/*
14843 	 * Delete all the BROADCAST ires matching this ill and add
14844 	 * them back. This time, ire_add_v4 should take care of
14845 	 * grouping them with others because ill is part of the
14846 	 * group.
14847 	 */
14848 	ill_bcast_delete_and_add(ill, 0);
14849 	ill_bcast_delete_and_add(ill, INADDR_BROADCAST);
14850 
14851 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
14852 
14853 		if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14854 		    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14855 			net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14856 		} else {
14857 			net_mask = htonl(IN_CLASSA_NET);
14858 		}
14859 		addr = net_mask & ipif->ipif_subnet;
14860 		ill_bcast_delete_and_add(ill, addr);
14861 		ill_bcast_delete_and_add(ill, ~net_mask | addr);
14862 
14863 		subnet_netmask = ipif->ipif_net_mask;
14864 		addr = ipif->ipif_subnet;
14865 		ill_bcast_delete_and_add(ill, addr);
14866 		ill_bcast_delete_and_add(ill, ~subnet_netmask | addr);
14867 	}
14868 }
14869 
14870 /*
14871  * This function is called from illgrp_delete when ill is being deleted
14872  * from the group.
14873  *
14874  * As ill is not there in the group anymore, any address belonging
14875  * to this ill should be cleared of IRE_MARK_NORECV.
14876  */
14877 static void
14878 ill_clear_bcast_mark(ill_t *ill, ipaddr_t addr)
14879 {
14880 	ire_t *ire;
14881 	irb_t *irb;
14882 
14883 	ASSERT(ill->ill_group == NULL);
14884 
14885 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, ill->ill_ipif,
14886 	    ALL_ZONES, NULL, MATCH_IRE_TYPE | MATCH_IRE_ILL);
14887 
14888 	if (ire != NULL) {
14889 		/*
14890 		 * IPMP and plumbing operations are serialized on the ipsq, so
14891 		 * no one will insert or delete a broadcast ire under our feet.
14892 		 */
14893 		irb = ire->ire_bucket;
14894 		rw_enter(&irb->irb_lock, RW_READER);
14895 		ire_refrele(ire);
14896 
14897 		for (; ire != NULL; ire = ire->ire_next) {
14898 			if (ire->ire_addr != addr)
14899 				break;
14900 			if (ire_to_ill(ire) != ill)
14901 				continue;
14902 
14903 			ASSERT(!(ire->ire_marks & IRE_MARK_CONDEMNED));
14904 			ire->ire_marks &= ~IRE_MARK_NORECV;
14905 		}
14906 		rw_exit(&irb->irb_lock);
14907 	}
14908 }
14909 
14910 /*
14911  * This function must be called only after the broadcast ires
14912  * have been grouped together. For a given address addr, nominate
14913  * only one of the ires whose interface is not FAILED or OFFLINE.
14914  *
14915  * This is also called when an ipif goes down, so that we can nominate
14916  * a different ire with the same address for receiving.
14917  */
14918 static void
14919 ill_mark_bcast(ill_group_t *illgrp, ipaddr_t addr)
14920 {
14921 	irb_t *irb;
14922 	ire_t *ire;
14923 	ire_t *ire1;
14924 	ire_t *save_ire;
14925 	ire_t **irep = NULL;
14926 	boolean_t first = B_TRUE;
14927 	ire_t *clear_ire = NULL;
14928 	ire_t *start_ire = NULL;
14929 	ire_t	*new_lb_ire;
14930 	ire_t	*new_nlb_ire;
14931 	boolean_t new_lb_ire_used = B_FALSE;
14932 	boolean_t new_nlb_ire_used = B_FALSE;
14933 	uint64_t match_flags;
14934 	uint64_t phyi_flags;
14935 	boolean_t fallback = B_FALSE;
14936 
14937 	ire = ire_ctable_lookup(addr, 0, IRE_BROADCAST, NULL, ALL_ZONES,
14938 	    NULL, MATCH_IRE_TYPE);
14939 	/*
14940 	 * We may not be able to find some ires if a previous
14941 	 * ire_create failed. This happens when an ipif goes
14942 	 * down and we are unable to create BROADCAST ires due
14943 	 * to memory failure. Thus, we have to check for NULL
14944 	 * below. This should handle the case for LOOPBACK,
14945 	 * POINTOPOINT and interfaces with some POINTOPOINT
14946 	 * logicals for which there are no BROADCAST ires.
14947 	 */
14948 	if (ire == NULL)
14949 		return;
14950 	/*
14951 	 * Currently IRE_BROADCASTS are deleted when an ipif
14952 	 * goes down which runs exclusively. Thus, setting
14953 	 * IRE_MARK_RCVD should not race with ire_delete marking
14954 	 * IRE_MARK_CONDEMNED. We grab the lock below just to
14955 	 * be consistent with other parts of the code that walks
14956 	 * a given bucket.
14957 	 */
14958 	save_ire = ire;
14959 	irb = ire->ire_bucket;
14960 	new_lb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
14961 	if (new_lb_ire == NULL) {
14962 		ire_refrele(ire);
14963 		return;
14964 	}
14965 	new_nlb_ire = kmem_cache_alloc(ire_cache, KM_NOSLEEP);
14966 	if (new_nlb_ire == NULL) {
14967 		ire_refrele(ire);
14968 		kmem_cache_free(ire_cache, new_lb_ire);
14969 		return;
14970 	}
14971 	IRB_REFHOLD(irb);
14972 	rw_enter(&irb->irb_lock, RW_WRITER);
14973 	/*
14974 	 * Get to the first ire matching the address and the
14975 	 * group. If the address does not match we are done
14976 	 * as we could not find the IRE. If the address matches
14977 	 * we should get to the first one matching the group.
14978 	 */
14979 	while (ire != NULL) {
14980 		if (ire->ire_addr != addr ||
14981 		    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
14982 			break;
14983 		}
14984 		ire = ire->ire_next;
14985 	}
14986 	match_flags = PHYI_FAILED | PHYI_INACTIVE;
14987 	start_ire = ire;
14988 redo:
14989 	while (ire != NULL && ire->ire_addr == addr &&
14990 	    ire->ire_ipif->ipif_ill->ill_group == illgrp) {
14991 		/*
14992 		 * The first ire for any address within a group
14993 		 * should always be the one with IRE_MARK_NORECV cleared
14994 		 * so that ip_wput_ire can avoid searching for one.
14995 		 * Note down the insertion point which will be used
14996 		 * later.
14997 		 */
14998 		if (first && (irep == NULL))
14999 			irep = ire->ire_ptpn;
15000 		/*
15001 		 * PHYI_FAILED is set when the interface fails.
15002 		 * This interface might have become good, but the
15003 		 * daemon has not yet detected. We should still
15004 		 * not receive on this. PHYI_OFFLINE should never
15005 		 * be picked as this has been offlined and soon
15006 		 * be removed.
15007 		 */
15008 		phyi_flags = ire->ire_ipif->ipif_ill->ill_phyint->phyint_flags;
15009 		if (phyi_flags & PHYI_OFFLINE) {
15010 			ire->ire_marks |= IRE_MARK_NORECV;
15011 			ire = ire->ire_next;
15012 			continue;
15013 		}
15014 		if (phyi_flags & match_flags) {
15015 			ire->ire_marks |= IRE_MARK_NORECV;
15016 			ire = ire->ire_next;
15017 			if ((phyi_flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
15018 			    PHYI_INACTIVE) {
15019 				fallback = B_TRUE;
15020 			}
15021 			continue;
15022 		}
15023 		if (first) {
15024 			/*
15025 			 * We will move this to the front of the list later
15026 			 * on.
15027 			 */
15028 			clear_ire = ire;
15029 			ire->ire_marks &= ~IRE_MARK_NORECV;
15030 		} else {
15031 			ire->ire_marks |= IRE_MARK_NORECV;
15032 		}
15033 		first = B_FALSE;
15034 		ire = ire->ire_next;
15035 	}
15036 	/*
15037 	 * If we never nominated anybody, try nominating at least
15038 	 * an INACTIVE, if we found one. Do it only once though.
15039 	 */
15040 	if (first && (match_flags == (PHYI_FAILED | PHYI_INACTIVE)) &&
15041 	    fallback) {
15042 		match_flags = PHYI_FAILED;
15043 		ire = start_ire;
15044 		irep = NULL;
15045 		goto redo;
15046 	}
15047 	ire_refrele(save_ire);
15048 
15049 	/*
15050 	 * irep non-NULL indicates that we entered the while loop
15051 	 * above. If clear_ire is at the insertion point, we don't
15052 	 * have to do anything. clear_ire will be NULL if all the
15053 	 * interfaces are failed.
15054 	 *
15055 	 * We cannot unlink and reinsert the ire at the right place
15056 	 * in the list since there can be other walkers of this bucket.
15057 	 * Instead we delete and recreate the ire
15058 	 */
15059 	if (clear_ire != NULL && irep != NULL && *irep != clear_ire) {
15060 		ire_t *clear_ire_stq = NULL;
15061 		mblk_t *fp_mp = NULL, *res_mp = NULL;
15062 
15063 		bzero(new_lb_ire, sizeof (ire_t));
15064 		if (clear_ire->ire_nce != NULL) {
15065 			fp_mp = clear_ire->ire_nce->nce_fp_mp;
15066 			res_mp = clear_ire->ire_nce->nce_res_mp;
15067 		}
15068 		/* XXX We need a recovery strategy here. */
15069 		if (ire_init(new_lb_ire,
15070 		    (uchar_t *)&clear_ire->ire_addr,
15071 		    (uchar_t *)&clear_ire->ire_mask,
15072 		    (uchar_t *)&clear_ire->ire_src_addr,
15073 		    (uchar_t *)&clear_ire->ire_gateway_addr,
15074 		    (uchar_t *)&clear_ire->ire_in_src_addr,
15075 		    &clear_ire->ire_max_frag,
15076 		    fp_mp,
15077 		    clear_ire->ire_rfq,
15078 		    clear_ire->ire_stq,
15079 		    clear_ire->ire_type,
15080 		    res_mp,
15081 		    clear_ire->ire_ipif,
15082 		    clear_ire->ire_in_ill,
15083 		    clear_ire->ire_cmask,
15084 		    clear_ire->ire_phandle,
15085 		    clear_ire->ire_ihandle,
15086 		    clear_ire->ire_flags,
15087 		    &clear_ire->ire_uinfo,
15088 		    NULL,
15089 		    NULL) == NULL)
15090 			cmn_err(CE_PANIC, "ire_init() failed");
15091 		if (clear_ire->ire_stq == NULL) {
15092 			ire_t *ire_next = clear_ire->ire_next;
15093 			if (ire_next != NULL &&
15094 			    ire_next->ire_stq != NULL &&
15095 			    ire_next->ire_addr == clear_ire->ire_addr &&
15096 			    ire_next->ire_ipif->ipif_ill ==
15097 			    clear_ire->ire_ipif->ipif_ill) {
15098 				clear_ire_stq = ire_next;
15099 
15100 				bzero(new_nlb_ire, sizeof (ire_t));
15101 				if (clear_ire_stq->ire_nce != NULL) {
15102 					fp_mp =
15103 					    clear_ire_stq->ire_nce->nce_fp_mp;
15104 					res_mp =
15105 					    clear_ire_stq->ire_nce->nce_res_mp;
15106 				} else {
15107 					fp_mp = res_mp = NULL;
15108 				}
15109 				/* XXX We need a recovery strategy here. */
15110 				if (ire_init(new_nlb_ire,
15111 				    (uchar_t *)&clear_ire_stq->ire_addr,
15112 				    (uchar_t *)&clear_ire_stq->ire_mask,
15113 				    (uchar_t *)&clear_ire_stq->ire_src_addr,
15114 				    (uchar_t *)&clear_ire_stq->ire_gateway_addr,
15115 				    (uchar_t *)&clear_ire_stq->ire_in_src_addr,
15116 				    &clear_ire_stq->ire_max_frag,
15117 				    fp_mp,
15118 				    clear_ire_stq->ire_rfq,
15119 				    clear_ire_stq->ire_stq,
15120 				    clear_ire_stq->ire_type,
15121 				    res_mp,
15122 				    clear_ire_stq->ire_ipif,
15123 				    clear_ire_stq->ire_in_ill,
15124 				    clear_ire_stq->ire_cmask,
15125 				    clear_ire_stq->ire_phandle,
15126 				    clear_ire_stq->ire_ihandle,
15127 				    clear_ire_stq->ire_flags,
15128 				    &clear_ire_stq->ire_uinfo,
15129 				    NULL,
15130 				    NULL) == NULL)
15131 					cmn_err(CE_PANIC, "ire_init() failed");
15132 			}
15133 		}
15134 
15135 		/*
15136 		 * Delete the ire. We can't call ire_delete() since
15137 		 * we are holding the bucket lock. We can't release the
15138 		 * bucket lock since we can't allow irep to change. So just
15139 		 * mark it CONDEMNED. The IRB_REFRELE will delete the
15140 		 * ire from the list and do the refrele.
15141 		 */
15142 		clear_ire->ire_marks |= IRE_MARK_CONDEMNED;
15143 		irb->irb_marks |= IRB_MARK_CONDEMNED;
15144 
15145 		if (clear_ire_stq != NULL) {
15146 			ire_fastpath_list_delete(
15147 			    (ill_t *)clear_ire_stq->ire_stq->q_ptr,
15148 			    clear_ire_stq);
15149 			clear_ire_stq->ire_marks |= IRE_MARK_CONDEMNED;
15150 		}
15151 
15152 		/*
15153 		 * Also take care of otherfields like ib/ob pkt count
15154 		 * etc. Need to dup them. ditto in ill_bcast_delete_and_add
15155 		 */
15156 
15157 		/* Add the new ire's. Insert at *irep */
15158 		new_lb_ire->ire_bucket = clear_ire->ire_bucket;
15159 		ire1 = *irep;
15160 		if (ire1 != NULL)
15161 			ire1->ire_ptpn = &new_lb_ire->ire_next;
15162 		new_lb_ire->ire_next = ire1;
15163 		/* Link the new one in. */
15164 		new_lb_ire->ire_ptpn = irep;
15165 		membar_producer();
15166 		*irep = new_lb_ire;
15167 		new_lb_ire_used = B_TRUE;
15168 		BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
15169 		new_lb_ire->ire_bucket->irb_ire_cnt++;
15170 		new_lb_ire->ire_ipif->ipif_ire_cnt++;
15171 
15172 		if (clear_ire_stq != NULL) {
15173 			new_nlb_ire->ire_bucket = clear_ire->ire_bucket;
15174 			irep = &new_lb_ire->ire_next;
15175 			/* Add the new ire. Insert at *irep */
15176 			ire1 = *irep;
15177 			if (ire1 != NULL)
15178 				ire1->ire_ptpn = &new_nlb_ire->ire_next;
15179 			new_nlb_ire->ire_next = ire1;
15180 			/* Link the new one in. */
15181 			new_nlb_ire->ire_ptpn = irep;
15182 			membar_producer();
15183 			*irep = new_nlb_ire;
15184 			new_nlb_ire_used = B_TRUE;
15185 			BUMP_IRE_STATS(ire_stats_v4, ire_stats_inserted);
15186 			new_nlb_ire->ire_bucket->irb_ire_cnt++;
15187 			new_nlb_ire->ire_ipif->ipif_ire_cnt++;
15188 			((ill_t *)new_nlb_ire->ire_stq->q_ptr)->ill_ire_cnt++;
15189 		}
15190 	}
15191 	rw_exit(&irb->irb_lock);
15192 	if (!new_lb_ire_used)
15193 		kmem_cache_free(ire_cache, new_lb_ire);
15194 	if (!new_nlb_ire_used)
15195 		kmem_cache_free(ire_cache, new_nlb_ire);
15196 	IRB_REFRELE(irb);
15197 }
15198 
15199 /*
15200  * Whenever an ipif goes down we have to renominate a different
15201  * broadcast ire to receive. Whenever an ipif comes up, we need
15202  * to make sure that we have only one nominated to receive.
15203  */
15204 static void
15205 ipif_renominate_bcast(ipif_t *ipif)
15206 {
15207 	ill_t *ill = ipif->ipif_ill;
15208 	ipaddr_t subnet_addr;
15209 	ipaddr_t net_addr;
15210 	ipaddr_t net_mask = 0;
15211 	ipaddr_t subnet_netmask;
15212 	ipaddr_t addr;
15213 	ill_group_t *illgrp;
15214 
15215 	illgrp = ill->ill_group;
15216 	/*
15217 	 * If this is the last ipif going down, it might take
15218 	 * the ill out of the group. In that case ipif_down ->
15219 	 * illgrp_delete takes care of doing the nomination.
15220 	 * ipif_down does not call for this case.
15221 	 */
15222 	ASSERT(illgrp != NULL);
15223 
15224 	/* There could not have been any ires associated with this */
15225 	if (ipif->ipif_subnet == 0)
15226 		return;
15227 
15228 	ill_mark_bcast(illgrp, 0);
15229 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
15230 
15231 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15232 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15233 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15234 	} else {
15235 		net_mask = htonl(IN_CLASSA_NET);
15236 	}
15237 	addr = net_mask & ipif->ipif_subnet;
15238 	ill_mark_bcast(illgrp, addr);
15239 
15240 	net_addr = ~net_mask | addr;
15241 	ill_mark_bcast(illgrp, net_addr);
15242 
15243 	subnet_netmask = ipif->ipif_net_mask;
15244 	addr = ipif->ipif_subnet;
15245 	ill_mark_bcast(illgrp, addr);
15246 
15247 	subnet_addr = ~subnet_netmask | addr;
15248 	ill_mark_bcast(illgrp, subnet_addr);
15249 }
15250 
15251 /*
15252  * Whenever we form or delete ill groups, we need to nominate one set of
15253  * BROADCAST ires for receiving in the group.
15254  *
15255  * 1) When ipif_up_done -> ilgrp_insert calls this function, BROADCAST ires
15256  *    have been added, but ill_ipif_up_count is 0. Thus, we don't assert
15257  *    for ill_ipif_up_count to be non-zero. This is the only case where
15258  *    ill_ipif_up_count is zero and we would still find the ires.
15259  *
15260  * 2) ip_sioctl_group_name/ifgrp_insert calls this function, at least one
15261  *    ipif is UP and we just have to do the nomination.
15262  *
15263  * 3) When ill_handoff_responsibility calls us, some ill has been removed
15264  *    from the group. So, we have to do the nomination.
15265  *
15266  * Because of (3), there could be just one ill in the group. But we have
15267  * to nominate still as IRE_MARK_NORCV may have been marked on this.
15268  * Thus, this function does not optimize when there is only one ill as
15269  * it is not correct for (3).
15270  */
15271 static void
15272 ill_nominate_bcast_rcv(ill_group_t *illgrp)
15273 {
15274 	ill_t *ill;
15275 	ipif_t *ipif;
15276 	ipaddr_t subnet_addr;
15277 	ipaddr_t prev_subnet_addr = 0;
15278 	ipaddr_t net_addr;
15279 	ipaddr_t prev_net_addr = 0;
15280 	ipaddr_t net_mask = 0;
15281 	ipaddr_t subnet_netmask;
15282 	ipaddr_t addr;
15283 
15284 	/*
15285 	 * When the last memeber is leaving, there is nothing to
15286 	 * nominate.
15287 	 */
15288 	if (illgrp->illgrp_ill_count == 0) {
15289 		ASSERT(illgrp->illgrp_ill == NULL);
15290 		return;
15291 	}
15292 
15293 	ill = illgrp->illgrp_ill;
15294 	ASSERT(!ill->ill_isv6);
15295 	/*
15296 	 * We assume that ires with same address and belonging to the
15297 	 * same group, has been grouped together. Nominating a *single*
15298 	 * ill in the group for sending and receiving broadcast is done
15299 	 * by making sure that the first BROADCAST ire (which will be
15300 	 * the one returned by ire_ctable_lookup for ip_rput and the
15301 	 * one that will be used in ip_wput_ire) will be the one that
15302 	 * will not have IRE_MARK_NORECV set.
15303 	 *
15304 	 * 1) ip_rput checks and discards packets received on ires marked
15305 	 *    with IRE_MARK_NORECV. Thus, we don't send up duplicate
15306 	 *    broadcast packets. We need to clear IRE_MARK_NORECV on the
15307 	 *    first ire in the group for every broadcast address in the group.
15308 	 *    ip_rput will accept packets only on the first ire i.e only
15309 	 *    one copy of the ill.
15310 	 *
15311 	 * 2) ip_wput_ire needs to send out just one copy of the broadcast
15312 	 *    packet for the whole group. It needs to send out on the ill
15313 	 *    whose ire has not been marked with IRE_MARK_NORECV. If it sends
15314 	 *    on the one marked with IRE_MARK_NORECV, ip_rput will accept
15315 	 *    the copy echoed back on other port where the ire is not marked
15316 	 *    with IRE_MARK_NORECV.
15317 	 *
15318 	 * Note that we just need to have the first IRE either loopback or
15319 	 * non-loopback (either of them may not exist if ire_create failed
15320 	 * during ipif_down) with IRE_MARK_NORECV not set. ip_rput will
15321 	 * always hit the first one and hence will always accept one copy.
15322 	 *
15323 	 * We have a broadcast ire per ill for all the unique prefixes
15324 	 * hosted on that ill. As we don't have a way of knowing the
15325 	 * unique prefixes on a given ill and hence in the whole group,
15326 	 * we just call ill_mark_bcast on all the prefixes that exist
15327 	 * in the group. For the common case of one prefix, the code
15328 	 * below optimizes by remebering the last address used for
15329 	 * markng. In the case of multiple prefixes, this will still
15330 	 * optimize depending the order of prefixes.
15331 	 *
15332 	 * The only unique address across the whole group is 0.0.0.0 and
15333 	 * 255.255.255.255 and thus we call only once. ill_mark_bcast enables
15334 	 * the first ire in the bucket for receiving and disables the
15335 	 * others.
15336 	 */
15337 	ill_mark_bcast(illgrp, 0);
15338 	ill_mark_bcast(illgrp, INADDR_BROADCAST);
15339 	for (; ill != NULL; ill = ill->ill_group_next) {
15340 
15341 		for (ipif = ill->ill_ipif; ipif != NULL;
15342 		    ipif = ipif->ipif_next) {
15343 
15344 			if (!(ipif->ipif_flags & IPIF_UP) ||
15345 			    ipif->ipif_subnet == 0) {
15346 				continue;
15347 			}
15348 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15349 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15350 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15351 			} else {
15352 				net_mask = htonl(IN_CLASSA_NET);
15353 			}
15354 			addr = net_mask & ipif->ipif_subnet;
15355 			if (prev_net_addr == 0 || prev_net_addr != addr) {
15356 				ill_mark_bcast(illgrp, addr);
15357 				net_addr = ~net_mask | addr;
15358 				ill_mark_bcast(illgrp, net_addr);
15359 			}
15360 			prev_net_addr = addr;
15361 
15362 			subnet_netmask = ipif->ipif_net_mask;
15363 			addr = ipif->ipif_subnet;
15364 			if (prev_subnet_addr == 0 ||
15365 			    prev_subnet_addr != addr) {
15366 				ill_mark_bcast(illgrp, addr);
15367 				subnet_addr = ~subnet_netmask | addr;
15368 				ill_mark_bcast(illgrp, subnet_addr);
15369 			}
15370 			prev_subnet_addr = addr;
15371 		}
15372 	}
15373 }
15374 
15375 /*
15376  * This function is called while forming ill groups.
15377  *
15378  * Currently, we handle only allmulti groups. We want to join
15379  * allmulti on only one of the ills in the groups. In future,
15380  * when we have link aggregation, we may have to join normal
15381  * multicast groups on multiple ills as switch does inbound load
15382  * balancing. Following are the functions that calls this
15383  * function :
15384  *
15385  * 1) ill_recover_multicast : Interface is coming back UP.
15386  *    When the first ipif comes back UP, ipif_up_done/ipif_up_done_v6
15387  *    will call ill_recover_multicast to recover all the multicast
15388  *    groups. We need to make sure that only one member is joined
15389  *    in the ill group.
15390  *
15391  * 2) ip_addmulti/ip_addmulti_v6 : ill groups has already been formed.
15392  *    Somebody is joining allmulti. We need to make sure that only one
15393  *    member is joined in the group.
15394  *
15395  * 3) illgrp_insert : If allmulti has already joined, we need to make
15396  *    sure that only one member is joined in the group.
15397  *
15398  * 4) ip_delmulti/ip_delmulti_v6 : Somebody in the group is leaving
15399  *    allmulti who we have nominated. We need to pick someother ill.
15400  *
15401  * 5) illgrp_delete : The ill we nominated is leaving the group,
15402  *    we need to pick a new ill to join the group.
15403  *
15404  * For (1), (2), (5) - we just have to check whether there is
15405  * a good ill joined in the group. If we could not find any ills
15406  * joined the group, we should join.
15407  *
15408  * For (4), the one that was nominated to receive, left the group.
15409  * There could be nobody joined in the group when this function is
15410  * called.
15411  *
15412  * For (3) - we need to explicitly check whether there are multiple
15413  * ills joined in the group.
15414  *
15415  * For simplicity, we don't differentiate any of the above cases. We
15416  * just leave the group if it is joined on any of them and join on
15417  * the first good ill.
15418  */
15419 int
15420 ill_nominate_mcast_rcv(ill_group_t *illgrp)
15421 {
15422 	ilm_t *ilm;
15423 	ill_t *ill;
15424 	ill_t *fallback_inactive_ill = NULL;
15425 	ill_t *fallback_failed_ill = NULL;
15426 	int ret = 0;
15427 
15428 	/*
15429 	 * Leave the allmulti on all the ills and start fresh.
15430 	 */
15431 	for (ill = illgrp->illgrp_ill; ill != NULL;
15432 	    ill = ill->ill_group_next) {
15433 		if (ill->ill_join_allmulti)
15434 			(void) ip_leave_allmulti(ill->ill_ipif);
15435 	}
15436 
15437 	/*
15438 	 * Choose a good ill. Fallback to inactive or failed if
15439 	 * none available. We need to fallback to FAILED in the
15440 	 * case where we have 2 interfaces in a group - where
15441 	 * one of them is failed and another is a good one and
15442 	 * the good one (not marked inactive) is leaving the group.
15443 	 */
15444 	ret = 0;
15445 	for (ill = illgrp->illgrp_ill; ill != NULL;
15446 	    ill = ill->ill_group_next) {
15447 		/* Never pick an offline interface */
15448 		if (ill->ill_phyint->phyint_flags & PHYI_OFFLINE)
15449 			continue;
15450 
15451 		if (ill->ill_phyint->phyint_flags & PHYI_FAILED) {
15452 			fallback_failed_ill = ill;
15453 			continue;
15454 		}
15455 		if (ill->ill_phyint->phyint_flags & PHYI_INACTIVE) {
15456 			fallback_inactive_ill = ill;
15457 			continue;
15458 		}
15459 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15460 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15461 				ret = ip_join_allmulti(ill->ill_ipif);
15462 				/*
15463 				 * ip_join_allmulti can fail because of memory
15464 				 * failures. So, make sure we join at least
15465 				 * on one ill.
15466 				 */
15467 				if (ill->ill_join_allmulti)
15468 					return (0);
15469 			}
15470 		}
15471 	}
15472 	if (ret != 0) {
15473 		/*
15474 		 * If we tried nominating above and failed to do so,
15475 		 * return error. We might have tried multiple times.
15476 		 * But, return the latest error.
15477 		 */
15478 		return (ret);
15479 	}
15480 	if ((ill = fallback_inactive_ill) != NULL) {
15481 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15482 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15483 				ret = ip_join_allmulti(ill->ill_ipif);
15484 				return (ret);
15485 			}
15486 		}
15487 	} else if ((ill = fallback_failed_ill) != NULL) {
15488 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15489 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15490 				ret = ip_join_allmulti(ill->ill_ipif);
15491 				return (ret);
15492 			}
15493 		}
15494 	}
15495 	return (0);
15496 }
15497 
15498 /*
15499  * This function is called from illgrp_delete after it is
15500  * deleted from the group to reschedule responsibilities
15501  * to a different ill.
15502  */
15503 static void
15504 ill_handoff_responsibility(ill_t *ill, ill_group_t *illgrp)
15505 {
15506 	ilm_t	*ilm;
15507 	ipif_t	*ipif;
15508 	ipaddr_t subnet_addr;
15509 	ipaddr_t net_addr;
15510 	ipaddr_t net_mask = 0;
15511 	ipaddr_t subnet_netmask;
15512 	ipaddr_t addr;
15513 
15514 	ASSERT(ill->ill_group == NULL);
15515 	/*
15516 	 * Broadcast Responsibility:
15517 	 *
15518 	 * 1. If this ill has been nominated for receiving broadcast
15519 	 * packets, we need to find a new one. Before we find a new
15520 	 * one, we need to re-group the ires that are part of this new
15521 	 * group (assumed by ill_nominate_bcast_rcv). We do this by
15522 	 * calling ill_group_bcast_for_xmit(ill) which will do the right
15523 	 * thing for us.
15524 	 *
15525 	 * 2. If this ill was not nominated for receiving broadcast
15526 	 * packets, we need to clear the IRE_MARK_NORECV flag
15527 	 * so that we continue to send up broadcast packets.
15528 	 */
15529 	if (!ill->ill_isv6) {
15530 		/*
15531 		 * Case 1 above : No optimization here. Just redo the
15532 		 * nomination.
15533 		 */
15534 		ill_group_bcast_for_xmit(ill);
15535 		ill_nominate_bcast_rcv(illgrp);
15536 
15537 		/*
15538 		 * Case 2 above : Lookup and clear IRE_MARK_NORECV.
15539 		 */
15540 		ill_clear_bcast_mark(ill, 0);
15541 		ill_clear_bcast_mark(ill, INADDR_BROADCAST);
15542 
15543 		for (ipif = ill->ill_ipif; ipif != NULL;
15544 		    ipif = ipif->ipif_next) {
15545 
15546 			if (!(ipif->ipif_flags & IPIF_UP) ||
15547 			    ipif->ipif_subnet == 0) {
15548 				continue;
15549 			}
15550 			if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
15551 			    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
15552 				net_mask = ip_net_mask(ipif->ipif_lcl_addr);
15553 			} else {
15554 				net_mask = htonl(IN_CLASSA_NET);
15555 			}
15556 			addr = net_mask & ipif->ipif_subnet;
15557 			ill_clear_bcast_mark(ill, addr);
15558 
15559 			net_addr = ~net_mask | addr;
15560 			ill_clear_bcast_mark(ill, net_addr);
15561 
15562 			subnet_netmask = ipif->ipif_net_mask;
15563 			addr = ipif->ipif_subnet;
15564 			ill_clear_bcast_mark(ill, addr);
15565 
15566 			subnet_addr = ~subnet_netmask | addr;
15567 			ill_clear_bcast_mark(ill, subnet_addr);
15568 		}
15569 	}
15570 
15571 	/*
15572 	 * Multicast Responsibility.
15573 	 *
15574 	 * If we have joined allmulti on this one, find a new member
15575 	 * in the group to join allmulti. As this ill is already part
15576 	 * of allmulti, we don't have to join on this one.
15577 	 *
15578 	 * If we have not joined allmulti on this one, there is no
15579 	 * responsibility to handoff. But we need to take new
15580 	 * responsibility i.e, join allmulti on this one if we need
15581 	 * to.
15582 	 */
15583 	if (ill->ill_join_allmulti) {
15584 		(void) ill_nominate_mcast_rcv(illgrp);
15585 	} else {
15586 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
15587 			if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
15588 				(void) ip_join_allmulti(ill->ill_ipif);
15589 				break;
15590 			}
15591 		}
15592 	}
15593 
15594 	/*
15595 	 * We intentionally do the flushing of IRE_CACHES only matching
15596 	 * on the ill and not on groups. Note that we are already deleted
15597 	 * from the group.
15598 	 *
15599 	 * This will make sure that all IRE_CACHES whose stq is pointing
15600 	 * at ill_wq or ire_ipif->ipif_ill pointing at this ill will get
15601 	 * deleted and IRE_CACHES that are not pointing at this ill will
15602 	 * be left alone.
15603 	 */
15604 	if (ill->ill_isv6) {
15605 		ire_walk_ill_v6(MATCH_IRE_ILL | MATCH_IRE_TYPE,
15606 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
15607 	} else {
15608 		ire_walk_ill_v4(MATCH_IRE_ILL | MATCH_IRE_TYPE,
15609 		    IRE_CACHE, illgrp_cache_delete, (char *)ill, ill);
15610 	}
15611 
15612 	/*
15613 	 * Some conn may have cached one of the IREs deleted above. By removing
15614 	 * the ire reference, we clean up the extra reference to the ill held in
15615 	 * ire->ire_stq.
15616 	 */
15617 	ipcl_walk(conn_cleanup_stale_ire, NULL);
15618 
15619 	/*
15620 	 * Re-do source address selection for all the members in the
15621 	 * group, if they borrowed source address from one of the ipifs
15622 	 * in this ill.
15623 	 */
15624 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15625 		if (ill->ill_isv6) {
15626 			ipif_update_other_ipifs_v6(ipif, illgrp);
15627 		} else {
15628 			ipif_update_other_ipifs(ipif, illgrp);
15629 		}
15630 	}
15631 }
15632 
15633 /*
15634  * Delete the ill from the group. The caller makes sure that it is
15635  * in a group and it okay to delete from the group. So, we always
15636  * delete here.
15637  */
15638 static void
15639 illgrp_delete(ill_t *ill)
15640 {
15641 	ill_group_t *illgrp;
15642 	ill_group_t *tmpg;
15643 	ill_t *tmp_ill;
15644 
15645 	/*
15646 	 * Reset illgrp_ill_schednext if it was pointing at us.
15647 	 * We need to do this before we set ill_group to NULL.
15648 	 */
15649 	rw_enter(&ill_g_lock, RW_WRITER);
15650 	mutex_enter(&ill->ill_lock);
15651 
15652 	illgrp_reset_schednext(ill);
15653 
15654 	illgrp = ill->ill_group;
15655 
15656 	/* Delete the ill from illgrp. */
15657 	if (illgrp->illgrp_ill == ill) {
15658 		illgrp->illgrp_ill = ill->ill_group_next;
15659 	} else {
15660 		tmp_ill = illgrp->illgrp_ill;
15661 		while (tmp_ill->ill_group_next != ill) {
15662 			tmp_ill = tmp_ill->ill_group_next;
15663 			ASSERT(tmp_ill != NULL);
15664 		}
15665 		tmp_ill->ill_group_next = ill->ill_group_next;
15666 	}
15667 	ill->ill_group = NULL;
15668 	ill->ill_group_next = NULL;
15669 
15670 	illgrp->illgrp_ill_count--;
15671 	mutex_exit(&ill->ill_lock);
15672 	rw_exit(&ill_g_lock);
15673 
15674 	/*
15675 	 * As this ill is leaving the group, we need to hand off
15676 	 * the responsibilities to the other ills in the group, if
15677 	 * this ill had some responsibilities.
15678 	 */
15679 
15680 	ill_handoff_responsibility(ill, illgrp);
15681 
15682 	rw_enter(&ill_g_lock, RW_WRITER);
15683 
15684 	if (illgrp->illgrp_ill_count == 0) {
15685 
15686 		ASSERT(illgrp->illgrp_ill == NULL);
15687 		if (ill->ill_isv6) {
15688 			if (illgrp == illgrp_head_v6) {
15689 				illgrp_head_v6 = illgrp->illgrp_next;
15690 			} else {
15691 				tmpg = illgrp_head_v6;
15692 				while (tmpg->illgrp_next != illgrp) {
15693 					tmpg = tmpg->illgrp_next;
15694 					ASSERT(tmpg != NULL);
15695 				}
15696 				tmpg->illgrp_next = illgrp->illgrp_next;
15697 			}
15698 		} else {
15699 			if (illgrp == illgrp_head_v4) {
15700 				illgrp_head_v4 = illgrp->illgrp_next;
15701 			} else {
15702 				tmpg = illgrp_head_v4;
15703 				while (tmpg->illgrp_next != illgrp) {
15704 					tmpg = tmpg->illgrp_next;
15705 					ASSERT(tmpg != NULL);
15706 				}
15707 				tmpg->illgrp_next = illgrp->illgrp_next;
15708 			}
15709 		}
15710 		mutex_destroy(&illgrp->illgrp_lock);
15711 		mi_free(illgrp);
15712 	}
15713 	rw_exit(&ill_g_lock);
15714 
15715 	/*
15716 	 * Even though the ill is out of the group its not necessary
15717 	 * to set ipsq_split as TRUE as the ipifs could be down temporarily
15718 	 * We will split the ipsq when phyint_groupname is set to NULL.
15719 	 */
15720 
15721 	/*
15722 	 * Send a routing sockets message if we are deleting from
15723 	 * groups with names.
15724 	 */
15725 	if (ill->ill_phyint->phyint_groupname_len != 0)
15726 		ip_rts_ifmsg(ill->ill_ipif);
15727 }
15728 
15729 /*
15730  * Re-do source address selection. This is normally called when
15731  * an ill joins the group or when a non-NOLOCAL/DEPRECATED/ANYCAST
15732  * ipif comes up.
15733  */
15734 void
15735 ill_update_source_selection(ill_t *ill)
15736 {
15737 	ipif_t *ipif;
15738 
15739 	ASSERT(IAM_WRITER_ILL(ill));
15740 
15741 	if (ill->ill_group != NULL)
15742 		ill = ill->ill_group->illgrp_ill;
15743 
15744 	for (; ill != NULL; ill = ill->ill_group_next) {
15745 		for (ipif = ill->ill_ipif; ipif != NULL;
15746 		    ipif = ipif->ipif_next) {
15747 			if (ill->ill_isv6)
15748 				ipif_recreate_interface_routes_v6(NULL, ipif);
15749 			else
15750 				ipif_recreate_interface_routes(NULL, ipif);
15751 		}
15752 	}
15753 }
15754 
15755 /*
15756  * Insert ill in a group headed by illgrp_head. The caller can either
15757  * pass a groupname in which case we search for a group with the
15758  * same name to insert in or pass a group to insert in. This function
15759  * would only search groups with names.
15760  *
15761  * NOTE : The caller should make sure that there is at least one ipif
15762  *	  UP on this ill so that illgrp_scheduler can pick this ill
15763  *	  for outbound packets. If ill_ipif_up_count is zero, we have
15764  *	  already sent a DL_UNBIND to the driver and we don't want to
15765  *	  send anymore packets. We don't assert for ipif_up_count
15766  *	  to be greater than zero, because ipif_up_done wants to call
15767  *	  this function before bumping up the ipif_up_count. See
15768  *	  ipif_up_done() for details.
15769  */
15770 int
15771 illgrp_insert(ill_group_t **illgrp_head, ill_t *ill, char *groupname,
15772     ill_group_t *grp_to_insert, boolean_t ipif_is_coming_up)
15773 {
15774 	ill_group_t *illgrp;
15775 	ill_t *prev_ill;
15776 	phyint_t *phyi;
15777 
15778 	ASSERT(ill->ill_group == NULL);
15779 
15780 	rw_enter(&ill_g_lock, RW_WRITER);
15781 	mutex_enter(&ill->ill_lock);
15782 
15783 	if (groupname != NULL) {
15784 		/*
15785 		 * Look for a group with a matching groupname to insert.
15786 		 */
15787 		for (illgrp = *illgrp_head; illgrp != NULL;
15788 		    illgrp = illgrp->illgrp_next) {
15789 
15790 			ill_t *tmp_ill;
15791 
15792 			/*
15793 			 * If we have an ill_group_t in the list which has
15794 			 * no ill_t assigned then we must be in the process of
15795 			 * removing this group. We skip this as illgrp_delete()
15796 			 * will remove it from the list.
15797 			 */
15798 			if ((tmp_ill = illgrp->illgrp_ill) == NULL) {
15799 				ASSERT(illgrp->illgrp_ill_count == 0);
15800 				continue;
15801 			}
15802 
15803 			ASSERT(tmp_ill->ill_phyint != NULL);
15804 			phyi = tmp_ill->ill_phyint;
15805 			/*
15806 			 * Look at groups which has names only.
15807 			 */
15808 			if (phyi->phyint_groupname_len == 0)
15809 				continue;
15810 			/*
15811 			 * Names are stored in the phyint common to both
15812 			 * IPv4 and IPv6.
15813 			 */
15814 			if (mi_strcmp(phyi->phyint_groupname,
15815 			    groupname) == 0) {
15816 				break;
15817 			}
15818 		}
15819 	} else {
15820 		/*
15821 		 * If the caller passes in a NULL "grp_to_insert", we
15822 		 * allocate one below and insert this singleton.
15823 		 */
15824 		illgrp = grp_to_insert;
15825 	}
15826 
15827 	ill->ill_group_next = NULL;
15828 
15829 	if (illgrp == NULL) {
15830 		illgrp = (ill_group_t *)mi_zalloc(sizeof (ill_group_t));
15831 		if (illgrp == NULL) {
15832 			return (ENOMEM);
15833 		}
15834 		illgrp->illgrp_next = *illgrp_head;
15835 		*illgrp_head = illgrp;
15836 		illgrp->illgrp_ill = ill;
15837 		illgrp->illgrp_ill_count = 1;
15838 		ill->ill_group = illgrp;
15839 		/*
15840 		 * Used in illgrp_scheduler to protect multiple threads
15841 		 * from traversing the list.
15842 		 */
15843 		mutex_init(&illgrp->illgrp_lock, NULL, MUTEX_DEFAULT, 0);
15844 	} else {
15845 		ASSERT(ill->ill_net_type ==
15846 		    illgrp->illgrp_ill->ill_net_type);
15847 		ASSERT(ill->ill_type == illgrp->illgrp_ill->ill_type);
15848 
15849 		/* Insert ill at tail of this group */
15850 		prev_ill = illgrp->illgrp_ill;
15851 		while (prev_ill->ill_group_next != NULL)
15852 			prev_ill = prev_ill->ill_group_next;
15853 		prev_ill->ill_group_next = ill;
15854 		ill->ill_group = illgrp;
15855 		illgrp->illgrp_ill_count++;
15856 		/*
15857 		 * Inherit group properties. Currently only forwarding
15858 		 * is the property we try to keep the same with all the
15859 		 * ills. When there are more, we will abstract this into
15860 		 * a function.
15861 		 */
15862 		ill->ill_flags &= ~ILLF_ROUTER;
15863 		ill->ill_flags |= (illgrp->illgrp_ill->ill_flags & ILLF_ROUTER);
15864 	}
15865 	mutex_exit(&ill->ill_lock);
15866 	rw_exit(&ill_g_lock);
15867 
15868 	/*
15869 	 * 1) When ipif_up_done() calls this function, ipif_up_count
15870 	 *    may be zero as it has not yet been bumped. But the ires
15871 	 *    have already been added. So, we do the nomination here
15872 	 *    itself. But, when ip_sioctl_groupname calls this, it checks
15873 	 *    for ill_ipif_up_count != 0. Thus we don't check for
15874 	 *    ill_ipif_up_count here while nominating broadcast ires for
15875 	 *    receive.
15876 	 *
15877 	 * 2) Similarly, we need to call ill_group_bcast_for_xmit here
15878 	 *    to group them properly as ire_add() has already happened
15879 	 *    in the ipif_up_done() case. For ip_sioctl_groupname/ifgrp_insert
15880 	 *    case, we need to do it here anyway.
15881 	 */
15882 	if (!ill->ill_isv6) {
15883 		ill_group_bcast_for_xmit(ill);
15884 		ill_nominate_bcast_rcv(illgrp);
15885 	}
15886 
15887 	if (!ipif_is_coming_up) {
15888 		/*
15889 		 * When ipif_up_done() calls this function, the multicast
15890 		 * groups have not been joined yet. So, there is no point in
15891 		 * nomination. ip_join_allmulti will handle groups when
15892 		 * ill_recover_multicast is called from ipif_up_done() later.
15893 		 */
15894 		(void) ill_nominate_mcast_rcv(illgrp);
15895 		/*
15896 		 * ipif_up_done calls ill_update_source_selection
15897 		 * anyway. Moreover, we don't want to re-create
15898 		 * interface routes while ipif_up_done() still has reference
15899 		 * to them. Refer to ipif_up_done() for more details.
15900 		 */
15901 		ill_update_source_selection(ill);
15902 	}
15903 
15904 	/*
15905 	 * Send a routing sockets message if we are inserting into
15906 	 * groups with names.
15907 	 */
15908 	if (groupname != NULL)
15909 		ip_rts_ifmsg(ill->ill_ipif);
15910 	return (0);
15911 }
15912 
15913 /*
15914  * Return the first phyint matching the groupname. There could
15915  * be more than one when there are ill groups.
15916  *
15917  * Needs work: called only from ip_sioctl_groupname
15918  */
15919 static phyint_t *
15920 phyint_lookup_group(char *groupname)
15921 {
15922 	phyint_t *phyi;
15923 
15924 	ASSERT(RW_LOCK_HELD(&ill_g_lock));
15925 	/*
15926 	 * Group names are stored in the phyint - a common structure
15927 	 * to both IPv4 and IPv6.
15928 	 */
15929 	phyi = avl_first(&phyint_g_list.phyint_list_avl_by_index);
15930 	for (; phyi != NULL;
15931 	    phyi = avl_walk(&phyint_g_list.phyint_list_avl_by_index,
15932 	    phyi, AVL_AFTER)) {
15933 		if (phyi->phyint_groupname_len == 0)
15934 			continue;
15935 		ASSERT(phyi->phyint_groupname != NULL);
15936 		if (mi_strcmp(groupname, phyi->phyint_groupname) == 0)
15937 			return (phyi);
15938 	}
15939 	return (NULL);
15940 }
15941 
15942 
15943 
15944 /*
15945  * MT notes on creation and deletion of IPMP groups
15946  *
15947  * Creation and deletion of IPMP groups introduce the need to merge or
15948  * split the associated serialization objects i.e the ipsq's. Normally all
15949  * the ills in an IPMP group would map to a single ipsq. If IPMP is not enabled
15950  * an ill-pair(v4, v6) i.e. phyint would map to a single ipsq. However during
15951  * the execution of the SIOCSLIFGROUPNAME command the picture changes. There
15952  * is a need to change the <ill-ipsq> association and we have to operate on both
15953  * the source and destination IPMP groups. For eg. attempting to set the
15954  * groupname of hme0 to mpk17-85 when it already belongs to mpk17-84 has to
15955  * handle 2 IPMP groups and 2 ipsqs. All the ills belonging to either of the
15956  * source or destination IPMP group are mapped to a single ipsq for executing
15957  * the SIOCSLIFGROUPNAME command. This is termed as a merge of the ipsq's.
15958  * The <ill-ipsq> mapping is restored back to normal at a later point. This is
15959  * termed as a split of the ipsq. The converse of the merge i.e. a split of the
15960  * ipsq happens while unwinding from ipsq_exit. If at least 1 set groupname
15961  * occurred on the ipsq, then the ipsq_split flag is set. This indicates the
15962  * ipsq has to be examined for redoing the <ill-ipsq> associations.
15963  *
15964  * In the above example the ioctl handling code locates the current ipsq of hme0
15965  * which is ipsq(mpk17-84). It then enters the above ipsq immediately or
15966  * eventually (after queueing the ioctl in ipsq(mpk17-84)). Then it locates
15967  * the destination ipsq which is ipsq(mpk17-85) and merges the source ipsq into
15968  * the destination ipsq. If the destination ipsq is not busy, it also enters
15969  * the destination ipsq exclusively. Now the actual groupname setting operation
15970  * can proceed. If the destination ipsq is busy, the operation is enqueued
15971  * on the destination (merged) ipsq and will be handled in the unwind from
15972  * ipsq_exit.
15973  *
15974  * To prevent other threads accessing the ill while the group name change is
15975  * in progres, we bring down the ipifs which also removes the ill from the
15976  * group. The group is changed in phyint and when the first ipif on the ill
15977  * is brought up, the ill is inserted into the right IPMP group by
15978  * illgrp_insert.
15979  */
15980 /* ARGSUSED */
15981 int
15982 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15983     ip_ioctl_cmd_t *ipip, void *ifreq)
15984 {
15985 	int i;
15986 	char *tmp;
15987 	int namelen;
15988 	ill_t *ill = ipif->ipif_ill;
15989 	ill_t *ill_v4, *ill_v6;
15990 	int err = 0;
15991 	phyint_t *phyi;
15992 	phyint_t *phyi_tmp;
15993 	struct lifreq *lifr;
15994 	mblk_t	*mp1;
15995 	char *groupname;
15996 	ipsq_t *ipsq;
15997 
15998 	ASSERT(IAM_WRITER_IPIF(ipif));
15999 
16000 	/* Existance verified in ip_wput_nondata */
16001 	mp1 = mp->b_cont->b_cont;
16002 	lifr = (struct lifreq *)mp1->b_rptr;
16003 	groupname = lifr->lifr_groupname;
16004 
16005 	if (ipif->ipif_id != 0)
16006 		return (EINVAL);
16007 
16008 	phyi = ill->ill_phyint;
16009 	ASSERT(phyi != NULL);
16010 
16011 	if (phyi->phyint_flags & PHYI_VIRTUAL)
16012 		return (EINVAL);
16013 
16014 	tmp = groupname;
16015 	for (i = 0; i < LIFNAMSIZ && *tmp != '\0'; tmp++, i++)
16016 		;
16017 
16018 	if (i == LIFNAMSIZ) {
16019 		/* no null termination */
16020 		return (EINVAL);
16021 	}
16022 
16023 	/*
16024 	 * Calculate the namelen exclusive of the null
16025 	 * termination character.
16026 	 */
16027 	namelen = tmp - groupname;
16028 
16029 	ill_v4 = phyi->phyint_illv4;
16030 	ill_v6 = phyi->phyint_illv6;
16031 
16032 	/*
16033 	 * ILL cannot be part of a usesrc group and and IPMP group at the
16034 	 * same time. No need to grab the ill_g_usesrc_lock here, see
16035 	 * synchronization notes in ip.c
16036 	 */
16037 	if (ipif->ipif_ill->ill_usesrc_grp_next != NULL) {
16038 		return (EINVAL);
16039 	}
16040 
16041 	/*
16042 	 * mark the ill as changing.
16043 	 * this should queue all new requests on the syncq.
16044 	 */
16045 	GRAB_ILL_LOCKS(ill_v4, ill_v6);
16046 
16047 	if (ill_v4 != NULL)
16048 		ill_v4->ill_state_flags |= ILL_CHANGING;
16049 	if (ill_v6 != NULL)
16050 		ill_v6->ill_state_flags |= ILL_CHANGING;
16051 	RELEASE_ILL_LOCKS(ill_v4, ill_v6);
16052 
16053 	if (namelen == 0) {
16054 		/*
16055 		 * Null string means remove this interface from the
16056 		 * existing group.
16057 		 */
16058 		if (phyi->phyint_groupname_len == 0) {
16059 			/*
16060 			 * Never was in a group.
16061 			 */
16062 			err = 0;
16063 			goto done;
16064 		}
16065 
16066 		/*
16067 		 * IPv4 or IPv6 may be temporarily out of the group when all
16068 		 * the ipifs are down. Thus, we need to check for ill_group to
16069 		 * be non-NULL.
16070 		 */
16071 		if (ill_v4 != NULL && ill_v4->ill_group != NULL) {
16072 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
16073 			mutex_enter(&ill_v4->ill_lock);
16074 			if (!ill_is_quiescent(ill_v4)) {
16075 				/*
16076 				 * ipsq_pending_mp_add will not fail since
16077 				 * connp is NULL
16078 				 */
16079 				(void) ipsq_pending_mp_add(NULL,
16080 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
16081 				mutex_exit(&ill_v4->ill_lock);
16082 				err = EINPROGRESS;
16083 				goto done;
16084 			}
16085 			mutex_exit(&ill_v4->ill_lock);
16086 		}
16087 
16088 		if (ill_v6 != NULL && ill_v6->ill_group != NULL) {
16089 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
16090 			mutex_enter(&ill_v6->ill_lock);
16091 			if (!ill_is_quiescent(ill_v6)) {
16092 				(void) ipsq_pending_mp_add(NULL,
16093 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
16094 				mutex_exit(&ill_v6->ill_lock);
16095 				err = EINPROGRESS;
16096 				goto done;
16097 			}
16098 			mutex_exit(&ill_v6->ill_lock);
16099 		}
16100 
16101 		rw_enter(&ill_g_lock, RW_WRITER);
16102 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
16103 		mutex_enter(&phyi->phyint_lock);
16104 		ASSERT(phyi->phyint_groupname != NULL);
16105 		mi_free(phyi->phyint_groupname);
16106 		phyi->phyint_groupname = NULL;
16107 		phyi->phyint_groupname_len = 0;
16108 		mutex_exit(&phyi->phyint_lock);
16109 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
16110 		rw_exit(&ill_g_lock);
16111 		err = ill_up_ipifs(ill, q, mp);
16112 
16113 		/*
16114 		 * set the split flag so that the ipsq can be split
16115 		 */
16116 		mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
16117 		phyi->phyint_ipsq->ipsq_split = B_TRUE;
16118 		mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
16119 
16120 	} else {
16121 		if (phyi->phyint_groupname_len != 0) {
16122 			ASSERT(phyi->phyint_groupname != NULL);
16123 			/* Are we inserting in the same group ? */
16124 			if (mi_strcmp(groupname,
16125 			    phyi->phyint_groupname) == 0) {
16126 				err = 0;
16127 				goto done;
16128 			}
16129 		}
16130 
16131 		rw_enter(&ill_g_lock, RW_READER);
16132 		/*
16133 		 * Merge ipsq for the group's.
16134 		 * This check is here as multiple groups/ills might be
16135 		 * sharing the same ipsq.
16136 		 * If we have to merege than the operation is restarted
16137 		 * on the new ipsq.
16138 		 */
16139 		ipsq = ip_ipsq_lookup(groupname, B_FALSE, NULL);
16140 		if (phyi->phyint_ipsq != ipsq) {
16141 			rw_exit(&ill_g_lock);
16142 			err = ill_merge_groups(ill, NULL, groupname, mp, q);
16143 			goto done;
16144 		}
16145 		/*
16146 		 * Running exclusive on new ipsq.
16147 		 */
16148 
16149 		ASSERT(ipsq != NULL);
16150 		ASSERT(ipsq->ipsq_writer == curthread);
16151 
16152 		/*
16153 		 * Check whether the ill_type and ill_net_type matches before
16154 		 * we allocate any memory so that the cleanup is easier.
16155 		 *
16156 		 * We can't group dissimilar ones as we can't load spread
16157 		 * packets across the group because of potential link-level
16158 		 * header differences.
16159 		 */
16160 		phyi_tmp = phyint_lookup_group(groupname);
16161 		if (phyi_tmp != NULL) {
16162 			if ((ill_v4 != NULL &&
16163 			    phyi_tmp->phyint_illv4 != NULL) &&
16164 			    ((ill_v4->ill_net_type !=
16165 			    phyi_tmp->phyint_illv4->ill_net_type) ||
16166 			    (ill_v4->ill_type !=
16167 			    phyi_tmp->phyint_illv4->ill_type))) {
16168 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
16169 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
16170 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
16171 				rw_exit(&ill_g_lock);
16172 				return (EINVAL);
16173 			}
16174 			if ((ill_v6 != NULL &&
16175 			    phyi_tmp->phyint_illv6 != NULL) &&
16176 			    ((ill_v6->ill_net_type !=
16177 			    phyi_tmp->phyint_illv6->ill_net_type) ||
16178 			    (ill_v6->ill_type !=
16179 			    phyi_tmp->phyint_illv6->ill_type))) {
16180 				mutex_enter(&phyi->phyint_ipsq->ipsq_lock);
16181 				phyi->phyint_ipsq->ipsq_split = B_TRUE;
16182 				mutex_exit(&phyi->phyint_ipsq->ipsq_lock);
16183 				rw_exit(&ill_g_lock);
16184 				return (EINVAL);
16185 			}
16186 		}
16187 
16188 		rw_exit(&ill_g_lock);
16189 
16190 		/*
16191 		 * bring down all v4 ipifs.
16192 		 */
16193 		if (ill_v4 != NULL) {
16194 			ill_down_ipifs(ill_v4, mp, 0, B_FALSE);
16195 		}
16196 
16197 		/*
16198 		 * bring down all v6 ipifs.
16199 		 */
16200 		if (ill_v6 != NULL) {
16201 			ill_down_ipifs(ill_v6, mp, 0, B_FALSE);
16202 		}
16203 
16204 		/*
16205 		 * make sure all ipifs are down and there are no active
16206 		 * references. Call to ipsq_pending_mp_add will not fail
16207 		 * since connp is NULL.
16208 		 */
16209 		if (ill_v4 != NULL) {
16210 			mutex_enter(&ill_v4->ill_lock);
16211 			if (!ill_is_quiescent(ill_v4)) {
16212 				(void) ipsq_pending_mp_add(NULL,
16213 				    ill_v4->ill_ipif, q, mp, ILL_DOWN);
16214 				mutex_exit(&ill_v4->ill_lock);
16215 				err = EINPROGRESS;
16216 				goto done;
16217 			}
16218 			mutex_exit(&ill_v4->ill_lock);
16219 		}
16220 
16221 		if (ill_v6 != NULL) {
16222 			mutex_enter(&ill_v6->ill_lock);
16223 			if (!ill_is_quiescent(ill_v6)) {
16224 				(void) ipsq_pending_mp_add(NULL,
16225 				    ill_v6->ill_ipif, q, mp, ILL_DOWN);
16226 				mutex_exit(&ill_v6->ill_lock);
16227 				err = EINPROGRESS;
16228 				goto done;
16229 			}
16230 			mutex_exit(&ill_v6->ill_lock);
16231 		}
16232 
16233 		/*
16234 		 * allocate including space for null terminator
16235 		 * before we insert.
16236 		 */
16237 		tmp = (char *)mi_alloc(namelen + 1, BPRI_MED);
16238 		if (tmp == NULL)
16239 			return (ENOMEM);
16240 
16241 		rw_enter(&ill_g_lock, RW_WRITER);
16242 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
16243 		mutex_enter(&phyi->phyint_lock);
16244 		if (phyi->phyint_groupname_len != 0) {
16245 			ASSERT(phyi->phyint_groupname != NULL);
16246 			mi_free(phyi->phyint_groupname);
16247 		}
16248 
16249 		/*
16250 		 * setup the new group name.
16251 		 */
16252 		phyi->phyint_groupname = tmp;
16253 		bcopy(groupname, phyi->phyint_groupname, namelen + 1);
16254 		phyi->phyint_groupname_len = namelen + 1;
16255 		mutex_exit(&phyi->phyint_lock);
16256 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
16257 		rw_exit(&ill_g_lock);
16258 
16259 		err = ill_up_ipifs(ill, q, mp);
16260 	}
16261 
16262 done:
16263 	/*
16264 	 *  normally ILL_CHANGING is cleared in ill_up_ipifs.
16265 	 */
16266 	if (err != EINPROGRESS) {
16267 		GRAB_ILL_LOCKS(ill_v4, ill_v6);
16268 		if (ill_v4 != NULL)
16269 			ill_v4->ill_state_flags &= ~ILL_CHANGING;
16270 		if (ill_v6 != NULL)
16271 			ill_v6->ill_state_flags &= ~ILL_CHANGING;
16272 		RELEASE_ILL_LOCKS(ill_v4, ill_v6);
16273 	}
16274 	return (err);
16275 }
16276 
16277 /* ARGSUSED */
16278 int
16279 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
16280     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
16281 {
16282 	ill_t *ill;
16283 	phyint_t *phyi;
16284 	struct lifreq *lifr;
16285 	mblk_t	*mp1;
16286 
16287 	/* Existence verified in ip_wput_nondata */
16288 	mp1 = mp->b_cont->b_cont;
16289 	lifr = (struct lifreq *)mp1->b_rptr;
16290 	ill = ipif->ipif_ill;
16291 	phyi = ill->ill_phyint;
16292 
16293 	lifr->lifr_groupname[0] = '\0';
16294 	/*
16295 	 * ill_group may be null if all the interfaces
16296 	 * are down. But still, the phyint should always
16297 	 * hold the name.
16298 	 */
16299 	if (phyi->phyint_groupname_len != 0) {
16300 		bcopy(phyi->phyint_groupname, lifr->lifr_groupname,
16301 		    phyi->phyint_groupname_len);
16302 	}
16303 
16304 	return (0);
16305 }
16306 
16307 
16308 typedef struct conn_move_s {
16309 	ill_t	*cm_from_ill;
16310 	ill_t	*cm_to_ill;
16311 	int	cm_ifindex;
16312 } conn_move_t;
16313 
16314 /*
16315  * ipcl_walk function for moving conn_multicast_ill for a given ill.
16316  */
16317 static void
16318 conn_move(conn_t *connp, caddr_t arg)
16319 {
16320 	conn_move_t *connm;
16321 	int ifindex;
16322 	int i;
16323 	ill_t *from_ill;
16324 	ill_t *to_ill;
16325 	ilg_t *ilg;
16326 	ilm_t *ret_ilm;
16327 
16328 	connm = (conn_move_t *)arg;
16329 	ifindex = connm->cm_ifindex;
16330 	from_ill = connm->cm_from_ill;
16331 	to_ill = connm->cm_to_ill;
16332 
16333 	/* Change IP_BOUND_IF/IPV6_BOUND_IF associations. */
16334 
16335 	/* All multicast fields protected by conn_lock */
16336 	mutex_enter(&connp->conn_lock);
16337 	ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill);
16338 	if ((connp->conn_outgoing_ill == from_ill) &&
16339 	    (ifindex == 0 || connp->conn_orig_bound_ifindex == ifindex)) {
16340 		connp->conn_outgoing_ill = to_ill;
16341 		connp->conn_incoming_ill = to_ill;
16342 	}
16343 
16344 	/* Change IP_MULTICAST_IF/IPV6_MULTICAST_IF associations */
16345 
16346 	if ((connp->conn_multicast_ill == from_ill) &&
16347 	    (ifindex == 0 || connp->conn_orig_multicast_ifindex == ifindex)) {
16348 		connp->conn_multicast_ill = connm->cm_to_ill;
16349 	}
16350 
16351 	/* Change IP_XMIT_IF associations */
16352 	if ((connp->conn_xmit_if_ill == from_ill) &&
16353 	    (ifindex == 0 || connp->conn_orig_xmit_ifindex == ifindex)) {
16354 		connp->conn_xmit_if_ill = to_ill;
16355 	}
16356 	/*
16357 	 * Change the ilg_ill to point to the new one. This assumes
16358 	 * ilm_move_v6 has moved the ilms to new_ill and the driver
16359 	 * has been told to receive packets on this interface.
16360 	 * ilm_move_v6 FAILBACKS all the ilms successfully always.
16361 	 * But when doing a FAILOVER, it might fail with ENOMEM and so
16362 	 * some ilms may not have moved. We check to see whether
16363 	 * the ilms have moved to to_ill. We can't check on from_ill
16364 	 * as in the process of moving, we could have split an ilm
16365 	 * in to two - which has the same orig_ifindex and v6group.
16366 	 *
16367 	 * For IPv4, ilg_ipif moves implicitly. The code below really
16368 	 * does not do anything for IPv4 as ilg_ill is NULL for IPv4.
16369 	 */
16370 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
16371 		ilg = &connp->conn_ilg[i];
16372 		if ((ilg->ilg_ill == from_ill) &&
16373 		    (ifindex == 0 || ilg->ilg_orig_ifindex == ifindex)) {
16374 			/* ifindex != 0 indicates failback */
16375 			if (ifindex != 0) {
16376 				connp->conn_ilg[i].ilg_ill = to_ill;
16377 				continue;
16378 			}
16379 
16380 			ret_ilm = ilm_lookup_ill_index_v6(to_ill,
16381 			    &ilg->ilg_v6group, ilg->ilg_orig_ifindex,
16382 			    connp->conn_zoneid);
16383 
16384 			if (ret_ilm != NULL)
16385 				connp->conn_ilg[i].ilg_ill = to_ill;
16386 		}
16387 	}
16388 	mutex_exit(&connp->conn_lock);
16389 }
16390 
16391 static void
16392 conn_move_ill(ill_t *from_ill, ill_t *to_ill, int ifindex)
16393 {
16394 	conn_move_t connm;
16395 
16396 	connm.cm_from_ill = from_ill;
16397 	connm.cm_to_ill = to_ill;
16398 	connm.cm_ifindex = ifindex;
16399 
16400 	ipcl_walk(conn_move, (caddr_t)&connm);
16401 }
16402 
16403 /*
16404  * ilm has been moved from from_ill to to_ill.
16405  * Send DL_DISABMULTI_REQ to ill and DL_ENABMULTI_REQ on to_ill.
16406  * appropriately.
16407  *
16408  * NOTE : We can't reuse the code in ip_ll_addmulti/delmulti because
16409  *	  the code there de-references ipif_ill to get the ill to
16410  *	  send multicast requests. It does not work as ipif is on its
16411  *	  move and already moved when this function is called.
16412  *	  Thus, we need to use from_ill and to_ill send down multicast
16413  *	  requests.
16414  */
16415 static void
16416 ilm_send_multicast_reqs(ill_t *from_ill, ill_t *to_ill)
16417 {
16418 	ipif_t *ipif;
16419 	ilm_t *ilm;
16420 
16421 	/*
16422 	 * See whether we need to send down DL_ENABMULTI_REQ on
16423 	 * to_ill as ilm has just been added.
16424 	 */
16425 	ASSERT(IAM_WRITER_ILL(to_ill));
16426 	ASSERT(IAM_WRITER_ILL(from_ill));
16427 
16428 	ILM_WALKER_HOLD(to_ill);
16429 	for (ilm = to_ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
16430 
16431 		if (!ilm->ilm_is_new || (ilm->ilm_flags & ILM_DELETED))
16432 			continue;
16433 		/*
16434 		 * no locks held, ill/ipif cannot dissappear as long
16435 		 * as we are writer.
16436 		 */
16437 		ipif = to_ill->ill_ipif;
16438 		/*
16439 		 * No need to hold any lock as we are the writer and this
16440 		 * can only be changed by a writer.
16441 		 */
16442 		ilm->ilm_is_new = B_FALSE;
16443 
16444 		if (to_ill->ill_net_type != IRE_IF_RESOLVER ||
16445 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
16446 			ip1dbg(("ilm_send_multicast_reqs: to_ill not "
16447 			    "resolver\n"));
16448 			continue;		/* Must be IRE_IF_NORESOLVER */
16449 		}
16450 
16451 
16452 		if (to_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
16453 			ip1dbg(("ilm_send_multicast_reqs: "
16454 			    "to_ill MULTI_BCAST\n"));
16455 			goto from;
16456 		}
16457 
16458 		if (to_ill->ill_isv6)
16459 			mld_joingroup(ilm);
16460 		else
16461 			igmp_joingroup(ilm);
16462 
16463 		if (to_ill->ill_ipif_up_count == 0) {
16464 			/*
16465 			 * Nobody there. All multicast addresses will be
16466 			 * re-joined when we get the DL_BIND_ACK bringing the
16467 			 * interface up.
16468 			 */
16469 			ilm->ilm_notify_driver = B_FALSE;
16470 			ip1dbg(("ilm_send_multicast_reqs: to_ill nobody up\n"));
16471 			goto from;
16472 		}
16473 
16474 		/*
16475 		 * For allmulti address, we want to join on only one interface.
16476 		 * Checking for ilm_numentries_v6 is not correct as you may
16477 		 * find an ilm with zero address on to_ill, but we may not
16478 		 * have nominated to_ill for receiving. Thus, if we have
16479 		 * nominated from_ill (ill_join_allmulti is set), nominate
16480 		 * only if to_ill is not already nominated (to_ill normally
16481 		 * should not have been nominated if "from_ill" has already
16482 		 * been nominated. As we don't prevent failovers from happening
16483 		 * across groups, we don't assert).
16484 		 */
16485 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
16486 			/*
16487 			 * There is no need to hold ill locks as we are
16488 			 * writer on both ills and when ill_join_allmulti
16489 			 * is changed the thread is always a writer.
16490 			 */
16491 			if (from_ill->ill_join_allmulti &&
16492 			    !to_ill->ill_join_allmulti) {
16493 				(void) ip_join_allmulti(to_ill->ill_ipif);
16494 			}
16495 		} else if (ilm->ilm_notify_driver) {
16496 
16497 			/*
16498 			 * This is a newly moved ilm so we need to tell the
16499 			 * driver about the new group. There can be more than
16500 			 * one ilm's for the same group in the list each with a
16501 			 * different orig_ifindex. We have to inform the driver
16502 			 * once. In ilm_move_v[4,6] we only set the flag
16503 			 * ilm_notify_driver for the first ilm.
16504 			 */
16505 
16506 			(void) ip_ll_send_enabmulti_req(to_ill,
16507 			    &ilm->ilm_v6addr);
16508 		}
16509 
16510 		ilm->ilm_notify_driver = B_FALSE;
16511 
16512 		/*
16513 		 * See whether we need to send down DL_DISABMULTI_REQ on
16514 		 * from_ill as ilm has just been removed.
16515 		 */
16516 from:
16517 		ipif = from_ill->ill_ipif;
16518 		if (from_ill->ill_net_type != IRE_IF_RESOLVER ||
16519 		    ipif->ipif_flags & IPIF_POINTOPOINT) {
16520 			ip1dbg(("ilm_send_multicast_reqs: "
16521 			    "from_ill not resolver\n"));
16522 			continue;		/* Must be IRE_IF_NORESOLVER */
16523 		}
16524 
16525 		if (from_ill->ill_phyint->phyint_flags & PHYI_MULTI_BCAST) {
16526 			ip1dbg(("ilm_send_multicast_reqs: "
16527 			    "from_ill MULTI_BCAST\n"));
16528 			continue;
16529 		}
16530 
16531 		if (IN6_IS_ADDR_UNSPECIFIED(&ilm->ilm_v6addr)) {
16532 			if (from_ill->ill_join_allmulti)
16533 			    (void) ip_leave_allmulti(from_ill->ill_ipif);
16534 		} else if (ilm_numentries_v6(from_ill, &ilm->ilm_v6addr) == 0) {
16535 			(void) ip_ll_send_disabmulti_req(from_ill,
16536 		    &ilm->ilm_v6addr);
16537 		}
16538 	}
16539 	ILM_WALKER_RELE(to_ill);
16540 }
16541 
16542 /*
16543  * This function is called when all multicast memberships needs
16544  * to be moved from "from_ill" to "to_ill" for IPv6. This function is
16545  * called only once unlike the IPv4 counterpart where it is called after
16546  * every logical interface is moved. The reason is due to multicast
16547  * memberships are joined using an interface address in IPv4 while in
16548  * IPv6, interface index is used.
16549  */
16550 static void
16551 ilm_move_v6(ill_t *from_ill, ill_t *to_ill, int ifindex)
16552 {
16553 	ilm_t	*ilm;
16554 	ilm_t	*ilm_next;
16555 	ilm_t	*new_ilm;
16556 	ilm_t	**ilmp;
16557 	int	count;
16558 	char buf[INET6_ADDRSTRLEN];
16559 	in6_addr_t ipv6_snm = ipv6_solicited_node_mcast;
16560 
16561 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16562 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16563 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16564 
16565 	if (ifindex == 0) {
16566 		/*
16567 		 * Form the solicited node mcast address which is used later.
16568 		 */
16569 		ipif_t *ipif;
16570 
16571 		ipif = from_ill->ill_ipif;
16572 		ASSERT(ipif->ipif_id == 0);
16573 
16574 		ipv6_snm.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
16575 	}
16576 
16577 	ilmp = &from_ill->ill_ilm;
16578 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
16579 		ilm_next = ilm->ilm_next;
16580 
16581 		if (ilm->ilm_flags & ILM_DELETED) {
16582 			ilmp = &ilm->ilm_next;
16583 			continue;
16584 		}
16585 
16586 		new_ilm = ilm_lookup_ill_index_v6(to_ill, &ilm->ilm_v6addr,
16587 		    ilm->ilm_orig_ifindex, ilm->ilm_zoneid);
16588 		ASSERT(ilm->ilm_orig_ifindex != 0);
16589 		if (ilm->ilm_orig_ifindex == ifindex) {
16590 			/*
16591 			 * We are failing back multicast memberships.
16592 			 * If the same ilm exists in to_ill, it means somebody
16593 			 * has joined the same group there e.g. ff02::1
16594 			 * is joined within the kernel when the interfaces
16595 			 * came UP.
16596 			 */
16597 			ASSERT(ilm->ilm_ipif == NULL);
16598 			if (new_ilm != NULL) {
16599 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16600 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16601 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16602 					new_ilm->ilm_is_new = B_TRUE;
16603 				}
16604 			} else {
16605 				/*
16606 				 * check if we can just move the ilm
16607 				 */
16608 				if (from_ill->ill_ilm_walker_cnt != 0) {
16609 					/*
16610 					 * We have walkers we cannot move
16611 					 * the ilm, so allocate a new ilm,
16612 					 * this (old) ilm will be marked
16613 					 * ILM_DELETED at the end of the loop
16614 					 * and will be freed when the
16615 					 * last walker exits.
16616 					 */
16617 					new_ilm = (ilm_t *)mi_zalloc
16618 					    (sizeof (ilm_t));
16619 					if (new_ilm == NULL) {
16620 						ip0dbg(("ilm_move_v6: "
16621 						    "FAILBACK of IPv6"
16622 						    " multicast address %s : "
16623 						    "from %s to"
16624 						    " %s failed : ENOMEM \n",
16625 						    inet_ntop(AF_INET6,
16626 						    &ilm->ilm_v6addr, buf,
16627 						    sizeof (buf)),
16628 						    from_ill->ill_name,
16629 						    to_ill->ill_name));
16630 
16631 							ilmp = &ilm->ilm_next;
16632 							continue;
16633 					}
16634 					*new_ilm = *ilm;
16635 					/*
16636 					 * we don't want new_ilm linked to
16637 					 * ilm's filter list.
16638 					 */
16639 					new_ilm->ilm_filter = NULL;
16640 				} else {
16641 					/*
16642 					 * No walkers we can move the ilm.
16643 					 * lets take it out of the list.
16644 					 */
16645 					*ilmp = ilm->ilm_next;
16646 					ilm->ilm_next = NULL;
16647 					new_ilm = ilm;
16648 				}
16649 
16650 				/*
16651 				 * if this is the first ilm for the group
16652 				 * set ilm_notify_driver so that we notify the
16653 				 * driver in ilm_send_multicast_reqs.
16654 				 */
16655 				if (ilm_lookup_ill_v6(to_ill,
16656 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16657 					new_ilm->ilm_notify_driver = B_TRUE;
16658 
16659 				new_ilm->ilm_ill = to_ill;
16660 				/* Add to the to_ill's list */
16661 				new_ilm->ilm_next = to_ill->ill_ilm;
16662 				to_ill->ill_ilm = new_ilm;
16663 				/*
16664 				 * set the flag so that mld_joingroup is
16665 				 * called in ilm_send_multicast_reqs().
16666 				 */
16667 				new_ilm->ilm_is_new = B_TRUE;
16668 			}
16669 			goto bottom;
16670 		} else if (ifindex != 0) {
16671 			/*
16672 			 * If this is FAILBACK (ifindex != 0) and the ifindex
16673 			 * has not matched above, look at the next ilm.
16674 			 */
16675 			ilmp = &ilm->ilm_next;
16676 			continue;
16677 		}
16678 		/*
16679 		 * If we are here, it means ifindex is 0. Failover
16680 		 * everything.
16681 		 *
16682 		 * We need to handle solicited node mcast address
16683 		 * and all_nodes mcast address differently as they
16684 		 * are joined witin the kenrel (ipif_multicast_up)
16685 		 * and potentially from the userland. We are called
16686 		 * after the ipifs of from_ill has been moved.
16687 		 * If we still find ilms on ill with solicited node
16688 		 * mcast address or all_nodes mcast address, it must
16689 		 * belong to the UP interface that has not moved e.g.
16690 		 * ipif_id 0 with the link local prefix does not move.
16691 		 * We join this on the new ill accounting for all the
16692 		 * userland memberships so that applications don't
16693 		 * see any failure.
16694 		 *
16695 		 * We need to make sure that we account only for the
16696 		 * solicited node and all node multicast addresses
16697 		 * that was brought UP on these. In the case of
16698 		 * a failover from A to B, we might have ilms belonging
16699 		 * to A (ilm_orig_ifindex pointing at A) on B accounting
16700 		 * for the membership from the userland. If we are failing
16701 		 * over from B to C now, we will find the ones belonging
16702 		 * to A on B. These don't account for the ill_ipif_up_count.
16703 		 * They just move from B to C. The check below on
16704 		 * ilm_orig_ifindex ensures that.
16705 		 */
16706 		if ((ilm->ilm_orig_ifindex ==
16707 		    from_ill->ill_phyint->phyint_ifindex) &&
16708 		    (IN6_ARE_ADDR_EQUAL(&ipv6_snm, &ilm->ilm_v6addr) ||
16709 		    IN6_ARE_ADDR_EQUAL(&ipv6_all_hosts_mcast,
16710 		    &ilm->ilm_v6addr))) {
16711 			ASSERT(ilm->ilm_refcnt > 0);
16712 			count = ilm->ilm_refcnt - from_ill->ill_ipif_up_count;
16713 			/*
16714 			 * For indentation reasons, we are not using a
16715 			 * "else" here.
16716 			 */
16717 			if (count == 0) {
16718 				ilmp = &ilm->ilm_next;
16719 				continue;
16720 			}
16721 			ilm->ilm_refcnt -= count;
16722 			if (new_ilm != NULL) {
16723 				/*
16724 				 * Can find one with the same
16725 				 * ilm_orig_ifindex, if we are failing
16726 				 * over to a STANDBY. This happens
16727 				 * when somebody wants to join a group
16728 				 * on a STANDBY interface and we
16729 				 * internally join on a different one.
16730 				 * If we had joined on from_ill then, a
16731 				 * failover now will find a new ilm
16732 				 * with this index.
16733 				 */
16734 				ip1dbg(("ilm_move_v6: FAILOVER, found"
16735 				    " new ilm on %s, group address %s\n",
16736 				    to_ill->ill_name,
16737 				    inet_ntop(AF_INET6,
16738 				    &ilm->ilm_v6addr, buf,
16739 				    sizeof (buf))));
16740 				new_ilm->ilm_refcnt += count;
16741 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16742 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16743 					new_ilm->ilm_is_new = B_TRUE;
16744 				}
16745 			} else {
16746 				new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
16747 				if (new_ilm == NULL) {
16748 					ip0dbg(("ilm_move_v6: FAILOVER of IPv6"
16749 					    " multicast address %s : from %s to"
16750 					    " %s failed : ENOMEM \n",
16751 					    inet_ntop(AF_INET6,
16752 					    &ilm->ilm_v6addr, buf,
16753 					    sizeof (buf)), from_ill->ill_name,
16754 					    to_ill->ill_name));
16755 					ilmp = &ilm->ilm_next;
16756 					continue;
16757 				}
16758 				*new_ilm = *ilm;
16759 				new_ilm->ilm_filter = NULL;
16760 				new_ilm->ilm_refcnt = count;
16761 				new_ilm->ilm_timer = INFINITY;
16762 				new_ilm->ilm_rtx.rtx_timer = INFINITY;
16763 				new_ilm->ilm_is_new = B_TRUE;
16764 				/*
16765 				 * If the to_ill has not joined this
16766 				 * group we need to tell the driver in
16767 				 * ill_send_multicast_reqs.
16768 				 */
16769 				if (ilm_lookup_ill_v6(to_ill,
16770 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16771 					new_ilm->ilm_notify_driver = B_TRUE;
16772 
16773 				new_ilm->ilm_ill = to_ill;
16774 				/* Add to the to_ill's list */
16775 				new_ilm->ilm_next = to_ill->ill_ilm;
16776 				to_ill->ill_ilm = new_ilm;
16777 				ASSERT(new_ilm->ilm_ipif == NULL);
16778 			}
16779 			if (ilm->ilm_refcnt == 0) {
16780 				goto bottom;
16781 			} else {
16782 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16783 				CLEAR_SLIST(new_ilm->ilm_filter);
16784 				ilmp = &ilm->ilm_next;
16785 			}
16786 			continue;
16787 		} else {
16788 			/*
16789 			 * ifindex = 0 means, move everything pointing at
16790 			 * from_ill. We are doing this becuase ill has
16791 			 * either FAILED or became INACTIVE.
16792 			 *
16793 			 * As we would like to move things later back to
16794 			 * from_ill, we want to retain the identity of this
16795 			 * ilm. Thus, we don't blindly increment the reference
16796 			 * count on the ilms matching the address alone. We
16797 			 * need to match on the ilm_orig_index also. new_ilm
16798 			 * was obtained by matching ilm_orig_index also.
16799 			 */
16800 			if (new_ilm != NULL) {
16801 				/*
16802 				 * This is possible only if a previous restore
16803 				 * was incomplete i.e restore to
16804 				 * ilm_orig_ifindex left some ilms because
16805 				 * of some failures. Thus when we are failing
16806 				 * again, we might find our old friends there.
16807 				 */
16808 				ip1dbg(("ilm_move_v6: FAILOVER, found new ilm"
16809 				    " on %s, group address %s\n",
16810 				    to_ill->ill_name,
16811 				    inet_ntop(AF_INET6,
16812 				    &ilm->ilm_v6addr, buf,
16813 				    sizeof (buf))));
16814 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16815 				if (new_ilm->ilm_fmode != MODE_IS_EXCLUDE ||
16816 				    !SLIST_IS_EMPTY(new_ilm->ilm_filter)) {
16817 					new_ilm->ilm_is_new = B_TRUE;
16818 				}
16819 			} else {
16820 				if (from_ill->ill_ilm_walker_cnt != 0) {
16821 					new_ilm = (ilm_t *)
16822 					    mi_zalloc(sizeof (ilm_t));
16823 					if (new_ilm == NULL) {
16824 						ip0dbg(("ilm_move_v6: "
16825 						    "FAILOVER of IPv6"
16826 						    " multicast address %s : "
16827 						    "from %s to"
16828 						    " %s failed : ENOMEM \n",
16829 						    inet_ntop(AF_INET6,
16830 						    &ilm->ilm_v6addr, buf,
16831 						    sizeof (buf)),
16832 						    from_ill->ill_name,
16833 						    to_ill->ill_name));
16834 
16835 							ilmp = &ilm->ilm_next;
16836 							continue;
16837 					}
16838 					*new_ilm = *ilm;
16839 					new_ilm->ilm_filter = NULL;
16840 				} else {
16841 					*ilmp = ilm->ilm_next;
16842 					new_ilm = ilm;
16843 				}
16844 				/*
16845 				 * If the to_ill has not joined this
16846 				 * group we need to tell the driver in
16847 				 * ill_send_multicast_reqs.
16848 				 */
16849 				if (ilm_lookup_ill_v6(to_ill,
16850 				    &new_ilm->ilm_v6addr, ALL_ZONES) == NULL)
16851 					new_ilm->ilm_notify_driver = B_TRUE;
16852 
16853 				/* Add to the to_ill's list */
16854 				new_ilm->ilm_next = to_ill->ill_ilm;
16855 				to_ill->ill_ilm = new_ilm;
16856 				ASSERT(ilm->ilm_ipif == NULL);
16857 				new_ilm->ilm_ill = to_ill;
16858 				new_ilm->ilm_is_new = B_TRUE;
16859 			}
16860 
16861 		}
16862 
16863 bottom:
16864 		/*
16865 		 * Revert multicast filter state to (EXCLUDE, NULL).
16866 		 * new_ilm->ilm_is_new should already be set if needed.
16867 		 */
16868 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16869 		CLEAR_SLIST(new_ilm->ilm_filter);
16870 		/*
16871 		 * We allocated/got a new ilm, free the old one.
16872 		 */
16873 		if (new_ilm != ilm) {
16874 			if (from_ill->ill_ilm_walker_cnt == 0) {
16875 				*ilmp = ilm->ilm_next;
16876 				ilm->ilm_next = NULL;
16877 				FREE_SLIST(ilm->ilm_filter);
16878 				FREE_SLIST(ilm->ilm_pendsrcs);
16879 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
16880 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
16881 				mi_free((char *)ilm);
16882 			} else {
16883 				ilm->ilm_flags |= ILM_DELETED;
16884 				from_ill->ill_ilm_cleanup_reqd = 1;
16885 				ilmp = &ilm->ilm_next;
16886 			}
16887 		}
16888 	}
16889 }
16890 
16891 /*
16892  * Move all the multicast memberships to to_ill. Called when
16893  * an ipif moves from "from_ill" to "to_ill". This function is slightly
16894  * different from IPv6 counterpart as multicast memberships are associated
16895  * with ills in IPv6. This function is called after every ipif is moved
16896  * unlike IPv6, where it is moved only once.
16897  */
16898 static void
16899 ilm_move_v4(ill_t *from_ill, ill_t *to_ill, ipif_t *ipif)
16900 {
16901 	ilm_t	*ilm;
16902 	ilm_t	*ilm_next;
16903 	ilm_t	*new_ilm;
16904 	ilm_t	**ilmp;
16905 
16906 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
16907 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
16908 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
16909 
16910 	ilmp = &from_ill->ill_ilm;
16911 	for (ilm = from_ill->ill_ilm; ilm != NULL; ilm = ilm_next) {
16912 		ilm_next = ilm->ilm_next;
16913 
16914 		if (ilm->ilm_flags & ILM_DELETED) {
16915 			ilmp = &ilm->ilm_next;
16916 			continue;
16917 		}
16918 
16919 		ASSERT(ilm->ilm_ipif != NULL);
16920 
16921 		if (ilm->ilm_ipif != ipif) {
16922 			ilmp = &ilm->ilm_next;
16923 			continue;
16924 		}
16925 
16926 		if (V4_PART_OF_V6(ilm->ilm_v6addr) ==
16927 		    htonl(INADDR_ALLHOSTS_GROUP)) {
16928 			/*
16929 			 * We joined this in ipif_multicast_up
16930 			 * and we never did an ipif_multicast_down
16931 			 * for IPv4. If nobody else from the userland
16932 			 * has reference, we free the ilm, and later
16933 			 * when this ipif comes up on the new ill,
16934 			 * we will join this again.
16935 			 */
16936 			if (--ilm->ilm_refcnt == 0)
16937 				goto delete_ilm;
16938 
16939 			new_ilm = ilm_lookup_ipif(ipif,
16940 			    V4_PART_OF_V6(ilm->ilm_v6addr));
16941 			if (new_ilm != NULL) {
16942 				new_ilm->ilm_refcnt += ilm->ilm_refcnt;
16943 				/*
16944 				 * We still need to deal with the from_ill.
16945 				 */
16946 				new_ilm->ilm_is_new = B_TRUE;
16947 				new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
16948 				CLEAR_SLIST(new_ilm->ilm_filter);
16949 				goto delete_ilm;
16950 			}
16951 			/*
16952 			 * If we could not find one e.g. ipif is
16953 			 * still down on to_ill, we add this ilm
16954 			 * on ill_new to preserve the reference
16955 			 * count.
16956 			 */
16957 		}
16958 		/*
16959 		 * When ipifs move, ilms always move with it
16960 		 * to the NEW ill. Thus we should never be
16961 		 * able to find ilm till we really move it here.
16962 		 */
16963 		ASSERT(ilm_lookup_ipif(ipif,
16964 		    V4_PART_OF_V6(ilm->ilm_v6addr)) == NULL);
16965 
16966 		if (from_ill->ill_ilm_walker_cnt != 0) {
16967 			new_ilm = (ilm_t *)mi_zalloc(sizeof (ilm_t));
16968 			if (new_ilm == NULL) {
16969 				char buf[INET6_ADDRSTRLEN];
16970 				ip0dbg(("ilm_move_v4: FAILBACK of IPv4"
16971 				    " multicast address %s : "
16972 				    "from %s to"
16973 				    " %s failed : ENOMEM \n",
16974 				    inet_ntop(AF_INET,
16975 				    &ilm->ilm_v6addr, buf,
16976 				    sizeof (buf)),
16977 				    from_ill->ill_name,
16978 				    to_ill->ill_name));
16979 
16980 				ilmp = &ilm->ilm_next;
16981 				continue;
16982 			}
16983 			*new_ilm = *ilm;
16984 			/* We don't want new_ilm linked to ilm's filter list */
16985 			new_ilm->ilm_filter = NULL;
16986 		} else {
16987 			/* Remove from the list */
16988 			*ilmp = ilm->ilm_next;
16989 			new_ilm = ilm;
16990 		}
16991 
16992 		/*
16993 		 * If we have never joined this group on the to_ill
16994 		 * make sure we tell the driver.
16995 		 */
16996 		if (ilm_lookup_ill_v6(to_ill, &new_ilm->ilm_v6addr,
16997 		    ALL_ZONES) == NULL)
16998 			new_ilm->ilm_notify_driver = B_TRUE;
16999 
17000 		/* Add to the to_ill's list */
17001 		new_ilm->ilm_next = to_ill->ill_ilm;
17002 		to_ill->ill_ilm = new_ilm;
17003 		new_ilm->ilm_is_new = B_TRUE;
17004 
17005 		/*
17006 		 * Revert multicast filter state to (EXCLUDE, NULL)
17007 		 */
17008 		new_ilm->ilm_fmode = MODE_IS_EXCLUDE;
17009 		CLEAR_SLIST(new_ilm->ilm_filter);
17010 
17011 		/*
17012 		 * Delete only if we have allocated a new ilm.
17013 		 */
17014 		if (new_ilm != ilm) {
17015 delete_ilm:
17016 			if (from_ill->ill_ilm_walker_cnt == 0) {
17017 				/* Remove from the list */
17018 				*ilmp = ilm->ilm_next;
17019 				ilm->ilm_next = NULL;
17020 				FREE_SLIST(ilm->ilm_filter);
17021 				FREE_SLIST(ilm->ilm_pendsrcs);
17022 				FREE_SLIST(ilm->ilm_rtx.rtx_allow);
17023 				FREE_SLIST(ilm->ilm_rtx.rtx_block);
17024 				mi_free((char *)ilm);
17025 			} else {
17026 				ilm->ilm_flags |= ILM_DELETED;
17027 				from_ill->ill_ilm_cleanup_reqd = 1;
17028 				ilmp = &ilm->ilm_next;
17029 			}
17030 		}
17031 	}
17032 }
17033 
17034 static uint_t
17035 ipif_get_id(ill_t *ill, uint_t id)
17036 {
17037 	uint_t	unit;
17038 	ipif_t	*tipif;
17039 	boolean_t found = B_FALSE;
17040 
17041 	/*
17042 	 * During failback, we want to go back to the same id
17043 	 * instead of the smallest id so that the original
17044 	 * configuration is maintained. id is non-zero in that
17045 	 * case.
17046 	 */
17047 	if (id != 0) {
17048 		/*
17049 		 * While failing back, if we still have an ipif with
17050 		 * MAX_ADDRS_PER_IF, it means this will be replaced
17051 		 * as soon as we return from this function. It was
17052 		 * to set to MAX_ADDRS_PER_IF by the caller so that
17053 		 * we can choose the smallest id. Thus we return zero
17054 		 * in that case ignoring the hint.
17055 		 */
17056 		if (ill->ill_ipif->ipif_id == MAX_ADDRS_PER_IF)
17057 			return (0);
17058 		for (tipif = ill->ill_ipif; tipif != NULL;
17059 		    tipif = tipif->ipif_next) {
17060 			if (tipif->ipif_id == id) {
17061 				found = B_TRUE;
17062 				break;
17063 			}
17064 		}
17065 		/*
17066 		 * If somebody already plumbed another logical
17067 		 * with the same id, we won't be able to find it.
17068 		 */
17069 		if (!found)
17070 			return (id);
17071 	}
17072 	for (unit = 0; unit <= ip_addrs_per_if; unit++) {
17073 		found = B_FALSE;
17074 		for (tipif = ill->ill_ipif; tipif != NULL;
17075 		    tipif = tipif->ipif_next) {
17076 			if (tipif->ipif_id == unit) {
17077 				found = B_TRUE;
17078 				break;
17079 			}
17080 		}
17081 		if (!found)
17082 			break;
17083 	}
17084 	return (unit);
17085 }
17086 
17087 /* ARGSUSED */
17088 static int
17089 ipif_move(ipif_t *ipif, ill_t *to_ill, queue_t *q, mblk_t *mp,
17090     ipif_t **rep_ipif_ptr)
17091 {
17092 	ill_t	*from_ill;
17093 	ipif_t	*rep_ipif;
17094 	ipif_t	**ipifp;
17095 	uint_t	unit;
17096 	int err = 0;
17097 	ipif_t	*to_ipif;
17098 	struct iocblk	*iocp;
17099 	boolean_t failback_cmd;
17100 	boolean_t remove_ipif;
17101 	int	rc;
17102 
17103 	ASSERT(IAM_WRITER_ILL(to_ill));
17104 	ASSERT(IAM_WRITER_IPIF(ipif));
17105 
17106 	iocp = (struct iocblk *)mp->b_rptr;
17107 	failback_cmd = (iocp->ioc_cmd == SIOCLIFFAILBACK);
17108 	remove_ipif = B_FALSE;
17109 
17110 	from_ill = ipif->ipif_ill;
17111 
17112 	ASSERT(MUTEX_HELD(&to_ill->ill_lock));
17113 	ASSERT(MUTEX_HELD(&from_ill->ill_lock));
17114 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
17115 
17116 	/*
17117 	 * Don't move LINK LOCAL addresses as they are tied to
17118 	 * physical interface.
17119 	 */
17120 	if (from_ill->ill_isv6 &&
17121 	    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6lcl_addr)) {
17122 		ipif->ipif_was_up = B_FALSE;
17123 		IPIF_UNMARK_MOVING(ipif);
17124 		return (0);
17125 	}
17126 
17127 	/*
17128 	 * We set the ipif_id to maximum so that the search for
17129 	 * ipif_id will pick the lowest number i.e 0 in the
17130 	 * following 2 cases :
17131 	 *
17132 	 * 1) We have a replacement ipif at the head of to_ill.
17133 	 *    We can't remove it yet as we can exceed ip_addrs_per_if
17134 	 *    on to_ill and hence the MOVE might fail. We want to
17135 	 *    remove it only if we could move the ipif. Thus, by
17136 	 *    setting it to the MAX value, we make the search in
17137 	 *    ipif_get_id return the zeroth id.
17138 	 *
17139 	 * 2) When DR pulls out the NIC and re-plumbs the interface,
17140 	 *    we might just have a zero address plumbed on the ipif
17141 	 *    with zero id in the case of IPv4. We remove that while
17142 	 *    doing the failback. We want to remove it only if we
17143 	 *    could move the ipif. Thus, by setting it to the MAX
17144 	 *    value, we make the search in ipif_get_id return the
17145 	 *    zeroth id.
17146 	 *
17147 	 * Both (1) and (2) are done only when when we are moving
17148 	 * an ipif (either due to failover/failback) which originally
17149 	 * belonged to this interface i.e the ipif_orig_ifindex is
17150 	 * the same as to_ill's ifindex. This is needed so that
17151 	 * FAILOVER from A -> B ( A failed) followed by FAILOVER
17152 	 * from B -> A (B is being removed from the group) and
17153 	 * FAILBACK from A -> B restores the original configuration.
17154 	 * Without the check for orig_ifindex, the second FAILOVER
17155 	 * could make the ipif belonging to B replace the A's zeroth
17156 	 * ipif and the subsequent failback re-creating the replacement
17157 	 * ipif again.
17158 	 *
17159 	 * NOTE : We created the replacement ipif when we did a
17160 	 * FAILOVER (See below). We could check for FAILBACK and
17161 	 * then look for replacement ipif to be removed. But we don't
17162 	 * want to do that because we wan't to allow the possibility
17163 	 * of a FAILOVER from A -> B (which creates the replacement ipif),
17164 	 * followed by a *FAILOVER* from B -> A instead of a FAILBACK
17165 	 * from B -> A.
17166 	 */
17167 	to_ipif = to_ill->ill_ipif;
17168 	if ((to_ill->ill_phyint->phyint_ifindex ==
17169 	    ipif->ipif_orig_ifindex) &&
17170 	    IPIF_REPL_CHECK(to_ipif, failback_cmd)) {
17171 		ASSERT(to_ipif->ipif_id == 0);
17172 		remove_ipif = B_TRUE;
17173 		to_ipif->ipif_id = MAX_ADDRS_PER_IF;
17174 	}
17175 	/*
17176 	 * Find the lowest logical unit number on the to_ill.
17177 	 * If we are failing back, try to get the original id
17178 	 * rather than the lowest one so that the original
17179 	 * configuration is maintained.
17180 	 *
17181 	 * XXX need a better scheme for this.
17182 	 */
17183 	if (failback_cmd) {
17184 		unit = ipif_get_id(to_ill, ipif->ipif_orig_ipifid);
17185 	} else {
17186 		unit = ipif_get_id(to_ill, 0);
17187 	}
17188 
17189 	/* Reset back to zero in case we fail below */
17190 	if (to_ipif->ipif_id == MAX_ADDRS_PER_IF)
17191 		to_ipif->ipif_id = 0;
17192 
17193 	if (unit == ip_addrs_per_if) {
17194 		ipif->ipif_was_up = B_FALSE;
17195 		IPIF_UNMARK_MOVING(ipif);
17196 		return (EINVAL);
17197 	}
17198 
17199 	/*
17200 	 * ipif is ready to move from "from_ill" to "to_ill".
17201 	 *
17202 	 * 1) If we are moving ipif with id zero, create a
17203 	 *    replacement ipif for this ipif on from_ill. If this fails
17204 	 *    fail the MOVE operation.
17205 	 *
17206 	 * 2) Remove the replacement ipif on to_ill if any.
17207 	 *    We could remove the replacement ipif when we are moving
17208 	 *    the ipif with id zero. But what if somebody already
17209 	 *    unplumbed it ? Thus we always remove it if it is present.
17210 	 *    We want to do it only if we are sure we are going to
17211 	 *    move the ipif to to_ill which is why there are no
17212 	 *    returns due to error till ipif is linked to to_ill.
17213 	 *    Note that the first ipif that we failback will always
17214 	 *    be zero if it is present.
17215 	 */
17216 	if (ipif->ipif_id == 0) {
17217 		ipaddr_t inaddr_any = INADDR_ANY;
17218 
17219 		rep_ipif = (ipif_t *)mi_alloc(sizeof (ipif_t), BPRI_MED);
17220 		if (rep_ipif == NULL) {
17221 			ipif->ipif_was_up = B_FALSE;
17222 			IPIF_UNMARK_MOVING(ipif);
17223 			return (ENOMEM);
17224 		}
17225 		*rep_ipif = ipif_zero;
17226 		/*
17227 		 * Before we put the ipif on the list, store the addresses
17228 		 * as mapped addresses as some of the ioctls e.g SIOCGIFADDR
17229 		 * assumes so. This logic is not any different from what
17230 		 * ipif_allocate does.
17231 		 */
17232 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17233 		    &rep_ipif->ipif_v6lcl_addr);
17234 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17235 		    &rep_ipif->ipif_v6src_addr);
17236 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17237 		    &rep_ipif->ipif_v6subnet);
17238 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17239 		    &rep_ipif->ipif_v6net_mask);
17240 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17241 		    &rep_ipif->ipif_v6brd_addr);
17242 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
17243 		    &rep_ipif->ipif_v6pp_dst_addr);
17244 		/*
17245 		 * We mark IPIF_NOFAILOVER so that this can never
17246 		 * move.
17247 		 */
17248 		rep_ipif->ipif_flags = ipif->ipif_flags | IPIF_NOFAILOVER;
17249 		rep_ipif->ipif_flags &= ~IPIF_UP & ~IPIF_DUPLICATE;
17250 		rep_ipif->ipif_replace_zero = B_TRUE;
17251 		mutex_init(&rep_ipif->ipif_saved_ire_lock, NULL,
17252 		    MUTEX_DEFAULT, NULL);
17253 		rep_ipif->ipif_id = 0;
17254 		rep_ipif->ipif_ire_type = ipif->ipif_ire_type;
17255 		rep_ipif->ipif_ill = from_ill;
17256 		rep_ipif->ipif_orig_ifindex =
17257 		    from_ill->ill_phyint->phyint_ifindex;
17258 		/* Insert at head */
17259 		rep_ipif->ipif_next = from_ill->ill_ipif;
17260 		from_ill->ill_ipif = rep_ipif;
17261 		/*
17262 		 * We don't really care to let apps know about
17263 		 * this interface.
17264 		 */
17265 	}
17266 
17267 	if (remove_ipif) {
17268 		/*
17269 		 * We set to a max value above for this case to get
17270 		 * id zero. ASSERT that we did get one.
17271 		 */
17272 		ASSERT((to_ipif->ipif_id == 0) && (unit == 0));
17273 		rep_ipif = to_ipif;
17274 		to_ill->ill_ipif = rep_ipif->ipif_next;
17275 		rep_ipif->ipif_next = NULL;
17276 		/*
17277 		 * If some apps scanned and find this interface,
17278 		 * it is time to let them know, so that they can
17279 		 * delete it.
17280 		 */
17281 
17282 		*rep_ipif_ptr = rep_ipif;
17283 	}
17284 
17285 	/* Get it out of the ILL interface list. */
17286 	ipifp = &ipif->ipif_ill->ill_ipif;
17287 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
17288 		if (*ipifp == ipif) {
17289 			*ipifp = ipif->ipif_next;
17290 			break;
17291 		}
17292 	}
17293 
17294 	/* Assign the new ill */
17295 	ipif->ipif_ill = to_ill;
17296 	ipif->ipif_id = unit;
17297 	/* id has already been checked */
17298 	rc = ipif_insert(ipif, B_FALSE, B_FALSE);
17299 	ASSERT(rc == 0);
17300 	/* Let SCTP update its list */
17301 	sctp_move_ipif(ipif, from_ill, to_ill);
17302 	/*
17303 	 * Handle the failover and failback of ipif_t between
17304 	 * ill_t that have differing maximum mtu values.
17305 	 */
17306 	if (ipif->ipif_mtu > to_ill->ill_max_mtu) {
17307 		if (ipif->ipif_saved_mtu == 0) {
17308 			/*
17309 			 * As this ipif_t is moving to an ill_t
17310 			 * that has a lower ill_max_mtu, its
17311 			 * ipif_mtu needs to be saved so it can
17312 			 * be restored during failback or during
17313 			 * failover to an ill_t which has a
17314 			 * higher ill_max_mtu.
17315 			 */
17316 			ipif->ipif_saved_mtu = ipif->ipif_mtu;
17317 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17318 		} else {
17319 			/*
17320 			 * The ipif_t is, once again, moving to
17321 			 * an ill_t that has a lower maximum mtu
17322 			 * value.
17323 			 */
17324 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17325 		}
17326 	} else if (ipif->ipif_mtu < to_ill->ill_max_mtu &&
17327 	    ipif->ipif_saved_mtu != 0) {
17328 		/*
17329 		 * The mtu of this ipif_t had to be reduced
17330 		 * during an earlier failover; this is an
17331 		 * opportunity for it to be increased (either as
17332 		 * part of another failover or a failback).
17333 		 */
17334 		if (ipif->ipif_saved_mtu <= to_ill->ill_max_mtu) {
17335 			ipif->ipif_mtu = ipif->ipif_saved_mtu;
17336 			ipif->ipif_saved_mtu = 0;
17337 		} else {
17338 			ipif->ipif_mtu = to_ill->ill_max_mtu;
17339 		}
17340 	}
17341 
17342 	/*
17343 	 * We preserve all the other fields of the ipif including
17344 	 * ipif_saved_ire_mp. The routes that are saved here will
17345 	 * be recreated on the new interface and back on the old
17346 	 * interface when we move back.
17347 	 */
17348 	ASSERT(ipif->ipif_arp_del_mp == NULL);
17349 
17350 	return (err);
17351 }
17352 
17353 static int
17354 ipif_move_all(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp,
17355     int ifindex, ipif_t **rep_ipif_ptr)
17356 {
17357 	ipif_t *mipif;
17358 	ipif_t *ipif_next;
17359 	int err;
17360 
17361 	/*
17362 	 * We don't really try to MOVE back things if some of the
17363 	 * operations fail. The daemon will take care of moving again
17364 	 * later on.
17365 	 */
17366 	for (mipif = from_ill->ill_ipif; mipif != NULL; mipif = ipif_next) {
17367 		ipif_next = mipif->ipif_next;
17368 		if (!(mipif->ipif_flags & IPIF_NOFAILOVER) &&
17369 		    (ifindex == 0 || ifindex == mipif->ipif_orig_ifindex)) {
17370 
17371 			err = ipif_move(mipif, to_ill, q, mp, rep_ipif_ptr);
17372 
17373 			/*
17374 			 * When the MOVE fails, it is the job of the
17375 			 * application to take care of this properly
17376 			 * i.e try again if it is ENOMEM.
17377 			 */
17378 			if (mipif->ipif_ill != from_ill) {
17379 				/*
17380 				 * ipif has moved.
17381 				 *
17382 				 * Move the multicast memberships associated
17383 				 * with this ipif to the new ill. For IPv6, we
17384 				 * do it once after all the ipifs are moved
17385 				 * (in ill_move) as they are not associated
17386 				 * with ipifs.
17387 				 *
17388 				 * We need to move the ilms as the ipif has
17389 				 * already been moved to a new ill even
17390 				 * in the case of errors. Neither
17391 				 * ilm_free(ipif) will find the ilm
17392 				 * when somebody unplumbs this ipif nor
17393 				 * ilm_delete(ilm) will be able to find the
17394 				 * ilm, if we don't move now.
17395 				 */
17396 				if (!from_ill->ill_isv6)
17397 					ilm_move_v4(from_ill, to_ill, mipif);
17398 			}
17399 
17400 			if (err != 0)
17401 				return (err);
17402 		}
17403 	}
17404 	return (0);
17405 }
17406 
17407 static int
17408 ill_move(ill_t *from_ill, ill_t *to_ill, queue_t *q, mblk_t *mp)
17409 {
17410 	int ifindex;
17411 	int err;
17412 	struct iocblk	*iocp;
17413 	ipif_t	*ipif;
17414 	ipif_t *rep_ipif_ptr = NULL;
17415 	ipif_t	*from_ipif = NULL;
17416 	boolean_t check_rep_if = B_FALSE;
17417 
17418 	iocp = (struct iocblk *)mp->b_rptr;
17419 	if (iocp->ioc_cmd == SIOCLIFFAILOVER) {
17420 		/*
17421 		 * Move everything pointing at from_ill to to_ill.
17422 		 * We acheive this by passing in 0 as ifindex.
17423 		 */
17424 		ifindex = 0;
17425 	} else {
17426 		/*
17427 		 * Move everything pointing at from_ill whose original
17428 		 * ifindex of connp, ipif, ilm points at to_ill->ill_index.
17429 		 * We acheive this by passing in ifindex rather than 0.
17430 		 * Multicast vifs, ilgs move implicitly because ipifs move.
17431 		 */
17432 		ASSERT(iocp->ioc_cmd == SIOCLIFFAILBACK);
17433 		ifindex = to_ill->ill_phyint->phyint_ifindex;
17434 	}
17435 
17436 	/*
17437 	 * Determine if there is at least one ipif that would move from
17438 	 * 'from_ill' to 'to_ill'. If so, it is possible that the replacement
17439 	 * ipif (if it exists) on the to_ill would be consumed as a result of
17440 	 * the move, in which case we need to quiesce the replacement ipif also.
17441 	 */
17442 	for (from_ipif = from_ill->ill_ipif; from_ipif != NULL;
17443 	    from_ipif = from_ipif->ipif_next) {
17444 		if (((ifindex == 0) ||
17445 		    (ifindex == from_ipif->ipif_orig_ifindex)) &&
17446 		    !(from_ipif->ipif_flags & IPIF_NOFAILOVER)) {
17447 			check_rep_if = B_TRUE;
17448 			break;
17449 		}
17450 	}
17451 
17452 
17453 	ill_down_ipifs(from_ill, mp, ifindex, B_TRUE);
17454 
17455 	GRAB_ILL_LOCKS(from_ill, to_ill);
17456 	if ((ipif = ill_quiescent_to_move(from_ill)) != NULL) {
17457 		(void) ipsq_pending_mp_add(NULL, ipif, q,
17458 		    mp, ILL_MOVE_OK);
17459 		RELEASE_ILL_LOCKS(from_ill, to_ill);
17460 		return (EINPROGRESS);
17461 	}
17462 
17463 	/* Check if the replacement ipif is quiescent to delete */
17464 	if (check_rep_if && IPIF_REPL_CHECK(to_ill->ill_ipif,
17465 	    (iocp->ioc_cmd == SIOCLIFFAILBACK))) {
17466 		to_ill->ill_ipif->ipif_state_flags |=
17467 		    IPIF_MOVING | IPIF_CHANGING;
17468 		if ((ipif = ill_quiescent_to_move(to_ill)) != NULL) {
17469 			(void) ipsq_pending_mp_add(NULL, ipif, q,
17470 			    mp, ILL_MOVE_OK);
17471 			RELEASE_ILL_LOCKS(from_ill, to_ill);
17472 			return (EINPROGRESS);
17473 		}
17474 	}
17475 	RELEASE_ILL_LOCKS(from_ill, to_ill);
17476 
17477 	ASSERT(!MUTEX_HELD(&to_ill->ill_lock));
17478 	rw_enter(&ill_g_lock, RW_WRITER);
17479 	GRAB_ILL_LOCKS(from_ill, to_ill);
17480 	err = ipif_move_all(from_ill, to_ill, q, mp, ifindex, &rep_ipif_ptr);
17481 
17482 	/* ilm_move is done inside ipif_move for IPv4 */
17483 	if (err == 0 && from_ill->ill_isv6)
17484 		ilm_move_v6(from_ill, to_ill, ifindex);
17485 
17486 	RELEASE_ILL_LOCKS(from_ill, to_ill);
17487 	rw_exit(&ill_g_lock);
17488 
17489 	/*
17490 	 * send rts messages and multicast messages.
17491 	 */
17492 	if (rep_ipif_ptr != NULL) {
17493 		ip_rts_ifmsg(rep_ipif_ptr);
17494 		ip_rts_newaddrmsg(RTM_DELETE, 0, rep_ipif_ptr);
17495 		IPIF_TRACE_CLEANUP(rep_ipif_ptr);
17496 		mi_free(rep_ipif_ptr);
17497 	}
17498 
17499 	conn_move_ill(from_ill, to_ill, ifindex);
17500 
17501 	return (err);
17502 }
17503 
17504 /*
17505  * Used to extract arguments for FAILOVER/FAILBACK ioctls.
17506  * Also checks for the validity of the arguments.
17507  * Note: We are already exclusive inside the from group.
17508  * It is upto the caller to release refcnt on the to_ill's.
17509  */
17510 static int
17511 ip_extract_move_args(queue_t *q, mblk_t *mp, ill_t **ill_from_v4,
17512     ill_t **ill_from_v6, ill_t **ill_to_v4, ill_t **ill_to_v6)
17513 {
17514 	int dst_index;
17515 	ipif_t *ipif_v4, *ipif_v6;
17516 	struct lifreq *lifr;
17517 	mblk_t *mp1;
17518 	boolean_t exists;
17519 	sin_t	*sin;
17520 	int	err = 0;
17521 
17522 	if ((mp1 = mp->b_cont) == NULL)
17523 		return (EPROTO);
17524 
17525 	if ((mp1 = mp1->b_cont) == NULL)
17526 		return (EPROTO);
17527 
17528 	lifr = (struct lifreq *)mp1->b_rptr;
17529 	sin = (sin_t *)&lifr->lifr_addr;
17530 
17531 	/*
17532 	 * We operate on both IPv4 and IPv6. Thus, we don't allow IPv4/IPv6
17533 	 * specific operations.
17534 	 */
17535 	if (sin->sin_family != AF_UNSPEC)
17536 		return (EINVAL);
17537 
17538 	/*
17539 	 * Get ipif with id 0. We are writer on the from ill. So we can pass
17540 	 * NULLs for the last 4 args and we know the lookup won't fail
17541 	 * with EINPROGRESS.
17542 	 */
17543 	ipif_v4 = ipif_lookup_on_name(lifr->lifr_name,
17544 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_FALSE,
17545 	    ALL_ZONES, NULL, NULL, NULL, NULL);
17546 	ipif_v6 = ipif_lookup_on_name(lifr->lifr_name,
17547 	    mi_strlen(lifr->lifr_name), B_FALSE, &exists, B_TRUE,
17548 	    ALL_ZONES, NULL, NULL, NULL, NULL);
17549 
17550 	if (ipif_v4 == NULL && ipif_v6 == NULL)
17551 		return (ENXIO);
17552 
17553 	if (ipif_v4 != NULL) {
17554 		ASSERT(ipif_v4->ipif_refcnt != 0);
17555 		if (ipif_v4->ipif_id != 0) {
17556 			err = EINVAL;
17557 			goto done;
17558 		}
17559 
17560 		ASSERT(IAM_WRITER_IPIF(ipif_v4));
17561 		*ill_from_v4 = ipif_v4->ipif_ill;
17562 	}
17563 
17564 	if (ipif_v6 != NULL) {
17565 		ASSERT(ipif_v6->ipif_refcnt != 0);
17566 		if (ipif_v6->ipif_id != 0) {
17567 			err = EINVAL;
17568 			goto done;
17569 		}
17570 
17571 		ASSERT(IAM_WRITER_IPIF(ipif_v6));
17572 		*ill_from_v6 = ipif_v6->ipif_ill;
17573 	}
17574 
17575 	err = 0;
17576 	dst_index = lifr->lifr_movetoindex;
17577 	*ill_to_v4 = ill_lookup_on_ifindex(dst_index, B_FALSE,
17578 	    q, mp, ip_process_ioctl, &err);
17579 	if (err != 0) {
17580 		/*
17581 		 * There could be only v6.
17582 		 */
17583 		if (err != ENXIO)
17584 			goto done;
17585 		err = 0;
17586 	}
17587 
17588 	*ill_to_v6 = ill_lookup_on_ifindex(dst_index, B_TRUE,
17589 	    q, mp, ip_process_ioctl, &err);
17590 	if (err != 0) {
17591 		if (err != ENXIO)
17592 			goto done;
17593 		if (*ill_to_v4 == NULL) {
17594 			err = ENXIO;
17595 			goto done;
17596 		}
17597 		err = 0;
17598 	}
17599 
17600 	/*
17601 	 * If we have something to MOVE i.e "from" not NULL,
17602 	 * "to" should be non-NULL.
17603 	 */
17604 	if ((*ill_from_v4 != NULL && *ill_to_v4 == NULL) ||
17605 	    (*ill_from_v6 != NULL && *ill_to_v6 == NULL)) {
17606 		err = EINVAL;
17607 	}
17608 
17609 done:
17610 	if (ipif_v4 != NULL)
17611 		ipif_refrele(ipif_v4);
17612 	if (ipif_v6 != NULL)
17613 		ipif_refrele(ipif_v6);
17614 	return (err);
17615 }
17616 
17617 /*
17618  * FAILOVER and FAILBACK are modelled as MOVE operations.
17619  *
17620  * We don't check whether the MOVE is within the same group or
17621  * not, because this ioctl can be used as a generic mechanism
17622  * to failover from interface A to B, though things will function
17623  * only if they are really part of the same group. Moreover,
17624  * all ipifs may be down and hence temporarily out of the group.
17625  *
17626  * ipif's that need to be moved are first brought down; V4 ipifs are brought
17627  * down first and then V6.  For each we wait for the ipif's to become quiescent.
17628  * Bringing down the ipifs ensures that all ires pointing to these ipifs's
17629  * have been deleted and there are no active references. Once quiescent the
17630  * ipif's are moved and brought up on the new ill.
17631  *
17632  * Normally the source ill and destination ill belong to the same IPMP group
17633  * and hence the same ipsq_t. In the event they don't belong to the same
17634  * same group the two ipsq's are first merged into one ipsq - that of the
17635  * to_ill. The multicast memberships on the source and destination ill cannot
17636  * change during the move operation since multicast joins/leaves also have to
17637  * execute on the same ipsq and are hence serialized.
17638  */
17639 /* ARGSUSED */
17640 int
17641 ip_sioctl_move(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
17642     ip_ioctl_cmd_t *ipip, void *ifreq)
17643 {
17644 	ill_t *ill_to_v4 = NULL;
17645 	ill_t *ill_to_v6 = NULL;
17646 	ill_t *ill_from_v4 = NULL;
17647 	ill_t *ill_from_v6 = NULL;
17648 	int err = 0;
17649 
17650 	/*
17651 	 * setup from and to ill's, we can get EINPROGRESS only for
17652 	 * to_ill's.
17653 	 */
17654 	err = ip_extract_move_args(q, mp, &ill_from_v4, &ill_from_v6,
17655 	    &ill_to_v4, &ill_to_v6);
17656 
17657 	if (err != 0) {
17658 		ip0dbg(("ip_sioctl_move: extract args failed\n"));
17659 		goto done;
17660 	}
17661 
17662 	/*
17663 	 * nothing to do.
17664 	 */
17665 	if ((ill_from_v4 != NULL) && (ill_from_v4 == ill_to_v4)) {
17666 		goto done;
17667 	}
17668 
17669 	/*
17670 	 * nothing to do.
17671 	 */
17672 	if ((ill_from_v6 != NULL) && (ill_from_v6 == ill_to_v6)) {
17673 		goto done;
17674 	}
17675 
17676 	/*
17677 	 * Mark the ill as changing.
17678 	 * ILL_CHANGING flag is cleared when the ipif's are brought up
17679 	 * in ill_up_ipifs in case of error they are cleared below.
17680 	 */
17681 
17682 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
17683 	if (ill_from_v4 != NULL)
17684 		ill_from_v4->ill_state_flags |= ILL_CHANGING;
17685 	if (ill_from_v6 != NULL)
17686 		ill_from_v6->ill_state_flags |= ILL_CHANGING;
17687 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
17688 
17689 	/*
17690 	 * Make sure that both src and dst are
17691 	 * in the same syncq group. If not make it happen.
17692 	 * We are not holding any locks because we are the writer
17693 	 * on the from_ipsq and we will hold locks in ill_merge_groups
17694 	 * to protect to_ipsq against changing.
17695 	 */
17696 	if (ill_from_v4 != NULL) {
17697 		if (ill_from_v4->ill_phyint->phyint_ipsq !=
17698 		    ill_to_v4->ill_phyint->phyint_ipsq) {
17699 			err = ill_merge_groups(ill_from_v4, ill_to_v4,
17700 			    NULL, mp, q);
17701 			goto err_ret;
17702 
17703 		}
17704 		ASSERT(!MUTEX_HELD(&ill_to_v4->ill_lock));
17705 	} else {
17706 
17707 		if (ill_from_v6->ill_phyint->phyint_ipsq !=
17708 		    ill_to_v6->ill_phyint->phyint_ipsq) {
17709 			err = ill_merge_groups(ill_from_v6, ill_to_v6,
17710 			    NULL, mp, q);
17711 			goto err_ret;
17712 
17713 		}
17714 		ASSERT(!MUTEX_HELD(&ill_to_v6->ill_lock));
17715 	}
17716 
17717 	/*
17718 	 * Now that the ipsq's have been merged and we are the writer
17719 	 * lets mark to_ill as changing as well.
17720 	 */
17721 
17722 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
17723 	if (ill_to_v4 != NULL)
17724 		ill_to_v4->ill_state_flags |= ILL_CHANGING;
17725 	if (ill_to_v6 != NULL)
17726 		ill_to_v6->ill_state_flags |= ILL_CHANGING;
17727 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
17728 
17729 	/*
17730 	 * Its ok for us to proceed with the move even if
17731 	 * ill_pending_mp is non null on one of the from ill's as the reply
17732 	 * should not be looking at the ipif, it should only care about the
17733 	 * ill itself.
17734 	 */
17735 
17736 	/*
17737 	 * lets move ipv4 first.
17738 	 */
17739 	if (ill_from_v4 != NULL) {
17740 		ASSERT(IAM_WRITER_ILL(ill_to_v4));
17741 		ill_from_v4->ill_move_in_progress = B_TRUE;
17742 		ill_to_v4->ill_move_in_progress = B_TRUE;
17743 		ill_to_v4->ill_move_peer = ill_from_v4;
17744 		ill_from_v4->ill_move_peer = ill_to_v4;
17745 		err = ill_move(ill_from_v4, ill_to_v4, q, mp);
17746 	}
17747 
17748 	/*
17749 	 * Now lets move ipv6.
17750 	 */
17751 	if (err == 0 && ill_from_v6 != NULL) {
17752 		ASSERT(IAM_WRITER_ILL(ill_to_v6));
17753 		ill_from_v6->ill_move_in_progress = B_TRUE;
17754 		ill_to_v6->ill_move_in_progress = B_TRUE;
17755 		ill_to_v6->ill_move_peer = ill_from_v6;
17756 		ill_from_v6->ill_move_peer = ill_to_v6;
17757 		err = ill_move(ill_from_v6, ill_to_v6, q, mp);
17758 	}
17759 
17760 err_ret:
17761 	/*
17762 	 * EINPROGRESS means we are waiting for the ipif's that need to be
17763 	 * moved to become quiescent.
17764 	 */
17765 	if (err == EINPROGRESS) {
17766 		goto done;
17767 	}
17768 
17769 	/*
17770 	 * if err is set ill_up_ipifs will not be called
17771 	 * lets clear the flags.
17772 	 */
17773 
17774 	GRAB_ILL_LOCKS(ill_to_v4, ill_to_v6);
17775 	GRAB_ILL_LOCKS(ill_from_v4, ill_from_v6);
17776 	/*
17777 	 * Some of the clearing may be redundant. But it is simple
17778 	 * not making any extra checks.
17779 	 */
17780 	if (ill_from_v6 != NULL) {
17781 		ill_from_v6->ill_move_in_progress = B_FALSE;
17782 		ill_from_v6->ill_move_peer = NULL;
17783 		ill_from_v6->ill_state_flags &= ~ILL_CHANGING;
17784 	}
17785 	if (ill_from_v4 != NULL) {
17786 		ill_from_v4->ill_move_in_progress = B_FALSE;
17787 		ill_from_v4->ill_move_peer = NULL;
17788 		ill_from_v4->ill_state_flags &= ~ILL_CHANGING;
17789 	}
17790 	if (ill_to_v6 != NULL) {
17791 		ill_to_v6->ill_move_in_progress = B_FALSE;
17792 		ill_to_v6->ill_move_peer = NULL;
17793 		ill_to_v6->ill_state_flags &= ~ILL_CHANGING;
17794 	}
17795 	if (ill_to_v4 != NULL) {
17796 		ill_to_v4->ill_move_in_progress = B_FALSE;
17797 		ill_to_v4->ill_move_peer = NULL;
17798 		ill_to_v4->ill_state_flags &= ~ILL_CHANGING;
17799 	}
17800 
17801 	/*
17802 	 * Check for setting INACTIVE, if STANDBY is set and FAILED is not set.
17803 	 * Do this always to maintain proper state i.e even in case of errors.
17804 	 * As phyint_inactive looks at both v4 and v6 interfaces,
17805 	 * we need not call on both v4 and v6 interfaces.
17806 	 */
17807 	if (ill_from_v4 != NULL) {
17808 		if ((ill_from_v4->ill_phyint->phyint_flags &
17809 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
17810 			phyint_inactive(ill_from_v4->ill_phyint);
17811 		}
17812 	} else if (ill_from_v6 != NULL) {
17813 		if ((ill_from_v6->ill_phyint->phyint_flags &
17814 		    (PHYI_STANDBY | PHYI_FAILED)) == PHYI_STANDBY) {
17815 			phyint_inactive(ill_from_v6->ill_phyint);
17816 		}
17817 	}
17818 
17819 	if (ill_to_v4 != NULL) {
17820 		if (ill_to_v4->ill_phyint->phyint_flags & PHYI_INACTIVE) {
17821 			ill_to_v4->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
17822 		}
17823 	} else if (ill_to_v6 != NULL) {
17824 		if (ill_to_v6->ill_phyint->phyint_flags & PHYI_INACTIVE) {
17825 			ill_to_v6->ill_phyint->phyint_flags &= ~PHYI_INACTIVE;
17826 		}
17827 	}
17828 
17829 	RELEASE_ILL_LOCKS(ill_to_v4, ill_to_v6);
17830 	RELEASE_ILL_LOCKS(ill_from_v4, ill_from_v6);
17831 
17832 no_err:
17833 	/*
17834 	 * lets bring the interfaces up on the to_ill.
17835 	 */
17836 	if (err == 0) {
17837 		err = ill_up_ipifs(ill_to_v4 == NULL ? ill_to_v6:ill_to_v4,
17838 		    q, mp);
17839 	}
17840 
17841 	if (err == 0) {
17842 		if (ill_from_v4 != NULL && ill_to_v4 != NULL)
17843 			ilm_send_multicast_reqs(ill_from_v4, ill_to_v4);
17844 
17845 		if (ill_from_v6 != NULL && ill_to_v6 != NULL)
17846 			ilm_send_multicast_reqs(ill_from_v6, ill_to_v6);
17847 	}
17848 done:
17849 
17850 	if (ill_to_v4 != NULL) {
17851 		ill_refrele(ill_to_v4);
17852 	}
17853 	if (ill_to_v6 != NULL) {
17854 		ill_refrele(ill_to_v6);
17855 	}
17856 
17857 	return (err);
17858 }
17859 
17860 static void
17861 ill_dl_down(ill_t *ill)
17862 {
17863 	/*
17864 	 * The ill is down; unbind but stay attached since we're still
17865 	 * associated with a PPA. If we have negotiated DLPI capabilites
17866 	 * with the data link service provider (IDS_OK) then reset them.
17867 	 * The interval between unbinding and rebinding is potentially
17868 	 * unbounded hence we cannot assume things will be the same.
17869 	 * The DLPI capabilities will be probed again when the data link
17870 	 * is brought up.
17871 	 */
17872 	mblk_t	*mp = ill->ill_unbind_mp;
17873 	hook_nic_event_t *info;
17874 
17875 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
17876 
17877 	ill->ill_unbind_mp = NULL;
17878 	if (mp != NULL) {
17879 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
17880 		    dlpi_prim_str(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
17881 		    ill->ill_name));
17882 		mutex_enter(&ill->ill_lock);
17883 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
17884 		mutex_exit(&ill->ill_lock);
17885 		if (ill->ill_dlpi_capab_state == IDS_OK)
17886 			ill_capability_reset(ill);
17887 		ill_dlpi_send(ill, mp);
17888 	}
17889 
17890 	/*
17891 	 * Toss all of our multicast memberships.  We could keep them, but
17892 	 * then we'd have to do bookkeeping of any joins and leaves performed
17893 	 * by the application while the the interface is down (we can't just
17894 	 * issue them because arp cannot currently process AR_ENTRY_SQUERY's
17895 	 * on a downed interface).
17896 	 */
17897 	ill_leave_multicast(ill);
17898 
17899 	mutex_enter(&ill->ill_lock);
17900 
17901 	ill->ill_dl_up = 0;
17902 
17903 	if ((info = ill->ill_nic_event_info) != NULL) {
17904 		ip2dbg(("ill_dl_down:unexpected nic event %d attached for %s\n",
17905 		    info->hne_event, ill->ill_name));
17906 		if (info->hne_data != NULL)
17907 			kmem_free(info->hne_data, info->hne_datalen);
17908 		kmem_free(info, sizeof (hook_nic_event_t));
17909 	}
17910 
17911 	info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP);
17912 	if (info != NULL) {
17913 		info->hne_nic = ill->ill_phyint->phyint_ifindex;
17914 		info->hne_lif = 0;
17915 		info->hne_event = NE_DOWN;
17916 		info->hne_data = NULL;
17917 		info->hne_datalen = 0;
17918 		info->hne_family = ill->ill_isv6 ? ipv6 : ipv4;
17919 	} else
17920 		ip2dbg(("ill_dl_down: could not attach DOWN nic event "
17921 		    "information for %s (ENOMEM)\n", ill->ill_name));
17922 
17923 	ill->ill_nic_event_info = info;
17924 
17925 	mutex_exit(&ill->ill_lock);
17926 }
17927 
17928 void
17929 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
17930 {
17931 	union DL_primitives *dlp;
17932 	t_uscalar_t prim;
17933 
17934 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
17935 
17936 	dlp = (union DL_primitives *)mp->b_rptr;
17937 	prim = dlp->dl_primitive;
17938 
17939 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
17940 		dlpi_prim_str(prim), prim, ill->ill_name));
17941 
17942 	switch (prim) {
17943 	case DL_PHYS_ADDR_REQ:
17944 	{
17945 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
17946 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
17947 		break;
17948 	}
17949 	case DL_BIND_REQ:
17950 		mutex_enter(&ill->ill_lock);
17951 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
17952 		mutex_exit(&ill->ill_lock);
17953 		break;
17954 	}
17955 
17956 	ill->ill_dlpi_pending = prim;
17957 
17958 	/*
17959 	 * Some drivers send M_FLUSH up to IP as part of unbind
17960 	 * request.  When this M_FLUSH is sent back to the driver,
17961 	 * this can go after we send the detach request if the
17962 	 * M_FLUSH ends up in IP's syncq. To avoid that, we reply
17963 	 * to the M_FLUSH in ip_rput and locally generate another
17964 	 * M_FLUSH for the correctness.  This will get freed in
17965 	 * ip_wput_nondata.
17966 	 */
17967 	if (prim == DL_UNBIND_REQ)
17968 		(void) putnextctl1(ill->ill_rq, M_FLUSH, FLUSHRW);
17969 
17970 	putnext(ill->ill_wq, mp);
17971 }
17972 
17973 /*
17974  * Send a DLPI control message to the driver but make sure there
17975  * is only one outstanding message. Uses ill_dlpi_pending to tell
17976  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
17977  * when an ACK or a NAK is received to process the next queued message.
17978  *
17979  * We don't protect ill_dlpi_pending with any lock. This is okay as
17980  * every place where its accessed, ip is exclusive while accessing
17981  * ill_dlpi_pending except when this function is called from ill_init()
17982  */
17983 void
17984 ill_dlpi_send(ill_t *ill, mblk_t *mp)
17985 {
17986 	mblk_t **mpp;
17987 
17988 	ASSERT(IAM_WRITER_ILL(ill));
17989 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
17990 
17991 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
17992 		/* Must queue message. Tail insertion */
17993 		mpp = &ill->ill_dlpi_deferred;
17994 		while (*mpp != NULL)
17995 			mpp = &((*mpp)->b_next);
17996 
17997 		ip1dbg(("ill_dlpi_send: deferring request for %s\n",
17998 		    ill->ill_name));
17999 
18000 		*mpp = mp;
18001 		return;
18002 	}
18003 
18004 	ill_dlpi_dispatch(ill, mp);
18005 }
18006 
18007 /*
18008  * Called when an DLPI control message has been acked or nacked to
18009  * send down the next queued message (if any).
18010  */
18011 void
18012 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
18013 {
18014 	mblk_t *mp;
18015 
18016 	ASSERT(IAM_WRITER_ILL(ill));
18017 
18018 	ASSERT(prim != DL_PRIM_INVAL);
18019 	if (ill->ill_dlpi_pending != prim) {
18020 		if (ill->ill_dlpi_pending == DL_PRIM_INVAL) {
18021 			(void) mi_strlog(ill->ill_rq, 1,
18022 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
18023 			    "ill_dlpi_done: unsolicited ack for %s from %s\n",
18024 			    dlpi_prim_str(prim), ill->ill_name);
18025 		} else {
18026 			(void) mi_strlog(ill->ill_rq, 1,
18027 			    SL_CONSOLE|SL_ERROR|SL_TRACE,
18028 			    "ill_dlpi_done: unexpected ack for %s from %s "
18029 			    "(expecting ack for %s)\n",
18030 			    dlpi_prim_str(prim), ill->ill_name,
18031 			    dlpi_prim_str(ill->ill_dlpi_pending));
18032 		}
18033 		return;
18034 	}
18035 
18036 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
18037 	    dlpi_prim_str(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
18038 
18039 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
18040 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
18041 		return;
18042 	}
18043 
18044 	ill->ill_dlpi_deferred = mp->b_next;
18045 	mp->b_next = NULL;
18046 
18047 	ill_dlpi_dispatch(ill, mp);
18048 }
18049 
18050 void
18051 conn_delete_ire(conn_t *connp, caddr_t arg)
18052 {
18053 	ipif_t	*ipif = (ipif_t *)arg;
18054 	ire_t	*ire;
18055 
18056 	/*
18057 	 * Look at the cached ires on conns which has pointers to ipifs.
18058 	 * We just call ire_refrele which clears up the reference
18059 	 * to ire. Called when a conn closes. Also called from ipif_free
18060 	 * to cleanup indirect references to the stale ipif via the cached ire.
18061 	 */
18062 	mutex_enter(&connp->conn_lock);
18063 	ire = connp->conn_ire_cache;
18064 	if (ire != NULL && (ipif == NULL || ire->ire_ipif == ipif)) {
18065 		connp->conn_ire_cache = NULL;
18066 		mutex_exit(&connp->conn_lock);
18067 		IRE_REFRELE_NOTR(ire);
18068 		return;
18069 	}
18070 	mutex_exit(&connp->conn_lock);
18071 
18072 }
18073 
18074 /*
18075  * Some operations (illgrp_delete(), ipif_down()) conditionally delete a number
18076  * of IREs. Those IREs may have been previously cached in the conn structure.
18077  * This ipcl_walk() walker function releases all references to such IREs based
18078  * on the condemned flag.
18079  */
18080 /* ARGSUSED */
18081 void
18082 conn_cleanup_stale_ire(conn_t *connp, caddr_t arg)
18083 {
18084 	ire_t	*ire;
18085 
18086 	mutex_enter(&connp->conn_lock);
18087 	ire = connp->conn_ire_cache;
18088 	if (ire != NULL && (ire->ire_marks & IRE_MARK_CONDEMNED)) {
18089 		connp->conn_ire_cache = NULL;
18090 		mutex_exit(&connp->conn_lock);
18091 		IRE_REFRELE_NOTR(ire);
18092 		return;
18093 	}
18094 	mutex_exit(&connp->conn_lock);
18095 }
18096 
18097 /*
18098  * Take down a specific interface, but don't lose any information about it.
18099  * Also delete interface from its interface group (ifgrp).
18100  * (Always called as writer.)
18101  * This function goes through the down sequence even if the interface is
18102  * already down. There are 2 reasons.
18103  * a. Currently we permit interface routes that depend on down interfaces
18104  *    to be added. This behaviour itself is questionable. However it appears
18105  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
18106  *    time. We go thru the cleanup in order to remove these routes.
18107  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
18108  *    DL_ERROR_ACK in response to the the DL_BIND request. The interface is
18109  *    down, but we need to cleanup i.e. do ill_dl_down and
18110  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
18111  *
18112  * IP-MT notes:
18113  *
18114  * Model of reference to interfaces.
18115  *
18116  * The following members in ipif_t track references to the ipif.
18117  *	int     ipif_refcnt;    Active reference count
18118  *	uint_t  ipif_ire_cnt;   Number of ire's referencing this ipif
18119  * The following members in ill_t track references to the ill.
18120  *	int             ill_refcnt;     active refcnt
18121  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
18122  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
18123  *
18124  * Reference to an ipif or ill can be obtained in any of the following ways.
18125  *
18126  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
18127  * Pointers to ipif / ill from other data structures viz ire and conn.
18128  * Implicit reference to the ipif / ill by holding a reference to the ire.
18129  *
18130  * The ipif/ill lookup functions return a reference held ipif / ill.
18131  * ipif_refcnt and ill_refcnt track the reference counts respectively.
18132  * This is a purely dynamic reference count associated with threads holding
18133  * references to the ipif / ill. Pointers from other structures do not
18134  * count towards this reference count.
18135  *
18136  * ipif_ire_cnt/ill_ire_cnt is the number of ire's associated with the
18137  * ipif/ill. This is incremented whenever a new ire is created referencing the
18138  * ipif/ill. This is done atomically inside ire_add_v[46] where the ire is
18139  * actually added to the ire hash table. The count is decremented in
18140  * ire_inactive where the ire is destroyed.
18141  *
18142  * nce's reference ill's thru nce_ill and the count of nce's associated with
18143  * an ill is recorded in ill_nce_cnt. This is incremented atomically in
18144  * ndp_add() where the nce is actually added to the table. Similarly it is
18145  * decremented in ndp_inactive where the nce is destroyed.
18146  *
18147  * Flow of ioctls involving interface down/up
18148  *
18149  * The following is the sequence of an attempt to set some critical flags on an
18150  * up interface.
18151  * ip_sioctl_flags
18152  * ipif_down
18153  * wait for ipif to be quiescent
18154  * ipif_down_tail
18155  * ip_sioctl_flags_tail
18156  *
18157  * All set ioctls that involve down/up sequence would have a skeleton similar
18158  * to the above. All the *tail functions are called after the refcounts have
18159  * dropped to the appropriate values.
18160  *
18161  * The mechanism to quiesce an ipif is as follows.
18162  *
18163  * Mark the ipif as IPIF_CHANGING. No more lookups will be allowed
18164  * on the ipif. Callers either pass a flag requesting wait or the lookup
18165  *  functions will return NULL.
18166  *
18167  * Delete all ires referencing this ipif
18168  *
18169  * Any thread attempting to do an ipif_refhold on an ipif that has been
18170  * obtained thru a cached pointer will first make sure that
18171  * the ipif can be refheld using the macro IPIF_CAN_LOOKUP and only then
18172  * increment the refcount.
18173  *
18174  * The above guarantees that the ipif refcount will eventually come down to
18175  * zero and the ipif will quiesce, once all threads that currently hold a
18176  * reference to the ipif refrelease the ipif. The ipif is quiescent after the
18177  * ipif_refcount has dropped to zero and all ire's associated with this ipif
18178  * have also been ire_inactive'd. i.e. when ipif_ire_cnt and ipif_refcnt both
18179  * drop to zero.
18180  *
18181  * Lookups during the IPIF_CHANGING/ILL_CHANGING interval.
18182  *
18183  * Threads trying to lookup an ipif or ill can pass a flag requesting
18184  * wait and restart if the ipif / ill cannot be looked up currently.
18185  * For eg. bind, and route operations (Eg. route add / delete) cannot return
18186  * failure if the ipif is currently undergoing an exclusive operation, and
18187  * hence pass the flag. The mblk is then enqueued in the ipsq and the operation
18188  * is restarted by ipsq_exit() when the currently exclusive ioctl completes.
18189  * The lookup and enqueue is atomic using the ill_lock and ipsq_lock. The
18190  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
18191  * change while the ill_lock is held. Before dropping the ill_lock we acquire
18192  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
18193  * until we release the ipsq_lock, even though the the ill/ipif state flags
18194  * can change after we drop the ill_lock.
18195  *
18196  * An attempt to send out a packet using an ipif that is currently
18197  * IPIF_CHANGING will fail. No attempt is made in this case to enqueue this
18198  * operation and restart it later when the exclusive condition on the ipif ends.
18199  * This is an example of not passing the wait flag to the lookup functions. For
18200  * example an attempt to refhold and use conn->conn_multicast_ipif and send
18201  * out a multicast packet on that ipif will fail while the ipif is
18202  * IPIF_CHANGING. An attempt to create an IRE_CACHE using an ipif that is
18203  * currently IPIF_CHANGING will also fail.
18204  */
18205 int
18206 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
18207 {
18208 	ill_t		*ill = ipif->ipif_ill;
18209 	phyint_t	*phyi;
18210 	conn_t		*connp;
18211 	boolean_t	success;
18212 	boolean_t	ipif_was_up = B_FALSE;
18213 
18214 	ASSERT(IAM_WRITER_IPIF(ipif));
18215 
18216 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
18217 
18218 	if (ipif->ipif_flags & IPIF_UP) {
18219 		mutex_enter(&ill->ill_lock);
18220 		ipif->ipif_flags &= ~IPIF_UP;
18221 		ASSERT(ill->ill_ipif_up_count > 0);
18222 		--ill->ill_ipif_up_count;
18223 		mutex_exit(&ill->ill_lock);
18224 		ipif_was_up = B_TRUE;
18225 		/* Update status in SCTP's list */
18226 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
18227 	}
18228 
18229 	/*
18230 	 * Blow away v6 memberships we established in ipif_multicast_up(); the
18231 	 * v4 ones are left alone (as is the ipif_multicast_up flag, so we
18232 	 * know not to rejoin when the interface is brought back up).
18233 	 */
18234 	if (ipif->ipif_isv6)
18235 		ipif_multicast_down(ipif);
18236 	/*
18237 	 * Remove from the mapping for __sin6_src_id. We insert only
18238 	 * when the address is not INADDR_ANY. As IPv4 addresses are
18239 	 * stored as mapped addresses, we need to check for mapped
18240 	 * INADDR_ANY also.
18241 	 */
18242 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
18243 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
18244 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
18245 		int err;
18246 
18247 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
18248 		    ipif->ipif_zoneid);
18249 		if (err != 0) {
18250 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
18251 		}
18252 	}
18253 
18254 	/*
18255 	 * Before we delete the ill from the group (if any), we need
18256 	 * to make sure that we delete all the routes dependent on
18257 	 * this and also any ipifs dependent on this ipif for
18258 	 * source address. We need to do before we delete from
18259 	 * the group because
18260 	 *
18261 	 * 1) ipif_down_delete_ire de-references ill->ill_group.
18262 	 *
18263 	 * 2) ipif_update_other_ipifs needs to walk the whole group
18264 	 *    for re-doing source address selection. Note that
18265 	 *    ipif_select_source[_v6] called from
18266 	 *    ipif_update_other_ipifs[_v6] will not pick this ipif
18267 	 *    because we have already marked down here i.e cleared
18268 	 *    IPIF_UP.
18269 	 */
18270 	if (ipif->ipif_isv6)
18271 		ire_walk_v6(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
18272 	else
18273 		ire_walk_v4(ipif_down_delete_ire, (char *)ipif, ALL_ZONES);
18274 
18275 	/*
18276 	 * Need to add these also to be saved and restored when the
18277 	 * ipif is brought down and up
18278 	 */
18279 	mutex_enter(&ire_mrtun_lock);
18280 	if (ire_mrtun_count != 0) {
18281 		mutex_exit(&ire_mrtun_lock);
18282 		ire_walk_ill_mrtun(0, 0, ipif_down_delete_ire,
18283 		    (char *)ipif, NULL);
18284 	} else {
18285 		mutex_exit(&ire_mrtun_lock);
18286 	}
18287 
18288 	mutex_enter(&ire_srcif_table_lock);
18289 	if (ire_srcif_table_count > 0) {
18290 		mutex_exit(&ire_srcif_table_lock);
18291 		ire_walk_srcif_table_v4(ipif_down_delete_ire, (char *)ipif);
18292 	} else {
18293 		mutex_exit(&ire_srcif_table_lock);
18294 	}
18295 
18296 	/*
18297 	 * Cleaning up the conn_ire_cache or conns must be done only after the
18298 	 * ires have been deleted above. Otherwise a thread could end up
18299 	 * caching an ire in a conn after we have finished the cleanup of the
18300 	 * conn. The caching is done after making sure that the ire is not yet
18301 	 * condemned. Also documented in the block comment above ip_output
18302 	 */
18303 	ipcl_walk(conn_cleanup_stale_ire, NULL);
18304 	/* Also, delete the ires cached in SCTP */
18305 	sctp_ire_cache_flush(ipif);
18306 
18307 	/* Resolve any IPsec/IKE NAT-T instances that depend on this ipif. */
18308 	nattymod_clean_ipif(ipif);
18309 
18310 	/*
18311 	 * Update any other ipifs which have used "our" local address as
18312 	 * a source address. This entails removing and recreating IRE_INTERFACE
18313 	 * entries for such ipifs.
18314 	 */
18315 	if (ipif->ipif_isv6)
18316 		ipif_update_other_ipifs_v6(ipif, ill->ill_group);
18317 	else
18318 		ipif_update_other_ipifs(ipif, ill->ill_group);
18319 
18320 	if (ipif_was_up) {
18321 		/*
18322 		 * Check whether it is last ipif to leave this group.
18323 		 * If this is the last ipif to leave, we should remove
18324 		 * this ill from the group as ipif_select_source will not
18325 		 * be able to find any useful ipifs if this ill is selected
18326 		 * for load balancing.
18327 		 *
18328 		 * For nameless groups, we should call ifgrp_delete if this
18329 		 * belongs to some group. As this ipif is going down, we may
18330 		 * need to reconstruct groups.
18331 		 */
18332 		phyi = ill->ill_phyint;
18333 		/*
18334 		 * If the phyint_groupname_len is 0, it may or may not
18335 		 * be in the nameless group. If the phyint_groupname_len is
18336 		 * not 0, then this ill should be part of some group.
18337 		 * As we always insert this ill in the group if
18338 		 * phyint_groupname_len is not zero when the first ipif
18339 		 * comes up (in ipif_up_done), it should be in a group
18340 		 * when the namelen is not 0.
18341 		 *
18342 		 * NOTE : When we delete the ill from the group,it will
18343 		 * blow away all the IRE_CACHES pointing either at this ipif or
18344 		 * ill_wq (illgrp_cache_delete does this). Thus, no IRES
18345 		 * should be pointing at this ill.
18346 		 */
18347 		ASSERT(phyi->phyint_groupname_len == 0 ||
18348 		    (phyi->phyint_groupname != NULL && ill->ill_group != NULL));
18349 
18350 		if (phyi->phyint_groupname_len != 0) {
18351 			if (ill->ill_ipif_up_count == 0)
18352 				illgrp_delete(ill);
18353 		}
18354 
18355 		/*
18356 		 * If we have deleted some of the broadcast ires associated
18357 		 * with this ipif, we need to re-nominate somebody else if
18358 		 * the ires that we deleted were the nominated ones.
18359 		 */
18360 		if (ill->ill_group != NULL && !ill->ill_isv6)
18361 			ipif_renominate_bcast(ipif);
18362 	}
18363 
18364 	/*
18365 	 * neighbor-discovery or arp entries for this interface.
18366 	 */
18367 	ipif_ndp_down(ipif);
18368 
18369 	/*
18370 	 * If mp is NULL the caller will wait for the appropriate refcnt.
18371 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
18372 	 * and ill_delete -> ipif_free -> ipif_down
18373 	 */
18374 	if (mp == NULL) {
18375 		ASSERT(q == NULL);
18376 		return (0);
18377 	}
18378 
18379 	if (CONN_Q(q)) {
18380 		connp = Q_TO_CONN(q);
18381 		mutex_enter(&connp->conn_lock);
18382 	} else {
18383 		connp = NULL;
18384 	}
18385 	mutex_enter(&ill->ill_lock);
18386 	/*
18387 	 * Are there any ire's pointing to this ipif that are still active ?
18388 	 * If this is the last ipif going down, are there any ire's pointing
18389 	 * to this ill that are still active ?
18390 	 */
18391 	if (ipif_is_quiescent(ipif)) {
18392 		mutex_exit(&ill->ill_lock);
18393 		if (connp != NULL)
18394 			mutex_exit(&connp->conn_lock);
18395 		return (0);
18396 	}
18397 
18398 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
18399 	    ill->ill_name, (void *)ill));
18400 	/*
18401 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
18402 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
18403 	 * which in turn is called by the last refrele on the ipif/ill/ire.
18404 	 */
18405 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
18406 	if (!success) {
18407 		/* The conn is closing. So just return */
18408 		ASSERT(connp != NULL);
18409 		mutex_exit(&ill->ill_lock);
18410 		mutex_exit(&connp->conn_lock);
18411 		return (EINTR);
18412 	}
18413 
18414 	mutex_exit(&ill->ill_lock);
18415 	if (connp != NULL)
18416 		mutex_exit(&connp->conn_lock);
18417 	return (EINPROGRESS);
18418 }
18419 
18420 void
18421 ipif_down_tail(ipif_t *ipif)
18422 {
18423 	ill_t	*ill = ipif->ipif_ill;
18424 
18425 	/*
18426 	 * Skip any loopback interface (null wq).
18427 	 * If this is the last logical interface on the ill
18428 	 * have ill_dl_down tell the driver we are gone (unbind)
18429 	 * Note that lun 0 can ipif_down even though
18430 	 * there are other logical units that are up.
18431 	 * This occurs e.g. when we change a "significant" IFF_ flag.
18432 	 */
18433 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
18434 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
18435 	    ill->ill_dl_up) {
18436 		ill_dl_down(ill);
18437 	}
18438 	ill->ill_logical_down = 0;
18439 
18440 	/*
18441 	 * Have to be after removing the routes in ipif_down_delete_ire.
18442 	 */
18443 	if (ipif->ipif_isv6) {
18444 		if (ill->ill_flags & ILLF_XRESOLV)
18445 			ipif_arp_down(ipif);
18446 	} else {
18447 		ipif_arp_down(ipif);
18448 	}
18449 
18450 	ip_rts_ifmsg(ipif);
18451 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif);
18452 }
18453 
18454 /*
18455  * Bring interface logically down without bringing the physical interface
18456  * down e.g. when the netmask is changed. This avoids long lasting link
18457  * negotiations between an ethernet interface and a certain switches.
18458  */
18459 static int
18460 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
18461 {
18462 	/*
18463 	 * The ill_logical_down flag is a transient flag. It is set here
18464 	 * and is cleared once the down has completed in ipif_down_tail.
18465 	 * This flag does not indicate whether the ill stream is in the
18466 	 * DL_BOUND state with the driver. Instead this flag is used by
18467 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
18468 	 * the driver. The state of the ill stream i.e. whether it is
18469 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
18470 	 */
18471 	ipif->ipif_ill->ill_logical_down = 1;
18472 	return (ipif_down(ipif, q, mp));
18473 }
18474 
18475 /*
18476  * This is called when the SIOCSLIFUSESRC ioctl is processed in IP.
18477  * If the usesrc client ILL is already part of a usesrc group or not,
18478  * in either case a ire_stq with the matching usesrc client ILL will
18479  * locate the IRE's that need to be deleted. We want IREs to be created
18480  * with the new source address.
18481  */
18482 static void
18483 ipif_delete_cache_ire(ire_t *ire, char *ill_arg)
18484 {
18485 	ill_t	*ucill = (ill_t *)ill_arg;
18486 
18487 	ASSERT(IAM_WRITER_ILL(ucill));
18488 
18489 	if (ire->ire_stq == NULL)
18490 		return;
18491 
18492 	if ((ire->ire_type == IRE_CACHE) &&
18493 	    ((ill_t *)ire->ire_stq->q_ptr == ucill))
18494 		ire_delete(ire);
18495 }
18496 
18497 /*
18498  * ire_walk routine to delete every IRE dependent on the interface
18499  * address that is going down.	(Always called as writer.)
18500  * Works for both v4 and v6.
18501  * In addition for checking for ire_ipif matches it also checks for
18502  * IRE_CACHE entries which have the same source address as the
18503  * disappearing ipif since ipif_select_source might have picked
18504  * that source. Note that ipif_down/ipif_update_other_ipifs takes
18505  * care of any IRE_INTERFACE with the disappearing source address.
18506  */
18507 static void
18508 ipif_down_delete_ire(ire_t *ire, char *ipif_arg)
18509 {
18510 	ipif_t	*ipif = (ipif_t *)ipif_arg;
18511 	ill_t *ire_ill;
18512 	ill_t *ipif_ill;
18513 
18514 	ASSERT(IAM_WRITER_IPIF(ipif));
18515 	if (ire->ire_ipif == NULL)
18516 		return;
18517 
18518 	/*
18519 	 * For IPv4, we derive source addresses for an IRE from ipif's
18520 	 * belonging to the same IPMP group as the IRE's outgoing
18521 	 * interface.  If an IRE's outgoing interface isn't in the
18522 	 * same IPMP group as a particular ipif, then that ipif
18523 	 * couldn't have been used as a source address for this IRE.
18524 	 *
18525 	 * For IPv6, source addresses are only restricted to the IPMP group
18526 	 * if the IRE is for a link-local address or a multicast address.
18527 	 * Otherwise, source addresses for an IRE can be chosen from
18528 	 * interfaces other than the the outgoing interface for that IRE.
18529 	 *
18530 	 * For source address selection details, see ipif_select_source()
18531 	 * and ipif_select_source_v6().
18532 	 */
18533 	if (ire->ire_ipversion == IPV4_VERSION ||
18534 	    IN6_IS_ADDR_LINKLOCAL(&ire->ire_addr_v6) ||
18535 	    IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) {
18536 		ire_ill = ire->ire_ipif->ipif_ill;
18537 		ipif_ill = ipif->ipif_ill;
18538 
18539 		if (ire_ill->ill_group != ipif_ill->ill_group) {
18540 			return;
18541 		}
18542 	}
18543 
18544 
18545 	if (ire->ire_ipif != ipif) {
18546 		/*
18547 		 * Look for a matching source address.
18548 		 */
18549 		if (ire->ire_type != IRE_CACHE)
18550 			return;
18551 		if (ipif->ipif_flags & IPIF_NOLOCAL)
18552 			return;
18553 
18554 		if (ire->ire_ipversion == IPV4_VERSION) {
18555 			if (ire->ire_src_addr != ipif->ipif_src_addr)
18556 				return;
18557 		} else {
18558 			if (!IN6_ARE_ADDR_EQUAL(&ire->ire_src_addr_v6,
18559 			    &ipif->ipif_v6lcl_addr))
18560 				return;
18561 		}
18562 		ire_delete(ire);
18563 		return;
18564 	}
18565 	/*
18566 	 * ire_delete() will do an ire_flush_cache which will delete
18567 	 * all ire_ipif matches
18568 	 */
18569 	ire_delete(ire);
18570 }
18571 
18572 /*
18573  * ire_walk_ill function for deleting all IRE_CACHE entries for an ill when
18574  * 1) an ipif (on that ill) changes the IPIF_DEPRECATED flags, or
18575  * 2) when an interface is brought up or down (on that ill).
18576  * This ensures that the IRE_CACHE entries don't retain stale source
18577  * address selection results.
18578  */
18579 void
18580 ill_ipif_cache_delete(ire_t *ire, char *ill_arg)
18581 {
18582 	ill_t	*ill = (ill_t *)ill_arg;
18583 	ill_t	*ipif_ill;
18584 
18585 	ASSERT(IAM_WRITER_ILL(ill));
18586 	/*
18587 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18588 	 * Hence this should be IRE_CACHE.
18589 	 */
18590 	ASSERT(ire->ire_type == IRE_CACHE);
18591 
18592 	/*
18593 	 * We are called for IRE_CACHES whose ire_ipif matches ill.
18594 	 * We are only interested in IRE_CACHES that has borrowed
18595 	 * the source address from ill_arg e.g. ipif_up_done[_v6]
18596 	 * for which we need to look at ire_ipif->ipif_ill match
18597 	 * with ill.
18598 	 */
18599 	ASSERT(ire->ire_ipif != NULL);
18600 	ipif_ill = ire->ire_ipif->ipif_ill;
18601 	if (ipif_ill == ill || (ill->ill_group != NULL &&
18602 	    ipif_ill->ill_group == ill->ill_group)) {
18603 		ire_delete(ire);
18604 	}
18605 }
18606 
18607 /*
18608  * Delete all the ire whose stq references ill_arg.
18609  */
18610 static void
18611 ill_stq_cache_delete(ire_t *ire, char *ill_arg)
18612 {
18613 	ill_t	*ill = (ill_t *)ill_arg;
18614 	ill_t	*ire_ill;
18615 
18616 	ASSERT(IAM_WRITER_ILL(ill));
18617 	/*
18618 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18619 	 * Hence this should be IRE_CACHE.
18620 	 */
18621 	ASSERT(ire->ire_type == IRE_CACHE);
18622 
18623 	/*
18624 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
18625 	 * matches ill. We are only interested in IRE_CACHES that
18626 	 * has ire_stq->q_ptr pointing at ill_arg. Thus we do the
18627 	 * filtering here.
18628 	 */
18629 	ire_ill = (ill_t *)ire->ire_stq->q_ptr;
18630 
18631 	if (ire_ill == ill)
18632 		ire_delete(ire);
18633 }
18634 
18635 /*
18636  * This is called when an ill leaves the group. We want to delete
18637  * all IRE_CACHES whose stq is pointing at ill_wq or ire_ipif is
18638  * pointing at ill.
18639  */
18640 static void
18641 illgrp_cache_delete(ire_t *ire, char *ill_arg)
18642 {
18643 	ill_t	*ill = (ill_t *)ill_arg;
18644 
18645 	ASSERT(IAM_WRITER_ILL(ill));
18646 	ASSERT(ill->ill_group == NULL);
18647 	/*
18648 	 * We use MATCH_IRE_TYPE/IRE_CACHE while calling ire_walk_ill_v4.
18649 	 * Hence this should be IRE_CACHE.
18650 	 */
18651 	ASSERT(ire->ire_type == IRE_CACHE);
18652 	/*
18653 	 * We are called for IRE_CACHES whose ire_stq and ire_ipif
18654 	 * matches ill. We are interested in both.
18655 	 */
18656 	ASSERT((ill == (ill_t *)ire->ire_stq->q_ptr) ||
18657 	    (ire->ire_ipif->ipif_ill == ill));
18658 
18659 	ire_delete(ire);
18660 }
18661 
18662 /*
18663  * Initiate deallocate of an IPIF. Always called as writer. Called by
18664  * ill_delete or ip_sioctl_removeif.
18665  */
18666 static void
18667 ipif_free(ipif_t *ipif)
18668 {
18669 	ASSERT(IAM_WRITER_IPIF(ipif));
18670 
18671 	if (ipif->ipif_recovery_id != 0)
18672 		(void) untimeout(ipif->ipif_recovery_id);
18673 	ipif->ipif_recovery_id = 0;
18674 
18675 	/* Remove conn references */
18676 	reset_conn_ipif(ipif);
18677 
18678 	/*
18679 	 * Make sure we have valid net and subnet broadcast ire's for the
18680 	 * other ipif's which share them with this ipif.
18681 	 */
18682 	if (!ipif->ipif_isv6)
18683 		ipif_check_bcast_ires(ipif);
18684 
18685 	/*
18686 	 * Take down the interface. We can be called either from ill_delete
18687 	 * or from ip_sioctl_removeif.
18688 	 */
18689 	(void) ipif_down(ipif, NULL, NULL);
18690 
18691 	rw_enter(&ill_g_lock, RW_WRITER);
18692 	/* Remove pointers to this ill in the multicast routing tables */
18693 	reset_mrt_vif_ipif(ipif);
18694 	rw_exit(&ill_g_lock);
18695 }
18696 
18697 static void
18698 ipif_free_tail(ipif_t *ipif)
18699 {
18700 	mblk_t	*mp;
18701 	ipif_t	**ipifp;
18702 
18703 	/*
18704 	 * Free state for addition IRE_IF_[NO]RESOLVER ire's.
18705 	 */
18706 	mutex_enter(&ipif->ipif_saved_ire_lock);
18707 	mp = ipif->ipif_saved_ire_mp;
18708 	ipif->ipif_saved_ire_mp = NULL;
18709 	mutex_exit(&ipif->ipif_saved_ire_lock);
18710 	freemsg(mp);
18711 
18712 	/*
18713 	 * Need to hold both ill_g_lock and ill_lock while
18714 	 * inserting or removing an ipif from the linked list
18715 	 * of ipifs hanging off the ill.
18716 	 */
18717 	rw_enter(&ill_g_lock, RW_WRITER);
18718 	/*
18719 	 * Remove all multicast memberships on the interface now.
18720 	 * This removes IPv4 multicast memberships joined within
18721 	 * the kernel as ipif_down does not do ipif_multicast_down
18722 	 * for IPv4. IPv6 is not handled here as the multicast memberships
18723 	 * are based on ill and not on ipif.
18724 	 */
18725 	ilm_free(ipif);
18726 
18727 	/*
18728 	 * Since we held the ill_g_lock while doing the ilm_free above,
18729 	 * we can assert the ilms were really deleted and not just marked
18730 	 * ILM_DELETED.
18731 	 */
18732 	ASSERT(ilm_walk_ipif(ipif) == 0);
18733 
18734 
18735 	IPIF_TRACE_CLEANUP(ipif);
18736 
18737 	/* Ask SCTP to take it out of it list */
18738 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
18739 
18740 	mutex_enter(&ipif->ipif_ill->ill_lock);
18741 	/* Get it out of the ILL interface list. */
18742 	ipifp = &ipif->ipif_ill->ill_ipif;
18743 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
18744 		if (*ipifp == ipif) {
18745 			*ipifp = ipif->ipif_next;
18746 			break;
18747 		}
18748 	}
18749 
18750 	mutex_exit(&ipif->ipif_ill->ill_lock);
18751 	rw_exit(&ill_g_lock);
18752 
18753 	mutex_destroy(&ipif->ipif_saved_ire_lock);
18754 
18755 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
18756 
18757 	/* Free the memory. */
18758 	mi_free((char *)ipif);
18759 }
18760 
18761 /*
18762  * Returns an ipif name in the form "ill_name/unit" if ipif_id is not zero,
18763  * "ill_name" otherwise.
18764  */
18765 char *
18766 ipif_get_name(const ipif_t *ipif, char *buf, int len)
18767 {
18768 	char	lbuf[32];
18769 	char	*name;
18770 	size_t	name_len;
18771 
18772 	buf[0] = '\0';
18773 	if (!ipif)
18774 		return (buf);
18775 	name = ipif->ipif_ill->ill_name;
18776 	name_len = ipif->ipif_ill->ill_name_length;
18777 	if (ipif->ipif_id != 0) {
18778 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
18779 		    ipif->ipif_id);
18780 		name = lbuf;
18781 		name_len = mi_strlen(name) + 1;
18782 	}
18783 	len -= 1;
18784 	buf[len] = '\0';
18785 	len = MIN(len, name_len);
18786 	bcopy(name, buf, len);
18787 	return (buf);
18788 }
18789 
18790 /*
18791  * Find an IPIF based on the name passed in.  Names can be of the
18792  * form <phys> (e.g., le0), <phys>:<#> (e.g., le0:1),
18793  * The <phys> string can have forms like <dev><#> (e.g., le0),
18794  * <dev><#>.<module> (e.g. le0.foo), or <dev>.<module><#> (e.g. ip.tun3).
18795  * When there is no colon, the implied unit id is zero. <phys> must
18796  * correspond to the name of an ILL.  (May be called as writer.)
18797  */
18798 static ipif_t *
18799 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
18800     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, queue_t *q,
18801     mblk_t *mp, ipsq_func_t func, int *error)
18802 {
18803 	char	*cp;
18804 	char	*endp;
18805 	long	id;
18806 	ill_t	*ill;
18807 	ipif_t	*ipif;
18808 	uint_t	ire_type;
18809 	boolean_t did_alloc = B_FALSE;
18810 	ipsq_t	*ipsq;
18811 
18812 	if (error != NULL)
18813 		*error = 0;
18814 
18815 	/*
18816 	 * If the caller wants to us to create the ipif, make sure we have a
18817 	 * valid zoneid
18818 	 */
18819 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
18820 
18821 	if (namelen == 0) {
18822 		if (error != NULL)
18823 			*error = ENXIO;
18824 		return (NULL);
18825 	}
18826 
18827 	*exists = B_FALSE;
18828 	/* Look for a colon in the name. */
18829 	endp = &name[namelen];
18830 	for (cp = endp; --cp > name; ) {
18831 		if (*cp == IPIF_SEPARATOR_CHAR)
18832 			break;
18833 	}
18834 
18835 	if (*cp == IPIF_SEPARATOR_CHAR) {
18836 		/*
18837 		 * Reject any non-decimal aliases for logical
18838 		 * interfaces. Aliases with leading zeroes
18839 		 * are also rejected as they introduce ambiguity
18840 		 * in the naming of the interfaces.
18841 		 * In order to confirm with existing semantics,
18842 		 * and to not break any programs/script relying
18843 		 * on that behaviour, if<0>:0 is considered to be
18844 		 * a valid interface.
18845 		 *
18846 		 * If alias has two or more digits and the first
18847 		 * is zero, fail.
18848 		 */
18849 		if (&cp[2] < endp && cp[1] == '0')
18850 			return (NULL);
18851 	}
18852 
18853 	if (cp <= name) {
18854 		cp = endp;
18855 	} else {
18856 		*cp = '\0';
18857 	}
18858 
18859 	/*
18860 	 * Look up the ILL, based on the portion of the name
18861 	 * before the slash. ill_lookup_on_name returns a held ill.
18862 	 * Temporary to check whether ill exists already. If so
18863 	 * ill_lookup_on_name will clear it.
18864 	 */
18865 	ill = ill_lookup_on_name(name, do_alloc, isv6,
18866 	    q, mp, func, error, &did_alloc);
18867 	if (cp != endp)
18868 		*cp = IPIF_SEPARATOR_CHAR;
18869 	if (ill == NULL)
18870 		return (NULL);
18871 
18872 	/* Establish the unit number in the name. */
18873 	id = 0;
18874 	if (cp < endp && *endp == '\0') {
18875 		/* If there was a colon, the unit number follows. */
18876 		cp++;
18877 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
18878 			ill_refrele(ill);
18879 			if (error != NULL)
18880 				*error = ENXIO;
18881 			return (NULL);
18882 		}
18883 	}
18884 
18885 	GRAB_CONN_LOCK(q);
18886 	mutex_enter(&ill->ill_lock);
18887 	/* Now see if there is an IPIF with this unit number. */
18888 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
18889 		if (ipif->ipif_id == id) {
18890 			if (zoneid != ALL_ZONES &&
18891 			    zoneid != ipif->ipif_zoneid &&
18892 			    ipif->ipif_zoneid != ALL_ZONES) {
18893 				mutex_exit(&ill->ill_lock);
18894 				RELEASE_CONN_LOCK(q);
18895 				ill_refrele(ill);
18896 				if (error != NULL)
18897 					*error = ENXIO;
18898 				return (NULL);
18899 			}
18900 			/*
18901 			 * The block comment at the start of ipif_down
18902 			 * explains the use of the macros used below
18903 			 */
18904 			if (IPIF_CAN_LOOKUP(ipif)) {
18905 				ipif_refhold_locked(ipif);
18906 				mutex_exit(&ill->ill_lock);
18907 				if (!did_alloc)
18908 					*exists = B_TRUE;
18909 				/*
18910 				 * Drop locks before calling ill_refrele
18911 				 * since it can potentially call into
18912 				 * ipif_ill_refrele_tail which can end up
18913 				 * in trying to acquire any lock.
18914 				 */
18915 				RELEASE_CONN_LOCK(q);
18916 				ill_refrele(ill);
18917 				return (ipif);
18918 			} else if (IPIF_CAN_WAIT(ipif, q)) {
18919 				ipsq = ill->ill_phyint->phyint_ipsq;
18920 				mutex_enter(&ipsq->ipsq_lock);
18921 				mutex_exit(&ill->ill_lock);
18922 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
18923 				mutex_exit(&ipsq->ipsq_lock);
18924 				RELEASE_CONN_LOCK(q);
18925 				ill_refrele(ill);
18926 				*error = EINPROGRESS;
18927 				return (NULL);
18928 			}
18929 		}
18930 	}
18931 	RELEASE_CONN_LOCK(q);
18932 
18933 	if (!do_alloc) {
18934 		mutex_exit(&ill->ill_lock);
18935 		ill_refrele(ill);
18936 		if (error != NULL)
18937 			*error = ENXIO;
18938 		return (NULL);
18939 	}
18940 
18941 	/*
18942 	 * If none found, atomically allocate and return a new one.
18943 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
18944 	 * to support "receive only" use of lo0:1 etc. as is still done
18945 	 * below as an initial guess.
18946 	 * However, this is now likely to be overriden later in ipif_up_done()
18947 	 * when we know for sure what address has been configured on the
18948 	 * interface, since we might have more than one loopback interface
18949 	 * with a loopback address, e.g. in the case of zones, and all the
18950 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
18951 	 */
18952 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
18953 		ire_type = IRE_LOOPBACK;
18954 	else
18955 		ire_type = IRE_LOCAL;
18956 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE);
18957 	if (ipif != NULL)
18958 		ipif_refhold_locked(ipif);
18959 	else if (error != NULL)
18960 		*error = ENOMEM;
18961 	mutex_exit(&ill->ill_lock);
18962 	ill_refrele(ill);
18963 	return (ipif);
18964 }
18965 
18966 /*
18967  * This routine is called whenever a new address comes up on an ipif.  If
18968  * we are configured to respond to address mask requests, then we are supposed
18969  * to broadcast an address mask reply at this time.  This routine is also
18970  * called if we are already up, but a netmask change is made.  This is legal
18971  * but might not make the system manager very popular.	(May be called
18972  * as writer.)
18973  */
18974 void
18975 ipif_mask_reply(ipif_t *ipif)
18976 {
18977 	icmph_t	*icmph;
18978 	ipha_t	*ipha;
18979 	mblk_t	*mp;
18980 
18981 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
18982 
18983 	if (!ip_respond_to_address_mask_broadcast)
18984 		return;
18985 
18986 	/* ICMP mask reply is IPv4 only */
18987 	ASSERT(!ipif->ipif_isv6);
18988 	/* ICMP mask reply is not for a loopback interface */
18989 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
18990 
18991 	mp = allocb(REPLY_LEN, BPRI_HI);
18992 	if (mp == NULL)
18993 		return;
18994 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
18995 
18996 	ipha = (ipha_t *)mp->b_rptr;
18997 	bzero(ipha, REPLY_LEN);
18998 	*ipha = icmp_ipha;
18999 	ipha->ipha_ttl = ip_broadcast_ttl;
19000 	ipha->ipha_src = ipif->ipif_src_addr;
19001 	ipha->ipha_dst = ipif->ipif_brd_addr;
19002 	ipha->ipha_length = htons(REPLY_LEN);
19003 	ipha->ipha_ident = 0;
19004 
19005 	icmph = (icmph_t *)&ipha[1];
19006 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
19007 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
19008 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
19009 	if (icmph->icmph_checksum == 0)
19010 		icmph->icmph_checksum = 0xffff;
19011 
19012 	put(ipif->ipif_wq, mp);
19013 
19014 #undef	REPLY_LEN
19015 }
19016 
19017 /*
19018  * When the mtu in the ipif changes, we call this routine through ire_walk
19019  * to update all the relevant IREs.
19020  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
19021  */
19022 static void
19023 ipif_mtu_change(ire_t *ire, char *ipif_arg)
19024 {
19025 	ipif_t *ipif = (ipif_t *)ipif_arg;
19026 
19027 	if (ire->ire_stq == NULL || ire->ire_ipif != ipif)
19028 		return;
19029 	ire->ire_max_frag = MIN(ipif->ipif_mtu, IP_MAXPACKET);
19030 }
19031 
19032 /*
19033  * When the mtu in the ill changes, we call this routine through ire_walk
19034  * to update all the relevant IREs.
19035  * Skip IRE_LOCAL and "loopback" IRE_BROADCAST by checking ire_stq.
19036  */
19037 void
19038 ill_mtu_change(ire_t *ire, char *ill_arg)
19039 {
19040 	ill_t	*ill = (ill_t *)ill_arg;
19041 
19042 	if (ire->ire_stq == NULL || ire->ire_ipif->ipif_ill != ill)
19043 		return;
19044 	ire->ire_max_frag = ire->ire_ipif->ipif_mtu;
19045 }
19046 
19047 /*
19048  * Join the ipif specific multicast groups.
19049  * Must be called after a mapping has been set up in the resolver.  (Always
19050  * called as writer.)
19051  */
19052 void
19053 ipif_multicast_up(ipif_t *ipif)
19054 {
19055 	int err, index;
19056 	ill_t *ill;
19057 
19058 	ASSERT(IAM_WRITER_IPIF(ipif));
19059 
19060 	ill = ipif->ipif_ill;
19061 	index = ill->ill_phyint->phyint_ifindex;
19062 
19063 	ip1dbg(("ipif_multicast_up\n"));
19064 	if (!(ill->ill_flags & ILLF_MULTICAST) || ipif->ipif_multicast_up)
19065 		return;
19066 
19067 	if (ipif->ipif_isv6) {
19068 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
19069 			return;
19070 
19071 		/* Join the all hosts multicast address */
19072 		ip1dbg(("ipif_multicast_up - addmulti\n"));
19073 		/*
19074 		 * Passing B_TRUE means we have to join the multicast
19075 		 * membership on this interface even though this is
19076 		 * FAILED. If we join on a different one in the group,
19077 		 * we will not be able to delete the membership later
19078 		 * as we currently don't track where we join when we
19079 		 * join within the kernel unlike applications where
19080 		 * we have ilg/ilg_orig_index. See ip_addmulti_v6
19081 		 * for more on this.
19082 		 */
19083 		err = ip_addmulti_v6(&ipv6_all_hosts_mcast, ill, index,
19084 		    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
19085 		if (err != 0) {
19086 			ip0dbg(("ipif_multicast_up: "
19087 			    "all_hosts_mcast failed %d\n",
19088 			    err));
19089 			return;
19090 		}
19091 		/*
19092 		 * Enable multicast for the solicited node multicast address
19093 		 */
19094 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
19095 			in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
19096 
19097 			ipv6_multi.s6_addr32[3] |=
19098 			    ipif->ipif_v6lcl_addr.s6_addr32[3];
19099 
19100 			err = ip_addmulti_v6(&ipv6_multi, ill, index,
19101 			    ipif->ipif_zoneid, ILGSTAT_NONE, MODE_IS_EXCLUDE,
19102 			    NULL);
19103 			if (err != 0) {
19104 				ip0dbg(("ipif_multicast_up: solicited MC"
19105 				    " failed %d\n", err));
19106 				(void) ip_delmulti_v6(&ipv6_all_hosts_mcast,
19107 				    ill, ill->ill_phyint->phyint_ifindex,
19108 				    ipif->ipif_zoneid, B_TRUE, B_TRUE);
19109 				return;
19110 			}
19111 		}
19112 	} else {
19113 		if (ipif->ipif_lcl_addr == INADDR_ANY)
19114 			return;
19115 
19116 		/* Join the all hosts multicast address */
19117 		ip1dbg(("ipif_multicast_up - addmulti\n"));
19118 		err = ip_addmulti(htonl(INADDR_ALLHOSTS_GROUP), ipif,
19119 		    ILGSTAT_NONE, MODE_IS_EXCLUDE, NULL);
19120 		if (err) {
19121 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
19122 			return;
19123 		}
19124 	}
19125 	ipif->ipif_multicast_up = 1;
19126 }
19127 
19128 /*
19129  * Blow away any IPv6 multicast groups that we joined in ipif_multicast_up();
19130  * any explicit memberships are blown away in ill_leave_multicast() when the
19131  * ill is brought down.
19132  */
19133 static void
19134 ipif_multicast_down(ipif_t *ipif)
19135 {
19136 	int err;
19137 
19138 	ASSERT(IAM_WRITER_IPIF(ipif));
19139 
19140 	ip1dbg(("ipif_multicast_down\n"));
19141 	if (!ipif->ipif_multicast_up)
19142 		return;
19143 
19144 	ASSERT(ipif->ipif_isv6);
19145 
19146 	ip1dbg(("ipif_multicast_down - delmulti\n"));
19147 
19148 	/*
19149 	 * Leave the all hosts multicast address. Similar to ip_addmulti_v6,
19150 	 * we should look for ilms on this ill rather than the ones that have
19151 	 * been failed over here.  They are here temporarily. As
19152 	 * ipif_multicast_up has joined on this ill, we should delete only
19153 	 * from this ill.
19154 	 */
19155 	err = ip_delmulti_v6(&ipv6_all_hosts_mcast, ipif->ipif_ill,
19156 	    ipif->ipif_ill->ill_phyint->phyint_ifindex, ipif->ipif_zoneid,
19157 	    B_TRUE, B_TRUE);
19158 	if (err != 0) {
19159 		ip0dbg(("ipif_multicast_down: all_hosts_mcast failed %d\n",
19160 		    err));
19161 	}
19162 	/*
19163 	 * Disable multicast for the solicited node multicast address
19164 	 */
19165 	if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
19166 		in6_addr_t ipv6_multi = ipv6_solicited_node_mcast;
19167 
19168 		ipv6_multi.s6_addr32[3] |=
19169 		    ipif->ipif_v6lcl_addr.s6_addr32[3];
19170 
19171 		err = ip_delmulti_v6(&ipv6_multi, ipif->ipif_ill,
19172 		    ipif->ipif_ill->ill_phyint->phyint_ifindex,
19173 		    ipif->ipif_zoneid, B_TRUE, B_TRUE);
19174 
19175 		if (err != 0) {
19176 			ip0dbg(("ipif_multicast_down: sol MC failed %d\n",
19177 			    err));
19178 		}
19179 	}
19180 
19181 	ipif->ipif_multicast_up = 0;
19182 }
19183 
19184 /*
19185  * Used when an interface comes up to recreate any extra routes on this
19186  * interface.
19187  */
19188 static ire_t **
19189 ipif_recover_ire(ipif_t *ipif)
19190 {
19191 	mblk_t	*mp;
19192 	ire_t	**ipif_saved_irep;
19193 	ire_t	**irep;
19194 
19195 	ip1dbg(("ipif_recover_ire(%s:%u)", ipif->ipif_ill->ill_name,
19196 	    ipif->ipif_id));
19197 
19198 	mutex_enter(&ipif->ipif_saved_ire_lock);
19199 	ipif_saved_irep = (ire_t **)kmem_zalloc(sizeof (ire_t *) *
19200 	    ipif->ipif_saved_ire_cnt, KM_NOSLEEP);
19201 	if (ipif_saved_irep == NULL) {
19202 		mutex_exit(&ipif->ipif_saved_ire_lock);
19203 		return (NULL);
19204 	}
19205 
19206 	irep = ipif_saved_irep;
19207 	for (mp = ipif->ipif_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
19208 		ire_t		*ire;
19209 		queue_t		*rfq;
19210 		queue_t		*stq;
19211 		ifrt_t		*ifrt;
19212 		uchar_t		*src_addr;
19213 		uchar_t		*gateway_addr;
19214 		mblk_t		*resolver_mp;
19215 		ushort_t	type;
19216 
19217 		/*
19218 		 * When the ire was initially created and then added in
19219 		 * ip_rt_add(), it was created either using ipif->ipif_net_type
19220 		 * in the case of a traditional interface route, or as one of
19221 		 * the IRE_OFFSUBNET types (with the exception of
19222 		 * IRE_HOST_REDIRECT which is created by icmp_redirect() and
19223 		 * which we don't need to save or recover).  In the case where
19224 		 * ipif->ipif_net_type was IRE_LOOPBACK, ip_rt_add() will update
19225 		 * the ire_type to IRE_IF_NORESOLVER before calling ire_add()
19226 		 * to satisfy software like GateD and Sun Cluster which creates
19227 		 * routes using the the loopback interface's address as a
19228 		 * gateway.
19229 		 *
19230 		 * As ifrt->ifrt_type reflects the already updated ire_type and
19231 		 * since ire_create() expects that IRE_IF_NORESOLVER will have
19232 		 * a valid nce_res_mp field (which doesn't make sense for a
19233 		 * IRE_LOOPBACK), ire_create() will be called in the same way
19234 		 * here as in ip_rt_add(), namely using ipif->ipif_net_type when
19235 		 * the route looks like a traditional interface route (where
19236 		 * ifrt->ifrt_type & IRE_INTERFACE is true) and otherwise using
19237 		 * the saved ifrt->ifrt_type.  This means that in the case where
19238 		 * ipif->ipif_net_type is IRE_LOOPBACK, the ire created by
19239 		 * ire_create() will be an IRE_LOOPBACK, it will then be turned
19240 		 * into an IRE_IF_NORESOLVER and then added by ire_add().
19241 		 */
19242 		ifrt = (ifrt_t *)mp->b_rptr;
19243 		if (ifrt->ifrt_type & IRE_INTERFACE) {
19244 			rfq = NULL;
19245 			stq = (ipif->ipif_net_type == IRE_IF_RESOLVER)
19246 			    ? ipif->ipif_rq : ipif->ipif_wq;
19247 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
19248 			    ? (uint8_t *)&ifrt->ifrt_src_addr
19249 			    : (uint8_t *)&ipif->ipif_src_addr;
19250 			gateway_addr = NULL;
19251 			resolver_mp = ipif->ipif_resolver_mp;
19252 			type = ipif->ipif_net_type;
19253 		} else if (ifrt->ifrt_type & IRE_BROADCAST) {
19254 			/* Recover multiroute broadcast IRE. */
19255 			rfq = ipif->ipif_rq;
19256 			stq = ipif->ipif_wq;
19257 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
19258 			    ? (uint8_t *)&ifrt->ifrt_src_addr
19259 			    : (uint8_t *)&ipif->ipif_src_addr;
19260 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
19261 			resolver_mp = ipif->ipif_bcast_mp;
19262 			type = ifrt->ifrt_type;
19263 		} else {
19264 			rfq = NULL;
19265 			stq = NULL;
19266 			src_addr = (ifrt->ifrt_flags & RTF_SETSRC)
19267 			    ? (uint8_t *)&ifrt->ifrt_src_addr : NULL;
19268 			gateway_addr = (uint8_t *)&ifrt->ifrt_gateway_addr;
19269 			resolver_mp = NULL;
19270 			type = ifrt->ifrt_type;
19271 		}
19272 
19273 		/*
19274 		 * Create a copy of the IRE with the saved address and netmask.
19275 		 */
19276 		ip1dbg(("ipif_recover_ire: creating IRE %s (%d) for "
19277 		    "0x%x/0x%x\n",
19278 		    ip_nv_lookup(ire_nv_tbl, ifrt->ifrt_type), ifrt->ifrt_type,
19279 		    ntohl(ifrt->ifrt_addr),
19280 		    ntohl(ifrt->ifrt_mask)));
19281 		ire = ire_create(
19282 		    (uint8_t *)&ifrt->ifrt_addr,
19283 		    (uint8_t *)&ifrt->ifrt_mask,
19284 		    src_addr,
19285 		    gateway_addr,
19286 		    NULL,
19287 		    &ifrt->ifrt_max_frag,
19288 		    NULL,
19289 		    rfq,
19290 		    stq,
19291 		    type,
19292 		    resolver_mp,
19293 		    ipif,
19294 		    NULL,
19295 		    0,
19296 		    0,
19297 		    0,
19298 		    ifrt->ifrt_flags,
19299 		    &ifrt->ifrt_iulp_info,
19300 		    NULL,
19301 		    NULL);
19302 
19303 		if (ire == NULL) {
19304 			mutex_exit(&ipif->ipif_saved_ire_lock);
19305 			kmem_free(ipif_saved_irep,
19306 			    ipif->ipif_saved_ire_cnt * sizeof (ire_t *));
19307 			return (NULL);
19308 		}
19309 
19310 		/*
19311 		 * Some software (for example, GateD and Sun Cluster) attempts
19312 		 * to create (what amount to) IRE_PREFIX routes with the
19313 		 * loopback address as the gateway.  This is primarily done to
19314 		 * set up prefixes with the RTF_REJECT flag set (for example,
19315 		 * when generating aggregate routes.)
19316 		 *
19317 		 * If the IRE type (as defined by ipif->ipif_net_type) is
19318 		 * IRE_LOOPBACK, then we map the request into a
19319 		 * IRE_IF_NORESOLVER.
19320 		 */
19321 		if (ipif->ipif_net_type == IRE_LOOPBACK)
19322 			ire->ire_type = IRE_IF_NORESOLVER;
19323 		/*
19324 		 * ire held by ire_add, will be refreled' towards the
19325 		 * the end of ipif_up_done
19326 		 */
19327 		(void) ire_add(&ire, NULL, NULL, NULL, B_FALSE);
19328 		*irep = ire;
19329 		irep++;
19330 		ip1dbg(("ipif_recover_ire: added ire %p\n", (void *)ire));
19331 	}
19332 	mutex_exit(&ipif->ipif_saved_ire_lock);
19333 	return (ipif_saved_irep);
19334 }
19335 
19336 /*
19337  * Used to set the netmask and broadcast address to default values when the
19338  * interface is brought up.  (Always called as writer.)
19339  */
19340 static void
19341 ipif_set_default(ipif_t *ipif)
19342 {
19343 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19344 
19345 	if (!ipif->ipif_isv6) {
19346 		/*
19347 		 * Interface holds an IPv4 address. Default
19348 		 * mask is the natural netmask.
19349 		 */
19350 		if (!ipif->ipif_net_mask) {
19351 			ipaddr_t	v4mask;
19352 
19353 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
19354 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
19355 		}
19356 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19357 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19358 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
19359 		} else {
19360 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
19361 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
19362 		}
19363 		/*
19364 		 * NOTE: SunOS 4.X does this even if the broadcast address
19365 		 * has been already set thus we do the same here.
19366 		 */
19367 		if (ipif->ipif_flags & IPIF_BROADCAST) {
19368 			ipaddr_t	v4addr;
19369 
19370 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
19371 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
19372 		}
19373 	} else {
19374 		/*
19375 		 * Interface holds an IPv6-only address.  Default
19376 		 * mask is all-ones.
19377 		 */
19378 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
19379 			ipif->ipif_v6net_mask = ipv6_all_ones;
19380 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19381 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19382 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
19383 		} else {
19384 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
19385 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
19386 		}
19387 	}
19388 }
19389 
19390 /*
19391  * Return 0 if this address can be used as local address without causing
19392  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
19393  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
19394  * Special checks are needed to allow the same IPv6 link-local address
19395  * on different ills.
19396  * TODO: allowing the same site-local address on different ill's.
19397  */
19398 int
19399 ip_addr_availability_check(ipif_t *new_ipif)
19400 {
19401 	in6_addr_t our_v6addr;
19402 	ill_t *ill;
19403 	ipif_t *ipif;
19404 	ill_walk_context_t ctx;
19405 
19406 	ASSERT(IAM_WRITER_IPIF(new_ipif));
19407 	ASSERT(MUTEX_HELD(&ip_addr_avail_lock));
19408 	ASSERT(RW_READ_HELD(&ill_g_lock));
19409 
19410 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
19411 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
19412 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
19413 		return (0);
19414 
19415 	our_v6addr = new_ipif->ipif_v6lcl_addr;
19416 
19417 	if (new_ipif->ipif_isv6)
19418 		ill = ILL_START_WALK_V6(&ctx);
19419 	else
19420 		ill = ILL_START_WALK_V4(&ctx);
19421 
19422 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
19423 		for (ipif = ill->ill_ipif; ipif != NULL;
19424 		    ipif = ipif->ipif_next) {
19425 			if ((ipif == new_ipif) ||
19426 			    !(ipif->ipif_flags & IPIF_UP) ||
19427 			    (ipif->ipif_flags & IPIF_UNNUMBERED))
19428 				continue;
19429 			if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
19430 			    &our_v6addr)) {
19431 				if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
19432 				    new_ipif->ipif_flags |= IPIF_UNNUMBERED;
19433 				else if (ipif->ipif_flags & IPIF_POINTOPOINT)
19434 				    ipif->ipif_flags |= IPIF_UNNUMBERED;
19435 				else if (IN6_IS_ADDR_LINKLOCAL(&our_v6addr) &&
19436 				    new_ipif->ipif_ill != ill)
19437 					continue;
19438 				else if (IN6_IS_ADDR_SITELOCAL(&our_v6addr) &&
19439 				    new_ipif->ipif_ill != ill)
19440 					continue;
19441 				else if (new_ipif->ipif_zoneid !=
19442 				    ipif->ipif_zoneid &&
19443 				    ipif->ipif_zoneid != ALL_ZONES &&
19444 				    (ill->ill_phyint->phyint_flags &
19445 				    PHYI_LOOPBACK))
19446 					continue;
19447 				else if (new_ipif->ipif_ill == ill)
19448 					return (EADDRINUSE);
19449 				else
19450 					return (EADDRNOTAVAIL);
19451 			}
19452 		}
19453 	}
19454 
19455 	return (0);
19456 }
19457 
19458 /*
19459  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
19460  * IREs for the ipif.
19461  * When the routine returns EINPROGRESS then mp has been consumed and
19462  * the ioctl will be acked from ip_rput_dlpi.
19463  */
19464 static int
19465 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
19466 {
19467 	ill_t	*ill = ipif->ipif_ill;
19468 	boolean_t isv6 = ipif->ipif_isv6;
19469 	int	err = 0;
19470 	boolean_t success;
19471 
19472 	ASSERT(IAM_WRITER_IPIF(ipif));
19473 
19474 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
19475 
19476 	/* Shouldn't get here if it is already up. */
19477 	if (ipif->ipif_flags & IPIF_UP)
19478 		return (EALREADY);
19479 
19480 	/* Skip arp/ndp for any loopback interface. */
19481 	if (ill->ill_wq != NULL) {
19482 		conn_t *connp = Q_TO_CONN(q);
19483 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
19484 
19485 		if (!ill->ill_dl_up) {
19486 			/*
19487 			 * ill_dl_up is not yet set. i.e. we are yet to
19488 			 * DL_BIND with the driver and this is the first
19489 			 * logical interface on the ill to become "up".
19490 			 * Tell the driver to get going (via DL_BIND_REQ).
19491 			 * Note that changing "significant" IFF_ flags
19492 			 * address/netmask etc cause a down/up dance, but
19493 			 * does not cause an unbind (DL_UNBIND) with the driver
19494 			 */
19495 			return (ill_dl_up(ill, ipif, mp, q));
19496 		}
19497 
19498 		/*
19499 		 * ipif_resolver_up may end up sending an
19500 		 * AR_INTERFACE_UP message to ARP, which would, in
19501 		 * turn send a DLPI message to the driver. ioctls are
19502 		 * serialized and so we cannot send more than one
19503 		 * interface up message at a time. If ipif_resolver_up
19504 		 * does send an interface up message to ARP, we get
19505 		 * EINPROGRESS and we will complete in ip_arp_done.
19506 		 */
19507 
19508 		ASSERT(connp != NULL);
19509 		ASSERT(ipsq->ipsq_pending_mp == NULL);
19510 		mutex_enter(&connp->conn_lock);
19511 		mutex_enter(&ill->ill_lock);
19512 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
19513 		mutex_exit(&ill->ill_lock);
19514 		mutex_exit(&connp->conn_lock);
19515 		if (!success)
19516 			return (EINTR);
19517 
19518 		/*
19519 		 * Crank up IPv6 neighbor discovery
19520 		 * Unlike ARP, this should complete when
19521 		 * ipif_ndp_up returns. However, for
19522 		 * ILLF_XRESOLV interfaces we also send a
19523 		 * AR_INTERFACE_UP to the external resolver.
19524 		 * That ioctl will complete in ip_rput.
19525 		 */
19526 		if (isv6) {
19527 			err = ipif_ndp_up(ipif, &ipif->ipif_v6lcl_addr,
19528 			    B_FALSE);
19529 			if (err != 0) {
19530 				if (err != EINPROGRESS)
19531 					mp = ipsq_pending_mp_get(ipsq, &connp);
19532 				return (err);
19533 			}
19534 		}
19535 		/* Now, ARP */
19536 		err = ipif_resolver_up(ipif, Res_act_initial);
19537 		if (err == EINPROGRESS) {
19538 			/* We will complete it in ip_arp_done */
19539 			return (err);
19540 		}
19541 		mp = ipsq_pending_mp_get(ipsq, &connp);
19542 		ASSERT(mp != NULL);
19543 		if (err != 0)
19544 			return (err);
19545 	} else {
19546 		/*
19547 		 * Interfaces without underlying hardware don't do duplicate
19548 		 * address detection.
19549 		 */
19550 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
19551 		ipif->ipif_addr_ready = 1;
19552 	}
19553 	return (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
19554 }
19555 
19556 /*
19557  * Perform a bind for the physical device.
19558  * When the routine returns EINPROGRESS then mp has been consumed and
19559  * the ioctl will be acked from ip_rput_dlpi.
19560  * Allocate an unbind message and save it until ipif_down.
19561  */
19562 static int
19563 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
19564 {
19565 	mblk_t	*areq_mp = NULL;
19566 	mblk_t	*bind_mp = NULL;
19567 	mblk_t	*unbind_mp = NULL;
19568 	conn_t	*connp;
19569 	boolean_t success;
19570 
19571 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
19572 	ASSERT(IAM_WRITER_ILL(ill));
19573 
19574 	ASSERT(mp != NULL);
19575 
19576 	/* Create a resolver cookie for ARP */
19577 	if (!ill->ill_isv6 && ill->ill_net_type == IRE_IF_RESOLVER) {
19578 		areq_t		*areq;
19579 		uint16_t	sap_addr;
19580 
19581 		areq_mp = ill_arp_alloc(ill,
19582 			(uchar_t *)&ip_areq_template, 0);
19583 		if (areq_mp == NULL) {
19584 			return (ENOMEM);
19585 		}
19586 		freemsg(ill->ill_resolver_mp);
19587 		ill->ill_resolver_mp = areq_mp;
19588 		areq = (areq_t *)areq_mp->b_rptr;
19589 		sap_addr = ill->ill_sap;
19590 		bcopy(&sap_addr, areq->areq_sap, sizeof (sap_addr));
19591 		/*
19592 		 * Wait till we call ill_pending_mp_add to determine
19593 		 * the success before we free the ill_resolver_mp and
19594 		 * attach areq_mp in it's place.
19595 		 */
19596 	}
19597 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
19598 	    DL_BIND_REQ);
19599 	if (bind_mp == NULL)
19600 		goto bad;
19601 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
19602 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
19603 
19604 	unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t), DL_UNBIND_REQ);
19605 	if (unbind_mp == NULL)
19606 		goto bad;
19607 
19608 	/*
19609 	 * Record state needed to complete this operation when the
19610 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
19611 	 */
19612 	if (WR(q)->q_next == NULL) {
19613 		connp = Q_TO_CONN(q);
19614 		mutex_enter(&connp->conn_lock);
19615 	} else {
19616 		connp = NULL;
19617 	}
19618 	mutex_enter(&ipif->ipif_ill->ill_lock);
19619 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
19620 	mutex_exit(&ipif->ipif_ill->ill_lock);
19621 	if (connp != NULL)
19622 		mutex_exit(&connp->conn_lock);
19623 	if (!success)
19624 		goto bad;
19625 
19626 	/*
19627 	 * Save the unbind message for ill_dl_down(); it will be consumed when
19628 	 * the interface goes down.
19629 	 */
19630 	ASSERT(ill->ill_unbind_mp == NULL);
19631 	ill->ill_unbind_mp = unbind_mp;
19632 
19633 	ill_dlpi_send(ill, bind_mp);
19634 	/* Send down link-layer capabilities probe if not already done. */
19635 	ill_capability_probe(ill);
19636 
19637 	/*
19638 	 * Sysid used to rely on the fact that netboots set domainname
19639 	 * and the like. Now that miniroot boots aren't strictly netboots
19640 	 * and miniroot network configuration is driven from userland
19641 	 * these things still need to be set. This situation can be detected
19642 	 * by comparing the interface being configured here to the one
19643 	 * dhcack was set to reference by the boot loader. Once sysid is
19644 	 * converted to use dhcp_ipc_getinfo() this call can go away.
19645 	 */
19646 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) && (dhcack != NULL) &&
19647 	    (strcmp(ill->ill_name, dhcack) == 0) &&
19648 	    (strlen(srpc_domain) == 0)) {
19649 		if (dhcpinit() != 0)
19650 			cmn_err(CE_WARN, "no cached dhcp response");
19651 	}
19652 
19653 	/*
19654 	 * This operation will complete in ip_rput_dlpi with either
19655 	 * a DL_BIND_ACK or DL_ERROR_ACK.
19656 	 */
19657 	return (EINPROGRESS);
19658 bad:
19659 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
19660 	/*
19661 	 * We don't have to check for possible removal from illgrp
19662 	 * as we have not yet inserted in illgrp. For groups
19663 	 * without names, this ipif is still not UP and hence
19664 	 * this could not have possibly had any influence in forming
19665 	 * groups.
19666 	 */
19667 
19668 	if (bind_mp != NULL)
19669 		freemsg(bind_mp);
19670 	if (unbind_mp != NULL)
19671 		freemsg(unbind_mp);
19672 	return (ENOMEM);
19673 }
19674 
19675 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
19676 
19677 /*
19678  * DLPI and ARP is up.
19679  * Create all the IREs associated with an interface bring up multicast.
19680  * Set the interface flag and finish other initialization
19681  * that potentially had to be differed to after DL_BIND_ACK.
19682  */
19683 int
19684 ipif_up_done(ipif_t *ipif)
19685 {
19686 	ire_t	*ire_array[20];
19687 	ire_t	**irep = ire_array;
19688 	ire_t	**irep1;
19689 	ipaddr_t net_mask = 0;
19690 	ipaddr_t subnet_mask, route_mask;
19691 	ill_t	*ill = ipif->ipif_ill;
19692 	queue_t	*stq;
19693 	ipif_t	 *src_ipif;
19694 	ipif_t   *tmp_ipif;
19695 	boolean_t	flush_ire_cache = B_TRUE;
19696 	int	err = 0;
19697 	phyint_t *phyi;
19698 	ire_t	**ipif_saved_irep = NULL;
19699 	int ipif_saved_ire_cnt;
19700 	int	cnt;
19701 	boolean_t	src_ipif_held = B_FALSE;
19702 	boolean_t	ire_added = B_FALSE;
19703 	boolean_t	loopback = B_FALSE;
19704 
19705 	ip1dbg(("ipif_up_done(%s:%u)\n",
19706 		ipif->ipif_ill->ill_name, ipif->ipif_id));
19707 	/* Check if this is a loopback interface */
19708 	if (ipif->ipif_ill->ill_wq == NULL)
19709 		loopback = B_TRUE;
19710 
19711 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19712 	/*
19713 	 * If all other interfaces for this ill are down or DEPRECATED,
19714 	 * or otherwise unsuitable for source address selection, remove
19715 	 * any IRE_CACHE entries for this ill to make sure source
19716 	 * address selection gets to take this new ipif into account.
19717 	 * No need to hold ill_lock while traversing the ipif list since
19718 	 * we are writer
19719 	 */
19720 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
19721 		tmp_ipif = tmp_ipif->ipif_next) {
19722 		if (((tmp_ipif->ipif_flags &
19723 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
19724 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
19725 		    (tmp_ipif == ipif))
19726 			continue;
19727 		/* first useable pre-existing interface */
19728 		flush_ire_cache = B_FALSE;
19729 		break;
19730 	}
19731 	if (flush_ire_cache)
19732 		ire_walk_ill_v4(MATCH_IRE_ILL_GROUP | MATCH_IRE_TYPE,
19733 		    IRE_CACHE, ill_ipif_cache_delete, (char *)ill, ill);
19734 
19735 	/*
19736 	 * Figure out which way the send-to queue should go.  Only
19737 	 * IRE_IF_RESOLVER or IRE_IF_NORESOLVER or IRE_LOOPBACK
19738 	 * should show up here.
19739 	 */
19740 	switch (ill->ill_net_type) {
19741 	case IRE_IF_RESOLVER:
19742 		stq = ill->ill_rq;
19743 		break;
19744 	case IRE_IF_NORESOLVER:
19745 	case IRE_LOOPBACK:
19746 		stq = ill->ill_wq;
19747 		break;
19748 	default:
19749 		return (EINVAL);
19750 	}
19751 
19752 	if (ill->ill_phyint->phyint_flags & PHYI_LOOPBACK) {
19753 		/*
19754 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
19755 		 * ipif_lookup_on_name(), but in the case of zones we can have
19756 		 * several loopback addresses on lo0. So all the interfaces with
19757 		 * loopback addresses need to be marked IRE_LOOPBACK.
19758 		 */
19759 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
19760 		    htonl(INADDR_LOOPBACK))
19761 			ipif->ipif_ire_type = IRE_LOOPBACK;
19762 		else
19763 			ipif->ipif_ire_type = IRE_LOCAL;
19764 	}
19765 
19766 	if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)) {
19767 		/*
19768 		 * Can't use our source address. Select a different
19769 		 * source address for the IRE_INTERFACE and IRE_LOCAL
19770 		 */
19771 		src_ipif = ipif_select_source(ipif->ipif_ill,
19772 		    ipif->ipif_subnet, ipif->ipif_zoneid);
19773 		if (src_ipif == NULL)
19774 			src_ipif = ipif;	/* Last resort */
19775 		else
19776 			src_ipif_held = B_TRUE;
19777 	} else {
19778 		src_ipif = ipif;
19779 	}
19780 
19781 	/* Create all the IREs associated with this interface */
19782 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
19783 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
19784 
19785 		/*
19786 		 * If we're on a labeled system then make sure that zone-
19787 		 * private addresses have proper remote host database entries.
19788 		 */
19789 		if (is_system_labeled() &&
19790 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
19791 		    !tsol_check_interface_address(ipif))
19792 			return (EINVAL);
19793 
19794 		/* Register the source address for __sin6_src_id */
19795 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
19796 		    ipif->ipif_zoneid);
19797 		if (err != 0) {
19798 			ip0dbg(("ipif_up_done: srcid_insert %d\n", err));
19799 			return (err);
19800 		}
19801 
19802 		/* If the interface address is set, create the local IRE. */
19803 		ip1dbg(("ipif_up_done: 0x%p creating IRE 0x%x for 0x%x\n",
19804 			(void *)ipif,
19805 			ipif->ipif_ire_type,
19806 			ntohl(ipif->ipif_lcl_addr)));
19807 		*irep++ = ire_create(
19808 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
19809 		    (uchar_t *)&ip_g_all_ones,		/* mask */
19810 		    (uchar_t *)&src_ipif->ipif_src_addr, /* source address */
19811 		    NULL,				/* no gateway */
19812 		    NULL,
19813 		    &ip_loopback_mtuplus,		/* max frag size */
19814 		    NULL,
19815 		    ipif->ipif_rq,			/* recv-from queue */
19816 		    NULL,				/* no send-to queue */
19817 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
19818 		    NULL,
19819 		    ipif,
19820 		    NULL,
19821 		    0,
19822 		    0,
19823 		    0,
19824 		    (ipif->ipif_flags & IPIF_PRIVATE) ?
19825 		    RTF_PRIVATE : 0,
19826 		    &ire_uinfo_null,
19827 		    NULL,
19828 		    NULL);
19829 	} else {
19830 		ip1dbg((
19831 		    "ipif_up_done: not creating IRE %d for 0x%x: flags 0x%x\n",
19832 		    ipif->ipif_ire_type,
19833 		    ntohl(ipif->ipif_lcl_addr),
19834 		    (uint_t)ipif->ipif_flags));
19835 	}
19836 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
19837 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
19838 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
19839 	} else {
19840 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
19841 	}
19842 
19843 	subnet_mask = ipif->ipif_net_mask;
19844 
19845 	/*
19846 	 * If mask was not specified, use natural netmask of
19847 	 * interface address. Also, store this mask back into the
19848 	 * ipif struct.
19849 	 */
19850 	if (subnet_mask == 0) {
19851 		subnet_mask = net_mask;
19852 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
19853 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
19854 		    ipif->ipif_v6subnet);
19855 	}
19856 
19857 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
19858 	if (stq != NULL && !(ipif->ipif_flags & IPIF_NOXMIT) &&
19859 	    ipif->ipif_subnet != INADDR_ANY) {
19860 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
19861 
19862 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
19863 			route_mask = IP_HOST_MASK;
19864 		} else {
19865 			route_mask = subnet_mask;
19866 		}
19867 
19868 		ip1dbg(("ipif_up_done: ipif 0x%p ill 0x%p "
19869 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
19870 			(void *)ipif, (void *)ill,
19871 			ill->ill_net_type,
19872 			ntohl(ipif->ipif_subnet)));
19873 		*irep++ = ire_create(
19874 		    (uchar_t *)&ipif->ipif_subnet,	/* dest address */
19875 		    (uchar_t *)&route_mask,		/* mask */
19876 		    (uchar_t *)&src_ipif->ipif_src_addr, /* src addr */
19877 		    NULL,				/* no gateway */
19878 		    NULL,
19879 		    &ipif->ipif_mtu,			/* max frag */
19880 		    NULL,
19881 		    NULL,				/* no recv queue */
19882 		    stq,				/* send-to queue */
19883 		    ill->ill_net_type,			/* IF_[NO]RESOLVER */
19884 		    ill->ill_resolver_mp,		/* xmit header */
19885 		    ipif,
19886 		    NULL,
19887 		    0,
19888 		    0,
19889 		    0,
19890 		    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE: 0,
19891 		    &ire_uinfo_null,
19892 		    NULL,
19893 		    NULL);
19894 	}
19895 
19896 	/*
19897 	 * If the interface address is set, create the broadcast IREs.
19898 	 *
19899 	 * ire_create_bcast checks if the proposed new IRE matches
19900 	 * any existing IRE's with the same physical interface (ILL).
19901 	 * This should get rid of duplicates.
19902 	 * ire_create_bcast also check IPIF_NOXMIT and does not create
19903 	 * any broadcast ires.
19904 	 */
19905 	if ((ipif->ipif_subnet != INADDR_ANY) &&
19906 	    (ipif->ipif_flags & IPIF_BROADCAST)) {
19907 		ipaddr_t addr;
19908 
19909 		ip1dbg(("ipif_up_done: creating broadcast IRE\n"));
19910 		irep = ire_check_and_create_bcast(ipif, 0, irep,
19911 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19912 		irep = ire_check_and_create_bcast(ipif, INADDR_BROADCAST, irep,
19913 		    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19914 
19915 		/*
19916 		 * For backward compatibility, we need to create net
19917 		 * broadcast ire's based on the old "IP address class
19918 		 * system."  The reason is that some old machines only
19919 		 * respond to these class derived net broadcast.
19920 		 *
19921 		 * But we should not create these net broadcast ire's if
19922 		 * the subnet_mask is shorter than the IP address class based
19923 		 * derived netmask.  Otherwise, we may create a net
19924 		 * broadcast address which is the same as an IP address
19925 		 * on the subnet.  Then TCP will refuse to talk to that
19926 		 * address.
19927 		 *
19928 		 * Nor do we need IRE_BROADCAST ire's for the interface
19929 		 * with the netmask as 0xFFFFFFFF, as IRE_LOCAL for that
19930 		 * interface is already created.  Creating these broadcast
19931 		 * ire's will only create confusion as the "addr" is going
19932 		 * to be same as that of the IP address of the interface.
19933 		 */
19934 		if (net_mask < subnet_mask) {
19935 			addr = net_mask & ipif->ipif_subnet;
19936 			irep = ire_check_and_create_bcast(ipif, addr, irep,
19937 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19938 			irep = ire_check_and_create_bcast(ipif,
19939 			    ~net_mask | addr, irep,
19940 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19941 		}
19942 
19943 		if (subnet_mask != 0xFFFFFFFF) {
19944 			addr = ipif->ipif_subnet;
19945 			irep = ire_check_and_create_bcast(ipif, addr, irep,
19946 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19947 			irep = ire_check_and_create_bcast(ipif,
19948 			    ~subnet_mask|addr, irep,
19949 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL));
19950 		}
19951 	}
19952 
19953 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
19954 
19955 	/* If an earlier ire_create failed, get out now */
19956 	for (irep1 = irep; irep1 > ire_array; ) {
19957 		irep1--;
19958 		if (*irep1 == NULL) {
19959 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
19960 			err = ENOMEM;
19961 			goto bad;
19962 		}
19963 	}
19964 
19965 	/*
19966 	 * Need to atomically check for ip_addr_availablity_check
19967 	 * under ip_addr_avail_lock, and if it fails got bad, and remove
19968 	 * from group also.The ill_g_lock is grabbed as reader
19969 	 * just to make sure no new ills or new ipifs are being added
19970 	 * to the system while we are checking the uniqueness of addresses.
19971 	 */
19972 	rw_enter(&ill_g_lock, RW_READER);
19973 	mutex_enter(&ip_addr_avail_lock);
19974 	/* Mark it up, and increment counters. */
19975 	ipif->ipif_flags |= IPIF_UP;
19976 	ill->ill_ipif_up_count++;
19977 	err = ip_addr_availability_check(ipif);
19978 	mutex_exit(&ip_addr_avail_lock);
19979 	rw_exit(&ill_g_lock);
19980 
19981 	if (err != 0) {
19982 		/*
19983 		 * Our address may already be up on the same ill. In this case,
19984 		 * the ARP entry for our ipif replaced the one for the other
19985 		 * ipif. So we don't want to delete it (otherwise the other ipif
19986 		 * would be unable to send packets).
19987 		 * ip_addr_availability_check() identifies this case for us and
19988 		 * returns EADDRINUSE; we need to turn it into EADDRNOTAVAIL
19989 		 * which is the expected error code.
19990 		 */
19991 		if (err == EADDRINUSE) {
19992 			freemsg(ipif->ipif_arp_del_mp);
19993 			ipif->ipif_arp_del_mp = NULL;
19994 			err = EADDRNOTAVAIL;
19995 		}
19996 		ill->ill_ipif_up_count--;
19997 		ipif->ipif_flags &= ~IPIF_UP;
19998 		goto bad;
19999 	}
20000 
20001 	/*
20002 	 * Add in all newly created IREs.  ire_create_bcast() has
20003 	 * already checked for duplicates of the IRE_BROADCAST type.
20004 	 * We want to add before we call ifgrp_insert which wants
20005 	 * to know whether IRE_IF_RESOLVER exists or not.
20006 	 *
20007 	 * NOTE : We refrele the ire though we may branch to "bad"
20008 	 *	  later on where we do ire_delete. This is okay
20009 	 *	  because nobody can delete it as we are running
20010 	 *	  exclusively.
20011 	 */
20012 	for (irep1 = irep; irep1 > ire_array; ) {
20013 		irep1--;
20014 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ipif->ipif_ill->ill_lock)));
20015 		/*
20016 		 * refheld by ire_add. refele towards the end of the func
20017 		 */
20018 		(void) ire_add(irep1, NULL, NULL, NULL, B_FALSE);
20019 	}
20020 	ire_added = B_TRUE;
20021 	/*
20022 	 * Form groups if possible.
20023 	 *
20024 	 * If we are supposed to be in a ill_group with a name, insert it
20025 	 * now as we know that at least one ipif is UP. Otherwise form
20026 	 * nameless groups.
20027 	 *
20028 	 * If ip_enable_group_ifs is set and ipif address is not 0, insert
20029 	 * this ipif into the appropriate interface group, or create a
20030 	 * new one. If this is already in a nameless group, we try to form
20031 	 * a bigger group looking at other ills potentially sharing this
20032 	 * ipif's prefix.
20033 	 */
20034 	phyi = ill->ill_phyint;
20035 	if (phyi->phyint_groupname_len != 0) {
20036 		ASSERT(phyi->phyint_groupname != NULL);
20037 		if (ill->ill_ipif_up_count == 1) {
20038 			ASSERT(ill->ill_group == NULL);
20039 			err = illgrp_insert(&illgrp_head_v4, ill,
20040 			    phyi->phyint_groupname, NULL, B_TRUE);
20041 			if (err != 0) {
20042 				ip1dbg(("ipif_up_done: illgrp allocation "
20043 				    "failed, error %d\n", err));
20044 				goto bad;
20045 			}
20046 		}
20047 		ASSERT(ill->ill_group != NULL);
20048 	}
20049 
20050 	/*
20051 	 * When this is part of group, we need to make sure that
20052 	 * any broadcast ires created because of this ipif coming
20053 	 * UP gets marked/cleared with IRE_MARK_NORECV appropriately
20054 	 * so that we don't receive duplicate broadcast packets.
20055 	 */
20056 	if (ill->ill_group != NULL && ill->ill_ipif_up_count != 0)
20057 		ipif_renominate_bcast(ipif);
20058 
20059 	/* Recover any additional IRE_IF_[NO]RESOLVER entries for this ipif */
20060 	ipif_saved_ire_cnt = ipif->ipif_saved_ire_cnt;
20061 	ipif_saved_irep = ipif_recover_ire(ipif);
20062 
20063 	if (!loopback) {
20064 		/*
20065 		 * If the broadcast address has been set, make sure it makes
20066 		 * sense based on the interface address.
20067 		 * Only match on ill since we are sharing broadcast addresses.
20068 		 */
20069 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
20070 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
20071 			ire_t	*ire;
20072 
20073 			ire = ire_ctable_lookup(ipif->ipif_brd_addr, 0,
20074 			    IRE_BROADCAST, ipif, ALL_ZONES,
20075 			    NULL, (MATCH_IRE_TYPE | MATCH_IRE_ILL));
20076 
20077 			if (ire == NULL) {
20078 				/*
20079 				 * If there isn't a matching broadcast IRE,
20080 				 * revert to the default for this netmask.
20081 				 */
20082 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
20083 				mutex_enter(&ipif->ipif_ill->ill_lock);
20084 				ipif_set_default(ipif);
20085 				mutex_exit(&ipif->ipif_ill->ill_lock);
20086 			} else {
20087 				ire_refrele(ire);
20088 			}
20089 		}
20090 
20091 	}
20092 
20093 	/* This is the first interface on this ill */
20094 	if (ipif->ipif_ipif_up_count == 1 && !loopback) {
20095 		/*
20096 		 * Need to recover all multicast memberships in the driver.
20097 		 * This had to be deferred until we had attached.
20098 		 */
20099 		ill_recover_multicast(ill);
20100 	}
20101 	/* Join the allhosts multicast address */
20102 	ipif_multicast_up(ipif);
20103 
20104 	if (!loopback) {
20105 		/*
20106 		 * See whether anybody else would benefit from the
20107 		 * new ipif that we added. We call this always rather
20108 		 * than while adding a non-IPIF_NOLOCAL/DEPRECATED/ANYCAST
20109 		 * ipif is for the benefit of illgrp_insert (done above)
20110 		 * which does not do source address selection as it does
20111 		 * not want to re-create interface routes that we are
20112 		 * having reference to it here.
20113 		 */
20114 		ill_update_source_selection(ill);
20115 	}
20116 
20117 	for (irep1 = irep; irep1 > ire_array; ) {
20118 		irep1--;
20119 		if (*irep1 != NULL) {
20120 			/* was held in ire_add */
20121 			ire_refrele(*irep1);
20122 		}
20123 	}
20124 
20125 	cnt = ipif_saved_ire_cnt;
20126 	for (irep1 = ipif_saved_irep; cnt > 0; irep1++, cnt--) {
20127 		if (*irep1 != NULL) {
20128 			/* was held in ire_add */
20129 			ire_refrele(*irep1);
20130 		}
20131 	}
20132 
20133 	if (!loopback && ipif->ipif_addr_ready) {
20134 		/* Broadcast an address mask reply. */
20135 		ipif_mask_reply(ipif);
20136 	}
20137 	if (ipif_saved_irep != NULL) {
20138 		kmem_free(ipif_saved_irep,
20139 		    ipif_saved_ire_cnt * sizeof (ire_t *));
20140 	}
20141 	if (src_ipif_held)
20142 		ipif_refrele(src_ipif);
20143 
20144 	/*
20145 	 * This had to be deferred until we had bound.  Tell routing sockets and
20146 	 * others that this interface is up if it looks like the address has
20147 	 * been validated.  Otherwise, if it isn't ready yet, wait for
20148 	 * duplicate address detection to do its thing.
20149 	 */
20150 	if (ipif->ipif_addr_ready) {
20151 		ip_rts_ifmsg(ipif);
20152 		ip_rts_newaddrmsg(RTM_ADD, 0, ipif);
20153 		/* Let SCTP update the status for this ipif */
20154 		sctp_update_ipif(ipif, SCTP_IPIF_UP);
20155 	}
20156 	return (0);
20157 
20158 bad:
20159 	ip1dbg(("ipif_up_done: FAILED \n"));
20160 	/*
20161 	 * We don't have to bother removing from ill groups because
20162 	 *
20163 	 * 1) For groups with names, we insert only when the first ipif
20164 	 *    comes up. In that case if it fails, it will not be in any
20165 	 *    group. So, we need not try to remove for that case.
20166 	 *
20167 	 * 2) For groups without names, either we tried to insert ipif_ill
20168 	 *    in a group as singleton or found some other group to become
20169 	 *    a bigger group. For the former, if it fails we don't have
20170 	 *    anything to do as ipif_ill is not in the group and for the
20171 	 *    latter, there are no failures in illgrp_insert/illgrp_delete
20172 	 *    (ENOMEM can't occur for this. Check ifgrp_insert).
20173 	 */
20174 	while (irep > ire_array) {
20175 		irep--;
20176 		if (*irep != NULL) {
20177 			ire_delete(*irep);
20178 			if (ire_added)
20179 				ire_refrele(*irep);
20180 		}
20181 	}
20182 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid);
20183 
20184 	if (ipif_saved_irep != NULL) {
20185 		kmem_free(ipif_saved_irep,
20186 		    ipif_saved_ire_cnt * sizeof (ire_t *));
20187 	}
20188 	if (src_ipif_held)
20189 		ipif_refrele(src_ipif);
20190 
20191 	ipif_arp_down(ipif);
20192 	return (err);
20193 }
20194 
20195 /*
20196  * Turn off the ARP with the ILLF_NOARP flag.
20197  */
20198 static int
20199 ill_arp_off(ill_t *ill)
20200 {
20201 	mblk_t	*arp_off_mp = NULL;
20202 	mblk_t	*arp_on_mp = NULL;
20203 
20204 	ip1dbg(("ill_arp_off(%s)\n", ill->ill_name));
20205 
20206 	ASSERT(IAM_WRITER_ILL(ill));
20207 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
20208 
20209 	/*
20210 	 * If the on message is still around we've already done
20211 	 * an arp_off without doing an arp_on thus there is no
20212 	 * work needed.
20213 	 */
20214 	if (ill->ill_arp_on_mp != NULL)
20215 		return (0);
20216 
20217 	/*
20218 	 * Allocate an ARP on message (to be saved) and an ARP off message
20219 	 */
20220 	arp_off_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aroff_template, 0);
20221 	if (!arp_off_mp)
20222 		return (ENOMEM);
20223 
20224 	arp_on_mp = ill_arp_alloc(ill, (uchar_t *)&ip_aron_template, 0);
20225 	if (!arp_on_mp)
20226 		goto failed;
20227 
20228 	ASSERT(ill->ill_arp_on_mp == NULL);
20229 	ill->ill_arp_on_mp = arp_on_mp;
20230 
20231 	/* Send an AR_INTERFACE_OFF request */
20232 	putnext(ill->ill_rq, arp_off_mp);
20233 	return (0);
20234 failed:
20235 
20236 	if (arp_off_mp)
20237 		freemsg(arp_off_mp);
20238 	return (ENOMEM);
20239 }
20240 
20241 /*
20242  * Turn on ARP by turning off the ILLF_NOARP flag.
20243  */
20244 static int
20245 ill_arp_on(ill_t *ill)
20246 {
20247 	mblk_t	*mp;
20248 
20249 	ip1dbg(("ipif_arp_on(%s)\n", ill->ill_name));
20250 
20251 	ASSERT(ill->ill_net_type == IRE_IF_RESOLVER);
20252 
20253 	ASSERT(IAM_WRITER_ILL(ill));
20254 	/*
20255 	 * Send an AR_INTERFACE_ON request if we have already done
20256 	 * an arp_off (which allocated the message).
20257 	 */
20258 	if (ill->ill_arp_on_mp != NULL) {
20259 		mp = ill->ill_arp_on_mp;
20260 		ill->ill_arp_on_mp = NULL;
20261 		putnext(ill->ill_rq, mp);
20262 	}
20263 	return (0);
20264 }
20265 
20266 /*
20267  * Called after either deleting ill from the group or when setting
20268  * FAILED or STANDBY on the interface.
20269  */
20270 static void
20271 illgrp_reset_schednext(ill_t *ill)
20272 {
20273 	ill_group_t *illgrp;
20274 	ill_t *save_ill;
20275 
20276 	ASSERT(IAM_WRITER_ILL(ill));
20277 	/*
20278 	 * When called from illgrp_delete, ill_group will be non-NULL.
20279 	 * But when called from ip_sioctl_flags, it could be NULL if
20280 	 * somebody is setting FAILED/INACTIVE on some interface which
20281 	 * is not part of a group.
20282 	 */
20283 	illgrp = ill->ill_group;
20284 	if (illgrp == NULL)
20285 		return;
20286 	if (illgrp->illgrp_ill_schednext != ill)
20287 		return;
20288 
20289 	illgrp->illgrp_ill_schednext = NULL;
20290 	save_ill = ill;
20291 	/*
20292 	 * Choose a good ill to be the next one for
20293 	 * outbound traffic. As the flags FAILED/STANDBY is
20294 	 * not yet marked when called from ip_sioctl_flags,
20295 	 * we check for ill separately.
20296 	 */
20297 	for (ill = illgrp->illgrp_ill; ill != NULL;
20298 	    ill = ill->ill_group_next) {
20299 		if ((ill != save_ill) &&
20300 		    !(ill->ill_phyint->phyint_flags &
20301 		    (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE))) {
20302 			illgrp->illgrp_ill_schednext = ill;
20303 			return;
20304 		}
20305 	}
20306 }
20307 
20308 /*
20309  * Given an ill, find the next ill in the group to be scheduled.
20310  * (This should be called by ip_newroute() before ire_create().)
20311  * The passed in ill may be pulled out of the group, after we have picked
20312  * up a different outgoing ill from the same group. However ire add will
20313  * atomically check this.
20314  */
20315 ill_t *
20316 illgrp_scheduler(ill_t *ill)
20317 {
20318 	ill_t *retill;
20319 	ill_group_t *illgrp;
20320 	int illcnt;
20321 	int i;
20322 	uint64_t flags;
20323 
20324 	/*
20325 	 * We don't use a lock to check for the ill_group. If this ill
20326 	 * is currently being inserted we may end up just returning this
20327 	 * ill itself. That is ok.
20328 	 */
20329 	if (ill->ill_group == NULL) {
20330 		ill_refhold(ill);
20331 		return (ill);
20332 	}
20333 
20334 	/*
20335 	 * Grab the ill_g_lock as reader to make sure we are dealing with
20336 	 * a set of stable ills. No ill can be added or deleted or change
20337 	 * group while we hold the reader lock.
20338 	 */
20339 	rw_enter(&ill_g_lock, RW_READER);
20340 	if ((illgrp = ill->ill_group) == NULL) {
20341 		rw_exit(&ill_g_lock);
20342 		ill_refhold(ill);
20343 		return (ill);
20344 	}
20345 
20346 	illcnt = illgrp->illgrp_ill_count;
20347 	mutex_enter(&illgrp->illgrp_lock);
20348 	retill = illgrp->illgrp_ill_schednext;
20349 
20350 	if (retill == NULL)
20351 		retill = illgrp->illgrp_ill;
20352 
20353 	/*
20354 	 * We do a circular search beginning at illgrp_ill_schednext
20355 	 * or illgrp_ill. We don't check the flags against the ill lock
20356 	 * since it can change anytime. The ire creation will be atomic
20357 	 * and will fail if the ill is FAILED or OFFLINE.
20358 	 */
20359 	for (i = 0; i < illcnt; i++) {
20360 		flags = retill->ill_phyint->phyint_flags;
20361 
20362 		if (!(flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) &&
20363 		    ILL_CAN_LOOKUP(retill)) {
20364 			illgrp->illgrp_ill_schednext = retill->ill_group_next;
20365 			ill_refhold(retill);
20366 			break;
20367 		}
20368 		retill = retill->ill_group_next;
20369 		if (retill == NULL)
20370 			retill = illgrp->illgrp_ill;
20371 	}
20372 	mutex_exit(&illgrp->illgrp_lock);
20373 	rw_exit(&ill_g_lock);
20374 
20375 	return (i == illcnt ? NULL : retill);
20376 }
20377 
20378 /*
20379  * Checks for availbility of a usable source address (if there is one) when the
20380  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
20381  * this selection is done regardless of the destination.
20382  */
20383 boolean_t
20384 ipif_usesrc_avail(ill_t *ill, zoneid_t zoneid)
20385 {
20386 	uint_t	ifindex;
20387 	ipif_t	*ipif = NULL;
20388 	ill_t	*uill;
20389 	boolean_t isv6;
20390 
20391 	ASSERT(ill != NULL);
20392 
20393 	isv6 = ill->ill_isv6;
20394 	ifindex = ill->ill_usesrc_ifindex;
20395 	if (ifindex != 0) {
20396 		uill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL,
20397 		    NULL);
20398 		if (uill == NULL)
20399 			return (NULL);
20400 		mutex_enter(&uill->ill_lock);
20401 		for (ipif = uill->ill_ipif; ipif != NULL;
20402 		    ipif = ipif->ipif_next) {
20403 			if (!IPIF_CAN_LOOKUP(ipif))
20404 				continue;
20405 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
20406 				continue;
20407 			if (!(ipif->ipif_flags & IPIF_UP))
20408 				continue;
20409 			if (ipif->ipif_zoneid != zoneid)
20410 				continue;
20411 			if ((isv6 &&
20412 			    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) ||
20413 			    (ipif->ipif_lcl_addr == INADDR_ANY))
20414 				continue;
20415 			mutex_exit(&uill->ill_lock);
20416 			ill_refrele(uill);
20417 			return (B_TRUE);
20418 		}
20419 		mutex_exit(&uill->ill_lock);
20420 		ill_refrele(uill);
20421 	}
20422 	return (B_FALSE);
20423 }
20424 
20425 /*
20426  * Determine the best source address given a destination address and an ill.
20427  * Prefers non-deprecated over deprecated but will return a deprecated
20428  * address if there is no other choice. If there is a usable source address
20429  * on the interface pointed to by ill_usesrc_ifindex then that is given
20430  * first preference.
20431  *
20432  * Returns NULL if there is no suitable source address for the ill.
20433  * This only occurs when there is no valid source address for the ill.
20434  */
20435 ipif_t *
20436 ipif_select_source(ill_t *ill, ipaddr_t dst, zoneid_t zoneid)
20437 {
20438 	ipif_t *ipif;
20439 	ipif_t *ipif_dep = NULL;	/* Fallback to deprecated */
20440 	ipif_t *ipif_arr[MAX_IPIF_SELECT_SOURCE];
20441 	int index = 0;
20442 	boolean_t wrapped = B_FALSE;
20443 	boolean_t same_subnet_only = B_FALSE;
20444 	boolean_t ipif_same_found, ipif_other_found;
20445 	boolean_t specific_found;
20446 	ill_t	*till, *usill = NULL;
20447 	tsol_tpc_t *src_rhtp, *dst_rhtp;
20448 
20449 	if (ill->ill_usesrc_ifindex != 0) {
20450 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex, B_FALSE,
20451 		    NULL, NULL, NULL, NULL);
20452 		if (usill != NULL)
20453 			ill = usill;	/* Select source from usesrc ILL */
20454 		else
20455 			return (NULL);
20456 	}
20457 
20458 	/*
20459 	 * If we're dealing with an unlabeled destination on a labeled system,
20460 	 * make sure that we ignore source addresses that are incompatible with
20461 	 * the destination's default label.  That destination's default label
20462 	 * must dominate the minimum label on the source address.
20463 	 */
20464 	dst_rhtp = NULL;
20465 	if (is_system_labeled()) {
20466 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
20467 		if (dst_rhtp == NULL)
20468 			return (NULL);
20469 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
20470 			TPC_RELE(dst_rhtp);
20471 			dst_rhtp = NULL;
20472 		}
20473 	}
20474 
20475 	/*
20476 	 * Holds the ill_g_lock as reader. This makes sure that no ipif/ill
20477 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
20478 	 * After selecting the right ipif, under ill_lock make sure ipif is
20479 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
20480 	 * we retry. Inside the loop we still need to check for CONDEMNED,
20481 	 * but not under a lock.
20482 	 */
20483 	rw_enter(&ill_g_lock, RW_READER);
20484 
20485 retry:
20486 	till = ill;
20487 	ipif_arr[0] = NULL;
20488 
20489 	if (till->ill_group != NULL)
20490 		till = till->ill_group->illgrp_ill;
20491 
20492 	/*
20493 	 * Choose one good source address from each ill across the group.
20494 	 * If possible choose a source address in the same subnet as
20495 	 * the destination address.
20496 	 *
20497 	 * We don't check for PHYI_FAILED or PHYI_INACTIVE or PHYI_OFFLINE
20498 	 * This is okay because of the following.
20499 	 *
20500 	 *    If PHYI_FAILED is set and we still have non-deprecated
20501 	 *    addresses, it means the addresses have not yet been
20502 	 *    failed over to a different interface. We potentially
20503 	 *    select them to create IRE_CACHES, which will be later
20504 	 *    flushed when the addresses move over.
20505 	 *
20506 	 *    If PHYI_INACTIVE is set and we still have non-deprecated
20507 	 *    addresses, it means either the user has configured them
20508 	 *    or PHYI_INACTIVE has not been cleared after the addresses
20509 	 *    been moved over. For the former, in.mpathd does a failover
20510 	 *    when the interface becomes INACTIVE and hence we should
20511 	 *    not find them. Once INACTIVE is set, we don't allow them
20512 	 *    to create logical interfaces anymore. For the latter, a
20513 	 *    flush will happen when INACTIVE is cleared which will
20514 	 *    flush the IRE_CACHES.
20515 	 *
20516 	 *    If PHYI_OFFLINE is set, all the addresses will be failed
20517 	 *    over soon. We potentially select them to create IRE_CACHEs,
20518 	 *    which will be later flushed when the addresses move over.
20519 	 *
20520 	 * NOTE : As ipif_select_source is called to borrow source address
20521 	 * for an ipif that is part of a group, source address selection
20522 	 * will be re-done whenever the group changes i.e either an
20523 	 * insertion/deletion in the group.
20524 	 *
20525 	 * Fill ipif_arr[] with source addresses, using these rules:
20526 	 *
20527 	 *	1. At most one source address from a given ill ends up
20528 	 *	   in ipif_arr[] -- that is, at most one of the ipif's
20529 	 *	   associated with a given ill ends up in ipif_arr[].
20530 	 *
20531 	 *	2. If there is at least one non-deprecated ipif in the
20532 	 *	   IPMP group with a source address on the same subnet as
20533 	 *	   our destination, then fill ipif_arr[] only with
20534 	 *	   source addresses on the same subnet as our destination.
20535 	 *	   Note that because of (1), only the first
20536 	 *	   non-deprecated ipif found with a source address
20537 	 *	   matching the destination ends up in ipif_arr[].
20538 	 *
20539 	 *	3. Otherwise, fill ipif_arr[] with non-deprecated source
20540 	 *	   addresses not in the same subnet as our destination.
20541 	 *	   Again, because of (1), only the first off-subnet source
20542 	 *	   address will be chosen.
20543 	 *
20544 	 *	4. If there are no non-deprecated ipifs, then just use
20545 	 *	   the source address associated with the last deprecated
20546 	 *	   one we find that happens to be on the same subnet,
20547 	 *	   otherwise the first one not in the same subnet.
20548 	 */
20549 	specific_found = B_FALSE;
20550 	for (; till != NULL; till = till->ill_group_next) {
20551 		ipif_same_found = B_FALSE;
20552 		ipif_other_found = B_FALSE;
20553 		for (ipif = till->ill_ipif; ipif != NULL;
20554 		    ipif = ipif->ipif_next) {
20555 			if (!IPIF_CAN_LOOKUP(ipif))
20556 				continue;
20557 			/* Always skip NOLOCAL and ANYCAST interfaces */
20558 			if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
20559 				continue;
20560 			if (!(ipif->ipif_flags & IPIF_UP) ||
20561 			    !ipif->ipif_addr_ready)
20562 				continue;
20563 			if (ipif->ipif_zoneid != zoneid &&
20564 			    ipif->ipif_zoneid != ALL_ZONES)
20565 				continue;
20566 			/*
20567 			 * Interfaces with 0.0.0.0 address are allowed to be UP,
20568 			 * but are not valid as source addresses.
20569 			 */
20570 			if (ipif->ipif_lcl_addr == INADDR_ANY)
20571 				continue;
20572 
20573 			/*
20574 			 * Check compatibility of local address for
20575 			 * destination's default label if we're on a labeled
20576 			 * system.  Incompatible addresses can't be used at
20577 			 * all.
20578 			 */
20579 			if (dst_rhtp != NULL) {
20580 				boolean_t incompat;
20581 
20582 				src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
20583 				    IPV4_VERSION, B_FALSE);
20584 				if (src_rhtp == NULL)
20585 					continue;
20586 				incompat =
20587 				    src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
20588 				    src_rhtp->tpc_tp.tp_doi !=
20589 				    dst_rhtp->tpc_tp.tp_doi ||
20590 				    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
20591 				    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
20592 				    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
20593 				    src_rhtp->tpc_tp.tp_sl_set_cipso));
20594 				TPC_RELE(src_rhtp);
20595 				if (incompat)
20596 					continue;
20597 			}
20598 
20599 			/*
20600 			 * We prefer not to use all all-zones addresses, if we
20601 			 * can avoid it, as they pose problems with unlabeled
20602 			 * destinations.
20603 			 */
20604 			if (ipif->ipif_zoneid != ALL_ZONES) {
20605 				if (!specific_found &&
20606 				    (!same_subnet_only ||
20607 				    (ipif->ipif_net_mask & dst) ==
20608 				    ipif->ipif_subnet)) {
20609 					index = 0;
20610 					specific_found = B_TRUE;
20611 					ipif_other_found = B_FALSE;
20612 				}
20613 			} else {
20614 				if (specific_found)
20615 					continue;
20616 			}
20617 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
20618 				if (ipif_dep == NULL ||
20619 				    (ipif->ipif_net_mask & dst) ==
20620 				    ipif->ipif_subnet)
20621 					ipif_dep = ipif;
20622 				continue;
20623 			}
20624 			if ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet) {
20625 				/* found a source address in the same subnet */
20626 				if (!same_subnet_only) {
20627 					same_subnet_only = B_TRUE;
20628 					index = 0;
20629 				}
20630 				ipif_same_found = B_TRUE;
20631 			} else {
20632 				if (same_subnet_only || ipif_other_found)
20633 					continue;
20634 				ipif_other_found = B_TRUE;
20635 			}
20636 			ipif_arr[index++] = ipif;
20637 			if (index == MAX_IPIF_SELECT_SOURCE) {
20638 				wrapped = B_TRUE;
20639 				index = 0;
20640 			}
20641 			if (ipif_same_found)
20642 				break;
20643 		}
20644 	}
20645 
20646 	if (ipif_arr[0] == NULL) {
20647 		ipif = ipif_dep;
20648 	} else {
20649 		if (wrapped)
20650 			index = MAX_IPIF_SELECT_SOURCE;
20651 		ipif = ipif_arr[ipif_rand() % index];
20652 		ASSERT(ipif != NULL);
20653 	}
20654 
20655 	if (ipif != NULL) {
20656 		mutex_enter(&ipif->ipif_ill->ill_lock);
20657 		if (!IPIF_CAN_LOOKUP(ipif)) {
20658 			mutex_exit(&ipif->ipif_ill->ill_lock);
20659 			goto retry;
20660 		}
20661 		ipif_refhold_locked(ipif);
20662 		mutex_exit(&ipif->ipif_ill->ill_lock);
20663 	}
20664 
20665 	rw_exit(&ill_g_lock);
20666 	if (usill != NULL)
20667 		ill_refrele(usill);
20668 	if (dst_rhtp != NULL)
20669 		TPC_RELE(dst_rhtp);
20670 
20671 #ifdef DEBUG
20672 	if (ipif == NULL) {
20673 		char buf1[INET6_ADDRSTRLEN];
20674 
20675 		ip1dbg(("ipif_select_source(%s, %s) -> NULL\n",
20676 		    ill->ill_name,
20677 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
20678 	} else {
20679 		char buf1[INET6_ADDRSTRLEN];
20680 		char buf2[INET6_ADDRSTRLEN];
20681 
20682 		ip1dbg(("ipif_select_source(%s, %s) -> %s\n",
20683 		    ipif->ipif_ill->ill_name,
20684 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
20685 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
20686 		    buf2, sizeof (buf2))));
20687 	}
20688 #endif /* DEBUG */
20689 	return (ipif);
20690 }
20691 
20692 
20693 /*
20694  * If old_ipif is not NULL, see if ipif was derived from old
20695  * ipif and if so, recreate the interface route by re-doing
20696  * source address selection. This happens when ipif_down ->
20697  * ipif_update_other_ipifs calls us.
20698  *
20699  * If old_ipif is NULL, just redo the source address selection
20700  * if needed. This happens when illgrp_insert or ipif_up_done
20701  * calls us.
20702  */
20703 static void
20704 ipif_recreate_interface_routes(ipif_t *old_ipif, ipif_t *ipif)
20705 {
20706 	ire_t *ire;
20707 	ire_t *ipif_ire;
20708 	queue_t *stq;
20709 	ipif_t *nipif;
20710 	ill_t *ill;
20711 	boolean_t need_rele = B_FALSE;
20712 
20713 	ASSERT(old_ipif == NULL || IAM_WRITER_IPIF(old_ipif));
20714 	ASSERT(IAM_WRITER_IPIF(ipif));
20715 
20716 	ill = ipif->ipif_ill;
20717 	if (!(ipif->ipif_flags &
20718 	    (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED))) {
20719 		/*
20720 		 * Can't possibly have borrowed the source
20721 		 * from old_ipif.
20722 		 */
20723 		return;
20724 	}
20725 
20726 	/*
20727 	 * Is there any work to be done? No work if the address
20728 	 * is INADDR_ANY, loopback or NOLOCAL or ANYCAST (
20729 	 * ipif_select_source() does not borrow addresses from
20730 	 * NOLOCAL and ANYCAST interfaces).
20731 	 */
20732 	if ((old_ipif != NULL) &&
20733 	    ((old_ipif->ipif_lcl_addr == INADDR_ANY) ||
20734 	    (old_ipif->ipif_ill->ill_wq == NULL) ||
20735 	    (old_ipif->ipif_flags &
20736 	    (IPIF_NOLOCAL|IPIF_ANYCAST)))) {
20737 		return;
20738 	}
20739 
20740 	/*
20741 	 * Perform the same checks as when creating the
20742 	 * IRE_INTERFACE in ipif_up_done.
20743 	 */
20744 	if (!(ipif->ipif_flags & IPIF_UP))
20745 		return;
20746 
20747 	if ((ipif->ipif_flags & IPIF_NOXMIT) ||
20748 	    (ipif->ipif_subnet == INADDR_ANY))
20749 		return;
20750 
20751 	ipif_ire = ipif_to_ire(ipif);
20752 	if (ipif_ire == NULL)
20753 		return;
20754 
20755 	/*
20756 	 * We know that ipif uses some other source for its
20757 	 * IRE_INTERFACE. Is it using the source of this
20758 	 * old_ipif?
20759 	 */
20760 	if (old_ipif != NULL &&
20761 	    old_ipif->ipif_lcl_addr != ipif_ire->ire_src_addr) {
20762 		ire_refrele(ipif_ire);
20763 		return;
20764 	}
20765 	if (ip_debug > 2) {
20766 		/* ip1dbg */
20767 		pr_addr_dbg("ipif_recreate_interface_routes: deleting IRE for"
20768 		    " src %s\n", AF_INET, &ipif_ire->ire_src_addr);
20769 	}
20770 
20771 	stq = ipif_ire->ire_stq;
20772 
20773 	/*
20774 	 * Can't use our source address. Select a different
20775 	 * source address for the IRE_INTERFACE.
20776 	 */
20777 	nipif = ipif_select_source(ill, ipif->ipif_subnet, ipif->ipif_zoneid);
20778 	if (nipif == NULL) {
20779 		/* Last resort - all ipif's have IPIF_NOLOCAL */
20780 		nipif = ipif;
20781 	} else {
20782 		need_rele = B_TRUE;
20783 	}
20784 
20785 	ire = ire_create(
20786 	    (uchar_t *)&ipif->ipif_subnet,	/* dest pref */
20787 	    (uchar_t *)&ipif->ipif_net_mask,	/* mask */
20788 	    (uchar_t *)&nipif->ipif_src_addr,	/* src addr */
20789 	    NULL,				/* no gateway */
20790 	    NULL,
20791 	    &ipif->ipif_mtu,			/* max frag */
20792 	    NULL,				/* fast path header */
20793 	    NULL,				/* no recv from queue */
20794 	    stq,				/* send-to queue */
20795 	    ill->ill_net_type,			/* IF_[NO]RESOLVER */
20796 	    ill->ill_resolver_mp,		/* xmit header */
20797 	    ipif,
20798 	    NULL,
20799 	    0,
20800 	    0,
20801 	    0,
20802 	    0,
20803 	    &ire_uinfo_null,
20804 	    NULL,
20805 	    NULL);
20806 
20807 	if (ire != NULL) {
20808 		ire_t *ret_ire;
20809 		int error;
20810 
20811 		/*
20812 		 * We don't need ipif_ire anymore. We need to delete
20813 		 * before we add so that ire_add does not detect
20814 		 * duplicates.
20815 		 */
20816 		ire_delete(ipif_ire);
20817 		ret_ire = ire;
20818 		error = ire_add(&ret_ire, NULL, NULL, NULL, B_FALSE);
20819 		ASSERT(error == 0);
20820 		ASSERT(ire == ret_ire);
20821 		/* Held in ire_add */
20822 		ire_refrele(ret_ire);
20823 	}
20824 	/*
20825 	 * Either we are falling through from above or could not
20826 	 * allocate a replacement.
20827 	 */
20828 	ire_refrele(ipif_ire);
20829 	if (need_rele)
20830 		ipif_refrele(nipif);
20831 }
20832 
20833 /*
20834  * This old_ipif is going away.
20835  *
20836  * Determine if any other ipif's is using our address as
20837  * ipif_lcl_addr (due to those being IPIF_NOLOCAL, IPIF_ANYCAST, or
20838  * IPIF_DEPRECATED).
20839  * Find the IRE_INTERFACE for such ipifs and recreate them
20840  * to use an different source address following the rules in
20841  * ipif_up_done.
20842  *
20843  * This function takes an illgrp as an argument so that illgrp_delete
20844  * can call this to update source address even after deleting the
20845  * old_ipif->ipif_ill from the ill group.
20846  */
20847 static void
20848 ipif_update_other_ipifs(ipif_t *old_ipif, ill_group_t *illgrp)
20849 {
20850 	ipif_t *ipif;
20851 	ill_t *ill;
20852 	char	buf[INET6_ADDRSTRLEN];
20853 
20854 	ASSERT(IAM_WRITER_IPIF(old_ipif));
20855 	ASSERT(illgrp == NULL || IAM_WRITER_IPIF(old_ipif));
20856 
20857 	ill = old_ipif->ipif_ill;
20858 
20859 	ip1dbg(("ipif_update_other_ipifs(%s, %s)\n",
20860 	    ill->ill_name,
20861 	    inet_ntop(AF_INET, &old_ipif->ipif_lcl_addr,
20862 	    buf, sizeof (buf))));
20863 	/*
20864 	 * If this part of a group, look at all ills as ipif_select_source
20865 	 * borrows source address across all the ills in the group.
20866 	 */
20867 	if (illgrp != NULL)
20868 		ill = illgrp->illgrp_ill;
20869 
20870 	for (; ill != NULL; ill = ill->ill_group_next) {
20871 		for (ipif = ill->ill_ipif; ipif != NULL;
20872 		    ipif = ipif->ipif_next) {
20873 
20874 			if (ipif == old_ipif)
20875 				continue;
20876 
20877 			ipif_recreate_interface_routes(old_ipif, ipif);
20878 		}
20879 	}
20880 }
20881 
20882 /* ARGSUSED */
20883 int
20884 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
20885 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
20886 {
20887 	/*
20888 	 * ill_phyint_reinit merged the v4 and v6 into a single
20889 	 * ipsq. Could also have become part of a ipmp group in the
20890 	 * process, and we might not have been able to complete the
20891 	 * operation in ipif_set_values, if we could not become
20892 	 * exclusive.  If so restart it here.
20893 	 */
20894 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
20895 }
20896 
20897 
20898 /* ARGSUSED */
20899 int
20900 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
20901     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
20902 {
20903 	queue_t		*q1 = q;
20904 	char 		*cp;
20905 	char		interf_name[LIFNAMSIZ];
20906 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
20907 
20908 	if (!q->q_next) {
20909 		ip1dbg((
20910 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
20911 		return (EINVAL);
20912 	}
20913 
20914 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
20915 		return (EALREADY);
20916 
20917 	do {
20918 		q1 = q1->q_next;
20919 	} while (q1->q_next);
20920 	cp = q1->q_qinfo->qi_minfo->mi_idname;
20921 	(void) sprintf(interf_name, "%s%d", cp, ppa);
20922 
20923 	/*
20924 	 * Here we are not going to delay the ioack until after
20925 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
20926 	 * original ioctl message before sending the requests.
20927 	 */
20928 	return (ipif_set_values(q, mp, interf_name, &ppa));
20929 }
20930 
20931 /* ARGSUSED */
20932 int
20933 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
20934     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
20935 {
20936 	return (ENXIO);
20937 }
20938 
20939 /*
20940  * Net and subnet broadcast ire's are now specific to the particular
20941  * physical interface (ill) and not to any one locigal interface (ipif).
20942  * However, if a particular logical interface is being taken down, it's
20943  * associated ire's will be taken down as well.  Hence, when we go to
20944  * take down or change the local address, broadcast address or netmask
20945  * of a specific logical interface, we must check to make sure that we
20946  * have valid net and subnet broadcast ire's for the other logical
20947  * interfaces which may have been shared with the logical interface
20948  * being brought down or changed.
20949  *
20950  * There is one set of 0.0.0.0 and 255.255.255.255 per ill. Usually it
20951  * is tied to the first interface coming UP. If that ipif is going down,
20952  * we need to recreate them on the next valid ipif.
20953  *
20954  * Note: assume that the ipif passed in is still up so that it's IRE
20955  * entries are still valid.
20956  */
20957 static void
20958 ipif_check_bcast_ires(ipif_t *test_ipif)
20959 {
20960 	ipif_t	*ipif;
20961 	ire_t	*test_subnet_ire, *test_net_ire;
20962 	ire_t	*test_allzero_ire, *test_allone_ire;
20963 	ire_t	*ire_array[12];
20964 	ire_t	**irep = &ire_array[0];
20965 	ire_t	**irep1;
20966 
20967 	ipaddr_t net_addr, subnet_addr, net_mask, subnet_mask;
20968 	ipaddr_t test_net_addr, test_subnet_addr;
20969 	ipaddr_t test_net_mask, test_subnet_mask;
20970 	boolean_t need_net_bcast_ire = B_FALSE;
20971 	boolean_t need_subnet_bcast_ire = B_FALSE;
20972 	boolean_t allzero_bcast_ire_created = B_FALSE;
20973 	boolean_t allone_bcast_ire_created = B_FALSE;
20974 	boolean_t net_bcast_ire_created = B_FALSE;
20975 	boolean_t subnet_bcast_ire_created = B_FALSE;
20976 
20977 	ipif_t  *backup_ipif_net = (ipif_t *)NULL;
20978 	ipif_t  *backup_ipif_subnet = (ipif_t *)NULL;
20979 	ipif_t  *backup_ipif_allzeros = (ipif_t *)NULL;
20980 	ipif_t  *backup_ipif_allones = (ipif_t *)NULL;
20981 	uint64_t check_flags = IPIF_DEPRECATED | IPIF_NOLOCAL | IPIF_ANYCAST;
20982 
20983 	ASSERT(!test_ipif->ipif_isv6);
20984 	ASSERT(IAM_WRITER_IPIF(test_ipif));
20985 
20986 	/*
20987 	 * No broadcast IREs for the LOOPBACK interface
20988 	 * or others such as point to point and IPIF_NOXMIT.
20989 	 */
20990 	if (!(test_ipif->ipif_flags & IPIF_BROADCAST) ||
20991 	    (test_ipif->ipif_flags & IPIF_NOXMIT))
20992 		return;
20993 
20994 	test_allzero_ire = ire_ctable_lookup(0, 0, IRE_BROADCAST,
20995 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20996 
20997 	test_allone_ire = ire_ctable_lookup(INADDR_BROADCAST, 0, IRE_BROADCAST,
20998 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
20999 
21000 	test_net_mask = ip_net_mask(test_ipif->ipif_subnet);
21001 	test_subnet_mask = test_ipif->ipif_net_mask;
21002 
21003 	/*
21004 	 * If no net mask set, assume the default based on net class.
21005 	 */
21006 	if (test_subnet_mask == 0)
21007 		test_subnet_mask = test_net_mask;
21008 
21009 	/*
21010 	 * Check if there is a network broadcast ire associated with this ipif
21011 	 */
21012 	test_net_addr = test_net_mask  & test_ipif->ipif_subnet;
21013 	test_net_ire = ire_ctable_lookup(test_net_addr, 0, IRE_BROADCAST,
21014 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
21015 
21016 	/*
21017 	 * Check if there is a subnet broadcast IRE associated with this ipif
21018 	 */
21019 	test_subnet_addr = test_subnet_mask  & test_ipif->ipif_subnet;
21020 	test_subnet_ire = ire_ctable_lookup(test_subnet_addr, 0, IRE_BROADCAST,
21021 	    test_ipif, ALL_ZONES, NULL, (MATCH_IRE_TYPE | MATCH_IRE_IPIF));
21022 
21023 	/*
21024 	 * No broadcast ire's associated with this ipif.
21025 	 */
21026 	if ((test_subnet_ire == NULL) && (test_net_ire == NULL) &&
21027 	    (test_allzero_ire == NULL) && (test_allone_ire == NULL)) {
21028 		return;
21029 	}
21030 
21031 	/*
21032 	 * We have established which bcast ires have to be replaced.
21033 	 * Next we try to locate ipifs that match there ires.
21034 	 * The rules are simple: If we find an ipif that matches on the subnet
21035 	 * address it will also match on the net address, the allzeros and
21036 	 * allones address. Any ipif that matches only on the net address will
21037 	 * also match the allzeros and allones addresses.
21038 	 * The other criterion is the ipif_flags. We look for non-deprecated
21039 	 * (and non-anycast and non-nolocal) ipifs as the best choice.
21040 	 * ipifs with check_flags matching (deprecated, etc) are used only
21041 	 * if good ipifs are not available. While looping, we save existing
21042 	 * deprecated ipifs as backup_ipif.
21043 	 * We loop through all the ipifs for this ill looking for ipifs
21044 	 * whose broadcast addr match the ipif passed in, but do not have
21045 	 * their own broadcast ires. For creating 0.0.0.0 and
21046 	 * 255.255.255.255 we just need an ipif on this ill to create.
21047 	 */
21048 	for (ipif = test_ipif->ipif_ill->ill_ipif; ipif != NULL;
21049 	    ipif = ipif->ipif_next) {
21050 
21051 		ASSERT(!ipif->ipif_isv6);
21052 		/*
21053 		 * Already checked the ipif passed in.
21054 		 */
21055 		if (ipif == test_ipif) {
21056 			continue;
21057 		}
21058 
21059 		/*
21060 		 * We only need to recreate broadcast ires if another ipif in
21061 		 * the same zone uses them. The new ires must be created in the
21062 		 * same zone.
21063 		 */
21064 		if (ipif->ipif_zoneid != test_ipif->ipif_zoneid) {
21065 			continue;
21066 		}
21067 
21068 		/*
21069 		 * Only interested in logical interfaces with valid local
21070 		 * addresses or with the ability to broadcast.
21071 		 */
21072 		if ((ipif->ipif_subnet == 0) ||
21073 		    !(ipif->ipif_flags & IPIF_BROADCAST) ||
21074 		    (ipif->ipif_flags & IPIF_NOXMIT) ||
21075 		    !(ipif->ipif_flags & IPIF_UP)) {
21076 			continue;
21077 		}
21078 		/*
21079 		 * Check if there is a net broadcast ire for this
21080 		 * net address.  If it turns out that the ipif we are
21081 		 * about to take down owns this ire, we must make a
21082 		 * new one because it is potentially going away.
21083 		 */
21084 		if (test_net_ire && (!net_bcast_ire_created)) {
21085 			net_mask = ip_net_mask(ipif->ipif_subnet);
21086 			net_addr = net_mask & ipif->ipif_subnet;
21087 			if (net_addr == test_net_addr) {
21088 				need_net_bcast_ire = B_TRUE;
21089 				/*
21090 				 * Use DEPRECATED ipif only if no good
21091 				 * ires are available. subnet_addr is
21092 				 * a better match than net_addr.
21093 				 */
21094 				if ((ipif->ipif_flags & check_flags) &&
21095 				    (backup_ipif_net == NULL)) {
21096 					backup_ipif_net = ipif;
21097 				}
21098 			}
21099 		}
21100 		/*
21101 		 * Check if there is a subnet broadcast ire for this
21102 		 * net address.  If it turns out that the ipif we are
21103 		 * about to take down owns this ire, we must make a
21104 		 * new one because it is potentially going away.
21105 		 */
21106 		if (test_subnet_ire && (!subnet_bcast_ire_created)) {
21107 			subnet_mask = ipif->ipif_net_mask;
21108 			subnet_addr = ipif->ipif_subnet;
21109 			if (subnet_addr == test_subnet_addr) {
21110 				need_subnet_bcast_ire = B_TRUE;
21111 				if ((ipif->ipif_flags & check_flags) &&
21112 				    (backup_ipif_subnet == NULL)) {
21113 					backup_ipif_subnet = ipif;
21114 				}
21115 			}
21116 		}
21117 
21118 
21119 		/* Short circuit here if this ipif is deprecated */
21120 		if (ipif->ipif_flags & check_flags) {
21121 			if ((test_allzero_ire != NULL) &&
21122 			    (!allzero_bcast_ire_created) &&
21123 			    (backup_ipif_allzeros == NULL)) {
21124 				backup_ipif_allzeros = ipif;
21125 			}
21126 			if ((test_allone_ire != NULL) &&
21127 			    (!allone_bcast_ire_created) &&
21128 			    (backup_ipif_allones == NULL)) {
21129 				backup_ipif_allones = ipif;
21130 			}
21131 			continue;
21132 		}
21133 
21134 		/*
21135 		 * Found an ipif which has the same broadcast ire as the
21136 		 * ipif passed in and the ipif passed in "owns" the ire.
21137 		 * Create new broadcast ire's for this broadcast addr.
21138 		 */
21139 		if (need_net_bcast_ire && !net_bcast_ire_created) {
21140 			irep = ire_create_bcast(ipif, net_addr, irep);
21141 			irep = ire_create_bcast(ipif,
21142 			    ~net_mask | net_addr, irep);
21143 			net_bcast_ire_created = B_TRUE;
21144 		}
21145 		if (need_subnet_bcast_ire && !subnet_bcast_ire_created) {
21146 			irep = ire_create_bcast(ipif, subnet_addr, irep);
21147 			irep = ire_create_bcast(ipif,
21148 			    ~subnet_mask | subnet_addr, irep);
21149 			subnet_bcast_ire_created = B_TRUE;
21150 		}
21151 		if (test_allzero_ire != NULL && !allzero_bcast_ire_created) {
21152 			irep = ire_create_bcast(ipif, 0, irep);
21153 			allzero_bcast_ire_created = B_TRUE;
21154 		}
21155 		if (test_allone_ire != NULL && !allone_bcast_ire_created) {
21156 			irep = ire_create_bcast(ipif, INADDR_BROADCAST, irep);
21157 			allone_bcast_ire_created = B_TRUE;
21158 		}
21159 		/*
21160 		 * Once we have created all the appropriate ires, we
21161 		 * just break out of this loop to add what we have created.
21162 		 * This has been indented similar to ire_match_args for
21163 		 * readability.
21164 		 */
21165 		if (((test_net_ire == NULL) ||
21166 			(net_bcast_ire_created)) &&
21167 		    ((test_subnet_ire == NULL) ||
21168 			(subnet_bcast_ire_created)) &&
21169 		    ((test_allzero_ire == NULL) ||
21170 			(allzero_bcast_ire_created)) &&
21171 		    ((test_allone_ire == NULL) ||
21172 			(allone_bcast_ire_created))) {
21173 			break;
21174 		}
21175 	}
21176 
21177 	/*
21178 	 * Create bcast ires on deprecated ipifs if no non-deprecated ipifs
21179 	 * exist. 6 pairs of bcast ires are needed.
21180 	 * Note - the old ires are deleted in ipif_down.
21181 	 */
21182 	if (need_net_bcast_ire && !net_bcast_ire_created && backup_ipif_net) {
21183 		ipif = backup_ipif_net;
21184 		irep = ire_create_bcast(ipif, net_addr, irep);
21185 		irep = ire_create_bcast(ipif, ~net_mask | net_addr, irep);
21186 		net_bcast_ire_created = B_TRUE;
21187 	}
21188 	if (need_subnet_bcast_ire && !subnet_bcast_ire_created &&
21189 	    backup_ipif_subnet) {
21190 		ipif = backup_ipif_subnet;
21191 		irep = ire_create_bcast(ipif, subnet_addr, irep);
21192 		irep = ire_create_bcast(ipif,
21193 		    ~subnet_mask | subnet_addr, irep);
21194 		subnet_bcast_ire_created = B_TRUE;
21195 	}
21196 	if (test_allzero_ire != NULL && !allzero_bcast_ire_created &&
21197 	    backup_ipif_allzeros) {
21198 		irep = ire_create_bcast(backup_ipif_allzeros, 0, irep);
21199 		allzero_bcast_ire_created = B_TRUE;
21200 	}
21201 	if (test_allone_ire != NULL && !allone_bcast_ire_created &&
21202 	    backup_ipif_allones) {
21203 		irep = ire_create_bcast(backup_ipif_allones,
21204 		    INADDR_BROADCAST, irep);
21205 		allone_bcast_ire_created = B_TRUE;
21206 	}
21207 
21208 	/*
21209 	 * If we can't create all of them, don't add any of them.
21210 	 * Code in ip_wput_ire and ire_to_ill assumes that we
21211 	 * always have a non-loopback copy and loopback copy
21212 	 * for a given address.
21213 	 */
21214 	for (irep1 = irep; irep1 > ire_array; ) {
21215 		irep1--;
21216 		if (*irep1 == NULL) {
21217 			ip0dbg(("ipif_check_bcast_ires: can't create "
21218 			    "IRE_BROADCAST, memory allocation failure\n"));
21219 			while (irep > ire_array) {
21220 				irep--;
21221 				if (*irep != NULL)
21222 					ire_delete(*irep);
21223 			}
21224 			goto bad;
21225 		}
21226 	}
21227 	for (irep1 = irep; irep1 > ire_array; ) {
21228 		int error;
21229 
21230 		irep1--;
21231 		error = ire_add(irep1, NULL, NULL, NULL, B_FALSE);
21232 		if (error == 0) {
21233 			ire_refrele(*irep1);		/* Held in ire_add */
21234 		}
21235 	}
21236 bad:
21237 	if (test_allzero_ire != NULL)
21238 		ire_refrele(test_allzero_ire);
21239 	if (test_allone_ire != NULL)
21240 		ire_refrele(test_allone_ire);
21241 	if (test_net_ire != NULL)
21242 		ire_refrele(test_net_ire);
21243 	if (test_subnet_ire != NULL)
21244 		ire_refrele(test_subnet_ire);
21245 }
21246 
21247 /*
21248  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
21249  * from lifr_flags and the name from lifr_name.
21250  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
21251  * since ipif_lookup_on_name uses the _isv6 flags when matching.
21252  * Returns EINPROGRESS when mp has been consumed by queueing it on
21253  * ill_pending_mp and the ioctl will complete in ip_rput.
21254  */
21255 /* ARGSUSED */
21256 int
21257 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21258     ip_ioctl_cmd_t *ipip, void *if_req)
21259 {
21260 	int	err;
21261 	ill_t	*ill;
21262 	struct lifreq *lifr = (struct lifreq *)if_req;
21263 
21264 	ASSERT(ipif != NULL);
21265 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
21266 	ASSERT(q->q_next != NULL);
21267 
21268 	ill = (ill_t *)q->q_ptr;
21269 	/*
21270 	 * If we are not writer on 'q' then this interface exists already
21271 	 * and previous lookups (ipif_extract_lifreq_cmn) found this ipif.
21272 	 * So return EALREADY
21273 	 */
21274 	if (ill != ipif->ipif_ill)
21275 		return (EALREADY);
21276 
21277 	if (ill->ill_name[0] != '\0')
21278 		return (EALREADY);
21279 
21280 	/*
21281 	 * Set all the flags. Allows all kinds of override. Provide some
21282 	 * sanity checking by not allowing IFF_BROADCAST and IFF_MULTICAST
21283 	 * unless there is either multicast/broadcast support in the driver
21284 	 * or it is a pt-pt link.
21285 	 */
21286 	if (lifr->lifr_flags & (IFF_PROMISC|IFF_ALLMULTI)) {
21287 		/* Meaningless to IP thus don't allow them to be set. */
21288 		ip1dbg(("ip_setname: EINVAL 1\n"));
21289 		return (EINVAL);
21290 	}
21291 	/*
21292 	 * For a DL_STYLE2 driver (ill_needs_attach), we would not have the
21293 	 * ill_bcast_addr_length info.
21294 	 */
21295 	if (!ill->ill_needs_attach &&
21296 	    ((lifr->lifr_flags & IFF_MULTICAST) &&
21297 	    !(lifr->lifr_flags & IFF_POINTOPOINT) &&
21298 	    ill->ill_bcast_addr_length == 0)) {
21299 		/* Link not broadcast/pt-pt capable i.e. no multicast */
21300 		ip1dbg(("ip_setname: EINVAL 2\n"));
21301 		return (EINVAL);
21302 	}
21303 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
21304 	    ((lifr->lifr_flags & IFF_IPV6) ||
21305 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
21306 		/* Link not broadcast capable or IPv6 i.e. no broadcast */
21307 		ip1dbg(("ip_setname: EINVAL 3\n"));
21308 		return (EINVAL);
21309 	}
21310 	if (lifr->lifr_flags & IFF_UP) {
21311 		/* Can only be set with SIOCSLIFFLAGS */
21312 		ip1dbg(("ip_setname: EINVAL 4\n"));
21313 		return (EINVAL);
21314 	}
21315 	if ((lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV6 &&
21316 	    (lifr->lifr_flags & (IFF_IPV6|IFF_IPV4)) != IFF_IPV4) {
21317 		ip1dbg(("ip_setname: EINVAL 5\n"));
21318 		return (EINVAL);
21319 	}
21320 	/*
21321 	 * Only allow the IFF_XRESOLV flag to be set on IPv6 interfaces.
21322 	 */
21323 	if ((lifr->lifr_flags & IFF_XRESOLV) &&
21324 	    !(lifr->lifr_flags & IFF_IPV6) &&
21325 	    !(ipif->ipif_isv6)) {
21326 		ip1dbg(("ip_setname: EINVAL 6\n"));
21327 		return (EINVAL);
21328 	}
21329 
21330 	/*
21331 	 * The user has done SIOCGLIFFLAGS prior to this ioctl and hence
21332 	 * we have all the flags here. So, we assign rather than we OR.
21333 	 * We can't OR the flags here because we don't want to set
21334 	 * both IFF_IPV4 and IFF_IPV6. We start off as IFF_IPV4 in
21335 	 * ipif_allocate and become IFF_IPV4 or IFF_IPV6 here depending
21336 	 * on lifr_flags value here.
21337 	 */
21338 	/*
21339 	 * This ill has not been inserted into the global list.
21340 	 * So we are still single threaded and don't need any lock
21341 	 */
21342 	ipif->ipif_flags = lifr->lifr_flags & IFF_LOGINT_FLAGS &
21343 	    ~IFF_DUPLICATE;
21344 	ill->ill_flags = lifr->lifr_flags & IFF_PHYINTINST_FLAGS;
21345 	ill->ill_phyint->phyint_flags = lifr->lifr_flags & IFF_PHYINT_FLAGS;
21346 
21347 	/* We started off as V4. */
21348 	if (ill->ill_flags & ILLF_IPV6) {
21349 		ill->ill_phyint->phyint_illv6 = ill;
21350 		ill->ill_phyint->phyint_illv4 = NULL;
21351 	}
21352 	err = ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa);
21353 	return (err);
21354 }
21355 
21356 /* ARGSUSED */
21357 int
21358 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21359     ip_ioctl_cmd_t *ipip, void *if_req)
21360 {
21361 	/*
21362 	 * ill_phyint_reinit merged the v4 and v6 into a single
21363 	 * ipsq. Could also have become part of a ipmp group in the
21364 	 * process, and we might not have been able to complete the
21365 	 * slifname in ipif_set_values, if we could not become
21366 	 * exclusive.  If so restart it here
21367 	 */
21368 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
21369 }
21370 
21371 /*
21372  * Return a pointer to the ipif which matches the index, IP version type and
21373  * zoneid.
21374  */
21375 ipif_t *
21376 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
21377     queue_t *q, mblk_t *mp, ipsq_func_t func, int *err)
21378 {
21379 	ill_t	*ill;
21380 	ipsq_t  *ipsq;
21381 	phyint_t *phyi;
21382 	ipif_t	*ipif;
21383 
21384 	ASSERT((q == NULL && mp == NULL && func == NULL && err == NULL) ||
21385 	    (q != NULL && mp != NULL && func != NULL && err != NULL));
21386 
21387 	if (err != NULL)
21388 		*err = 0;
21389 
21390 	/*
21391 	 * Indexes are stored in the phyint - a common structure
21392 	 * to both IPv4 and IPv6.
21393 	 */
21394 
21395 	rw_enter(&ill_g_lock, RW_READER);
21396 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_index,
21397 	    (void *) &index, NULL);
21398 	if (phyi != NULL) {
21399 		ill = isv6 ? phyi->phyint_illv6 : phyi->phyint_illv4;
21400 		if (ill == NULL) {
21401 			rw_exit(&ill_g_lock);
21402 			if (err != NULL)
21403 				*err = ENXIO;
21404 			return (NULL);
21405 		}
21406 		GRAB_CONN_LOCK(q);
21407 		mutex_enter(&ill->ill_lock);
21408 		if (ILL_CAN_LOOKUP(ill)) {
21409 			for (ipif = ill->ill_ipif; ipif != NULL;
21410 			    ipif = ipif->ipif_next) {
21411 				if (IPIF_CAN_LOOKUP(ipif) &&
21412 				    (zoneid == ALL_ZONES ||
21413 				    zoneid == ipif->ipif_zoneid ||
21414 				    ipif->ipif_zoneid == ALL_ZONES)) {
21415 					ipif_refhold_locked(ipif);
21416 					mutex_exit(&ill->ill_lock);
21417 					RELEASE_CONN_LOCK(q);
21418 					rw_exit(&ill_g_lock);
21419 					return (ipif);
21420 				}
21421 			}
21422 		} else if (ILL_CAN_WAIT(ill, q)) {
21423 			ipsq = ill->ill_phyint->phyint_ipsq;
21424 			mutex_enter(&ipsq->ipsq_lock);
21425 			rw_exit(&ill_g_lock);
21426 			mutex_exit(&ill->ill_lock);
21427 			ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
21428 			mutex_exit(&ipsq->ipsq_lock);
21429 			RELEASE_CONN_LOCK(q);
21430 			*err = EINPROGRESS;
21431 			return (NULL);
21432 		}
21433 		mutex_exit(&ill->ill_lock);
21434 		RELEASE_CONN_LOCK(q);
21435 	}
21436 	rw_exit(&ill_g_lock);
21437 	if (err != NULL)
21438 		*err = ENXIO;
21439 	return (NULL);
21440 }
21441 
21442 typedef struct conn_change_s {
21443 	uint_t cc_old_ifindex;
21444 	uint_t cc_new_ifindex;
21445 } conn_change_t;
21446 
21447 /*
21448  * ipcl_walk function for changing interface index.
21449  */
21450 static void
21451 conn_change_ifindex(conn_t *connp, caddr_t arg)
21452 {
21453 	conn_change_t *connc;
21454 	uint_t old_ifindex;
21455 	uint_t new_ifindex;
21456 	int i;
21457 	ilg_t *ilg;
21458 
21459 	connc = (conn_change_t *)arg;
21460 	old_ifindex = connc->cc_old_ifindex;
21461 	new_ifindex = connc->cc_new_ifindex;
21462 
21463 	if (connp->conn_orig_bound_ifindex == old_ifindex)
21464 		connp->conn_orig_bound_ifindex = new_ifindex;
21465 
21466 	if (connp->conn_orig_multicast_ifindex == old_ifindex)
21467 		connp->conn_orig_multicast_ifindex = new_ifindex;
21468 
21469 	if (connp->conn_orig_xmit_ifindex == old_ifindex)
21470 		connp->conn_orig_xmit_ifindex = new_ifindex;
21471 
21472 	for (i = connp->conn_ilg_inuse - 1; i >= 0; i--) {
21473 		ilg = &connp->conn_ilg[i];
21474 		if (ilg->ilg_orig_ifindex == old_ifindex)
21475 			ilg->ilg_orig_ifindex = new_ifindex;
21476 	}
21477 }
21478 
21479 /*
21480  * Walk all the ipifs and ilms on this ill and change the orig_ifindex
21481  * to new_index if it matches the old_index.
21482  *
21483  * Failovers typically happen within a group of ills. But somebody
21484  * can remove an ill from the group after a failover happened. If
21485  * we are setting the ifindex after this, we potentially need to
21486  * look at all the ills rather than just the ones in the group.
21487  * We cut down the work by looking at matching ill_net_types
21488  * and ill_types as we could not possibly grouped them together.
21489  */
21490 static void
21491 ip_change_ifindex(ill_t *ill_orig, conn_change_t *connc)
21492 {
21493 	ill_t *ill;
21494 	ipif_t *ipif;
21495 	uint_t old_ifindex;
21496 	uint_t new_ifindex;
21497 	ilm_t *ilm;
21498 	ill_walk_context_t ctx;
21499 
21500 	old_ifindex = connc->cc_old_ifindex;
21501 	new_ifindex = connc->cc_new_ifindex;
21502 
21503 	rw_enter(&ill_g_lock, RW_READER);
21504 	ill = ILL_START_WALK_ALL(&ctx);
21505 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
21506 		if ((ill_orig->ill_net_type != ill->ill_net_type) ||
21507 			(ill_orig->ill_type != ill->ill_type)) {
21508 			continue;
21509 		}
21510 		for (ipif = ill->ill_ipif; ipif != NULL;
21511 				ipif = ipif->ipif_next) {
21512 			if (ipif->ipif_orig_ifindex == old_ifindex)
21513 				ipif->ipif_orig_ifindex = new_ifindex;
21514 		}
21515 		for (ilm = ill->ill_ilm; ilm != NULL; ilm = ilm->ilm_next) {
21516 			if (ilm->ilm_orig_ifindex == old_ifindex)
21517 				ilm->ilm_orig_ifindex = new_ifindex;
21518 		}
21519 	}
21520 	rw_exit(&ill_g_lock);
21521 }
21522 
21523 /*
21524  * We first need to ensure that the new index is unique, and
21525  * then carry the change across both v4 and v6 ill representation
21526  * of the physical interface.
21527  */
21528 /* ARGSUSED */
21529 int
21530 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21531     ip_ioctl_cmd_t *ipip, void *ifreq)
21532 {
21533 	ill_t		*ill;
21534 	ill_t		*ill_other;
21535 	phyint_t	*phyi;
21536 	int		old_index;
21537 	conn_change_t	connc;
21538 	struct ifreq	*ifr = (struct ifreq *)ifreq;
21539 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21540 	uint_t	index;
21541 	ill_t	*ill_v4;
21542 	ill_t	*ill_v6;
21543 
21544 	if (ipip->ipi_cmd_type == IF_CMD)
21545 		index = ifr->ifr_index;
21546 	else
21547 		index = lifr->lifr_index;
21548 
21549 	/*
21550 	 * Only allow on physical interface. Also, index zero is illegal.
21551 	 *
21552 	 * Need to check for PHYI_FAILED and PHYI_INACTIVE
21553 	 *
21554 	 * 1) If PHYI_FAILED is set, a failover could have happened which
21555 	 *    implies a possible failback might have to happen. As failback
21556 	 *    depends on the old index, we should fail setting the index.
21557 	 *
21558 	 * 2) If PHYI_INACTIVE is set, in.mpathd does a failover so that
21559 	 *    any addresses or multicast memberships are failed over to
21560 	 *    a non-STANDBY interface. As failback depends on the old
21561 	 *    index, we should fail setting the index for this case also.
21562 	 *
21563 	 * 3) If PHYI_OFFLINE is set, a possible failover has happened.
21564 	 *    Be consistent with PHYI_FAILED and fail the ioctl.
21565 	 */
21566 	ill = ipif->ipif_ill;
21567 	phyi = ill->ill_phyint;
21568 	if ((phyi->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE|PHYI_OFFLINE)) ||
21569 	    ipif->ipif_id != 0 || index == 0) {
21570 		return (EINVAL);
21571 	}
21572 	old_index = phyi->phyint_ifindex;
21573 
21574 	/* If the index is not changing, no work to do */
21575 	if (old_index == index)
21576 		return (0);
21577 
21578 	/*
21579 	 * Use ill_lookup_on_ifindex to determine if the
21580 	 * new index is unused and if so allow the change.
21581 	 */
21582 	ill_v6 = ill_lookup_on_ifindex(index, B_TRUE, NULL, NULL, NULL, NULL);
21583 	ill_v4 = ill_lookup_on_ifindex(index, B_FALSE, NULL, NULL, NULL, NULL);
21584 	if (ill_v6 != NULL || ill_v4 != NULL) {
21585 		if (ill_v4 != NULL)
21586 			ill_refrele(ill_v4);
21587 		if (ill_v6 != NULL)
21588 			ill_refrele(ill_v6);
21589 		return (EBUSY);
21590 	}
21591 
21592 	/*
21593 	 * The new index is unused. Set it in the phyint.
21594 	 * Locate the other ill so that we can send a routing
21595 	 * sockets message.
21596 	 */
21597 	if (ill->ill_isv6) {
21598 		ill_other = phyi->phyint_illv4;
21599 	} else {
21600 		ill_other = phyi->phyint_illv6;
21601 	}
21602 
21603 	phyi->phyint_ifindex = index;
21604 
21605 	connc.cc_old_ifindex = old_index;
21606 	connc.cc_new_ifindex = index;
21607 	ip_change_ifindex(ill, &connc);
21608 	ipcl_walk(conn_change_ifindex, (caddr_t)&connc);
21609 
21610 	/* Send the routing sockets message */
21611 	ip_rts_ifmsg(ipif);
21612 	if (ill_other != NULL)
21613 		ip_rts_ifmsg(ill_other->ill_ipif);
21614 
21615 	return (0);
21616 }
21617 
21618 /* ARGSUSED */
21619 int
21620 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21621     ip_ioctl_cmd_t *ipip, void *ifreq)
21622 {
21623 	struct ifreq	*ifr = (struct ifreq *)ifreq;
21624 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21625 
21626 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
21627 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21628 	/* Get the interface index */
21629 	if (ipip->ipi_cmd_type == IF_CMD) {
21630 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
21631 	} else {
21632 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
21633 	}
21634 	return (0);
21635 }
21636 
21637 /* ARGSUSED */
21638 int
21639 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21640     ip_ioctl_cmd_t *ipip, void *ifreq)
21641 {
21642 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21643 
21644 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
21645 		ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21646 	/* Get the interface zone */
21647 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21648 	lifr->lifr_zoneid = ipif->ipif_zoneid;
21649 	return (0);
21650 }
21651 
21652 /*
21653  * Set the zoneid of an interface.
21654  */
21655 /* ARGSUSED */
21656 int
21657 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21658     ip_ioctl_cmd_t *ipip, void *ifreq)
21659 {
21660 	struct lifreq	*lifr = (struct lifreq *)ifreq;
21661 	int err = 0;
21662 	boolean_t need_up = B_FALSE;
21663 	zone_t *zptr;
21664 	zone_status_t status;
21665 	zoneid_t zoneid;
21666 
21667 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21668 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
21669 		if (!is_system_labeled())
21670 			return (ENOTSUP);
21671 		zoneid = GLOBAL_ZONEID;
21672 	}
21673 
21674 	/* cannot assign instance zero to a non-global zone */
21675 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
21676 		return (ENOTSUP);
21677 
21678 	/*
21679 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
21680 	 * the event of a race with the zone shutdown processing, since IP
21681 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
21682 	 * interface will be cleaned up even if the zone is shut down
21683 	 * immediately after the status check. If the interface can't be brought
21684 	 * down right away, and the zone is shut down before the restart
21685 	 * function is called, we resolve the possible races by rechecking the
21686 	 * zone status in the restart function.
21687 	 */
21688 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
21689 		return (EINVAL);
21690 	status = zone_status_get(zptr);
21691 	zone_rele(zptr);
21692 
21693 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
21694 		return (EINVAL);
21695 
21696 	if (ipif->ipif_flags & IPIF_UP) {
21697 		/*
21698 		 * If the interface is already marked up,
21699 		 * we call ipif_down which will take care
21700 		 * of ditching any IREs that have been set
21701 		 * up based on the old interface address.
21702 		 */
21703 		err = ipif_logical_down(ipif, q, mp);
21704 		if (err == EINPROGRESS)
21705 			return (err);
21706 		ipif_down_tail(ipif);
21707 		need_up = B_TRUE;
21708 	}
21709 
21710 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
21711 	return (err);
21712 }
21713 
21714 static int
21715 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
21716     queue_t *q, mblk_t *mp, boolean_t need_up)
21717 {
21718 	int	err = 0;
21719 
21720 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
21721 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21722 
21723 	/* Set the new zone id. */
21724 	ipif->ipif_zoneid = zoneid;
21725 
21726 	/* Update sctp list */
21727 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
21728 
21729 	if (need_up) {
21730 		/*
21731 		 * Now bring the interface back up.  If this
21732 		 * is the only IPIF for the ILL, ipif_up
21733 		 * will have to re-bind to the device, so
21734 		 * we may get back EINPROGRESS, in which
21735 		 * case, this IOCTL will get completed in
21736 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
21737 		 */
21738 		err = ipif_up(ipif, q, mp);
21739 	}
21740 	return (err);
21741 }
21742 
21743 /* ARGSUSED */
21744 int
21745 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21746     ip_ioctl_cmd_t *ipip, void *if_req)
21747 {
21748 	struct lifreq *lifr = (struct lifreq *)if_req;
21749 	zoneid_t zoneid;
21750 	zone_t *zptr;
21751 	zone_status_t status;
21752 
21753 	ASSERT(ipif->ipif_id != 0);
21754 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
21755 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
21756 		zoneid = GLOBAL_ZONEID;
21757 
21758 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
21759 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21760 
21761 	/*
21762 	 * We recheck the zone status to resolve the following race condition:
21763 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
21764 	 * 2) hme0:1 is up and can't be brought down right away;
21765 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
21766 	 * 3) zone "myzone" is halted; the zone status switches to
21767 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
21768 	 * the interfaces to remove - hme0:1 is not returned because it's not
21769 	 * yet in "myzone", so it won't be removed;
21770 	 * 4) the restart function for SIOCSLIFZONE is called; without the
21771 	 * status check here, we would have hme0:1 in "myzone" after it's been
21772 	 * destroyed.
21773 	 * Note that if the status check fails, we need to bring the interface
21774 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
21775 	 * ipif_up_done[_v6]().
21776 	 */
21777 	status = ZONE_IS_UNINITIALIZED;
21778 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
21779 		status = zone_status_get(zptr);
21780 		zone_rele(zptr);
21781 	}
21782 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
21783 		if (ipif->ipif_isv6) {
21784 			(void) ipif_up_done_v6(ipif);
21785 		} else {
21786 			(void) ipif_up_done(ipif);
21787 		}
21788 		return (EINVAL);
21789 	}
21790 
21791 	ipif_down_tail(ipif);
21792 
21793 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
21794 	    B_TRUE));
21795 }
21796 
21797 /* ARGSUSED */
21798 int
21799 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21800 	ip_ioctl_cmd_t *ipip, void *ifreq)
21801 {
21802 	struct lifreq	*lifr = ifreq;
21803 
21804 	ASSERT(q->q_next == NULL);
21805 	ASSERT(CONN_Q(q));
21806 
21807 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
21808 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
21809 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
21810 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
21811 
21812 	return (0);
21813 }
21814 
21815 
21816 /* Find the previous ILL in this usesrc group */
21817 static ill_t *
21818 ill_prev_usesrc(ill_t *uill)
21819 {
21820 	ill_t *ill;
21821 
21822 	for (ill = uill->ill_usesrc_grp_next;
21823 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
21824 	    ill = ill->ill_usesrc_grp_next)
21825 		/* do nothing */;
21826 	return (ill);
21827 }
21828 
21829 /*
21830  * Release all members of the usesrc group. This routine is called
21831  * from ill_delete when the interface being unplumbed is the
21832  * group head.
21833  */
21834 static void
21835 ill_disband_usesrc_group(ill_t *uill)
21836 {
21837 	ill_t *next_ill, *tmp_ill;
21838 	ASSERT(RW_WRITE_HELD(&ill_g_usesrc_lock));
21839 	next_ill = uill->ill_usesrc_grp_next;
21840 
21841 	do {
21842 		ASSERT(next_ill != NULL);
21843 		tmp_ill = next_ill->ill_usesrc_grp_next;
21844 		ASSERT(tmp_ill != NULL);
21845 		next_ill->ill_usesrc_grp_next = NULL;
21846 		next_ill->ill_usesrc_ifindex = 0;
21847 		next_ill = tmp_ill;
21848 	} while (next_ill->ill_usesrc_ifindex != 0);
21849 	uill->ill_usesrc_grp_next = NULL;
21850 }
21851 
21852 /*
21853  * Remove the client usesrc ILL from the list and relink to a new list
21854  */
21855 int
21856 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
21857 {
21858 	ill_t *ill, *tmp_ill;
21859 
21860 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
21861 	    (uill != NULL) && RW_WRITE_HELD(&ill_g_usesrc_lock));
21862 
21863 	/*
21864 	 * Check if the usesrc client ILL passed in is not already
21865 	 * in use as a usesrc ILL i.e one whose source address is
21866 	 * in use OR a usesrc ILL is not already in use as a usesrc
21867 	 * client ILL
21868 	 */
21869 	if ((ucill->ill_usesrc_ifindex == 0) ||
21870 	    (uill->ill_usesrc_ifindex != 0)) {
21871 		return (-1);
21872 	}
21873 
21874 	ill = ill_prev_usesrc(ucill);
21875 	ASSERT(ill->ill_usesrc_grp_next != NULL);
21876 
21877 	/* Remove from the current list */
21878 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
21879 		/* Only two elements in the list */
21880 		ASSERT(ill->ill_usesrc_ifindex == 0);
21881 		ill->ill_usesrc_grp_next = NULL;
21882 	} else {
21883 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
21884 	}
21885 
21886 	if (ifindex == 0) {
21887 		ucill->ill_usesrc_ifindex = 0;
21888 		ucill->ill_usesrc_grp_next = NULL;
21889 		return (0);
21890 	}
21891 
21892 	ucill->ill_usesrc_ifindex = ifindex;
21893 	tmp_ill = uill->ill_usesrc_grp_next;
21894 	uill->ill_usesrc_grp_next = ucill;
21895 	ucill->ill_usesrc_grp_next =
21896 	    (tmp_ill != NULL) ? tmp_ill : uill;
21897 	return (0);
21898 }
21899 
21900 /*
21901  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
21902  * ip.c for locking details.
21903  */
21904 /* ARGSUSED */
21905 int
21906 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
21907     ip_ioctl_cmd_t *ipip, void *ifreq)
21908 {
21909 	struct lifreq *lifr = (struct lifreq *)ifreq;
21910 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE,
21911 	    ill_flag_changed = B_FALSE;
21912 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
21913 	int err = 0, ret;
21914 	uint_t ifindex;
21915 	phyint_t *us_phyint, *us_cli_phyint;
21916 	ipsq_t *ipsq = NULL;
21917 
21918 	ASSERT(IAM_WRITER_IPIF(ipif));
21919 	ASSERT(q->q_next == NULL);
21920 	ASSERT(CONN_Q(q));
21921 
21922 	isv6 = (Q_TO_CONN(q))->conn_af_isv6;
21923 	us_cli_phyint = usesrc_cli_ill->ill_phyint;
21924 
21925 	ASSERT(us_cli_phyint != NULL);
21926 
21927 	/*
21928 	 * If the client ILL is being used for IPMP, abort.
21929 	 * Note, this can be done before ipsq_try_enter since we are already
21930 	 * exclusive on this ILL
21931 	 */
21932 	if ((us_cli_phyint->phyint_groupname != NULL) ||
21933 	    (us_cli_phyint->phyint_flags & PHYI_STANDBY)) {
21934 		return (EINVAL);
21935 	}
21936 
21937 	ifindex = lifr->lifr_index;
21938 	if (ifindex == 0) {
21939 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
21940 			/* non usesrc group interface, nothing to reset */
21941 			return (0);
21942 		}
21943 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
21944 		/* valid reset request */
21945 		reset_flg = B_TRUE;
21946 	}
21947 
21948 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, q, mp,
21949 	    ip_process_ioctl, &err);
21950 
21951 	if (usesrc_ill == NULL) {
21952 		return (err);
21953 	}
21954 
21955 	/*
21956 	 * The usesrc_cli_ill or the usesrc_ill cannot be part of an IPMP
21957 	 * group nor can either of the interfaces be used for standy. So
21958 	 * to guarantee mutual exclusion with ip_sioctl_flags (which sets
21959 	 * PHYI_STANDBY) and ip_sioctl_groupname (which sets the groupname)
21960 	 * we need to be exclusive on the ipsq belonging to the usesrc_ill.
21961 	 * We are already exlusive on this ipsq i.e ipsq corresponding to
21962 	 * the usesrc_cli_ill
21963 	 */
21964 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
21965 	    NEW_OP, B_TRUE);
21966 	if (ipsq == NULL) {
21967 		err = EINPROGRESS;
21968 		/* Operation enqueued on the ipsq of the usesrc ILL */
21969 		goto done;
21970 	}
21971 
21972 	/* Check if the usesrc_ill is used for IPMP */
21973 	us_phyint = usesrc_ill->ill_phyint;
21974 	if ((us_phyint->phyint_groupname != NULL) ||
21975 	    (us_phyint->phyint_flags & PHYI_STANDBY)) {
21976 		err = EINVAL;
21977 		goto done;
21978 	}
21979 
21980 	/*
21981 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
21982 	 * already a client then return EINVAL
21983 	 */
21984 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
21985 		err = EINVAL;
21986 		goto done;
21987 	}
21988 
21989 	/*
21990 	 * If the ill_usesrc_ifindex field is already set to what it needs to
21991 	 * be then this is a duplicate operation.
21992 	 */
21993 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
21994 		err = 0;
21995 		goto done;
21996 	}
21997 
21998 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
21999 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
22000 	    usesrc_ill->ill_isv6));
22001 
22002 	/*
22003 	 * The next step ensures that no new ires will be created referencing
22004 	 * the client ill, until the ILL_CHANGING flag is cleared. Then
22005 	 * we go through an ire walk deleting all ire caches that reference
22006 	 * the client ill. New ires referencing the client ill that are added
22007 	 * to the ire table before the ILL_CHANGING flag is set, will be
22008 	 * cleaned up by the ire walk below. Attempt to add new ires referencing
22009 	 * the client ill while the ILL_CHANGING flag is set will be failed
22010 	 * during the ire_add in ire_atomic_start. ire_atomic_start atomically
22011 	 * checks (under the ill_g_usesrc_lock) that the ire being added
22012 	 * is not stale, i.e the ire_stq and ire_ipif are consistent and
22013 	 * belong to the same usesrc group.
22014 	 */
22015 	mutex_enter(&usesrc_cli_ill->ill_lock);
22016 	usesrc_cli_ill->ill_state_flags |= ILL_CHANGING;
22017 	mutex_exit(&usesrc_cli_ill->ill_lock);
22018 	ill_flag_changed = B_TRUE;
22019 
22020 	if (ipif->ipif_isv6)
22021 		ire_walk_v6(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
22022 		    ALL_ZONES);
22023 	else
22024 		ire_walk_v4(ipif_delete_cache_ire, (char *)usesrc_cli_ill,
22025 		    ALL_ZONES);
22026 
22027 	/*
22028 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
22029 	 * and the ill_usesrc_ifindex fields
22030 	 */
22031 	rw_enter(&ill_g_usesrc_lock, RW_WRITER);
22032 
22033 	if (reset_flg) {
22034 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
22035 		if (ret != 0) {
22036 			err = EINVAL;
22037 		}
22038 		rw_exit(&ill_g_usesrc_lock);
22039 		goto done;
22040 	}
22041 
22042 	/*
22043 	 * Four possibilities to consider:
22044 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
22045 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
22046 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
22047 	 * 4. Both are part of their respective usesrc groups
22048 	 */
22049 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
22050 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
22051 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
22052 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
22053 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
22054 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
22055 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
22056 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
22057 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
22058 		/* Insert at head of list */
22059 		usesrc_cli_ill->ill_usesrc_grp_next =
22060 		    usesrc_ill->ill_usesrc_grp_next;
22061 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
22062 	} else {
22063 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
22064 		    ifindex);
22065 		if (ret != 0)
22066 			err = EINVAL;
22067 	}
22068 	rw_exit(&ill_g_usesrc_lock);
22069 
22070 done:
22071 	if (ill_flag_changed) {
22072 		mutex_enter(&usesrc_cli_ill->ill_lock);
22073 		usesrc_cli_ill->ill_state_flags &= ~ILL_CHANGING;
22074 		mutex_exit(&usesrc_cli_ill->ill_lock);
22075 	}
22076 	if (ipsq != NULL)
22077 		ipsq_exit(ipsq, B_TRUE, B_TRUE);
22078 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
22079 	ill_refrele(usesrc_ill);
22080 	return (err);
22081 }
22082 
22083 /*
22084  * comparison function used by avl.
22085  */
22086 static int
22087 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
22088 {
22089 
22090 	uint_t index;
22091 
22092 	ASSERT(phyip != NULL && index_ptr != NULL);
22093 
22094 	index = *((uint_t *)index_ptr);
22095 	/*
22096 	 * let the phyint with the lowest index be on top.
22097 	 */
22098 	if (((phyint_t *)phyip)->phyint_ifindex < index)
22099 		return (1);
22100 	if (((phyint_t *)phyip)->phyint_ifindex > index)
22101 		return (-1);
22102 	return (0);
22103 }
22104 
22105 /*
22106  * comparison function used by avl.
22107  */
22108 static int
22109 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
22110 {
22111 	ill_t *ill;
22112 	int res = 0;
22113 
22114 	ASSERT(phyip != NULL && name_ptr != NULL);
22115 
22116 	if (((phyint_t *)phyip)->phyint_illv4)
22117 		ill = ((phyint_t *)phyip)->phyint_illv4;
22118 	else
22119 		ill = ((phyint_t *)phyip)->phyint_illv6;
22120 	ASSERT(ill != NULL);
22121 
22122 	res = strcmp(ill->ill_name, (char *)name_ptr);
22123 	if (res > 0)
22124 		return (1);
22125 	else if (res < 0)
22126 		return (-1);
22127 	return (0);
22128 }
22129 /*
22130  * This function is called from ill_delete when the ill is being
22131  * unplumbed. We remove the reference from the phyint and we also
22132  * free the phyint when there are no more references to it.
22133  */
22134 static void
22135 ill_phyint_free(ill_t *ill)
22136 {
22137 	phyint_t *phyi;
22138 	phyint_t *next_phyint;
22139 	ipsq_t *cur_ipsq;
22140 
22141 	ASSERT(ill->ill_phyint != NULL);
22142 
22143 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
22144 	phyi = ill->ill_phyint;
22145 	ill->ill_phyint = NULL;
22146 	/*
22147 	 * ill_init allocates a phyint always to store the copy
22148 	 * of flags relevant to phyint. At that point in time, we could
22149 	 * not assign the name and hence phyint_illv4/v6 could not be
22150 	 * initialized. Later in ipif_set_values, we assign the name to
22151 	 * the ill, at which point in time we assign phyint_illv4/v6.
22152 	 * Thus we don't rely on phyint_illv6 to be initialized always.
22153 	 */
22154 	if (ill->ill_flags & ILLF_IPV6) {
22155 		phyi->phyint_illv6 = NULL;
22156 	} else {
22157 		phyi->phyint_illv4 = NULL;
22158 	}
22159 	/*
22160 	 * ipif_down removes it from the group when the last ipif goes
22161 	 * down.
22162 	 */
22163 	ASSERT(ill->ill_group == NULL);
22164 
22165 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL)
22166 		return;
22167 
22168 	/*
22169 	 * Make sure this phyint was put in the list.
22170 	 */
22171 	if (phyi->phyint_ifindex > 0) {
22172 		avl_remove(&phyint_g_list.phyint_list_avl_by_index,
22173 		    phyi);
22174 		avl_remove(&phyint_g_list.phyint_list_avl_by_name,
22175 		    phyi);
22176 	}
22177 	/*
22178 	 * remove phyint from the ipsq list.
22179 	 */
22180 	cur_ipsq = phyi->phyint_ipsq;
22181 	if (phyi == cur_ipsq->ipsq_phyint_list) {
22182 		cur_ipsq->ipsq_phyint_list = phyi->phyint_ipsq_next;
22183 	} else {
22184 		next_phyint = cur_ipsq->ipsq_phyint_list;
22185 		while (next_phyint != NULL) {
22186 			if (next_phyint->phyint_ipsq_next == phyi) {
22187 				next_phyint->phyint_ipsq_next =
22188 					phyi->phyint_ipsq_next;
22189 				break;
22190 			}
22191 			next_phyint = next_phyint->phyint_ipsq_next;
22192 		}
22193 		ASSERT(next_phyint != NULL);
22194 	}
22195 	IPSQ_DEC_REF(cur_ipsq);
22196 
22197 	if (phyi->phyint_groupname_len != 0) {
22198 		ASSERT(phyi->phyint_groupname != NULL);
22199 		mi_free(phyi->phyint_groupname);
22200 	}
22201 	mi_free(phyi);
22202 }
22203 
22204 /*
22205  * Attach the ill to the phyint structure which can be shared by both
22206  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
22207  * function is called from ipif_set_values and ill_lookup_on_name (for
22208  * loopback) where we know the name of the ill. We lookup the ill and if
22209  * there is one present already with the name use that phyint. Otherwise
22210  * reuse the one allocated by ill_init.
22211  */
22212 static void
22213 ill_phyint_reinit(ill_t *ill)
22214 {
22215 	boolean_t isv6 = ill->ill_isv6;
22216 	phyint_t *phyi_old;
22217 	phyint_t *phyi;
22218 	avl_index_t where = 0;
22219 	ill_t	*ill_other = NULL;
22220 	ipsq_t	*ipsq;
22221 
22222 	ASSERT(RW_WRITE_HELD(&ill_g_lock));
22223 
22224 	phyi_old = ill->ill_phyint;
22225 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
22226 	    phyi_old->phyint_illv6 == NULL));
22227 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
22228 	    phyi_old->phyint_illv4 == NULL));
22229 	ASSERT(phyi_old->phyint_ifindex == 0);
22230 
22231 	phyi = avl_find(&phyint_g_list.phyint_list_avl_by_name,
22232 	    ill->ill_name, &where);
22233 
22234 	/*
22235 	 * 1. We grabbed the ill_g_lock before inserting this ill into
22236 	 *    the global list of ills. So no other thread could have located
22237 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
22238 	 * 2. Now locate the other protocol instance of this ill.
22239 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
22240 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
22241 	 *    of neither ill can change.
22242 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
22243 	 *    other ill.
22244 	 * 5. Release all locks.
22245 	 */
22246 
22247 	/*
22248 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
22249 	 * we are initializing IPv4.
22250 	 */
22251 	if (phyi != NULL) {
22252 		ill_other = (isv6) ? phyi->phyint_illv4 :
22253 		    phyi->phyint_illv6;
22254 		ASSERT(ill_other->ill_phyint != NULL);
22255 		ASSERT((isv6 && !ill_other->ill_isv6) ||
22256 		    (!isv6 && ill_other->ill_isv6));
22257 		GRAB_ILL_LOCKS(ill, ill_other);
22258 		/*
22259 		 * We are potentially throwing away phyint_flags which
22260 		 * could be different from the one that we obtain from
22261 		 * ill_other->ill_phyint. But it is okay as we are assuming
22262 		 * that the state maintained within IP is correct.
22263 		 */
22264 		mutex_enter(&phyi->phyint_lock);
22265 		if (isv6) {
22266 			ASSERT(phyi->phyint_illv6 == NULL);
22267 			phyi->phyint_illv6 = ill;
22268 		} else {
22269 			ASSERT(phyi->phyint_illv4 == NULL);
22270 			phyi->phyint_illv4 = ill;
22271 		}
22272 		/*
22273 		 * This is a new ill, currently undergoing SLIFNAME
22274 		 * So we could not have joined an IPMP group until now.
22275 		 */
22276 		ASSERT(phyi_old->phyint_ipsq_next == NULL &&
22277 		    phyi_old->phyint_groupname == NULL);
22278 
22279 		/*
22280 		 * This phyi_old is going away. Decref ipsq_refs and
22281 		 * assert it is zero. The ipsq itself will be freed in
22282 		 * ipsq_exit
22283 		 */
22284 		ipsq = phyi_old->phyint_ipsq;
22285 		IPSQ_DEC_REF(ipsq);
22286 		ASSERT(ipsq->ipsq_refs == 0);
22287 		/* Get the singleton phyint out of the ipsq list */
22288 		ASSERT(phyi_old->phyint_ipsq_next == NULL);
22289 		ipsq->ipsq_phyint_list = NULL;
22290 		phyi_old->phyint_illv4 = NULL;
22291 		phyi_old->phyint_illv6 = NULL;
22292 		mi_free(phyi_old);
22293 	} else {
22294 		mutex_enter(&ill->ill_lock);
22295 		/*
22296 		 * We don't need to acquire any lock, since
22297 		 * the ill is not yet visible globally  and we
22298 		 * have not yet released the ill_g_lock.
22299 		 */
22300 		phyi = phyi_old;
22301 		mutex_enter(&phyi->phyint_lock);
22302 		/* XXX We need a recovery strategy here. */
22303 		if (!phyint_assign_ifindex(phyi))
22304 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
22305 
22306 		avl_insert(&phyint_g_list.phyint_list_avl_by_name,
22307 		    (void *)phyi, where);
22308 
22309 		(void) avl_find(&phyint_g_list.phyint_list_avl_by_index,
22310 		    &phyi->phyint_ifindex, &where);
22311 		avl_insert(&phyint_g_list.phyint_list_avl_by_index,
22312 		    (void *)phyi, where);
22313 	}
22314 
22315 	/*
22316 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
22317 	 * pending mp is not affected because that is per ill basis.
22318 	 */
22319 	ill->ill_phyint = phyi;
22320 
22321 	/*
22322 	 * Keep the index on ipif_orig_index to be used by FAILOVER.
22323 	 * We do this here as when the first ipif was allocated,
22324 	 * ipif_allocate does not know the right interface index.
22325 	 */
22326 
22327 	ill->ill_ipif->ipif_orig_ifindex = ill->ill_phyint->phyint_ifindex;
22328 	/*
22329 	 * Now that the phyint's ifindex has been assigned, complete the
22330 	 * remaining
22331 	 */
22332 	if (ill->ill_isv6) {
22333 		ill->ill_ip6_mib->ipv6IfIndex =
22334 		    ill->ill_phyint->phyint_ifindex;
22335 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
22336 		    ill->ill_phyint->phyint_ifindex;
22337 	}
22338 
22339 	/*
22340 	 * Generate an event within the hooks framework to indicate that
22341 	 * a new interface has just been added to IP.  For this event to
22342 	 * be generated, the network interface must, at least, have an
22343 	 * ifindex assigned to it.
22344 	 *
22345 	 * This needs to be run inside the ill_g_lock perimeter to ensure
22346 	 * that the ordering of delivered events to listeners matches the
22347 	 * order of them in the kernel.
22348 	 *
22349 	 * This function could be called from ill_lookup_on_name. In that case
22350 	 * the interface is loopback "lo", which will not generate a NIC event.
22351 	 */
22352 	if (ill->ill_name_length <= 2 ||
22353 	    ill->ill_name[0] != 'l' || ill->ill_name[1] != 'o') {
22354 		hook_nic_event_t *info;
22355 		if ((info = ill->ill_nic_event_info) != NULL) {
22356 			ip2dbg(("ill_phyint_reinit: unexpected nic event %d "
22357 			    "attached for %s\n", info->hne_event,
22358 			    ill->ill_name));
22359 			if (info->hne_data != NULL)
22360 				kmem_free(info->hne_data, info->hne_datalen);
22361 			kmem_free(info, sizeof (hook_nic_event_t));
22362 		}
22363 
22364 		info = kmem_alloc(sizeof (hook_nic_event_t), KM_NOSLEEP);
22365 		if (info != NULL) {
22366 			info->hne_nic = ill->ill_phyint->phyint_ifindex;
22367 			info->hne_lif = 0;
22368 			info->hne_event = NE_PLUMB;
22369 			info->hne_family = ill->ill_isv6 ? ipv6 : ipv4;
22370 			info->hne_data = kmem_alloc(ill->ill_name_length,
22371 			    KM_NOSLEEP);
22372 			if (info->hne_data != NULL) {
22373 				info->hne_datalen = ill->ill_name_length;
22374 				bcopy(ill->ill_name, info->hne_data,
22375 				    info->hne_datalen);
22376 			} else {
22377 				ip2dbg(("ill_phyint_reinit: could not attach "
22378 				    "ill_name information for PLUMB nic event "
22379 				    "of %s (ENOMEM)\n", ill->ill_name));
22380 				kmem_free(info, sizeof (hook_nic_event_t));
22381 			}
22382 		} else
22383 			ip2dbg(("ill_phyint_reinit: could not attach PLUMB nic "
22384 			    "event information for %s (ENOMEM)\n",
22385 			    ill->ill_name));
22386 
22387 		ill->ill_nic_event_info = info;
22388 	}
22389 
22390 	RELEASE_ILL_LOCKS(ill, ill_other);
22391 	mutex_exit(&phyi->phyint_lock);
22392 }
22393 
22394 /*
22395  * Notify any downstream modules of the name of this interface.
22396  * An M_IOCTL is used even though we don't expect a successful reply.
22397  * Any reply message from the driver (presumably an M_IOCNAK) will
22398  * eventually get discarded somewhere upstream.  The message format is
22399  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
22400  * to IP.
22401  */
22402 static void
22403 ip_ifname_notify(ill_t *ill, queue_t *q)
22404 {
22405 	mblk_t *mp1, *mp2;
22406 	struct iocblk *iocp;
22407 	struct lifreq *lifr;
22408 
22409 	mp1 = mkiocb(SIOCSLIFNAME);
22410 	if (mp1 == NULL)
22411 		return;
22412 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
22413 	if (mp2 == NULL) {
22414 		freeb(mp1);
22415 		return;
22416 	}
22417 
22418 	mp1->b_cont = mp2;
22419 	iocp = (struct iocblk *)mp1->b_rptr;
22420 	iocp->ioc_count = sizeof (struct lifreq);
22421 
22422 	lifr = (struct lifreq *)mp2->b_rptr;
22423 	mp2->b_wptr += sizeof (struct lifreq);
22424 	bzero(lifr, sizeof (struct lifreq));
22425 
22426 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
22427 	lifr->lifr_ppa = ill->ill_ppa;
22428 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
22429 
22430 	putnext(q, mp1);
22431 }
22432 
22433 static boolean_t ip_trash_timer_started = B_FALSE;
22434 
22435 static int
22436 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
22437 {
22438 	int err;
22439 
22440 	/* Set the obsolete NDD per-interface forwarding name. */
22441 	err = ill_set_ndd_name(ill);
22442 	if (err != 0) {
22443 		cmn_err(CE_WARN, "ipif_set_values: ill_set_ndd_name (%d)\n",
22444 		    err);
22445 	}
22446 
22447 	/* Tell downstream modules where they are. */
22448 	ip_ifname_notify(ill, q);
22449 
22450 	/*
22451 	 * ill_dl_phys returns EINPROGRESS in the usual case.
22452 	 * Error cases are ENOMEM ...
22453 	 */
22454 	err = ill_dl_phys(ill, ipif, mp, q);
22455 
22456 	/*
22457 	 * If there is no IRE expiration timer running, get one started.
22458 	 * igmp and mld timers will be triggered by the first multicast
22459 	 */
22460 	if (!ip_trash_timer_started) {
22461 		/*
22462 		 * acquire the lock and check again.
22463 		 */
22464 		mutex_enter(&ip_trash_timer_lock);
22465 		if (!ip_trash_timer_started) {
22466 			ip_ire_expire_id = timeout(ip_trash_timer_expire, NULL,
22467 			    MSEC_TO_TICK(ip_timer_interval));
22468 			ip_trash_timer_started = B_TRUE;
22469 		}
22470 		mutex_exit(&ip_trash_timer_lock);
22471 	}
22472 
22473 	if (ill->ill_isv6) {
22474 		mutex_enter(&mld_slowtimeout_lock);
22475 		if (mld_slowtimeout_id == 0) {
22476 			mld_slowtimeout_id = timeout(mld_slowtimo, NULL,
22477 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
22478 		}
22479 		mutex_exit(&mld_slowtimeout_lock);
22480 	} else {
22481 		mutex_enter(&igmp_slowtimeout_lock);
22482 		if (igmp_slowtimeout_id == 0) {
22483 			igmp_slowtimeout_id = timeout(igmp_slowtimo, NULL,
22484 				MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
22485 		}
22486 		mutex_exit(&igmp_slowtimeout_lock);
22487 	}
22488 
22489 	return (err);
22490 }
22491 
22492 /*
22493  * Common routine for ppa and ifname setting. Should be called exclusive.
22494  *
22495  * Returns EINPROGRESS when mp has been consumed by queueing it on
22496  * ill_pending_mp and the ioctl will complete in ip_rput.
22497  *
22498  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
22499  * the new name and new ppa in lifr_name and lifr_ppa respectively.
22500  * For SLIFNAME, we pass these values back to the userland.
22501  */
22502 static int
22503 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
22504 {
22505 	ill_t	*ill;
22506 	ipif_t	*ipif;
22507 	ipsq_t	*ipsq;
22508 	char	*ppa_ptr;
22509 	char	*old_ptr;
22510 	char	old_char;
22511 	int	error;
22512 
22513 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
22514 	ASSERT(q->q_next != NULL);
22515 	ASSERT(interf_name != NULL);
22516 
22517 	ill = (ill_t *)q->q_ptr;
22518 
22519 	ASSERT(ill->ill_name[0] == '\0');
22520 	ASSERT(IAM_WRITER_ILL(ill));
22521 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
22522 	ASSERT(ill->ill_ppa == UINT_MAX);
22523 
22524 	/* The ppa is sent down by ifconfig or is chosen */
22525 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
22526 		return (EINVAL);
22527 	}
22528 
22529 	/*
22530 	 * make sure ppa passed in is same as ppa in the name.
22531 	 * This check is not made when ppa == UINT_MAX in that case ppa
22532 	 * in the name could be anything. System will choose a ppa and
22533 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
22534 	 */
22535 	if (*new_ppa_ptr != UINT_MAX) {
22536 		/* stoi changes the pointer */
22537 		old_ptr = ppa_ptr;
22538 		/*
22539 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
22540 		 * (they don't have an externally visible ppa).  We assign one
22541 		 * here so that we can manage the interface.  Note that in
22542 		 * the past this value was always 0 for DLPI 1 drivers.
22543 		 */
22544 		if (*new_ppa_ptr == 0)
22545 			*new_ppa_ptr = stoi(&old_ptr);
22546 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
22547 			return (EINVAL);
22548 	}
22549 	/*
22550 	 * terminate string before ppa
22551 	 * save char at that location.
22552 	 */
22553 	old_char = ppa_ptr[0];
22554 	ppa_ptr[0] = '\0';
22555 
22556 	ill->ill_ppa = *new_ppa_ptr;
22557 	/*
22558 	 * Finish as much work now as possible before calling ill_glist_insert
22559 	 * which makes the ill globally visible and also merges it with the
22560 	 * other protocol instance of this phyint. The remaining work is
22561 	 * done after entering the ipsq which may happen sometime later.
22562 	 * ill_set_ndd_name occurs after the ill has been made globally visible.
22563 	 */
22564 	ipif = ill->ill_ipif;
22565 
22566 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
22567 	ipif_assign_seqid(ipif);
22568 
22569 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
22570 		ill->ill_flags |= ILLF_IPV4;
22571 
22572 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
22573 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
22574 
22575 	if (ill->ill_flags & ILLF_IPV6) {
22576 
22577 		ill->ill_isv6 = B_TRUE;
22578 		if (ill->ill_rq != NULL) {
22579 			ill->ill_rq->q_qinfo = &rinit_ipv6;
22580 			ill->ill_wq->q_qinfo = &winit_ipv6;
22581 		}
22582 
22583 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
22584 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
22585 		ipif->ipif_v6src_addr = ipv6_all_zeros;
22586 		ipif->ipif_v6subnet = ipv6_all_zeros;
22587 		ipif->ipif_v6net_mask = ipv6_all_zeros;
22588 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
22589 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
22590 		/*
22591 		 * point-to-point or Non-mulicast capable
22592 		 * interfaces won't do NUD unless explicitly
22593 		 * configured to do so.
22594 		 */
22595 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
22596 		    !(ill->ill_flags & ILLF_MULTICAST)) {
22597 			ill->ill_flags |= ILLF_NONUD;
22598 		}
22599 		/* Make sure IPv4 specific flag is not set on IPv6 if */
22600 		if (ill->ill_flags & ILLF_NOARP) {
22601 			/*
22602 			 * Note: xresolv interfaces will eventually need
22603 			 * NOARP set here as well, but that will require
22604 			 * those external resolvers to have some
22605 			 * knowledge of that flag and act appropriately.
22606 			 * Not to be changed at present.
22607 			 */
22608 			ill->ill_flags &= ~ILLF_NOARP;
22609 		}
22610 		/*
22611 		 * Set the ILLF_ROUTER flag according to the global
22612 		 * IPv6 forwarding policy.
22613 		 */
22614 		if (ipv6_forward != 0)
22615 			ill->ill_flags |= ILLF_ROUTER;
22616 	} else if (ill->ill_flags & ILLF_IPV4) {
22617 		ill->ill_isv6 = B_FALSE;
22618 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
22619 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6src_addr);
22620 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
22621 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
22622 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
22623 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
22624 		/*
22625 		 * Set the ILLF_ROUTER flag according to the global
22626 		 * IPv4 forwarding policy.
22627 		 */
22628 		if (ip_g_forward != 0)
22629 			ill->ill_flags |= ILLF_ROUTER;
22630 	}
22631 
22632 	ASSERT(ill->ill_phyint != NULL);
22633 
22634 	/*
22635 	 * The ipv6Ifindex and ipv6IfIcmpIfIndex assignments will
22636 	 * be completed in ill_glist_insert -> ill_phyint_reinit
22637 	 */
22638 	if (ill->ill_isv6) {
22639 		/* allocate v6 mib */
22640 		if (!ill_allocate_mibs(ill))
22641 			return (ENOMEM);
22642 	}
22643 
22644 	/*
22645 	 * Pick a default sap until we get the DL_INFO_ACK back from
22646 	 * the driver.
22647 	 */
22648 	if (ill->ill_sap == 0) {
22649 		if (ill->ill_isv6)
22650 			ill->ill_sap  = IP6_DL_SAP;
22651 		else
22652 			ill->ill_sap  = IP_DL_SAP;
22653 	}
22654 
22655 	ill->ill_ifname_pending = 1;
22656 	ill->ill_ifname_pending_err = 0;
22657 
22658 	ill_refhold(ill);
22659 	rw_enter(&ill_g_lock, RW_WRITER);
22660 	if ((error = ill_glist_insert(ill, interf_name,
22661 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
22662 		ill->ill_ppa = UINT_MAX;
22663 		ill->ill_name[0] = '\0';
22664 		/*
22665 		 * undo null termination done above.
22666 		 */
22667 		ppa_ptr[0] = old_char;
22668 		rw_exit(&ill_g_lock);
22669 		ill_refrele(ill);
22670 		return (error);
22671 	}
22672 
22673 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
22674 
22675 	/*
22676 	 * When we return the buffer pointed to by interf_name should contain
22677 	 * the same name as in ill_name.
22678 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
22679 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
22680 	 * so copy full name and update the ppa ptr.
22681 	 * When ppa passed in != UINT_MAX all values are correct just undo
22682 	 * null termination, this saves a bcopy.
22683 	 */
22684 	if (*new_ppa_ptr == UINT_MAX) {
22685 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
22686 		*new_ppa_ptr = ill->ill_ppa;
22687 	} else {
22688 		/*
22689 		 * undo null termination done above.
22690 		 */
22691 		ppa_ptr[0] = old_char;
22692 	}
22693 
22694 	/* Let SCTP know about this ILL */
22695 	sctp_update_ill(ill, SCTP_ILL_INSERT);
22696 
22697 	/* and also about the first ipif */
22698 	sctp_update_ipif(ipif, SCTP_IPIF_INSERT);
22699 
22700 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_reprocess_ioctl, NEW_OP,
22701 	    B_TRUE);
22702 
22703 	rw_exit(&ill_g_lock);
22704 	ill_refrele(ill);
22705 	if (ipsq == NULL)
22706 		return (EINPROGRESS);
22707 
22708 	/*
22709 	 * Need to set the ipsq_current_ipif now, if we have changed ipsq
22710 	 * due to the phyint merge in ill_phyint_reinit.
22711 	 */
22712 	ASSERT(ipsq->ipsq_current_ipif == NULL ||
22713 		ipsq->ipsq_current_ipif == ipif);
22714 	ipsq->ipsq_current_ipif = ipif;
22715 	ipsq->ipsq_last_cmd = SIOCSLIFNAME;
22716 	error = ipif_set_values_tail(ill, ipif, mp, q);
22717 	ipsq_exit(ipsq, B_TRUE, B_TRUE);
22718 	if (error != 0 && error != EINPROGRESS) {
22719 		/*
22720 		 * restore previous values
22721 		 */
22722 		ill->ill_isv6 = B_FALSE;
22723 	}
22724 	return (error);
22725 }
22726 
22727 
22728 extern void (*ip_cleanup_func)(void);
22729 
22730 void
22731 ipif_init(void)
22732 {
22733 	hrtime_t hrt;
22734 	int i;
22735 
22736 	/*
22737 	 * Can't call drv_getparm here as it is too early in the boot.
22738 	 * As we use ipif_src_random just for picking a different
22739 	 * source address everytime, this need not be really random.
22740 	 */
22741 	hrt = gethrtime();
22742 	ipif_src_random = ((hrt >> 32) & 0xffffffff) * (hrt & 0xffffffff);
22743 
22744 	for (i = 0; i < MAX_G_HEADS; i++) {
22745 		ill_g_heads[i].ill_g_list_head = (ill_if_t *)&ill_g_heads[i];
22746 		ill_g_heads[i].ill_g_list_tail = (ill_if_t *)&ill_g_heads[i];
22747 	}
22748 
22749 	avl_create(&phyint_g_list.phyint_list_avl_by_index,
22750 	    ill_phyint_compare_index,
22751 	    sizeof (phyint_t),
22752 	    offsetof(struct phyint, phyint_avl_by_index));
22753 	avl_create(&phyint_g_list.phyint_list_avl_by_name,
22754 	    ill_phyint_compare_name,
22755 	    sizeof (phyint_t),
22756 	    offsetof(struct phyint, phyint_avl_by_name));
22757 
22758 	ip_cleanup_func = ip_thread_exit;
22759 }
22760 
22761 /*
22762  * This is called by ip_rt_add when src_addr value is other than zero.
22763  * src_addr signifies the source address of the incoming packet. For
22764  * reverse tunnel route we need to create a source addr based routing
22765  * table. This routine creates ip_mrtun_table if it's empty and then
22766  * it adds the route entry hashed by source address. It verifies that
22767  * the outgoing interface is always a non-resolver interface (tunnel).
22768  */
22769 int
22770 ip_mrtun_rt_add(ipaddr_t in_src_addr, int flags, ipif_t *ipif_arg,
22771     ipif_t *src_ipif, ire_t **ire_arg, queue_t *q, mblk_t *mp, ipsq_func_t func)
22772 {
22773 	ire_t   *ire;
22774 	ire_t	*save_ire;
22775 	ipif_t  *ipif;
22776 	ill_t   *in_ill = NULL;
22777 	ill_t	*out_ill;
22778 	queue_t	*stq;
22779 	mblk_t	*dlureq_mp;
22780 	int	error;
22781 
22782 	if (ire_arg != NULL)
22783 		*ire_arg = NULL;
22784 	ASSERT(in_src_addr != INADDR_ANY);
22785 
22786 	ipif = ipif_arg;
22787 	if (ipif != NULL) {
22788 		out_ill = ipif->ipif_ill;
22789 	} else {
22790 		ip1dbg(("ip_mrtun_rt_add: ipif is NULL\n"));
22791 		return (EINVAL);
22792 	}
22793 
22794 	if (src_ipif == NULL) {
22795 		ip1dbg(("ip_mrtun_rt_add: src_ipif is NULL\n"));
22796 		return (EINVAL);
22797 	}
22798 	in_ill = src_ipif->ipif_ill;
22799 
22800 	/*
22801 	 * Check for duplicates. We don't need to
22802 	 * match out_ill, because the uniqueness of
22803 	 * a route is only dependent on src_addr and
22804 	 * in_ill.
22805 	 */
22806 	ire = ire_mrtun_lookup(in_src_addr, in_ill);
22807 	if (ire != NULL) {
22808 		ire_refrele(ire);
22809 		return (EEXIST);
22810 	}
22811 	if (ipif->ipif_net_type != IRE_IF_NORESOLVER) {
22812 		ip2dbg(("ip_mrtun_rt_add: outgoing interface is type %d\n",
22813 		    ipif->ipif_net_type));
22814 		return (EINVAL);
22815 	}
22816 
22817 	stq = ipif->ipif_wq;
22818 	ASSERT(stq != NULL);
22819 
22820 	/*
22821 	 * The outgoing interface must be non-resolver
22822 	 * interface.
22823 	 */
22824 	dlureq_mp = ill_dlur_gen(NULL,
22825 	    out_ill->ill_phys_addr_length, out_ill->ill_sap,
22826 	    out_ill->ill_sap_length);
22827 
22828 	if (dlureq_mp == NULL) {
22829 		ip1dbg(("ip_newroute: dlureq_mp NULL\n"));
22830 		return (ENOMEM);
22831 	}
22832 
22833 	/* Create the IRE. */
22834 
22835 	ire = ire_create(
22836 	    NULL,				/* Zero dst addr */
22837 	    NULL,				/* Zero mask */
22838 	    NULL,				/* Zero gateway addr */
22839 	    NULL,				/* Zero ipif_src addr */
22840 	    (uint8_t *)&in_src_addr,		/* in_src-addr */
22841 	    &ipif->ipif_mtu,
22842 	    NULL,
22843 	    NULL,				/* rfq */
22844 	    stq,
22845 	    IRE_MIPRTUN,
22846 	    dlureq_mp,
22847 	    ipif,
22848 	    in_ill,
22849 	    0,
22850 	    0,
22851 	    0,
22852 	    flags,
22853 	    &ire_uinfo_null,
22854 	    NULL,
22855 	    NULL);
22856 
22857 	if (ire == NULL) {
22858 		freeb(dlureq_mp);
22859 		return (ENOMEM);
22860 	}
22861 	ip2dbg(("ip_mrtun_rt_add: mrtun route is created with type %d\n",
22862 	    ire->ire_type));
22863 	save_ire = ire;
22864 	ASSERT(save_ire != NULL);
22865 	error = ire_add_mrtun(&ire, q, mp, func);
22866 	/*
22867 	 * If ire_add_mrtun() failed, the ire passed in was freed
22868 	 * so there is no need to do so here.
22869 	 */
22870 	if (error != 0) {
22871 		return (error);
22872 	}
22873 
22874 	/* Duplicate check */
22875 	if (ire != save_ire) {
22876 		/* route already exists by now */
22877 		ire_refrele(ire);
22878 		return (EEXIST);
22879 	}
22880 
22881 	if (ire_arg != NULL) {
22882 		/*
22883 		 * Store the ire that was just added. the caller
22884 		 * ip_rts_request responsible for doing ire_refrele()
22885 		 * on it.
22886 		 */
22887 		*ire_arg = ire;
22888 	} else {
22889 		ire_refrele(ire);	/* held in ire_add_mrtun */
22890 	}
22891 
22892 	return (0);
22893 }
22894 
22895 /*
22896  * It is called by ip_rt_delete() only when mipagent requests to delete
22897  * a reverse tunnel route that was added by ip_mrtun_rt_add() before.
22898  */
22899 
22900 int
22901 ip_mrtun_rt_delete(ipaddr_t in_src_addr, ipif_t *src_ipif)
22902 {
22903 	ire_t   *ire = NULL;
22904 
22905 	if (in_src_addr == INADDR_ANY)
22906 		return (EINVAL);
22907 	if (src_ipif == NULL)
22908 		return (EINVAL);
22909 
22910 	/* search if this route exists in the ip_mrtun_table */
22911 	ire = ire_mrtun_lookup(in_src_addr, src_ipif->ipif_ill);
22912 	if (ire == NULL) {
22913 		ip2dbg(("ip_mrtun_rt_delete: ire not found\n"));
22914 		return (ESRCH);
22915 	}
22916 	ire_delete(ire);
22917 	ire_refrele(ire);
22918 	return (0);
22919 }
22920 
22921 /*
22922  * Lookup the ipif corresponding to the onlink destination address. For
22923  * point-to-point interfaces, it matches with remote endpoint destination
22924  * address. For point-to-multipoint interfaces it only tries to match the
22925  * destination with the interface's subnet address. The longest, most specific
22926  * match is found to take care of such rare network configurations like -
22927  * le0: 129.146.1.1/16
22928  * le1: 129.146.2.2/24
22929  * It is used only by SO_DONTROUTE at the moment.
22930  */
22931 ipif_t *
22932 ipif_lookup_onlink_addr(ipaddr_t addr, zoneid_t zoneid)
22933 {
22934 	ipif_t	*ipif, *best_ipif;
22935 	ill_t	*ill;
22936 	ill_walk_context_t ctx;
22937 
22938 	ASSERT(zoneid != ALL_ZONES);
22939 	best_ipif = NULL;
22940 
22941 	rw_enter(&ill_g_lock, RW_READER);
22942 	ill = ILL_START_WALK_V4(&ctx);
22943 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
22944 		mutex_enter(&ill->ill_lock);
22945 		for (ipif = ill->ill_ipif; ipif != NULL;
22946 		    ipif = ipif->ipif_next) {
22947 			if (!IPIF_CAN_LOOKUP(ipif))
22948 				continue;
22949 			if (ipif->ipif_zoneid != zoneid &&
22950 			    ipif->ipif_zoneid != ALL_ZONES)
22951 				continue;
22952 			/*
22953 			 * Point-to-point case. Look for exact match with
22954 			 * destination address.
22955 			 */
22956 			if (ipif->ipif_flags & IPIF_POINTOPOINT) {
22957 				if (ipif->ipif_pp_dst_addr == addr) {
22958 					ipif_refhold_locked(ipif);
22959 					mutex_exit(&ill->ill_lock);
22960 					rw_exit(&ill_g_lock);
22961 					if (best_ipif != NULL)
22962 						ipif_refrele(best_ipif);
22963 					return (ipif);
22964 				}
22965 			} else if (ipif->ipif_subnet == (addr &
22966 			    ipif->ipif_net_mask)) {
22967 				/*
22968 				 * Point-to-multipoint case. Looping through to
22969 				 * find the most specific match. If there are
22970 				 * multiple best match ipif's then prefer ipif's
22971 				 * that are UP. If there is only one best match
22972 				 * ipif and it is DOWN we must still return it.
22973 				 */
22974 				if ((best_ipif == NULL) ||
22975 				    (ipif->ipif_net_mask >
22976 				    best_ipif->ipif_net_mask) ||
22977 				    ((ipif->ipif_net_mask ==
22978 				    best_ipif->ipif_net_mask) &&
22979 				    ((ipif->ipif_flags & IPIF_UP) &&
22980 				    (!(best_ipif->ipif_flags & IPIF_UP))))) {
22981 					ipif_refhold_locked(ipif);
22982 					mutex_exit(&ill->ill_lock);
22983 					rw_exit(&ill_g_lock);
22984 					if (best_ipif != NULL)
22985 						ipif_refrele(best_ipif);
22986 					best_ipif = ipif;
22987 					rw_enter(&ill_g_lock, RW_READER);
22988 					mutex_enter(&ill->ill_lock);
22989 				}
22990 			}
22991 		}
22992 		mutex_exit(&ill->ill_lock);
22993 	}
22994 	rw_exit(&ill_g_lock);
22995 	return (best_ipif);
22996 }
22997 
22998 
22999 /*
23000  * Save enough information so that we can recreate the IRE if
23001  * the interface goes down and then up.
23002  */
23003 static void
23004 ipif_save_ire(ipif_t *ipif, ire_t *ire)
23005 {
23006 	mblk_t	*save_mp;
23007 
23008 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
23009 	if (save_mp != NULL) {
23010 		ifrt_t	*ifrt;
23011 
23012 		save_mp->b_wptr += sizeof (ifrt_t);
23013 		ifrt = (ifrt_t *)save_mp->b_rptr;
23014 		bzero(ifrt, sizeof (ifrt_t));
23015 		ifrt->ifrt_type = ire->ire_type;
23016 		ifrt->ifrt_addr = ire->ire_addr;
23017 		ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
23018 		ifrt->ifrt_src_addr = ire->ire_src_addr;
23019 		ifrt->ifrt_mask = ire->ire_mask;
23020 		ifrt->ifrt_flags = ire->ire_flags;
23021 		ifrt->ifrt_max_frag = ire->ire_max_frag;
23022 		mutex_enter(&ipif->ipif_saved_ire_lock);
23023 		save_mp->b_cont = ipif->ipif_saved_ire_mp;
23024 		ipif->ipif_saved_ire_mp = save_mp;
23025 		ipif->ipif_saved_ire_cnt++;
23026 		mutex_exit(&ipif->ipif_saved_ire_lock);
23027 	}
23028 }
23029 
23030 
23031 static void
23032 ipif_remove_ire(ipif_t *ipif, ire_t *ire)
23033 {
23034 	mblk_t	**mpp;
23035 	mblk_t	*mp;
23036 	ifrt_t	*ifrt;
23037 
23038 	/* Remove from ipif_saved_ire_mp list if it is there */
23039 	mutex_enter(&ipif->ipif_saved_ire_lock);
23040 	for (mpp = &ipif->ipif_saved_ire_mp; *mpp != NULL;
23041 	    mpp = &(*mpp)->b_cont) {
23042 		/*
23043 		 * On a given ipif, the triple of address, gateway and
23044 		 * mask is unique for each saved IRE (in the case of
23045 		 * ordinary interface routes, the gateway address is
23046 		 * all-zeroes).
23047 		 */
23048 		mp = *mpp;
23049 		ifrt = (ifrt_t *)mp->b_rptr;
23050 		if (ifrt->ifrt_addr == ire->ire_addr &&
23051 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
23052 		    ifrt->ifrt_mask == ire->ire_mask) {
23053 			*mpp = mp->b_cont;
23054 			ipif->ipif_saved_ire_cnt--;
23055 			freeb(mp);
23056 			break;
23057 		}
23058 	}
23059 	mutex_exit(&ipif->ipif_saved_ire_lock);
23060 }
23061 
23062 
23063 /*
23064  * IP multirouting broadcast routes handling
23065  * Append CGTP broadcast IREs to regular ones created
23066  * at ifconfig time.
23067  */
23068 static void
23069 ip_cgtp_bcast_add(ire_t *ire, ire_t *ire_dst)
23070 {
23071 	ire_t *ire_prim;
23072 
23073 	ASSERT(ire != NULL);
23074 	ASSERT(ire_dst != NULL);
23075 
23076 	ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
23077 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
23078 	if (ire_prim != NULL) {
23079 		/*
23080 		 * We are in the special case of broadcasts for
23081 		 * CGTP. We add an IRE_BROADCAST that holds
23082 		 * the RTF_MULTIRT flag, the destination
23083 		 * address of ire_dst and the low level
23084 		 * info of ire_prim. In other words, CGTP
23085 		 * broadcast is added to the redundant ipif.
23086 		 */
23087 		ipif_t *ipif_prim;
23088 		ire_t  *bcast_ire;
23089 
23090 		ipif_prim = ire_prim->ire_ipif;
23091 
23092 		ip2dbg(("ip_cgtp_filter_bcast_add: "
23093 		    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
23094 		    (void *)ire_dst, (void *)ire_prim,
23095 		    (void *)ipif_prim));
23096 
23097 		bcast_ire = ire_create(
23098 		    (uchar_t *)&ire->ire_addr,
23099 		    (uchar_t *)&ip_g_all_ones,
23100 		    (uchar_t *)&ire_dst->ire_src_addr,
23101 		    (uchar_t *)&ire->ire_gateway_addr,
23102 		    NULL,
23103 		    &ipif_prim->ipif_mtu,
23104 		    NULL,
23105 		    ipif_prim->ipif_rq,
23106 		    ipif_prim->ipif_wq,
23107 		    IRE_BROADCAST,
23108 		    ipif_prim->ipif_bcast_mp,
23109 		    ipif_prim,
23110 		    NULL,
23111 		    0,
23112 		    0,
23113 		    0,
23114 		    ire->ire_flags,
23115 		    &ire_uinfo_null,
23116 		    NULL,
23117 		    NULL);
23118 
23119 		if (bcast_ire != NULL) {
23120 
23121 			if (ire_add(&bcast_ire, NULL, NULL, NULL,
23122 			    B_FALSE) == 0) {
23123 				ip2dbg(("ip_cgtp_filter_bcast_add: "
23124 				    "added bcast_ire %p\n",
23125 				    (void *)bcast_ire));
23126 
23127 				ipif_save_ire(bcast_ire->ire_ipif,
23128 				    bcast_ire);
23129 				ire_refrele(bcast_ire);
23130 			}
23131 		}
23132 		ire_refrele(ire_prim);
23133 	}
23134 }
23135 
23136 
23137 /*
23138  * IP multirouting broadcast routes handling
23139  * Remove the broadcast ire
23140  */
23141 static void
23142 ip_cgtp_bcast_delete(ire_t *ire)
23143 {
23144 	ire_t *ire_dst;
23145 
23146 	ASSERT(ire != NULL);
23147 	ire_dst = ire_ctable_lookup(ire->ire_addr, 0, IRE_BROADCAST,
23148 	    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
23149 	if (ire_dst != NULL) {
23150 		ire_t *ire_prim;
23151 
23152 		ire_prim = ire_ctable_lookup(ire->ire_gateway_addr, 0,
23153 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE);
23154 		if (ire_prim != NULL) {
23155 			ipif_t *ipif_prim;
23156 			ire_t  *bcast_ire;
23157 
23158 			ipif_prim = ire_prim->ire_ipif;
23159 
23160 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
23161 			    "ire_dst %p, ire_prim %p, ipif_prim %p\n",
23162 			    (void *)ire_dst, (void *)ire_prim,
23163 			    (void *)ipif_prim));
23164 
23165 			bcast_ire = ire_ctable_lookup(ire->ire_addr,
23166 			    ire->ire_gateway_addr,
23167 			    IRE_BROADCAST,
23168 			    ipif_prim, ALL_ZONES,
23169 			    NULL,
23170 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_IPIF |
23171 			    MATCH_IRE_MASK);
23172 
23173 			if (bcast_ire != NULL) {
23174 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
23175 				    "looked up bcast_ire %p\n",
23176 				    (void *)bcast_ire));
23177 				ipif_remove_ire(bcast_ire->ire_ipif,
23178 					bcast_ire);
23179 				ire_delete(bcast_ire);
23180 			}
23181 			ire_refrele(ire_prim);
23182 		}
23183 		ire_refrele(ire_dst);
23184 	}
23185 }
23186 
23187 /*
23188  * IPsec hardware acceleration capabilities related functions.
23189  */
23190 
23191 /*
23192  * Free a per-ill IPsec capabilities structure.
23193  */
23194 static void
23195 ill_ipsec_capab_free(ill_ipsec_capab_t *capab)
23196 {
23197 	if (capab->auth_hw_algs != NULL)
23198 		kmem_free(capab->auth_hw_algs, capab->algs_size);
23199 	if (capab->encr_hw_algs != NULL)
23200 		kmem_free(capab->encr_hw_algs, capab->algs_size);
23201 	if (capab->encr_algparm != NULL)
23202 		kmem_free(capab->encr_algparm, capab->encr_algparm_size);
23203 	kmem_free(capab, sizeof (ill_ipsec_capab_t));
23204 }
23205 
23206 /*
23207  * Allocate a new per-ill IPsec capabilities structure. This structure
23208  * is specific to an IPsec protocol (AH or ESP). It is implemented as
23209  * an array which specifies, for each algorithm, whether this algorithm
23210  * is supported by the ill or not.
23211  */
23212 static ill_ipsec_capab_t *
23213 ill_ipsec_capab_alloc(void)
23214 {
23215 	ill_ipsec_capab_t *capab;
23216 	uint_t nelems;
23217 
23218 	capab = kmem_zalloc(sizeof (ill_ipsec_capab_t), KM_NOSLEEP);
23219 	if (capab == NULL)
23220 		return (NULL);
23221 
23222 	/* we need one bit per algorithm */
23223 	nelems = MAX_IPSEC_ALGS / BITS(ipsec_capab_elem_t);
23224 	capab->algs_size = nelems * sizeof (ipsec_capab_elem_t);
23225 
23226 	/* allocate memory to store algorithm flags */
23227 	capab->encr_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
23228 	if (capab->encr_hw_algs == NULL)
23229 		goto nomem;
23230 	capab->auth_hw_algs = kmem_zalloc(capab->algs_size, KM_NOSLEEP);
23231 	if (capab->auth_hw_algs == NULL)
23232 		goto nomem;
23233 	/*
23234 	 * Leave encr_algparm NULL for now since we won't need it half
23235 	 * the time
23236 	 */
23237 	return (capab);
23238 
23239 nomem:
23240 	ill_ipsec_capab_free(capab);
23241 	return (NULL);
23242 }
23243 
23244 /*
23245  * Resize capability array.  Since we're exclusive, this is OK.
23246  */
23247 static boolean_t
23248 ill_ipsec_capab_resize_algparm(ill_ipsec_capab_t *capab, int algid)
23249 {
23250 	ipsec_capab_algparm_t *nalp, *oalp;
23251 	uint32_t olen, nlen;
23252 
23253 	oalp = capab->encr_algparm;
23254 	olen = capab->encr_algparm_size;
23255 
23256 	if (oalp != NULL) {
23257 		if (algid < capab->encr_algparm_end)
23258 			return (B_TRUE);
23259 	}
23260 
23261 	nlen = (algid + 1) * sizeof (*nalp);
23262 	nalp = kmem_zalloc(nlen, KM_NOSLEEP);
23263 	if (nalp == NULL)
23264 		return (B_FALSE);
23265 
23266 	if (oalp != NULL) {
23267 		bcopy(oalp, nalp, olen);
23268 		kmem_free(oalp, olen);
23269 	}
23270 	capab->encr_algparm = nalp;
23271 	capab->encr_algparm_size = nlen;
23272 	capab->encr_algparm_end = algid + 1;
23273 
23274 	return (B_TRUE);
23275 }
23276 
23277 /*
23278  * Compare the capabilities of the specified ill with the protocol
23279  * and algorithms specified by the SA passed as argument.
23280  * If they match, returns B_TRUE, B_FALSE if they do not match.
23281  *
23282  * The ill can be passed as a pointer to it, or by specifying its index
23283  * and whether it is an IPv6 ill (ill_index and ill_isv6 arguments).
23284  *
23285  * Called by ipsec_out_is_accelerated() do decide whether an outbound
23286  * packet is eligible for hardware acceleration, and by
23287  * ill_ipsec_capab_send_all() to decide whether a SA must be sent down
23288  * to a particular ill.
23289  */
23290 boolean_t
23291 ipsec_capab_match(ill_t *ill, uint_t ill_index, boolean_t ill_isv6,
23292     ipsa_t *sa)
23293 {
23294 	boolean_t sa_isv6;
23295 	uint_t algid;
23296 	struct ill_ipsec_capab_s *cpp;
23297 	boolean_t need_refrele = B_FALSE;
23298 
23299 	if (ill == NULL) {
23300 		ill = ill_lookup_on_ifindex(ill_index, ill_isv6, NULL,
23301 		    NULL, NULL, NULL);
23302 		if (ill == NULL) {
23303 			ip0dbg(("ipsec_capab_match: ill doesn't exist\n"));
23304 			return (B_FALSE);
23305 		}
23306 		need_refrele = B_TRUE;
23307 	}
23308 
23309 	/*
23310 	 * Use the address length specified by the SA to determine
23311 	 * if it corresponds to a IPv6 address, and fail the matching
23312 	 * if the isv6 flag passed as argument does not match.
23313 	 * Note: this check is used for SADB capability checking before
23314 	 * sending SA information to an ill.
23315 	 */
23316 	sa_isv6 = (sa->ipsa_addrfam == AF_INET6);
23317 	if (sa_isv6 != ill_isv6)
23318 		/* protocol mismatch */
23319 		goto done;
23320 
23321 	/*
23322 	 * Check if the ill supports the protocol, algorithm(s) and
23323 	 * key size(s) specified by the SA, and get the pointers to
23324 	 * the algorithms supported by the ill.
23325 	 */
23326 	switch (sa->ipsa_type) {
23327 
23328 	case SADB_SATYPE_ESP:
23329 		if (!(ill->ill_capabilities & ILL_CAPAB_ESP))
23330 			/* ill does not support ESP acceleration */
23331 			goto done;
23332 		cpp = ill->ill_ipsec_capab_esp;
23333 		algid = sa->ipsa_auth_alg;
23334 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->auth_hw_algs))
23335 			goto done;
23336 		algid = sa->ipsa_encr_alg;
23337 		if (!IPSEC_ALG_IS_ENABLED(algid, cpp->encr_hw_algs))
23338 			goto done;
23339 		if (algid < cpp->encr_algparm_end) {
23340 			ipsec_capab_algparm_t *alp = &cpp->encr_algparm[algid];
23341 			if (sa->ipsa_encrkeybits < alp->minkeylen)
23342 				goto done;
23343 			if (sa->ipsa_encrkeybits > alp->maxkeylen)
23344 				goto done;
23345 		}
23346 		break;
23347 
23348 	case SADB_SATYPE_AH:
23349 		if (!(ill->ill_capabilities & ILL_CAPAB_AH))
23350 			/* ill does not support AH acceleration */
23351 			goto done;
23352 		if (!IPSEC_ALG_IS_ENABLED(sa->ipsa_auth_alg,
23353 		    ill->ill_ipsec_capab_ah->auth_hw_algs))
23354 			goto done;
23355 		break;
23356 	}
23357 
23358 	if (need_refrele)
23359 		ill_refrele(ill);
23360 	return (B_TRUE);
23361 done:
23362 	if (need_refrele)
23363 		ill_refrele(ill);
23364 	return (B_FALSE);
23365 }
23366 
23367 
23368 /*
23369  * Add a new ill to the list of IPsec capable ills.
23370  * Called from ill_capability_ipsec_ack() when an ACK was received
23371  * indicating that IPsec hardware processing was enabled for an ill.
23372  *
23373  * ill must point to the ill for which acceleration was enabled.
23374  * dl_cap must be set to DL_CAPAB_IPSEC_AH or DL_CAPAB_IPSEC_ESP.
23375  */
23376 static void
23377 ill_ipsec_capab_add(ill_t *ill, uint_t dl_cap, boolean_t sadb_resync)
23378 {
23379 	ipsec_capab_ill_t **ills, *cur_ill, *new_ill;
23380 	uint_t sa_type;
23381 	uint_t ipproto;
23382 
23383 	ASSERT((dl_cap == DL_CAPAB_IPSEC_AH) ||
23384 	    (dl_cap == DL_CAPAB_IPSEC_ESP));
23385 
23386 	switch (dl_cap) {
23387 	case DL_CAPAB_IPSEC_AH:
23388 		sa_type = SADB_SATYPE_AH;
23389 		ills = &ipsec_capab_ills_ah;
23390 		ipproto = IPPROTO_AH;
23391 		break;
23392 	case DL_CAPAB_IPSEC_ESP:
23393 		sa_type = SADB_SATYPE_ESP;
23394 		ills = &ipsec_capab_ills_esp;
23395 		ipproto = IPPROTO_ESP;
23396 		break;
23397 	}
23398 
23399 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
23400 
23401 	/*
23402 	 * Add ill index to list of hardware accelerators. If
23403 	 * already in list, do nothing.
23404 	 */
23405 	for (cur_ill = *ills; cur_ill != NULL &&
23406 	    (cur_ill->ill_index != ill->ill_phyint->phyint_ifindex ||
23407 	    cur_ill->ill_isv6 != ill->ill_isv6); cur_ill = cur_ill->next)
23408 		;
23409 
23410 	if (cur_ill == NULL) {
23411 		/* if this is a new entry for this ill */
23412 		new_ill = kmem_zalloc(sizeof (ipsec_capab_ill_t), KM_NOSLEEP);
23413 		if (new_ill == NULL) {
23414 			rw_exit(&ipsec_capab_ills_lock);
23415 			return;
23416 		}
23417 
23418 		new_ill->ill_index = ill->ill_phyint->phyint_ifindex;
23419 		new_ill->ill_isv6 = ill->ill_isv6;
23420 		new_ill->next = *ills;
23421 		*ills = new_ill;
23422 	} else if (!sadb_resync) {
23423 		/* not resync'ing SADB and an entry exists for this ill */
23424 		rw_exit(&ipsec_capab_ills_lock);
23425 		return;
23426 	}
23427 
23428 	rw_exit(&ipsec_capab_ills_lock);
23429 
23430 	if (ipcl_proto_fanout_v6[ipproto].connf_head != NULL)
23431 		/*
23432 		 * IPsec module for protocol loaded, initiate dump
23433 		 * of the SADB to this ill.
23434 		 */
23435 		sadb_ill_download(ill, sa_type);
23436 }
23437 
23438 /*
23439  * Remove an ill from the list of IPsec capable ills.
23440  */
23441 static void
23442 ill_ipsec_capab_delete(ill_t *ill, uint_t dl_cap)
23443 {
23444 	ipsec_capab_ill_t **ills, *cur_ill, *prev_ill;
23445 
23446 	ASSERT(dl_cap == DL_CAPAB_IPSEC_AH ||
23447 	    dl_cap == DL_CAPAB_IPSEC_ESP);
23448 
23449 	ills = (dl_cap == DL_CAPAB_IPSEC_AH) ? &ipsec_capab_ills_ah :
23450 	    &ipsec_capab_ills_esp;
23451 
23452 	rw_enter(&ipsec_capab_ills_lock, RW_WRITER);
23453 
23454 	prev_ill = NULL;
23455 	for (cur_ill = *ills; cur_ill != NULL && (cur_ill->ill_index !=
23456 	    ill->ill_phyint->phyint_ifindex || cur_ill->ill_isv6 !=
23457 	    ill->ill_isv6); prev_ill = cur_ill, cur_ill = cur_ill->next)
23458 		;
23459 	if (cur_ill == NULL) {
23460 		/* entry not found */
23461 		rw_exit(&ipsec_capab_ills_lock);
23462 		return;
23463 	}
23464 	if (prev_ill == NULL) {
23465 		/* entry at front of list */
23466 		*ills = NULL;
23467 	} else {
23468 		prev_ill->next = cur_ill->next;
23469 	}
23470 	kmem_free(cur_ill, sizeof (ipsec_capab_ill_t));
23471 	rw_exit(&ipsec_capab_ills_lock);
23472 }
23473 
23474 
23475 /*
23476  * Handling of DL_CONTROL_REQ messages that must be sent down to
23477  * an ill while having exclusive access.
23478  */
23479 /* ARGSUSED */
23480 static void
23481 ill_ipsec_capab_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
23482 {
23483 	ill_t *ill = (ill_t *)q->q_ptr;
23484 
23485 	ill_dlpi_send(ill, mp);
23486 }
23487 
23488 
23489 /*
23490  * Called by SADB to send a DL_CONTROL_REQ message to every ill
23491  * supporting the specified IPsec protocol acceleration.
23492  * sa_type must be SADB_SATYPE_AH or SADB_SATYPE_ESP.
23493  * We free the mblk and, if sa is non-null, release the held referece.
23494  */
23495 void
23496 ill_ipsec_capab_send_all(uint_t sa_type, mblk_t *mp, ipsa_t *sa)
23497 {
23498 	ipsec_capab_ill_t *ici, *cur_ici;
23499 	ill_t *ill;
23500 	mblk_t *nmp, *mp_ship_list = NULL, *next_mp;
23501 
23502 	ici = (sa_type == SADB_SATYPE_AH) ? ipsec_capab_ills_ah :
23503 	    ipsec_capab_ills_esp;
23504 
23505 	rw_enter(&ipsec_capab_ills_lock, RW_READER);
23506 
23507 	for (cur_ici = ici; cur_ici != NULL; cur_ici = cur_ici->next) {
23508 		ill = ill_lookup_on_ifindex(cur_ici->ill_index,
23509 		    cur_ici->ill_isv6, NULL, NULL, NULL, NULL);
23510 
23511 		/*
23512 		 * Handle the case where the ill goes away while the SADB is
23513 		 * attempting to send messages.  If it's going away, it's
23514 		 * nuking its shadow SADB, so we don't care..
23515 		 */
23516 
23517 		if (ill == NULL)
23518 			continue;
23519 
23520 		if (sa != NULL) {
23521 			/*
23522 			 * Make sure capabilities match before
23523 			 * sending SA to ill.
23524 			 */
23525 			if (!ipsec_capab_match(ill, cur_ici->ill_index,
23526 			    cur_ici->ill_isv6, sa)) {
23527 				ill_refrele(ill);
23528 				continue;
23529 			}
23530 
23531 			mutex_enter(&sa->ipsa_lock);
23532 			sa->ipsa_flags |= IPSA_F_HW;
23533 			mutex_exit(&sa->ipsa_lock);
23534 		}
23535 
23536 		/*
23537 		 * Copy template message, and add it to the front
23538 		 * of the mblk ship list. We want to avoid holding
23539 		 * the ipsec_capab_ills_lock while sending the
23540 		 * message to the ills.
23541 		 *
23542 		 * The b_next and b_prev are temporarily used
23543 		 * to build a list of mblks to be sent down, and to
23544 		 * save the ill to which they must be sent.
23545 		 */
23546 		nmp = copymsg(mp);
23547 		if (nmp == NULL) {
23548 			ill_refrele(ill);
23549 			continue;
23550 		}
23551 		ASSERT(nmp->b_next == NULL && nmp->b_prev == NULL);
23552 		nmp->b_next = mp_ship_list;
23553 		mp_ship_list = nmp;
23554 		nmp->b_prev = (mblk_t *)ill;
23555 	}
23556 
23557 	rw_exit(&ipsec_capab_ills_lock);
23558 
23559 	nmp = mp_ship_list;
23560 	while (nmp != NULL) {
23561 		/* restore the mblk to a sane state */
23562 		next_mp = nmp->b_next;
23563 		nmp->b_next = NULL;
23564 		ill = (ill_t *)nmp->b_prev;
23565 		nmp->b_prev = NULL;
23566 
23567 		/*
23568 		 * Ship the mblk to the ill, must be exclusive. Keep the
23569 		 * reference to the ill as qwriter_ip() does a ill_referele().
23570 		 */
23571 		(void) qwriter_ip(NULL, ill, ill->ill_wq, nmp,
23572 		    ill_ipsec_capab_send_writer, NEW_OP, B_TRUE);
23573 
23574 		nmp = next_mp;
23575 	}
23576 
23577 	if (sa != NULL)
23578 		IPSA_REFRELE(sa);
23579 	freemsg(mp);
23580 }
23581 
23582 
23583 /*
23584  * Derive an interface id from the link layer address.
23585  * Knows about IEEE 802 and IEEE EUI-64 mappings.
23586  */
23587 static boolean_t
23588 ip_ether_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23589 {
23590 	char		*addr;
23591 
23592 	if (phys_length != ETHERADDRL)
23593 		return (B_FALSE);
23594 
23595 	/* Form EUI-64 like address */
23596 	addr = (char *)&v6addr->s6_addr32[2];
23597 	bcopy((char *)phys_addr, addr, 3);
23598 	addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
23599 	addr[3] = (char)0xff;
23600 	addr[4] = (char)0xfe;
23601 	bcopy((char *)phys_addr + 3, addr + 5, 3);
23602 	return (B_TRUE);
23603 }
23604 
23605 /* ARGSUSED */
23606 static boolean_t
23607 ip_nodef_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23608 {
23609 	return (B_FALSE);
23610 }
23611 
23612 /* ARGSUSED */
23613 static boolean_t
23614 ip_ether_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
23615     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
23616 {
23617 	/*
23618 	 * Multicast address mappings used over Ethernet/802.X.
23619 	 * This address is used as a base for mappings.
23620 	 */
23621 	static uint8_t ipv6_g_phys_multi_addr[] = {0x33, 0x33, 0x00,
23622 	    0x00, 0x00, 0x00};
23623 
23624 	/*
23625 	 * Extract low order 32 bits from IPv6 multicast address.
23626 	 * Or that into the link layer address, starting from the
23627 	 * second byte.
23628 	 */
23629 	*hw_start = 2;
23630 	v6_extract_mask->s6_addr32[0] = 0;
23631 	v6_extract_mask->s6_addr32[1] = 0;
23632 	v6_extract_mask->s6_addr32[2] = 0;
23633 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
23634 	bcopy(ipv6_g_phys_multi_addr, maddr, lla_length);
23635 	return (B_TRUE);
23636 }
23637 
23638 /*
23639  * Indicate by return value whether multicast is supported. If not,
23640  * this code should not touch/change any parameters.
23641  */
23642 /* ARGSUSED */
23643 static boolean_t
23644 ip_ether_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
23645     uint32_t *hw_start, ipaddr_t *extract_mask)
23646 {
23647 	/*
23648 	 * Multicast address mappings used over Ethernet/802.X.
23649 	 * This address is used as a base for mappings.
23650 	 */
23651 	static uint8_t ip_g_phys_multi_addr[] = { 0x01, 0x00, 0x5e,
23652 	    0x00, 0x00, 0x00 };
23653 
23654 	if (phys_length != ETHERADDRL)
23655 		return (B_FALSE);
23656 
23657 	*extract_mask = htonl(0x007fffff);
23658 	*hw_start = 2;
23659 	bcopy(ip_g_phys_multi_addr, maddr, ETHERADDRL);
23660 	return (B_TRUE);
23661 }
23662 
23663 /*
23664  * Derive IPoIB interface id from the link layer address.
23665  */
23666 static boolean_t
23667 ip_ib_v6intfid(uint_t phys_length, uint8_t *phys_addr, in6_addr_t *v6addr)
23668 {
23669 	char		*addr;
23670 
23671 	if (phys_length != 20)
23672 		return (B_FALSE);
23673 	addr = (char *)&v6addr->s6_addr32[2];
23674 	bcopy(phys_addr + 12, addr, 8);
23675 	/*
23676 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
23677 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
23678 	 * rules. In these cases, the IBA considers these GUIDs to be in
23679 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
23680 	 * required; vendors are required not to assign global EUI-64's
23681 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
23682 	 * of the interface identifier. Whether the GUID is in modified
23683 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
23684 	 * bit set to 1.
23685 	 */
23686 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
23687 	return (B_TRUE);
23688 }
23689 
23690 /*
23691  * Note on mapping from multicast IP addresses to IPoIB multicast link
23692  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
23693  * The format of an IPoIB multicast address is:
23694  *
23695  *  4 byte QPN      Scope Sign.  Pkey
23696  * +--------------------------------------------+
23697  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
23698  * +--------------------------------------------+
23699  *
23700  * The Scope and Pkey components are properties of the IBA port and
23701  * network interface. They can be ascertained from the broadcast address.
23702  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
23703  */
23704 
23705 static boolean_t
23706 ip_ib_v6mapinfo(uint_t lla_length, uint8_t *bphys_addr, uint8_t *maddr,
23707     uint32_t *hw_start, in6_addr_t *v6_extract_mask)
23708 {
23709 	/*
23710 	 * Base IPoIB IPv6 multicast address used for mappings.
23711 	 * Does not contain the IBA scope/Pkey values.
23712 	 */
23713 	static uint8_t ipv6_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
23714 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
23715 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
23716 
23717 	/*
23718 	 * Extract low order 80 bits from IPv6 multicast address.
23719 	 * Or that into the link layer address, starting from the
23720 	 * sixth byte.
23721 	 */
23722 	*hw_start = 6;
23723 	bcopy(ipv6_g_phys_ibmulti_addr, maddr, lla_length);
23724 
23725 	/*
23726 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
23727 	 */
23728 	*(maddr + 5) = *(bphys_addr + 5);
23729 	*(maddr + 8) = *(bphys_addr + 8);
23730 	*(maddr + 9) = *(bphys_addr + 9);
23731 
23732 	v6_extract_mask->s6_addr32[0] = 0;
23733 	v6_extract_mask->s6_addr32[1] = htonl(0x0000ffff);
23734 	v6_extract_mask->s6_addr32[2] = 0xffffffffU;
23735 	v6_extract_mask->s6_addr32[3] = 0xffffffffU;
23736 	return (B_TRUE);
23737 }
23738 
23739 static boolean_t
23740 ip_ib_v4mapinfo(uint_t phys_length, uint8_t *bphys_addr, uint8_t *maddr,
23741     uint32_t *hw_start, ipaddr_t *extract_mask)
23742 {
23743 	/*
23744 	 * Base IPoIB IPv4 multicast address used for mappings.
23745 	 * Does not contain the IBA scope/Pkey values.
23746 	 */
23747 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
23748 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
23749 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
23750 
23751 	if (phys_length != sizeof (ipv4_g_phys_ibmulti_addr))
23752 		return (B_FALSE);
23753 
23754 	/*
23755 	 * Extract low order 28 bits from IPv4 multicast address.
23756 	 * Or that into the link layer address, starting from the
23757 	 * sixteenth byte.
23758 	 */
23759 	*extract_mask = htonl(0x0fffffff);
23760 	*hw_start = 16;
23761 	bcopy(ipv4_g_phys_ibmulti_addr, maddr, phys_length);
23762 
23763 	/*
23764 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
23765 	 */
23766 	*(maddr + 5) = *(bphys_addr + 5);
23767 	*(maddr + 8) = *(bphys_addr + 8);
23768 	*(maddr + 9) = *(bphys_addr + 9);
23769 	return (B_TRUE);
23770 }
23771 
23772 /*
23773  * Returns B_TRUE if an ipif is present in the given zone, matching some flags
23774  * (typically IPIF_UP). If ipifp is non-null, the held ipif is returned there.
23775  * This works for both IPv4 and IPv6; if the passed-in ill is v6, the ipif with
23776  * the link-local address is preferred.
23777  */
23778 boolean_t
23779 ipif_lookup_zoneid(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
23780 {
23781 	ipif_t	*ipif;
23782 	ipif_t	*maybe_ipif = NULL;
23783 
23784 	mutex_enter(&ill->ill_lock);
23785 	if (ill->ill_state_flags & ILL_CONDEMNED) {
23786 		mutex_exit(&ill->ill_lock);
23787 		if (ipifp != NULL)
23788 			*ipifp = NULL;
23789 		return (B_FALSE);
23790 	}
23791 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
23792 		if (!IPIF_CAN_LOOKUP(ipif))
23793 			continue;
23794 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
23795 		    ipif->ipif_zoneid != ALL_ZONES)
23796 			continue;
23797 		if ((ipif->ipif_flags & flags) != flags)
23798 			continue;
23799 
23800 		if (ipifp == NULL) {
23801 			mutex_exit(&ill->ill_lock);
23802 			ASSERT(maybe_ipif == NULL);
23803 			return (B_TRUE);
23804 		}
23805 		if (!ill->ill_isv6 ||
23806 		    IN6_IS_ADDR_LINKLOCAL(&ipif->ipif_v6src_addr)) {
23807 			ipif_refhold_locked(ipif);
23808 			mutex_exit(&ill->ill_lock);
23809 			*ipifp = ipif;
23810 			return (B_TRUE);
23811 		}
23812 		if (maybe_ipif == NULL)
23813 			maybe_ipif = ipif;
23814 	}
23815 	if (ipifp != NULL) {
23816 		if (maybe_ipif != NULL)
23817 			ipif_refhold_locked(maybe_ipif);
23818 		*ipifp = maybe_ipif;
23819 	}
23820 	mutex_exit(&ill->ill_lock);
23821 	return (maybe_ipif != NULL);
23822 }
23823 
23824 /*
23825  * Same as ipif_lookup_zoneid() but looks at all the ills in the same group.
23826  */
23827 boolean_t
23828 ipif_lookup_zoneid_group(ill_t *ill, zoneid_t zoneid, int flags, ipif_t **ipifp)
23829 {
23830 	ill_t *illg;
23831 
23832 	/*
23833 	 * We look at the passed-in ill first without grabbing ill_g_lock.
23834 	 */
23835 	if (ipif_lookup_zoneid(ill, zoneid, flags, ipifp)) {
23836 		return (B_TRUE);
23837 	}
23838 	rw_enter(&ill_g_lock, RW_READER);
23839 	if (ill->ill_group == NULL) {
23840 		/* ill not in a group */
23841 		rw_exit(&ill_g_lock);
23842 		return (B_FALSE);
23843 	}
23844 
23845 	/*
23846 	 * There's no ipif in the zone on ill, however ill is part of an IPMP
23847 	 * group. We need to look for an ipif in the zone on all the ills in the
23848 	 * group.
23849 	 */
23850 	illg = ill->ill_group->illgrp_ill;
23851 	do {
23852 		/*
23853 		 * We don't call ipif_lookup_zoneid() on ill as we already know
23854 		 * that it's not there.
23855 		 */
23856 		if (illg != ill &&
23857 		    ipif_lookup_zoneid(illg, zoneid, flags, ipifp)) {
23858 			break;
23859 		}
23860 	} while ((illg = illg->ill_group_next) != NULL);
23861 	rw_exit(&ill_g_lock);
23862 	return (illg != NULL);
23863 }
23864 
23865 /*
23866  * Check if this ill is only being used to send ICMP probes for IPMP
23867  */
23868 boolean_t
23869 ill_is_probeonly(ill_t *ill)
23870 {
23871 	/*
23872 	 * Check if the interface is FAILED, or INACTIVE
23873 	 */
23874 	if (ill->ill_phyint->phyint_flags & (PHYI_FAILED|PHYI_INACTIVE))
23875 		return (B_TRUE);
23876 
23877 	return (B_FALSE);
23878 }
23879 
23880 /*
23881  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
23882  * If a pointer to an ipif_t is returned then the caller will need to do
23883  * an ill_refrele().
23884  */
23885 ipif_t *
23886 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6)
23887 {
23888 	ipif_t *ipif;
23889 	ill_t *ill;
23890 
23891 	ill = ill_lookup_on_ifindex(ifindex, isv6, NULL, NULL, NULL, NULL);
23892 
23893 	if (ill == NULL)
23894 		return (NULL);
23895 
23896 	mutex_enter(&ill->ill_lock);
23897 	if (ill->ill_state_flags & ILL_CONDEMNED) {
23898 		mutex_exit(&ill->ill_lock);
23899 		ill_refrele(ill);
23900 		return (NULL);
23901 	}
23902 
23903 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
23904 		if (!IPIF_CAN_LOOKUP(ipif))
23905 			continue;
23906 		if (lifidx == ipif->ipif_id) {
23907 			ipif_refhold_locked(ipif);
23908 			break;
23909 		}
23910 	}
23911 
23912 	mutex_exit(&ill->ill_lock);
23913 	ill_refrele(ill);
23914 	return (ipif);
23915 }
23916