xref: /illumos-gate/usr/src/uts/common/inet/ip/ip_if.c (revision d66189af)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 1990 Mentat Inc.
24  * Copyright (c) 2013 by Delphix. All rights reserved.
25  * Copyright (c) 2016, Joyent, Inc. All rights reserved.
26  * Copyright (c) 2014, OmniTI Computer Consulting, Inc. All rights reserved.
27  * Copyright 2023 Oxide Computer Company
28  */
29 
30 /*
31  * This file contains the interface control functions for IP.
32  */
33 
34 #include <sys/types.h>
35 #include <sys/stream.h>
36 #include <sys/dlpi.h>
37 #include <sys/stropts.h>
38 #include <sys/strsun.h>
39 #include <sys/sysmacros.h>
40 #include <sys/strsubr.h>
41 #include <sys/strlog.h>
42 #include <sys/ddi.h>
43 #include <sys/sunddi.h>
44 #include <sys/cmn_err.h>
45 #include <sys/kstat.h>
46 #include <sys/debug.h>
47 #include <sys/zone.h>
48 #include <sys/sunldi.h>
49 #include <sys/file.h>
50 #include <sys/bitmap.h>
51 #include <sys/cpuvar.h>
52 #include <sys/time.h>
53 #include <sys/ctype.h>
54 #include <sys/kmem.h>
55 #include <sys/systm.h>
56 #include <sys/param.h>
57 #include <sys/socket.h>
58 #include <sys/isa_defs.h>
59 #include <net/if.h>
60 #include <net/if_arp.h>
61 #include <net/if_types.h>
62 #include <net/if_dl.h>
63 #include <net/route.h>
64 #include <sys/sockio.h>
65 #include <netinet/in.h>
66 #include <netinet/ip6.h>
67 #include <netinet/icmp6.h>
68 #include <netinet/igmp_var.h>
69 #include <sys/policy.h>
70 #include <sys/ethernet.h>
71 #include <sys/callb.h>
72 #include <sys/md5.h>
73 
74 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
75 #include <inet/mi.h>
76 #include <inet/nd.h>
77 #include <inet/tunables.h>
78 #include <inet/arp.h>
79 #include <inet/ip_arp.h>
80 #include <inet/mib2.h>
81 #include <inet/ip.h>
82 #include <inet/ip6.h>
83 #include <inet/ip6_asp.h>
84 #include <inet/tcp.h>
85 #include <inet/ip_multi.h>
86 #include <inet/ip_ire.h>
87 #include <inet/ip_ftable.h>
88 #include <inet/ip_rts.h>
89 #include <inet/ip_ndp.h>
90 #include <inet/ip_if.h>
91 #include <inet/ip_impl.h>
92 #include <inet/sctp_ip.h>
93 #include <inet/ip_netinfo.h>
94 #include <inet/ilb_ip.h>
95 
96 #include <netinet/igmp.h>
97 #include <inet/ip_listutils.h>
98 #include <inet/ipclassifier.h>
99 #include <sys/mac_client.h>
100 #include <sys/dld.h>
101 #include <sys/mac_flow.h>
102 
103 #include <sys/systeminfo.h>
104 #include <sys/bootconf.h>
105 
106 #include <sys/tsol/tndb.h>
107 #include <sys/tsol/tnet.h>
108 
109 #include <inet/rawip_impl.h> /* needed for icmp_stack_t */
110 #include <inet/udp_impl.h> /* needed for udp_stack_t */
111 
112 /* The character which tells where the ill_name ends */
113 #define	IPIF_SEPARATOR_CHAR	':'
114 
115 /* IP ioctl function table entry */
116 typedef struct ipft_s {
117 	int	ipft_cmd;
118 	pfi_t	ipft_pfi;
119 	int	ipft_min_size;
120 	int	ipft_flags;
121 } ipft_t;
122 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
123 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
124 
125 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
126 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
127 		    char *value, caddr_t cp, cred_t *ioc_cr);
128 
129 static boolean_t ill_is_quiescent(ill_t *);
130 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
131 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
132 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
133     mblk_t *mp, boolean_t need_up);
134 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
135     mblk_t *mp, boolean_t need_up);
136 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
137     queue_t *q, mblk_t *mp, boolean_t need_up);
138 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
139     mblk_t *mp);
140 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
141     mblk_t *mp);
142 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
143     queue_t *q, mblk_t *mp, boolean_t need_up);
144 static int	ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
145     int ioccmd, struct linkblk *li);
146 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **, ip_stack_t *);
147 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
148 static void	ipsq_flush(ill_t *ill);
149 
150 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
151     queue_t *q, mblk_t *mp, boolean_t need_up);
152 static void	ipsq_delete(ipsq_t *);
153 
154 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
155     boolean_t initialize, boolean_t insert, int *errorp);
156 static ire_t	**ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep);
157 static void	ipif_delete_bcast_ires(ipif_t *ipif);
158 static int	ipif_add_ires_v4(ipif_t *, boolean_t);
159 static boolean_t ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif,
160 		    boolean_t isv6);
161 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
162 static void	ipif_free(ipif_t *ipif);
163 static void	ipif_free_tail(ipif_t *ipif);
164 static void	ipif_set_default(ipif_t *ipif);
165 static int	ipif_set_values(queue_t *q, mblk_t *mp,
166     char *interf_name, uint_t *ppa);
167 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
168     queue_t *q);
169 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
170     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
171     ip_stack_t *);
172 static ipif_t	*ipif_lookup_on_name_async(char *name, size_t namelen,
173     boolean_t isv6, zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func,
174     int *error, ip_stack_t *);
175 
176 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
177 static void	ill_delete_interface_type(ill_if_t *);
178 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
179 static void	ill_dl_down(ill_t *ill);
180 static void	ill_down(ill_t *ill);
181 static void	ill_down_ipifs(ill_t *, boolean_t);
182 static void	ill_free_mib(ill_t *ill);
183 static void	ill_glist_delete(ill_t *);
184 static void	ill_phyint_reinit(ill_t *ill);
185 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
186 static void	ill_set_phys_addr_tail(ipsq_t *, queue_t *, mblk_t *, void *);
187 static void	ill_replumb_tail(ipsq_t *, queue_t *, mblk_t *, void *);
188 
189 static ip_v6intfid_func_t ip_ether_v6intfid, ip_ib_v6intfid;
190 static ip_v6intfid_func_t ip_ipv4_v6intfid, ip_ipv6_v6intfid;
191 static ip_v6intfid_func_t ip_ipmp_v6intfid, ip_nodef_v6intfid;
192 static ip_v6intfid_func_t ip_ipv4_v6destintfid, ip_ipv6_v6destintfid;
193 static ip_v4mapinfo_func_t ip_ether_v4_mapping;
194 static ip_v6mapinfo_func_t ip_ether_v6_mapping;
195 static ip_v4mapinfo_func_t ip_ib_v4_mapping;
196 static ip_v6mapinfo_func_t ip_ib_v6_mapping;
197 static ip_v4mapinfo_func_t ip_mbcast_mapping;
198 static void	ip_cgtp_bcast_add(ire_t *, ip_stack_t *);
199 static void	ip_cgtp_bcast_delete(ire_t *, ip_stack_t *);
200 static void	phyint_free(phyint_t *);
201 
202 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *);
203 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
204 static void ill_capability_vrrp_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
205 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
206 static void ill_capability_hcksum_reset_fill(ill_t *, mblk_t *);
207 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
208     dl_capability_sub_t *);
209 static void ill_capability_zerocopy_reset_fill(ill_t *, mblk_t *);
210 static void	ill_capability_dld_reset_fill(ill_t *, mblk_t *);
211 static void	ill_capability_dld_ack(ill_t *, mblk_t *,
212 		    dl_capability_sub_t *);
213 static void	ill_capability_dld_enable(ill_t *);
214 static void	ill_capability_ack_thr(void *);
215 static void	ill_capability_lso_enable(ill_t *);
216 
217 static ill_t	*ill_prev_usesrc(ill_t *);
218 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
219 static void	ill_disband_usesrc_group(ill_t *);
220 static void	ip_sioctl_garp_reply(mblk_t *, ill_t *, void *, int);
221 
222 #ifdef DEBUG
223 static	void	ill_trace_cleanup(const ill_t *);
224 static	void	ipif_trace_cleanup(const ipif_t *);
225 #endif
226 
227 static	void	ill_dlpi_clear_deferred(ill_t *ill);
228 
229 static	void	phyint_flags_init(phyint_t *, t_uscalar_t);
230 
231 /*
232  * if we go over the memory footprint limit more than once in this msec
233  * interval, we'll start pruning aggressively.
234  */
235 int ip_min_frag_prune_time = 0;
236 
237 static ipft_t	ip_ioctl_ftbl[] = {
238 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
239 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
240 		IPFT_F_NO_REPLY },
241 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
242 	{ 0 }
243 };
244 
245 /* Simple ICMP IP Header Template */
246 static ipha_t icmp_ipha = {
247 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
248 };
249 
250 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
251 
252 static ip_m_t   ip_m_tbl[] = {
253 	{ DL_ETHER, IFT_ETHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
254 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
255 	    ip_nodef_v6intfid },
256 	{ DL_CSMACD, IFT_ISO88023, ETHERTYPE_IP, ETHERTYPE_IPV6,
257 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
258 	    ip_nodef_v6intfid },
259 	{ DL_TPB, IFT_ISO88024, ETHERTYPE_IP, ETHERTYPE_IPV6,
260 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
261 	    ip_nodef_v6intfid },
262 	{ DL_TPR, IFT_ISO88025, ETHERTYPE_IP, ETHERTYPE_IPV6,
263 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
264 	    ip_nodef_v6intfid },
265 	{ DL_FDDI, IFT_FDDI, ETHERTYPE_IP, ETHERTYPE_IPV6,
266 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
267 	    ip_nodef_v6intfid },
268 	{ DL_IB, IFT_IB, ETHERTYPE_IP, ETHERTYPE_IPV6,
269 	    ip_ib_v4_mapping, ip_ib_v6_mapping, ip_ib_v6intfid,
270 	    ip_nodef_v6intfid },
271 	{ DL_IPV4, IFT_IPV4, IPPROTO_ENCAP, IPPROTO_IPV6,
272 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
273 	    ip_ipv4_v6destintfid },
274 	{ DL_IPV6, IFT_IPV6, IPPROTO_ENCAP, IPPROTO_IPV6,
275 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv6_v6intfid,
276 	    ip_ipv6_v6destintfid },
277 	{ DL_6TO4, IFT_6TO4, IPPROTO_ENCAP, IPPROTO_IPV6,
278 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
279 	    ip_nodef_v6intfid },
280 	{ SUNW_DL_VNI, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
281 	    NULL, NULL, ip_nodef_v6intfid, ip_nodef_v6intfid },
282 	{ SUNW_DL_IPMP, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
283 	    NULL, NULL, ip_ipmp_v6intfid, ip_nodef_v6intfid },
284 	{ DL_OTHER, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
285 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
286 	    ip_nodef_v6intfid }
287 };
288 
289 char	ipif_loopback_name[] = "lo0";
290 
291 /* These are used by all IP network modules. */
292 sin6_t	sin6_null;	/* Zero address for quick clears */
293 sin_t	sin_null;	/* Zero address for quick clears */
294 
295 /* When set search for unused ipif_seqid */
296 static ipif_t	ipif_zero;
297 
298 /*
299  * ppa arena is created after these many
300  * interfaces have been plumbed.
301  */
302 uint_t	ill_no_arena = 12;	/* Setable in /etc/system */
303 
304 /*
305  * Allocate per-interface mibs.
306  * Returns true if ok. False otherwise.
307  *  ipsq  may not yet be allocated (loopback case ).
308  */
309 static boolean_t
ill_allocate_mibs(ill_t * ill)310 ill_allocate_mibs(ill_t *ill)
311 {
312 	/* Already allocated? */
313 	if (ill->ill_ip_mib != NULL) {
314 		if (ill->ill_isv6)
315 			ASSERT(ill->ill_icmp6_mib != NULL);
316 		return (B_TRUE);
317 	}
318 
319 	ill->ill_ip_mib = kmem_zalloc(sizeof (*ill->ill_ip_mib),
320 	    KM_NOSLEEP);
321 	if (ill->ill_ip_mib == NULL) {
322 		return (B_FALSE);
323 	}
324 
325 	/* Setup static information */
326 	SET_MIB(ill->ill_ip_mib->ipIfStatsEntrySize,
327 	    sizeof (mib2_ipIfStatsEntry_t));
328 	if (ill->ill_isv6) {
329 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
330 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
331 		    sizeof (mib2_ipv6AddrEntry_t));
332 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
333 		    sizeof (mib2_ipv6RouteEntry_t));
334 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
335 		    sizeof (mib2_ipv6NetToMediaEntry_t));
336 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
337 		    sizeof (ipv6_member_t));
338 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
339 		    sizeof (ipv6_grpsrc_t));
340 	} else {
341 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
342 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
343 		    sizeof (mib2_ipAddrEntry_t));
344 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
345 		    sizeof (mib2_ipRouteEntry_t));
346 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
347 		    sizeof (mib2_ipNetToMediaEntry_t));
348 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
349 		    sizeof (ip_member_t));
350 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
351 		    sizeof (ip_grpsrc_t));
352 
353 		/*
354 		 * For a v4 ill, we are done at this point, because per ill
355 		 * icmp mibs are only used for v6.
356 		 */
357 		return (B_TRUE);
358 	}
359 
360 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
361 	    KM_NOSLEEP);
362 	if (ill->ill_icmp6_mib == NULL) {
363 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
364 		ill->ill_ip_mib = NULL;
365 		return (B_FALSE);
366 	}
367 	/* static icmp info */
368 	ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
369 	    sizeof (mib2_ipv6IfIcmpEntry_t);
370 	/*
371 	 * The ipIfStatsIfindex and ipv6IfIcmpIndex will be assigned later
372 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
373 	 * -> ill_phyint_reinit
374 	 */
375 	return (B_TRUE);
376 }
377 
378 /*
379  * Completely vaporize a lower level tap and all associated interfaces.
380  * ill_delete is called only out of ip_close when the device control
381  * stream is being closed.
382  */
383 void
ill_delete(ill_t * ill)384 ill_delete(ill_t *ill)
385 {
386 	ipif_t	*ipif;
387 	ill_t	*prev_ill;
388 	ip_stack_t	*ipst = ill->ill_ipst;
389 
390 	/*
391 	 * ill_delete may be forcibly entering the ipsq. The previous
392 	 * ioctl may not have completed and may need to be aborted.
393 	 * ipsq_flush takes care of it. If we don't need to enter the
394 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
395 	 * ill_delete_tail is sufficient.
396 	 */
397 	ipsq_flush(ill);
398 
399 	/*
400 	 * Nuke all interfaces.  ipif_free will take down the interface,
401 	 * remove it from the list, and free the data structure.
402 	 * Walk down the ipif list and remove the logical interfaces
403 	 * first before removing the main ipif. We can't unplumb
404 	 * zeroth interface first in the case of IPv6 as update_conn_ill
405 	 * -> ip_ll_multireq de-references ill_ipif for checking
406 	 * POINTOPOINT.
407 	 *
408 	 * If ill_ipif was not properly initialized (i.e low on memory),
409 	 * then no interfaces to clean up. In this case just clean up the
410 	 * ill.
411 	 */
412 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
413 		ipif_free(ipif);
414 
415 	/*
416 	 * clean out all the nce_t entries that depend on this
417 	 * ill for the ill_phys_addr.
418 	 */
419 	nce_flush(ill, B_TRUE);
420 
421 	/* Clean up msgs on pending upcalls for mrouted */
422 	reset_mrt_ill(ill);
423 
424 	update_conn_ill(ill, ipst);
425 
426 	/*
427 	 * Remove multicast references added as a result of calls to
428 	 * ip_join_allmulti().
429 	 */
430 	ip_purge_allmulti(ill);
431 
432 	/*
433 	 * If the ill being deleted is under IPMP, boot it out of the illgrp.
434 	 */
435 	if (IS_UNDER_IPMP(ill))
436 		ipmp_ill_leave_illgrp(ill);
437 
438 	/*
439 	 * ill_down will arrange to blow off any IRE's dependent on this
440 	 * ILL, and shut down fragmentation reassembly.
441 	 */
442 	ill_down(ill);
443 
444 	/* Let SCTP know, so that it can remove this from its list. */
445 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
446 
447 	/*
448 	 * Walk all CONNs that can have a reference on an ire or nce for this
449 	 * ill (we actually walk all that now have stale references).
450 	 */
451 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
452 
453 	/* With IPv6 we have dce_ifindex. Cleanup for neatness */
454 	if (ill->ill_isv6)
455 		dce_cleanup(ill->ill_phyint->phyint_ifindex, ipst);
456 
457 	/*
458 	 * If an address on this ILL is being used as a source address then
459 	 * clear out the pointers in other ILLs that point to this ILL.
460 	 */
461 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
462 	if (ill->ill_usesrc_grp_next != NULL) {
463 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
464 			ill_disband_usesrc_group(ill);
465 		} else {	/* consumer of the usesrc ILL */
466 			prev_ill = ill_prev_usesrc(ill);
467 			prev_ill->ill_usesrc_grp_next =
468 			    ill->ill_usesrc_grp_next;
469 		}
470 	}
471 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
472 }
473 
474 static void
ipif_non_duplicate(ipif_t * ipif)475 ipif_non_duplicate(ipif_t *ipif)
476 {
477 	ill_t *ill = ipif->ipif_ill;
478 	mutex_enter(&ill->ill_lock);
479 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
480 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
481 		ASSERT(ill->ill_ipif_dup_count > 0);
482 		ill->ill_ipif_dup_count--;
483 	}
484 	mutex_exit(&ill->ill_lock);
485 }
486 
487 /*
488  * ill_delete_tail is called from ip_modclose after all references
489  * to the closing ill are gone. The wait is done in ip_modclose
490  */
491 void
ill_delete_tail(ill_t * ill)492 ill_delete_tail(ill_t *ill)
493 {
494 	mblk_t	**mpp;
495 	ipif_t	*ipif;
496 	ip_stack_t *ipst = ill->ill_ipst;
497 
498 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
499 		ipif_non_duplicate(ipif);
500 		(void) ipif_down_tail(ipif);
501 	}
502 
503 	ASSERT(ill->ill_ipif_dup_count == 0);
504 
505 	/*
506 	 * If polling capability is enabled (which signifies direct
507 	 * upcall into IP and driver has ill saved as a handle),
508 	 * we need to make sure that unbind has completed before we
509 	 * let the ill disappear and driver no longer has any reference
510 	 * to this ill.
511 	 */
512 	mutex_enter(&ill->ill_lock);
513 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
514 		cv_wait(&ill->ill_cv, &ill->ill_lock);
515 	mutex_exit(&ill->ill_lock);
516 	ASSERT(!(ill->ill_capabilities &
517 	    (ILL_CAPAB_DLD | ILL_CAPAB_DLD_POLL | ILL_CAPAB_DLD_DIRECT)));
518 
519 	if (ill->ill_net_type != IRE_LOOPBACK)
520 		qprocsoff(ill->ill_rq);
521 
522 	/*
523 	 * We do an ipsq_flush once again now. New messages could have
524 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
525 	 * could also have landed up if an ioctl thread had looked up
526 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
527 	 * enqueued the ioctl when we did the ipsq_flush last time.
528 	 */
529 	ipsq_flush(ill);
530 
531 	/*
532 	 * Free capabilities.
533 	 */
534 	if (ill->ill_hcksum_capab != NULL) {
535 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
536 		ill->ill_hcksum_capab = NULL;
537 	}
538 
539 	if (ill->ill_zerocopy_capab != NULL) {
540 		kmem_free(ill->ill_zerocopy_capab,
541 		    sizeof (ill_zerocopy_capab_t));
542 		ill->ill_zerocopy_capab = NULL;
543 	}
544 
545 	if (ill->ill_lso_capab != NULL) {
546 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
547 		ill->ill_lso_capab = NULL;
548 	}
549 
550 	if (ill->ill_dld_capab != NULL) {
551 		kmem_free(ill->ill_dld_capab, sizeof (ill_dld_capab_t));
552 		ill->ill_dld_capab = NULL;
553 	}
554 
555 	/* Clean up ill_allowed_ips* related state */
556 	if (ill->ill_allowed_ips != NULL) {
557 		ASSERT(ill->ill_allowed_ips_cnt > 0);
558 		kmem_free(ill->ill_allowed_ips,
559 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
560 		ill->ill_allowed_ips = NULL;
561 		ill->ill_allowed_ips_cnt = 0;
562 	}
563 
564 	while (ill->ill_ipif != NULL)
565 		ipif_free_tail(ill->ill_ipif);
566 
567 	/*
568 	 * We have removed all references to ilm from conn and the ones joined
569 	 * within the kernel.
570 	 *
571 	 * We don't walk conns, mrts and ires because
572 	 *
573 	 * 1) update_conn_ill and reset_mrt_ill cleans up conns and mrts.
574 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
575 	 *    ill references.
576 	 */
577 
578 	/*
579 	 * If this ill is an IPMP meta-interface, blow away the illgrp.  This
580 	 * is safe to do because the illgrp has already been unlinked from the
581 	 * group by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find it.
582 	 */
583 	if (IS_IPMP(ill)) {
584 		ipmp_illgrp_destroy(ill->ill_grp);
585 		ill->ill_grp = NULL;
586 	}
587 
588 	if (ill->ill_mphysaddr_list != NULL) {
589 		multiphysaddr_t *mpa, *tmpa;
590 
591 		mpa = ill->ill_mphysaddr_list;
592 		ill->ill_mphysaddr_list = NULL;
593 		while (mpa) {
594 			tmpa = mpa->mpa_next;
595 			kmem_free(mpa, sizeof (*mpa));
596 			mpa = tmpa;
597 		}
598 	}
599 	/*
600 	 * Take us out of the list of ILLs. ill_glist_delete -> phyint_free
601 	 * could free the phyint. No more reference to the phyint after this
602 	 * point.
603 	 */
604 	(void) ill_glist_delete(ill);
605 
606 	if (ill->ill_frag_ptr != NULL) {
607 		uint_t count;
608 
609 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
610 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
611 		}
612 		mi_free(ill->ill_frag_ptr);
613 		ill->ill_frag_ptr = NULL;
614 		ill->ill_frag_hash_tbl = NULL;
615 	}
616 
617 	freemsg(ill->ill_nd_lla_mp);
618 	/* Free all retained control messages. */
619 	mpp = &ill->ill_first_mp_to_free;
620 	do {
621 		while (mpp[0]) {
622 			mblk_t  *mp;
623 			mblk_t  *mp1;
624 
625 			mp = mpp[0];
626 			mpp[0] = mp->b_next;
627 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
628 				mp1->b_next = NULL;
629 				mp1->b_prev = NULL;
630 			}
631 			freemsg(mp);
632 		}
633 	} while (mpp++ != &ill->ill_last_mp_to_free);
634 
635 	ill_free_mib(ill);
636 
637 #ifdef DEBUG
638 	ill_trace_cleanup(ill);
639 #endif
640 
641 	/* The default multicast interface might have changed */
642 	ire_increment_multicast_generation(ipst, ill->ill_isv6);
643 
644 	/* Drop refcnt here */
645 	netstack_rele(ill->ill_ipst->ips_netstack);
646 	ill->ill_ipst = NULL;
647 }
648 
649 static void
ill_free_mib(ill_t * ill)650 ill_free_mib(ill_t *ill)
651 {
652 	ip_stack_t *ipst = ill->ill_ipst;
653 
654 	/*
655 	 * MIB statistics must not be lost, so when an interface
656 	 * goes away the counter values will be added to the global
657 	 * MIBs.
658 	 */
659 	if (ill->ill_ip_mib != NULL) {
660 		if (ill->ill_isv6) {
661 			ip_mib2_add_ip_stats(&ipst->ips_ip6_mib,
662 			    ill->ill_ip_mib);
663 		} else {
664 			ip_mib2_add_ip_stats(&ipst->ips_ip_mib,
665 			    ill->ill_ip_mib);
666 		}
667 
668 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
669 		ill->ill_ip_mib = NULL;
670 	}
671 	if (ill->ill_icmp6_mib != NULL) {
672 		ip_mib2_add_icmp6_stats(&ipst->ips_icmp6_mib,
673 		    ill->ill_icmp6_mib);
674 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
675 		ill->ill_icmp6_mib = NULL;
676 	}
677 }
678 
679 /*
680  * Concatenate together a physical address and a sap.
681  *
682  * Sap_lengths are interpreted as follows:
683  *   sap_length == 0	==>	no sap
684  *   sap_length > 0	==>	sap is at the head of the dlpi address
685  *   sap_length < 0	==>	sap is at the tail of the dlpi address
686  */
687 static void
ill_dlur_copy_address(uchar_t * phys_src,uint_t phys_length,t_scalar_t sap_src,t_scalar_t sap_length,uchar_t * dst)688 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
689     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
690 {
691 	uint16_t sap_addr = (uint16_t)sap_src;
692 
693 	if (sap_length == 0) {
694 		if (phys_src == NULL)
695 			bzero(dst, phys_length);
696 		else
697 			bcopy(phys_src, dst, phys_length);
698 	} else if (sap_length < 0) {
699 		if (phys_src == NULL)
700 			bzero(dst, phys_length);
701 		else
702 			bcopy(phys_src, dst, phys_length);
703 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
704 	} else {
705 		bcopy(&sap_addr, dst, sizeof (sap_addr));
706 		if (phys_src == NULL)
707 			bzero((char *)dst + sap_length, phys_length);
708 		else
709 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
710 	}
711 }
712 
713 /*
714  * Generate a dl_unitdata_req mblk for the device and address given.
715  * addr_length is the length of the physical portion of the address.
716  * If addr is NULL include an all zero address of the specified length.
717  * TRUE? In any case, addr_length is taken to be the entire length of the
718  * dlpi address, including the absolute value of sap_length.
719  */
720 mblk_t *
ill_dlur_gen(uchar_t * addr,uint_t addr_length,t_uscalar_t sap,t_scalar_t sap_length)721 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
722     t_scalar_t sap_length)
723 {
724 	dl_unitdata_req_t *dlur;
725 	mblk_t	*mp;
726 	t_scalar_t	abs_sap_length;		/* absolute value */
727 
728 	abs_sap_length = ABS(sap_length);
729 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
730 	    DL_UNITDATA_REQ);
731 	if (mp == NULL)
732 		return (NULL);
733 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
734 	/* HACK: accomodate incompatible DLPI drivers */
735 	if (addr_length == 8)
736 		addr_length = 6;
737 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
738 	dlur->dl_dest_addr_offset = sizeof (*dlur);
739 	dlur->dl_priority.dl_min = 0;
740 	dlur->dl_priority.dl_max = 0;
741 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
742 	    (uchar_t *)&dlur[1]);
743 	return (mp);
744 }
745 
746 /*
747  * Add the pending mp to the list. There can be only 1 pending mp
748  * in the list. Any exclusive ioctl that needs to wait for a response
749  * from another module or driver needs to use this function to set
750  * the ipx_pending_mp to the ioctl mblk and wait for the response from
751  * the other module/driver. This is also used while waiting for the
752  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
753  */
754 boolean_t
ipsq_pending_mp_add(conn_t * connp,ipif_t * ipif,queue_t * q,mblk_t * add_mp,int waitfor)755 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
756     int waitfor)
757 {
758 	ipxop_t	*ipx = ipif->ipif_ill->ill_phyint->phyint_ipsq->ipsq_xop;
759 
760 	ASSERT(IAM_WRITER_IPIF(ipif));
761 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
762 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
763 	ASSERT(ipx->ipx_pending_mp == NULL);
764 	/*
765 	 * The caller may be using a different ipif than the one passed into
766 	 * ipsq_current_start() (e.g., suppose an ioctl that came in on the V4
767 	 * ill needs to wait for the V6 ill to quiesce).  So we can't ASSERT
768 	 * that `ipx_current_ipif == ipif'.
769 	 */
770 	ASSERT(ipx->ipx_current_ipif != NULL);
771 
772 	/*
773 	 * M_IOCDATA from ioctls, M_ERROR/M_HANGUP/M_PROTO/M_PCPROTO from the
774 	 * driver.
775 	 */
776 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_ERROR) ||
777 	    (DB_TYPE(add_mp) == M_HANGUP) || (DB_TYPE(add_mp) == M_PROTO) ||
778 	    (DB_TYPE(add_mp) == M_PCPROTO));
779 
780 	if (connp != NULL) {
781 		ASSERT(MUTEX_HELD(&connp->conn_lock));
782 		/*
783 		 * Return error if the conn has started closing. The conn
784 		 * could have finished cleaning up the pending mp list,
785 		 * If so we should not add another mp to the list negating
786 		 * the cleanup.
787 		 */
788 		if (connp->conn_state_flags & CONN_CLOSING)
789 			return (B_FALSE);
790 	}
791 	mutex_enter(&ipx->ipx_lock);
792 	ipx->ipx_pending_ipif = ipif;
793 	/*
794 	 * Note down the queue in b_queue. This will be returned by
795 	 * ipsq_pending_mp_get. Caller will then use these values to restart
796 	 * the processing
797 	 */
798 	add_mp->b_next = NULL;
799 	add_mp->b_queue = q;
800 	ipx->ipx_pending_mp = add_mp;
801 	ipx->ipx_waitfor = waitfor;
802 	mutex_exit(&ipx->ipx_lock);
803 
804 	if (connp != NULL)
805 		connp->conn_oper_pending_ill = ipif->ipif_ill;
806 
807 	return (B_TRUE);
808 }
809 
810 /*
811  * Retrieve the ipx_pending_mp and return it. There can be only 1 mp
812  * queued in the list.
813  */
814 mblk_t *
ipsq_pending_mp_get(ipsq_t * ipsq,conn_t ** connpp)815 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
816 {
817 	mblk_t	*curr = NULL;
818 	ipxop_t	*ipx = ipsq->ipsq_xop;
819 
820 	*connpp = NULL;
821 	mutex_enter(&ipx->ipx_lock);
822 	if (ipx->ipx_pending_mp == NULL) {
823 		mutex_exit(&ipx->ipx_lock);
824 		return (NULL);
825 	}
826 
827 	/* There can be only 1 such excl message */
828 	curr = ipx->ipx_pending_mp;
829 	ASSERT(curr->b_next == NULL);
830 	ipx->ipx_pending_ipif = NULL;
831 	ipx->ipx_pending_mp = NULL;
832 	ipx->ipx_waitfor = 0;
833 	mutex_exit(&ipx->ipx_lock);
834 
835 	if (CONN_Q(curr->b_queue)) {
836 		/*
837 		 * This mp did a refhold on the conn, at the start of the ioctl.
838 		 * So we can safely return a pointer to the conn to the caller.
839 		 */
840 		*connpp = Q_TO_CONN(curr->b_queue);
841 	} else {
842 		*connpp = NULL;
843 	}
844 	curr->b_next = NULL;
845 	curr->b_prev = NULL;
846 	return (curr);
847 }
848 
849 /*
850  * Cleanup the ioctl mp queued in ipx_pending_mp
851  * - Called in the ill_delete path
852  * - Called in the M_ERROR or M_HANGUP path on the ill.
853  * - Called in the conn close path.
854  *
855  * Returns success on finding the pending mblk associated with the ioctl or
856  * exclusive operation in progress, failure otherwise.
857  */
858 boolean_t
ipsq_pending_mp_cleanup(ill_t * ill,conn_t * connp)859 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
860 {
861 	mblk_t	*mp;
862 	ipxop_t	*ipx;
863 	queue_t	*q;
864 	ipif_t	*ipif;
865 	int	cmd;
866 
867 	ASSERT(IAM_WRITER_ILL(ill));
868 	ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
869 
870 	mutex_enter(&ipx->ipx_lock);
871 	mp = ipx->ipx_pending_mp;
872 	if (connp != NULL) {
873 		if (mp == NULL || mp->b_queue != CONNP_TO_WQ(connp)) {
874 			/*
875 			 * Nothing to clean since the conn that is closing
876 			 * does not have a matching pending mblk in
877 			 * ipx_pending_mp.
878 			 */
879 			mutex_exit(&ipx->ipx_lock);
880 			return (B_FALSE);
881 		}
882 	} else {
883 		/*
884 		 * A non-zero ill_error signifies we are called in the
885 		 * M_ERROR or M_HANGUP path and we need to unconditionally
886 		 * abort any current ioctl and do the corresponding cleanup.
887 		 * A zero ill_error means we are in the ill_delete path and
888 		 * we do the cleanup only if there is a pending mp.
889 		 */
890 		if (mp == NULL && ill->ill_error == 0) {
891 			mutex_exit(&ipx->ipx_lock);
892 			return (B_FALSE);
893 		}
894 	}
895 
896 	/* Now remove from the ipx_pending_mp */
897 	ipx->ipx_pending_mp = NULL;
898 	ipif = ipx->ipx_pending_ipif;
899 	ipx->ipx_pending_ipif = NULL;
900 	ipx->ipx_waitfor = 0;
901 	ipx->ipx_current_ipif = NULL;
902 	cmd = ipx->ipx_current_ioctl;
903 	ipx->ipx_current_ioctl = 0;
904 	ipx->ipx_current_done = B_TRUE;
905 	mutex_exit(&ipx->ipx_lock);
906 
907 	if (mp == NULL)
908 		return (B_FALSE);
909 
910 	q = mp->b_queue;
911 	mp->b_next = NULL;
912 	mp->b_prev = NULL;
913 	mp->b_queue = NULL;
914 
915 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
916 		DTRACE_PROBE4(ipif__ioctl,
917 		    char *, "ipsq_pending_mp_cleanup",
918 		    int, cmd, ill_t *, ipif == NULL ? NULL : ipif->ipif_ill,
919 		    ipif_t *, ipif);
920 		if (connp == NULL) {
921 			ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
922 		} else {
923 			ip_ioctl_finish(q, mp, ENXIO, CONN_CLOSE, NULL);
924 			mutex_enter(&ipif->ipif_ill->ill_lock);
925 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
926 			mutex_exit(&ipif->ipif_ill->ill_lock);
927 		}
928 	} else {
929 		inet_freemsg(mp);
930 	}
931 	return (B_TRUE);
932 }
933 
934 /*
935  * Called in the conn close path and ill delete path
936  */
937 static void
ipsq_xopq_mp_cleanup(ill_t * ill,conn_t * connp)938 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
939 {
940 	ipsq_t	*ipsq;
941 	mblk_t	*prev;
942 	mblk_t	*curr;
943 	mblk_t	*next;
944 	queue_t	*wq, *rq = NULL;
945 	mblk_t	*tmp_list = NULL;
946 
947 	ASSERT(IAM_WRITER_ILL(ill));
948 	if (connp != NULL)
949 		wq = CONNP_TO_WQ(connp);
950 	else
951 		wq = ill->ill_wq;
952 
953 	/*
954 	 * In the case of lo0 being unplumbed, ill_wq will be NULL. Guard
955 	 * against this here.
956 	 */
957 	if (wq != NULL)
958 		rq = RD(wq);
959 
960 	ipsq = ill->ill_phyint->phyint_ipsq;
961 	/*
962 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
963 	 * In the case of ioctl from a conn, there can be only 1 mp
964 	 * queued on the ipsq. If an ill is being unplumbed flush all
965 	 * the messages.
966 	 */
967 	mutex_enter(&ipsq->ipsq_lock);
968 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
969 	    curr = next) {
970 		next = curr->b_next;
971 		if (connp == NULL ||
972 		    (curr->b_queue == wq || curr->b_queue == rq)) {
973 			/* Unlink the mblk from the pending mp list */
974 			if (prev != NULL) {
975 				prev->b_next = curr->b_next;
976 			} else {
977 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
978 				ipsq->ipsq_xopq_mphead = curr->b_next;
979 			}
980 			if (ipsq->ipsq_xopq_mptail == curr)
981 				ipsq->ipsq_xopq_mptail = prev;
982 			/*
983 			 * Create a temporary list and release the ipsq lock
984 			 * New elements are added to the head of the tmp_list
985 			 */
986 			curr->b_next = tmp_list;
987 			tmp_list = curr;
988 		} else {
989 			prev = curr;
990 		}
991 	}
992 	mutex_exit(&ipsq->ipsq_lock);
993 
994 	while (tmp_list != NULL) {
995 		curr = tmp_list;
996 		tmp_list = curr->b_next;
997 		curr->b_next = NULL;
998 		curr->b_prev = NULL;
999 		wq = curr->b_queue;
1000 		curr->b_queue = NULL;
1001 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1002 			DTRACE_PROBE4(ipif__ioctl,
1003 			    char *, "ipsq_xopq_mp_cleanup",
1004 			    int, 0, ill_t *, NULL, ipif_t *, NULL);
1005 			ip_ioctl_finish(wq, curr, ENXIO, connp != NULL ?
1006 			    CONN_CLOSE : NO_COPYOUT, NULL);
1007 		} else {
1008 			/*
1009 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1010 			 * this can't be just inet_freemsg. we have to
1011 			 * restart it otherwise the thread will be stuck.
1012 			 */
1013 			inet_freemsg(curr);
1014 		}
1015 	}
1016 }
1017 
1018 /*
1019  * This conn has started closing. Cleanup any pending ioctl from this conn.
1020  * STREAMS ensures that there can be at most 1 active ioctl on a stream.
1021  */
1022 void
conn_ioctl_cleanup(conn_t * connp)1023 conn_ioctl_cleanup(conn_t *connp)
1024 {
1025 	ipsq_t	*ipsq;
1026 	ill_t	*ill;
1027 	boolean_t refheld;
1028 
1029 	/*
1030 	 * Check for a queued ioctl. If the ioctl has not yet started, the mp
1031 	 * is pending in the list headed by ipsq_xopq_head. If the ioctl has
1032 	 * started the mp could be present in ipx_pending_mp. Note that if
1033 	 * conn_oper_pending_ill is NULL, the ioctl may still be in flight and
1034 	 * not yet queued anywhere. In this case, the conn close code will wait
1035 	 * until the conn_ref is dropped. If the stream was a tcp stream, then
1036 	 * tcp_close will wait first until all ioctls have completed for this
1037 	 * conn.
1038 	 */
1039 	mutex_enter(&connp->conn_lock);
1040 	ill = connp->conn_oper_pending_ill;
1041 	if (ill == NULL) {
1042 		mutex_exit(&connp->conn_lock);
1043 		return;
1044 	}
1045 
1046 	/*
1047 	 * We may not be able to refhold the ill if the ill/ipif
1048 	 * is changing. But we need to make sure that the ill will
1049 	 * not vanish. So we just bump up the ill_waiter count.
1050 	 */
1051 	refheld = ill_waiter_inc(ill);
1052 	mutex_exit(&connp->conn_lock);
1053 	if (refheld) {
1054 		if (ipsq_enter(ill, B_TRUE, NEW_OP)) {
1055 			ill_waiter_dcr(ill);
1056 			/*
1057 			 * Check whether this ioctl has started and is
1058 			 * pending. If it is not found there then check
1059 			 * whether this ioctl has not even started and is in
1060 			 * the ipsq_xopq list.
1061 			 */
1062 			if (!ipsq_pending_mp_cleanup(ill, connp))
1063 				ipsq_xopq_mp_cleanup(ill, connp);
1064 			ipsq = ill->ill_phyint->phyint_ipsq;
1065 			ipsq_exit(ipsq);
1066 			return;
1067 		}
1068 	}
1069 
1070 	/*
1071 	 * The ill is also closing and we could not bump up the
1072 	 * ill_waiter_count or we could not enter the ipsq. Leave
1073 	 * the cleanup to ill_delete
1074 	 */
1075 	mutex_enter(&connp->conn_lock);
1076 	while (connp->conn_oper_pending_ill != NULL)
1077 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1078 	mutex_exit(&connp->conn_lock);
1079 	if (refheld)
1080 		ill_waiter_dcr(ill);
1081 }
1082 
1083 /*
1084  * ipcl_walk function for cleaning up conn_*_ill fields.
1085  * Note that we leave ixa_multicast_ifindex, conn_incoming_ifindex, and
1086  * conn_bound_if in place. We prefer dropping
1087  * packets instead of sending them out the wrong interface, or accepting
1088  * packets from the wrong ifindex.
1089  */
1090 static void
conn_cleanup_ill(conn_t * connp,caddr_t arg)1091 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1092 {
1093 	ill_t	*ill = (ill_t *)arg;
1094 
1095 	mutex_enter(&connp->conn_lock);
1096 	if (connp->conn_dhcpinit_ill == ill) {
1097 		connp->conn_dhcpinit_ill = NULL;
1098 		ASSERT(ill->ill_dhcpinit != 0);
1099 		atomic_dec_32(&ill->ill_dhcpinit);
1100 		ill_set_inputfn(ill);
1101 	}
1102 	mutex_exit(&connp->conn_lock);
1103 }
1104 
1105 static int
ill_down_ipifs_tail(ill_t * ill)1106 ill_down_ipifs_tail(ill_t *ill)
1107 {
1108 	ipif_t	*ipif;
1109 	int err;
1110 
1111 	ASSERT(IAM_WRITER_ILL(ill));
1112 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1113 		ipif_non_duplicate(ipif);
1114 		/*
1115 		 * ipif_down_tail will call arp_ll_down on the last ipif
1116 		 * and typically return EINPROGRESS when the DL_UNBIND is sent.
1117 		 */
1118 		if ((err = ipif_down_tail(ipif)) != 0)
1119 			return (err);
1120 	}
1121 	return (0);
1122 }
1123 
1124 /* ARGSUSED */
1125 void
ipif_all_down_tail(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * dummy_arg)1126 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1127 {
1128 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1129 	(void) ill_down_ipifs_tail(q->q_ptr);
1130 	freemsg(mp);
1131 	ipsq_current_finish(ipsq);
1132 }
1133 
1134 /*
1135  * ill_down_start is called when we want to down this ill and bring it up again
1136  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1137  * all interfaces, but don't tear down any plumbing.
1138  */
1139 boolean_t
ill_down_start(queue_t * q,mblk_t * mp)1140 ill_down_start(queue_t *q, mblk_t *mp)
1141 {
1142 	ill_t	*ill = q->q_ptr;
1143 	ipif_t	*ipif;
1144 
1145 	ASSERT(IAM_WRITER_ILL(ill));
1146 	/*
1147 	 * It is possible that some ioctl is already in progress while we
1148 	 * received the M_ERROR / M_HANGUP in which case, we need to abort
1149 	 * the ioctl. ill_down_start() is being processed as CUR_OP rather
1150 	 * than as NEW_OP since the cause of the M_ERROR / M_HANGUP may prevent
1151 	 * the in progress ioctl from ever completing.
1152 	 *
1153 	 * The thread that started the ioctl (if any) must have returned,
1154 	 * since we are now executing as writer. After the 2 calls below,
1155 	 * the state of the ipsq and the ill would reflect no trace of any
1156 	 * pending operation. Subsequently if there is any response to the
1157 	 * original ioctl from the driver, it would be discarded as an
1158 	 * unsolicited message from the driver.
1159 	 */
1160 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1161 	ill_dlpi_clear_deferred(ill);
1162 
1163 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1164 		(void) ipif_down(ipif, NULL, NULL);
1165 
1166 	ill_down(ill);
1167 
1168 	/*
1169 	 * Walk all CONNs that can have a reference on an ire or nce for this
1170 	 * ill (we actually walk all that now have stale references).
1171 	 */
1172 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ill->ill_ipst);
1173 
1174 	/* With IPv6 we have dce_ifindex. Cleanup for neatness */
1175 	if (ill->ill_isv6)
1176 		dce_cleanup(ill->ill_phyint->phyint_ifindex, ill->ill_ipst);
1177 
1178 	ipsq_current_start(ill->ill_phyint->phyint_ipsq, ill->ill_ipif, 0);
1179 
1180 	/*
1181 	 * Atomically test and add the pending mp if references are active.
1182 	 */
1183 	mutex_enter(&ill->ill_lock);
1184 	if (!ill_is_quiescent(ill)) {
1185 		/* call cannot fail since `conn_t *' argument is NULL */
1186 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1187 		    mp, ILL_DOWN);
1188 		mutex_exit(&ill->ill_lock);
1189 		return (B_FALSE);
1190 	}
1191 	mutex_exit(&ill->ill_lock);
1192 	return (B_TRUE);
1193 }
1194 
1195 static void
ill_down(ill_t * ill)1196 ill_down(ill_t *ill)
1197 {
1198 	mblk_t	*mp;
1199 	ip_stack_t	*ipst = ill->ill_ipst;
1200 
1201 	/*
1202 	 * Blow off any IREs dependent on this ILL.
1203 	 * The caller needs to handle conn_ixa_cleanup
1204 	 */
1205 	ill_delete_ires(ill);
1206 
1207 	ire_walk_ill(0, 0, ill_downi, ill, ill);
1208 
1209 	/* Remove any conn_*_ill depending on this ill */
1210 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill, ipst);
1211 
1212 	/*
1213 	 * Free state for additional IREs.
1214 	 */
1215 	mutex_enter(&ill->ill_saved_ire_lock);
1216 	mp = ill->ill_saved_ire_mp;
1217 	ill->ill_saved_ire_mp = NULL;
1218 	ill->ill_saved_ire_cnt = 0;
1219 	mutex_exit(&ill->ill_saved_ire_lock);
1220 	freemsg(mp);
1221 }
1222 
1223 /*
1224  * ire_walk routine used to delete every IRE that depends on
1225  * 'ill'.  (Always called as writer, and may only be called from ire_walk.)
1226  *
1227  * Note: since the routes added by the kernel are deleted separately,
1228  * this will only be 1) IRE_IF_CLONE and 2) manually added IRE_INTERFACE.
1229  *
1230  * We also remove references on ire_nce_cache entries that refer to the ill.
1231  */
1232 void
ill_downi(ire_t * ire,char * ill_arg)1233 ill_downi(ire_t *ire, char *ill_arg)
1234 {
1235 	ill_t	*ill = (ill_t *)ill_arg;
1236 	nce_t	*nce;
1237 
1238 	mutex_enter(&ire->ire_lock);
1239 	nce = ire->ire_nce_cache;
1240 	if (nce != NULL && nce->nce_ill == ill)
1241 		ire->ire_nce_cache = NULL;
1242 	else
1243 		nce = NULL;
1244 	mutex_exit(&ire->ire_lock);
1245 	if (nce != NULL)
1246 		nce_refrele(nce);
1247 	if (ire->ire_ill == ill) {
1248 		/*
1249 		 * The existing interface binding for ire must be
1250 		 * deleted before trying to bind the route to another
1251 		 * interface. However, since we are using the contents of the
1252 		 * ire after ire_delete, the caller has to ensure that
1253 		 * CONDEMNED (deleted) ire's are not removed from the list
1254 		 * when ire_delete() returns. Currently ill_downi() is
1255 		 * only called as part of ire_walk*() routines, so that
1256 		 * the irb_refhold() done by ire_walk*() will ensure that
1257 		 * ire_delete() does not lead to ire_inactive().
1258 		 */
1259 		ASSERT(ire->ire_bucket->irb_refcnt > 0);
1260 		ire_delete(ire);
1261 		if (ire->ire_unbound)
1262 			ire_rebind(ire);
1263 	}
1264 }
1265 
1266 /* Remove IRE_IF_CLONE on this ill */
1267 void
ill_downi_if_clone(ire_t * ire,char * ill_arg)1268 ill_downi_if_clone(ire_t *ire, char *ill_arg)
1269 {
1270 	ill_t	*ill = (ill_t *)ill_arg;
1271 
1272 	ASSERT(ire->ire_type & IRE_IF_CLONE);
1273 	if (ire->ire_ill == ill)
1274 		ire_delete(ire);
1275 }
1276 
1277 /* Consume an M_IOCACK of the fastpath probe. */
1278 void
ill_fastpath_ack(ill_t * ill,mblk_t * mp)1279 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1280 {
1281 	mblk_t	*mp1 = mp;
1282 
1283 	/*
1284 	 * If this was the first attempt turn on the fastpath probing.
1285 	 */
1286 	mutex_enter(&ill->ill_lock);
1287 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1288 		ill->ill_dlpi_fastpath_state = IDS_OK;
1289 	mutex_exit(&ill->ill_lock);
1290 
1291 	/* Free the M_IOCACK mblk, hold on to the data */
1292 	mp = mp->b_cont;
1293 	freeb(mp1);
1294 	if (mp == NULL)
1295 		return;
1296 	if (mp->b_cont != NULL)
1297 		nce_fastpath_update(ill, mp);
1298 	else
1299 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1300 	freemsg(mp);
1301 }
1302 
1303 /*
1304  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1305  * The data portion of the request is a dl_unitdata_req_t template for
1306  * what we would send downstream in the absence of a fastpath confirmation.
1307  */
1308 int
ill_fastpath_probe(ill_t * ill,mblk_t * dlur_mp)1309 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1310 {
1311 	struct iocblk	*ioc;
1312 	mblk_t	*mp;
1313 
1314 	if (dlur_mp == NULL)
1315 		return (EINVAL);
1316 
1317 	mutex_enter(&ill->ill_lock);
1318 	switch (ill->ill_dlpi_fastpath_state) {
1319 	case IDS_FAILED:
1320 		/*
1321 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1322 		 * support it.
1323 		 */
1324 		mutex_exit(&ill->ill_lock);
1325 		return (ENOTSUP);
1326 	case IDS_UNKNOWN:
1327 		/* This is the first probe */
1328 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1329 		break;
1330 	default:
1331 		break;
1332 	}
1333 	mutex_exit(&ill->ill_lock);
1334 
1335 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1336 		return (EAGAIN);
1337 
1338 	mp->b_cont = copyb(dlur_mp);
1339 	if (mp->b_cont == NULL) {
1340 		freeb(mp);
1341 		return (EAGAIN);
1342 	}
1343 
1344 	ioc = (struct iocblk *)mp->b_rptr;
1345 	ioc->ioc_count = msgdsize(mp->b_cont);
1346 
1347 	DTRACE_PROBE3(ill__dlpi, char *, "ill_fastpath_probe",
1348 	    char *, "DL_IOC_HDR_INFO", ill_t *, ill);
1349 	putnext(ill->ill_wq, mp);
1350 	return (0);
1351 }
1352 
1353 void
ill_capability_probe(ill_t * ill)1354 ill_capability_probe(ill_t *ill)
1355 {
1356 	mblk_t	*mp;
1357 
1358 	ASSERT(IAM_WRITER_ILL(ill));
1359 
1360 	if (ill->ill_dlpi_capab_state != IDCS_UNKNOWN &&
1361 	    ill->ill_dlpi_capab_state != IDCS_FAILED)
1362 		return;
1363 
1364 	/*
1365 	 * We are starting a new cycle of capability negotiation.
1366 	 * Free up the capab reset messages of any previous incarnation.
1367 	 * We will do a fresh allocation when we get the response to our probe
1368 	 */
1369 	if (ill->ill_capab_reset_mp != NULL) {
1370 		freemsg(ill->ill_capab_reset_mp);
1371 		ill->ill_capab_reset_mp = NULL;
1372 	}
1373 
1374 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1375 
1376 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
1377 	if (mp == NULL)
1378 		return;
1379 
1380 	ill_capability_send(ill, mp);
1381 	ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
1382 }
1383 
1384 void
ill_capability_reset(ill_t * ill,boolean_t reneg)1385 ill_capability_reset(ill_t *ill, boolean_t reneg)
1386 {
1387 	ASSERT(IAM_WRITER_ILL(ill));
1388 
1389 	if (ill->ill_dlpi_capab_state != IDCS_OK)
1390 		return;
1391 
1392 	ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
1393 
1394 	ill_capability_send(ill, ill->ill_capab_reset_mp);
1395 	ill->ill_capab_reset_mp = NULL;
1396 	/*
1397 	 * We turn off all capabilities except those pertaining to
1398 	 * direct function call capabilities viz. ILL_CAPAB_DLD*
1399 	 * which will be turned off by the corresponding reset functions.
1400 	 */
1401 	ill->ill_capabilities &= ~(ILL_CAPAB_HCKSUM  | ILL_CAPAB_ZEROCOPY);
1402 }
1403 
1404 static void
ill_capability_reset_alloc(ill_t * ill)1405 ill_capability_reset_alloc(ill_t *ill)
1406 {
1407 	mblk_t *mp;
1408 	size_t	size = 0;
1409 	int	err;
1410 	dl_capability_req_t	*capb;
1411 
1412 	ASSERT(IAM_WRITER_ILL(ill));
1413 	ASSERT(ill->ill_capab_reset_mp == NULL);
1414 
1415 	if (ILL_HCKSUM_CAPABLE(ill)) {
1416 		size += sizeof (dl_capability_sub_t) +
1417 		    sizeof (dl_capab_hcksum_t);
1418 	}
1419 
1420 	if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) {
1421 		size += sizeof (dl_capability_sub_t) +
1422 		    sizeof (dl_capab_zerocopy_t);
1423 	}
1424 
1425 	if (ill->ill_capabilities & ILL_CAPAB_DLD) {
1426 		size += sizeof (dl_capability_sub_t) +
1427 		    sizeof (dl_capab_dld_t);
1428 	}
1429 
1430 	mp = allocb_wait(size + sizeof (dl_capability_req_t), BPRI_MED,
1431 	    STR_NOSIG, &err);
1432 
1433 	mp->b_datap->db_type = M_PROTO;
1434 	bzero(mp->b_rptr, size + sizeof (dl_capability_req_t));
1435 
1436 	capb = (dl_capability_req_t *)mp->b_rptr;
1437 	capb->dl_primitive = DL_CAPABILITY_REQ;
1438 	capb->dl_sub_offset = sizeof (dl_capability_req_t);
1439 	capb->dl_sub_length = size;
1440 
1441 	mp->b_wptr += sizeof (dl_capability_req_t);
1442 
1443 	/*
1444 	 * Each handler fills in the corresponding dl_capability_sub_t
1445 	 * inside the mblk,
1446 	 */
1447 	ill_capability_hcksum_reset_fill(ill, mp);
1448 	ill_capability_zerocopy_reset_fill(ill, mp);
1449 	ill_capability_dld_reset_fill(ill, mp);
1450 
1451 	ill->ill_capab_reset_mp = mp;
1452 }
1453 
1454 static void
ill_capability_id_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * outers)1455 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1456 {
1457 	dl_capab_id_t *id_ic;
1458 	uint_t sub_dl_cap = outers->dl_cap;
1459 	dl_capability_sub_t *inners;
1460 	uint8_t *capend;
1461 
1462 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1463 
1464 	/*
1465 	 * Note: range checks here are not absolutely sufficient to
1466 	 * make us robust against malformed messages sent by drivers;
1467 	 * this is in keeping with the rest of IP's dlpi handling.
1468 	 * (Remember, it's coming from something else in the kernel
1469 	 * address space)
1470 	 */
1471 
1472 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1473 	if (capend > mp->b_wptr) {
1474 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1475 		    "malformed sub-capability too long for mblk");
1476 		return;
1477 	}
1478 
1479 	id_ic = (dl_capab_id_t *)(outers + 1);
1480 
1481 	inners = &id_ic->id_subcap;
1482 	if (outers->dl_length < sizeof (*id_ic) ||
1483 	    inners->dl_length > (outers->dl_length - sizeof (*inners))) {
1484 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1485 		    "encapsulated capab type %d too long for mblk",
1486 		    inners->dl_cap);
1487 		return;
1488 	}
1489 
1490 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1491 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1492 		    "isn't as expected; pass-thru module(s) detected, "
1493 		    "discarding capability\n", inners->dl_cap));
1494 		return;
1495 	}
1496 
1497 	/* Process the encapsulated sub-capability */
1498 	ill_capability_dispatch(ill, mp, inners);
1499 }
1500 
1501 static void
ill_capability_dld_reset_fill(ill_t * ill,mblk_t * mp)1502 ill_capability_dld_reset_fill(ill_t *ill, mblk_t *mp)
1503 {
1504 	dl_capability_sub_t *dl_subcap;
1505 
1506 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
1507 		return;
1508 
1509 	/*
1510 	 * The dl_capab_dld_t that follows the dl_capability_sub_t is not
1511 	 * initialized below since it is not used by DLD.
1512 	 */
1513 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1514 	dl_subcap->dl_cap = DL_CAPAB_DLD;
1515 	dl_subcap->dl_length = sizeof (dl_capab_dld_t);
1516 
1517 	mp->b_wptr += sizeof (dl_capability_sub_t) + sizeof (dl_capab_dld_t);
1518 }
1519 
1520 static void
ill_capability_dispatch(ill_t * ill,mblk_t * mp,dl_capability_sub_t * subp)1521 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp)
1522 {
1523 	/*
1524 	 * If no ipif was brought up over this ill, this DL_CAPABILITY_REQ/ACK
1525 	 * is only to get the VRRP capability.
1526 	 *
1527 	 * Note that we cannot check ill_ipif_up_count here since
1528 	 * ill_ipif_up_count is only incremented when the resolver is setup.
1529 	 * That is done asynchronously, and can race with this function.
1530 	 */
1531 	if (!ill->ill_dl_up) {
1532 		if (subp->dl_cap == DL_CAPAB_VRRP)
1533 			ill_capability_vrrp_ack(ill, mp, subp);
1534 		return;
1535 	}
1536 
1537 	switch (subp->dl_cap) {
1538 	case DL_CAPAB_HCKSUM:
1539 		ill_capability_hcksum_ack(ill, mp, subp);
1540 		break;
1541 	case DL_CAPAB_ZEROCOPY:
1542 		ill_capability_zerocopy_ack(ill, mp, subp);
1543 		break;
1544 	case DL_CAPAB_DLD:
1545 		ill_capability_dld_ack(ill, mp, subp);
1546 		break;
1547 	case DL_CAPAB_VRRP:
1548 		break;
1549 	default:
1550 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
1551 		    subp->dl_cap));
1552 	}
1553 }
1554 
1555 /*
1556  * Process the vrrp capability received from a DLS Provider. isub must point
1557  * to the sub-capability (DL_CAPAB_VRRP) of a DL_CAPABILITY_ACK message.
1558  */
1559 static void
ill_capability_vrrp_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * isub)1560 ill_capability_vrrp_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1561 {
1562 	dl_capab_vrrp_t	*vrrp;
1563 	uint_t		sub_dl_cap = isub->dl_cap;
1564 	uint8_t		*capend;
1565 
1566 	ASSERT(IAM_WRITER_ILL(ill));
1567 	ASSERT(sub_dl_cap == DL_CAPAB_VRRP);
1568 
1569 	/*
1570 	 * Note: range checks here are not absolutely sufficient to
1571 	 * make us robust against malformed messages sent by drivers;
1572 	 * this is in keeping with the rest of IP's dlpi handling.
1573 	 * (Remember, it's coming from something else in the kernel
1574 	 * address space)
1575 	 */
1576 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1577 	if (capend > mp->b_wptr) {
1578 		cmn_err(CE_WARN, "ill_capability_vrrp_ack: "
1579 		    "malformed sub-capability too long for mblk");
1580 		return;
1581 	}
1582 	vrrp = (dl_capab_vrrp_t *)(isub + 1);
1583 
1584 	/*
1585 	 * Compare the IP address family and set ILLF_VRRP for the right ill.
1586 	 */
1587 	if ((vrrp->vrrp_af == AF_INET6 && ill->ill_isv6) ||
1588 	    (vrrp->vrrp_af == AF_INET && !ill->ill_isv6)) {
1589 		ill->ill_flags |= ILLF_VRRP;
1590 	}
1591 }
1592 
1593 /*
1594  * Process a hardware checksum offload capability negotiation ack received
1595  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
1596  * of a DL_CAPABILITY_ACK message.
1597  */
1598 static void
ill_capability_hcksum_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * isub)1599 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1600 {
1601 	dl_capability_req_t	*ocap;
1602 	dl_capab_hcksum_t	*ihck, *ohck;
1603 	ill_hcksum_capab_t	**ill_hcksum;
1604 	mblk_t			*nmp = NULL;
1605 	uint_t			sub_dl_cap = isub->dl_cap;
1606 	uint8_t			*capend;
1607 
1608 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
1609 
1610 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
1611 
1612 	/*
1613 	 * Note: range checks here are not absolutely sufficient to
1614 	 * make us robust against malformed messages sent by drivers;
1615 	 * this is in keeping with the rest of IP's dlpi handling.
1616 	 * (Remember, it's coming from something else in the kernel
1617 	 * address space)
1618 	 */
1619 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1620 	if (capend > mp->b_wptr) {
1621 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1622 		    "malformed sub-capability too long for mblk");
1623 		return;
1624 	}
1625 
1626 	/*
1627 	 * There are two types of acks we process here:
1628 	 * 1. acks in reply to a (first form) generic capability req
1629 	 *    (no ENABLE flag set)
1630 	 * 2. acks in reply to a ENABLE capability req.
1631 	 *    (ENABLE flag set)
1632 	 */
1633 	ihck = (dl_capab_hcksum_t *)(isub + 1);
1634 
1635 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
1636 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
1637 		    "unsupported hardware checksum "
1638 		    "sub-capability (version %d, expected %d)",
1639 		    ihck->hcksum_version, HCKSUM_VERSION_1);
1640 		return;
1641 	}
1642 
1643 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
1644 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
1645 		    "checksum capability isn't as expected; pass-thru "
1646 		    "module(s) detected, discarding capability\n"));
1647 		return;
1648 	}
1649 
1650 #define	CURR_HCKSUM_CAPAB				\
1651 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
1652 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
1653 
1654 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
1655 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
1656 		/* do ENABLE processing */
1657 		if (*ill_hcksum == NULL) {
1658 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
1659 			    KM_NOSLEEP);
1660 
1661 			if (*ill_hcksum == NULL) {
1662 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1663 				    "could not enable hcksum version %d "
1664 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
1665 				    ill->ill_name);
1666 				return;
1667 			}
1668 		}
1669 
1670 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
1671 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
1672 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
1673 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
1674 		    "has enabled hardware checksumming\n ",
1675 		    ill->ill_name));
1676 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
1677 		/*
1678 		 * Enabling hardware checksum offload
1679 		 * Currently IP supports {TCP,UDP}/IPv4
1680 		 * partial and full cksum offload and
1681 		 * IPv4 header checksum offload.
1682 		 * Allocate new mblk which will
1683 		 * contain a new capability request
1684 		 * to enable hardware checksum offload.
1685 		 */
1686 		uint_t	size;
1687 		uchar_t	*rptr;
1688 
1689 		size = sizeof (dl_capability_req_t) +
1690 		    sizeof (dl_capability_sub_t) + isub->dl_length;
1691 
1692 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1693 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1694 			    "could not enable hardware cksum for %s (ENOMEM)\n",
1695 			    ill->ill_name);
1696 			return;
1697 		}
1698 
1699 		rptr = nmp->b_rptr;
1700 		/* initialize dl_capability_req_t */
1701 		ocap = (dl_capability_req_t *)nmp->b_rptr;
1702 		ocap->dl_sub_offset =
1703 		    sizeof (dl_capability_req_t);
1704 		ocap->dl_sub_length =
1705 		    sizeof (dl_capability_sub_t) +
1706 		    isub->dl_length;
1707 		nmp->b_rptr += sizeof (dl_capability_req_t);
1708 
1709 		/* initialize dl_capability_sub_t */
1710 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
1711 		nmp->b_rptr += sizeof (*isub);
1712 
1713 		/* initialize dl_capab_hcksum_t */
1714 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
1715 		bcopy(ihck, ohck, sizeof (*ihck));
1716 
1717 		nmp->b_rptr = rptr;
1718 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
1719 
1720 		/* Set ENABLE flag */
1721 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
1722 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
1723 
1724 		/*
1725 		 * nmp points to a DL_CAPABILITY_REQ message to enable
1726 		 * hardware checksum acceleration.
1727 		 */
1728 		ill_capability_send(ill, nmp);
1729 	} else {
1730 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
1731 		    "advertised %x hardware checksum capability flags\n",
1732 		    ill->ill_name, ihck->hcksum_txflags));
1733 	}
1734 }
1735 
1736 static void
ill_capability_hcksum_reset_fill(ill_t * ill,mblk_t * mp)1737 ill_capability_hcksum_reset_fill(ill_t *ill, mblk_t *mp)
1738 {
1739 	dl_capab_hcksum_t *hck_subcap;
1740 	dl_capability_sub_t *dl_subcap;
1741 
1742 	if (!ILL_HCKSUM_CAPABLE(ill))
1743 		return;
1744 
1745 	ASSERT(ill->ill_hcksum_capab != NULL);
1746 
1747 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1748 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
1749 	dl_subcap->dl_length = sizeof (*hck_subcap);
1750 
1751 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
1752 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
1753 	hck_subcap->hcksum_txflags = 0;
1754 
1755 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*hck_subcap);
1756 }
1757 
1758 static void
ill_capability_zerocopy_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * isub)1759 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1760 {
1761 	mblk_t *nmp = NULL;
1762 	dl_capability_req_t *oc;
1763 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
1764 	ill_zerocopy_capab_t **ill_zerocopy_capab;
1765 	uint_t sub_dl_cap = isub->dl_cap;
1766 	uint8_t *capend;
1767 
1768 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
1769 
1770 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
1771 
1772 	/*
1773 	 * Note: range checks here are not absolutely sufficient to
1774 	 * make us robust against malformed messages sent by drivers;
1775 	 * this is in keeping with the rest of IP's dlpi handling.
1776 	 * (Remember, it's coming from something else in the kernel
1777 	 * address space)
1778 	 */
1779 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1780 	if (capend > mp->b_wptr) {
1781 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1782 		    "malformed sub-capability too long for mblk");
1783 		return;
1784 	}
1785 
1786 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
1787 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
1788 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
1789 		    "unsupported ZEROCOPY sub-capability (version %d, "
1790 		    "expected %d)", zc_ic->zerocopy_version,
1791 		    ZEROCOPY_VERSION_1);
1792 		return;
1793 	}
1794 
1795 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
1796 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
1797 		    "capability isn't as expected; pass-thru module(s) "
1798 		    "detected, discarding capability\n"));
1799 		return;
1800 	}
1801 
1802 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
1803 		if (*ill_zerocopy_capab == NULL) {
1804 			*ill_zerocopy_capab =
1805 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
1806 			    KM_NOSLEEP);
1807 
1808 			if (*ill_zerocopy_capab == NULL) {
1809 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1810 				    "could not enable Zero-copy version %d "
1811 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
1812 				    ill->ill_name);
1813 				return;
1814 			}
1815 		}
1816 
1817 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
1818 		    "supports Zero-copy version %d\n", ill->ill_name,
1819 		    ZEROCOPY_VERSION_1));
1820 
1821 		(*ill_zerocopy_capab)->ill_zerocopy_version =
1822 		    zc_ic->zerocopy_version;
1823 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
1824 		    zc_ic->zerocopy_flags;
1825 
1826 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
1827 	} else {
1828 		uint_t size;
1829 		uchar_t *rptr;
1830 
1831 		size = sizeof (dl_capability_req_t) +
1832 		    sizeof (dl_capability_sub_t) +
1833 		    sizeof (dl_capab_zerocopy_t);
1834 
1835 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1836 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1837 			    "could not enable zerocopy for %s (ENOMEM)\n",
1838 			    ill->ill_name);
1839 			return;
1840 		}
1841 
1842 		rptr = nmp->b_rptr;
1843 		/* initialize dl_capability_req_t */
1844 		oc = (dl_capability_req_t *)rptr;
1845 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
1846 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
1847 		    sizeof (dl_capab_zerocopy_t);
1848 		rptr += sizeof (dl_capability_req_t);
1849 
1850 		/* initialize dl_capability_sub_t */
1851 		bcopy(isub, rptr, sizeof (*isub));
1852 		rptr += sizeof (*isub);
1853 
1854 		/* initialize dl_capab_zerocopy_t */
1855 		zc_oc = (dl_capab_zerocopy_t *)rptr;
1856 		*zc_oc = *zc_ic;
1857 
1858 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
1859 		    "to enable zero-copy version %d\n", ill->ill_name,
1860 		    ZEROCOPY_VERSION_1));
1861 
1862 		/* set VMSAFE_MEM flag */
1863 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
1864 
1865 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
1866 		ill_capability_send(ill, nmp);
1867 	}
1868 }
1869 
1870 static void
ill_capability_zerocopy_reset_fill(ill_t * ill,mblk_t * mp)1871 ill_capability_zerocopy_reset_fill(ill_t *ill, mblk_t *mp)
1872 {
1873 	dl_capab_zerocopy_t *zerocopy_subcap;
1874 	dl_capability_sub_t *dl_subcap;
1875 
1876 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
1877 		return;
1878 
1879 	ASSERT(ill->ill_zerocopy_capab != NULL);
1880 
1881 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1882 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
1883 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
1884 
1885 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
1886 	zerocopy_subcap->zerocopy_version =
1887 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
1888 	zerocopy_subcap->zerocopy_flags = 0;
1889 
1890 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
1891 }
1892 
1893 /*
1894  * DLD capability
1895  * Refer to dld.h for more information regarding the purpose and usage
1896  * of this capability.
1897  */
1898 static void
ill_capability_dld_ack(ill_t * ill,mblk_t * mp,dl_capability_sub_t * isub)1899 ill_capability_dld_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1900 {
1901 	dl_capab_dld_t		*dld_ic, dld;
1902 	uint_t			sub_dl_cap = isub->dl_cap;
1903 	uint8_t			*capend;
1904 	ill_dld_capab_t		*idc;
1905 
1906 	ASSERT(IAM_WRITER_ILL(ill));
1907 	ASSERT(sub_dl_cap == DL_CAPAB_DLD);
1908 
1909 	/*
1910 	 * Note: range checks here are not absolutely sufficient to
1911 	 * make us robust against malformed messages sent by drivers;
1912 	 * this is in keeping with the rest of IP's dlpi handling.
1913 	 * (Remember, it's coming from something else in the kernel
1914 	 * address space)
1915 	 */
1916 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1917 	if (capend > mp->b_wptr) {
1918 		cmn_err(CE_WARN, "ill_capability_dld_ack: "
1919 		    "malformed sub-capability too long for mblk");
1920 		return;
1921 	}
1922 	dld_ic = (dl_capab_dld_t *)(isub + 1);
1923 	if (dld_ic->dld_version != DLD_CURRENT_VERSION) {
1924 		cmn_err(CE_CONT, "ill_capability_dld_ack: "
1925 		    "unsupported DLD sub-capability (version %d, "
1926 		    "expected %d)", dld_ic->dld_version,
1927 		    DLD_CURRENT_VERSION);
1928 		return;
1929 	}
1930 	if (!dlcapabcheckqid(&dld_ic->dld_mid, ill->ill_lmod_rq)) {
1931 		ip1dbg(("ill_capability_dld_ack: mid token for dld "
1932 		    "capability isn't as expected; pass-thru module(s) "
1933 		    "detected, discarding capability\n"));
1934 		return;
1935 	}
1936 
1937 	/*
1938 	 * Copy locally to ensure alignment.
1939 	 */
1940 	bcopy(dld_ic, &dld, sizeof (dl_capab_dld_t));
1941 
1942 	if ((idc = ill->ill_dld_capab) == NULL) {
1943 		idc = kmem_zalloc(sizeof (ill_dld_capab_t), KM_NOSLEEP);
1944 		if (idc == NULL) {
1945 			cmn_err(CE_WARN, "ill_capability_dld_ack: "
1946 			    "could not enable DLD version %d "
1947 			    "for %s (ENOMEM)\n", DLD_CURRENT_VERSION,
1948 			    ill->ill_name);
1949 			return;
1950 		}
1951 		ill->ill_dld_capab = idc;
1952 	}
1953 	idc->idc_capab_df = (ip_capab_func_t)dld.dld_capab;
1954 	idc->idc_capab_dh = (void *)dld.dld_capab_handle;
1955 	ip1dbg(("ill_capability_dld_ack: interface %s "
1956 	    "supports DLD version %d\n", ill->ill_name, DLD_CURRENT_VERSION));
1957 
1958 	ill_capability_dld_enable(ill);
1959 }
1960 
1961 /*
1962  * Typically capability negotiation between IP and the driver happens via
1963  * DLPI message exchange. However GLD also offers a direct function call
1964  * mechanism to exchange the DLD_DIRECT_CAPAB and DLD_POLL_CAPAB capabilities,
1965  * But arbitrary function calls into IP or GLD are not permitted, since both
1966  * of them are protected by their own perimeter mechanism. The perimeter can
1967  * be viewed as a coarse lock or serialization mechanism. The hierarchy of
1968  * these perimeters is IP -> MAC. Thus for example to enable the squeue
1969  * polling, IP needs to enter its perimeter, then call ill_mac_perim_enter
1970  * to enter the mac perimeter and then do the direct function calls into
1971  * GLD to enable squeue polling. The ring related callbacks from the mac into
1972  * the stack to add, bind, quiesce, restart or cleanup a ring are all
1973  * protected by the mac perimeter.
1974  */
1975 static void
ill_mac_perim_enter(ill_t * ill,mac_perim_handle_t * mphp)1976 ill_mac_perim_enter(ill_t *ill, mac_perim_handle_t *mphp)
1977 {
1978 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1979 	int			err;
1980 
1981 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mphp,
1982 	    DLD_ENABLE);
1983 	ASSERT(err == 0);
1984 }
1985 
1986 static void
ill_mac_perim_exit(ill_t * ill,mac_perim_handle_t mph)1987 ill_mac_perim_exit(ill_t *ill, mac_perim_handle_t mph)
1988 {
1989 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1990 	int			err;
1991 
1992 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mph,
1993 	    DLD_DISABLE);
1994 	ASSERT(err == 0);
1995 }
1996 
1997 boolean_t
ill_mac_perim_held(ill_t * ill)1998 ill_mac_perim_held(ill_t *ill)
1999 {
2000 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2001 
2002 	return (idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, NULL,
2003 	    DLD_QUERY));
2004 }
2005 
2006 static void
ill_capability_direct_enable(ill_t * ill)2007 ill_capability_direct_enable(ill_t *ill)
2008 {
2009 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2010 	ill_dld_direct_t	*idd = &idc->idc_direct;
2011 	dld_capab_direct_t	direct;
2012 	int			rc;
2013 
2014 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2015 
2016 	bzero(&direct, sizeof (direct));
2017 	direct.di_rx_cf = (uintptr_t)ip_input;
2018 	direct.di_rx_ch = ill;
2019 
2020 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT, &direct,
2021 	    DLD_ENABLE);
2022 	if (rc == 0) {
2023 		idd->idd_tx_df = (ip_dld_tx_t)direct.di_tx_df;
2024 		idd->idd_tx_dh = direct.di_tx_dh;
2025 		idd->idd_tx_cb_df = (ip_dld_callb_t)direct.di_tx_cb_df;
2026 		idd->idd_tx_cb_dh = direct.di_tx_cb_dh;
2027 		idd->idd_tx_fctl_df = (ip_dld_fctl_t)direct.di_tx_fctl_df;
2028 		idd->idd_tx_fctl_dh = direct.di_tx_fctl_dh;
2029 		ASSERT(idd->idd_tx_cb_df != NULL);
2030 		ASSERT(idd->idd_tx_fctl_df != NULL);
2031 		ASSERT(idd->idd_tx_df != NULL);
2032 		/*
2033 		 * One time registration of flow enable callback function
2034 		 */
2035 		ill->ill_flownotify_mh = idd->idd_tx_cb_df(idd->idd_tx_cb_dh,
2036 		    ill_flow_enable, ill);
2037 		ill->ill_capabilities |= ILL_CAPAB_DLD_DIRECT;
2038 		DTRACE_PROBE1(direct_on, (ill_t *), ill);
2039 	} else {
2040 		cmn_err(CE_WARN, "warning: could not enable DIRECT "
2041 		    "capability, rc = %d\n", rc);
2042 		DTRACE_PROBE2(direct_off, (ill_t *), ill, (int), rc);
2043 	}
2044 }
2045 
2046 static void
ill_capability_poll_enable(ill_t * ill)2047 ill_capability_poll_enable(ill_t *ill)
2048 {
2049 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2050 	dld_capab_poll_t	poll;
2051 	int			rc;
2052 
2053 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2054 
2055 	bzero(&poll, sizeof (poll));
2056 	poll.poll_ring_add_cf = (uintptr_t)ip_squeue_add_ring;
2057 	poll.poll_ring_remove_cf = (uintptr_t)ip_squeue_clean_ring;
2058 	poll.poll_ring_quiesce_cf = (uintptr_t)ip_squeue_quiesce_ring;
2059 	poll.poll_ring_restart_cf = (uintptr_t)ip_squeue_restart_ring;
2060 	poll.poll_ring_bind_cf = (uintptr_t)ip_squeue_bind_ring;
2061 	poll.poll_ring_ch = ill;
2062 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL, &poll,
2063 	    DLD_ENABLE);
2064 	if (rc == 0) {
2065 		ill->ill_capabilities |= ILL_CAPAB_DLD_POLL;
2066 		DTRACE_PROBE1(poll_on, (ill_t *), ill);
2067 	} else {
2068 		ip1dbg(("warning: could not enable POLL "
2069 		    "capability, rc = %d\n", rc));
2070 		DTRACE_PROBE2(poll_off, (ill_t *), ill, (int), rc);
2071 	}
2072 }
2073 
2074 /*
2075  * Enable the LSO capability.
2076  */
2077 static void
ill_capability_lso_enable(ill_t * ill)2078 ill_capability_lso_enable(ill_t *ill)
2079 {
2080 	ill_dld_capab_t	*idc = ill->ill_dld_capab;
2081 	dld_capab_lso_t	lso;
2082 	int rc;
2083 
2084 	ASSERT(IAM_WRITER_ILL(ill));
2085 
2086 	if (ill->ill_lso_capab == NULL) {
2087 		ill->ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
2088 		    KM_NOSLEEP);
2089 		if (ill->ill_lso_capab == NULL) {
2090 			cmn_err(CE_WARN, "ill_capability_lso_enable: "
2091 			    "could not enable LSO for %s (ENOMEM)\n",
2092 			    ill->ill_name);
2093 			return;
2094 		}
2095 	}
2096 
2097 	bzero(&lso, sizeof (lso));
2098 	if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO, &lso,
2099 	    DLD_ENABLE)) == 0) {
2100 		ill->ill_lso_capab->ill_lso_flags = lso.lso_flags;
2101 		ill->ill_lso_capab->ill_lso_max_tcpv4 = lso.lso_max_tcpv4;
2102 		ill->ill_lso_capab->ill_lso_max_tcpv6 = lso.lso_max_tcpv6;
2103 		ill->ill_capabilities |= ILL_CAPAB_LSO;
2104 		ip1dbg(("ill_capability_lso_enable: interface %s "
2105 		    "has enabled LSO\n ", ill->ill_name));
2106 	} else {
2107 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
2108 		ill->ill_lso_capab = NULL;
2109 		DTRACE_PROBE2(lso_off, (ill_t *), ill, (int), rc);
2110 	}
2111 }
2112 
2113 static void
ill_capability_dld_enable(ill_t * ill)2114 ill_capability_dld_enable(ill_t *ill)
2115 {
2116 	mac_perim_handle_t mph;
2117 
2118 	ASSERT(IAM_WRITER_ILL(ill));
2119 
2120 	ill_mac_perim_enter(ill, &mph);
2121 	if (!ill->ill_isv6) {
2122 		ill_capability_direct_enable(ill);
2123 		ill_capability_poll_enable(ill);
2124 	}
2125 	ill_capability_lso_enable(ill);
2126 	ill->ill_capabilities |= ILL_CAPAB_DLD;
2127 	ill_mac_perim_exit(ill, mph);
2128 }
2129 
2130 static void
ill_capability_dld_disable(ill_t * ill)2131 ill_capability_dld_disable(ill_t *ill)
2132 {
2133 	ill_dld_capab_t	*idc;
2134 	ill_dld_direct_t *idd;
2135 	mac_perim_handle_t	mph;
2136 
2137 	ASSERT(IAM_WRITER_ILL(ill));
2138 
2139 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
2140 		return;
2141 
2142 	ill_mac_perim_enter(ill, &mph);
2143 
2144 	idc = ill->ill_dld_capab;
2145 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT) != 0) {
2146 		/*
2147 		 * For performance we avoid locks in the transmit data path
2148 		 * and don't maintain a count of the number of threads using
2149 		 * direct calls. Thus some threads could be using direct
2150 		 * transmit calls to GLD, even after the capability mechanism
2151 		 * turns it off. This is still safe since the handles used in
2152 		 * the direct calls continue to be valid until the unplumb is
2153 		 * completed. Remove the callback that was added (1-time) at
2154 		 * capab enable time.
2155 		 */
2156 		mutex_enter(&ill->ill_lock);
2157 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_DIRECT;
2158 		mutex_exit(&ill->ill_lock);
2159 		if (ill->ill_flownotify_mh != NULL) {
2160 			idd = &idc->idc_direct;
2161 			idd->idd_tx_cb_df(idd->idd_tx_cb_dh, NULL,
2162 			    ill->ill_flownotify_mh);
2163 			ill->ill_flownotify_mh = NULL;
2164 		}
2165 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT,
2166 		    NULL, DLD_DISABLE);
2167 	}
2168 
2169 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_POLL) != 0) {
2170 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_POLL;
2171 		ip_squeue_clean_all(ill);
2172 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL,
2173 		    NULL, DLD_DISABLE);
2174 	}
2175 
2176 	if ((ill->ill_capabilities & ILL_CAPAB_LSO) != 0) {
2177 		ASSERT(ill->ill_lso_capab != NULL);
2178 		/*
2179 		 * Clear the capability flag for LSO but retain the
2180 		 * ill_lso_capab structure since it's possible that another
2181 		 * thread is still referring to it.  The structure only gets
2182 		 * deallocated when we destroy the ill.
2183 		 */
2184 
2185 		ill->ill_capabilities &= ~ILL_CAPAB_LSO;
2186 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO,
2187 		    NULL, DLD_DISABLE);
2188 	}
2189 
2190 	ill->ill_capabilities &= ~ILL_CAPAB_DLD;
2191 	ill_mac_perim_exit(ill, mph);
2192 }
2193 
2194 /*
2195  * Capability Negotiation protocol
2196  *
2197  * We don't wait for DLPI capability operations to finish during interface
2198  * bringup or teardown. Doing so would introduce more asynchrony and the
2199  * interface up/down operations will need multiple return and restarts.
2200  * Instead the 'ipsq_current_ipif' of the ipsq is not cleared as long as
2201  * the 'ill_dlpi_deferred' chain is non-empty. This ensures that the next
2202  * exclusive operation won't start until the DLPI operations of the previous
2203  * exclusive operation complete.
2204  *
2205  * The capability state machine is shown below.
2206  *
2207  * state		next state		event, action
2208  *
2209  * IDCS_UNKNOWN		IDCS_PROBE_SENT		ill_capability_probe
2210  * IDCS_PROBE_SENT	IDCS_OK			ill_capability_ack
2211  * IDCS_PROBE_SENT	IDCS_FAILED		ip_rput_dlpi_writer (nack)
2212  * IDCS_OK		IDCS_RENEG		Receipt of DL_NOTE_CAPAB_RENEG
2213  * IDCS_OK		IDCS_RESET_SENT		ill_capability_reset
2214  * IDCS_RESET_SENT	IDCS_UNKNOWN		ill_capability_ack_thr
2215  * IDCS_RENEG		IDCS_PROBE_SENT		ill_capability_ack_thr ->
2216  *						    ill_capability_probe.
2217  */
2218 
2219 /*
2220  * Dedicated thread started from ip_stack_init that handles capability
2221  * disable. This thread ensures the taskq dispatch does not fail by waiting
2222  * for resources using TQ_SLEEP. The taskq mechanism is used to ensure
2223  * that direct calls to DLD are done in a cv_waitable context.
2224  */
2225 void
ill_taskq_dispatch(ip_stack_t * ipst)2226 ill_taskq_dispatch(ip_stack_t *ipst)
2227 {
2228 	callb_cpr_t cprinfo;
2229 	char	name[64];
2230 	mblk_t	*mp;
2231 
2232 	(void) snprintf(name, sizeof (name), "ill_taskq_dispatch_%d",
2233 	    ipst->ips_netstack->netstack_stackid);
2234 	CALLB_CPR_INIT(&cprinfo, &ipst->ips_capab_taskq_lock, callb_generic_cpr,
2235 	    name);
2236 	mutex_enter(&ipst->ips_capab_taskq_lock);
2237 
2238 	for (;;) {
2239 		mp = ipst->ips_capab_taskq_head;
2240 		while (mp != NULL) {
2241 			ipst->ips_capab_taskq_head = mp->b_next;
2242 			if (ipst->ips_capab_taskq_head == NULL)
2243 				ipst->ips_capab_taskq_tail = NULL;
2244 			mutex_exit(&ipst->ips_capab_taskq_lock);
2245 			mp->b_next = NULL;
2246 
2247 			VERIFY(taskq_dispatch(system_taskq,
2248 			    ill_capability_ack_thr, mp, TQ_SLEEP) !=
2249 			    TASKQID_INVALID);
2250 			mutex_enter(&ipst->ips_capab_taskq_lock);
2251 			mp = ipst->ips_capab_taskq_head;
2252 		}
2253 
2254 		if (ipst->ips_capab_taskq_quit)
2255 			break;
2256 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
2257 		cv_wait(&ipst->ips_capab_taskq_cv, &ipst->ips_capab_taskq_lock);
2258 		CALLB_CPR_SAFE_END(&cprinfo, &ipst->ips_capab_taskq_lock);
2259 	}
2260 	VERIFY(ipst->ips_capab_taskq_head == NULL);
2261 	VERIFY(ipst->ips_capab_taskq_tail == NULL);
2262 	CALLB_CPR_EXIT(&cprinfo);
2263 	thread_exit();
2264 }
2265 
2266 /*
2267  * Consume a new-style hardware capabilities negotiation ack.
2268  * Called via taskq on receipt of DL_CAPABILITY_ACK.
2269  */
2270 static void
ill_capability_ack_thr(void * arg)2271 ill_capability_ack_thr(void *arg)
2272 {
2273 	mblk_t	*mp = arg;
2274 	dl_capability_ack_t *capp;
2275 	dl_capability_sub_t *subp, *endp;
2276 	ill_t	*ill;
2277 	boolean_t reneg;
2278 
2279 	ill = (ill_t *)mp->b_prev;
2280 	mp->b_prev = NULL;
2281 
2282 	VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
2283 
2284 	if (ill->ill_dlpi_capab_state == IDCS_RESET_SENT ||
2285 	    ill->ill_dlpi_capab_state == IDCS_RENEG) {
2286 		/*
2287 		 * We have received the ack for our DL_CAPAB reset request.
2288 		 * There isnt' anything in the message that needs processing.
2289 		 * All message based capabilities have been disabled, now
2290 		 * do the function call based capability disable.
2291 		 */
2292 		reneg = ill->ill_dlpi_capab_state == IDCS_RENEG;
2293 		ill_capability_dld_disable(ill);
2294 		ill->ill_dlpi_capab_state = IDCS_UNKNOWN;
2295 		if (reneg)
2296 			ill_capability_probe(ill);
2297 		goto done;
2298 	}
2299 
2300 	if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
2301 		ill->ill_dlpi_capab_state = IDCS_OK;
2302 
2303 	capp = (dl_capability_ack_t *)mp->b_rptr;
2304 
2305 	if (capp->dl_sub_length == 0) {
2306 		/* no new-style capabilities */
2307 		goto done;
2308 	}
2309 
2310 	/* make sure the driver supplied correct dl_sub_length */
2311 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
2312 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
2313 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
2314 		goto done;
2315 	}
2316 
2317 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
2318 	/*
2319 	 * There are sub-capabilities. Process the ones we know about.
2320 	 * Loop until we don't have room for another sub-cap header..
2321 	 */
2322 	for (subp = SC(capp, capp->dl_sub_offset),
2323 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
2324 	    subp <= endp;
2325 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
2326 
2327 		switch (subp->dl_cap) {
2328 		case DL_CAPAB_ID_WRAPPER:
2329 			ill_capability_id_ack(ill, mp, subp);
2330 			break;
2331 		default:
2332 			ill_capability_dispatch(ill, mp, subp);
2333 			break;
2334 		}
2335 	}
2336 #undef SC
2337 done:
2338 	inet_freemsg(mp);
2339 	ill_capability_done(ill);
2340 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
2341 }
2342 
2343 /*
2344  * This needs to be started in a taskq thread to provide a cv_waitable
2345  * context.
2346  */
2347 void
ill_capability_ack(ill_t * ill,mblk_t * mp)2348 ill_capability_ack(ill_t *ill, mblk_t *mp)
2349 {
2350 	ip_stack_t	*ipst = ill->ill_ipst;
2351 
2352 	mp->b_prev = (mblk_t *)ill;
2353 	ASSERT(mp->b_next == NULL);
2354 
2355 	if (taskq_dispatch(system_taskq, ill_capability_ack_thr, mp,
2356 	    TQ_NOSLEEP) != TASKQID_INVALID)
2357 		return;
2358 
2359 	/*
2360 	 * The taskq dispatch failed. Signal the ill_taskq_dispatch thread
2361 	 * which will do the dispatch using TQ_SLEEP to guarantee success.
2362 	 */
2363 	mutex_enter(&ipst->ips_capab_taskq_lock);
2364 	if (ipst->ips_capab_taskq_head == NULL) {
2365 		ASSERT(ipst->ips_capab_taskq_tail == NULL);
2366 		ipst->ips_capab_taskq_head = mp;
2367 	} else {
2368 		ipst->ips_capab_taskq_tail->b_next = mp;
2369 	}
2370 	ipst->ips_capab_taskq_tail = mp;
2371 
2372 	cv_signal(&ipst->ips_capab_taskq_cv);
2373 	mutex_exit(&ipst->ips_capab_taskq_lock);
2374 }
2375 
2376 /*
2377  * This routine is called to scan the fragmentation reassembly table for
2378  * the specified ILL for any packets that are starting to smell.
2379  * dead_interval is the maximum time in seconds that will be tolerated.  It
2380  * will either be the value specified in ip_g_frag_timeout, or zero if the
2381  * ILL is shutting down and it is time to blow everything off.
2382  *
2383  * It returns the number of seconds (as a time_t) that the next frag timer
2384  * should be scheduled for, 0 meaning that the timer doesn't need to be
2385  * re-started.  Note that the method of calculating next_timeout isn't
2386  * entirely accurate since time will flow between the time we grab
2387  * current_time and the time we schedule the next timeout.  This isn't a
2388  * big problem since this is the timer for sending an ICMP reassembly time
2389  * exceeded messages, and it doesn't have to be exactly accurate.
2390  *
2391  * This function is
2392  * sometimes called as writer, although this is not required.
2393  */
2394 time_t
ill_frag_timeout(ill_t * ill,time_t dead_interval)2395 ill_frag_timeout(ill_t *ill, time_t dead_interval)
2396 {
2397 	ipfb_t	*ipfb;
2398 	ipfb_t	*endp;
2399 	ipf_t	*ipf;
2400 	ipf_t	*ipfnext;
2401 	mblk_t	*mp;
2402 	time_t	current_time = gethrestime_sec();
2403 	time_t	next_timeout = 0;
2404 	uint32_t	hdr_length;
2405 	mblk_t	*send_icmp_head;
2406 	mblk_t	*send_icmp_head_v6;
2407 	ip_stack_t *ipst = ill->ill_ipst;
2408 	ip_recv_attr_t iras;
2409 
2410 	bzero(&iras, sizeof (iras));
2411 	iras.ira_flags = 0;
2412 	iras.ira_ill = iras.ira_rill = ill;
2413 	iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
2414 	iras.ira_rifindex = iras.ira_ruifindex;
2415 
2416 	ipfb = ill->ill_frag_hash_tbl;
2417 	if (ipfb == NULL)
2418 		return (B_FALSE);
2419 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
2420 	/* Walk the frag hash table. */
2421 	for (; ipfb < endp; ipfb++) {
2422 		send_icmp_head = NULL;
2423 		send_icmp_head_v6 = NULL;
2424 		mutex_enter(&ipfb->ipfb_lock);
2425 		while ((ipf = ipfb->ipfb_ipf) != 0) {
2426 			time_t frag_time = current_time - ipf->ipf_timestamp;
2427 			time_t frag_timeout;
2428 
2429 			if (frag_time < dead_interval) {
2430 				/*
2431 				 * There are some outstanding fragments
2432 				 * that will timeout later.  Make note of
2433 				 * the time so that we can reschedule the
2434 				 * next timeout appropriately.
2435 				 */
2436 				frag_timeout = dead_interval - frag_time;
2437 				if (next_timeout == 0 ||
2438 				    frag_timeout < next_timeout) {
2439 					next_timeout = frag_timeout;
2440 				}
2441 				break;
2442 			}
2443 			/* Time's up.  Get it out of here. */
2444 			hdr_length = ipf->ipf_nf_hdr_len;
2445 			ipfnext = ipf->ipf_hash_next;
2446 			if (ipfnext)
2447 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
2448 			*ipf->ipf_ptphn = ipfnext;
2449 			mp = ipf->ipf_mp->b_cont;
2450 			for (; mp; mp = mp->b_cont) {
2451 				/* Extra points for neatness. */
2452 				IP_REASS_SET_START(mp, 0);
2453 				IP_REASS_SET_END(mp, 0);
2454 			}
2455 			mp = ipf->ipf_mp->b_cont;
2456 			atomic_add_32(&ill->ill_frag_count, -ipf->ipf_count);
2457 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
2458 			ipfb->ipfb_count -= ipf->ipf_count;
2459 			ASSERT(ipfb->ipfb_frag_pkts > 0);
2460 			ipfb->ipfb_frag_pkts--;
2461 			/*
2462 			 * We do not send any icmp message from here because
2463 			 * we currently are holding the ipfb_lock for this
2464 			 * hash chain. If we try and send any icmp messages
2465 			 * from here we may end up via a put back into ip
2466 			 * trying to get the same lock, causing a recursive
2467 			 * mutex panic. Instead we build a list and send all
2468 			 * the icmp messages after we have dropped the lock.
2469 			 */
2470 			if (ill->ill_isv6) {
2471 				if (hdr_length != 0) {
2472 					mp->b_next = send_icmp_head_v6;
2473 					send_icmp_head_v6 = mp;
2474 				} else {
2475 					freemsg(mp);
2476 				}
2477 			} else {
2478 				if (hdr_length != 0) {
2479 					mp->b_next = send_icmp_head;
2480 					send_icmp_head = mp;
2481 				} else {
2482 					freemsg(mp);
2483 				}
2484 			}
2485 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2486 			ip_drop_input("ipIfStatsReasmFails", ipf->ipf_mp, ill);
2487 			freeb(ipf->ipf_mp);
2488 		}
2489 		mutex_exit(&ipfb->ipfb_lock);
2490 		/*
2491 		 * Now need to send any icmp messages that we delayed from
2492 		 * above.
2493 		 */
2494 		while (send_icmp_head_v6 != NULL) {
2495 			ip6_t *ip6h;
2496 
2497 			mp = send_icmp_head_v6;
2498 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
2499 			mp->b_next = NULL;
2500 			ip6h = (ip6_t *)mp->b_rptr;
2501 			iras.ira_flags = 0;
2502 			/*
2503 			 * This will result in an incorrect ALL_ZONES zoneid
2504 			 * for multicast packets, but we
2505 			 * don't send ICMP errors for those in any case.
2506 			 */
2507 			iras.ira_zoneid =
2508 			    ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
2509 			    ill, ipst);
2510 			ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2511 			icmp_time_exceeded_v6(mp,
2512 			    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
2513 			    &iras);
2514 			ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2515 		}
2516 		while (send_icmp_head != NULL) {
2517 			ipaddr_t dst;
2518 
2519 			mp = send_icmp_head;
2520 			send_icmp_head = send_icmp_head->b_next;
2521 			mp->b_next = NULL;
2522 
2523 			dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
2524 
2525 			iras.ira_flags = IRAF_IS_IPV4;
2526 			/*
2527 			 * This will result in an incorrect ALL_ZONES zoneid
2528 			 * for broadcast and multicast packets, but we
2529 			 * don't send ICMP errors for those in any case.
2530 			 */
2531 			iras.ira_zoneid = ipif_lookup_addr_zoneid(dst,
2532 			    ill, ipst);
2533 			ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2534 			icmp_time_exceeded(mp,
2535 			    ICMP_REASSEMBLY_TIME_EXCEEDED, &iras);
2536 			ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2537 		}
2538 	}
2539 	/*
2540 	 * A non-dying ILL will use the return value to decide whether to
2541 	 * restart the frag timer, and for how long.
2542 	 */
2543 	return (next_timeout);
2544 }
2545 
2546 /*
2547  * This routine is called when the approximate count of mblk memory used
2548  * for the specified ILL has exceeded max_count.
2549  */
2550 void
ill_frag_prune(ill_t * ill,uint_t max_count)2551 ill_frag_prune(ill_t *ill, uint_t max_count)
2552 {
2553 	ipfb_t	*ipfb;
2554 	ipf_t	*ipf;
2555 	size_t	count;
2556 	clock_t now;
2557 
2558 	/*
2559 	 * If we are here within ip_min_frag_prune_time msecs remove
2560 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
2561 	 * ill_frag_free_num_pkts.
2562 	 */
2563 	mutex_enter(&ill->ill_lock);
2564 	now = ddi_get_lbolt();
2565 	if (TICK_TO_MSEC(now - ill->ill_last_frag_clean_time) <=
2566 	    (ip_min_frag_prune_time != 0 ?
2567 	    ip_min_frag_prune_time : msec_per_tick)) {
2568 
2569 		ill->ill_frag_free_num_pkts++;
2570 
2571 	} else {
2572 		ill->ill_frag_free_num_pkts = 0;
2573 	}
2574 	ill->ill_last_frag_clean_time = now;
2575 	mutex_exit(&ill->ill_lock);
2576 
2577 	/*
2578 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
2579 	 */
2580 	if (ill->ill_frag_free_num_pkts != 0) {
2581 		int ix;
2582 
2583 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2584 			ipfb = &ill->ill_frag_hash_tbl[ix];
2585 			mutex_enter(&ipfb->ipfb_lock);
2586 			if (ipfb->ipfb_ipf != NULL) {
2587 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
2588 				    ill->ill_frag_free_num_pkts);
2589 			}
2590 			mutex_exit(&ipfb->ipfb_lock);
2591 		}
2592 	}
2593 	/*
2594 	 * While the reassembly list for this ILL is too big, prune a fragment
2595 	 * queue by age, oldest first.
2596 	 */
2597 	while (ill->ill_frag_count > max_count) {
2598 		int	ix;
2599 		ipfb_t	*oipfb = NULL;
2600 		uint_t	oldest = UINT_MAX;
2601 
2602 		count = 0;
2603 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2604 			ipfb = &ill->ill_frag_hash_tbl[ix];
2605 			mutex_enter(&ipfb->ipfb_lock);
2606 			ipf = ipfb->ipfb_ipf;
2607 			if (ipf != NULL && ipf->ipf_gen < oldest) {
2608 				oldest = ipf->ipf_gen;
2609 				oipfb = ipfb;
2610 			}
2611 			count += ipfb->ipfb_count;
2612 			mutex_exit(&ipfb->ipfb_lock);
2613 		}
2614 		if (oipfb == NULL)
2615 			break;
2616 
2617 		if (count <= max_count)
2618 			return;	/* Somebody beat us to it, nothing to do */
2619 		mutex_enter(&oipfb->ipfb_lock);
2620 		ipf = oipfb->ipfb_ipf;
2621 		if (ipf != NULL) {
2622 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
2623 		}
2624 		mutex_exit(&oipfb->ipfb_lock);
2625 	}
2626 }
2627 
2628 /*
2629  * free 'free_cnt' fragmented packets starting at ipf.
2630  */
2631 void
ill_frag_free_pkts(ill_t * ill,ipfb_t * ipfb,ipf_t * ipf,int free_cnt)2632 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
2633 {
2634 	size_t	count;
2635 	mblk_t	*mp;
2636 	mblk_t	*tmp;
2637 	ipf_t **ipfp = ipf->ipf_ptphn;
2638 
2639 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
2640 	ASSERT(ipfp != NULL);
2641 	ASSERT(ipf != NULL);
2642 
2643 	while (ipf != NULL && free_cnt-- > 0) {
2644 		count = ipf->ipf_count;
2645 		mp = ipf->ipf_mp;
2646 		ipf = ipf->ipf_hash_next;
2647 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
2648 			IP_REASS_SET_START(tmp, 0);
2649 			IP_REASS_SET_END(tmp, 0);
2650 		}
2651 		atomic_add_32(&ill->ill_frag_count, -count);
2652 		ASSERT(ipfb->ipfb_count >= count);
2653 		ipfb->ipfb_count -= count;
2654 		ASSERT(ipfb->ipfb_frag_pkts > 0);
2655 		ipfb->ipfb_frag_pkts--;
2656 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2657 		ip_drop_input("ipIfStatsReasmFails", mp, ill);
2658 		freemsg(mp);
2659 	}
2660 
2661 	if (ipf)
2662 		ipf->ipf_ptphn = ipfp;
2663 	ipfp[0] = ipf;
2664 }
2665 
2666 /*
2667  * Helper function for ill_forward_set().
2668  */
2669 static void
ill_forward_set_on_ill(ill_t * ill,boolean_t enable)2670 ill_forward_set_on_ill(ill_t *ill, boolean_t enable)
2671 {
2672 	ip_stack_t	*ipst = ill->ill_ipst;
2673 
2674 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2675 
2676 	ip1dbg(("ill_forward_set: %s %s forwarding on %s",
2677 	    (enable ? "Enabling" : "Disabling"),
2678 	    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
2679 	mutex_enter(&ill->ill_lock);
2680 	if (enable)
2681 		ill->ill_flags |= ILLF_ROUTER;
2682 	else
2683 		ill->ill_flags &= ~ILLF_ROUTER;
2684 	mutex_exit(&ill->ill_lock);
2685 	if (ill->ill_isv6)
2686 		ill_set_nce_router_flags(ill, enable);
2687 	/* Notify routing socket listeners of this change. */
2688 	if (ill->ill_ipif != NULL)
2689 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
2690 }
2691 
2692 /*
2693  * Set an ill's ILLF_ROUTER flag appropriately.  Send up RTS_IFINFO routing
2694  * socket messages for each interface whose flags we change.
2695  */
2696 int
ill_forward_set(ill_t * ill,boolean_t enable)2697 ill_forward_set(ill_t *ill, boolean_t enable)
2698 {
2699 	ipmp_illgrp_t *illg;
2700 	ip_stack_t *ipst = ill->ill_ipst;
2701 
2702 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2703 
2704 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
2705 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)))
2706 		return (0);
2707 
2708 	if (IS_LOOPBACK(ill))
2709 		return (EINVAL);
2710 
2711 	if (enable && ill->ill_allowed_ips_cnt > 0)
2712 		return (EPERM);
2713 
2714 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
2715 		/*
2716 		 * Update all of the interfaces in the group.
2717 		 */
2718 		illg = ill->ill_grp;
2719 		ill = list_head(&illg->ig_if);
2720 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill))
2721 			ill_forward_set_on_ill(ill, enable);
2722 
2723 		/*
2724 		 * Update the IPMP meta-interface.
2725 		 */
2726 		ill_forward_set_on_ill(ipmp_illgrp_ipmp_ill(illg), enable);
2727 		return (0);
2728 	}
2729 
2730 	ill_forward_set_on_ill(ill, enable);
2731 	return (0);
2732 }
2733 
2734 /*
2735  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
2736  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
2737  * set or clear.
2738  */
2739 static void
ill_set_nce_router_flags(ill_t * ill,boolean_t enable)2740 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
2741 {
2742 	ipif_t *ipif;
2743 	ncec_t *ncec;
2744 	nce_t *nce;
2745 
2746 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
2747 		/*
2748 		 * NOTE: we match across the illgrp because nce's for
2749 		 * addresses on IPMP interfaces have an nce_ill that points to
2750 		 * the bound underlying ill.
2751 		 */
2752 		nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
2753 		if (nce != NULL) {
2754 			ncec = nce->nce_common;
2755 			mutex_enter(&ncec->ncec_lock);
2756 			if (enable)
2757 				ncec->ncec_flags |= NCE_F_ISROUTER;
2758 			else
2759 				ncec->ncec_flags &= ~NCE_F_ISROUTER;
2760 			mutex_exit(&ncec->ncec_lock);
2761 			nce_refrele(nce);
2762 		}
2763 	}
2764 }
2765 
2766 /*
2767  * Intializes the context structure and returns the first ill in the list
2768  * cuurently start_list and end_list can have values:
2769  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
2770  * IP_V4_G_HEAD		Traverse IPV4 list only.
2771  * IP_V6_G_HEAD		Traverse IPV6 list only.
2772  */
2773 
2774 /*
2775  * We don't check for CONDEMNED ills here. Caller must do that if
2776  * necessary under the ill lock.
2777  */
2778 ill_t *
ill_first(int start_list,int end_list,ill_walk_context_t * ctx,ip_stack_t * ipst)2779 ill_first(int start_list, int end_list, ill_walk_context_t *ctx,
2780     ip_stack_t *ipst)
2781 {
2782 	ill_if_t *ifp;
2783 	ill_t *ill;
2784 	avl_tree_t *avl_tree;
2785 
2786 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
2787 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
2788 
2789 	/*
2790 	 * setup the lists to search
2791 	 */
2792 	if (end_list != MAX_G_HEADS) {
2793 		ctx->ctx_current_list = start_list;
2794 		ctx->ctx_last_list = end_list;
2795 	} else {
2796 		ctx->ctx_last_list = MAX_G_HEADS - 1;
2797 		ctx->ctx_current_list = 0;
2798 	}
2799 
2800 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
2801 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2802 		if (ifp != (ill_if_t *)
2803 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2804 			avl_tree = &ifp->illif_avl_by_ppa;
2805 			ill = avl_first(avl_tree);
2806 			/*
2807 			 * ill is guaranteed to be non NULL or ifp should have
2808 			 * not existed.
2809 			 */
2810 			ASSERT(ill != NULL);
2811 			return (ill);
2812 		}
2813 		ctx->ctx_current_list++;
2814 	}
2815 
2816 	return (NULL);
2817 }
2818 
2819 /*
2820  * returns the next ill in the list. ill_first() must have been called
2821  * before calling ill_next() or bad things will happen.
2822  */
2823 
2824 /*
2825  * We don't check for CONDEMNED ills here. Caller must do that if
2826  * necessary under the ill lock.
2827  */
2828 ill_t *
ill_next(ill_walk_context_t * ctx,ill_t * lastill)2829 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
2830 {
2831 	ill_if_t *ifp;
2832 	ill_t *ill;
2833 	ip_stack_t	*ipst = lastill->ill_ipst;
2834 
2835 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
2836 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst));
2837 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
2838 	    AVL_AFTER)) != NULL) {
2839 		return (ill);
2840 	}
2841 
2842 	/* goto next ill_ifp in the list. */
2843 	ifp = lastill->ill_ifptr->illif_next;
2844 
2845 	/* make sure not at end of circular list */
2846 	while (ifp ==
2847 	    (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2848 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
2849 			return (NULL);
2850 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2851 	}
2852 
2853 	return (avl_first(&ifp->illif_avl_by_ppa));
2854 }
2855 
2856 /*
2857  * Check interface name for correct format: [a-zA-Z]+[a-zA-Z0-9._]*[0-9]+
2858  * The final number (PPA) must not have any leading zeros.  Upon success, a
2859  * pointer to the start of the PPA is returned; otherwise NULL is returned.
2860  */
2861 static char *
ill_get_ppa_ptr(char * name)2862 ill_get_ppa_ptr(char *name)
2863 {
2864 	int namelen = strlen(name);
2865 	int end_ndx = namelen - 1;
2866 	int ppa_ndx, i;
2867 
2868 	/*
2869 	 * Check that the first character is [a-zA-Z], and that the last
2870 	 * character is [0-9].
2871 	 */
2872 	if (namelen == 0 || !isalpha(name[0]) || !isdigit(name[end_ndx]))
2873 		return (NULL);
2874 
2875 	/*
2876 	 * Set `ppa_ndx' to the PPA start, and check for leading zeroes.
2877 	 */
2878 	for (ppa_ndx = end_ndx; ppa_ndx > 0; ppa_ndx--)
2879 		if (!isdigit(name[ppa_ndx - 1]))
2880 			break;
2881 
2882 	if (name[ppa_ndx] == '0' && ppa_ndx < end_ndx)
2883 		return (NULL);
2884 
2885 	/*
2886 	 * Check that the intermediate characters are [a-z0-9.]
2887 	 */
2888 	for (i = 1; i < ppa_ndx; i++) {
2889 		if (!isalpha(name[i]) && !isdigit(name[i]) &&
2890 		    name[i] != '.' && name[i] != '_') {
2891 			return (NULL);
2892 		}
2893 	}
2894 
2895 	return (name + ppa_ndx);
2896 }
2897 
2898 /*
2899  * use avl tree to locate the ill.
2900  */
2901 static ill_t *
ill_find_by_name(char * name,boolean_t isv6,ip_stack_t * ipst)2902 ill_find_by_name(char *name, boolean_t isv6, ip_stack_t *ipst)
2903 {
2904 	char *ppa_ptr = NULL;
2905 	int len;
2906 	uint_t ppa;
2907 	ill_t *ill = NULL;
2908 	ill_if_t *ifp;
2909 	int list;
2910 
2911 	/*
2912 	 * get ppa ptr
2913 	 */
2914 	if (isv6)
2915 		list = IP_V6_G_HEAD;
2916 	else
2917 		list = IP_V4_G_HEAD;
2918 
2919 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
2920 		return (NULL);
2921 	}
2922 
2923 	len = ppa_ptr - name + 1;
2924 
2925 	ppa = stoi(&ppa_ptr);
2926 
2927 	ifp = IP_VX_ILL_G_LIST(list, ipst);
2928 
2929 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2930 		/*
2931 		 * match is done on len - 1 as the name is not null
2932 		 * terminated it contains ppa in addition to the interface
2933 		 * name.
2934 		 */
2935 		if ((ifp->illif_name_len == len) &&
2936 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
2937 			break;
2938 		} else {
2939 			ifp = ifp->illif_next;
2940 		}
2941 	}
2942 
2943 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2944 		/*
2945 		 * Even the interface type does not exist.
2946 		 */
2947 		return (NULL);
2948 	}
2949 
2950 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
2951 	if (ill != NULL) {
2952 		mutex_enter(&ill->ill_lock);
2953 		if (ILL_CAN_LOOKUP(ill)) {
2954 			ill_refhold_locked(ill);
2955 			mutex_exit(&ill->ill_lock);
2956 			return (ill);
2957 		}
2958 		mutex_exit(&ill->ill_lock);
2959 	}
2960 	return (NULL);
2961 }
2962 
2963 /*
2964  * comparison function for use with avl.
2965  */
2966 static int
ill_compare_ppa(const void * ppa_ptr,const void * ill_ptr)2967 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
2968 {
2969 	uint_t ppa;
2970 	uint_t ill_ppa;
2971 
2972 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
2973 
2974 	ppa = *((uint_t *)ppa_ptr);
2975 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
2976 	/*
2977 	 * We want the ill with the lowest ppa to be on the
2978 	 * top.
2979 	 */
2980 	if (ill_ppa < ppa)
2981 		return (1);
2982 	if (ill_ppa > ppa)
2983 		return (-1);
2984 	return (0);
2985 }
2986 
2987 /*
2988  * remove an interface type from the global list.
2989  */
2990 static void
ill_delete_interface_type(ill_if_t * interface)2991 ill_delete_interface_type(ill_if_t *interface)
2992 {
2993 	ASSERT(interface != NULL);
2994 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
2995 
2996 	avl_destroy(&interface->illif_avl_by_ppa);
2997 	if (interface->illif_ppa_arena != NULL)
2998 		vmem_destroy(interface->illif_ppa_arena);
2999 
3000 	remque(interface);
3001 
3002 	mi_free(interface);
3003 }
3004 
3005 /*
3006  * remove ill from the global list.
3007  */
3008 static void
ill_glist_delete(ill_t * ill)3009 ill_glist_delete(ill_t *ill)
3010 {
3011 	ip_stack_t	*ipst;
3012 	phyint_t	*phyi;
3013 
3014 	if (ill == NULL)
3015 		return;
3016 	ipst = ill->ill_ipst;
3017 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3018 
3019 	/*
3020 	 * If the ill was never inserted into the AVL tree
3021 	 * we skip the if branch.
3022 	 */
3023 	if (ill->ill_ifptr != NULL) {
3024 		/*
3025 		 * remove from AVL tree and free ppa number
3026 		 */
3027 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
3028 
3029 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
3030 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
3031 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3032 		}
3033 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
3034 			ill_delete_interface_type(ill->ill_ifptr);
3035 		}
3036 
3037 		/*
3038 		 * Indicate ill is no longer in the list.
3039 		 */
3040 		ill->ill_ifptr = NULL;
3041 		ill->ill_name_length = 0;
3042 		ill->ill_name[0] = '\0';
3043 		ill->ill_ppa = UINT_MAX;
3044 	}
3045 
3046 	/* Generate one last event for this ill. */
3047 	ill_nic_event_dispatch(ill, 0, NE_UNPLUMB, ill->ill_name,
3048 	    ill->ill_name_length);
3049 
3050 	ASSERT(ill->ill_phyint != NULL);
3051 	phyi = ill->ill_phyint;
3052 	ill->ill_phyint = NULL;
3053 
3054 	/*
3055 	 * ill_init allocates a phyint always to store the copy
3056 	 * of flags relevant to phyint. At that point in time, we could
3057 	 * not assign the name and hence phyint_illv4/v6 could not be
3058 	 * initialized. Later in ipif_set_values, we assign the name to
3059 	 * the ill, at which point in time we assign phyint_illv4/v6.
3060 	 * Thus we don't rely on phyint_illv6 to be initialized always.
3061 	 */
3062 	if (ill->ill_flags & ILLF_IPV6)
3063 		phyi->phyint_illv6 = NULL;
3064 	else
3065 		phyi->phyint_illv4 = NULL;
3066 
3067 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL) {
3068 		rw_exit(&ipst->ips_ill_g_lock);
3069 		return;
3070 	}
3071 
3072 	/*
3073 	 * There are no ills left on this phyint; pull it out of the phyint
3074 	 * avl trees, and free it.
3075 	 */
3076 	if (phyi->phyint_ifindex > 0) {
3077 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3078 		    phyi);
3079 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
3080 		    phyi);
3081 	}
3082 	rw_exit(&ipst->ips_ill_g_lock);
3083 
3084 	phyint_free(phyi);
3085 }
3086 
3087 /*
3088  * allocate a ppa, if the number of plumbed interfaces of this type are
3089  * less than ill_no_arena do a linear search to find a unused ppa.
3090  * When the number goes beyond ill_no_arena switch to using an arena.
3091  * Note: ppa value of zero cannot be allocated from vmem_arena as it
3092  * is the return value for an error condition, so allocation starts at one
3093  * and is decremented by one.
3094  */
3095 static int
ill_alloc_ppa(ill_if_t * ifp,ill_t * ill)3096 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
3097 {
3098 	ill_t *tmp_ill;
3099 	uint_t start, end;
3100 	int ppa;
3101 
3102 	if (ifp->illif_ppa_arena == NULL &&
3103 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
3104 		/*
3105 		 * Create an arena.
3106 		 */
3107 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
3108 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
3109 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
3110 			/* allocate what has already been assigned */
3111 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
3112 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
3113 		    tmp_ill, AVL_AFTER)) {
3114 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3115 			    1,		/* size */
3116 			    1,		/* align/quantum */
3117 			    0,		/* phase */
3118 			    0,		/* nocross */
3119 			    /* minaddr */
3120 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 1),
3121 			    /* maxaddr */
3122 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 2),
3123 			    VM_NOSLEEP|VM_FIRSTFIT);
3124 			if (ppa == 0) {
3125 				ip1dbg(("ill_alloc_ppa: ppa allocation"
3126 				    " failed while switching"));
3127 				vmem_destroy(ifp->illif_ppa_arena);
3128 				ifp->illif_ppa_arena = NULL;
3129 				break;
3130 			}
3131 		}
3132 	}
3133 
3134 	if (ifp->illif_ppa_arena != NULL) {
3135 		if (ill->ill_ppa == UINT_MAX) {
3136 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
3137 			    1, VM_NOSLEEP|VM_FIRSTFIT);
3138 			if (ppa == 0)
3139 				return (EAGAIN);
3140 			ill->ill_ppa = --ppa;
3141 		} else {
3142 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3143 			    1,		/* size */
3144 			    1,		/* align/quantum */
3145 			    0,		/* phase */
3146 			    0,		/* nocross */
3147 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
3148 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
3149 			    VM_NOSLEEP|VM_FIRSTFIT);
3150 			/*
3151 			 * Most likely the allocation failed because
3152 			 * the requested ppa was in use.
3153 			 */
3154 			if (ppa == 0)
3155 				return (EEXIST);
3156 		}
3157 		return (0);
3158 	}
3159 
3160 	/*
3161 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
3162 	 * been plumbed to create one. Do a linear search to get a unused ppa.
3163 	 */
3164 	if (ill->ill_ppa == UINT_MAX) {
3165 		end = UINT_MAX - 1;
3166 		start = 0;
3167 	} else {
3168 		end = start = ill->ill_ppa;
3169 	}
3170 
3171 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
3172 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
3173 		if (start++ >= end) {
3174 			if (ill->ill_ppa == UINT_MAX)
3175 				return (EAGAIN);
3176 			else
3177 				return (EEXIST);
3178 		}
3179 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
3180 	}
3181 	ill->ill_ppa = start;
3182 	return (0);
3183 }
3184 
3185 /*
3186  * Insert ill into the list of configured ill's. Once this function completes,
3187  * the ill is globally visible and is available through lookups. More precisely
3188  * this happens after the caller drops the ill_g_lock.
3189  */
3190 static int
ill_glist_insert(ill_t * ill,char * name,boolean_t isv6)3191 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
3192 {
3193 	ill_if_t *ill_interface;
3194 	avl_index_t where = 0;
3195 	int error;
3196 	int name_length;
3197 	int index;
3198 	boolean_t check_length = B_FALSE;
3199 	ip_stack_t	*ipst = ill->ill_ipst;
3200 
3201 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
3202 
3203 	name_length = mi_strlen(name) + 1;
3204 
3205 	if (isv6)
3206 		index = IP_V6_G_HEAD;
3207 	else
3208 		index = IP_V4_G_HEAD;
3209 
3210 	ill_interface = IP_VX_ILL_G_LIST(index, ipst);
3211 	/*
3212 	 * Search for interface type based on name
3213 	 */
3214 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3215 		if ((ill_interface->illif_name_len == name_length) &&
3216 		    (strcmp(ill_interface->illif_name, name) == 0)) {
3217 			break;
3218 		}
3219 		ill_interface = ill_interface->illif_next;
3220 	}
3221 
3222 	/*
3223 	 * Interface type not found, create one.
3224 	 */
3225 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3226 		ill_g_head_t ghead;
3227 
3228 		/*
3229 		 * allocate ill_if_t structure
3230 		 */
3231 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
3232 		if (ill_interface == NULL) {
3233 			return (ENOMEM);
3234 		}
3235 
3236 		(void) strcpy(ill_interface->illif_name, name);
3237 		ill_interface->illif_name_len = name_length;
3238 
3239 		avl_create(&ill_interface->illif_avl_by_ppa,
3240 		    ill_compare_ppa, sizeof (ill_t),
3241 		    offsetof(struct ill_s, ill_avl_byppa));
3242 
3243 		/*
3244 		 * link the structure in the back to maintain order
3245 		 * of configuration for ifconfig output.
3246 		 */
3247 		ghead = ipst->ips_ill_g_heads[index];
3248 		insque(ill_interface, ghead.ill_g_list_tail);
3249 	}
3250 
3251 	if (ill->ill_ppa == UINT_MAX)
3252 		check_length = B_TRUE;
3253 
3254 	error = ill_alloc_ppa(ill_interface, ill);
3255 	if (error != 0) {
3256 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3257 			ill_delete_interface_type(ill->ill_ifptr);
3258 		return (error);
3259 	}
3260 
3261 	/*
3262 	 * When the ppa is choosen by the system, check that there is
3263 	 * enough space to insert ppa. if a specific ppa was passed in this
3264 	 * check is not required as the interface name passed in will have
3265 	 * the right ppa in it.
3266 	 */
3267 	if (check_length) {
3268 		/*
3269 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
3270 		 */
3271 		char buf[sizeof (uint_t) * 3];
3272 
3273 		/*
3274 		 * convert ppa to string to calculate the amount of space
3275 		 * required for it in the name.
3276 		 */
3277 		numtos(ill->ill_ppa, buf);
3278 
3279 		/* Do we have enough space to insert ppa ? */
3280 
3281 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
3282 			/* Free ppa and interface type struct */
3283 			if (ill_interface->illif_ppa_arena != NULL) {
3284 				vmem_free(ill_interface->illif_ppa_arena,
3285 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3286 			}
3287 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3288 				ill_delete_interface_type(ill->ill_ifptr);
3289 
3290 			return (EINVAL);
3291 		}
3292 	}
3293 
3294 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
3295 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
3296 
3297 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
3298 	    &where);
3299 	ill->ill_ifptr = ill_interface;
3300 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
3301 
3302 	ill_phyint_reinit(ill);
3303 	return (0);
3304 }
3305 
3306 /* Initialize the per phyint ipsq used for serialization */
3307 static boolean_t
ipsq_init(ill_t * ill,boolean_t enter)3308 ipsq_init(ill_t *ill, boolean_t enter)
3309 {
3310 	ipsq_t  *ipsq;
3311 	ipxop_t	*ipx;
3312 
3313 	if ((ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP)) == NULL)
3314 		return (B_FALSE);
3315 
3316 	ill->ill_phyint->phyint_ipsq = ipsq;
3317 	ipx = ipsq->ipsq_xop = &ipsq->ipsq_ownxop;
3318 	ipx->ipx_ipsq = ipsq;
3319 	ipsq->ipsq_next = ipsq;
3320 	ipsq->ipsq_phyint = ill->ill_phyint;
3321 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
3322 	mutex_init(&ipx->ipx_lock, NULL, MUTEX_DEFAULT, 0);
3323 	ipsq->ipsq_ipst = ill->ill_ipst;	/* No netstack_hold */
3324 	if (enter) {
3325 		ipx->ipx_writer = curthread;
3326 		ipx->ipx_forced = B_FALSE;
3327 		ipx->ipx_reentry_cnt = 1;
3328 #ifdef DEBUG
3329 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
3330 #endif
3331 	}
3332 	return (B_TRUE);
3333 }
3334 
3335 /*
3336  * Here we perform initialisation of the ill_t common to both regular
3337  * interface ILLs and the special loopback ILL created by ill_lookup_on_name.
3338  */
3339 static int
ill_init_common(ill_t * ill,queue_t * q,boolean_t isv6,boolean_t is_loopback,boolean_t ipsq_enter)3340 ill_init_common(ill_t *ill, queue_t *q, boolean_t isv6, boolean_t is_loopback,
3341     boolean_t ipsq_enter)
3342 {
3343 	int count;
3344 	uchar_t *frag_ptr;
3345 
3346 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
3347 	mutex_init(&ill->ill_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
3348 	ill->ill_saved_ire_cnt = 0;
3349 
3350 	if (is_loopback) {
3351 		ill->ill_max_frag = isv6 ? ip_loopback_mtu_v6plus :
3352 		    ip_loopback_mtuplus;
3353 		/*
3354 		 * No resolver here.
3355 		 */
3356 		ill->ill_net_type = IRE_LOOPBACK;
3357 	} else {
3358 		ill->ill_rq = q;
3359 		ill->ill_wq = WR(q);
3360 		ill->ill_ppa = UINT_MAX;
3361 	}
3362 
3363 	ill->ill_isv6 = isv6;
3364 
3365 	/*
3366 	 * Allocate sufficient space to contain our fragment hash table and
3367 	 * the device name.
3368 	 */
3369 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE + 2 * LIFNAMSIZ);
3370 	if (frag_ptr == NULL)
3371 		return (ENOMEM);
3372 	ill->ill_frag_ptr = frag_ptr;
3373 	ill->ill_frag_free_num_pkts = 0;
3374 	ill->ill_last_frag_clean_time = 0;
3375 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
3376 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
3377 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
3378 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
3379 		    NULL, MUTEX_DEFAULT, NULL);
3380 	}
3381 
3382 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
3383 	if (ill->ill_phyint == NULL) {
3384 		mi_free(frag_ptr);
3385 		return (ENOMEM);
3386 	}
3387 
3388 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
3389 	if (isv6) {
3390 		ill->ill_phyint->phyint_illv6 = ill;
3391 	} else {
3392 		ill->ill_phyint->phyint_illv4 = ill;
3393 	}
3394 	if (is_loopback) {
3395 		phyint_flags_init(ill->ill_phyint, DL_LOOP);
3396 	}
3397 
3398 	list_create(&ill->ill_nce, sizeof (nce_t), offsetof(nce_t, nce_node));
3399 
3400 	ill_set_inputfn(ill);
3401 
3402 	if (!ipsq_init(ill, ipsq_enter)) {
3403 		mi_free(frag_ptr);
3404 		mi_free(ill->ill_phyint);
3405 		return (ENOMEM);
3406 	}
3407 
3408 	/* Frag queue limit stuff */
3409 	ill->ill_frag_count = 0;
3410 	ill->ill_ipf_gen = 0;
3411 
3412 	rw_init(&ill->ill_mcast_lock, NULL, RW_DEFAULT, NULL);
3413 	mutex_init(&ill->ill_mcast_serializer, NULL, MUTEX_DEFAULT, NULL);
3414 	ill->ill_global_timer = INFINITY;
3415 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
3416 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
3417 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
3418 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
3419 
3420 	/*
3421 	 * Initialize IPv6 configuration variables.  The IP module is always
3422 	 * opened as an IPv4 module.  Instead tracking down the cases where
3423 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
3424 	 * here for convenience, this has no effect until the ill is set to do
3425 	 * IPv6.
3426 	 */
3427 	ill->ill_reachable_time = ND_REACHABLE_TIME;
3428 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
3429 	ill->ill_max_buf = ND_MAX_Q;
3430 	ill->ill_refcnt = 0;
3431 
3432 	return (0);
3433 }
3434 
3435 /*
3436  * ill_init is called by ip_open when a device control stream is opened.
3437  * It does a few initializations, and shoots a DL_INFO_REQ message down
3438  * to the driver.  The response is later picked up in ip_rput_dlpi and
3439  * used to set up default mechanisms for talking to the driver.  (Always
3440  * called as writer.)
3441  *
3442  * If this function returns error, ip_open will call ip_close which in
3443  * turn will call ill_delete to clean up any memory allocated here that
3444  * is not yet freed.
3445  *
3446  * Note: ill_ipst and ill_zoneid must be set before calling ill_init.
3447  */
3448 int
ill_init(queue_t * q,ill_t * ill)3449 ill_init(queue_t *q, ill_t *ill)
3450 {
3451 	int ret;
3452 	dl_info_req_t	*dlir;
3453 	mblk_t	*info_mp;
3454 
3455 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
3456 	    BPRI_HI);
3457 	if (info_mp == NULL)
3458 		return (ENOMEM);
3459 
3460 	/*
3461 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
3462 	 * at this point because of the following reason. If we can't
3463 	 * enter the ipsq at some point and cv_wait, the writer that
3464 	 * wakes us up tries to locate us using the list of all phyints
3465 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
3466 	 * If we don't set it now, we risk a missed wakeup.
3467 	 */
3468 	if ((ret = ill_init_common(ill, q, B_FALSE, B_FALSE, B_TRUE)) != 0) {
3469 		freemsg(info_mp);
3470 		return (ret);
3471 	}
3472 
3473 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
3474 
3475 	/* Send down the Info Request to the driver. */
3476 	info_mp->b_datap->db_type = M_PCPROTO;
3477 	dlir = (dl_info_req_t *)info_mp->b_rptr;
3478 	info_mp->b_wptr = (uchar_t *)&dlir[1];
3479 	dlir->dl_primitive = DL_INFO_REQ;
3480 
3481 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
3482 
3483 	qprocson(q);
3484 	ill_dlpi_send(ill, info_mp);
3485 
3486 	return (0);
3487 }
3488 
3489 /*
3490  * ill_dls_info
3491  * creates datalink socket info from the device.
3492  */
3493 int
ill_dls_info(struct sockaddr_dl * sdl,const ill_t * ill)3494 ill_dls_info(struct sockaddr_dl *sdl, const ill_t *ill)
3495 {
3496 	size_t	len;
3497 
3498 	sdl->sdl_family = AF_LINK;
3499 	sdl->sdl_index = ill_get_upper_ifindex(ill);
3500 	sdl->sdl_type = ill->ill_type;
3501 	ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3502 	len = strlen(sdl->sdl_data);
3503 	ASSERT(len < 256);
3504 	sdl->sdl_nlen = (uchar_t)len;
3505 	sdl->sdl_alen = ill->ill_phys_addr_length;
3506 	sdl->sdl_slen = 0;
3507 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL)
3508 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[len], sdl->sdl_alen);
3509 
3510 	return (sizeof (struct sockaddr_dl));
3511 }
3512 
3513 /*
3514  * ill_xarp_info
3515  * creates xarp info from the device.
3516  */
3517 static int
ill_xarp_info(struct sockaddr_dl * sdl,ill_t * ill)3518 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
3519 {
3520 	sdl->sdl_family = AF_LINK;
3521 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
3522 	sdl->sdl_type = ill->ill_type;
3523 	ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3524 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
3525 	sdl->sdl_alen = ill->ill_phys_addr_length;
3526 	sdl->sdl_slen = 0;
3527 	return (sdl->sdl_nlen);
3528 }
3529 
3530 static int
loopback_kstat_update(kstat_t * ksp,int rw)3531 loopback_kstat_update(kstat_t *ksp, int rw)
3532 {
3533 	kstat_named_t *kn;
3534 	netstackid_t	stackid;
3535 	netstack_t	*ns;
3536 	ip_stack_t	*ipst;
3537 
3538 	if (ksp == NULL || ksp->ks_data == NULL)
3539 		return (EIO);
3540 
3541 	if (rw == KSTAT_WRITE)
3542 		return (EACCES);
3543 
3544 	kn = KSTAT_NAMED_PTR(ksp);
3545 	stackid = (zoneid_t)(uintptr_t)ksp->ks_private;
3546 
3547 	ns = netstack_find_by_stackid(stackid);
3548 	if (ns == NULL)
3549 		return (-1);
3550 
3551 	ipst = ns->netstack_ip;
3552 	if (ipst == NULL) {
3553 		netstack_rele(ns);
3554 		return (-1);
3555 	}
3556 	kn[0].value.ui32 = ipst->ips_loopback_packets;
3557 	kn[1].value.ui32 = ipst->ips_loopback_packets;
3558 	netstack_rele(ns);
3559 	return (0);
3560 }
3561 
3562 /*
3563  * Has ifindex been plumbed already?
3564  */
3565 static boolean_t
phyint_exists(uint_t index,ip_stack_t * ipst)3566 phyint_exists(uint_t index, ip_stack_t *ipst)
3567 {
3568 	ASSERT(index != 0);
3569 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
3570 
3571 	return (avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3572 	    &index, NULL) != NULL);
3573 }
3574 
3575 /*
3576  * Pick a unique ifindex.
3577  * When the index counter passes IF_INDEX_MAX for the first time, the wrap
3578  * flag is set so that next time time ip_assign_ifindex() is called, it
3579  * falls through and resets the index counter back to 1, the minimum value
3580  * for the interface index. The logic below assumes that ips_ill_index
3581  * can hold a value of IF_INDEX_MAX+1 without there being any loss
3582  * (i.e. reset back to 0.)
3583  */
3584 boolean_t
ip_assign_ifindex(uint_t * indexp,ip_stack_t * ipst)3585 ip_assign_ifindex(uint_t *indexp, ip_stack_t *ipst)
3586 {
3587 	uint_t loops;
3588 
3589 	if (!ipst->ips_ill_index_wrap) {
3590 		*indexp = ipst->ips_ill_index++;
3591 		if (ipst->ips_ill_index > IF_INDEX_MAX) {
3592 			/*
3593 			 * Reached the maximum ifindex value, set the wrap
3594 			 * flag to indicate that it is no longer possible
3595 			 * to assume that a given index is unallocated.
3596 			 */
3597 			ipst->ips_ill_index_wrap = B_TRUE;
3598 		}
3599 		return (B_TRUE);
3600 	}
3601 
3602 	if (ipst->ips_ill_index > IF_INDEX_MAX)
3603 		ipst->ips_ill_index = 1;
3604 
3605 	/*
3606 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
3607 	 * at this point and don't want to call any function that attempts
3608 	 * to get the lock again.
3609 	 */
3610 	for (loops = IF_INDEX_MAX; loops > 0; loops--) {
3611 		if (!phyint_exists(ipst->ips_ill_index, ipst)) {
3612 			/* found unused index - use it */
3613 			*indexp = ipst->ips_ill_index;
3614 			return (B_TRUE);
3615 		}
3616 
3617 		ipst->ips_ill_index++;
3618 		if (ipst->ips_ill_index > IF_INDEX_MAX)
3619 			ipst->ips_ill_index = 1;
3620 	}
3621 
3622 	/*
3623 	 * all interface indicies are inuse.
3624 	 */
3625 	return (B_FALSE);
3626 }
3627 
3628 /*
3629  * Assign a unique interface index for the phyint.
3630  */
3631 static boolean_t
phyint_assign_ifindex(phyint_t * phyi,ip_stack_t * ipst)3632 phyint_assign_ifindex(phyint_t *phyi, ip_stack_t *ipst)
3633 {
3634 	ASSERT(phyi->phyint_ifindex == 0);
3635 	return (ip_assign_ifindex(&phyi->phyint_ifindex, ipst));
3636 }
3637 
3638 /*
3639  * Initialize the flags on `phyi' as per the provided mactype.
3640  */
3641 static void
phyint_flags_init(phyint_t * phyi,t_uscalar_t mactype)3642 phyint_flags_init(phyint_t *phyi, t_uscalar_t mactype)
3643 {
3644 	uint64_t flags = 0;
3645 
3646 	/*
3647 	 * Initialize PHYI_RUNNING and PHYI_FAILED.  For non-IPMP interfaces,
3648 	 * we always presume the underlying hardware is working and set
3649 	 * PHYI_RUNNING (if it's not, the driver will subsequently send a
3650 	 * DL_NOTE_LINK_DOWN message).  For IPMP interfaces, at initialization
3651 	 * there are no active interfaces in the group so we set PHYI_FAILED.
3652 	 */
3653 	if (mactype == SUNW_DL_IPMP)
3654 		flags |= PHYI_FAILED;
3655 	else
3656 		flags |= PHYI_RUNNING;
3657 
3658 	switch (mactype) {
3659 	case SUNW_DL_VNI:
3660 		flags |= PHYI_VIRTUAL;
3661 		break;
3662 	case SUNW_DL_IPMP:
3663 		flags |= PHYI_IPMP;
3664 		break;
3665 	case DL_LOOP:
3666 		flags |= (PHYI_LOOPBACK | PHYI_VIRTUAL);
3667 		break;
3668 	}
3669 
3670 	mutex_enter(&phyi->phyint_lock);
3671 	phyi->phyint_flags |= flags;
3672 	mutex_exit(&phyi->phyint_lock);
3673 }
3674 
3675 /*
3676  * Return a pointer to the ill which matches the supplied name.  Note that
3677  * the ill name length includes the null termination character.  (May be
3678  * called as writer.)
3679  * If do_alloc and the interface is "lo0" it will be automatically created.
3680  * Cannot bump up reference on condemned ills. So dup detect can't be done
3681  * using this func.
3682  */
3683 ill_t *
ill_lookup_on_name(char * name,boolean_t do_alloc,boolean_t isv6,boolean_t * did_alloc,ip_stack_t * ipst)3684 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
3685     boolean_t *did_alloc, ip_stack_t *ipst)
3686 {
3687 	ill_t	*ill;
3688 	ipif_t	*ipif;
3689 	ipsq_t	*ipsq;
3690 	kstat_named_t	*kn;
3691 	boolean_t isloopback;
3692 	in6_addr_t ov6addr;
3693 
3694 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
3695 
3696 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3697 	ill = ill_find_by_name(name, isv6, ipst);
3698 	rw_exit(&ipst->ips_ill_g_lock);
3699 	if (ill != NULL)
3700 		return (ill);
3701 
3702 	/*
3703 	 * Couldn't find it.  Does this happen to be a lookup for the
3704 	 * loopback device and are we allowed to allocate it?
3705 	 */
3706 	if (!isloopback || !do_alloc)
3707 		return (NULL);
3708 
3709 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3710 	ill = ill_find_by_name(name, isv6, ipst);
3711 	if (ill != NULL) {
3712 		rw_exit(&ipst->ips_ill_g_lock);
3713 		return (ill);
3714 	}
3715 
3716 	/* Create the loopback device on demand */
3717 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
3718 	    sizeof (ipif_loopback_name), BPRI_MED));
3719 	if (ill == NULL)
3720 		goto done;
3721 
3722 	bzero(ill, sizeof (*ill));
3723 	ill->ill_ipst = ipst;
3724 	netstack_hold(ipst->ips_netstack);
3725 	/*
3726 	 * For exclusive stacks we set the zoneid to zero
3727 	 * to make IP operate as if in the global zone.
3728 	 */
3729 	ill->ill_zoneid = GLOBAL_ZONEID;
3730 
3731 	if (ill_init_common(ill, NULL, isv6, B_TRUE, B_FALSE) != 0)
3732 		goto done;
3733 
3734 	if (!ill_allocate_mibs(ill))
3735 		goto done;
3736 
3737 	ill->ill_current_frag = ill->ill_max_frag;
3738 	ill->ill_mtu = ill->ill_max_frag;	/* Initial value */
3739 	ill->ill_mc_mtu = ill->ill_mtu;
3740 	/*
3741 	 * ipif_loopback_name can't be pointed at directly because its used
3742 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
3743 	 * from the glist, ill_glist_delete() sets the first character of
3744 	 * ill_name to '\0'.
3745 	 */
3746 	ill->ill_name = (char *)ill + sizeof (*ill);
3747 	(void) strcpy(ill->ill_name, ipif_loopback_name);
3748 	ill->ill_name_length = sizeof (ipif_loopback_name);
3749 	/* Set ill_dlpi_pending for ipsq_current_finish() to work properly */
3750 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
3751 
3752 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE, B_TRUE, NULL);
3753 	if (ipif == NULL)
3754 		goto done;
3755 
3756 	ill->ill_flags = ILLF_MULTICAST;
3757 
3758 	ov6addr = ipif->ipif_v6lcl_addr;
3759 	/* Set up default loopback address and mask. */
3760 	if (!isv6) {
3761 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
3762 
3763 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
3764 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
3765 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3766 		    ipif->ipif_v6subnet);
3767 		ill->ill_flags |= ILLF_IPV4;
3768 	} else {
3769 		ipif->ipif_v6lcl_addr = ipv6_loopback;
3770 		ipif->ipif_v6net_mask = ipv6_all_ones;
3771 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3772 		    ipif->ipif_v6subnet);
3773 		ill->ill_flags |= ILLF_IPV6;
3774 	}
3775 
3776 	/*
3777 	 * Chain us in at the end of the ill list. hold the ill
3778 	 * before we make it globally visible. 1 for the lookup.
3779 	 */
3780 	ill_refhold(ill);
3781 
3782 	ipsq = ill->ill_phyint->phyint_ipsq;
3783 
3784 	if (ill_glist_insert(ill, "lo", isv6) != 0)
3785 		cmn_err(CE_PANIC, "cannot insert loopback interface");
3786 
3787 	/* Let SCTP know so that it can add this to its list */
3788 	sctp_update_ill(ill, SCTP_ILL_INSERT);
3789 
3790 	/*
3791 	 * We have already assigned ipif_v6lcl_addr above, but we need to
3792 	 * call sctp_update_ipif_addr() after SCTP_ILL_INSERT, which
3793 	 * requires to be after ill_glist_insert() since we need the
3794 	 * ill_index set. Pass on ipv6_loopback as the old address.
3795 	 */
3796 	sctp_update_ipif_addr(ipif, ov6addr);
3797 
3798 	ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
3799 
3800 	/*
3801 	 * ill_glist_insert() -> ill_phyint_reinit() may have merged IPSQs.
3802 	 * If so, free our original one.
3803 	 */
3804 	if (ipsq != ill->ill_phyint->phyint_ipsq)
3805 		ipsq_delete(ipsq);
3806 
3807 	if (ipst->ips_loopback_ksp == NULL) {
3808 		/* Export loopback interface statistics */
3809 		ipst->ips_loopback_ksp = kstat_create_netstack("lo", 0,
3810 		    ipif_loopback_name, "net",
3811 		    KSTAT_TYPE_NAMED, 2, 0,
3812 		    ipst->ips_netstack->netstack_stackid);
3813 		if (ipst->ips_loopback_ksp != NULL) {
3814 			ipst->ips_loopback_ksp->ks_update =
3815 			    loopback_kstat_update;
3816 			kn = KSTAT_NAMED_PTR(ipst->ips_loopback_ksp);
3817 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
3818 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
3819 			ipst->ips_loopback_ksp->ks_private =
3820 			    (void *)(uintptr_t)ipst->ips_netstack->
3821 			    netstack_stackid;
3822 			kstat_install(ipst->ips_loopback_ksp);
3823 		}
3824 	}
3825 
3826 	*did_alloc = B_TRUE;
3827 	rw_exit(&ipst->ips_ill_g_lock);
3828 	ill_nic_event_dispatch(ill, MAP_IPIF_ID(ill->ill_ipif->ipif_id),
3829 	    NE_PLUMB, ill->ill_name, ill->ill_name_length);
3830 	return (ill);
3831 done:
3832 	if (ill != NULL) {
3833 		if (ill->ill_phyint != NULL) {
3834 			ipsq = ill->ill_phyint->phyint_ipsq;
3835 			if (ipsq != NULL) {
3836 				ipsq->ipsq_phyint = NULL;
3837 				ipsq_delete(ipsq);
3838 			}
3839 			mi_free(ill->ill_phyint);
3840 		}
3841 		ill_free_mib(ill);
3842 		if (ill->ill_ipst != NULL)
3843 			netstack_rele(ill->ill_ipst->ips_netstack);
3844 		mi_free(ill);
3845 	}
3846 	rw_exit(&ipst->ips_ill_g_lock);
3847 	return (NULL);
3848 }
3849 
3850 /*
3851  * For IPP calls - use the ip_stack_t for global stack.
3852  */
3853 ill_t *
ill_lookup_on_ifindex_global_instance(uint_t index,boolean_t isv6)3854 ill_lookup_on_ifindex_global_instance(uint_t index, boolean_t isv6)
3855 {
3856 	ip_stack_t	*ipst;
3857 	ill_t		*ill;
3858 	netstack_t	*ns;
3859 
3860 	ns = netstack_find_by_stackid(GLOBAL_NETSTACKID);
3861 
3862 	if ((ipst = ns->netstack_ip) == NULL) {
3863 		cmn_err(CE_WARN, "No ip_stack_t for zoneid zero!\n");
3864 		netstack_rele(ns);
3865 		return (NULL);
3866 	}
3867 
3868 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
3869 	netstack_rele(ns);
3870 	return (ill);
3871 }
3872 
3873 /*
3874  * Return a pointer to the ill which matches the index and IP version type.
3875  */
3876 ill_t *
ill_lookup_on_ifindex(uint_t index,boolean_t isv6,ip_stack_t * ipst)3877 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3878 {
3879 	ill_t	*ill;
3880 	phyint_t *phyi;
3881 
3882 	/*
3883 	 * Indexes are stored in the phyint - a common structure
3884 	 * to both IPv4 and IPv6.
3885 	 */
3886 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3887 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3888 	    (void *) &index, NULL);
3889 	if (phyi != NULL) {
3890 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
3891 		if (ill != NULL) {
3892 			mutex_enter(&ill->ill_lock);
3893 			if (!ILL_IS_CONDEMNED(ill)) {
3894 				ill_refhold_locked(ill);
3895 				mutex_exit(&ill->ill_lock);
3896 				rw_exit(&ipst->ips_ill_g_lock);
3897 				return (ill);
3898 			}
3899 			mutex_exit(&ill->ill_lock);
3900 		}
3901 	}
3902 	rw_exit(&ipst->ips_ill_g_lock);
3903 	return (NULL);
3904 }
3905 
3906 /*
3907  * Verify whether or not an interface index is valid for the specified zoneid
3908  * to transmit packets.
3909  * It can be zero (meaning "reset") or an interface index assigned
3910  * to a non-VNI interface. (We don't use VNI interface to send packets.)
3911  */
3912 boolean_t
ip_xmit_ifindex_valid(uint_t ifindex,zoneid_t zoneid,boolean_t isv6,ip_stack_t * ipst)3913 ip_xmit_ifindex_valid(uint_t ifindex, zoneid_t zoneid, boolean_t isv6,
3914     ip_stack_t *ipst)
3915 {
3916 	ill_t		*ill;
3917 
3918 	if (ifindex == 0)
3919 		return (B_TRUE);
3920 
3921 	ill = ill_lookup_on_ifindex_zoneid(ifindex, zoneid, isv6, ipst);
3922 	if (ill == NULL)
3923 		return (B_FALSE);
3924 	if (IS_VNI(ill)) {
3925 		ill_refrele(ill);
3926 		return (B_FALSE);
3927 	}
3928 	ill_refrele(ill);
3929 	return (B_TRUE);
3930 }
3931 
3932 /*
3933  * Return the ifindex next in sequence after the passed in ifindex.
3934  * If there is no next ifindex for the given protocol, return 0.
3935  */
3936 uint_t
ill_get_next_ifindex(uint_t index,boolean_t isv6,ip_stack_t * ipst)3937 ill_get_next_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3938 {
3939 	phyint_t *phyi;
3940 	phyint_t *phyi_initial;
3941 	uint_t   ifindex;
3942 
3943 	phyi_initial = NULL;
3944 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3945 
3946 	if (index == 0) {
3947 		phyi = avl_first(
3948 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index);
3949 	} else {
3950 		phyi = phyi_initial = avl_find(
3951 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3952 		    (void *) &index, NULL);
3953 	}
3954 
3955 	for (; phyi != NULL;
3956 	    phyi = avl_walk(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3957 	    phyi, AVL_AFTER)) {
3958 		/*
3959 		 * If we're not returning the first interface in the tree
3960 		 * and we still haven't moved past the phyint_t that
3961 		 * corresponds to index, avl_walk needs to be called again
3962 		 */
3963 		if (!((index != 0) && (phyi == phyi_initial))) {
3964 			if (isv6) {
3965 				if ((phyi->phyint_illv6) &&
3966 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
3967 				    (phyi->phyint_illv6->ill_isv6 == 1))
3968 					break;
3969 			} else {
3970 				if ((phyi->phyint_illv4) &&
3971 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
3972 				    (phyi->phyint_illv4->ill_isv6 == 0))
3973 					break;
3974 			}
3975 		}
3976 	}
3977 
3978 	rw_exit(&ipst->ips_ill_g_lock);
3979 
3980 	if (phyi != NULL)
3981 		ifindex = phyi->phyint_ifindex;
3982 	else
3983 		ifindex = 0;
3984 
3985 	return (ifindex);
3986 }
3987 
3988 /*
3989  * Return the ifindex for the named interface.
3990  * If there is no next ifindex for the interface, return 0.
3991  */
3992 uint_t
ill_get_ifindex_by_name(char * name,ip_stack_t * ipst)3993 ill_get_ifindex_by_name(char *name, ip_stack_t *ipst)
3994 {
3995 	phyint_t	*phyi;
3996 	avl_index_t	where = 0;
3997 	uint_t		ifindex;
3998 
3999 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4000 
4001 	if ((phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
4002 	    name, &where)) == NULL) {
4003 		rw_exit(&ipst->ips_ill_g_lock);
4004 		return (0);
4005 	}
4006 
4007 	ifindex = phyi->phyint_ifindex;
4008 
4009 	rw_exit(&ipst->ips_ill_g_lock);
4010 
4011 	return (ifindex);
4012 }
4013 
4014 /*
4015  * Return the ifindex to be used by upper layer protocols for instance
4016  * for IPV6_RECVPKTINFO. If IPMP this is the one for the upper ill.
4017  */
4018 uint_t
ill_get_upper_ifindex(const ill_t * ill)4019 ill_get_upper_ifindex(const ill_t *ill)
4020 {
4021 	if (IS_UNDER_IPMP(ill))
4022 		return (ipmp_ill_get_ipmp_ifindex(ill));
4023 	else
4024 		return (ill->ill_phyint->phyint_ifindex);
4025 }
4026 
4027 
4028 /*
4029  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
4030  * that gives a running thread a reference to the ill. This reference must be
4031  * released by the thread when it is done accessing the ill and related
4032  * objects. ill_refcnt can not be used to account for static references
4033  * such as other structures pointing to an ill. Callers must generally
4034  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
4035  * or be sure that the ill is not being deleted or changing state before
4036  * calling the refhold functions. A non-zero ill_refcnt ensures that the
4037  * ill won't change any of its critical state such as address, netmask etc.
4038  */
4039 void
ill_refhold(ill_t * ill)4040 ill_refhold(ill_t *ill)
4041 {
4042 	mutex_enter(&ill->ill_lock);
4043 	ill->ill_refcnt++;
4044 	ILL_TRACE_REF(ill);
4045 	mutex_exit(&ill->ill_lock);
4046 }
4047 
4048 void
ill_refhold_locked(ill_t * ill)4049 ill_refhold_locked(ill_t *ill)
4050 {
4051 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4052 	ill->ill_refcnt++;
4053 	ILL_TRACE_REF(ill);
4054 }
4055 
4056 /* Returns true if we managed to get a refhold */
4057 boolean_t
ill_check_and_refhold(ill_t * ill)4058 ill_check_and_refhold(ill_t *ill)
4059 {
4060 	mutex_enter(&ill->ill_lock);
4061 	if (!ILL_IS_CONDEMNED(ill)) {
4062 		ill_refhold_locked(ill);
4063 		mutex_exit(&ill->ill_lock);
4064 		return (B_TRUE);
4065 	}
4066 	mutex_exit(&ill->ill_lock);
4067 	return (B_FALSE);
4068 }
4069 
4070 /*
4071  * Must not be called while holding any locks. Otherwise if this is
4072  * the last reference to be released, there is a chance of recursive mutex
4073  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
4074  * to restart an ioctl.
4075  */
4076 void
ill_refrele(ill_t * ill)4077 ill_refrele(ill_t *ill)
4078 {
4079 	mutex_enter(&ill->ill_lock);
4080 	ASSERT(ill->ill_refcnt != 0);
4081 	ill->ill_refcnt--;
4082 	ILL_UNTRACE_REF(ill);
4083 	if (ill->ill_refcnt != 0) {
4084 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
4085 		mutex_exit(&ill->ill_lock);
4086 		return;
4087 	}
4088 
4089 	/* Drops the ill_lock */
4090 	ipif_ill_refrele_tail(ill);
4091 }
4092 
4093 /*
4094  * Obtain a weak reference count on the ill. This reference ensures the
4095  * ill won't be freed, but the ill may change any of its critical state
4096  * such as netmask, address etc. Returns an error if the ill has started
4097  * closing.
4098  */
4099 boolean_t
ill_waiter_inc(ill_t * ill)4100 ill_waiter_inc(ill_t *ill)
4101 {
4102 	mutex_enter(&ill->ill_lock);
4103 	if (ill->ill_state_flags & ILL_CONDEMNED) {
4104 		mutex_exit(&ill->ill_lock);
4105 		return (B_FALSE);
4106 	}
4107 	ill->ill_waiters++;
4108 	mutex_exit(&ill->ill_lock);
4109 	return (B_TRUE);
4110 }
4111 
4112 void
ill_waiter_dcr(ill_t * ill)4113 ill_waiter_dcr(ill_t *ill)
4114 {
4115 	mutex_enter(&ill->ill_lock);
4116 	ill->ill_waiters--;
4117 	if (ill->ill_waiters == 0)
4118 		cv_broadcast(&ill->ill_cv);
4119 	mutex_exit(&ill->ill_lock);
4120 }
4121 
4122 /*
4123  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
4124  * driver.  We construct best guess defaults for lower level information that
4125  * we need.  If an interface is brought up without injection of any overriding
4126  * information from outside, we have to be ready to go with these defaults.
4127  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
4128  * we primarely want the dl_provider_style.
4129  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
4130  * at which point we assume the other part of the information is valid.
4131  */
4132 void
ip_ll_subnet_defaults(ill_t * ill,mblk_t * mp)4133 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
4134 {
4135 	uchar_t		*brdcst_addr;
4136 	uint_t		brdcst_addr_length, phys_addr_length;
4137 	t_scalar_t	sap_length;
4138 	dl_info_ack_t	*dlia;
4139 	ip_m_t		*ipm;
4140 	dl_qos_cl_sel1_t *sel1;
4141 	int		min_mtu;
4142 
4143 	ASSERT(IAM_WRITER_ILL(ill));
4144 
4145 	/*
4146 	 * Till the ill is fully up  the ill is not globally visible.
4147 	 * So no need for a lock.
4148 	 */
4149 	dlia = (dl_info_ack_t *)mp->b_rptr;
4150 	ill->ill_mactype = dlia->dl_mac_type;
4151 
4152 	ipm = ip_m_lookup(dlia->dl_mac_type);
4153 	if (ipm == NULL) {
4154 		ipm = ip_m_lookup(DL_OTHER);
4155 		ASSERT(ipm != NULL);
4156 	}
4157 	ill->ill_media = ipm;
4158 
4159 	/*
4160 	 * When the new DLPI stuff is ready we'll pull lengths
4161 	 * from dlia.
4162 	 */
4163 	if (dlia->dl_version == DL_VERSION_2) {
4164 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
4165 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
4166 		    brdcst_addr_length);
4167 		if (brdcst_addr == NULL) {
4168 			brdcst_addr_length = 0;
4169 		}
4170 		sap_length = dlia->dl_sap_length;
4171 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
4172 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
4173 		    brdcst_addr_length, sap_length, phys_addr_length));
4174 	} else {
4175 		brdcst_addr_length = 6;
4176 		brdcst_addr = ip_six_byte_all_ones;
4177 		sap_length = -2;
4178 		phys_addr_length = brdcst_addr_length;
4179 	}
4180 
4181 	ill->ill_bcast_addr_length = brdcst_addr_length;
4182 	ill->ill_phys_addr_length = phys_addr_length;
4183 	ill->ill_sap_length = sap_length;
4184 
4185 	/*
4186 	 * Synthetic DLPI types such as SUNW_DL_IPMP specify a zero SDU,
4187 	 * but we must ensure a minimum IP MTU is used since other bits of
4188 	 * IP will fly apart otherwise.
4189 	 */
4190 	min_mtu = ill->ill_isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
4191 	ill->ill_max_frag = MAX(min_mtu, dlia->dl_max_sdu);
4192 	ill->ill_current_frag = ill->ill_max_frag;
4193 	ill->ill_mtu = ill->ill_max_frag;
4194 	ill->ill_mc_mtu = ill->ill_mtu;	/* Overridden by DL_NOTE_SDU_SIZE2 */
4195 
4196 	ill->ill_type = ipm->ip_m_type;
4197 
4198 	if (!ill->ill_dlpi_style_set) {
4199 		if (dlia->dl_provider_style == DL_STYLE2)
4200 			ill->ill_needs_attach = 1;
4201 
4202 		phyint_flags_init(ill->ill_phyint, ill->ill_mactype);
4203 
4204 		/*
4205 		 * Allocate the first ipif on this ill.  We don't delay it
4206 		 * further as ioctl handling assumes at least one ipif exists.
4207 		 *
4208 		 * At this point we don't know whether the ill is v4 or v6.
4209 		 * We will know this whan the SIOCSLIFNAME happens and
4210 		 * the correct value for ill_isv6 will be assigned in
4211 		 * ipif_set_values(). We need to hold the ill lock and
4212 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
4213 		 * the wakeup.
4214 		 */
4215 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
4216 		    dlia->dl_provider_style != DL_STYLE2, B_TRUE, NULL);
4217 		mutex_enter(&ill->ill_lock);
4218 		ASSERT(ill->ill_dlpi_style_set == 0);
4219 		ill->ill_dlpi_style_set = 1;
4220 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
4221 		cv_broadcast(&ill->ill_cv);
4222 		mutex_exit(&ill->ill_lock);
4223 		freemsg(mp);
4224 		return;
4225 	}
4226 	ASSERT(ill->ill_ipif != NULL);
4227 	/*
4228 	 * We know whether it is IPv4 or IPv6 now, as this is the
4229 	 * second DL_INFO_ACK we are recieving in response to the
4230 	 * DL_INFO_REQ sent in ipif_set_values.
4231 	 */
4232 	ill->ill_sap = (ill->ill_isv6) ? ipm->ip_m_ipv6sap : ipm->ip_m_ipv4sap;
4233 	/*
4234 	 * Clear all the flags that were set based on ill_bcast_addr_length
4235 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
4236 	 * changed now and we need to re-evaluate.
4237 	 */
4238 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
4239 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
4240 
4241 	/*
4242 	 * Free ill_bcast_mp as things could have changed now.
4243 	 *
4244 	 * NOTE: The IPMP meta-interface is special-cased because it starts
4245 	 * with no underlying interfaces (and thus an unknown broadcast
4246 	 * address length), but we enforce that an interface is broadcast-
4247 	 * capable as part of allowing it to join a group.
4248 	 */
4249 	if (ill->ill_bcast_addr_length == 0 && !IS_IPMP(ill)) {
4250 		if (ill->ill_bcast_mp != NULL)
4251 			freemsg(ill->ill_bcast_mp);
4252 		ill->ill_net_type = IRE_IF_NORESOLVER;
4253 
4254 		ill->ill_bcast_mp = ill_dlur_gen(NULL,
4255 		    ill->ill_phys_addr_length,
4256 		    ill->ill_sap,
4257 		    ill->ill_sap_length);
4258 
4259 		if (ill->ill_isv6)
4260 			/*
4261 			 * Note: xresolv interfaces will eventually need NOARP
4262 			 * set here as well, but that will require those
4263 			 * external resolvers to have some knowledge of
4264 			 * that flag and act appropriately. Not to be changed
4265 			 * at present.
4266 			 */
4267 			ill->ill_flags |= ILLF_NONUD;
4268 		else
4269 			ill->ill_flags |= ILLF_NOARP;
4270 
4271 		if (ill->ill_mactype == SUNW_DL_VNI) {
4272 			ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
4273 		} else if (ill->ill_phys_addr_length == 0 ||
4274 		    ill->ill_mactype == DL_IPV4 ||
4275 		    ill->ill_mactype == DL_IPV6) {
4276 			/*
4277 			 * The underying link is point-to-point, so mark the
4278 			 * interface as such.  We can do IP multicast over
4279 			 * such a link since it transmits all network-layer
4280 			 * packets to the remote side the same way.
4281 			 */
4282 			ill->ill_flags |= ILLF_MULTICAST;
4283 			ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
4284 		}
4285 	} else {
4286 		ill->ill_net_type = IRE_IF_RESOLVER;
4287 		if (ill->ill_bcast_mp != NULL)
4288 			freemsg(ill->ill_bcast_mp);
4289 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
4290 		    ill->ill_bcast_addr_length, ill->ill_sap,
4291 		    ill->ill_sap_length);
4292 		/*
4293 		 * Later detect lack of DLPI driver multicast
4294 		 * capability by catching DL_ENABMULTI errors in
4295 		 * ip_rput_dlpi.
4296 		 */
4297 		ill->ill_flags |= ILLF_MULTICAST;
4298 		if (!ill->ill_isv6)
4299 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
4300 	}
4301 
4302 	/* For IPMP, PHYI_IPMP should already be set by phyint_flags_init() */
4303 	if (ill->ill_mactype == SUNW_DL_IPMP)
4304 		ASSERT(ill->ill_phyint->phyint_flags & PHYI_IPMP);
4305 
4306 	/* By default an interface does not support any CoS marking */
4307 	ill->ill_flags &= ~ILLF_COS_ENABLED;
4308 
4309 	/*
4310 	 * If we get QoS information in DL_INFO_ACK, the device supports
4311 	 * some form of CoS marking, set ILLF_COS_ENABLED.
4312 	 */
4313 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
4314 	    dlia->dl_qos_length);
4315 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
4316 		ill->ill_flags |= ILLF_COS_ENABLED;
4317 	}
4318 
4319 	/* Clear any previous error indication. */
4320 	ill->ill_error = 0;
4321 	freemsg(mp);
4322 }
4323 
4324 /*
4325  * Perform various checks to verify that an address would make sense as a
4326  * local, remote, or subnet interface address.
4327  */
4328 static boolean_t
ip_addr_ok_v4(ipaddr_t addr,ipaddr_t subnet_mask)4329 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
4330 {
4331 	ipaddr_t	net_mask;
4332 
4333 	/*
4334 	 * Don't allow all zeroes, or all ones, but allow
4335 	 * all ones netmask.
4336 	 */
4337 	if ((net_mask = ip_net_mask(addr)) == 0)
4338 		return (B_FALSE);
4339 	/* A given netmask overrides the "guess" netmask */
4340 	if (subnet_mask != 0)
4341 		net_mask = subnet_mask;
4342 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
4343 	    (addr == (addr | ~net_mask)))) {
4344 		return (B_FALSE);
4345 	}
4346 
4347 	/*
4348 	 * Even if the netmask is all ones, we do not allow address to be
4349 	 * 255.255.255.255
4350 	 */
4351 	if (addr == INADDR_BROADCAST)
4352 		return (B_FALSE);
4353 
4354 	if (CLASSD(addr))
4355 		return (B_FALSE);
4356 
4357 	return (B_TRUE);
4358 }
4359 
4360 #define	V6_IPIF_LINKLOCAL(p)	\
4361 	IN6_IS_ADDR_LINKLOCAL(&(p)->ipif_v6lcl_addr)
4362 
4363 /*
4364  * Compare two given ipifs and check if the second one is better than
4365  * the first one using the order of preference (not taking deprecated
4366  * into acount) specified in ipif_lookup_multicast().
4367  */
4368 static boolean_t
ipif_comp_multi(ipif_t * old_ipif,ipif_t * new_ipif,boolean_t isv6)4369 ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif, boolean_t isv6)
4370 {
4371 	/* Check the least preferred first. */
4372 	if (IS_LOOPBACK(old_ipif->ipif_ill)) {
4373 		/* If both ipifs are the same, use the first one. */
4374 		if (IS_LOOPBACK(new_ipif->ipif_ill))
4375 			return (B_FALSE);
4376 		else
4377 			return (B_TRUE);
4378 	}
4379 
4380 	/* For IPv6, check for link local address. */
4381 	if (isv6 && V6_IPIF_LINKLOCAL(old_ipif)) {
4382 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4383 		    V6_IPIF_LINKLOCAL(new_ipif)) {
4384 			/* The second one is equal or less preferred. */
4385 			return (B_FALSE);
4386 		} else {
4387 			return (B_TRUE);
4388 		}
4389 	}
4390 
4391 	/* Then check for point to point interface. */
4392 	if (old_ipif->ipif_flags & IPIF_POINTOPOINT) {
4393 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4394 		    (isv6 && V6_IPIF_LINKLOCAL(new_ipif)) ||
4395 		    (new_ipif->ipif_flags & IPIF_POINTOPOINT)) {
4396 			return (B_FALSE);
4397 		} else {
4398 			return (B_TRUE);
4399 		}
4400 	}
4401 
4402 	/* old_ipif is a normal interface, so no need to use the new one. */
4403 	return (B_FALSE);
4404 }
4405 
4406 /*
4407  * Find a mulitcast-capable ipif given an IP instance and zoneid.
4408  * The ipif must be up, and its ill must multicast-capable, not
4409  * condemned, not an underlying interface in an IPMP group, and
4410  * not a VNI interface.  Order of preference:
4411  *
4412  *	1a. normal
4413  *	1b. normal, but deprecated
4414  *	2a. point to point
4415  *	2b. point to point, but deprecated
4416  *	3a. link local
4417  *	3b. link local, but deprecated
4418  *	4. loopback.
4419  */
4420 static ipif_t *
ipif_lookup_multicast(ip_stack_t * ipst,zoneid_t zoneid,boolean_t isv6)4421 ipif_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4422 {
4423 	ill_t			*ill;
4424 	ill_walk_context_t	ctx;
4425 	ipif_t			*ipif;
4426 	ipif_t			*saved_ipif = NULL;
4427 	ipif_t			*dep_ipif = NULL;
4428 
4429 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4430 	if (isv6)
4431 		ill = ILL_START_WALK_V6(&ctx, ipst);
4432 	else
4433 		ill = ILL_START_WALK_V4(&ctx, ipst);
4434 
4435 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4436 		mutex_enter(&ill->ill_lock);
4437 		if (IS_VNI(ill) || IS_UNDER_IPMP(ill) ||
4438 		    ILL_IS_CONDEMNED(ill) ||
4439 		    !(ill->ill_flags & ILLF_MULTICAST)) {
4440 			mutex_exit(&ill->ill_lock);
4441 			continue;
4442 		}
4443 		for (ipif = ill->ill_ipif; ipif != NULL;
4444 		    ipif = ipif->ipif_next) {
4445 			if (zoneid != ipif->ipif_zoneid &&
4446 			    zoneid != ALL_ZONES &&
4447 			    ipif->ipif_zoneid != ALL_ZONES) {
4448 				continue;
4449 			}
4450 			if (!(ipif->ipif_flags & IPIF_UP) ||
4451 			    IPIF_IS_CONDEMNED(ipif)) {
4452 				continue;
4453 			}
4454 
4455 			/*
4456 			 * Found one candidate.  If it is deprecated,
4457 			 * remember it in dep_ipif.  If it is not deprecated,
4458 			 * remember it in saved_ipif.
4459 			 */
4460 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
4461 				if (dep_ipif == NULL) {
4462 					dep_ipif = ipif;
4463 				} else if (ipif_comp_multi(dep_ipif, ipif,
4464 				    isv6)) {
4465 					/*
4466 					 * If the previous dep_ipif does not
4467 					 * belong to the same ill, we've done
4468 					 * a ipif_refhold() on it.  So we need
4469 					 * to release it.
4470 					 */
4471 					if (dep_ipif->ipif_ill != ill)
4472 						ipif_refrele(dep_ipif);
4473 					dep_ipif = ipif;
4474 				}
4475 				continue;
4476 			}
4477 			if (saved_ipif == NULL) {
4478 				saved_ipif = ipif;
4479 			} else {
4480 				if (ipif_comp_multi(saved_ipif, ipif, isv6)) {
4481 					if (saved_ipif->ipif_ill != ill)
4482 						ipif_refrele(saved_ipif);
4483 					saved_ipif = ipif;
4484 				}
4485 			}
4486 		}
4487 		/*
4488 		 * Before going to the next ill, do a ipif_refhold() on the
4489 		 * saved ones.
4490 		 */
4491 		if (saved_ipif != NULL && saved_ipif->ipif_ill == ill)
4492 			ipif_refhold_locked(saved_ipif);
4493 		if (dep_ipif != NULL && dep_ipif->ipif_ill == ill)
4494 			ipif_refhold_locked(dep_ipif);
4495 		mutex_exit(&ill->ill_lock);
4496 	}
4497 	rw_exit(&ipst->ips_ill_g_lock);
4498 
4499 	/*
4500 	 * If we have only the saved_ipif, return it.  But if we have both
4501 	 * saved_ipif and dep_ipif, check to see which one is better.
4502 	 */
4503 	if (saved_ipif != NULL) {
4504 		if (dep_ipif != NULL) {
4505 			if (ipif_comp_multi(saved_ipif, dep_ipif, isv6)) {
4506 				ipif_refrele(saved_ipif);
4507 				return (dep_ipif);
4508 			} else {
4509 				ipif_refrele(dep_ipif);
4510 				return (saved_ipif);
4511 			}
4512 		}
4513 		return (saved_ipif);
4514 	} else {
4515 		return (dep_ipif);
4516 	}
4517 }
4518 
4519 ill_t *
ill_lookup_multicast(ip_stack_t * ipst,zoneid_t zoneid,boolean_t isv6)4520 ill_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4521 {
4522 	ipif_t *ipif;
4523 	ill_t *ill;
4524 
4525 	ipif = ipif_lookup_multicast(ipst, zoneid, isv6);
4526 	if (ipif == NULL)
4527 		return (NULL);
4528 
4529 	ill = ipif->ipif_ill;
4530 	ill_refhold(ill);
4531 	ipif_refrele(ipif);
4532 	return (ill);
4533 }
4534 
4535 /*
4536  * This function is called when an application does not specify an interface
4537  * to be used for multicast traffic (joining a group/sending data).  It
4538  * calls ire_lookup_multi() to look for an interface route for the
4539  * specified multicast group.  Doing this allows the administrator to add
4540  * prefix routes for multicast to indicate which interface to be used for
4541  * multicast traffic in the above scenario.  The route could be for all
4542  * multicast (224.0/4), for a single multicast group (a /32 route) or
4543  * anything in between.  If there is no such multicast route, we just find
4544  * any multicast capable interface and return it.  The returned ipif
4545  * is refhold'ed.
4546  *
4547  * We support MULTIRT and RTF_SETSRC on the multicast routes added to the
4548  * unicast table. This is used by CGTP.
4549  */
4550 ill_t *
ill_lookup_group_v4(ipaddr_t group,zoneid_t zoneid,ip_stack_t * ipst,boolean_t * multirtp,ipaddr_t * setsrcp)4551 ill_lookup_group_v4(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst,
4552     boolean_t *multirtp, ipaddr_t *setsrcp)
4553 {
4554 	ill_t			*ill;
4555 
4556 	ill = ire_lookup_multi_ill_v4(group, zoneid, ipst, multirtp, setsrcp);
4557 	if (ill != NULL)
4558 		return (ill);
4559 
4560 	return (ill_lookup_multicast(ipst, zoneid, B_FALSE));
4561 }
4562 
4563 /*
4564  * Look for an ipif with the specified interface address and destination.
4565  * The destination address is used only for matching point-to-point interfaces.
4566  */
4567 ipif_t *
ipif_lookup_interface(ipaddr_t if_addr,ipaddr_t dst,ip_stack_t * ipst)4568 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, ip_stack_t *ipst)
4569 {
4570 	ipif_t	*ipif;
4571 	ill_t	*ill;
4572 	ill_walk_context_t ctx;
4573 
4574 	/*
4575 	 * First match all the point-to-point interfaces
4576 	 * before looking at non-point-to-point interfaces.
4577 	 * This is done to avoid returning non-point-to-point
4578 	 * ipif instead of unnumbered point-to-point ipif.
4579 	 */
4580 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4581 	ill = ILL_START_WALK_V4(&ctx, ipst);
4582 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4583 		mutex_enter(&ill->ill_lock);
4584 		for (ipif = ill->ill_ipif; ipif != NULL;
4585 		    ipif = ipif->ipif_next) {
4586 			/* Allow the ipif to be down */
4587 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
4588 			    (ipif->ipif_lcl_addr == if_addr) &&
4589 			    (ipif->ipif_pp_dst_addr == dst)) {
4590 				if (!IPIF_IS_CONDEMNED(ipif)) {
4591 					ipif_refhold_locked(ipif);
4592 					mutex_exit(&ill->ill_lock);
4593 					rw_exit(&ipst->ips_ill_g_lock);
4594 					return (ipif);
4595 				}
4596 			}
4597 		}
4598 		mutex_exit(&ill->ill_lock);
4599 	}
4600 	rw_exit(&ipst->ips_ill_g_lock);
4601 
4602 	/* lookup the ipif based on interface address */
4603 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, ipst);
4604 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
4605 	return (ipif);
4606 }
4607 
4608 /*
4609  * Common function for ipif_lookup_addr() and ipif_lookup_addr_exact().
4610  */
4611 static ipif_t *
ipif_lookup_addr_common(ipaddr_t addr,ill_t * match_ill,uint32_t match_flags,zoneid_t zoneid,ip_stack_t * ipst)4612 ipif_lookup_addr_common(ipaddr_t addr, ill_t *match_ill, uint32_t match_flags,
4613     zoneid_t zoneid, ip_stack_t *ipst)
4614 {
4615 	ipif_t  *ipif;
4616 	ill_t   *ill;
4617 	boolean_t ptp = B_FALSE;
4618 	ill_walk_context_t	ctx;
4619 	boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP);
4620 	boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP);
4621 
4622 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4623 	/*
4624 	 * Repeat twice, first based on local addresses and
4625 	 * next time for pointopoint.
4626 	 */
4627 repeat:
4628 	ill = ILL_START_WALK_V4(&ctx, ipst);
4629 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4630 		if (match_ill != NULL && ill != match_ill &&
4631 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
4632 			continue;
4633 		}
4634 		mutex_enter(&ill->ill_lock);
4635 		for (ipif = ill->ill_ipif; ipif != NULL;
4636 		    ipif = ipif->ipif_next) {
4637 			if (zoneid != ALL_ZONES &&
4638 			    zoneid != ipif->ipif_zoneid &&
4639 			    ipif->ipif_zoneid != ALL_ZONES)
4640 				continue;
4641 
4642 			if (no_duplicate && !(ipif->ipif_flags & IPIF_UP))
4643 				continue;
4644 
4645 			/* Allow the ipif to be down */
4646 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4647 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4648 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4649 			    (ipif->ipif_pp_dst_addr == addr))) {
4650 				if (!IPIF_IS_CONDEMNED(ipif)) {
4651 					ipif_refhold_locked(ipif);
4652 					mutex_exit(&ill->ill_lock);
4653 					rw_exit(&ipst->ips_ill_g_lock);
4654 					return (ipif);
4655 				}
4656 			}
4657 		}
4658 		mutex_exit(&ill->ill_lock);
4659 	}
4660 
4661 	/* If we already did the ptp case, then we are done */
4662 	if (ptp) {
4663 		rw_exit(&ipst->ips_ill_g_lock);
4664 		return (NULL);
4665 	}
4666 	ptp = B_TRUE;
4667 	goto repeat;
4668 }
4669 
4670 /*
4671  * Lookup an ipif with the specified address.  For point-to-point links we
4672  * look for matches on either the destination address or the local address,
4673  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
4674  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
4675  * (or illgrp if `match_ill' is in an IPMP group).
4676  */
4677 ipif_t *
ipif_lookup_addr(ipaddr_t addr,ill_t * match_ill,zoneid_t zoneid,ip_stack_t * ipst)4678 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4679     ip_stack_t *ipst)
4680 {
4681 	return (ipif_lookup_addr_common(addr, match_ill, IPIF_MATCH_ILLGRP,
4682 	    zoneid, ipst));
4683 }
4684 
4685 /*
4686  * Lookup an ipif with the specified address. Similar to ipif_lookup_addr,
4687  * except that we will only return an address if it is not marked as
4688  * IPIF_DUPLICATE
4689  */
4690 ipif_t *
ipif_lookup_addr_nondup(ipaddr_t addr,ill_t * match_ill,zoneid_t zoneid,ip_stack_t * ipst)4691 ipif_lookup_addr_nondup(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4692     ip_stack_t *ipst)
4693 {
4694 	return (ipif_lookup_addr_common(addr, match_ill,
4695 	    (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP),
4696 	    zoneid, ipst));
4697 }
4698 
4699 /*
4700  * Special abbreviated version of ipif_lookup_addr() that doesn't match
4701  * `match_ill' across the IPMP group.  This function is only needed in some
4702  * corner-cases; almost everything should use ipif_lookup_addr().
4703  */
4704 ipif_t *
ipif_lookup_addr_exact(ipaddr_t addr,ill_t * match_ill,ip_stack_t * ipst)4705 ipif_lookup_addr_exact(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4706 {
4707 	ASSERT(match_ill != NULL);
4708 	return (ipif_lookup_addr_common(addr, match_ill, 0, ALL_ZONES,
4709 	    ipst));
4710 }
4711 
4712 /*
4713  * Look for an ipif with the specified address. For point-point links
4714  * we look for matches on either the destination address and the local
4715  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
4716  * is set.
4717  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
4718  * ill (or illgrp if `match_ill' is in an IPMP group).
4719  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
4720  */
4721 zoneid_t
ipif_lookup_addr_zoneid(ipaddr_t addr,ill_t * match_ill,ip_stack_t * ipst)4722 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4723 {
4724 	zoneid_t zoneid;
4725 	ipif_t  *ipif;
4726 	ill_t   *ill;
4727 	boolean_t ptp = B_FALSE;
4728 	ill_walk_context_t	ctx;
4729 
4730 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4731 	/*
4732 	 * Repeat twice, first based on local addresses and
4733 	 * next time for pointopoint.
4734 	 */
4735 repeat:
4736 	ill = ILL_START_WALK_V4(&ctx, ipst);
4737 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4738 		if (match_ill != NULL && ill != match_ill &&
4739 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
4740 			continue;
4741 		}
4742 		mutex_enter(&ill->ill_lock);
4743 		for (ipif = ill->ill_ipif; ipif != NULL;
4744 		    ipif = ipif->ipif_next) {
4745 			/* Allow the ipif to be down */
4746 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4747 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4748 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4749 			    (ipif->ipif_pp_dst_addr == addr)) &&
4750 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
4751 				zoneid = ipif->ipif_zoneid;
4752 				mutex_exit(&ill->ill_lock);
4753 				rw_exit(&ipst->ips_ill_g_lock);
4754 				/*
4755 				 * If ipif_zoneid was ALL_ZONES then we have
4756 				 * a trusted extensions shared IP address.
4757 				 * In that case GLOBAL_ZONEID works to send.
4758 				 */
4759 				if (zoneid == ALL_ZONES)
4760 					zoneid = GLOBAL_ZONEID;
4761 				return (zoneid);
4762 			}
4763 		}
4764 		mutex_exit(&ill->ill_lock);
4765 	}
4766 
4767 	/* If we already did the ptp case, then we are done */
4768 	if (ptp) {
4769 		rw_exit(&ipst->ips_ill_g_lock);
4770 		return (ALL_ZONES);
4771 	}
4772 	ptp = B_TRUE;
4773 	goto repeat;
4774 }
4775 
4776 /*
4777  * Look for an ipif that matches the specified remote address i.e. the
4778  * ipif that would receive the specified packet.
4779  * First look for directly connected interfaces and then do a recursive
4780  * IRE lookup and pick the first ipif corresponding to the source address in the
4781  * ire.
4782  * Returns: held ipif
4783  *
4784  * This is only used for ICMP_ADDRESS_MASK_REQUESTs
4785  */
4786 ipif_t *
ipif_lookup_remote(ill_t * ill,ipaddr_t addr,zoneid_t zoneid)4787 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
4788 {
4789 	ipif_t	*ipif;
4790 
4791 	ASSERT(!ill->ill_isv6);
4792 
4793 	/*
4794 	 * Someone could be changing this ipif currently or change it
4795 	 * after we return this. Thus  a few packets could use the old
4796 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
4797 	 * will atomically be updated or cleaned up with the new value
4798 	 * Thus we don't need a lock to check the flags or other attrs below.
4799 	 */
4800 	mutex_enter(&ill->ill_lock);
4801 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4802 		if (IPIF_IS_CONDEMNED(ipif))
4803 			continue;
4804 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
4805 		    ipif->ipif_zoneid != ALL_ZONES)
4806 			continue;
4807 		/* Allow the ipif to be down */
4808 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
4809 			if ((ipif->ipif_pp_dst_addr == addr) ||
4810 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
4811 			    ipif->ipif_lcl_addr == addr)) {
4812 				ipif_refhold_locked(ipif);
4813 				mutex_exit(&ill->ill_lock);
4814 				return (ipif);
4815 			}
4816 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
4817 			ipif_refhold_locked(ipif);
4818 			mutex_exit(&ill->ill_lock);
4819 			return (ipif);
4820 		}
4821 	}
4822 	mutex_exit(&ill->ill_lock);
4823 	/*
4824 	 * For a remote destination it isn't possible to nail down a particular
4825 	 * ipif.
4826 	 */
4827 
4828 	/* Pick the first interface */
4829 	ipif = ipif_get_next_ipif(NULL, ill);
4830 	return (ipif);
4831 }
4832 
4833 /*
4834  * This func does not prevent refcnt from increasing. But if
4835  * the caller has taken steps to that effect, then this func
4836  * can be used to determine whether the ill has become quiescent
4837  */
4838 static boolean_t
ill_is_quiescent(ill_t * ill)4839 ill_is_quiescent(ill_t *ill)
4840 {
4841 	ipif_t	*ipif;
4842 
4843 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4844 
4845 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4846 		if (ipif->ipif_refcnt != 0)
4847 			return (B_FALSE);
4848 	}
4849 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
4850 		return (B_FALSE);
4851 	}
4852 	return (B_TRUE);
4853 }
4854 
4855 boolean_t
ill_is_freeable(ill_t * ill)4856 ill_is_freeable(ill_t *ill)
4857 {
4858 	ipif_t	*ipif;
4859 
4860 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4861 
4862 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4863 		if (ipif->ipif_refcnt != 0) {
4864 			return (B_FALSE);
4865 		}
4866 	}
4867 	if (!ILL_FREE_OK(ill) || ill->ill_refcnt != 0) {
4868 		return (B_FALSE);
4869 	}
4870 	return (B_TRUE);
4871 }
4872 
4873 /*
4874  * This func does not prevent refcnt from increasing. But if
4875  * the caller has taken steps to that effect, then this func
4876  * can be used to determine whether the ipif has become quiescent
4877  */
4878 static boolean_t
ipif_is_quiescent(ipif_t * ipif)4879 ipif_is_quiescent(ipif_t *ipif)
4880 {
4881 	ill_t *ill;
4882 
4883 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4884 
4885 	if (ipif->ipif_refcnt != 0)
4886 		return (B_FALSE);
4887 
4888 	ill = ipif->ipif_ill;
4889 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
4890 	    ill->ill_logical_down) {
4891 		return (B_TRUE);
4892 	}
4893 
4894 	/* This is the last ipif going down or being deleted on this ill */
4895 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0) {
4896 		return (B_FALSE);
4897 	}
4898 
4899 	return (B_TRUE);
4900 }
4901 
4902 /*
4903  * return true if the ipif can be destroyed: the ipif has to be quiescent
4904  * with zero references from ire/ilm to it.
4905  */
4906 static boolean_t
ipif_is_freeable(ipif_t * ipif)4907 ipif_is_freeable(ipif_t *ipif)
4908 {
4909 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4910 	ASSERT(ipif->ipif_id != 0);
4911 	return (ipif->ipif_refcnt == 0);
4912 }
4913 
4914 /*
4915  * The ipif/ill/ire has been refreled. Do the tail processing.
4916  * Determine if the ipif or ill in question has become quiescent and if so
4917  * wakeup close and/or restart any queued pending ioctl that is waiting
4918  * for the ipif_down (or ill_down)
4919  */
4920 void
ipif_ill_refrele_tail(ill_t * ill)4921 ipif_ill_refrele_tail(ill_t *ill)
4922 {
4923 	mblk_t	*mp;
4924 	conn_t	*connp;
4925 	ipsq_t	*ipsq;
4926 	ipxop_t	*ipx;
4927 	ipif_t	*ipif;
4928 	dl_notify_ind_t *dlindp;
4929 
4930 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4931 
4932 	if ((ill->ill_state_flags & ILL_CONDEMNED) && ill_is_freeable(ill)) {
4933 		/* ip_modclose() may be waiting */
4934 		cv_broadcast(&ill->ill_cv);
4935 	}
4936 
4937 	ipsq = ill->ill_phyint->phyint_ipsq;
4938 	mutex_enter(&ipsq->ipsq_lock);
4939 	ipx = ipsq->ipsq_xop;
4940 	mutex_enter(&ipx->ipx_lock);
4941 	if (ipx->ipx_waitfor == 0)	/* no one's waiting; bail */
4942 		goto unlock;
4943 
4944 	ASSERT(ipx->ipx_pending_mp != NULL && ipx->ipx_pending_ipif != NULL);
4945 
4946 	ipif = ipx->ipx_pending_ipif;
4947 	if (ipif->ipif_ill != ill)	/* wait is for another ill; bail */
4948 		goto unlock;
4949 
4950 	switch (ipx->ipx_waitfor) {
4951 	case IPIF_DOWN:
4952 		if (!ipif_is_quiescent(ipif))
4953 			goto unlock;
4954 		break;
4955 	case IPIF_FREE:
4956 		if (!ipif_is_freeable(ipif))
4957 			goto unlock;
4958 		break;
4959 	case ILL_DOWN:
4960 		if (!ill_is_quiescent(ill))
4961 			goto unlock;
4962 		break;
4963 	case ILL_FREE:
4964 		/*
4965 		 * ILL_FREE is only for loopback; normal ill teardown waits
4966 		 * synchronously in ip_modclose() without using ipx_waitfor,
4967 		 * handled by the cv_broadcast() at the top of this function.
4968 		 */
4969 		if (!ill_is_freeable(ill))
4970 			goto unlock;
4971 		break;
4972 	default:
4973 		cmn_err(CE_PANIC, "ipsq: %p unknown ipx_waitfor %d\n",
4974 		    (void *)ipsq, ipx->ipx_waitfor);
4975 	}
4976 
4977 	ill_refhold_locked(ill);	/* for qwriter_ip() call below */
4978 	mutex_exit(&ipx->ipx_lock);
4979 	mp = ipsq_pending_mp_get(ipsq, &connp);
4980 	mutex_exit(&ipsq->ipsq_lock);
4981 	mutex_exit(&ill->ill_lock);
4982 
4983 	ASSERT(mp != NULL);
4984 	/*
4985 	 * NOTE: all of the qwriter_ip() calls below use CUR_OP since
4986 	 * we can only get here when the current operation decides it
4987 	 * it needs to quiesce via ipsq_pending_mp_add().
4988 	 */
4989 	switch (mp->b_datap->db_type) {
4990 	case M_PCPROTO:
4991 	case M_PROTO:
4992 		/*
4993 		 * For now, only DL_NOTIFY_IND messages can use this facility.
4994 		 */
4995 		dlindp = (dl_notify_ind_t *)mp->b_rptr;
4996 		ASSERT(dlindp->dl_primitive == DL_NOTIFY_IND);
4997 
4998 		switch (dlindp->dl_notification) {
4999 		case DL_NOTE_PHYS_ADDR:
5000 			qwriter_ip(ill, ill->ill_rq, mp,
5001 			    ill_set_phys_addr_tail, CUR_OP, B_TRUE);
5002 			return;
5003 		case DL_NOTE_REPLUMB:
5004 			qwriter_ip(ill, ill->ill_rq, mp,
5005 			    ill_replumb_tail, CUR_OP, B_TRUE);
5006 			return;
5007 		default:
5008 			ASSERT(0);
5009 			ill_refrele(ill);
5010 		}
5011 		break;
5012 
5013 	case M_ERROR:
5014 	case M_HANGUP:
5015 		qwriter_ip(ill, ill->ill_rq, mp, ipif_all_down_tail, CUR_OP,
5016 		    B_TRUE);
5017 		return;
5018 
5019 	case M_IOCTL:
5020 	case M_IOCDATA:
5021 		qwriter_ip(ill, (connp != NULL ? CONNP_TO_WQ(connp) :
5022 		    ill->ill_wq), mp, ip_reprocess_ioctl, CUR_OP, B_TRUE);
5023 		return;
5024 
5025 	default:
5026 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
5027 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
5028 	}
5029 	return;
5030 unlock:
5031 	mutex_exit(&ipsq->ipsq_lock);
5032 	mutex_exit(&ipx->ipx_lock);
5033 	mutex_exit(&ill->ill_lock);
5034 }
5035 
5036 #ifdef DEBUG
5037 /* Reuse trace buffer from beginning (if reached the end) and record trace */
5038 static void
th_trace_rrecord(th_trace_t * th_trace)5039 th_trace_rrecord(th_trace_t *th_trace)
5040 {
5041 	tr_buf_t *tr_buf;
5042 	uint_t lastref;
5043 
5044 	lastref = th_trace->th_trace_lastref;
5045 	lastref++;
5046 	if (lastref == TR_BUF_MAX)
5047 		lastref = 0;
5048 	th_trace->th_trace_lastref = lastref;
5049 	tr_buf = &th_trace->th_trbuf[lastref];
5050 	tr_buf->tr_time = ddi_get_lbolt();
5051 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, TR_STACK_DEPTH);
5052 }
5053 
5054 static void
th_trace_free(void * value)5055 th_trace_free(void *value)
5056 {
5057 	th_trace_t *th_trace = value;
5058 
5059 	ASSERT(th_trace->th_refcnt == 0);
5060 	kmem_free(th_trace, sizeof (*th_trace));
5061 }
5062 
5063 /*
5064  * Find or create the per-thread hash table used to track object references.
5065  * The ipst argument is NULL if we shouldn't allocate.
5066  *
5067  * Accesses per-thread data, so there's no need to lock here.
5068  */
5069 static mod_hash_t *
th_trace_gethash(ip_stack_t * ipst)5070 th_trace_gethash(ip_stack_t *ipst)
5071 {
5072 	th_hash_t *thh;
5073 
5074 	if ((thh = tsd_get(ip_thread_data)) == NULL && ipst != NULL) {
5075 		mod_hash_t *mh;
5076 		char name[256];
5077 		size_t objsize, rshift;
5078 		int retv;
5079 
5080 		if ((thh = kmem_alloc(sizeof (*thh), KM_NOSLEEP)) == NULL)
5081 			return (NULL);
5082 		(void) snprintf(name, sizeof (name), "th_trace_%p",
5083 		    (void *)curthread);
5084 
5085 		/*
5086 		 * We use mod_hash_create_extended here rather than the more
5087 		 * obvious mod_hash_create_ptrhash because the latter has a
5088 		 * hard-coded KM_SLEEP, and we'd prefer to fail rather than
5089 		 * block.
5090 		 */
5091 		objsize = MAX(MAX(sizeof (ill_t), sizeof (ipif_t)),
5092 		    MAX(sizeof (ire_t), sizeof (ncec_t)));
5093 		rshift = highbit(objsize);
5094 		mh = mod_hash_create_extended(name, 64, mod_hash_null_keydtor,
5095 		    th_trace_free, mod_hash_byptr, (void *)rshift,
5096 		    mod_hash_ptrkey_cmp, KM_NOSLEEP);
5097 		if (mh == NULL) {
5098 			kmem_free(thh, sizeof (*thh));
5099 			return (NULL);
5100 		}
5101 		thh->thh_hash = mh;
5102 		thh->thh_ipst = ipst;
5103 		/*
5104 		 * We trace ills, ipifs, ires, and nces.  All of these are
5105 		 * per-IP-stack, so the lock on the thread list is as well.
5106 		 */
5107 		rw_enter(&ip_thread_rwlock, RW_WRITER);
5108 		list_insert_tail(&ip_thread_list, thh);
5109 		rw_exit(&ip_thread_rwlock);
5110 		retv = tsd_set(ip_thread_data, thh);
5111 		ASSERT(retv == 0);
5112 	}
5113 	return (thh != NULL ? thh->thh_hash : NULL);
5114 }
5115 
5116 boolean_t
th_trace_ref(const void * obj,ip_stack_t * ipst)5117 th_trace_ref(const void *obj, ip_stack_t *ipst)
5118 {
5119 	th_trace_t *th_trace;
5120 	mod_hash_t *mh;
5121 	mod_hash_val_t val;
5122 
5123 	if ((mh = th_trace_gethash(ipst)) == NULL)
5124 		return (B_FALSE);
5125 
5126 	/*
5127 	 * Attempt to locate the trace buffer for this obj and thread.
5128 	 * If it does not exist, then allocate a new trace buffer and
5129 	 * insert into the hash.
5130 	 */
5131 	if (mod_hash_find(mh, (mod_hash_key_t)obj, &val) == MH_ERR_NOTFOUND) {
5132 		th_trace = kmem_zalloc(sizeof (th_trace_t), KM_NOSLEEP);
5133 		if (th_trace == NULL)
5134 			return (B_FALSE);
5135 
5136 		th_trace->th_id = curthread;
5137 		if (mod_hash_insert(mh, (mod_hash_key_t)obj,
5138 		    (mod_hash_val_t)th_trace) != 0) {
5139 			kmem_free(th_trace, sizeof (th_trace_t));
5140 			return (B_FALSE);
5141 		}
5142 	} else {
5143 		th_trace = (th_trace_t *)val;
5144 	}
5145 
5146 	ASSERT(th_trace->th_refcnt >= 0 &&
5147 	    th_trace->th_refcnt < TR_BUF_MAX - 1);
5148 
5149 	th_trace->th_refcnt++;
5150 	th_trace_rrecord(th_trace);
5151 	return (B_TRUE);
5152 }
5153 
5154 /*
5155  * For the purpose of tracing a reference release, we assume that global
5156  * tracing is always on and that the same thread initiated the reference hold
5157  * is releasing.
5158  */
5159 void
th_trace_unref(const void * obj)5160 th_trace_unref(const void *obj)
5161 {
5162 	int retv;
5163 	mod_hash_t *mh;
5164 	th_trace_t *th_trace;
5165 	mod_hash_val_t val;
5166 
5167 	mh = th_trace_gethash(NULL);
5168 	retv = mod_hash_find(mh, (mod_hash_key_t)obj, &val);
5169 	ASSERT(retv == 0);
5170 	th_trace = (th_trace_t *)val;
5171 
5172 	ASSERT(th_trace->th_refcnt > 0);
5173 	th_trace->th_refcnt--;
5174 	th_trace_rrecord(th_trace);
5175 }
5176 
5177 /*
5178  * If tracing has been disabled, then we assume that the reference counts are
5179  * now useless, and we clear them out before destroying the entries.
5180  */
5181 void
th_trace_cleanup(const void * obj,boolean_t trace_disable)5182 th_trace_cleanup(const void *obj, boolean_t trace_disable)
5183 {
5184 	th_hash_t	*thh;
5185 	mod_hash_t	*mh;
5186 	mod_hash_val_t	val;
5187 	th_trace_t	*th_trace;
5188 	int		retv;
5189 
5190 	rw_enter(&ip_thread_rwlock, RW_READER);
5191 	for (thh = list_head(&ip_thread_list); thh != NULL;
5192 	    thh = list_next(&ip_thread_list, thh)) {
5193 		if (mod_hash_find(mh = thh->thh_hash, (mod_hash_key_t)obj,
5194 		    &val) == 0) {
5195 			th_trace = (th_trace_t *)val;
5196 			if (trace_disable)
5197 				th_trace->th_refcnt = 0;
5198 			retv = mod_hash_destroy(mh, (mod_hash_key_t)obj);
5199 			ASSERT(retv == 0);
5200 		}
5201 	}
5202 	rw_exit(&ip_thread_rwlock);
5203 }
5204 
5205 void
ipif_trace_ref(ipif_t * ipif)5206 ipif_trace_ref(ipif_t *ipif)
5207 {
5208 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5209 
5210 	if (ipif->ipif_trace_disable)
5211 		return;
5212 
5213 	if (!th_trace_ref(ipif, ipif->ipif_ill->ill_ipst)) {
5214 		ipif->ipif_trace_disable = B_TRUE;
5215 		ipif_trace_cleanup(ipif);
5216 	}
5217 }
5218 
5219 void
ipif_untrace_ref(ipif_t * ipif)5220 ipif_untrace_ref(ipif_t *ipif)
5221 {
5222 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5223 
5224 	if (!ipif->ipif_trace_disable)
5225 		th_trace_unref(ipif);
5226 }
5227 
5228 void
ill_trace_ref(ill_t * ill)5229 ill_trace_ref(ill_t *ill)
5230 {
5231 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5232 
5233 	if (ill->ill_trace_disable)
5234 		return;
5235 
5236 	if (!th_trace_ref(ill, ill->ill_ipst)) {
5237 		ill->ill_trace_disable = B_TRUE;
5238 		ill_trace_cleanup(ill);
5239 	}
5240 }
5241 
5242 void
ill_untrace_ref(ill_t * ill)5243 ill_untrace_ref(ill_t *ill)
5244 {
5245 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5246 
5247 	if (!ill->ill_trace_disable)
5248 		th_trace_unref(ill);
5249 }
5250 
5251 /*
5252  * Called when ipif is unplumbed or when memory alloc fails.  Note that on
5253  * failure, ipif_trace_disable is set.
5254  */
5255 static void
ipif_trace_cleanup(const ipif_t * ipif)5256 ipif_trace_cleanup(const ipif_t *ipif)
5257 {
5258 	th_trace_cleanup(ipif, ipif->ipif_trace_disable);
5259 }
5260 
5261 /*
5262  * Called when ill is unplumbed or when memory alloc fails.  Note that on
5263  * failure, ill_trace_disable is set.
5264  */
5265 static void
ill_trace_cleanup(const ill_t * ill)5266 ill_trace_cleanup(const ill_t *ill)
5267 {
5268 	th_trace_cleanup(ill, ill->ill_trace_disable);
5269 }
5270 #endif /* DEBUG */
5271 
5272 void
ipif_refhold_locked(ipif_t * ipif)5273 ipif_refhold_locked(ipif_t *ipif)
5274 {
5275 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5276 	ipif->ipif_refcnt++;
5277 	IPIF_TRACE_REF(ipif);
5278 }
5279 
5280 void
ipif_refhold(ipif_t * ipif)5281 ipif_refhold(ipif_t *ipif)
5282 {
5283 	ill_t	*ill;
5284 
5285 	ill = ipif->ipif_ill;
5286 	mutex_enter(&ill->ill_lock);
5287 	ipif->ipif_refcnt++;
5288 	IPIF_TRACE_REF(ipif);
5289 	mutex_exit(&ill->ill_lock);
5290 }
5291 
5292 /*
5293  * Must not be called while holding any locks. Otherwise if this is
5294  * the last reference to be released there is a chance of recursive mutex
5295  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5296  * to restart an ioctl.
5297  */
5298 void
ipif_refrele(ipif_t * ipif)5299 ipif_refrele(ipif_t *ipif)
5300 {
5301 	ill_t	*ill;
5302 
5303 	ill = ipif->ipif_ill;
5304 
5305 	mutex_enter(&ill->ill_lock);
5306 	ASSERT(ipif->ipif_refcnt != 0);
5307 	ipif->ipif_refcnt--;
5308 	IPIF_UNTRACE_REF(ipif);
5309 	if (ipif->ipif_refcnt != 0) {
5310 		mutex_exit(&ill->ill_lock);
5311 		return;
5312 	}
5313 
5314 	/* Drops the ill_lock */
5315 	ipif_ill_refrele_tail(ill);
5316 }
5317 
5318 ipif_t *
ipif_get_next_ipif(ipif_t * curr,ill_t * ill)5319 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
5320 {
5321 	ipif_t	*ipif;
5322 
5323 	mutex_enter(&ill->ill_lock);
5324 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
5325 	    ipif != NULL; ipif = ipif->ipif_next) {
5326 		if (IPIF_IS_CONDEMNED(ipif))
5327 			continue;
5328 		ipif_refhold_locked(ipif);
5329 		mutex_exit(&ill->ill_lock);
5330 		return (ipif);
5331 	}
5332 	mutex_exit(&ill->ill_lock);
5333 	return (NULL);
5334 }
5335 
5336 /*
5337  * TODO: make this table extendible at run time
5338  * Return a pointer to the mac type info for 'mac_type'
5339  */
5340 static ip_m_t *
ip_m_lookup(t_uscalar_t mac_type)5341 ip_m_lookup(t_uscalar_t mac_type)
5342 {
5343 	ip_m_t	*ipm;
5344 
5345 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
5346 		if (ipm->ip_m_mac_type == mac_type)
5347 			return (ipm);
5348 	return (NULL);
5349 }
5350 
5351 /*
5352  * Make a link layer address from the multicast IP address *addr.
5353  * To form the link layer address, invoke the ip_m_v*mapping function
5354  * associated with the link-layer type.
5355  */
5356 void
ip_mcast_mapping(ill_t * ill,uchar_t * addr,uchar_t * hwaddr)5357 ip_mcast_mapping(ill_t *ill, uchar_t *addr, uchar_t *hwaddr)
5358 {
5359 	ip_m_t *ipm;
5360 
5361 	if (ill->ill_net_type == IRE_IF_NORESOLVER)
5362 		return;
5363 
5364 	ASSERT(addr != NULL);
5365 
5366 	ipm = ip_m_lookup(ill->ill_mactype);
5367 	if (ipm == NULL ||
5368 	    (ill->ill_isv6 && ipm->ip_m_v6mapping == NULL) ||
5369 	    (!ill->ill_isv6 && ipm->ip_m_v4mapping == NULL)) {
5370 		ip0dbg(("no mapping for ill %s mactype 0x%x\n",
5371 		    ill->ill_name, ill->ill_mactype));
5372 		return;
5373 	}
5374 	if (ill->ill_isv6)
5375 		(*ipm->ip_m_v6mapping)(ill, addr, hwaddr);
5376 	else
5377 		(*ipm->ip_m_v4mapping)(ill, addr, hwaddr);
5378 }
5379 
5380 /*
5381  * Returns B_FALSE if the IPv4 netmask pointed by `mask' is non-contiguous.
5382  * Otherwise returns B_TRUE.
5383  *
5384  * The netmask can be verified to be contiguous with 32 shifts and or
5385  * operations. Take the contiguous mask (in host byte order) and compute
5386  *	mask | mask << 1 | mask << 2 | ... | mask << 31
5387  * the result will be the same as the 'mask' for contiguous mask.
5388  */
5389 static boolean_t
ip_contiguous_mask(uint32_t mask)5390 ip_contiguous_mask(uint32_t mask)
5391 {
5392 	uint32_t	m = mask;
5393 	int		i;
5394 
5395 	for (i = 1; i < 32; i++)
5396 		m |= (mask << i);
5397 
5398 	return (m == mask);
5399 }
5400 
5401 /*
5402  * ip_rt_add is called to add an IPv4 route to the forwarding table.
5403  * ill is passed in to associate it with the correct interface.
5404  * If ire_arg is set, then we return the held IRE in that location.
5405  */
5406 int
ip_rt_add(ipaddr_t dst_addr,ipaddr_t mask,ipaddr_t gw_addr,ipaddr_t src_addr,int flags,ill_t * ill,ire_t ** ire_arg,boolean_t ioctl_msg,struct rtsa_s * sp,ip_stack_t * ipst,zoneid_t zoneid)5407 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5408     ipaddr_t src_addr, int flags, ill_t *ill, ire_t **ire_arg,
5409     boolean_t ioctl_msg, struct rtsa_s *sp, ip_stack_t *ipst, zoneid_t zoneid)
5410 {
5411 	ire_t	*ire, *nire;
5412 	ire_t	*gw_ire = NULL;
5413 	ipif_t	*ipif = NULL;
5414 	uint_t	type;
5415 	int	match_flags = MATCH_IRE_TYPE;
5416 	tsol_gc_t *gc = NULL;
5417 	tsol_gcgrp_t *gcgrp = NULL;
5418 	boolean_t gcgrp_xtraref = B_FALSE;
5419 	boolean_t cgtp_broadcast;
5420 	boolean_t unbound = B_FALSE;
5421 
5422 	ip1dbg(("ip_rt_add:"));
5423 
5424 	if (ire_arg != NULL)
5425 		*ire_arg = NULL;
5426 
5427 	/* disallow non-contiguous netmasks */
5428 	if (!ip_contiguous_mask(ntohl(mask)))
5429 		return (ENOTSUP);
5430 
5431 	/*
5432 	 * If this is the case of RTF_HOST being set, then we set the netmask
5433 	 * to all ones (regardless if one was supplied).
5434 	 */
5435 	if (flags & RTF_HOST)
5436 		mask = IP_HOST_MASK;
5437 
5438 	/*
5439 	 * Prevent routes with a zero gateway from being created (since
5440 	 * interfaces can currently be plumbed and brought up no assigned
5441 	 * address).
5442 	 */
5443 	if (gw_addr == 0)
5444 		return (ENETUNREACH);
5445 	/*
5446 	 * Get the ipif, if any, corresponding to the gw_addr
5447 	 * If -ifp was specified we restrict ourselves to the ill, otherwise
5448 	 * we match on the gatway and destination to handle unnumbered pt-pt
5449 	 * interfaces.
5450 	 */
5451 	if (ill != NULL)
5452 		ipif = ipif_lookup_addr(gw_addr, ill, ALL_ZONES, ipst);
5453 	else
5454 		ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
5455 	if (ipif != NULL) {
5456 		if (IS_VNI(ipif->ipif_ill)) {
5457 			ipif_refrele(ipif);
5458 			return (EINVAL);
5459 		}
5460 	}
5461 
5462 	/*
5463 	 * GateD will attempt to create routes with a loopback interface
5464 	 * address as the gateway and with RTF_GATEWAY set.  We allow
5465 	 * these routes to be added, but create them as interface routes
5466 	 * since the gateway is an interface address.
5467 	 */
5468 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
5469 		flags &= ~RTF_GATEWAY;
5470 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
5471 		    mask == IP_HOST_MASK) {
5472 			ire = ire_ftable_lookup_v4(dst_addr, 0, 0, IRE_LOOPBACK,
5473 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
5474 			    NULL);
5475 			if (ire != NULL) {
5476 				ire_refrele(ire);
5477 				ipif_refrele(ipif);
5478 				return (EEXIST);
5479 			}
5480 			ip1dbg(("ip_rt_add: 0x%p creating IRE 0x%x"
5481 			    "for 0x%x\n", (void *)ipif,
5482 			    ipif->ipif_ire_type,
5483 			    ntohl(ipif->ipif_lcl_addr)));
5484 			ire = ire_create(
5485 			    (uchar_t *)&dst_addr,	/* dest address */
5486 			    (uchar_t *)&mask,		/* mask */
5487 			    NULL,			/* no gateway */
5488 			    ipif->ipif_ire_type,	/* LOOPBACK */
5489 			    ipif->ipif_ill,
5490 			    zoneid,
5491 			    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
5492 			    NULL,
5493 			    ipst);
5494 
5495 			if (ire == NULL) {
5496 				ipif_refrele(ipif);
5497 				return (ENOMEM);
5498 			}
5499 			/* src address assigned by the caller? */
5500 			if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5501 				ire->ire_setsrc_addr = src_addr;
5502 
5503 			nire = ire_add(ire);
5504 			if (nire == NULL) {
5505 				/*
5506 				 * In the result of failure, ire_add() will have
5507 				 * already deleted the ire in question, so there
5508 				 * is no need to do that here.
5509 				 */
5510 				ipif_refrele(ipif);
5511 				return (ENOMEM);
5512 			}
5513 			/*
5514 			 * Check if it was a duplicate entry. This handles
5515 			 * the case of two racing route adds for the same route
5516 			 */
5517 			if (nire != ire) {
5518 				ASSERT(nire->ire_identical_ref > 1);
5519 				ire_delete(nire);
5520 				ire_refrele(nire);
5521 				ipif_refrele(ipif);
5522 				return (EEXIST);
5523 			}
5524 			ire = nire;
5525 			goto save_ire;
5526 		}
5527 	}
5528 
5529 	/*
5530 	 * The routes for multicast with CGTP are quite special in that
5531 	 * the gateway is the local interface address, yet RTF_GATEWAY
5532 	 * is set. We turn off RTF_GATEWAY to provide compatibility with
5533 	 * this undocumented and unusual use of multicast routes.
5534 	 */
5535 	if ((flags & RTF_MULTIRT) && ipif != NULL)
5536 		flags &= ~RTF_GATEWAY;
5537 
5538 	/*
5539 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
5540 	 * and the gateway address provided is one of the system's interface
5541 	 * addresses.  By using the routing socket interface and supplying an
5542 	 * RTA_IFP sockaddr with an interface index, an alternate method of
5543 	 * specifying an interface route to be created is available which uses
5544 	 * the interface index that specifies the outgoing interface rather than
5545 	 * the address of an outgoing interface (which may not be able to
5546 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
5547 	 * flag, routes can be specified which not only specify the next-hop to
5548 	 * be used when routing to a certain prefix, but also which outgoing
5549 	 * interface should be used.
5550 	 *
5551 	 * Previously, interfaces would have unique addresses assigned to them
5552 	 * and so the address assigned to a particular interface could be used
5553 	 * to identify a particular interface.  One exception to this was the
5554 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
5555 	 *
5556 	 * With the advent of IPv6 and its link-local addresses, this
5557 	 * restriction was relaxed and interfaces could share addresses between
5558 	 * themselves.  In fact, typically all of the link-local interfaces on
5559 	 * an IPv6 node or router will have the same link-local address.  In
5560 	 * order to differentiate between these interfaces, the use of an
5561 	 * interface index is necessary and this index can be carried inside a
5562 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
5563 	 * of using the interface index, however, is that all of the ipif's that
5564 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
5565 	 * cannot be used to differentiate between ipif's (or logical
5566 	 * interfaces) that belong to the same ill (physical interface).
5567 	 *
5568 	 * For example, in the following case involving IPv4 interfaces and
5569 	 * logical interfaces
5570 	 *
5571 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
5572 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0
5573 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0
5574 	 *
5575 	 * the ipif's corresponding to each of these interface routes can be
5576 	 * uniquely identified by the "gateway" (actually interface address).
5577 	 *
5578 	 * In this case involving multiple IPv6 default routes to a particular
5579 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
5580 	 * default route is of interest:
5581 	 *
5582 	 *	default		fe80::123:4567:89ab:cdef	U	if0
5583 	 *	default		fe80::123:4567:89ab:cdef	U	if1
5584 	 */
5585 
5586 	/* RTF_GATEWAY not set */
5587 	if (!(flags & RTF_GATEWAY)) {
5588 		if (sp != NULL) {
5589 			ip2dbg(("ip_rt_add: gateway security attributes "
5590 			    "cannot be set with interface route\n"));
5591 			if (ipif != NULL)
5592 				ipif_refrele(ipif);
5593 			return (EINVAL);
5594 		}
5595 
5596 		/*
5597 		 * Whether or not ill (RTA_IFP) is set, we require that
5598 		 * the gateway is one of our local addresses.
5599 		 */
5600 		if (ipif == NULL)
5601 			return (ENETUNREACH);
5602 
5603 		/*
5604 		 * We use MATCH_IRE_ILL here. If the caller specified an
5605 		 * interface (from the RTA_IFP sockaddr) we use it, otherwise
5606 		 * we use the ill derived from the gateway address.
5607 		 * We can always match the gateway address since we record it
5608 		 * in ire_gateway_addr.
5609 		 * We don't allow RTA_IFP to specify a different ill than the
5610 		 * one matching the ipif to make sure we can delete the route.
5611 		 */
5612 		match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL;
5613 		if (ill == NULL) {
5614 			ill = ipif->ipif_ill;
5615 		} else if (ill != ipif->ipif_ill) {
5616 			ipif_refrele(ipif);
5617 			return (EINVAL);
5618 		}
5619 
5620 		/*
5621 		 * We check for an existing entry at this point.
5622 		 *
5623 		 * Since a netmask isn't passed in via the ioctl interface
5624 		 * (SIOCADDRT), we don't check for a matching netmask in that
5625 		 * case.
5626 		 */
5627 		if (!ioctl_msg)
5628 			match_flags |= MATCH_IRE_MASK;
5629 		ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
5630 		    IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst,
5631 		    NULL);
5632 		if (ire != NULL) {
5633 			ire_refrele(ire);
5634 			ipif_refrele(ipif);
5635 			return (EEXIST);
5636 		}
5637 
5638 		/*
5639 		 * Some software (for example, GateD and Sun Cluster) attempts
5640 		 * to create (what amount to) IRE_PREFIX routes with the
5641 		 * loopback address as the gateway.  This is primarily done to
5642 		 * set up prefixes with the RTF_REJECT flag set (for example,
5643 		 * when generating aggregate routes.)
5644 		 *
5645 		 * If the IRE type (as defined by ill->ill_net_type) would be
5646 		 * IRE_LOOPBACK, then we map the request into a
5647 		 * IRE_IF_NORESOLVER. We also OR in the RTF_BLACKHOLE flag as
5648 		 * these interface routes, by definition, can only be that.
5649 		 *
5650 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
5651 		 * routine, but rather using ire_create() directly.
5652 		 *
5653 		 */
5654 		type = ill->ill_net_type;
5655 		if (type == IRE_LOOPBACK) {
5656 			type = IRE_IF_NORESOLVER;
5657 			flags |= RTF_BLACKHOLE;
5658 		}
5659 
5660 		/*
5661 		 * Create a copy of the IRE_IF_NORESOLVER or
5662 		 * IRE_IF_RESOLVER with the modified address, netmask, and
5663 		 * gateway.
5664 		 */
5665 		ire = ire_create(
5666 		    (uchar_t *)&dst_addr,
5667 		    (uint8_t *)&mask,
5668 		    (uint8_t *)&gw_addr,
5669 		    type,
5670 		    ill,
5671 		    zoneid,
5672 		    flags,
5673 		    NULL,
5674 		    ipst);
5675 		if (ire == NULL) {
5676 			ipif_refrele(ipif);
5677 			return (ENOMEM);
5678 		}
5679 
5680 		/* src address assigned by the caller? */
5681 		if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5682 			ire->ire_setsrc_addr = src_addr;
5683 
5684 		nire = ire_add(ire);
5685 		if (nire == NULL) {
5686 			/*
5687 			 * In the result of failure, ire_add() will have
5688 			 * already deleted the ire in question, so there
5689 			 * is no need to do that here.
5690 			 */
5691 			ipif_refrele(ipif);
5692 			return (ENOMEM);
5693 		}
5694 		/*
5695 		 * Check if it was a duplicate entry. This handles
5696 		 * the case of two racing route adds for the same route
5697 		 */
5698 		if (nire != ire) {
5699 			ire_delete(nire);
5700 			ire_refrele(nire);
5701 			ipif_refrele(ipif);
5702 			return (EEXIST);
5703 		}
5704 		ire = nire;
5705 		goto save_ire;
5706 	}
5707 
5708 	/*
5709 	 * Get an interface IRE for the specified gateway.
5710 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
5711 	 * gateway, it is currently unreachable and we fail the request
5712 	 * accordingly. We reject any RTF_GATEWAY routes where the gateway
5713 	 * is an IRE_LOCAL or IRE_LOOPBACK.
5714 	 * If RTA_IFP was specified we look on that particular ill.
5715 	 */
5716 	if (ill != NULL)
5717 		match_flags |= MATCH_IRE_ILL;
5718 
5719 	/* Check whether the gateway is reachable. */
5720 again:
5721 	type = IRE_INTERFACE | IRE_LOCAL | IRE_LOOPBACK;
5722 	if (flags & RTF_INDIRECT)
5723 		type |= IRE_OFFLINK;
5724 
5725 	gw_ire = ire_ftable_lookup_v4(gw_addr, 0, 0, type, ill,
5726 	    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
5727 	if (gw_ire == NULL) {
5728 		/*
5729 		 * With IPMP, we allow host routes to influence in.mpathd's
5730 		 * target selection.  However, if the test addresses are on
5731 		 * their own network, the above lookup will fail since the
5732 		 * underlying IRE_INTERFACEs are marked hidden.  So allow
5733 		 * hidden test IREs to be found and try again.
5734 		 */
5735 		if (!(match_flags & MATCH_IRE_TESTHIDDEN))  {
5736 			match_flags |= MATCH_IRE_TESTHIDDEN;
5737 			goto again;
5738 		}
5739 		if (ipif != NULL)
5740 			ipif_refrele(ipif);
5741 		return (ENETUNREACH);
5742 	}
5743 	if (gw_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
5744 		ire_refrele(gw_ire);
5745 		if (ipif != NULL)
5746 			ipif_refrele(ipif);
5747 		return (ENETUNREACH);
5748 	}
5749 
5750 	if (ill == NULL && !(flags & RTF_INDIRECT)) {
5751 		unbound = B_TRUE;
5752 		if (ipst->ips_ip_strict_src_multihoming > 0)
5753 			ill = gw_ire->ire_ill;
5754 	}
5755 
5756 	/*
5757 	 * We create one of three types of IREs as a result of this request
5758 	 * based on the netmask.  A netmask of all ones (which is automatically
5759 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
5760 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
5761 	 * created.  Otherwise, an IRE_PREFIX route is created for the
5762 	 * destination prefix.
5763 	 */
5764 	if (mask == IP_HOST_MASK)
5765 		type = IRE_HOST;
5766 	else if (mask == 0)
5767 		type = IRE_DEFAULT;
5768 	else
5769 		type = IRE_PREFIX;
5770 
5771 	/* check for a duplicate entry */
5772 	ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
5773 	    ALL_ZONES, NULL, match_flags | MATCH_IRE_MASK | MATCH_IRE_GW,
5774 	    0, ipst, NULL);
5775 	if (ire != NULL) {
5776 		if (ipif != NULL)
5777 			ipif_refrele(ipif);
5778 		ire_refrele(gw_ire);
5779 		ire_refrele(ire);
5780 		return (EEXIST);
5781 	}
5782 
5783 	/* Security attribute exists */
5784 	if (sp != NULL) {
5785 		tsol_gcgrp_addr_t ga;
5786 
5787 		/* find or create the gateway credentials group */
5788 		ga.ga_af = AF_INET;
5789 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
5790 
5791 		/* we hold reference to it upon success */
5792 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
5793 		if (gcgrp == NULL) {
5794 			if (ipif != NULL)
5795 				ipif_refrele(ipif);
5796 			ire_refrele(gw_ire);
5797 			return (ENOMEM);
5798 		}
5799 
5800 		/*
5801 		 * Create and add the security attribute to the group; a
5802 		 * reference to the group is made upon allocating a new
5803 		 * entry successfully.  If it finds an already-existing
5804 		 * entry for the security attribute in the group, it simply
5805 		 * returns it and no new reference is made to the group.
5806 		 */
5807 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
5808 		if (gc == NULL) {
5809 			if (ipif != NULL)
5810 				ipif_refrele(ipif);
5811 			/* release reference held by gcgrp_lookup */
5812 			GCGRP_REFRELE(gcgrp);
5813 			ire_refrele(gw_ire);
5814 			return (ENOMEM);
5815 		}
5816 	}
5817 
5818 	/* Create the IRE. */
5819 	ire = ire_create(
5820 	    (uchar_t *)&dst_addr,		/* dest address */
5821 	    (uchar_t *)&mask,			/* mask */
5822 	    (uchar_t *)&gw_addr,		/* gateway address */
5823 	    (ushort_t)type,			/* IRE type */
5824 	    ill,
5825 	    zoneid,
5826 	    flags,
5827 	    gc,					/* security attribute */
5828 	    ipst);
5829 
5830 	/*
5831 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
5832 	 * reference to the 'gcgrp'. We can now release the extra reference
5833 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
5834 	 */
5835 	if (gcgrp_xtraref)
5836 		GCGRP_REFRELE(gcgrp);
5837 	if (ire == NULL) {
5838 		if (gc != NULL)
5839 			GC_REFRELE(gc);
5840 		if (ipif != NULL)
5841 			ipif_refrele(ipif);
5842 		ire_refrele(gw_ire);
5843 		return (ENOMEM);
5844 	}
5845 
5846 	/* Before we add, check if an extra CGTP broadcast is needed */
5847 	cgtp_broadcast = ((flags & RTF_MULTIRT) &&
5848 	    ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST);
5849 
5850 	/* src address assigned by the caller? */
5851 	if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5852 		ire->ire_setsrc_addr = src_addr;
5853 
5854 	ire->ire_unbound = unbound;
5855 
5856 	/*
5857 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
5858 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
5859 	 */
5860 
5861 	/* Add the new IRE. */
5862 	nire = ire_add(ire);
5863 	if (nire == NULL) {
5864 		/*
5865 		 * In the result of failure, ire_add() will have
5866 		 * already deleted the ire in question, so there
5867 		 * is no need to do that here.
5868 		 */
5869 		if (ipif != NULL)
5870 			ipif_refrele(ipif);
5871 		ire_refrele(gw_ire);
5872 		return (ENOMEM);
5873 	}
5874 	/*
5875 	 * Check if it was a duplicate entry. This handles
5876 	 * the case of two racing route adds for the same route
5877 	 */
5878 	if (nire != ire) {
5879 		ire_delete(nire);
5880 		ire_refrele(nire);
5881 		if (ipif != NULL)
5882 			ipif_refrele(ipif);
5883 		ire_refrele(gw_ire);
5884 		return (EEXIST);
5885 	}
5886 	ire = nire;
5887 
5888 	if (flags & RTF_MULTIRT) {
5889 		/*
5890 		 * Invoke the CGTP (multirouting) filtering module
5891 		 * to add the dst address in the filtering database.
5892 		 * Replicated inbound packets coming from that address
5893 		 * will be filtered to discard the duplicates.
5894 		 * It is not necessary to call the CGTP filter hook
5895 		 * when the dst address is a broadcast or multicast,
5896 		 * because an IP source address cannot be a broadcast
5897 		 * or a multicast.
5898 		 */
5899 		if (cgtp_broadcast) {
5900 			ip_cgtp_bcast_add(ire, ipst);
5901 			goto save_ire;
5902 		}
5903 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
5904 		    !CLASSD(ire->ire_addr)) {
5905 			int res;
5906 			ipif_t *src_ipif;
5907 
5908 			/* Find the source address corresponding to gw_ire */
5909 			src_ipif = ipif_lookup_addr(gw_ire->ire_gateway_addr,
5910 			    NULL, zoneid, ipst);
5911 			if (src_ipif != NULL) {
5912 				res = ipst->ips_ip_cgtp_filter_ops->
5913 				    cfo_add_dest_v4(
5914 				    ipst->ips_netstack->netstack_stackid,
5915 				    ire->ire_addr,
5916 				    ire->ire_gateway_addr,
5917 				    ire->ire_setsrc_addr,
5918 				    src_ipif->ipif_lcl_addr);
5919 				ipif_refrele(src_ipif);
5920 			} else {
5921 				res = EADDRNOTAVAIL;
5922 			}
5923 			if (res != 0) {
5924 				if (ipif != NULL)
5925 					ipif_refrele(ipif);
5926 				ire_refrele(gw_ire);
5927 				ire_delete(ire);
5928 				ire_refrele(ire);	/* Held in ire_add */
5929 				return (res);
5930 			}
5931 		}
5932 	}
5933 
5934 save_ire:
5935 	if (gw_ire != NULL) {
5936 		ire_refrele(gw_ire);
5937 		gw_ire = NULL;
5938 	}
5939 	if (ill != NULL) {
5940 		/*
5941 		 * Save enough information so that we can recreate the IRE if
5942 		 * the interface goes down and then up.  The metrics associated
5943 		 * with the route will be saved as well when rts_setmetrics() is
5944 		 * called after the IRE has been created.  In the case where
5945 		 * memory cannot be allocated, none of this information will be
5946 		 * saved.
5947 		 */
5948 		ill_save_ire(ill, ire);
5949 	}
5950 	if (ioctl_msg)
5951 		ip_rts_rtmsg(RTM_OLDADD, ire, 0, ipst);
5952 	if (ire_arg != NULL) {
5953 		/*
5954 		 * Store the ire that was successfully added into where ire_arg
5955 		 * points to so that callers don't have to look it up
5956 		 * themselves (but they are responsible for ire_refrele()ing
5957 		 * the ire when they are finished with it).
5958 		 */
5959 		*ire_arg = ire;
5960 	} else {
5961 		ire_refrele(ire);		/* Held in ire_add */
5962 	}
5963 	if (ipif != NULL)
5964 		ipif_refrele(ipif);
5965 	return (0);
5966 }
5967 
5968 /*
5969  * ip_rt_delete is called to delete an IPv4 route.
5970  * ill is passed in to associate it with the correct interface.
5971  */
5972 /* ARGSUSED4 */
5973 int
ip_rt_delete(ipaddr_t dst_addr,ipaddr_t mask,ipaddr_t gw_addr,uint_t rtm_addrs,int flags,ill_t * ill,boolean_t ioctl_msg,ip_stack_t * ipst,zoneid_t zoneid)5974 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5975     uint_t rtm_addrs, int flags, ill_t *ill, boolean_t ioctl_msg,
5976     ip_stack_t *ipst, zoneid_t zoneid)
5977 {
5978 	ire_t	*ire = NULL;
5979 	ipif_t	*ipif;
5980 	uint_t	type;
5981 	uint_t	match_flags = MATCH_IRE_TYPE;
5982 	int	err = 0;
5983 
5984 	ip1dbg(("ip_rt_delete:"));
5985 	/*
5986 	 * If this is the case of RTF_HOST being set, then we set the netmask
5987 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
5988 	 */
5989 	if (flags & RTF_HOST) {
5990 		mask = IP_HOST_MASK;
5991 		match_flags |= MATCH_IRE_MASK;
5992 	} else if (rtm_addrs & RTA_NETMASK) {
5993 		match_flags |= MATCH_IRE_MASK;
5994 	}
5995 
5996 	/*
5997 	 * Note that RTF_GATEWAY is never set on a delete, therefore
5998 	 * we check if the gateway address is one of our interfaces first,
5999 	 * and fall back on RTF_GATEWAY routes.
6000 	 *
6001 	 * This makes it possible to delete an original
6002 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
6003 	 * However, we have RTF_KERNEL set on the ones created by ipif_up
6004 	 * and those can not be deleted here.
6005 	 *
6006 	 * We use MATCH_IRE_ILL if we know the interface. If the caller
6007 	 * specified an interface (from the RTA_IFP sockaddr) we use it,
6008 	 * otherwise we use the ill derived from the gateway address.
6009 	 * We can always match the gateway address since we record it
6010 	 * in ire_gateway_addr.
6011 	 *
6012 	 * For more detail on specifying routes by gateway address and by
6013 	 * interface index, see the comments in ip_rt_add().
6014 	 */
6015 	ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
6016 	if (ipif != NULL) {
6017 		ill_t	*ill_match;
6018 
6019 		if (ill != NULL)
6020 			ill_match = ill;
6021 		else
6022 			ill_match = ipif->ipif_ill;
6023 
6024 		match_flags |= MATCH_IRE_ILL;
6025 		if (ipif->ipif_ire_type == IRE_LOOPBACK) {
6026 			ire = ire_ftable_lookup_v4(dst_addr, mask, 0,
6027 			    IRE_LOOPBACK, ill_match, ALL_ZONES, NULL,
6028 			    match_flags, 0, ipst, NULL);
6029 		}
6030 		if (ire == NULL) {
6031 			match_flags |= MATCH_IRE_GW;
6032 			ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
6033 			    IRE_INTERFACE, ill_match, ALL_ZONES, NULL,
6034 			    match_flags, 0, ipst, NULL);
6035 		}
6036 		/* Avoid deleting routes created by kernel from an ipif */
6037 		if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) {
6038 			ire_refrele(ire);
6039 			ire = NULL;
6040 		}
6041 
6042 		/* Restore in case we didn't find a match */
6043 		match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL);
6044 	}
6045 
6046 	if (ire == NULL) {
6047 		/*
6048 		 * At this point, the gateway address is not one of our own
6049 		 * addresses or a matching interface route was not found.  We
6050 		 * set the IRE type to lookup based on whether
6051 		 * this is a host route, a default route or just a prefix.
6052 		 *
6053 		 * If an ill was passed in, then the lookup is based on an
6054 		 * interface index so MATCH_IRE_ILL is added to match_flags.
6055 		 */
6056 		match_flags |= MATCH_IRE_GW;
6057 		if (ill != NULL)
6058 			match_flags |= MATCH_IRE_ILL;
6059 		if (mask == IP_HOST_MASK)
6060 			type = IRE_HOST;
6061 		else if (mask == 0)
6062 			type = IRE_DEFAULT;
6063 		else
6064 			type = IRE_PREFIX;
6065 		ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
6066 		    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
6067 	}
6068 
6069 	if (ipif != NULL) {
6070 		ipif_refrele(ipif);
6071 		ipif = NULL;
6072 	}
6073 
6074 	if (ire == NULL)
6075 		return (ESRCH);
6076 
6077 	if (ire->ire_flags & RTF_MULTIRT) {
6078 		/*
6079 		 * Invoke the CGTP (multirouting) filtering module
6080 		 * to remove the dst address from the filtering database.
6081 		 * Packets coming from that address will no longer be
6082 		 * filtered to remove duplicates.
6083 		 */
6084 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
6085 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v4(
6086 			    ipst->ips_netstack->netstack_stackid,
6087 			    ire->ire_addr, ire->ire_gateway_addr);
6088 		}
6089 		ip_cgtp_bcast_delete(ire, ipst);
6090 	}
6091 
6092 	ill = ire->ire_ill;
6093 	if (ill != NULL)
6094 		ill_remove_saved_ire(ill, ire);
6095 	if (ioctl_msg)
6096 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0, ipst);
6097 	ire_delete(ire);
6098 	ire_refrele(ire);
6099 	return (err);
6100 }
6101 
6102 /*
6103  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
6104  */
6105 /* ARGSUSED */
6106 int
ip_siocaddrt(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_if_req)6107 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6108     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6109 {
6110 	ipaddr_t dst_addr;
6111 	ipaddr_t gw_addr;
6112 	ipaddr_t mask;
6113 	int error = 0;
6114 	mblk_t *mp1;
6115 	struct rtentry *rt;
6116 	ipif_t *ipif = NULL;
6117 	ip_stack_t	*ipst;
6118 
6119 	ASSERT(q->q_next == NULL);
6120 	ipst = CONNQ_TO_IPST(q);
6121 
6122 	ip1dbg(("ip_siocaddrt:"));
6123 	/* Existence of mp1 verified in ip_wput_nondata */
6124 	mp1 = mp->b_cont->b_cont;
6125 	rt = (struct rtentry *)mp1->b_rptr;
6126 
6127 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6128 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6129 
6130 	/*
6131 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
6132 	 * to a particular host address.  In this case, we set the netmask to
6133 	 * all ones for the particular destination address.  Otherwise,
6134 	 * determine the netmask to be used based on dst_addr and the interfaces
6135 	 * in use.
6136 	 */
6137 	if (rt->rt_flags & RTF_HOST) {
6138 		mask = IP_HOST_MASK;
6139 	} else {
6140 		/*
6141 		 * Note that ip_subnet_mask returns a zero mask in the case of
6142 		 * default (an all-zeroes address).
6143 		 */
6144 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6145 	}
6146 
6147 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
6148 	    B_TRUE, NULL, ipst, ALL_ZONES);
6149 	if (ipif != NULL)
6150 		ipif_refrele(ipif);
6151 	return (error);
6152 }
6153 
6154 /*
6155  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
6156  */
6157 /* ARGSUSED */
6158 int
ip_siocdelrt(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_if_req)6159 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6160     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6161 {
6162 	ipaddr_t dst_addr;
6163 	ipaddr_t gw_addr;
6164 	ipaddr_t mask;
6165 	int error;
6166 	mblk_t *mp1;
6167 	struct rtentry *rt;
6168 	ipif_t *ipif = NULL;
6169 	ip_stack_t	*ipst;
6170 
6171 	ASSERT(q->q_next == NULL);
6172 	ipst = CONNQ_TO_IPST(q);
6173 
6174 	ip1dbg(("ip_siocdelrt:"));
6175 	/* Existence of mp1 verified in ip_wput_nondata */
6176 	mp1 = mp->b_cont->b_cont;
6177 	rt = (struct rtentry *)mp1->b_rptr;
6178 
6179 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6180 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6181 
6182 	/*
6183 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
6184 	 * to a particular host address.  In this case, we set the netmask to
6185 	 * all ones for the particular destination address.  Otherwise,
6186 	 * determine the netmask to be used based on dst_addr and the interfaces
6187 	 * in use.
6188 	 */
6189 	if (rt->rt_flags & RTF_HOST) {
6190 		mask = IP_HOST_MASK;
6191 	} else {
6192 		/*
6193 		 * Note that ip_subnet_mask returns a zero mask in the case of
6194 		 * default (an all-zeroes address).
6195 		 */
6196 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6197 	}
6198 
6199 	error = ip_rt_delete(dst_addr, mask, gw_addr,
6200 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, B_TRUE,
6201 	    ipst, ALL_ZONES);
6202 	if (ipif != NULL)
6203 		ipif_refrele(ipif);
6204 	return (error);
6205 }
6206 
6207 /*
6208  * Enqueue the mp onto the ipsq, chained by b_next.
6209  * b_prev stores the function to be executed later, and b_queue the queue
6210  * where this mp originated.
6211  */
6212 void
ipsq_enq(ipsq_t * ipsq,queue_t * q,mblk_t * mp,ipsq_func_t func,int type,ill_t * pending_ill)6213 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6214     ill_t *pending_ill)
6215 {
6216 	conn_t	*connp;
6217 	ipxop_t *ipx = ipsq->ipsq_xop;
6218 
6219 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6220 	ASSERT(MUTEX_HELD(&ipx->ipx_lock));
6221 	ASSERT(func != NULL);
6222 
6223 	mp->b_queue = q;
6224 	mp->b_prev = (void *)func;
6225 	mp->b_next = NULL;
6226 
6227 	switch (type) {
6228 	case CUR_OP:
6229 		if (ipx->ipx_mptail != NULL) {
6230 			ASSERT(ipx->ipx_mphead != NULL);
6231 			ipx->ipx_mptail->b_next = mp;
6232 		} else {
6233 			ASSERT(ipx->ipx_mphead == NULL);
6234 			ipx->ipx_mphead = mp;
6235 		}
6236 		ipx->ipx_mptail = mp;
6237 		break;
6238 
6239 	case NEW_OP:
6240 		if (ipsq->ipsq_xopq_mptail != NULL) {
6241 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
6242 			ipsq->ipsq_xopq_mptail->b_next = mp;
6243 		} else {
6244 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
6245 			ipsq->ipsq_xopq_mphead = mp;
6246 		}
6247 		ipsq->ipsq_xopq_mptail = mp;
6248 		ipx->ipx_ipsq_queued = B_TRUE;
6249 		break;
6250 
6251 	case SWITCH_OP:
6252 		ASSERT(ipsq->ipsq_swxop != NULL);
6253 		/* only one switch operation is currently allowed */
6254 		ASSERT(ipsq->ipsq_switch_mp == NULL);
6255 		ipsq->ipsq_switch_mp = mp;
6256 		ipx->ipx_ipsq_queued = B_TRUE;
6257 		break;
6258 	default:
6259 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
6260 	}
6261 
6262 	if (CONN_Q(q) && pending_ill != NULL) {
6263 		connp = Q_TO_CONN(q);
6264 		ASSERT(MUTEX_HELD(&connp->conn_lock));
6265 		connp->conn_oper_pending_ill = pending_ill;
6266 	}
6267 }
6268 
6269 /*
6270  * Dequeue the next message that requested exclusive access to this IPSQ's
6271  * xop.  Specifically:
6272  *
6273  *  1. If we're still processing the current operation on `ipsq', then
6274  *     dequeue the next message for the operation (from ipx_mphead), or
6275  *     return NULL if there are no queued messages for the operation.
6276  *     These messages are queued via CUR_OP to qwriter_ip() and friends.
6277  *
6278  *  2. If the current operation on `ipsq' has completed (ipx_current_ipif is
6279  *     not set) see if the ipsq has requested an xop switch.  If so, switch
6280  *     `ipsq' to a different xop.  Xop switches only happen when joining or
6281  *     leaving IPMP groups and require a careful dance -- see the comments
6282  *     in-line below for details.  If we're leaving a group xop or if we're
6283  *     joining a group xop and become writer on it, then we proceed to (3).
6284  *     Otherwise, we return NULL and exit the xop.
6285  *
6286  *  3. For each IPSQ in the xop, return any switch operation stored on
6287  *     ipsq_switch_mp (set via SWITCH_OP); these must be processed before
6288  *     any other messages queued on the IPSQ.  Otherwise, dequeue the next
6289  *     exclusive operation (queued via NEW_OP) stored on ipsq_xopq_mphead.
6290  *     Note that if the phyint tied to `ipsq' is not using IPMP there will
6291  *     only be one IPSQ in the xop.  Otherwise, there will be one IPSQ for
6292  *     each phyint in the group, including the IPMP meta-interface phyint.
6293  */
6294 static mblk_t *
ipsq_dq(ipsq_t * ipsq)6295 ipsq_dq(ipsq_t *ipsq)
6296 {
6297 	ill_t	*illv4, *illv6;
6298 	mblk_t	*mp;
6299 	ipsq_t	*xopipsq;
6300 	ipsq_t	*leftipsq = NULL;
6301 	ipxop_t *ipx;
6302 	phyint_t *phyi = ipsq->ipsq_phyint;
6303 	ip_stack_t *ipst = ipsq->ipsq_ipst;
6304 	boolean_t emptied = B_FALSE;
6305 
6306 	/*
6307 	 * Grab all the locks we need in the defined order (ill_g_lock ->
6308 	 * ipsq_lock -> ipx_lock); ill_g_lock is needed to use ipsq_next.
6309 	 */
6310 	rw_enter(&ipst->ips_ill_g_lock,
6311 	    ipsq->ipsq_swxop != NULL ? RW_WRITER : RW_READER);
6312 	mutex_enter(&ipsq->ipsq_lock);
6313 	ipx = ipsq->ipsq_xop;
6314 	mutex_enter(&ipx->ipx_lock);
6315 
6316 	/*
6317 	 * Dequeue the next message associated with the current exclusive
6318 	 * operation, if any.
6319 	 */
6320 	if ((mp = ipx->ipx_mphead) != NULL) {
6321 		ipx->ipx_mphead = mp->b_next;
6322 		if (ipx->ipx_mphead == NULL)
6323 			ipx->ipx_mptail = NULL;
6324 		mp->b_next = (void *)ipsq;
6325 		goto out;
6326 	}
6327 
6328 	if (ipx->ipx_current_ipif != NULL)
6329 		goto empty;
6330 
6331 	if (ipsq->ipsq_swxop != NULL) {
6332 		/*
6333 		 * The exclusive operation that is now being completed has
6334 		 * requested a switch to a different xop.  This happens
6335 		 * when an interface joins or leaves an IPMP group.  Joins
6336 		 * happen through SIOCSLIFGROUPNAME (ip_sioctl_groupname()).
6337 		 * Leaves happen via SIOCSLIFGROUPNAME, interface unplumb
6338 		 * (phyint_free()), or interface plumb for an ill type
6339 		 * not in the IPMP group (ip_rput_dlpi_writer()).
6340 		 *
6341 		 * Xop switches are not allowed on the IPMP meta-interface.
6342 		 */
6343 		ASSERT(phyi == NULL || !(phyi->phyint_flags & PHYI_IPMP));
6344 		ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
6345 		DTRACE_PROBE1(ipsq__switch, (ipsq_t *), ipsq);
6346 
6347 		if (ipsq->ipsq_swxop == &ipsq->ipsq_ownxop) {
6348 			/*
6349 			 * We're switching back to our own xop, so we have two
6350 			 * xop's to drain/exit: our own, and the group xop
6351 			 * that we are leaving.
6352 			 *
6353 			 * First, pull ourselves out of the group ipsq list.
6354 			 * This is safe since we're writer on ill_g_lock.
6355 			 */
6356 			ASSERT(ipsq->ipsq_xop != &ipsq->ipsq_ownxop);
6357 
6358 			xopipsq = ipx->ipx_ipsq;
6359 			while (xopipsq->ipsq_next != ipsq)
6360 				xopipsq = xopipsq->ipsq_next;
6361 
6362 			xopipsq->ipsq_next = ipsq->ipsq_next;
6363 			ipsq->ipsq_next = ipsq;
6364 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
6365 			ipsq->ipsq_swxop = NULL;
6366 
6367 			/*
6368 			 * Second, prepare to exit the group xop.  The actual
6369 			 * ipsq_exit() is done at the end of this function
6370 			 * since we cannot hold any locks across ipsq_exit().
6371 			 * Note that although we drop the group's ipx_lock, no
6372 			 * threads can proceed since we're still ipx_writer.
6373 			 */
6374 			leftipsq = xopipsq;
6375 			mutex_exit(&ipx->ipx_lock);
6376 
6377 			/*
6378 			 * Third, set ipx to point to our own xop (which was
6379 			 * inactive and therefore can be entered).
6380 			 */
6381 			ipx = ipsq->ipsq_xop;
6382 			mutex_enter(&ipx->ipx_lock);
6383 			ASSERT(ipx->ipx_writer == NULL);
6384 			ASSERT(ipx->ipx_current_ipif == NULL);
6385 		} else {
6386 			/*
6387 			 * We're switching from our own xop to a group xop.
6388 			 * The requestor of the switch must ensure that the
6389 			 * group xop cannot go away (e.g. by ensuring the
6390 			 * phyint associated with the xop cannot go away).
6391 			 *
6392 			 * If we can become writer on our new xop, then we'll
6393 			 * do the drain.  Otherwise, the current writer of our
6394 			 * new xop will do the drain when it exits.
6395 			 *
6396 			 * First, splice ourselves into the group IPSQ list.
6397 			 * This is safe since we're writer on ill_g_lock.
6398 			 */
6399 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6400 
6401 			xopipsq = ipsq->ipsq_swxop->ipx_ipsq;
6402 			while (xopipsq->ipsq_next != ipsq->ipsq_swxop->ipx_ipsq)
6403 				xopipsq = xopipsq->ipsq_next;
6404 
6405 			xopipsq->ipsq_next = ipsq;
6406 			ipsq->ipsq_next = ipsq->ipsq_swxop->ipx_ipsq;
6407 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
6408 			ipsq->ipsq_swxop = NULL;
6409 
6410 			/*
6411 			 * Second, exit our own xop, since it's now unused.
6412 			 * This is safe since we've got the only reference.
6413 			 */
6414 			ASSERT(ipx->ipx_writer == curthread);
6415 			ipx->ipx_writer = NULL;
6416 			VERIFY(--ipx->ipx_reentry_cnt == 0);
6417 			ipx->ipx_ipsq_queued = B_FALSE;
6418 			mutex_exit(&ipx->ipx_lock);
6419 
6420 			/*
6421 			 * Third, set ipx to point to our new xop, and check
6422 			 * if we can become writer on it.  If we cannot, then
6423 			 * the current writer will drain the IPSQ group when
6424 			 * it exits.  Our ipsq_xop is guaranteed to be stable
6425 			 * because we're still holding ipsq_lock.
6426 			 */
6427 			ipx = ipsq->ipsq_xop;
6428 			mutex_enter(&ipx->ipx_lock);
6429 			if (ipx->ipx_writer != NULL ||
6430 			    ipx->ipx_current_ipif != NULL) {
6431 				goto out;
6432 			}
6433 		}
6434 
6435 		/*
6436 		 * Fourth, become writer on our new ipx before we continue
6437 		 * with the drain.  Note that we never dropped ipsq_lock
6438 		 * above, so no other thread could've raced with us to
6439 		 * become writer first.  Also, we're holding ipx_lock, so
6440 		 * no other thread can examine the ipx right now.
6441 		 */
6442 		ASSERT(ipx->ipx_current_ipif == NULL);
6443 		ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6444 		VERIFY(ipx->ipx_reentry_cnt++ == 0);
6445 		ipx->ipx_writer = curthread;
6446 		ipx->ipx_forced = B_FALSE;
6447 #ifdef DEBUG
6448 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6449 #endif
6450 	}
6451 
6452 	xopipsq = ipsq;
6453 	do {
6454 		/*
6455 		 * So that other operations operate on a consistent and
6456 		 * complete phyint, a switch message on an IPSQ must be
6457 		 * handled prior to any other operations on that IPSQ.
6458 		 */
6459 		if ((mp = xopipsq->ipsq_switch_mp) != NULL) {
6460 			xopipsq->ipsq_switch_mp = NULL;
6461 			ASSERT(mp->b_next == NULL);
6462 			mp->b_next = (void *)xopipsq;
6463 			goto out;
6464 		}
6465 
6466 		if ((mp = xopipsq->ipsq_xopq_mphead) != NULL) {
6467 			xopipsq->ipsq_xopq_mphead = mp->b_next;
6468 			if (xopipsq->ipsq_xopq_mphead == NULL)
6469 				xopipsq->ipsq_xopq_mptail = NULL;
6470 			mp->b_next = (void *)xopipsq;
6471 			goto out;
6472 		}
6473 	} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6474 empty:
6475 	/*
6476 	 * There are no messages.  Further, we are holding ipx_lock, hence no
6477 	 * new messages can end up on any IPSQ in the xop.
6478 	 */
6479 	ipx->ipx_writer = NULL;
6480 	ipx->ipx_forced = B_FALSE;
6481 	VERIFY(--ipx->ipx_reentry_cnt == 0);
6482 	ipx->ipx_ipsq_queued = B_FALSE;
6483 	emptied = B_TRUE;
6484 #ifdef	DEBUG
6485 	ipx->ipx_depth = 0;
6486 #endif
6487 out:
6488 	mutex_exit(&ipx->ipx_lock);
6489 	mutex_exit(&ipsq->ipsq_lock);
6490 
6491 	/*
6492 	 * If we completely emptied the xop, then wake up any threads waiting
6493 	 * to enter any of the IPSQ's associated with it.
6494 	 */
6495 	if (emptied) {
6496 		xopipsq = ipsq;
6497 		do {
6498 			if ((phyi = xopipsq->ipsq_phyint) == NULL)
6499 				continue;
6500 
6501 			illv4 = phyi->phyint_illv4;
6502 			illv6 = phyi->phyint_illv6;
6503 
6504 			GRAB_ILL_LOCKS(illv4, illv6);
6505 			if (illv4 != NULL)
6506 				cv_broadcast(&illv4->ill_cv);
6507 			if (illv6 != NULL)
6508 				cv_broadcast(&illv6->ill_cv);
6509 			RELEASE_ILL_LOCKS(illv4, illv6);
6510 		} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6511 	}
6512 	rw_exit(&ipst->ips_ill_g_lock);
6513 
6514 	/*
6515 	 * Now that all locks are dropped, exit the IPSQ we left.
6516 	 */
6517 	if (leftipsq != NULL)
6518 		ipsq_exit(leftipsq);
6519 
6520 	return (mp);
6521 }
6522 
6523 /*
6524  * Return completion status of previously initiated DLPI operations on
6525  * ills in the purview of an ipsq.
6526  */
6527 static boolean_t
ipsq_dlpi_done(ipsq_t * ipsq)6528 ipsq_dlpi_done(ipsq_t *ipsq)
6529 {
6530 	ipsq_t		*ipsq_start;
6531 	phyint_t	*phyi;
6532 	ill_t		*ill;
6533 
6534 	ASSERT(RW_LOCK_HELD(&ipsq->ipsq_ipst->ips_ill_g_lock));
6535 	ipsq_start = ipsq;
6536 
6537 	do {
6538 		/*
6539 		 * The only current users of this function are ipsq_try_enter
6540 		 * and ipsq_enter which have made sure that ipsq_writer is
6541 		 * NULL before we reach here. ill_dlpi_pending is modified
6542 		 * only by an ipsq writer
6543 		 */
6544 		ASSERT(ipsq->ipsq_xop->ipx_writer == NULL);
6545 		phyi = ipsq->ipsq_phyint;
6546 		/*
6547 		 * phyi could be NULL if a phyint that is part of an
6548 		 * IPMP group is being unplumbed. A more detailed
6549 		 * comment is in ipmp_grp_update_kstats()
6550 		 */
6551 		if (phyi != NULL) {
6552 			ill = phyi->phyint_illv4;
6553 			if (ill != NULL &&
6554 			    (ill->ill_dlpi_pending != DL_PRIM_INVAL ||
6555 			    ill->ill_arl_dlpi_pending))
6556 				return (B_FALSE);
6557 
6558 			ill = phyi->phyint_illv6;
6559 			if (ill != NULL &&
6560 			    ill->ill_dlpi_pending != DL_PRIM_INVAL)
6561 				return (B_FALSE);
6562 		}
6563 
6564 	} while ((ipsq = ipsq->ipsq_next) != ipsq_start);
6565 
6566 	return (B_TRUE);
6567 }
6568 
6569 /*
6570  * Enter the ipsq corresponding to ill, by waiting synchronously till
6571  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
6572  * will have to drain completely before ipsq_enter returns success.
6573  * ipx_current_ipif will be set if some exclusive op is in progress,
6574  * and the ipsq_exit logic will start the next enqueued op after
6575  * completion of the current op. If 'force' is used, we don't wait
6576  * for the enqueued ops. This is needed when a conn_close wants to
6577  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
6578  * of an ill can also use this option. But we dont' use it currently.
6579  */
6580 #define	ENTER_SQ_WAIT_TICKS 100
6581 boolean_t
ipsq_enter(ill_t * ill,boolean_t force,int type)6582 ipsq_enter(ill_t *ill, boolean_t force, int type)
6583 {
6584 	ipsq_t	*ipsq;
6585 	ipxop_t *ipx;
6586 	boolean_t waited_enough = B_FALSE;
6587 	ip_stack_t *ipst = ill->ill_ipst;
6588 
6589 	/*
6590 	 * Note that the relationship between ill and ipsq is fixed as long as
6591 	 * the ill is not ILL_CONDEMNED.  Holding ipsq_lock ensures the
6592 	 * relationship between the IPSQ and xop cannot change.  However,
6593 	 * since we cannot hold ipsq_lock across the cv_wait(), it may change
6594 	 * while we're waiting.  We wait on ill_cv and rely on ipsq_exit()
6595 	 * waking up all ills in the xop when it becomes available.
6596 	 */
6597 	for (;;) {
6598 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6599 		mutex_enter(&ill->ill_lock);
6600 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6601 			mutex_exit(&ill->ill_lock);
6602 			rw_exit(&ipst->ips_ill_g_lock);
6603 			return (B_FALSE);
6604 		}
6605 
6606 		ipsq = ill->ill_phyint->phyint_ipsq;
6607 		mutex_enter(&ipsq->ipsq_lock);
6608 		ipx = ipsq->ipsq_xop;
6609 		mutex_enter(&ipx->ipx_lock);
6610 
6611 		if (ipx->ipx_writer == NULL && (type == CUR_OP ||
6612 		    (ipx->ipx_current_ipif == NULL && ipsq_dlpi_done(ipsq)) ||
6613 		    waited_enough))
6614 			break;
6615 
6616 		rw_exit(&ipst->ips_ill_g_lock);
6617 
6618 		if (!force || ipx->ipx_writer != NULL) {
6619 			mutex_exit(&ipx->ipx_lock);
6620 			mutex_exit(&ipsq->ipsq_lock);
6621 			cv_wait(&ill->ill_cv, &ill->ill_lock);
6622 		} else {
6623 			mutex_exit(&ipx->ipx_lock);
6624 			mutex_exit(&ipsq->ipsq_lock);
6625 			(void) cv_reltimedwait(&ill->ill_cv,
6626 			    &ill->ill_lock, ENTER_SQ_WAIT_TICKS, TR_CLOCK_TICK);
6627 			waited_enough = B_TRUE;
6628 		}
6629 		mutex_exit(&ill->ill_lock);
6630 	}
6631 
6632 	ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6633 	ASSERT(ipx->ipx_reentry_cnt == 0);
6634 	ipx->ipx_writer = curthread;
6635 	ipx->ipx_forced = (ipx->ipx_current_ipif != NULL);
6636 	ipx->ipx_reentry_cnt++;
6637 #ifdef DEBUG
6638 	ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6639 #endif
6640 	mutex_exit(&ipx->ipx_lock);
6641 	mutex_exit(&ipsq->ipsq_lock);
6642 	mutex_exit(&ill->ill_lock);
6643 	rw_exit(&ipst->ips_ill_g_lock);
6644 
6645 	return (B_TRUE);
6646 }
6647 
6648 /*
6649  * ipif_set_values() has a constraint that it cannot drop the ips_ill_g_lock
6650  * across the call to the core interface ipsq_try_enter() and hence calls this
6651  * function directly. This is explained more fully in ipif_set_values().
6652  * In order to support the above constraint, ipsq_try_enter is implemented as
6653  * a wrapper that grabs the ips_ill_g_lock and calls this function subsequently
6654  */
6655 static ipsq_t *
ipsq_try_enter_internal(ill_t * ill,queue_t * q,mblk_t * mp,ipsq_func_t func,int type,boolean_t reentry_ok)6656 ipsq_try_enter_internal(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func,
6657     int type, boolean_t reentry_ok)
6658 {
6659 	ipsq_t	*ipsq;
6660 	ipxop_t	*ipx;
6661 	ip_stack_t *ipst = ill->ill_ipst;
6662 
6663 	/*
6664 	 * lock ordering:
6665 	 * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock.
6666 	 *
6667 	 * ipx of an ipsq can't change when ipsq_lock is held.
6668 	 */
6669 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
6670 	GRAB_CONN_LOCK(q);
6671 	mutex_enter(&ill->ill_lock);
6672 	ipsq = ill->ill_phyint->phyint_ipsq;
6673 	mutex_enter(&ipsq->ipsq_lock);
6674 	ipx = ipsq->ipsq_xop;
6675 	mutex_enter(&ipx->ipx_lock);
6676 
6677 	/*
6678 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
6679 	 *    (Note: If the caller does not specify reentry_ok then neither
6680 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
6681 	 *    again. Otherwise it can lead to an infinite loop
6682 	 * 2. Enter the ipsq if there is no current writer and this attempted
6683 	 *    entry is part of the current operation
6684 	 * 3. Enter the ipsq if there is no current writer and this is a new
6685 	 *    operation and the operation queue is empty and there is no
6686 	 *    operation currently in progress and if all previously initiated
6687 	 *    DLPI operations have completed.
6688 	 */
6689 	if ((ipx->ipx_writer == curthread && reentry_ok) ||
6690 	    (ipx->ipx_writer == NULL && (type == CUR_OP || (type == NEW_OP &&
6691 	    !ipx->ipx_ipsq_queued && ipx->ipx_current_ipif == NULL &&
6692 	    ipsq_dlpi_done(ipsq))))) {
6693 		/* Success. */
6694 		ipx->ipx_reentry_cnt++;
6695 		ipx->ipx_writer = curthread;
6696 		ipx->ipx_forced = B_FALSE;
6697 		mutex_exit(&ipx->ipx_lock);
6698 		mutex_exit(&ipsq->ipsq_lock);
6699 		mutex_exit(&ill->ill_lock);
6700 		RELEASE_CONN_LOCK(q);
6701 #ifdef DEBUG
6702 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6703 #endif
6704 		return (ipsq);
6705 	}
6706 
6707 	if (func != NULL)
6708 		ipsq_enq(ipsq, q, mp, func, type, ill);
6709 
6710 	mutex_exit(&ipx->ipx_lock);
6711 	mutex_exit(&ipsq->ipsq_lock);
6712 	mutex_exit(&ill->ill_lock);
6713 	RELEASE_CONN_LOCK(q);
6714 	return (NULL);
6715 }
6716 
6717 /*
6718  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
6719  * certain critical operations like plumbing (i.e. most set ioctls), etc.
6720  * There is one ipsq per phyint. The ipsq
6721  * serializes exclusive ioctls issued by applications on a per ipsq basis in
6722  * ipsq_xopq_mphead. It also protects against multiple threads executing in
6723  * the ipsq. Responses from the driver pertain to the current ioctl (say a
6724  * DL_BIND_ACK in response to a DL_BIND_REQ initiated as part of bringing
6725  * up the interface) and are enqueued in ipx_mphead.
6726  *
6727  * If a thread does not want to reenter the ipsq when it is already writer,
6728  * it must make sure that the specified reentry point to be called later
6729  * when the ipsq is empty, nor any code path starting from the specified reentry
6730  * point must never ever try to enter the ipsq again. Otherwise it can lead
6731  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
6732  * When the thread that is currently exclusive finishes, it (ipsq_exit)
6733  * dequeues the requests waiting to become exclusive in ipx_mphead and calls
6734  * the reentry point. When the list at ipx_mphead becomes empty ipsq_exit
6735  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
6736  * ioctl if the current ioctl has completed. If the current ioctl is still
6737  * in progress it simply returns. The current ioctl could be waiting for
6738  * a response from another module (the driver or could be waiting for
6739  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipx_pending_mp
6740  * and ipx_pending_ipif are set. ipx_current_ipif is set throughout the
6741  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
6742  * ipx_current_ipif is NULL which happens only once the ioctl is complete and
6743  * all associated DLPI operations have completed.
6744  */
6745 
6746 /*
6747  * Try to enter the IPSQ corresponding to `ipif' or `ill' exclusively (`ipif'
6748  * and `ill' cannot both be specified).  Returns a pointer to the entered IPSQ
6749  * on success, or NULL on failure.  The caller ensures ipif/ill is valid by
6750  * refholding it as necessary.  If the IPSQ cannot be entered and `func' is
6751  * non-NULL, then `func' will be called back with `q' and `mp' once the IPSQ
6752  * can be entered.  If `func' is NULL, then `q' and `mp' are ignored.
6753  */
6754 ipsq_t *
ipsq_try_enter(ipif_t * ipif,ill_t * ill,queue_t * q,mblk_t * mp,ipsq_func_t func,int type,boolean_t reentry_ok)6755 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
6756     ipsq_func_t func, int type, boolean_t reentry_ok)
6757 {
6758 	ip_stack_t	*ipst;
6759 	ipsq_t		*ipsq;
6760 
6761 	/* Only 1 of ipif or ill can be specified */
6762 	ASSERT((ipif != NULL) ^ (ill != NULL));
6763 
6764 	if (ipif != NULL)
6765 		ill = ipif->ipif_ill;
6766 	ipst = ill->ill_ipst;
6767 
6768 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6769 	ipsq = ipsq_try_enter_internal(ill, q, mp, func, type, reentry_ok);
6770 	rw_exit(&ipst->ips_ill_g_lock);
6771 
6772 	return (ipsq);
6773 }
6774 
6775 /*
6776  * Try to enter the IPSQ corresponding to `ill' as writer.  The caller ensures
6777  * ill is valid by refholding it if necessary; we will refrele.  If the IPSQ
6778  * cannot be entered, the mp is queued for completion.
6779  */
6780 void
qwriter_ip(ill_t * ill,queue_t * q,mblk_t * mp,ipsq_func_t func,int type,boolean_t reentry_ok)6781 qwriter_ip(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6782     boolean_t reentry_ok)
6783 {
6784 	ipsq_t	*ipsq;
6785 
6786 	ipsq = ipsq_try_enter(NULL, ill, q, mp, func, type, reentry_ok);
6787 
6788 	/*
6789 	 * Drop the caller's refhold on the ill.  This is safe since we either
6790 	 * entered the IPSQ (and thus are exclusive), or failed to enter the
6791 	 * IPSQ, in which case we return without accessing ill anymore.  This
6792 	 * is needed because func needs to see the correct refcount.
6793 	 * e.g. removeif can work only then.
6794 	 */
6795 	ill_refrele(ill);
6796 	if (ipsq != NULL) {
6797 		(*func)(ipsq, q, mp, NULL);
6798 		ipsq_exit(ipsq);
6799 	}
6800 }
6801 
6802 /*
6803  * Exit the specified IPSQ.  If this is the final exit on it then drain it
6804  * prior to exiting.  Caller must be writer on the specified IPSQ.
6805  */
6806 void
ipsq_exit(ipsq_t * ipsq)6807 ipsq_exit(ipsq_t *ipsq)
6808 {
6809 	mblk_t *mp;
6810 	ipsq_t *mp_ipsq;
6811 	queue_t	*q;
6812 	phyint_t *phyi;
6813 	ipsq_func_t func;
6814 
6815 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6816 
6817 	ASSERT(ipsq->ipsq_xop->ipx_reentry_cnt >= 1);
6818 	if (ipsq->ipsq_xop->ipx_reentry_cnt != 1) {
6819 		ipsq->ipsq_xop->ipx_reentry_cnt--;
6820 		return;
6821 	}
6822 
6823 	for (;;) {
6824 		phyi = ipsq->ipsq_phyint;
6825 		mp = ipsq_dq(ipsq);
6826 		mp_ipsq = (mp == NULL) ? NULL : (ipsq_t *)mp->b_next;
6827 
6828 		/*
6829 		 * If we've changed to a new IPSQ, and the phyint associated
6830 		 * with the old one has gone away, free the old IPSQ.  Note
6831 		 * that this cannot happen while the IPSQ is in a group.
6832 		 */
6833 		if (mp_ipsq != ipsq && phyi == NULL) {
6834 			ASSERT(ipsq->ipsq_next == ipsq);
6835 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6836 			ipsq_delete(ipsq);
6837 		}
6838 
6839 		if (mp == NULL)
6840 			break;
6841 
6842 		q = mp->b_queue;
6843 		func = (ipsq_func_t)mp->b_prev;
6844 		ipsq = mp_ipsq;
6845 		mp->b_next = mp->b_prev = NULL;
6846 		mp->b_queue = NULL;
6847 
6848 		/*
6849 		 * If 'q' is an conn queue, it is valid, since we did a
6850 		 * a refhold on the conn at the start of the ioctl.
6851 		 * If 'q' is an ill queue, it is valid, since close of an
6852 		 * ill will clean up its IPSQ.
6853 		 */
6854 		(*func)(ipsq, q, mp, NULL);
6855 	}
6856 }
6857 
6858 /*
6859  * Used to start any igmp or mld timers that could not be started
6860  * while holding ill_mcast_lock. The timers can't be started while holding
6861  * the lock, since mld/igmp_start_timers may need to call untimeout()
6862  * which can't be done while holding the lock which the timeout handler
6863  * acquires. Otherwise
6864  * there could be a deadlock since the timeout handlers
6865  * mld_timeout_handler_per_ill/igmp_timeout_handler_per_ill also acquire
6866  * ill_mcast_lock.
6867  */
6868 void
ill_mcast_timer_start(ip_stack_t * ipst)6869 ill_mcast_timer_start(ip_stack_t *ipst)
6870 {
6871 	int		next;
6872 
6873 	mutex_enter(&ipst->ips_igmp_timer_lock);
6874 	next = ipst->ips_igmp_deferred_next;
6875 	ipst->ips_igmp_deferred_next = INFINITY;
6876 	mutex_exit(&ipst->ips_igmp_timer_lock);
6877 
6878 	if (next != INFINITY)
6879 		igmp_start_timers(next, ipst);
6880 
6881 	mutex_enter(&ipst->ips_mld_timer_lock);
6882 	next = ipst->ips_mld_deferred_next;
6883 	ipst->ips_mld_deferred_next = INFINITY;
6884 	mutex_exit(&ipst->ips_mld_timer_lock);
6885 
6886 	if (next != INFINITY)
6887 		mld_start_timers(next, ipst);
6888 }
6889 
6890 /*
6891  * Start the current exclusive operation on `ipsq'; associate it with `ipif'
6892  * and `ioccmd'.
6893  */
6894 void
ipsq_current_start(ipsq_t * ipsq,ipif_t * ipif,int ioccmd)6895 ipsq_current_start(ipsq_t *ipsq, ipif_t *ipif, int ioccmd)
6896 {
6897 	ill_t *ill = ipif->ipif_ill;
6898 	ipxop_t *ipx = ipsq->ipsq_xop;
6899 
6900 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6901 	ASSERT(ipx->ipx_current_ipif == NULL);
6902 	ASSERT(ipx->ipx_current_ioctl == 0);
6903 
6904 	ipx->ipx_current_done = B_FALSE;
6905 	ipx->ipx_current_ioctl = ioccmd;
6906 	mutex_enter(&ipx->ipx_lock);
6907 	ipx->ipx_current_ipif = ipif;
6908 	mutex_exit(&ipx->ipx_lock);
6909 
6910 	/*
6911 	 * Set IPIF_CHANGING on one or more ipifs associated with the
6912 	 * current exclusive operation.  IPIF_CHANGING prevents any new
6913 	 * references to the ipif (so that the references will eventually
6914 	 * drop to zero) and also prevents any "get" operations (e.g.,
6915 	 * SIOCGLIFFLAGS) from being able to access the ipif until the
6916 	 * operation has completed and the ipif is again in a stable state.
6917 	 *
6918 	 * For ioctls, IPIF_CHANGING is set on the ipif associated with the
6919 	 * ioctl.  For internal operations (where ioccmd is zero), all ipifs
6920 	 * on the ill are marked with IPIF_CHANGING since it's unclear which
6921 	 * ipifs will be affected.
6922 	 *
6923 	 * Note that SIOCLIFREMOVEIF is a special case as it sets
6924 	 * IPIF_CONDEMNED internally after identifying the right ipif to
6925 	 * operate on.
6926 	 */
6927 	switch (ioccmd) {
6928 	case SIOCLIFREMOVEIF:
6929 		break;
6930 	case 0:
6931 		mutex_enter(&ill->ill_lock);
6932 		ipif = ipif->ipif_ill->ill_ipif;
6933 		for (; ipif != NULL; ipif = ipif->ipif_next)
6934 			ipif->ipif_state_flags |= IPIF_CHANGING;
6935 		mutex_exit(&ill->ill_lock);
6936 		break;
6937 	default:
6938 		mutex_enter(&ill->ill_lock);
6939 		ipif->ipif_state_flags |= IPIF_CHANGING;
6940 		mutex_exit(&ill->ill_lock);
6941 	}
6942 }
6943 
6944 /*
6945  * Finish the current exclusive operation on `ipsq'.  Usually, this will allow
6946  * the next exclusive operation to begin once we ipsq_exit().  However, if
6947  * pending DLPI operations remain, then we will wait for the queue to drain
6948  * before allowing the next exclusive operation to begin.  This ensures that
6949  * DLPI operations from one exclusive operation are never improperly processed
6950  * as part of a subsequent exclusive operation.
6951  */
6952 void
ipsq_current_finish(ipsq_t * ipsq)6953 ipsq_current_finish(ipsq_t *ipsq)
6954 {
6955 	ipxop_t	*ipx = ipsq->ipsq_xop;
6956 	t_uscalar_t dlpi_pending = DL_PRIM_INVAL;
6957 	ipif_t	*ipif = ipx->ipx_current_ipif;
6958 
6959 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6960 
6961 	/*
6962 	 * For SIOCLIFREMOVEIF, the ipif has been already been blown away
6963 	 * (but in that case, IPIF_CHANGING will already be clear and no
6964 	 * pending DLPI messages can remain).
6965 	 */
6966 	if (ipx->ipx_current_ioctl != SIOCLIFREMOVEIF) {
6967 		ill_t *ill = ipif->ipif_ill;
6968 
6969 		mutex_enter(&ill->ill_lock);
6970 		dlpi_pending = ill->ill_dlpi_pending;
6971 		if (ipx->ipx_current_ioctl == 0) {
6972 			ipif = ill->ill_ipif;
6973 			for (; ipif != NULL; ipif = ipif->ipif_next)
6974 				ipif->ipif_state_flags &= ~IPIF_CHANGING;
6975 		} else {
6976 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
6977 		}
6978 		mutex_exit(&ill->ill_lock);
6979 	}
6980 
6981 	ASSERT(!ipx->ipx_current_done);
6982 	ipx->ipx_current_done = B_TRUE;
6983 	ipx->ipx_current_ioctl = 0;
6984 	if (dlpi_pending == DL_PRIM_INVAL) {
6985 		mutex_enter(&ipx->ipx_lock);
6986 		ipx->ipx_current_ipif = NULL;
6987 		mutex_exit(&ipx->ipx_lock);
6988 	}
6989 }
6990 
6991 /*
6992  * The ill is closing. Flush all messages on the ipsq that originated
6993  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
6994  * for this ill since ipsq_enter could not have entered until then.
6995  * New messages can't be queued since the CONDEMNED flag is set.
6996  */
6997 static void
ipsq_flush(ill_t * ill)6998 ipsq_flush(ill_t *ill)
6999 {
7000 	queue_t	*q;
7001 	mblk_t	*prev;
7002 	mblk_t	*mp;
7003 	mblk_t	*mp_next;
7004 	ipxop_t	*ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
7005 
7006 	ASSERT(IAM_WRITER_ILL(ill));
7007 
7008 	/*
7009 	 * Flush any messages sent up by the driver.
7010 	 */
7011 	mutex_enter(&ipx->ipx_lock);
7012 	for (prev = NULL, mp = ipx->ipx_mphead; mp != NULL; mp = mp_next) {
7013 		mp_next = mp->b_next;
7014 		q = mp->b_queue;
7015 		if (q == ill->ill_rq || q == ill->ill_wq) {
7016 			/* dequeue mp */
7017 			if (prev == NULL)
7018 				ipx->ipx_mphead = mp->b_next;
7019 			else
7020 				prev->b_next = mp->b_next;
7021 			if (ipx->ipx_mptail == mp) {
7022 				ASSERT(mp_next == NULL);
7023 				ipx->ipx_mptail = prev;
7024 			}
7025 			inet_freemsg(mp);
7026 		} else {
7027 			prev = mp;
7028 		}
7029 	}
7030 	mutex_exit(&ipx->ipx_lock);
7031 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7032 	ipsq_xopq_mp_cleanup(ill, NULL);
7033 }
7034 
7035 /*
7036  * Parse an ifreq or lifreq struct coming down ioctls and refhold
7037  * and return the associated ipif.
7038  * Return value:
7039  *	Non zero: An error has occurred. ci may not be filled out.
7040  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
7041  *	a held ipif in ci.ci_ipif.
7042  */
7043 int
ip_extract_lifreq(queue_t * q,mblk_t * mp,const ip_ioctl_cmd_t * ipip,cmd_info_t * ci)7044 ip_extract_lifreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
7045     cmd_info_t *ci)
7046 {
7047 	char		*name;
7048 	struct ifreq    *ifr;
7049 	struct lifreq    *lifr;
7050 	ipif_t		*ipif = NULL;
7051 	ill_t		*ill;
7052 	conn_t		*connp;
7053 	boolean_t	isv6;
7054 	int		err;
7055 	mblk_t		*mp1;
7056 	zoneid_t	zoneid;
7057 	ip_stack_t	*ipst;
7058 
7059 	if (q->q_next != NULL) {
7060 		ill = (ill_t *)q->q_ptr;
7061 		isv6 = ill->ill_isv6;
7062 		connp = NULL;
7063 		zoneid = ALL_ZONES;
7064 		ipst = ill->ill_ipst;
7065 	} else {
7066 		ill = NULL;
7067 		connp = Q_TO_CONN(q);
7068 		isv6 = (connp->conn_family == AF_INET6);
7069 		zoneid = connp->conn_zoneid;
7070 		if (zoneid == GLOBAL_ZONEID) {
7071 			/* global zone can access ipifs in all zones */
7072 			zoneid = ALL_ZONES;
7073 		}
7074 		ipst = connp->conn_netstack->netstack_ip;
7075 	}
7076 
7077 	/* Has been checked in ip_wput_nondata */
7078 	mp1 = mp->b_cont->b_cont;
7079 
7080 	if (ipip->ipi_cmd_type == IF_CMD) {
7081 		/* This a old style SIOC[GS]IF* command */
7082 		ifr = (struct ifreq *)mp1->b_rptr;
7083 		/*
7084 		 * Null terminate the string to protect against buffer
7085 		 * overrun. String was generated by user code and may not
7086 		 * be trusted.
7087 		 */
7088 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
7089 		name = ifr->ifr_name;
7090 		ci->ci_sin = (sin_t *)&ifr->ifr_addr;
7091 		ci->ci_sin6 = NULL;
7092 		ci->ci_lifr = (struct lifreq *)ifr;
7093 	} else {
7094 		/* This a new style SIOC[GS]LIF* command */
7095 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
7096 		lifr = (struct lifreq *)mp1->b_rptr;
7097 		/*
7098 		 * Null terminate the string to protect against buffer
7099 		 * overrun. String was generated by user code and may not
7100 		 * be trusted.
7101 		 */
7102 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
7103 		name = lifr->lifr_name;
7104 		ci->ci_sin = (sin_t *)&lifr->lifr_addr;
7105 		ci->ci_sin6 = (sin6_t *)&lifr->lifr_addr;
7106 		ci->ci_lifr = lifr;
7107 	}
7108 
7109 	if (ipip->ipi_cmd == SIOCSLIFNAME) {
7110 		/*
7111 		 * The ioctl will be failed if the ioctl comes down
7112 		 * an conn stream
7113 		 */
7114 		if (ill == NULL) {
7115 			/*
7116 			 * Not an ill queue, return EINVAL same as the
7117 			 * old error code.
7118 			 */
7119 			return (ENXIO);
7120 		}
7121 		ipif = ill->ill_ipif;
7122 		ipif_refhold(ipif);
7123 	} else {
7124 		/*
7125 		 * Ensure that ioctls don't see any internal state changes
7126 		 * caused by set ioctls by deferring them if IPIF_CHANGING is
7127 		 * set.
7128 		 */
7129 		ipif = ipif_lookup_on_name_async(name, mi_strlen(name),
7130 		    isv6, zoneid, q, mp, ip_process_ioctl, &err, ipst);
7131 		if (ipif == NULL) {
7132 			if (err == EINPROGRESS)
7133 				return (err);
7134 			err = 0;	/* Ensure we don't use it below */
7135 		}
7136 	}
7137 
7138 	/*
7139 	 * Old style [GS]IFCMD does not admit IPv6 ipif
7140 	 */
7141 	if (ipif != NULL && ipif->ipif_isv6 && ipip->ipi_cmd_type == IF_CMD) {
7142 		ipif_refrele(ipif);
7143 		return (ENXIO);
7144 	}
7145 
7146 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
7147 	    name[0] == '\0') {
7148 		/*
7149 		 * Handle a or a SIOC?IF* with a null name
7150 		 * during plumb (on the ill queue before the I_PLINK).
7151 		 */
7152 		ipif = ill->ill_ipif;
7153 		ipif_refhold(ipif);
7154 	}
7155 
7156 	if (ipif == NULL)
7157 		return (ENXIO);
7158 
7159 	DTRACE_PROBE4(ipif__ioctl, char *, "ip_extract_lifreq",
7160 	    int, ipip->ipi_cmd, ill_t *, ipif->ipif_ill, ipif_t *, ipif);
7161 
7162 	ci->ci_ipif = ipif;
7163 	return (0);
7164 }
7165 
7166 /*
7167  * Return the total number of ipifs.
7168  */
7169 static uint_t
ip_get_numifs(zoneid_t zoneid,ip_stack_t * ipst)7170 ip_get_numifs(zoneid_t zoneid, ip_stack_t *ipst)
7171 {
7172 	uint_t numifs = 0;
7173 	ill_t	*ill;
7174 	ill_walk_context_t	ctx;
7175 	ipif_t	*ipif;
7176 
7177 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7178 	ill = ILL_START_WALK_V4(&ctx, ipst);
7179 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7180 		if (IS_UNDER_IPMP(ill))
7181 			continue;
7182 		for (ipif = ill->ill_ipif; ipif != NULL;
7183 		    ipif = ipif->ipif_next) {
7184 			if (ipif->ipif_zoneid == zoneid ||
7185 			    ipif->ipif_zoneid == ALL_ZONES)
7186 				numifs++;
7187 		}
7188 	}
7189 	rw_exit(&ipst->ips_ill_g_lock);
7190 	return (numifs);
7191 }
7192 
7193 /*
7194  * Return the total number of ipifs.
7195  */
7196 static uint_t
ip_get_numlifs(int family,int lifn_flags,zoneid_t zoneid,ip_stack_t * ipst)7197 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid, ip_stack_t *ipst)
7198 {
7199 	uint_t numifs = 0;
7200 	ill_t	*ill;
7201 	ipif_t	*ipif;
7202 	ill_walk_context_t	ctx;
7203 
7204 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
7205 
7206 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7207 	if (family == AF_INET)
7208 		ill = ILL_START_WALK_V4(&ctx, ipst);
7209 	else if (family == AF_INET6)
7210 		ill = ILL_START_WALK_V6(&ctx, ipst);
7211 	else
7212 		ill = ILL_START_WALK_ALL(&ctx, ipst);
7213 
7214 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7215 		if (IS_UNDER_IPMP(ill) && !(lifn_flags & LIFC_UNDER_IPMP))
7216 			continue;
7217 
7218 		for (ipif = ill->ill_ipif; ipif != NULL;
7219 		    ipif = ipif->ipif_next) {
7220 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7221 			    !(lifn_flags & LIFC_NOXMIT))
7222 				continue;
7223 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7224 			    !(lifn_flags & LIFC_TEMPORARY))
7225 				continue;
7226 			if (((ipif->ipif_flags &
7227 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7228 			    IPIF_DEPRECATED)) ||
7229 			    IS_LOOPBACK(ill) ||
7230 			    !(ipif->ipif_flags & IPIF_UP)) &&
7231 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
7232 				continue;
7233 
7234 			if (zoneid != ipif->ipif_zoneid &&
7235 			    ipif->ipif_zoneid != ALL_ZONES &&
7236 			    (zoneid != GLOBAL_ZONEID ||
7237 			    !(lifn_flags & LIFC_ALLZONES)))
7238 				continue;
7239 
7240 			numifs++;
7241 		}
7242 	}
7243 	rw_exit(&ipst->ips_ill_g_lock);
7244 	return (numifs);
7245 }
7246 
7247 uint_t
ip_get_lifsrcofnum(ill_t * ill)7248 ip_get_lifsrcofnum(ill_t *ill)
7249 {
7250 	uint_t numifs = 0;
7251 	ill_t	*ill_head = ill;
7252 	ip_stack_t	*ipst = ill->ill_ipst;
7253 
7254 	/*
7255 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
7256 	 * other thread may be trying to relink the ILLs in this usesrc group
7257 	 * and adjusting the ill_usesrc_grp_next pointers
7258 	 */
7259 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7260 	if ((ill->ill_usesrc_ifindex == 0) &&
7261 	    (ill->ill_usesrc_grp_next != NULL)) {
7262 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
7263 		    ill = ill->ill_usesrc_grp_next)
7264 			numifs++;
7265 	}
7266 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
7267 
7268 	return (numifs);
7269 }
7270 
7271 /* Null values are passed in for ipif, sin, and ifreq */
7272 /* ARGSUSED */
7273 int
ip_sioctl_get_ifnum(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7274 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7275     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7276 {
7277 	int *nump;
7278 	conn_t *connp = Q_TO_CONN(q);
7279 
7280 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7281 
7282 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
7283 	nump = (int *)mp->b_cont->b_cont->b_rptr;
7284 
7285 	*nump = ip_get_numifs(connp->conn_zoneid,
7286 	    connp->conn_netstack->netstack_ip);
7287 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
7288 	return (0);
7289 }
7290 
7291 /* Null values are passed in for ipif, sin, and ifreq */
7292 /* ARGSUSED */
7293 int
ip_sioctl_get_lifnum(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7294 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
7295     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7296 {
7297 	struct lifnum *lifn;
7298 	mblk_t	*mp1;
7299 	conn_t *connp = Q_TO_CONN(q);
7300 
7301 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7302 
7303 	/* Existence checked in ip_wput_nondata */
7304 	mp1 = mp->b_cont->b_cont;
7305 
7306 	lifn = (struct lifnum *)mp1->b_rptr;
7307 	switch (lifn->lifn_family) {
7308 	case AF_UNSPEC:
7309 	case AF_INET:
7310 	case AF_INET6:
7311 		break;
7312 	default:
7313 		return (EAFNOSUPPORT);
7314 	}
7315 
7316 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
7317 	    connp->conn_zoneid, connp->conn_netstack->netstack_ip);
7318 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
7319 	return (0);
7320 }
7321 
7322 /* ARGSUSED */
7323 int
ip_sioctl_get_ifconf(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7324 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7325     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7326 {
7327 	STRUCT_HANDLE(ifconf, ifc);
7328 	mblk_t *mp1;
7329 	struct iocblk *iocp;
7330 	struct ifreq *ifr;
7331 	ill_walk_context_t	ctx;
7332 	ill_t	*ill;
7333 	ipif_t	*ipif;
7334 	struct sockaddr_in *sin;
7335 	int32_t	ifclen;
7336 	zoneid_t zoneid;
7337 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
7338 
7339 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
7340 
7341 	ip1dbg(("ip_sioctl_get_ifconf"));
7342 	/* Existence verified in ip_wput_nondata */
7343 	mp1 = mp->b_cont->b_cont;
7344 	iocp = (struct iocblk *)mp->b_rptr;
7345 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7346 
7347 	/*
7348 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
7349 	 * the user buffer address and length into which the list of struct
7350 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
7351 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
7352 	 * the SIOCGIFCONF operation was redefined to simply provide
7353 	 * a large output buffer into which we are supposed to jam the ifreq
7354 	 * array.  The same ioctl command code was used, despite the fact that
7355 	 * both the applications and the kernel code had to change, thus making
7356 	 * it impossible to support both interfaces.
7357 	 *
7358 	 * For reasons not good enough to try to explain, the following
7359 	 * algorithm is used for deciding what to do with one of these:
7360 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
7361 	 * form with the output buffer coming down as the continuation message.
7362 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
7363 	 * and we have to copy in the ifconf structure to find out how big the
7364 	 * output buffer is and where to copy out to.  Sure no problem...
7365 	 *
7366 	 */
7367 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
7368 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
7369 		int numifs = 0;
7370 		size_t ifc_bufsize;
7371 
7372 		/*
7373 		 * Must be (better be!) continuation of a TRANSPARENT
7374 		 * IOCTL.  We just copied in the ifconf structure.
7375 		 */
7376 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
7377 		    (struct ifconf *)mp1->b_rptr);
7378 
7379 		/*
7380 		 * Allocate a buffer to hold requested information.
7381 		 *
7382 		 * If ifc_len is larger than what is needed, we only
7383 		 * allocate what we will use.
7384 		 *
7385 		 * If ifc_len is smaller than what is needed, return
7386 		 * EINVAL.
7387 		 *
7388 		 * XXX: the ill_t structure can hava 2 counters, for
7389 		 * v4 and v6 (not just ill_ipif_up_count) to store the
7390 		 * number of interfaces for a device, so we don't need
7391 		 * to count them here...
7392 		 */
7393 		numifs = ip_get_numifs(zoneid, ipst);
7394 
7395 		ifclen = STRUCT_FGET(ifc, ifc_len);
7396 		ifc_bufsize = numifs * sizeof (struct ifreq);
7397 		if (ifc_bufsize > ifclen) {
7398 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7399 				/* old behaviour */
7400 				return (EINVAL);
7401 			} else {
7402 				ifc_bufsize = ifclen;
7403 			}
7404 		}
7405 
7406 		mp1 = mi_copyout_alloc(q, mp,
7407 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
7408 		if (mp1 == NULL)
7409 			return (ENOMEM);
7410 
7411 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
7412 	}
7413 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7414 	/*
7415 	 * the SIOCGIFCONF ioctl only knows about
7416 	 * IPv4 addresses, so don't try to tell
7417 	 * it about interfaces with IPv6-only
7418 	 * addresses. (Last parm 'isv6' is B_FALSE)
7419 	 */
7420 
7421 	ifr = (struct ifreq *)mp1->b_rptr;
7422 
7423 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7424 	ill = ILL_START_WALK_V4(&ctx, ipst);
7425 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7426 		if (IS_UNDER_IPMP(ill))
7427 			continue;
7428 		for (ipif = ill->ill_ipif; ipif != NULL;
7429 		    ipif = ipif->ipif_next) {
7430 			if (zoneid != ipif->ipif_zoneid &&
7431 			    ipif->ipif_zoneid != ALL_ZONES)
7432 				continue;
7433 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
7434 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7435 					/* old behaviour */
7436 					rw_exit(&ipst->ips_ill_g_lock);
7437 					return (EINVAL);
7438 				} else {
7439 					goto if_copydone;
7440 				}
7441 			}
7442 			ipif_get_name(ipif, ifr->ifr_name,
7443 			    sizeof (ifr->ifr_name));
7444 			sin = (sin_t *)&ifr->ifr_addr;
7445 			*sin = sin_null;
7446 			sin->sin_family = AF_INET;
7447 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7448 			ifr++;
7449 		}
7450 	}
7451 if_copydone:
7452 	rw_exit(&ipst->ips_ill_g_lock);
7453 	mp1->b_wptr = (uchar_t *)ifr;
7454 
7455 	if (STRUCT_BUF(ifc) != NULL) {
7456 		STRUCT_FSET(ifc, ifc_len,
7457 		    (int)((uchar_t *)ifr - mp1->b_rptr));
7458 	}
7459 	return (0);
7460 }
7461 
7462 /*
7463  * Get the interfaces using the address hosted on the interface passed in,
7464  * as a source adddress
7465  */
7466 /* ARGSUSED */
7467 int
ip_sioctl_get_lifsrcof(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7468 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7469     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7470 {
7471 	mblk_t *mp1;
7472 	ill_t	*ill, *ill_head;
7473 	ipif_t	*ipif, *orig_ipif;
7474 	int	numlifs = 0;
7475 	size_t	lifs_bufsize, lifsmaxlen;
7476 	struct	lifreq *lifr;
7477 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7478 	uint_t	ifindex;
7479 	zoneid_t zoneid;
7480 	boolean_t isv6 = B_FALSE;
7481 	struct	sockaddr_in	*sin;
7482 	struct	sockaddr_in6	*sin6;
7483 	STRUCT_HANDLE(lifsrcof, lifs);
7484 	ip_stack_t		*ipst;
7485 
7486 	ipst = CONNQ_TO_IPST(q);
7487 
7488 	ASSERT(q->q_next == NULL);
7489 
7490 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7491 
7492 	/* Existence verified in ip_wput_nondata */
7493 	mp1 = mp->b_cont->b_cont;
7494 
7495 	/*
7496 	 * Must be (better be!) continuation of a TRANSPARENT
7497 	 * IOCTL.  We just copied in the lifsrcof structure.
7498 	 */
7499 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
7500 	    (struct lifsrcof *)mp1->b_rptr);
7501 
7502 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
7503 		return (EINVAL);
7504 
7505 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
7506 	isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
7507 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, ipst);
7508 	if (ipif == NULL) {
7509 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
7510 		    ifindex));
7511 		return (ENXIO);
7512 	}
7513 
7514 	/* Allocate a buffer to hold requested information */
7515 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
7516 	lifs_bufsize = numlifs * sizeof (struct lifreq);
7517 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
7518 	/* The actual size needed is always returned in lifs_len */
7519 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
7520 
7521 	/* If the amount we need is more than what is passed in, abort */
7522 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
7523 		ipif_refrele(ipif);
7524 		return (0);
7525 	}
7526 
7527 	mp1 = mi_copyout_alloc(q, mp,
7528 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
7529 	if (mp1 == NULL) {
7530 		ipif_refrele(ipif);
7531 		return (ENOMEM);
7532 	}
7533 
7534 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
7535 	bzero(mp1->b_rptr, lifs_bufsize);
7536 
7537 	lifr = (struct lifreq *)mp1->b_rptr;
7538 
7539 	ill = ill_head = ipif->ipif_ill;
7540 	orig_ipif = ipif;
7541 
7542 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
7543 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7544 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7545 
7546 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
7547 	for (; (ill != NULL) && (ill != ill_head);
7548 	    ill = ill->ill_usesrc_grp_next) {
7549 
7550 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
7551 			break;
7552 
7553 		ipif = ill->ill_ipif;
7554 		ipif_get_name(ipif, lifr->lifr_name, sizeof (lifr->lifr_name));
7555 		if (ipif->ipif_isv6) {
7556 			sin6 = (sin6_t *)&lifr->lifr_addr;
7557 			*sin6 = sin6_null;
7558 			sin6->sin6_family = AF_INET6;
7559 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
7560 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
7561 			    &ipif->ipif_v6net_mask);
7562 		} else {
7563 			sin = (sin_t *)&lifr->lifr_addr;
7564 			*sin = sin_null;
7565 			sin->sin_family = AF_INET;
7566 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7567 			lifr->lifr_addrlen = ip_mask_to_plen(
7568 			    ipif->ipif_net_mask);
7569 		}
7570 		lifr++;
7571 	}
7572 	rw_exit(&ipst->ips_ill_g_lock);
7573 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
7574 	ipif_refrele(orig_ipif);
7575 	mp1->b_wptr = (uchar_t *)lifr;
7576 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
7577 
7578 	return (0);
7579 }
7580 
7581 /* ARGSUSED */
7582 int
ip_sioctl_get_lifconf(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)7583 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7584     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7585 {
7586 	mblk_t *mp1;
7587 	int	list;
7588 	ill_t	*ill;
7589 	ipif_t	*ipif;
7590 	int	flags;
7591 	int	numlifs = 0;
7592 	size_t	lifc_bufsize;
7593 	struct	lifreq *lifr;
7594 	sa_family_t	family;
7595 	struct	sockaddr_in	*sin;
7596 	struct	sockaddr_in6	*sin6;
7597 	ill_walk_context_t	ctx;
7598 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7599 	int32_t	lifclen;
7600 	zoneid_t zoneid;
7601 	STRUCT_HANDLE(lifconf, lifc);
7602 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
7603 
7604 	ip1dbg(("ip_sioctl_get_lifconf"));
7605 
7606 	ASSERT(q->q_next == NULL);
7607 
7608 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7609 
7610 	/* Existence verified in ip_wput_nondata */
7611 	mp1 = mp->b_cont->b_cont;
7612 
7613 	/*
7614 	 * An extended version of SIOCGIFCONF that takes an
7615 	 * additional address family and flags field.
7616 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
7617 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
7618 	 * interfaces are omitted.
7619 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
7620 	 * unless LIFC_TEMPORARY is specified.
7621 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
7622 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
7623 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
7624 	 * has priority over LIFC_NOXMIT.
7625 	 */
7626 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
7627 
7628 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
7629 		return (EINVAL);
7630 
7631 	/*
7632 	 * Must be (better be!) continuation of a TRANSPARENT
7633 	 * IOCTL.  We just copied in the lifconf structure.
7634 	 */
7635 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
7636 
7637 	family = STRUCT_FGET(lifc, lifc_family);
7638 	flags = STRUCT_FGET(lifc, lifc_flags);
7639 
7640 	switch (family) {
7641 	case AF_UNSPEC:
7642 		/*
7643 		 * walk all ILL's.
7644 		 */
7645 		list = MAX_G_HEADS;
7646 		break;
7647 	case AF_INET:
7648 		/*
7649 		 * walk only IPV4 ILL's.
7650 		 */
7651 		list = IP_V4_G_HEAD;
7652 		break;
7653 	case AF_INET6:
7654 		/*
7655 		 * walk only IPV6 ILL's.
7656 		 */
7657 		list = IP_V6_G_HEAD;
7658 		break;
7659 	default:
7660 		return (EAFNOSUPPORT);
7661 	}
7662 
7663 	/*
7664 	 * Allocate a buffer to hold requested information.
7665 	 *
7666 	 * If lifc_len is larger than what is needed, we only
7667 	 * allocate what we will use.
7668 	 *
7669 	 * If lifc_len is smaller than what is needed, return
7670 	 * EINVAL.
7671 	 */
7672 	numlifs = ip_get_numlifs(family, flags, zoneid, ipst);
7673 	lifc_bufsize = numlifs * sizeof (struct lifreq);
7674 	lifclen = STRUCT_FGET(lifc, lifc_len);
7675 	if (lifc_bufsize > lifclen) {
7676 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
7677 			return (EINVAL);
7678 		else
7679 			lifc_bufsize = lifclen;
7680 	}
7681 
7682 	mp1 = mi_copyout_alloc(q, mp,
7683 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
7684 	if (mp1 == NULL)
7685 		return (ENOMEM);
7686 
7687 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
7688 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7689 
7690 	lifr = (struct lifreq *)mp1->b_rptr;
7691 
7692 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7693 	ill = ill_first(list, list, &ctx, ipst);
7694 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7695 		if (IS_UNDER_IPMP(ill) && !(flags & LIFC_UNDER_IPMP))
7696 			continue;
7697 
7698 		for (ipif = ill->ill_ipif; ipif != NULL;
7699 		    ipif = ipif->ipif_next) {
7700 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7701 			    !(flags & LIFC_NOXMIT))
7702 				continue;
7703 
7704 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7705 			    !(flags & LIFC_TEMPORARY))
7706 				continue;
7707 
7708 			if (((ipif->ipif_flags &
7709 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7710 			    IPIF_DEPRECATED)) ||
7711 			    IS_LOOPBACK(ill) ||
7712 			    !(ipif->ipif_flags & IPIF_UP)) &&
7713 			    (flags & LIFC_EXTERNAL_SOURCE))
7714 				continue;
7715 
7716 			if (zoneid != ipif->ipif_zoneid &&
7717 			    ipif->ipif_zoneid != ALL_ZONES &&
7718 			    (zoneid != GLOBAL_ZONEID ||
7719 			    !(flags & LIFC_ALLZONES)))
7720 				continue;
7721 
7722 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
7723 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
7724 					rw_exit(&ipst->ips_ill_g_lock);
7725 					return (EINVAL);
7726 				} else {
7727 					goto lif_copydone;
7728 				}
7729 			}
7730 
7731 			ipif_get_name(ipif, lifr->lifr_name,
7732 			    sizeof (lifr->lifr_name));
7733 			lifr->lifr_type = ill->ill_type;
7734 			if (ipif->ipif_isv6) {
7735 				sin6 = (sin6_t *)&lifr->lifr_addr;
7736 				*sin6 = sin6_null;
7737 				sin6->sin6_family = AF_INET6;
7738 				sin6->sin6_addr =
7739 				    ipif->ipif_v6lcl_addr;
7740 				lifr->lifr_addrlen =
7741 				    ip_mask_to_plen_v6(
7742 				    &ipif->ipif_v6net_mask);
7743 				if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
7744 					sin6->sin6_scope_id =
7745 					    ill->ill_phyint->phyint_ifindex;
7746 				}
7747 			} else {
7748 				sin = (sin_t *)&lifr->lifr_addr;
7749 				*sin = sin_null;
7750 				sin->sin_family = AF_INET;
7751 				sin->sin_addr.s_addr =
7752 				    ipif->ipif_lcl_addr;
7753 				lifr->lifr_addrlen =
7754 				    ip_mask_to_plen(
7755 				    ipif->ipif_net_mask);
7756 			}
7757 			lifr++;
7758 		}
7759 	}
7760 lif_copydone:
7761 	rw_exit(&ipst->ips_ill_g_lock);
7762 
7763 	mp1->b_wptr = (uchar_t *)lifr;
7764 	if (STRUCT_BUF(lifc) != NULL) {
7765 		STRUCT_FSET(lifc, lifc_len,
7766 		    (int)((uchar_t *)lifr - mp1->b_rptr));
7767 	}
7768 	return (0);
7769 }
7770 
7771 static void
ip_sioctl_ip6addrpolicy(queue_t * q,mblk_t * mp)7772 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
7773 {
7774 	ip6_asp_t *table;
7775 	size_t table_size;
7776 	mblk_t *data_mp;
7777 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7778 	ip_stack_t	*ipst;
7779 
7780 	if (q->q_next == NULL)
7781 		ipst = CONNQ_TO_IPST(q);
7782 	else
7783 		ipst = ILLQ_TO_IPST(q);
7784 
7785 	/* These two ioctls are I_STR only */
7786 	if (iocp->ioc_count == TRANSPARENT) {
7787 		miocnak(q, mp, 0, EINVAL);
7788 		return;
7789 	}
7790 
7791 	data_mp = mp->b_cont;
7792 	if (data_mp == NULL) {
7793 		/* The user passed us a NULL argument */
7794 		table = NULL;
7795 		table_size = iocp->ioc_count;
7796 	} else {
7797 		/*
7798 		 * The user provided a table.  The stream head
7799 		 * may have copied in the user data in chunks,
7800 		 * so make sure everything is pulled up
7801 		 * properly.
7802 		 */
7803 		if (MBLKL(data_mp) < iocp->ioc_count) {
7804 			mblk_t *new_data_mp;
7805 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
7806 			    NULL) {
7807 				miocnak(q, mp, 0, ENOMEM);
7808 				return;
7809 			}
7810 			freemsg(data_mp);
7811 			data_mp = new_data_mp;
7812 			mp->b_cont = data_mp;
7813 		}
7814 		table = (ip6_asp_t *)data_mp->b_rptr;
7815 		table_size = iocp->ioc_count;
7816 	}
7817 
7818 	switch (iocp->ioc_cmd) {
7819 	case SIOCGIP6ADDRPOLICY:
7820 		iocp->ioc_rval = ip6_asp_get(table, table_size, ipst);
7821 		if (iocp->ioc_rval == -1)
7822 			iocp->ioc_error = EINVAL;
7823 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7824 		else if (table != NULL &&
7825 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
7826 			ip6_asp_t *src = table;
7827 			ip6_asp32_t *dst = (void *)table;
7828 			int count = table_size / sizeof (ip6_asp_t);
7829 			int i;
7830 
7831 			/*
7832 			 * We need to do an in-place shrink of the array
7833 			 * to match the alignment attributes of the
7834 			 * 32-bit ABI looking at it.
7835 			 */
7836 			/* LINTED: logical expression always true: op "||" */
7837 			ASSERT(sizeof (*src) > sizeof (*dst));
7838 			for (i = 1; i < count; i++)
7839 				bcopy(src + i, dst + i, sizeof (*dst));
7840 		}
7841 #endif
7842 		break;
7843 
7844 	case SIOCSIP6ADDRPOLICY:
7845 		ASSERT(mp->b_prev == NULL);
7846 		mp->b_prev = (void *)q;
7847 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7848 		/*
7849 		 * We pass in the datamodel here so that the ip6_asp_replace()
7850 		 * routine can handle converting from 32-bit to native formats
7851 		 * where necessary.
7852 		 *
7853 		 * A better way to handle this might be to convert the inbound
7854 		 * data structure here, and hang it off a new 'mp'; thus the
7855 		 * ip6_asp_replace() logic would always be dealing with native
7856 		 * format data structures..
7857 		 *
7858 		 * (An even simpler way to handle these ioctls is to just
7859 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
7860 		 * and just recompile everything that depends on it.)
7861 		 */
7862 #endif
7863 		ip6_asp_replace(mp, table, table_size, B_FALSE, ipst,
7864 		    iocp->ioc_flag & IOC_MODELS);
7865 		return;
7866 	}
7867 
7868 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
7869 	qreply(q, mp);
7870 }
7871 
7872 static void
ip_sioctl_dstinfo(queue_t * q,mblk_t * mp)7873 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
7874 {
7875 	mblk_t		*data_mp;
7876 	struct dstinforeq	*dir;
7877 	uint8_t		*end, *cur;
7878 	in6_addr_t	*daddr, *saddr;
7879 	ipaddr_t	v4daddr;
7880 	ire_t		*ire;
7881 	ipaddr_t	v4setsrc;
7882 	in6_addr_t	v6setsrc;
7883 	char		*slabel, *dlabel;
7884 	boolean_t	isipv4;
7885 	int		match_ire;
7886 	ill_t		*dst_ill;
7887 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7888 	conn_t		*connp = Q_TO_CONN(q);
7889 	zoneid_t	zoneid = IPCL_ZONEID(connp);
7890 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
7891 	uint64_t	ipif_flags;
7892 
7893 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
7894 
7895 	/*
7896 	 * This ioctl is I_STR only, and must have a
7897 	 * data mblk following the M_IOCTL mblk.
7898 	 */
7899 	data_mp = mp->b_cont;
7900 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
7901 		miocnak(q, mp, 0, EINVAL);
7902 		return;
7903 	}
7904 
7905 	if (MBLKL(data_mp) < iocp->ioc_count) {
7906 		mblk_t *new_data_mp;
7907 
7908 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
7909 			miocnak(q, mp, 0, ENOMEM);
7910 			return;
7911 		}
7912 		freemsg(data_mp);
7913 		data_mp = new_data_mp;
7914 		mp->b_cont = data_mp;
7915 	}
7916 	match_ire = MATCH_IRE_DSTONLY;
7917 
7918 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
7919 	    end - cur >= sizeof (struct dstinforeq);
7920 	    cur += sizeof (struct dstinforeq)) {
7921 		dir = (struct dstinforeq *)cur;
7922 		daddr = &dir->dir_daddr;
7923 		saddr = &dir->dir_saddr;
7924 
7925 		/*
7926 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
7927 		 * v4 mapped addresses; ire_ftable_lookup_v6()
7928 		 * and ip_select_source_v6() do not.
7929 		 */
7930 		dir->dir_dscope = ip_addr_scope_v6(daddr);
7931 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence, ipst);
7932 
7933 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
7934 		if (isipv4) {
7935 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
7936 			v4setsrc = INADDR_ANY;
7937 			ire = ire_route_recursive_v4(v4daddr, 0, NULL, zoneid,
7938 			    NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v4setsrc,
7939 			    NULL, NULL);
7940 		} else {
7941 			v6setsrc = ipv6_all_zeros;
7942 			ire = ire_route_recursive_v6(daddr, 0, NULL, zoneid,
7943 			    NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v6setsrc,
7944 			    NULL, NULL);
7945 		}
7946 		ASSERT(ire != NULL);
7947 		if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
7948 			ire_refrele(ire);
7949 			dir->dir_dreachable = 0;
7950 
7951 			/* move on to next dst addr */
7952 			continue;
7953 		}
7954 		dir->dir_dreachable = 1;
7955 
7956 		dst_ill = ire_nexthop_ill(ire);
7957 		if (dst_ill == NULL) {
7958 			ire_refrele(ire);
7959 			continue;
7960 		}
7961 
7962 		/* With ipmp we most likely look at the ipmp ill here */
7963 		dir->dir_dmactype = dst_ill->ill_mactype;
7964 
7965 		if (isipv4) {
7966 			ipaddr_t v4saddr;
7967 
7968 			if (ip_select_source_v4(dst_ill, v4setsrc, v4daddr,
7969 			    connp->conn_ixa->ixa_multicast_ifaddr, zoneid, ipst,
7970 			    &v4saddr, NULL, &ipif_flags) != 0) {
7971 				v4saddr = INADDR_ANY;
7972 				ipif_flags = 0;
7973 			}
7974 			IN6_IPADDR_TO_V4MAPPED(v4saddr, saddr);
7975 		} else {
7976 			if (ip_select_source_v6(dst_ill, &v6setsrc, daddr,
7977 			    zoneid, ipst, B_FALSE, IPV6_PREFER_SRC_DEFAULT,
7978 			    saddr, NULL, &ipif_flags) != 0) {
7979 				*saddr = ipv6_all_zeros;
7980 				ipif_flags = 0;
7981 			}
7982 		}
7983 
7984 		dir->dir_sscope = ip_addr_scope_v6(saddr);
7985 		slabel = ip6_asp_lookup(saddr, NULL, ipst);
7986 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
7987 		dir->dir_sdeprecated = (ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
7988 		ire_refrele(ire);
7989 		ill_refrele(dst_ill);
7990 	}
7991 	miocack(q, mp, iocp->ioc_count, 0);
7992 }
7993 
7994 /*
7995  * Check if this is an address assigned to this machine.
7996  * Skips interfaces that are down by using ire checks.
7997  * Translates mapped addresses to v4 addresses and then
7998  * treats them as such, returning true if the v4 address
7999  * associated with this mapped address is configured.
8000  * Note: Applications will have to be careful what they do
8001  * with the response; use of mapped addresses limits
8002  * what can be done with the socket, especially with
8003  * respect to socket options and ioctls - neither IPv4
8004  * options nor IPv6 sticky options/ancillary data options
8005  * may be used.
8006  */
8007 /* ARGSUSED */
8008 int
ip_sioctl_tmyaddr(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)8009 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8010     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8011 {
8012 	struct sioc_addrreq *sia;
8013 	sin_t *sin;
8014 	ire_t *ire;
8015 	mblk_t *mp1;
8016 	zoneid_t zoneid;
8017 	ip_stack_t	*ipst;
8018 
8019 	ip1dbg(("ip_sioctl_tmyaddr"));
8020 
8021 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8022 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8023 	ipst = CONNQ_TO_IPST(q);
8024 
8025 	/* Existence verified in ip_wput_nondata */
8026 	mp1 = mp->b_cont->b_cont;
8027 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8028 	sin = (sin_t *)&sia->sa_addr;
8029 	switch (sin->sin_family) {
8030 	case AF_INET6: {
8031 		sin6_t *sin6 = (sin6_t *)sin;
8032 
8033 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8034 			ipaddr_t v4_addr;
8035 
8036 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8037 			    v4_addr);
8038 			ire = ire_ftable_lookup_v4(v4_addr, 0, 0,
8039 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8040 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8041 		} else {
8042 			in6_addr_t v6addr;
8043 
8044 			v6addr = sin6->sin6_addr;
8045 			ire = ire_ftable_lookup_v6(&v6addr, 0, 0,
8046 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8047 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8048 		}
8049 		break;
8050 	}
8051 	case AF_INET: {
8052 		ipaddr_t v4addr;
8053 
8054 		v4addr = sin->sin_addr.s_addr;
8055 		ire = ire_ftable_lookup_v4(v4addr, 0, 0,
8056 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8057 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8058 		break;
8059 	}
8060 	default:
8061 		return (EAFNOSUPPORT);
8062 	}
8063 	if (ire != NULL) {
8064 		sia->sa_res = 1;
8065 		ire_refrele(ire);
8066 	} else {
8067 		sia->sa_res = 0;
8068 	}
8069 	return (0);
8070 }
8071 
8072 /*
8073  * Check if this is an address assigned on-link i.e. neighbor,
8074  * and makes sure it's reachable from the current zone.
8075  * Returns true for my addresses as well.
8076  * Translates mapped addresses to v4 addresses and then
8077  * treats them as such, returning true if the v4 address
8078  * associated with this mapped address is configured.
8079  * Note: Applications will have to be careful what they do
8080  * with the response; use of mapped addresses limits
8081  * what can be done with the socket, especially with
8082  * respect to socket options and ioctls - neither IPv4
8083  * options nor IPv6 sticky options/ancillary data options
8084  * may be used.
8085  */
8086 /* ARGSUSED */
8087 int
ip_sioctl_tonlink(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * duymmy_ifreq)8088 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8089     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
8090 {
8091 	struct sioc_addrreq *sia;
8092 	sin_t *sin;
8093 	mblk_t	*mp1;
8094 	ire_t *ire = NULL;
8095 	zoneid_t zoneid;
8096 	ip_stack_t	*ipst;
8097 
8098 	ip1dbg(("ip_sioctl_tonlink"));
8099 
8100 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8101 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8102 	ipst = CONNQ_TO_IPST(q);
8103 
8104 	/* Existence verified in ip_wput_nondata */
8105 	mp1 = mp->b_cont->b_cont;
8106 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8107 	sin = (sin_t *)&sia->sa_addr;
8108 
8109 	/*
8110 	 * We check for IRE_ONLINK and exclude IRE_BROADCAST|IRE_MULTICAST
8111 	 * to make sure we only look at on-link unicast address.
8112 	 */
8113 	switch (sin->sin_family) {
8114 	case AF_INET6: {
8115 		sin6_t *sin6 = (sin6_t *)sin;
8116 
8117 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8118 			ipaddr_t v4_addr;
8119 
8120 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8121 			    v4_addr);
8122 			if (!CLASSD(v4_addr)) {
8123 				ire = ire_ftable_lookup_v4(v4_addr, 0, 0, 0,
8124 				    NULL, zoneid, NULL, MATCH_IRE_DSTONLY,
8125 				    0, ipst, NULL);
8126 			}
8127 		} else {
8128 			in6_addr_t v6addr;
8129 
8130 			v6addr = sin6->sin6_addr;
8131 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
8132 				ire = ire_ftable_lookup_v6(&v6addr, 0, 0, 0,
8133 				    NULL, zoneid, NULL, MATCH_IRE_DSTONLY, 0,
8134 				    ipst, NULL);
8135 			}
8136 		}
8137 		break;
8138 	}
8139 	case AF_INET: {
8140 		ipaddr_t v4addr;
8141 
8142 		v4addr = sin->sin_addr.s_addr;
8143 		if (!CLASSD(v4addr)) {
8144 			ire = ire_ftable_lookup_v4(v4addr, 0, 0, 0, NULL,
8145 			    zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
8146 		}
8147 		break;
8148 	}
8149 	default:
8150 		return (EAFNOSUPPORT);
8151 	}
8152 	sia->sa_res = 0;
8153 	if (ire != NULL) {
8154 		ASSERT(!(ire->ire_type & IRE_MULTICAST));
8155 
8156 		if ((ire->ire_type & IRE_ONLINK) &&
8157 		    !(ire->ire_type & IRE_BROADCAST))
8158 			sia->sa_res = 1;
8159 		ire_refrele(ire);
8160 	}
8161 	return (0);
8162 }
8163 
8164 /*
8165  * TBD: implement when kernel maintaines a list of site prefixes.
8166  */
8167 /* ARGSUSED */
8168 int
ip_sioctl_tmysite(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)8169 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8170     ip_ioctl_cmd_t *ipip, void *ifreq)
8171 {
8172 	return (ENXIO);
8173 }
8174 
8175 /* ARP IOCTLs. */
8176 /* ARGSUSED */
8177 int
ip_sioctl_arp(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)8178 ip_sioctl_arp(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8179     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8180 {
8181 	int		err;
8182 	ipaddr_t	ipaddr;
8183 	struct iocblk	*iocp;
8184 	conn_t		*connp;
8185 	struct arpreq	*ar;
8186 	struct xarpreq	*xar;
8187 	int		arp_flags, flags, alength;
8188 	uchar_t		*lladdr;
8189 	ip_stack_t	*ipst;
8190 	ill_t		*ill = ipif->ipif_ill;
8191 	ill_t		*proxy_ill = NULL;
8192 	ipmp_arpent_t	*entp = NULL;
8193 	boolean_t	proxyarp = B_FALSE;
8194 	boolean_t	if_arp_ioctl = B_FALSE;
8195 	ncec_t		*ncec = NULL;
8196 	nce_t		*nce;
8197 
8198 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8199 	connp = Q_TO_CONN(q);
8200 	ipst = connp->conn_netstack->netstack_ip;
8201 	iocp = (struct iocblk *)mp->b_rptr;
8202 
8203 	if (ipip->ipi_cmd_type == XARP_CMD) {
8204 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
8205 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
8206 		ar = NULL;
8207 
8208 		arp_flags = xar->xarp_flags;
8209 		lladdr = (uchar_t *)LLADDR(&xar->xarp_ha);
8210 		if_arp_ioctl = (xar->xarp_ha.sdl_nlen != 0);
8211 		/*
8212 		 * Validate against user's link layer address length
8213 		 * input and name and addr length limits.
8214 		 */
8215 		alength = ill->ill_phys_addr_length;
8216 		if (ipip->ipi_cmd == SIOCSXARP) {
8217 			if (alength != xar->xarp_ha.sdl_alen ||
8218 			    (alength + xar->xarp_ha.sdl_nlen >
8219 			    sizeof (xar->xarp_ha.sdl_data)))
8220 				return (EINVAL);
8221 		}
8222 	} else {
8223 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
8224 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
8225 		xar = NULL;
8226 
8227 		arp_flags = ar->arp_flags;
8228 		lladdr = (uchar_t *)ar->arp_ha.sa_data;
8229 		/*
8230 		 * Theoretically, the sa_family could tell us what link
8231 		 * layer type this operation is trying to deal with. By
8232 		 * common usage AF_UNSPEC means ethernet. We'll assume
8233 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
8234 		 * for now. Our new SIOC*XARP ioctls can be used more
8235 		 * generally.
8236 		 *
8237 		 * If the underlying media happens to have a non 6 byte
8238 		 * address, arp module will fail set/get, but the del
8239 		 * operation will succeed.
8240 		 */
8241 		alength = 6;
8242 		if ((ipip->ipi_cmd != SIOCDARP) &&
8243 		    (alength != ill->ill_phys_addr_length)) {
8244 			return (EINVAL);
8245 		}
8246 	}
8247 
8248 	/* Translate ATF* flags to NCE* flags */
8249 	flags = 0;
8250 	if (arp_flags & ATF_AUTHORITY)
8251 		flags |= NCE_F_AUTHORITY;
8252 	if (arp_flags & ATF_PERM)
8253 		flags |= NCE_F_NONUD; /* not subject to aging */
8254 	if (arp_flags & ATF_PUBL)
8255 		flags |= NCE_F_PUBLISH;
8256 
8257 	/*
8258 	 * IPMP ARP special handling:
8259 	 *
8260 	 * 1. Since ARP mappings must appear consistent across the group,
8261 	 *    prohibit changing ARP mappings on the underlying interfaces.
8262 	 *
8263 	 * 2. Since ARP mappings for IPMP data addresses are maintained by
8264 	 *    IP itself, prohibit changing them.
8265 	 *
8266 	 * 3. For proxy ARP, use a functioning hardware address in the group,
8267 	 *    provided one exists.  If one doesn't, just add the entry as-is;
8268 	 *    ipmp_illgrp_refresh_arpent() will refresh it if things change.
8269 	 */
8270 	if (IS_UNDER_IPMP(ill)) {
8271 		if (ipip->ipi_cmd != SIOCGARP && ipip->ipi_cmd != SIOCGXARP)
8272 			return (EPERM);
8273 	}
8274 	if (IS_IPMP(ill)) {
8275 		ipmp_illgrp_t *illg = ill->ill_grp;
8276 
8277 		switch (ipip->ipi_cmd) {
8278 		case SIOCSARP:
8279 		case SIOCSXARP:
8280 			proxy_ill = ipmp_illgrp_find_ill(illg, lladdr, alength);
8281 			if (proxy_ill != NULL) {
8282 				proxyarp = B_TRUE;
8283 				if (!ipmp_ill_is_active(proxy_ill))
8284 					proxy_ill = ipmp_illgrp_next_ill(illg);
8285 				if (proxy_ill != NULL)
8286 					lladdr = proxy_ill->ill_phys_addr;
8287 			}
8288 			/* FALLTHRU */
8289 		}
8290 	}
8291 
8292 	ipaddr = sin->sin_addr.s_addr;
8293 	/*
8294 	 * don't match across illgrp per case (1) and (2).
8295 	 * XXX use IS_IPMP(ill) like ndp_sioc_update?
8296 	 */
8297 	nce = nce_lookup_v4(ill, &ipaddr);
8298 	if (nce != NULL)
8299 		ncec = nce->nce_common;
8300 
8301 	switch (iocp->ioc_cmd) {
8302 	case SIOCDARP:
8303 	case SIOCDXARP: {
8304 		/*
8305 		 * Delete the NCE if any.
8306 		 */
8307 		if (ncec == NULL) {
8308 			iocp->ioc_error = ENXIO;
8309 			break;
8310 		}
8311 		/* Don't allow changes to arp mappings of local addresses. */
8312 		if (NCE_MYADDR(ncec)) {
8313 			nce_refrele(nce);
8314 			return (ENOTSUP);
8315 		}
8316 		iocp->ioc_error = 0;
8317 
8318 		/*
8319 		 * Delete the nce_common which has ncec_ill set to ipmp_ill.
8320 		 * This will delete all the nce entries on the under_ills.
8321 		 */
8322 		ncec_delete(ncec);
8323 		/*
8324 		 * Once the NCE has been deleted, then the ire_dep* consistency
8325 		 * mechanism will find any IRE which depended on the now
8326 		 * condemned NCE (as part of sending packets).
8327 		 * That mechanism handles redirects by deleting redirects
8328 		 * that refer to UNREACHABLE nces.
8329 		 */
8330 		break;
8331 	}
8332 	case SIOCGARP:
8333 	case SIOCGXARP:
8334 		if (ncec != NULL) {
8335 			lladdr = ncec->ncec_lladdr;
8336 			flags = ncec->ncec_flags;
8337 			iocp->ioc_error = 0;
8338 			ip_sioctl_garp_reply(mp, ncec->ncec_ill, lladdr, flags);
8339 		} else {
8340 			iocp->ioc_error = ENXIO;
8341 		}
8342 		break;
8343 	case SIOCSARP:
8344 	case SIOCSXARP:
8345 		/* Don't allow changes to arp mappings of local addresses. */
8346 		if (ncec != NULL && NCE_MYADDR(ncec)) {
8347 			nce_refrele(nce);
8348 			return (ENOTSUP);
8349 		}
8350 
8351 		/* static arp entries will undergo NUD if ATF_PERM is not set */
8352 		flags |= NCE_F_STATIC;
8353 		if (!if_arp_ioctl) {
8354 			ip_nce_lookup_and_update(&ipaddr, NULL, ipst,
8355 			    lladdr, alength, flags);
8356 		} else {
8357 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
8358 			if (ipif != NULL) {
8359 				ip_nce_lookup_and_update(&ipaddr, ipif, ipst,
8360 				    lladdr, alength, flags);
8361 				ipif_refrele(ipif);
8362 			}
8363 		}
8364 		if (nce != NULL) {
8365 			nce_refrele(nce);
8366 			nce = NULL;
8367 		}
8368 		/*
8369 		 * NCE_F_STATIC entries will be added in state ND_REACHABLE
8370 		 * by nce_add_common()
8371 		 */
8372 		err = nce_lookup_then_add_v4(ill, lladdr,
8373 		    ill->ill_phys_addr_length, &ipaddr, flags, ND_UNCHANGED,
8374 		    &nce);
8375 		if (err == EEXIST) {
8376 			ncec = nce->nce_common;
8377 			mutex_enter(&ncec->ncec_lock);
8378 			ncec->ncec_state = ND_REACHABLE;
8379 			ncec->ncec_flags = flags;
8380 			nce_update(ncec, ND_UNCHANGED, lladdr);
8381 			mutex_exit(&ncec->ncec_lock);
8382 			err = 0;
8383 		}
8384 		if (nce != NULL) {
8385 			nce_refrele(nce);
8386 			nce = NULL;
8387 		}
8388 		if (IS_IPMP(ill) && err == 0) {
8389 			entp = ipmp_illgrp_create_arpent(ill->ill_grp,
8390 			    proxyarp, ipaddr, lladdr, ill->ill_phys_addr_length,
8391 			    flags);
8392 			if (entp == NULL || (proxyarp && proxy_ill == NULL)) {
8393 				iocp->ioc_error = (entp == NULL ? ENOMEM : 0);
8394 				break;
8395 			}
8396 		}
8397 		iocp->ioc_error = err;
8398 	}
8399 
8400 	if (nce != NULL) {
8401 		nce_refrele(nce);
8402 	}
8403 
8404 	/*
8405 	 * If we created an IPMP ARP entry, mark that we've notified ARP.
8406 	 */
8407 	if (entp != NULL)
8408 		ipmp_illgrp_mark_arpent(ill->ill_grp, entp);
8409 
8410 	return (iocp->ioc_error);
8411 }
8412 
8413 /*
8414  * Parse an [x]arpreq structure coming down SIOC[GSD][X]ARP ioctls, identify
8415  * the associated sin and refhold and return the associated ipif via `ci'.
8416  */
8417 int
ip_extract_arpreq(queue_t * q,mblk_t * mp,const ip_ioctl_cmd_t * ipip,cmd_info_t * ci)8418 ip_extract_arpreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8419     cmd_info_t *ci)
8420 {
8421 	mblk_t	*mp1;
8422 	sin_t	*sin;
8423 	conn_t	*connp;
8424 	ipif_t	*ipif;
8425 	ire_t	*ire = NULL;
8426 	ill_t	*ill = NULL;
8427 	boolean_t exists;
8428 	ip_stack_t *ipst;
8429 	struct arpreq *ar;
8430 	struct xarpreq *xar;
8431 	struct sockaddr_dl *sdl;
8432 
8433 	/* ioctl comes down on a conn */
8434 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8435 	connp = Q_TO_CONN(q);
8436 	if (connp->conn_family == AF_INET6)
8437 		return (ENXIO);
8438 
8439 	ipst = connp->conn_netstack->netstack_ip;
8440 
8441 	/* Verified in ip_wput_nondata */
8442 	mp1 = mp->b_cont->b_cont;
8443 
8444 	if (ipip->ipi_cmd_type == XARP_CMD) {
8445 		ASSERT(MBLKL(mp1) >= sizeof (struct xarpreq));
8446 		xar = (struct xarpreq *)mp1->b_rptr;
8447 		sin = (sin_t *)&xar->xarp_pa;
8448 		sdl = &xar->xarp_ha;
8449 
8450 		if (sdl->sdl_family != AF_LINK || sin->sin_family != AF_INET)
8451 			return (ENXIO);
8452 		if (sdl->sdl_nlen >= LIFNAMSIZ)
8453 			return (EINVAL);
8454 	} else {
8455 		ASSERT(ipip->ipi_cmd_type == ARP_CMD);
8456 		ASSERT(MBLKL(mp1) >= sizeof (struct arpreq));
8457 		ar = (struct arpreq *)mp1->b_rptr;
8458 		sin = (sin_t *)&ar->arp_pa;
8459 	}
8460 
8461 	if (ipip->ipi_cmd_type == XARP_CMD && sdl->sdl_nlen != 0) {
8462 		ipif = ipif_lookup_on_name(sdl->sdl_data, sdl->sdl_nlen,
8463 		    B_FALSE, &exists, B_FALSE, ALL_ZONES, ipst);
8464 		if (ipif == NULL)
8465 			return (ENXIO);
8466 		if (ipif->ipif_id != 0) {
8467 			ipif_refrele(ipif);
8468 			return (ENXIO);
8469 		}
8470 	} else {
8471 		/*
8472 		 * Either an SIOC[DGS]ARP or an SIOC[DGS]XARP with an sdl_nlen
8473 		 * of 0: use the IP address to find the ipif.  If the IP
8474 		 * address is an IPMP test address, ire_ftable_lookup() will
8475 		 * find the wrong ill, so we first do an ipif_lookup_addr().
8476 		 */
8477 		ipif = ipif_lookup_addr(sin->sin_addr.s_addr, NULL, ALL_ZONES,
8478 		    ipst);
8479 		if (ipif == NULL) {
8480 			ire = ire_ftable_lookup_v4(sin->sin_addr.s_addr,
8481 			    0, 0, IRE_IF_RESOLVER, NULL, ALL_ZONES,
8482 			    NULL, MATCH_IRE_TYPE, 0, ipst, NULL);
8483 			if (ire == NULL || ((ill = ire->ire_ill) == NULL)) {
8484 				if (ire != NULL)
8485 					ire_refrele(ire);
8486 				return (ENXIO);
8487 			}
8488 			ASSERT(ire != NULL && ill != NULL);
8489 			ipif = ill->ill_ipif;
8490 			ipif_refhold(ipif);
8491 			ire_refrele(ire);
8492 		}
8493 	}
8494 
8495 	if (ipif->ipif_ill->ill_net_type != IRE_IF_RESOLVER) {
8496 		ipif_refrele(ipif);
8497 		return (ENXIO);
8498 	}
8499 
8500 	ci->ci_sin = sin;
8501 	ci->ci_ipif = ipif;
8502 	return (0);
8503 }
8504 
8505 /*
8506  * Link or unlink the illgrp on IPMP meta-interface `ill' depending on the
8507  * value of `ioccmd'.  While an illgrp is linked to an ipmp_grp_t, it is
8508  * accessible from that ipmp_grp_t, which means SIOCSLIFGROUPNAME can look it
8509  * up and thus an ill can join that illgrp.
8510  *
8511  * We use I_PLINK/I_PUNLINK to do the link/unlink operations rather than
8512  * open()/close() primarily because close() is not allowed to fail or block
8513  * forever.  On the other hand, I_PUNLINK *can* fail, and there's no reason
8514  * why anyone should ever need to I_PUNLINK an in-use IPMP stream.  To ensure
8515  * symmetric behavior (e.g., doing an I_PLINK after and I_PUNLINK undoes the
8516  * I_PUNLINK) we defer linking to I_PLINK.  Separately, we also fail attempts
8517  * to I_LINK since I_UNLINK is optional and we'd end up in an inconsistent
8518  * state if I_UNLINK didn't occur.
8519  *
8520  * Note that for each plumb/unplumb operation, we may end up here more than
8521  * once because of the way ifconfig works.  However, it's OK to link the same
8522  * illgrp more than once, or unlink an illgrp that's already unlinked.
8523  */
8524 static int
ip_sioctl_plink_ipmp(ill_t * ill,int ioccmd)8525 ip_sioctl_plink_ipmp(ill_t *ill, int ioccmd)
8526 {
8527 	int err;
8528 	ip_stack_t *ipst = ill->ill_ipst;
8529 
8530 	ASSERT(IS_IPMP(ill));
8531 	ASSERT(IAM_WRITER_ILL(ill));
8532 
8533 	switch (ioccmd) {
8534 	case I_LINK:
8535 		return (ENOTSUP);
8536 
8537 	case I_PLINK:
8538 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8539 		ipmp_illgrp_link_grp(ill->ill_grp, ill->ill_phyint->phyint_grp);
8540 		rw_exit(&ipst->ips_ipmp_lock);
8541 		break;
8542 
8543 	case I_PUNLINK:
8544 		/*
8545 		 * Require all UP ipifs be brought down prior to unlinking the
8546 		 * illgrp so any associated IREs (and other state) is torched.
8547 		 */
8548 		if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0)
8549 			return (EBUSY);
8550 
8551 		/*
8552 		 * NOTE: We hold ipmp_lock across the unlink to prevent a race
8553 		 * with an SIOCSLIFGROUPNAME request from an ill trying to
8554 		 * join this group.  Specifically: ills trying to join grab
8555 		 * ipmp_lock and bump a "pending join" counter checked by
8556 		 * ipmp_illgrp_unlink_grp().  During the unlink no new pending
8557 		 * joins can occur (since we have ipmp_lock).  Once we drop
8558 		 * ipmp_lock, subsequent SIOCSLIFGROUPNAME requests will not
8559 		 * find the illgrp (since we unlinked it) and will return
8560 		 * EAFNOSUPPORT.  This will then take them back through the
8561 		 * IPMP meta-interface plumbing logic in ifconfig, and thus
8562 		 * back through I_PLINK above.
8563 		 */
8564 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8565 		err = ipmp_illgrp_unlink_grp(ill->ill_grp);
8566 		rw_exit(&ipst->ips_ipmp_lock);
8567 		return (err);
8568 	default:
8569 		break;
8570 	}
8571 	return (0);
8572 }
8573 
8574 /*
8575  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
8576  * atomically set/clear the muxids. Also complete the ioctl by acking or
8577  * naking it.  Note that the code is structured such that the link type,
8578  * whether it's persistent or not, is treated equally.  ifconfig(8) and
8579  * its clones use the persistent link, while pppd(8) and perhaps many
8580  * other daemons may use non-persistent link.  When combined with some
8581  * ill_t states, linking and unlinking lower streams may be used as
8582  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
8583  */
8584 /* ARGSUSED */
8585 void
ip_sioctl_plink(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * dummy_arg)8586 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8587 {
8588 	mblk_t		*mp1;
8589 	struct linkblk	*li;
8590 	int		ioccmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
8591 	int		err = 0;
8592 
8593 	ASSERT(ioccmd == I_PLINK || ioccmd == I_PUNLINK ||
8594 	    ioccmd == I_LINK || ioccmd == I_UNLINK);
8595 
8596 	mp1 = mp->b_cont;	/* This is the linkblk info */
8597 	li = (struct linkblk *)mp1->b_rptr;
8598 
8599 	err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li);
8600 	if (err == EINPROGRESS)
8601 		return;
8602 	if (err == 0)
8603 		miocack(q, mp, 0, 0);
8604 	else
8605 		miocnak(q, mp, 0, err);
8606 
8607 	/* Conn was refheld in ip_sioctl_copyin_setup */
8608 	if (CONN_Q(q)) {
8609 		CONN_DEC_IOCTLREF(Q_TO_CONN(q));
8610 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
8611 	}
8612 }
8613 
8614 /*
8615  * Process I_{P}LINK and I_{P}UNLINK requests named by `ioccmd' and pointed to
8616  * by `mp' and `li' for the IP module stream (if li->q_bot is in fact an IP
8617  * module stream).
8618  * Returns zero on success, EINPROGRESS if the operation is still pending, or
8619  * an error code on failure.
8620  */
8621 static int
ip_sioctl_plink_ipmod(ipsq_t * ipsq,queue_t * q,mblk_t * mp,int ioccmd,struct linkblk * li)8622 ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp, int ioccmd,
8623     struct linkblk *li)
8624 {
8625 	int		err = 0;
8626 	ill_t		*ill;
8627 	queue_t		*ipwq, *dwq;
8628 	const char	*name;
8629 	struct qinit	*qinfo;
8630 	boolean_t	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
8631 	boolean_t	entered_ipsq = B_FALSE;
8632 	boolean_t	is_ip = B_FALSE;
8633 	arl_t		*arl;
8634 
8635 	/*
8636 	 * Walk the lower stream to verify it's the IP module stream.
8637 	 * The IP module is identified by its name, wput function,
8638 	 * and non-NULL q_next.  STREAMS ensures that the lower stream
8639 	 * (li->l_qbot) will not vanish until this ioctl completes.
8640 	 */
8641 	for (ipwq = li->l_qbot; ipwq != NULL; ipwq = ipwq->q_next) {
8642 		qinfo = ipwq->q_qinfo;
8643 		name = qinfo->qi_minfo->mi_idname;
8644 		if (name != NULL && strcmp(name, ip_mod_info.mi_idname) == 0 &&
8645 		    qinfo->qi_putp != ip_lwput && ipwq->q_next != NULL) {
8646 			is_ip = B_TRUE;
8647 			break;
8648 		}
8649 		if (name != NULL && strcmp(name, arp_mod_info.mi_idname) == 0 &&
8650 		    qinfo->qi_putp != ip_lwput && ipwq->q_next != NULL) {
8651 			break;
8652 		}
8653 	}
8654 
8655 	/*
8656 	 * If this isn't an IP module stream, bail.
8657 	 */
8658 	if (ipwq == NULL)
8659 		return (0);
8660 
8661 	if (!is_ip) {
8662 		arl = (arl_t *)ipwq->q_ptr;
8663 		ill = arl_to_ill(arl);
8664 		if (ill == NULL)
8665 			return (0);
8666 	} else {
8667 		ill = ipwq->q_ptr;
8668 	}
8669 	ASSERT(ill != NULL);
8670 
8671 	if (ipsq == NULL) {
8672 		ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
8673 		    NEW_OP, B_FALSE);
8674 		if (ipsq == NULL) {
8675 			if (!is_ip)
8676 				ill_refrele(ill);
8677 			return (EINPROGRESS);
8678 		}
8679 		entered_ipsq = B_TRUE;
8680 	}
8681 	ASSERT(IAM_WRITER_ILL(ill));
8682 	mutex_enter(&ill->ill_lock);
8683 	if (!is_ip) {
8684 		if (islink && ill->ill_muxid == 0) {
8685 			/*
8686 			 * Plumbing has to be done with IP plumbed first, arp
8687 			 * second, but here we have arp being plumbed first.
8688 			 */
8689 			mutex_exit(&ill->ill_lock);
8690 			if (entered_ipsq)
8691 				ipsq_exit(ipsq);
8692 			ill_refrele(ill);
8693 			return (EINVAL);
8694 		}
8695 	}
8696 	mutex_exit(&ill->ill_lock);
8697 	if (!is_ip) {
8698 		arl->arl_muxid = islink ? li->l_index : 0;
8699 		ill_refrele(ill);
8700 		goto done;
8701 	}
8702 
8703 	if (IS_IPMP(ill) && (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
8704 		goto done;
8705 
8706 	/*
8707 	 * As part of I_{P}LINKing, stash the number of downstream modules and
8708 	 * the read queue of the module immediately below IP in the ill.
8709 	 * These are used during the capability negotiation below.
8710 	 */
8711 	ill->ill_lmod_rq = NULL;
8712 	ill->ill_lmod_cnt = 0;
8713 	if (islink && ((dwq = ipwq->q_next) != NULL)) {
8714 		ill->ill_lmod_rq = RD(dwq);
8715 		for (; dwq != NULL; dwq = dwq->q_next)
8716 			ill->ill_lmod_cnt++;
8717 	}
8718 
8719 	ill->ill_muxid = islink ? li->l_index : 0;
8720 
8721 	/*
8722 	 * Mark the ipsq busy until the capability operations initiated below
8723 	 * complete. The PLINK/UNLINK ioctl itself completes when our caller
8724 	 * returns, but the capability operation may complete asynchronously
8725 	 * much later.
8726 	 */
8727 	ipsq_current_start(ipsq, ill->ill_ipif, ioccmd);
8728 	/*
8729 	 * If there's at least one up ipif on this ill, then we're bound to
8730 	 * the underlying driver via DLPI.  In that case, renegotiate
8731 	 * capabilities to account for any possible change in modules
8732 	 * interposed between IP and the driver.
8733 	 */
8734 	if (ill->ill_ipif_up_count > 0) {
8735 		if (islink)
8736 			ill_capability_probe(ill);
8737 		else
8738 			ill_capability_reset(ill, B_FALSE);
8739 	}
8740 	ipsq_current_finish(ipsq);
8741 done:
8742 	if (entered_ipsq)
8743 		ipsq_exit(ipsq);
8744 
8745 	return (err);
8746 }
8747 
8748 /*
8749  * Search the ioctl command in the ioctl tables and return a pointer
8750  * to the ioctl command information. The ioctl command tables are
8751  * static and fully populated at compile time.
8752  */
8753 ip_ioctl_cmd_t *
ip_sioctl_lookup(int ioc_cmd)8754 ip_sioctl_lookup(int ioc_cmd)
8755 {
8756 	int index;
8757 	ip_ioctl_cmd_t *ipip;
8758 	ip_ioctl_cmd_t *ipip_end;
8759 
8760 	if (ioc_cmd == IPI_DONTCARE)
8761 		return (NULL);
8762 
8763 	/*
8764 	 * Do a 2 step search. First search the indexed table
8765 	 * based on the least significant byte of the ioctl cmd.
8766 	 * If we don't find a match, then search the misc table
8767 	 * serially.
8768 	 */
8769 	index = ioc_cmd & 0xFF;
8770 	if (index < ip_ndx_ioctl_count) {
8771 		ipip = &ip_ndx_ioctl_table[index];
8772 		if (ipip->ipi_cmd == ioc_cmd) {
8773 			/* Found a match in the ndx table */
8774 			return (ipip);
8775 		}
8776 	}
8777 
8778 	/* Search the misc table */
8779 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
8780 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
8781 		if (ipip->ipi_cmd == ioc_cmd)
8782 			/* Found a match in the misc table */
8783 			return (ipip);
8784 	}
8785 
8786 	return (NULL);
8787 }
8788 
8789 /*
8790  * helper function for ip_sioctl_getsetprop(), which does some sanity checks
8791  */
8792 static boolean_t
getset_ioctl_checks(mblk_t * mp)8793 getset_ioctl_checks(mblk_t *mp)
8794 {
8795 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8796 	mblk_t		*mp1 = mp->b_cont;
8797 	mod_ioc_prop_t	*pioc;
8798 	uint_t		flags;
8799 	uint_t		pioc_size;
8800 
8801 	/* do sanity checks on various arguments */
8802 	if (mp1 == NULL || iocp->ioc_count == 0 ||
8803 	    iocp->ioc_count == TRANSPARENT) {
8804 		return (B_FALSE);
8805 	}
8806 	if (msgdsize(mp1) < iocp->ioc_count) {
8807 		if (!pullupmsg(mp1, iocp->ioc_count))
8808 			return (B_FALSE);
8809 	}
8810 
8811 	pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8812 
8813 	/* sanity checks on mpr_valsize */
8814 	pioc_size = sizeof (mod_ioc_prop_t);
8815 	if (pioc->mpr_valsize != 0)
8816 		pioc_size += pioc->mpr_valsize - 1;
8817 
8818 	if (iocp->ioc_count != pioc_size)
8819 		return (B_FALSE);
8820 
8821 	flags = pioc->mpr_flags;
8822 	if (iocp->ioc_cmd == SIOCSETPROP) {
8823 		/*
8824 		 * One can either reset the value to it's default value or
8825 		 * change the current value or append/remove the value from
8826 		 * a multi-valued properties.
8827 		 */
8828 		if ((flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8829 		    flags != MOD_PROP_ACTIVE &&
8830 		    flags != (MOD_PROP_ACTIVE|MOD_PROP_APPEND) &&
8831 		    flags != (MOD_PROP_ACTIVE|MOD_PROP_REMOVE))
8832 			return (B_FALSE);
8833 	} else {
8834 		ASSERT(iocp->ioc_cmd == SIOCGETPROP);
8835 
8836 		/*
8837 		 * One can retrieve only one kind of property information
8838 		 * at a time.
8839 		 */
8840 		if ((flags & MOD_PROP_ACTIVE) != MOD_PROP_ACTIVE &&
8841 		    (flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8842 		    (flags & MOD_PROP_POSSIBLE) != MOD_PROP_POSSIBLE &&
8843 		    (flags & MOD_PROP_PERM) != MOD_PROP_PERM)
8844 			return (B_FALSE);
8845 	}
8846 
8847 	return (B_TRUE);
8848 }
8849 
8850 /*
8851  * process the SIOC{SET|GET}PROP ioctl's
8852  */
8853 /* ARGSUSED */
8854 static void
ip_sioctl_getsetprop(queue_t * q,mblk_t * mp)8855 ip_sioctl_getsetprop(queue_t *q, mblk_t *mp)
8856 {
8857 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8858 	mblk_t		*mp1 = mp->b_cont;
8859 	mod_ioc_prop_t	*pioc;
8860 	mod_prop_info_t *ptbl = NULL, *pinfo = NULL;
8861 	ip_stack_t	*ipst;
8862 	netstack_t	*stack;
8863 	cred_t		*cr;
8864 	boolean_t	set;
8865 	int		err;
8866 
8867 	ASSERT(q->q_next == NULL);
8868 	ASSERT(CONN_Q(q));
8869 
8870 	if (!getset_ioctl_checks(mp)) {
8871 		miocnak(q, mp, 0, EINVAL);
8872 		return;
8873 	}
8874 	ipst = CONNQ_TO_IPST(q);
8875 	stack = ipst->ips_netstack;
8876 	pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8877 
8878 	switch (pioc->mpr_proto) {
8879 	case MOD_PROTO_IP:
8880 	case MOD_PROTO_IPV4:
8881 	case MOD_PROTO_IPV6:
8882 		ptbl = ipst->ips_propinfo_tbl;
8883 		break;
8884 	case MOD_PROTO_RAWIP:
8885 		ptbl = stack->netstack_icmp->is_propinfo_tbl;
8886 		break;
8887 	case MOD_PROTO_TCP:
8888 		ptbl = stack->netstack_tcp->tcps_propinfo_tbl;
8889 		break;
8890 	case MOD_PROTO_UDP:
8891 		ptbl = stack->netstack_udp->us_propinfo_tbl;
8892 		break;
8893 	case MOD_PROTO_SCTP:
8894 		ptbl = stack->netstack_sctp->sctps_propinfo_tbl;
8895 		break;
8896 	default:
8897 		miocnak(q, mp, 0, EINVAL);
8898 		return;
8899 	}
8900 
8901 	pinfo = mod_prop_lookup(ptbl, pioc->mpr_name, pioc->mpr_proto);
8902 	if (pinfo == NULL) {
8903 		miocnak(q, mp, 0, ENOENT);
8904 		return;
8905 	}
8906 
8907 	set = (iocp->ioc_cmd == SIOCSETPROP) ? B_TRUE : B_FALSE;
8908 	if (set && pinfo->mpi_setf != NULL) {
8909 		cr = msg_getcred(mp, NULL);
8910 		if (cr == NULL)
8911 			cr = iocp->ioc_cr;
8912 		err = pinfo->mpi_setf(stack, cr, pinfo, pioc->mpr_ifname,
8913 		    pioc->mpr_val, pioc->mpr_flags);
8914 	} else if (!set && pinfo->mpi_getf != NULL) {
8915 		err = pinfo->mpi_getf(stack, pinfo, pioc->mpr_ifname,
8916 		    pioc->mpr_val, pioc->mpr_valsize, pioc->mpr_flags);
8917 	} else {
8918 		err = EPERM;
8919 	}
8920 
8921 	if (err != 0) {
8922 		miocnak(q, mp, 0, err);
8923 	} else {
8924 		if (set)
8925 			miocack(q, mp, 0, 0);
8926 		else    /* For get, we need to return back the data */
8927 			miocack(q, mp, iocp->ioc_count, 0);
8928 	}
8929 }
8930 
8931 /*
8932  * process the legacy ND_GET, ND_SET ioctl just for {ip|ip6}_forwarding
8933  * as several routing daemons have unfortunately used this 'unpublished'
8934  * but well-known ioctls.
8935  */
8936 /* ARGSUSED */
8937 static void
ip_process_legacy_nddprop(queue_t * q,mblk_t * mp)8938 ip_process_legacy_nddprop(queue_t *q, mblk_t *mp)
8939 {
8940 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8941 	mblk_t		*mp1 = mp->b_cont;
8942 	char		*pname, *pval, *buf;
8943 	uint_t		bufsize, proto;
8944 	mod_prop_info_t *pinfo = NULL;
8945 	ip_stack_t	*ipst;
8946 	int		err = 0;
8947 
8948 	ASSERT(CONN_Q(q));
8949 	ipst = CONNQ_TO_IPST(q);
8950 
8951 	if (iocp->ioc_count == 0 || mp1 == NULL) {
8952 		miocnak(q, mp, 0, EINVAL);
8953 		return;
8954 	}
8955 
8956 	mp1->b_datap->db_lim[-1] = '\0';	/* Force null termination */
8957 	pval = buf = pname = (char *)mp1->b_rptr;
8958 	bufsize = MBLKL(mp1);
8959 
8960 	if (strcmp(pname, "ip_forwarding") == 0) {
8961 		pname = "forwarding";
8962 		proto = MOD_PROTO_IPV4;
8963 	} else if (strcmp(pname, "ip6_forwarding") == 0) {
8964 		pname = "forwarding";
8965 		proto = MOD_PROTO_IPV6;
8966 	} else {
8967 		miocnak(q, mp, 0, EINVAL);
8968 		return;
8969 	}
8970 
8971 	pinfo = mod_prop_lookup(ipst->ips_propinfo_tbl, pname, proto);
8972 
8973 	switch (iocp->ioc_cmd) {
8974 	case ND_GET:
8975 		if ((err = pinfo->mpi_getf(ipst->ips_netstack, pinfo, NULL, buf,
8976 		    bufsize, 0)) == 0) {
8977 			miocack(q, mp, iocp->ioc_count, 0);
8978 			return;
8979 		}
8980 		break;
8981 	case ND_SET:
8982 		/*
8983 		 * buffer will have property name and value in the following
8984 		 * format,
8985 		 * <property name>'\0'<property value>'\0', extract them;
8986 		 */
8987 		while (*pval++)
8988 			noop;
8989 
8990 		if (!*pval || pval >= (char *)mp1->b_wptr) {
8991 			err = EINVAL;
8992 		} else if ((err = pinfo->mpi_setf(ipst->ips_netstack, NULL,
8993 		    pinfo, NULL, pval, 0)) == 0) {
8994 			miocack(q, mp, 0, 0);
8995 			return;
8996 		}
8997 		break;
8998 	default:
8999 		err = EINVAL;
9000 		break;
9001 	}
9002 	miocnak(q, mp, 0, err);
9003 }
9004 
9005 /*
9006  * Wrapper function for resuming deferred ioctl processing
9007  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9008  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9009  */
9010 /* ARGSUSED */
9011 void
ip_sioctl_copyin_resume(ipsq_t * dummy_ipsq,queue_t * q,mblk_t * mp,void * dummy_arg)9012 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9013     void *dummy_arg)
9014 {
9015 	ip_sioctl_copyin_setup(q, mp);
9016 }
9017 
9018 /*
9019  * ip_sioctl_copyin_setup is called by ip_wput_nondata with any M_IOCTL message
9020  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9021  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9022  * We establish here the size of the block to be copied in.  mi_copyin
9023  * arranges for this to happen, an processing continues in ip_wput_nondata with
9024  * an M_IOCDATA message.
9025  */
9026 void
ip_sioctl_copyin_setup(queue_t * q,mblk_t * mp)9027 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9028 {
9029 	int	copyin_size;
9030 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9031 	ip_ioctl_cmd_t *ipip;
9032 	cred_t *cr;
9033 	ip_stack_t	*ipst;
9034 
9035 	if (CONN_Q(q))
9036 		ipst = CONNQ_TO_IPST(q);
9037 	else
9038 		ipst = ILLQ_TO_IPST(q);
9039 
9040 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9041 	if (ipip == NULL) {
9042 		/*
9043 		 * The ioctl is not one we understand or own.
9044 		 * Pass it along to be processed down stream,
9045 		 * if this is a module instance of IP, else nak
9046 		 * the ioctl.
9047 		 */
9048 		if (q->q_next == NULL) {
9049 			goto nak;
9050 		} else {
9051 			putnext(q, mp);
9052 			return;
9053 		}
9054 	}
9055 
9056 	/*
9057 	 * If this is deferred, then we will do all the checks when we
9058 	 * come back.
9059 	 */
9060 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
9061 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup(ipst)) {
9062 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
9063 		return;
9064 	}
9065 
9066 	/*
9067 	 * Only allow a very small subset of IP ioctls on this stream if
9068 	 * IP is a module and not a driver. Allowing ioctls to be processed
9069 	 * in this case may cause assert failures or data corruption.
9070 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
9071 	 * ioctls allowed on an IP module stream, after which this stream
9072 	 * normally becomes a multiplexor (at which time the stream head
9073 	 * will fail all ioctls).
9074 	 */
9075 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
9076 		goto nak;
9077 	}
9078 
9079 	/* Make sure we have ioctl data to process. */
9080 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
9081 		goto nak;
9082 
9083 	/*
9084 	 * Prefer dblk credential over ioctl credential; some synthesized
9085 	 * ioctls have kcred set because there's no way to crhold()
9086 	 * a credential in some contexts.  (ioc_cr is not crfree() by
9087 	 * the framework; the caller of ioctl needs to hold the reference
9088 	 * for the duration of the call).
9089 	 */
9090 	cr = msg_getcred(mp, NULL);
9091 	if (cr == NULL)
9092 		cr = iocp->ioc_cr;
9093 
9094 	/* Make sure normal users don't send down privileged ioctls */
9095 	if ((ipip->ipi_flags & IPI_PRIV) &&
9096 	    (cr != NULL) && secpolicy_ip_config(cr, B_TRUE) != 0) {
9097 		/* We checked the privilege earlier but log it here */
9098 		miocnak(q, mp, 0, secpolicy_ip_config(cr, B_FALSE));
9099 		return;
9100 	}
9101 
9102 	/*
9103 	 * The ioctl command tables can only encode fixed length
9104 	 * ioctl data. If the length is variable, the table will
9105 	 * encode the length as zero. Such special cases are handled
9106 	 * below in the switch.
9107 	 */
9108 	if (ipip->ipi_copyin_size != 0) {
9109 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
9110 		return;
9111 	}
9112 
9113 	switch (iocp->ioc_cmd) {
9114 	case O_SIOCGIFCONF:
9115 	case SIOCGIFCONF:
9116 		/*
9117 		 * This IOCTL is hilarious.  See comments in
9118 		 * ip_sioctl_get_ifconf for the story.
9119 		 */
9120 		if (iocp->ioc_count == TRANSPARENT)
9121 			copyin_size = SIZEOF_STRUCT(ifconf,
9122 			    iocp->ioc_flag);
9123 		else
9124 			copyin_size = iocp->ioc_count;
9125 		mi_copyin(q, mp, NULL, copyin_size);
9126 		return;
9127 
9128 	case O_SIOCGLIFCONF:
9129 	case SIOCGLIFCONF:
9130 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
9131 		mi_copyin(q, mp, NULL, copyin_size);
9132 		return;
9133 
9134 	case SIOCGLIFSRCOF:
9135 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
9136 		mi_copyin(q, mp, NULL, copyin_size);
9137 		return;
9138 
9139 	case SIOCGIP6ADDRPOLICY:
9140 		ip_sioctl_ip6addrpolicy(q, mp);
9141 		ip6_asp_table_refrele(ipst);
9142 		return;
9143 
9144 	case SIOCSIP6ADDRPOLICY:
9145 		ip_sioctl_ip6addrpolicy(q, mp);
9146 		return;
9147 
9148 	case SIOCGDSTINFO:
9149 		ip_sioctl_dstinfo(q, mp);
9150 		ip6_asp_table_refrele(ipst);
9151 		return;
9152 
9153 	case ND_SET:
9154 	case ND_GET:
9155 		ip_process_legacy_nddprop(q, mp);
9156 		return;
9157 
9158 	case SIOCSETPROP:
9159 	case SIOCGETPROP:
9160 		ip_sioctl_getsetprop(q, mp);
9161 		return;
9162 
9163 	case I_PLINK:
9164 	case I_PUNLINK:
9165 	case I_LINK:
9166 	case I_UNLINK:
9167 		/*
9168 		 * We treat non-persistent link similarly as the persistent
9169 		 * link case, in terms of plumbing/unplumbing, as well as
9170 		 * dynamic re-plumbing events indicator.  See comments
9171 		 * in ip_sioctl_plink() for more.
9172 		 *
9173 		 * Request can be enqueued in the 'ipsq' while waiting
9174 		 * to become exclusive. So bump up the conn ref.
9175 		 */
9176 		if (CONN_Q(q)) {
9177 			CONN_INC_REF(Q_TO_CONN(q));
9178 			CONN_INC_IOCTLREF(Q_TO_CONN(q))
9179 		}
9180 		ip_sioctl_plink(NULL, q, mp, NULL);
9181 		return;
9182 
9183 	case IP_IOCTL:
9184 		ip_wput_ioctl(q, mp);
9185 		return;
9186 
9187 	case SIOCILB:
9188 		/* The ioctl length varies depending on the ILB command. */
9189 		copyin_size = iocp->ioc_count;
9190 		if (copyin_size < sizeof (ilb_cmd_t))
9191 			goto nak;
9192 		mi_copyin(q, mp, NULL, copyin_size);
9193 		return;
9194 
9195 	default:
9196 		cmn_err(CE_WARN, "Unknown ioctl %d/0x%x slipped through.",
9197 		    iocp->ioc_cmd, iocp->ioc_cmd);
9198 		/* FALLTHRU */
9199 	}
9200 nak:
9201 	if (mp->b_cont != NULL) {
9202 		freemsg(mp->b_cont);
9203 		mp->b_cont = NULL;
9204 	}
9205 	iocp->ioc_error = EINVAL;
9206 	mp->b_datap->db_type = M_IOCNAK;
9207 	iocp->ioc_count = 0;
9208 	qreply(q, mp);
9209 }
9210 
9211 static void
ip_sioctl_garp_reply(mblk_t * mp,ill_t * ill,void * hwaddr,int flags)9212 ip_sioctl_garp_reply(mblk_t *mp, ill_t *ill, void *hwaddr, int flags)
9213 {
9214 	struct arpreq *ar;
9215 	struct xarpreq *xar;
9216 	mblk_t	*tmp;
9217 	struct iocblk *iocp;
9218 	int x_arp_ioctl = B_FALSE;
9219 	int *flagsp;
9220 	char *storage = NULL;
9221 
9222 	ASSERT(ill != NULL);
9223 
9224 	iocp = (struct iocblk *)mp->b_rptr;
9225 	ASSERT(iocp->ioc_cmd == SIOCGXARP || iocp->ioc_cmd == SIOCGARP);
9226 
9227 	tmp = (mp->b_cont)->b_cont; /* xarpreq/arpreq */
9228 	if ((iocp->ioc_cmd == SIOCGXARP) ||
9229 	    (iocp->ioc_cmd == SIOCSXARP)) {
9230 		x_arp_ioctl = B_TRUE;
9231 		xar = (struct xarpreq *)tmp->b_rptr;
9232 		flagsp = &xar->xarp_flags;
9233 		storage = xar->xarp_ha.sdl_data;
9234 	} else {
9235 		ar = (struct arpreq *)tmp->b_rptr;
9236 		flagsp = &ar->arp_flags;
9237 		storage = ar->arp_ha.sa_data;
9238 	}
9239 
9240 	/*
9241 	 * We're done if this is not an SIOCG{X}ARP
9242 	 */
9243 	if (x_arp_ioctl) {
9244 		storage += ill_xarp_info(&xar->xarp_ha, ill);
9245 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
9246 		    sizeof (xar->xarp_ha.sdl_data)) {
9247 			iocp->ioc_error = EINVAL;
9248 			return;
9249 		}
9250 	}
9251 	*flagsp = ATF_INUSE;
9252 	/*
9253 	 * If /sbin/arp told us we are the authority using the "permanent"
9254 	 * flag, or if this is one of my addresses print "permanent"
9255 	 * in the /sbin/arp output.
9256 	 */
9257 	if ((flags & NCE_F_MYADDR) || (flags & NCE_F_AUTHORITY))
9258 		*flagsp |= ATF_AUTHORITY;
9259 	if (flags & NCE_F_NONUD)
9260 		*flagsp |= ATF_PERM; /* not subject to aging */
9261 	if (flags & NCE_F_PUBLISH)
9262 		*flagsp |= ATF_PUBL;
9263 	if (hwaddr != NULL) {
9264 		*flagsp |= ATF_COM;
9265 		bcopy((char *)hwaddr, storage, ill->ill_phys_addr_length);
9266 	}
9267 }
9268 
9269 /*
9270  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
9271  * interface) create the next available logical interface for this
9272  * physical interface.
9273  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
9274  * ipif with the specified name.
9275  *
9276  * If the address family is not AF_UNSPEC then set the address as well.
9277  *
9278  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
9279  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
9280  *
9281  * Executed as a writer on the ill.
9282  * So no lock is needed to traverse the ipif chain, or examine the
9283  * phyint flags.
9284  */
9285 /* ARGSUSED */
9286 int
ip_sioctl_addif(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * dummy_ipip,void * dummy_ifreq)9287 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9288     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9289 {
9290 	mblk_t	*mp1;
9291 	struct lifreq *lifr;
9292 	boolean_t	isv6;
9293 	boolean_t	exists;
9294 	char	*name;
9295 	char	*endp;
9296 	char	*cp;
9297 	int	namelen;
9298 	ipif_t	*ipif;
9299 	long	id;
9300 	ipsq_t	*ipsq;
9301 	ill_t	*ill;
9302 	sin_t	*sin;
9303 	int	err = 0;
9304 	boolean_t found_sep = B_FALSE;
9305 	conn_t	*connp;
9306 	zoneid_t zoneid;
9307 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
9308 
9309 	ASSERT(q->q_next == NULL);
9310 	ip1dbg(("ip_sioctl_addif\n"));
9311 	/* Existence of mp1 has been checked in ip_wput_nondata */
9312 	mp1 = mp->b_cont->b_cont;
9313 	/*
9314 	 * Null terminate the string to protect against buffer
9315 	 * overrun. String was generated by user code and may not
9316 	 * be trusted.
9317 	 */
9318 	lifr = (struct lifreq *)mp1->b_rptr;
9319 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
9320 	name = lifr->lifr_name;
9321 	ASSERT(CONN_Q(q));
9322 	connp = Q_TO_CONN(q);
9323 	isv6 = (connp->conn_family == AF_INET6);
9324 	zoneid = connp->conn_zoneid;
9325 	namelen = mi_strlen(name);
9326 	if (namelen == 0)
9327 		return (EINVAL);
9328 
9329 	exists = B_FALSE;
9330 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
9331 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
9332 		/*
9333 		 * Allow creating lo0 using SIOCLIFADDIF.
9334 		 * can't be any other writer thread. So can pass null below
9335 		 * for the last 4 args to ipif_lookup_name.
9336 		 */
9337 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen, B_TRUE,
9338 		    &exists, isv6, zoneid, ipst);
9339 		/* Prevent any further action */
9340 		if (ipif == NULL) {
9341 			return (ENOBUFS);
9342 		} else if (!exists) {
9343 			/* We created the ipif now and as writer */
9344 			ipif_refrele(ipif);
9345 			return (0);
9346 		} else {
9347 			ill = ipif->ipif_ill;
9348 			ill_refhold(ill);
9349 			ipif_refrele(ipif);
9350 		}
9351 	} else {
9352 		/* Look for a colon in the name. */
9353 		endp = &name[namelen];
9354 		for (cp = endp; --cp > name; ) {
9355 			if (*cp == IPIF_SEPARATOR_CHAR) {
9356 				found_sep = B_TRUE;
9357 				/*
9358 				 * Reject any non-decimal aliases for plumbing
9359 				 * of logical interfaces. Aliases with leading
9360 				 * zeroes are also rejected as they introduce
9361 				 * ambiguity in the naming of the interfaces.
9362 				 * Comparing with "0" takes care of all such
9363 				 * cases.
9364 				 */
9365 				if ((strncmp("0", cp+1, 1)) == 0)
9366 					return (EINVAL);
9367 
9368 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
9369 				    id <= 0 || *endp != '\0') {
9370 					return (EINVAL);
9371 				}
9372 				*cp = '\0';
9373 				break;
9374 			}
9375 		}
9376 		ill = ill_lookup_on_name(name, B_FALSE, isv6, NULL, ipst);
9377 		if (found_sep)
9378 			*cp = IPIF_SEPARATOR_CHAR;
9379 		if (ill == NULL)
9380 			return (ENXIO);
9381 	}
9382 
9383 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
9384 	    B_TRUE);
9385 
9386 	/*
9387 	 * Release the refhold due to the lookup, now that we are excl
9388 	 * or we are just returning
9389 	 */
9390 	ill_refrele(ill);
9391 
9392 	if (ipsq == NULL)
9393 		return (EINPROGRESS);
9394 
9395 	/* We are now exclusive on the IPSQ */
9396 	ASSERT(IAM_WRITER_ILL(ill));
9397 
9398 	if (found_sep) {
9399 		/* Now see if there is an IPIF with this unit number. */
9400 		for (ipif = ill->ill_ipif; ipif != NULL;
9401 		    ipif = ipif->ipif_next) {
9402 			if (ipif->ipif_id == id) {
9403 				err = EEXIST;
9404 				goto done;
9405 			}
9406 		}
9407 	}
9408 
9409 	/*
9410 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
9411 	 * of lo0.  Plumbing for lo0:0 happens in ipif_lookup_on_name()
9412 	 * instead.
9413 	 */
9414 	if ((ipif = ipif_allocate(ill, found_sep ? id : -1, IRE_LOCAL,
9415 	    B_TRUE, B_TRUE, &err)) == NULL) {
9416 		goto done;
9417 	}
9418 
9419 	/* Return created name with ioctl */
9420 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
9421 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
9422 	ip1dbg(("created %s\n", lifr->lifr_name));
9423 
9424 	/* Set address */
9425 	sin = (sin_t *)&lifr->lifr_addr;
9426 	if (sin->sin_family != AF_UNSPEC) {
9427 		err = ip_sioctl_addr(ipif, sin, q, mp,
9428 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
9429 	}
9430 
9431 done:
9432 	ipsq_exit(ipsq);
9433 	return (err);
9434 }
9435 
9436 /*
9437  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
9438  * interface) delete it based on the IP address (on this physical interface).
9439  * Otherwise delete it based on the ipif_id.
9440  * Also, special handling to allow a removeif of lo0.
9441  */
9442 /* ARGSUSED */
9443 int
ip_sioctl_removeif(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_if_req)9444 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9445     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9446 {
9447 	conn_t		*connp;
9448 	ill_t		*ill = ipif->ipif_ill;
9449 	boolean_t	 success;
9450 	ip_stack_t	*ipst;
9451 
9452 	ipst = CONNQ_TO_IPST(q);
9453 
9454 	ASSERT(q->q_next == NULL);
9455 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
9456 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9457 	ASSERT(IAM_WRITER_IPIF(ipif));
9458 
9459 	connp = Q_TO_CONN(q);
9460 	/*
9461 	 * Special case for unplumbing lo0 (the loopback physical interface).
9462 	 * If unplumbing lo0, the incoming address structure has been
9463 	 * initialized to all zeros. When unplumbing lo0, all its logical
9464 	 * interfaces must be removed too.
9465 	 *
9466 	 * Note that this interface may be called to remove a specific
9467 	 * loopback logical interface (eg, lo0:1). But in that case
9468 	 * ipif->ipif_id != 0 so that the code path for that case is the
9469 	 * same as any other interface (meaning it skips the code directly
9470 	 * below).
9471 	 */
9472 	if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9473 		if (sin->sin_family == AF_UNSPEC &&
9474 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
9475 			/*
9476 			 * Mark it condemned. No new ref. will be made to ill.
9477 			 */
9478 			mutex_enter(&ill->ill_lock);
9479 			ill->ill_state_flags |= ILL_CONDEMNED;
9480 			for (ipif = ill->ill_ipif; ipif != NULL;
9481 			    ipif = ipif->ipif_next) {
9482 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
9483 			}
9484 			mutex_exit(&ill->ill_lock);
9485 
9486 			ipif = ill->ill_ipif;
9487 			/* unplumb the loopback interface */
9488 			ill_delete(ill);
9489 			mutex_enter(&connp->conn_lock);
9490 			mutex_enter(&ill->ill_lock);
9491 
9492 			/* Are any references to this ill active */
9493 			if (ill_is_freeable(ill)) {
9494 				mutex_exit(&ill->ill_lock);
9495 				mutex_exit(&connp->conn_lock);
9496 				ill_delete_tail(ill);
9497 				mi_free(ill);
9498 				return (0);
9499 			}
9500 			success = ipsq_pending_mp_add(connp, ipif,
9501 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
9502 			mutex_exit(&connp->conn_lock);
9503 			mutex_exit(&ill->ill_lock);
9504 			if (success)
9505 				return (EINPROGRESS);
9506 			else
9507 				return (EINTR);
9508 		}
9509 	}
9510 
9511 	if (ipif->ipif_id == 0) {
9512 		ipsq_t *ipsq;
9513 
9514 		/* Find based on address */
9515 		if (ipif->ipif_isv6) {
9516 			sin6_t *sin6;
9517 
9518 			if (sin->sin_family != AF_INET6)
9519 				return (EAFNOSUPPORT);
9520 
9521 			sin6 = (sin6_t *)sin;
9522 			/* We are a writer, so we should be able to lookup */
9523 			ipif = ipif_lookup_addr_exact_v6(&sin6->sin6_addr, ill,
9524 			    ipst);
9525 		} else {
9526 			if (sin->sin_family != AF_INET)
9527 				return (EAFNOSUPPORT);
9528 
9529 			/* We are a writer, so we should be able to lookup */
9530 			ipif = ipif_lookup_addr_exact(sin->sin_addr.s_addr, ill,
9531 			    ipst);
9532 		}
9533 		if (ipif == NULL) {
9534 			return (EADDRNOTAVAIL);
9535 		}
9536 
9537 		/*
9538 		 * It is possible for a user to send an SIOCLIFREMOVEIF with
9539 		 * lifr_name of the physical interface but with an ip address
9540 		 * lifr_addr of a logical interface plumbed over it.
9541 		 * So update ipx_current_ipif now that ipif points to the
9542 		 * correct one.
9543 		 */
9544 		ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
9545 		ipsq->ipsq_xop->ipx_current_ipif = ipif;
9546 
9547 		/* This is a writer */
9548 		ipif_refrele(ipif);
9549 	}
9550 
9551 	/*
9552 	 * Can not delete instance zero since it is tied to the ill.
9553 	 */
9554 	if (ipif->ipif_id == 0)
9555 		return (EBUSY);
9556 
9557 	mutex_enter(&ill->ill_lock);
9558 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
9559 	mutex_exit(&ill->ill_lock);
9560 
9561 	ipif_free(ipif);
9562 
9563 	mutex_enter(&connp->conn_lock);
9564 	mutex_enter(&ill->ill_lock);
9565 
9566 	/* Are any references to this ipif active */
9567 	if (ipif_is_freeable(ipif)) {
9568 		mutex_exit(&ill->ill_lock);
9569 		mutex_exit(&connp->conn_lock);
9570 		ipif_non_duplicate(ipif);
9571 		(void) ipif_down_tail(ipif);
9572 		ipif_free_tail(ipif); /* frees ipif */
9573 		return (0);
9574 	}
9575 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
9576 	    IPIF_FREE);
9577 	mutex_exit(&ill->ill_lock);
9578 	mutex_exit(&connp->conn_lock);
9579 	if (success)
9580 		return (EINPROGRESS);
9581 	else
9582 		return (EINTR);
9583 }
9584 
9585 /*
9586  * Restart the removeif ioctl. The refcnt has gone down to 0.
9587  * The ipif is already condemned. So can't find it thru lookups.
9588  */
9589 /* ARGSUSED */
9590 int
ip_sioctl_removeif_restart(ipif_t * ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_if_req)9591 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
9592     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9593 {
9594 	ill_t *ill = ipif->ipif_ill;
9595 
9596 	ASSERT(IAM_WRITER_IPIF(ipif));
9597 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
9598 
9599 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
9600 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9601 
9602 	if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9603 		ASSERT(ill->ill_state_flags & ILL_CONDEMNED);
9604 		ill_delete_tail(ill);
9605 		mi_free(ill);
9606 		return (0);
9607 	}
9608 
9609 	ipif_non_duplicate(ipif);
9610 	(void) ipif_down_tail(ipif);
9611 	ipif_free_tail(ipif);
9612 
9613 	return (0);
9614 }
9615 
9616 /*
9617  * Set the local interface address using the given prefix and ill_token.
9618  */
9619 /* ARGSUSED */
9620 int
ip_sioctl_prefix(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * dummy_ipip,void * dummy_ifreq)9621 ip_sioctl_prefix(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9622     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9623 {
9624 	int err;
9625 	in6_addr_t v6addr;
9626 	sin6_t *sin6;
9627 	ill_t *ill;
9628 	int i;
9629 
9630 	ip1dbg(("ip_sioctl_prefix(%s:%u %p)\n",
9631 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9632 
9633 	ASSERT(IAM_WRITER_IPIF(ipif));
9634 
9635 	if (!ipif->ipif_isv6)
9636 		return (EINVAL);
9637 
9638 	if (sin->sin_family != AF_INET6)
9639 		return (EAFNOSUPPORT);
9640 
9641 	sin6 = (sin6_t *)sin;
9642 	v6addr = sin6->sin6_addr;
9643 	ill = ipif->ipif_ill;
9644 
9645 	if (IN6_IS_ADDR_UNSPECIFIED(&v6addr) ||
9646 	    IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token))
9647 		return (EADDRNOTAVAIL);
9648 
9649 	for (i = 0; i < 4; i++)
9650 		sin6->sin6_addr.s6_addr32[i] |= ill->ill_token.s6_addr32[i];
9651 
9652 	err = ip_sioctl_addr(ipif, sin, q, mp,
9653 	    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], dummy_ifreq);
9654 	return (err);
9655 }
9656 
9657 /*
9658  * Restart entry point to restart the address set operation after the
9659  * refcounts have dropped to zero.
9660  */
9661 /* ARGSUSED */
9662 int
ip_sioctl_prefix_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)9663 ip_sioctl_prefix_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9664     ip_ioctl_cmd_t *ipip, void *ifreq)
9665 {
9666 	ip1dbg(("ip_sioctl_prefix_restart(%s:%u %p)\n",
9667 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9668 	return (ip_sioctl_addr_restart(ipif, sin, q, mp, ipip, ifreq));
9669 }
9670 
9671 /*
9672  * Set the local interface address.
9673  * Allow an address of all zero when the interface is down.
9674  */
9675 /* ARGSUSED */
9676 int
ip_sioctl_addr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * dummy_ipip,void * dummy_ifreq)9677 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9678     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9679 {
9680 	int err = 0;
9681 	in6_addr_t v6addr;
9682 	boolean_t need_up = B_FALSE;
9683 	ill_t *ill;
9684 	int i;
9685 
9686 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
9687 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9688 
9689 	ASSERT(IAM_WRITER_IPIF(ipif));
9690 
9691 	ill = ipif->ipif_ill;
9692 	if (ipif->ipif_isv6) {
9693 		sin6_t *sin6;
9694 		phyint_t *phyi;
9695 
9696 		if (sin->sin_family != AF_INET6)
9697 			return (EAFNOSUPPORT);
9698 
9699 		sin6 = (sin6_t *)sin;
9700 		v6addr = sin6->sin6_addr;
9701 		phyi = ill->ill_phyint;
9702 
9703 		/*
9704 		 * Enforce that true multicast interfaces have a link-local
9705 		 * address for logical unit 0.
9706 		 *
9707 		 * However for those ipif's for which link-local address was
9708 		 * not created by default, also allow setting :: as the address.
9709 		 * This scenario would arise, when we delete an address on ipif
9710 		 * with logical unit 0, we would want to set :: as the address.
9711 		 */
9712 		if (ipif->ipif_id == 0 &&
9713 		    (ill->ill_flags & ILLF_MULTICAST) &&
9714 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
9715 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
9716 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
9717 
9718 			/*
9719 			 * if default link-local was not created by kernel for
9720 			 * this ill, allow setting :: as the address on ipif:0.
9721 			 */
9722 			if (ill->ill_flags & ILLF_NOLINKLOCAL) {
9723 				if (!IN6_IS_ADDR_UNSPECIFIED(&v6addr))
9724 					return (EADDRNOTAVAIL);
9725 			} else {
9726 				return (EADDRNOTAVAIL);
9727 			}
9728 		}
9729 
9730 		/*
9731 		 * up interfaces shouldn't have the unspecified address
9732 		 * unless they also have the IPIF_NOLOCAL flags set and
9733 		 * have a subnet assigned.
9734 		 */
9735 		if ((ipif->ipif_flags & IPIF_UP) &&
9736 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
9737 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
9738 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
9739 			return (EADDRNOTAVAIL);
9740 		}
9741 
9742 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
9743 			return (EADDRNOTAVAIL);
9744 	} else {
9745 		ipaddr_t addr;
9746 
9747 		if (sin->sin_family != AF_INET)
9748 			return (EAFNOSUPPORT);
9749 
9750 		addr = sin->sin_addr.s_addr;
9751 
9752 		/* Allow INADDR_ANY as the local address. */
9753 		if (addr != INADDR_ANY &&
9754 		    !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
9755 			return (EADDRNOTAVAIL);
9756 
9757 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9758 	}
9759 	/*
9760 	 * verify that the address being configured is permitted by the
9761 	 * ill_allowed_ips[] for the interface.
9762 	 */
9763 	if (ill->ill_allowed_ips_cnt > 0) {
9764 		for (i = 0; i < ill->ill_allowed_ips_cnt; i++) {
9765 			if (IN6_ARE_ADDR_EQUAL(&ill->ill_allowed_ips[i],
9766 			    &v6addr))
9767 				break;
9768 		}
9769 		if (i == ill->ill_allowed_ips_cnt) {
9770 			pr_addr_dbg("!allowed addr %s\n", AF_INET6, &v6addr);
9771 			return (EPERM);
9772 		}
9773 	}
9774 	/*
9775 	 * Even if there is no change we redo things just to rerun
9776 	 * ipif_set_default.
9777 	 */
9778 	if (ipif->ipif_flags & IPIF_UP) {
9779 		/*
9780 		 * Setting a new local address, make sure
9781 		 * we have net and subnet bcast ire's for
9782 		 * the old address if we need them.
9783 		 */
9784 		/*
9785 		 * If the interface is already marked up,
9786 		 * we call ipif_down which will take care
9787 		 * of ditching any IREs that have been set
9788 		 * up based on the old interface address.
9789 		 */
9790 		err = ipif_logical_down(ipif, q, mp);
9791 		if (err == EINPROGRESS)
9792 			return (err);
9793 		(void) ipif_down_tail(ipif);
9794 		need_up = 1;
9795 	}
9796 
9797 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
9798 	return (err);
9799 }
9800 
9801 int
ip_sioctl_addr_tail(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,boolean_t need_up)9802 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9803     boolean_t need_up)
9804 {
9805 	in6_addr_t v6addr;
9806 	in6_addr_t ov6addr;
9807 	ipaddr_t addr;
9808 	sin6_t	*sin6;
9809 	int	sinlen;
9810 	int	err = 0;
9811 	ill_t	*ill = ipif->ipif_ill;
9812 	boolean_t need_dl_down;
9813 	boolean_t need_arp_down;
9814 	struct iocblk *iocp;
9815 
9816 	iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
9817 
9818 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
9819 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9820 	ASSERT(IAM_WRITER_IPIF(ipif));
9821 
9822 	/* Must cancel any pending timer before taking the ill_lock */
9823 	if (ipif->ipif_recovery_id != 0)
9824 		(void) untimeout(ipif->ipif_recovery_id);
9825 	ipif->ipif_recovery_id = 0;
9826 
9827 	if (ipif->ipif_isv6) {
9828 		sin6 = (sin6_t *)sin;
9829 		v6addr = sin6->sin6_addr;
9830 		sinlen = sizeof (struct sockaddr_in6);
9831 	} else {
9832 		addr = sin->sin_addr.s_addr;
9833 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9834 		sinlen = sizeof (struct sockaddr_in);
9835 	}
9836 	mutex_enter(&ill->ill_lock);
9837 	ov6addr = ipif->ipif_v6lcl_addr;
9838 	ipif->ipif_v6lcl_addr = v6addr;
9839 	sctp_update_ipif_addr(ipif, ov6addr);
9840 	ipif->ipif_addr_ready = 0;
9841 
9842 	ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
9843 
9844 	/*
9845 	 * If the interface was previously marked as a duplicate, then since
9846 	 * we've now got a "new" address, it should no longer be considered a
9847 	 * duplicate -- even if the "new" address is the same as the old one.
9848 	 * Note that if all ipifs are down, we may have a pending ARP down
9849 	 * event to handle.  This is because we want to recover from duplicates
9850 	 * and thus delay tearing down ARP until the duplicates have been
9851 	 * removed or disabled.
9852 	 */
9853 	need_dl_down = need_arp_down = B_FALSE;
9854 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
9855 		need_arp_down = !need_up;
9856 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
9857 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
9858 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
9859 			need_dl_down = B_TRUE;
9860 		}
9861 	}
9862 
9863 	ipif_set_default(ipif);
9864 
9865 	/*
9866 	 * If we've just manually set the IPv6 link-local address (0th ipif),
9867 	 * tag the ill so that future updates to the interface ID don't result
9868 	 * in this address getting automatically reconfigured from under the
9869 	 * administrator.
9870 	 */
9871 	if (ipif->ipif_isv6 && ipif->ipif_id == 0) {
9872 		if (iocp == NULL || (iocp->ioc_cmd == SIOCSLIFADDR &&
9873 		    !IN6_IS_ADDR_UNSPECIFIED(&v6addr)))
9874 			ill->ill_manual_linklocal = 1;
9875 	}
9876 
9877 	/*
9878 	 * When publishing an interface address change event, we only notify
9879 	 * the event listeners of the new address.  It is assumed that if they
9880 	 * actively care about the addresses assigned that they will have
9881 	 * already discovered the previous address assigned (if there was one.)
9882 	 *
9883 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
9884 	 */
9885 	if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
9886 		ill_nic_event_dispatch(ill, MAP_IPIF_ID(ipif->ipif_id),
9887 		    NE_ADDRESS_CHANGE, sin, sinlen);
9888 	}
9889 
9890 	mutex_exit(&ill->ill_lock);
9891 
9892 	if (need_up) {
9893 		/*
9894 		 * Now bring the interface back up.  If this
9895 		 * is the only IPIF for the ILL, ipif_up
9896 		 * will have to re-bind to the device, so
9897 		 * we may get back EINPROGRESS, in which
9898 		 * case, this IOCTL will get completed in
9899 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
9900 		 */
9901 		err = ipif_up(ipif, q, mp);
9902 	} else {
9903 		/* Perhaps ilgs should use this ill */
9904 		update_conn_ill(NULL, ill->ill_ipst);
9905 	}
9906 
9907 	if (need_dl_down)
9908 		ill_dl_down(ill);
9909 
9910 	if (need_arp_down && !ill->ill_isv6)
9911 		(void) ipif_arp_down(ipif);
9912 
9913 	/*
9914 	 * The default multicast interface might have changed (for
9915 	 * instance if the IPv6 scope of the address changed)
9916 	 */
9917 	ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
9918 
9919 	return (err);
9920 }
9921 
9922 /*
9923  * Restart entry point to restart the address set operation after the
9924  * refcounts have dropped to zero.
9925  */
9926 /* ARGSUSED */
9927 int
ip_sioctl_addr_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)9928 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9929     ip_ioctl_cmd_t *ipip, void *ifreq)
9930 {
9931 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
9932 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9933 	ASSERT(IAM_WRITER_IPIF(ipif));
9934 	(void) ipif_down_tail(ipif);
9935 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
9936 }
9937 
9938 /* ARGSUSED */
9939 int
ip_sioctl_get_addr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)9940 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9941     ip_ioctl_cmd_t *ipip, void *if_req)
9942 {
9943 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
9944 	struct lifreq *lifr = (struct lifreq *)if_req;
9945 
9946 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
9947 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9948 	/*
9949 	 * The net mask and address can't change since we have a
9950 	 * reference to the ipif. So no lock is necessary.
9951 	 */
9952 	if (ipif->ipif_isv6) {
9953 		*sin6 = sin6_null;
9954 		sin6->sin6_family = AF_INET6;
9955 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
9956 		if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
9957 			sin6->sin6_scope_id =
9958 			    ipif->ipif_ill->ill_phyint->phyint_ifindex;
9959 		}
9960 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
9961 		lifr->lifr_addrlen =
9962 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
9963 	} else {
9964 		*sin = sin_null;
9965 		sin->sin_family = AF_INET;
9966 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
9967 		if (ipip->ipi_cmd_type == LIF_CMD) {
9968 			lifr->lifr_addrlen =
9969 			    ip_mask_to_plen(ipif->ipif_net_mask);
9970 		}
9971 	}
9972 	return (0);
9973 }
9974 
9975 /*
9976  * Set the destination address for a pt-pt interface.
9977  */
9978 /* ARGSUSED */
9979 int
ip_sioctl_dstaddr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)9980 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9981     ip_ioctl_cmd_t *ipip, void *if_req)
9982 {
9983 	int err = 0;
9984 	in6_addr_t v6addr;
9985 	boolean_t need_up = B_FALSE;
9986 
9987 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
9988 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9989 	ASSERT(IAM_WRITER_IPIF(ipif));
9990 
9991 	if (ipif->ipif_isv6) {
9992 		sin6_t *sin6;
9993 
9994 		if (sin->sin_family != AF_INET6)
9995 			return (EAFNOSUPPORT);
9996 
9997 		sin6 = (sin6_t *)sin;
9998 		v6addr = sin6->sin6_addr;
9999 
10000 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10001 			return (EADDRNOTAVAIL);
10002 	} else {
10003 		ipaddr_t addr;
10004 
10005 		if (sin->sin_family != AF_INET)
10006 			return (EAFNOSUPPORT);
10007 
10008 		addr = sin->sin_addr.s_addr;
10009 		if (addr != INADDR_ANY &&
10010 		    !ip_addr_ok_v4(addr, ipif->ipif_net_mask)) {
10011 			return (EADDRNOTAVAIL);
10012 		}
10013 
10014 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10015 	}
10016 
10017 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
10018 		return (0);	/* No change */
10019 
10020 	if (ipif->ipif_flags & IPIF_UP) {
10021 		/*
10022 		 * If the interface is already marked up,
10023 		 * we call ipif_down which will take care
10024 		 * of ditching any IREs that have been set
10025 		 * up based on the old pp dst address.
10026 		 */
10027 		err = ipif_logical_down(ipif, q, mp);
10028 		if (err == EINPROGRESS)
10029 			return (err);
10030 		(void) ipif_down_tail(ipif);
10031 		need_up = B_TRUE;
10032 	}
10033 	/*
10034 	 * could return EINPROGRESS. If so ioctl will complete in
10035 	 * ip_rput_dlpi_writer
10036 	 */
10037 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
10038 	return (err);
10039 }
10040 
10041 static int
ip_sioctl_dstaddr_tail(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,boolean_t need_up)10042 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10043     boolean_t need_up)
10044 {
10045 	in6_addr_t v6addr;
10046 	ill_t	*ill = ipif->ipif_ill;
10047 	int	err = 0;
10048 	boolean_t need_dl_down;
10049 	boolean_t need_arp_down;
10050 
10051 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
10052 	    ipif->ipif_id, (void *)ipif));
10053 
10054 	/* Must cancel any pending timer before taking the ill_lock */
10055 	if (ipif->ipif_recovery_id != 0)
10056 		(void) untimeout(ipif->ipif_recovery_id);
10057 	ipif->ipif_recovery_id = 0;
10058 
10059 	if (ipif->ipif_isv6) {
10060 		sin6_t *sin6;
10061 
10062 		sin6 = (sin6_t *)sin;
10063 		v6addr = sin6->sin6_addr;
10064 	} else {
10065 		ipaddr_t addr;
10066 
10067 		addr = sin->sin_addr.s_addr;
10068 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10069 	}
10070 	mutex_enter(&ill->ill_lock);
10071 	/* Set point to point destination address. */
10072 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10073 		/*
10074 		 * Allow this as a means of creating logical
10075 		 * pt-pt interfaces on top of e.g. an Ethernet.
10076 		 * XXX Undocumented HACK for testing.
10077 		 * pt-pt interfaces are created with NUD disabled.
10078 		 */
10079 		ipif->ipif_flags |= IPIF_POINTOPOINT;
10080 		ipif->ipif_flags &= ~IPIF_BROADCAST;
10081 		if (ipif->ipif_isv6)
10082 			ill->ill_flags |= ILLF_NONUD;
10083 	}
10084 
10085 	/*
10086 	 * If the interface was previously marked as a duplicate, then since
10087 	 * we've now got a "new" address, it should no longer be considered a
10088 	 * duplicate -- even if the "new" address is the same as the old one.
10089 	 * Note that if all ipifs are down, we may have a pending ARP down
10090 	 * event to handle.
10091 	 */
10092 	need_dl_down = need_arp_down = B_FALSE;
10093 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
10094 		need_arp_down = !need_up;
10095 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
10096 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
10097 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
10098 			need_dl_down = B_TRUE;
10099 		}
10100 	}
10101 
10102 	/*
10103 	 * If we've just manually set the IPv6 destination link-local address
10104 	 * (0th ipif), tag the ill so that future updates to the destination
10105 	 * interface ID (as can happen with interfaces over IP tunnels) don't
10106 	 * result in this address getting automatically reconfigured from
10107 	 * under the administrator.
10108 	 */
10109 	if (ipif->ipif_isv6 && ipif->ipif_id == 0)
10110 		ill->ill_manual_dst_linklocal = 1;
10111 
10112 	/* Set the new address. */
10113 	ipif->ipif_v6pp_dst_addr = v6addr;
10114 	/* Make sure subnet tracks pp_dst */
10115 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
10116 	mutex_exit(&ill->ill_lock);
10117 
10118 	if (need_up) {
10119 		/*
10120 		 * Now bring the interface back up.  If this
10121 		 * is the only IPIF for the ILL, ipif_up
10122 		 * will have to re-bind to the device, so
10123 		 * we may get back EINPROGRESS, in which
10124 		 * case, this IOCTL will get completed in
10125 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10126 		 */
10127 		err = ipif_up(ipif, q, mp);
10128 	}
10129 
10130 	if (need_dl_down)
10131 		ill_dl_down(ill);
10132 	if (need_arp_down && !ipif->ipif_isv6)
10133 		(void) ipif_arp_down(ipif);
10134 
10135 	return (err);
10136 }
10137 
10138 /*
10139  * Restart entry point to restart the dstaddress set operation after the
10140  * refcounts have dropped to zero.
10141  */
10142 /* ARGSUSED */
10143 int
ip_sioctl_dstaddr_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)10144 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10145     ip_ioctl_cmd_t *ipip, void *ifreq)
10146 {
10147 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
10148 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10149 	(void) ipif_down_tail(ipif);
10150 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
10151 }
10152 
10153 /* ARGSUSED */
10154 int
ip_sioctl_get_dstaddr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10155 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10156     ip_ioctl_cmd_t *ipip, void *if_req)
10157 {
10158 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
10159 
10160 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
10161 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10162 	/*
10163 	 * Get point to point destination address. The addresses can't
10164 	 * change since we hold a reference to the ipif.
10165 	 */
10166 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
10167 		return (EADDRNOTAVAIL);
10168 
10169 	if (ipif->ipif_isv6) {
10170 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10171 		*sin6 = sin6_null;
10172 		sin6->sin6_family = AF_INET6;
10173 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
10174 	} else {
10175 		*sin = sin_null;
10176 		sin->sin_family = AF_INET;
10177 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
10178 	}
10179 	return (0);
10180 }
10181 
10182 /*
10183  * Check which flags will change by the given flags being set
10184  * silently ignore flags which userland is not allowed to control.
10185  * (Because these flags may change between SIOCGLIFFLAGS and
10186  * SIOCSLIFFLAGS, and that's outside of userland's control,
10187  * we need to silently ignore them rather than fail.)
10188  */
10189 static void
ip_sioctl_flags_onoff(ipif_t * ipif,uint64_t flags,uint64_t * onp,uint64_t * offp)10190 ip_sioctl_flags_onoff(ipif_t *ipif, uint64_t flags, uint64_t *onp,
10191     uint64_t *offp)
10192 {
10193 	ill_t		*ill = ipif->ipif_ill;
10194 	phyint_t	*phyi = ill->ill_phyint;
10195 	uint64_t	cantchange_flags, intf_flags;
10196 	uint64_t	turn_on, turn_off;
10197 
10198 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10199 	cantchange_flags = IFF_CANTCHANGE;
10200 	if (IS_IPMP(ill))
10201 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
10202 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
10203 	turn_off = intf_flags & turn_on;
10204 	turn_on ^= turn_off;
10205 	*onp = turn_on;
10206 	*offp = turn_off;
10207 }
10208 
10209 /*
10210  * Set interface flags.  Many flags require special handling (e.g.,
10211  * bringing the interface down); see below for details.
10212  *
10213  * NOTE : We really don't enforce that ipif_id zero should be used
10214  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
10215  *	  is because applications generally does SICGLIFFLAGS and
10216  *	  ORs in the new flags (that affects the logical) and does a
10217  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
10218  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
10219  *	  flags that will be turned on is correct with respect to
10220  *	  ipif_id 0. For backward compatibility reasons, it is not done.
10221  */
10222 /* ARGSUSED */
10223 int
ip_sioctl_flags(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10224 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10225     ip_ioctl_cmd_t *ipip, void *if_req)
10226 {
10227 	uint64_t turn_on;
10228 	uint64_t turn_off;
10229 	int	err = 0;
10230 	phyint_t *phyi;
10231 	ill_t *ill;
10232 	conn_t *connp;
10233 	uint64_t intf_flags;
10234 	boolean_t phyint_flags_modified = B_FALSE;
10235 	uint64_t flags;
10236 	struct ifreq *ifr;
10237 	struct lifreq *lifr;
10238 	boolean_t set_linklocal = B_FALSE;
10239 
10240 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
10241 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10242 
10243 	ASSERT(IAM_WRITER_IPIF(ipif));
10244 
10245 	ill = ipif->ipif_ill;
10246 	phyi = ill->ill_phyint;
10247 
10248 	if (ipip->ipi_cmd_type == IF_CMD) {
10249 		ifr = (struct ifreq *)if_req;
10250 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
10251 	} else {
10252 		lifr = (struct lifreq *)if_req;
10253 		flags = lifr->lifr_flags;
10254 	}
10255 
10256 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10257 
10258 	/*
10259 	 * Have the flags been set correctly until now?
10260 	 */
10261 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10262 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10263 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10264 	/*
10265 	 * Compare the new flags to the old, and partition
10266 	 * into those coming on and those going off.
10267 	 * For the 16 bit command keep the bits above bit 16 unchanged.
10268 	 */
10269 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
10270 		flags |= intf_flags & ~0xFFFF;
10271 
10272 	/*
10273 	 * Explicitly fail attempts to change flags that are always invalid on
10274 	 * an IPMP meta-interface.
10275 	 */
10276 	if (IS_IPMP(ill) && ((flags ^ intf_flags) & IFF_IPMP_INVALID))
10277 		return (EINVAL);
10278 
10279 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10280 	if ((turn_on|turn_off) == 0)
10281 		return (0);	/* No change */
10282 
10283 	/*
10284 	 * All test addresses must be IFF_DEPRECATED (to ensure source address
10285 	 * selection avoids them) -- so force IFF_DEPRECATED on, and do not
10286 	 * allow it to be turned off.
10287 	 */
10288 	if ((turn_off & (IFF_DEPRECATED|IFF_NOFAILOVER)) == IFF_DEPRECATED &&
10289 	    (turn_on|intf_flags) & IFF_NOFAILOVER)
10290 		return (EINVAL);
10291 
10292 	if ((connp = Q_TO_CONN(q)) == NULL)
10293 		return (EINVAL);
10294 
10295 	/*
10296 	 * Only vrrp control socket is allowed to change IFF_UP and
10297 	 * IFF_NOACCEPT flags when IFF_VRRP is set.
10298 	 */
10299 	if ((intf_flags & IFF_VRRP) && ((turn_off | turn_on) & IFF_UP)) {
10300 		if (!connp->conn_isvrrp)
10301 			return (EINVAL);
10302 	}
10303 
10304 	/*
10305 	 * The IFF_NOACCEPT flag can only be set on an IFF_VRRP IP address by
10306 	 * VRRP control socket.
10307 	 */
10308 	if ((turn_off | turn_on) & IFF_NOACCEPT) {
10309 		if (!connp->conn_isvrrp || !(intf_flags & IFF_VRRP))
10310 			return (EINVAL);
10311 	}
10312 
10313 	if (turn_on & IFF_NOFAILOVER) {
10314 		turn_on |= IFF_DEPRECATED;
10315 		flags |= IFF_DEPRECATED;
10316 	}
10317 
10318 	/*
10319 	 * On underlying interfaces, only allow applications to manage test
10320 	 * addresses -- otherwise, they may get confused when the address
10321 	 * moves as part of being brought up.  Likewise, prevent an
10322 	 * application-managed test address from being converted to a data
10323 	 * address.  To prevent migration of administratively up addresses in
10324 	 * the kernel, we don't allow them to be converted either.
10325 	 */
10326 	if (IS_UNDER_IPMP(ill)) {
10327 		const uint64_t appflags = IFF_DHCPRUNNING | IFF_ADDRCONF;
10328 
10329 		if ((turn_on & appflags) && !(flags & IFF_NOFAILOVER))
10330 			return (EINVAL);
10331 
10332 		if ((turn_off & IFF_NOFAILOVER) &&
10333 		    (flags & (appflags | IFF_UP | IFF_DUPLICATE)))
10334 			return (EINVAL);
10335 	}
10336 
10337 	/*
10338 	 * Only allow IFF_TEMPORARY flag to be set on
10339 	 * IPv6 interfaces.
10340 	 */
10341 	if ((turn_on & IFF_TEMPORARY) && !(ipif->ipif_isv6))
10342 		return (EINVAL);
10343 
10344 	/*
10345 	 * cannot turn off IFF_NOXMIT on  VNI interfaces.
10346 	 */
10347 	if ((turn_off & IFF_NOXMIT) && IS_VNI(ipif->ipif_ill))
10348 		return (EINVAL);
10349 
10350 	/*
10351 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
10352 	 * interfaces.  It makes no sense in that context.
10353 	 */
10354 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
10355 		return (EINVAL);
10356 
10357 	/*
10358 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
10359 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
10360 	 * If the link local address isn't set, and can be set, it will get
10361 	 * set later on in this function.
10362 	 */
10363 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
10364 	    (flags & IFF_UP) && !(flags & (IFF_NOLOCAL|IFF_ANYCAST)) &&
10365 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
10366 		if (ipif_cant_setlinklocal(ipif))
10367 			return (EINVAL);
10368 		set_linklocal = B_TRUE;
10369 	}
10370 
10371 	/*
10372 	 * If we modify physical interface flags, we'll potentially need to
10373 	 * send up two routing socket messages for the changes (one for the
10374 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
10375 	 */
10376 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10377 		phyint_flags_modified = B_TRUE;
10378 
10379 	/*
10380 	 * All functioning PHYI_STANDBY interfaces start life PHYI_INACTIVE
10381 	 * (otherwise, we'd immediately use them, defeating standby).  Also,
10382 	 * since PHYI_INACTIVE has a separate meaning when PHYI_STANDBY is not
10383 	 * set, don't allow PHYI_STANDBY to be set if PHYI_INACTIVE is already
10384 	 * set, and clear PHYI_INACTIVE if PHYI_STANDBY is being cleared.  We
10385 	 * also don't allow PHYI_STANDBY if VNI is enabled since its semantics
10386 	 * will not be honored.
10387 	 */
10388 	if (turn_on & PHYI_STANDBY) {
10389 		/*
10390 		 * No need to grab ill_g_usesrc_lock here; see the
10391 		 * synchronization notes in ip.c.
10392 		 */
10393 		if (ill->ill_usesrc_grp_next != NULL ||
10394 		    intf_flags & PHYI_INACTIVE)
10395 			return (EINVAL);
10396 		if (!(flags & PHYI_FAILED)) {
10397 			flags |= PHYI_INACTIVE;
10398 			turn_on |= PHYI_INACTIVE;
10399 		}
10400 	}
10401 
10402 	if (turn_off & PHYI_STANDBY) {
10403 		flags &= ~PHYI_INACTIVE;
10404 		turn_off |= PHYI_INACTIVE;
10405 	}
10406 
10407 	/*
10408 	 * PHYI_FAILED and PHYI_INACTIVE are mutually exclusive; fail if both
10409 	 * would end up on.
10410 	 */
10411 	if ((flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
10412 	    (PHYI_FAILED | PHYI_INACTIVE))
10413 		return (EINVAL);
10414 
10415 	/*
10416 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
10417 	 * status of the interface.
10418 	 */
10419 	if ((turn_on | turn_off) & ILLF_ROUTER) {
10420 		err = ill_forward_set(ill, ((turn_on & ILLF_ROUTER) != 0));
10421 		if (err != 0)
10422 			return (err);
10423 	}
10424 
10425 	/*
10426 	 * If the interface is not UP and we are not going to
10427 	 * bring it UP, record the flags and return. When the
10428 	 * interface comes UP later, the right actions will be
10429 	 * taken.
10430 	 */
10431 	if (!(ipif->ipif_flags & IPIF_UP) &&
10432 	    !(turn_on & IPIF_UP)) {
10433 		/* Record new flags in their respective places. */
10434 		mutex_enter(&ill->ill_lock);
10435 		mutex_enter(&ill->ill_phyint->phyint_lock);
10436 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10437 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10438 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10439 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10440 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10441 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10442 		mutex_exit(&ill->ill_lock);
10443 		mutex_exit(&ill->ill_phyint->phyint_lock);
10444 
10445 		/*
10446 		 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the
10447 		 * same to the kernel: if any of them has been set by
10448 		 * userland, the interface cannot be used for data traffic.
10449 		 */
10450 		if ((turn_on|turn_off) &
10451 		    (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10452 			ASSERT(!IS_IPMP(ill));
10453 			/*
10454 			 * It's possible the ill is part of an "anonymous"
10455 			 * IPMP group rather than a real group.  In that case,
10456 			 * there are no other interfaces in the group and thus
10457 			 * no need to call ipmp_phyint_refresh_active().
10458 			 */
10459 			if (IS_UNDER_IPMP(ill))
10460 				ipmp_phyint_refresh_active(phyi);
10461 		}
10462 
10463 		if (phyint_flags_modified) {
10464 			if (phyi->phyint_illv4 != NULL) {
10465 				ip_rts_ifmsg(phyi->phyint_illv4->
10466 				    ill_ipif, RTSQ_DEFAULT);
10467 			}
10468 			if (phyi->phyint_illv6 != NULL) {
10469 				ip_rts_ifmsg(phyi->phyint_illv6->
10470 				    ill_ipif, RTSQ_DEFAULT);
10471 			}
10472 		}
10473 		/* The default multicast interface might have changed */
10474 		ire_increment_multicast_generation(ill->ill_ipst,
10475 		    ill->ill_isv6);
10476 
10477 		return (0);
10478 	} else if (set_linklocal) {
10479 		mutex_enter(&ill->ill_lock);
10480 		if (set_linklocal)
10481 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
10482 		mutex_exit(&ill->ill_lock);
10483 	}
10484 
10485 	/*
10486 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
10487 	 * or point-to-point interfaces with an unspecified destination. We do
10488 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
10489 	 * have a subnet assigned, which is how in.ndpd currently manages its
10490 	 * onlink prefix list when no addresses are configured with those
10491 	 * prefixes.
10492 	 */
10493 	if (ipif->ipif_isv6 &&
10494 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
10495 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
10496 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
10497 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10498 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
10499 		return (EINVAL);
10500 	}
10501 
10502 	/*
10503 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
10504 	 * from being brought up.
10505 	 */
10506 	if (!ipif->ipif_isv6 &&
10507 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10508 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
10509 		return (EINVAL);
10510 	}
10511 
10512 	/*
10513 	 * If we are going to change one or more of the flags that are
10514 	 * IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL, ILLF_NOARP,
10515 	 * ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, IPIF_PREFERRED, and
10516 	 * IPIF_NOFAILOVER, we will take special action.  This is
10517 	 * done by bring the ipif down, changing the flags and bringing
10518 	 * it back up again.  For IPIF_NOFAILOVER, the act of bringing it
10519 	 * back up will trigger the address to be moved.
10520 	 *
10521 	 * If we are going to change IFF_NOACCEPT, we need to bring
10522 	 * all the ipifs down then bring them up again.	 The act of
10523 	 * bringing all the ipifs back up will trigger the local
10524 	 * ires being recreated with "no_accept" set/cleared.
10525 	 *
10526 	 * Note that ILLF_NOACCEPT is always set separately from the
10527 	 * other flags.
10528 	 */
10529 	if ((turn_on|turn_off) &
10530 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
10531 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED|
10532 	    IPIF_NOFAILOVER)) {
10533 		/*
10534 		 * ipif_down() will ire_delete bcast ire's for the subnet,
10535 		 * while the ire_identical_ref tracks the case of IRE_BROADCAST
10536 		 * entries shared between multiple ipifs on the same subnet.
10537 		 */
10538 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
10539 		    !(turn_off & IPIF_UP)) {
10540 			if (ipif->ipif_flags & IPIF_UP)
10541 				ill->ill_logical_down = 1;
10542 			turn_on &= ~IPIF_UP;
10543 		}
10544 		err = ipif_down(ipif, q, mp);
10545 		ip1dbg(("ipif_down returns %d err ", err));
10546 		if (err == EINPROGRESS)
10547 			return (err);
10548 		(void) ipif_down_tail(ipif);
10549 	} else if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10550 		/*
10551 		 * If we can quiesce the ill, then continue.  If not, then
10552 		 * ip_sioctl_flags_tail() will be called from
10553 		 * ipif_ill_refrele_tail().
10554 		 */
10555 		ill_down_ipifs(ill, B_TRUE);
10556 
10557 		mutex_enter(&connp->conn_lock);
10558 		mutex_enter(&ill->ill_lock);
10559 		if (!ill_is_quiescent(ill)) {
10560 			boolean_t success;
10561 
10562 			success = ipsq_pending_mp_add(connp, ill->ill_ipif,
10563 			    q, mp, ILL_DOWN);
10564 			mutex_exit(&ill->ill_lock);
10565 			mutex_exit(&connp->conn_lock);
10566 			return (success ? EINPROGRESS : EINTR);
10567 		}
10568 		mutex_exit(&ill->ill_lock);
10569 		mutex_exit(&connp->conn_lock);
10570 	}
10571 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10572 }
10573 
10574 static int
ip_sioctl_flags_tail(ipif_t * ipif,uint64_t flags,queue_t * q,mblk_t * mp)10575 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp)
10576 {
10577 	ill_t	*ill;
10578 	phyint_t *phyi;
10579 	uint64_t turn_on, turn_off;
10580 	boolean_t phyint_flags_modified = B_FALSE;
10581 	int	err = 0;
10582 	boolean_t set_linklocal = B_FALSE;
10583 
10584 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
10585 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
10586 
10587 	ASSERT(IAM_WRITER_IPIF(ipif));
10588 
10589 	ill = ipif->ipif_ill;
10590 	phyi = ill->ill_phyint;
10591 
10592 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10593 
10594 	/*
10595 	 * IFF_UP is handled separately.
10596 	 */
10597 	turn_on &= ~IFF_UP;
10598 	turn_off &= ~IFF_UP;
10599 
10600 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10601 		phyint_flags_modified = B_TRUE;
10602 
10603 	/*
10604 	 * Now we change the flags. Track current value of
10605 	 * other flags in their respective places.
10606 	 */
10607 	mutex_enter(&ill->ill_lock);
10608 	mutex_enter(&phyi->phyint_lock);
10609 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10610 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10611 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10612 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10613 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10614 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10615 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
10616 		set_linklocal = B_TRUE;
10617 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
10618 	}
10619 
10620 	mutex_exit(&ill->ill_lock);
10621 	mutex_exit(&phyi->phyint_lock);
10622 
10623 	if (set_linklocal)
10624 		(void) ipif_setlinklocal(ipif);
10625 
10626 	/*
10627 	 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the same to
10628 	 * the kernel: if any of them has been set by userland, the interface
10629 	 * cannot be used for data traffic.
10630 	 */
10631 	if ((turn_on|turn_off) & (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10632 		ASSERT(!IS_IPMP(ill));
10633 		/*
10634 		 * It's possible the ill is part of an "anonymous" IPMP group
10635 		 * rather than a real group.  In that case, there are no other
10636 		 * interfaces in the group and thus no need for us to call
10637 		 * ipmp_phyint_refresh_active().
10638 		 */
10639 		if (IS_UNDER_IPMP(ill))
10640 			ipmp_phyint_refresh_active(phyi);
10641 	}
10642 
10643 	if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10644 		/*
10645 		 * If the ILLF_NOACCEPT flag is changed, bring up all the
10646 		 * ipifs that were brought down.
10647 		 *
10648 		 * The routing sockets messages are sent as the result
10649 		 * of ill_up_ipifs(), further, SCTP's IPIF list was updated
10650 		 * as well.
10651 		 */
10652 		err = ill_up_ipifs(ill, q, mp);
10653 	} else if ((flags & IFF_UP) && !(ipif->ipif_flags & IPIF_UP)) {
10654 		/*
10655 		 * XXX ipif_up really does not know whether a phyint flags
10656 		 * was modified or not. So, it sends up information on
10657 		 * only one routing sockets message. As we don't bring up
10658 		 * the interface and also set PHYI_ flags simultaneously
10659 		 * it should be okay.
10660 		 */
10661 		err = ipif_up(ipif, q, mp);
10662 	} else {
10663 		/*
10664 		 * Make sure routing socket sees all changes to the flags.
10665 		 * ipif_up_done* handles this when we use ipif_up.
10666 		 */
10667 		if (phyint_flags_modified) {
10668 			if (phyi->phyint_illv4 != NULL) {
10669 				ip_rts_ifmsg(phyi->phyint_illv4->
10670 				    ill_ipif, RTSQ_DEFAULT);
10671 			}
10672 			if (phyi->phyint_illv6 != NULL) {
10673 				ip_rts_ifmsg(phyi->phyint_illv6->
10674 				    ill_ipif, RTSQ_DEFAULT);
10675 			}
10676 		} else {
10677 			ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
10678 		}
10679 		/*
10680 		 * Update the flags in SCTP's IPIF list, ipif_up() will do
10681 		 * this in need_up case.
10682 		 */
10683 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10684 	}
10685 
10686 	/* The default multicast interface might have changed */
10687 	ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
10688 	return (err);
10689 }
10690 
10691 /*
10692  * Restart the flags operation now that the refcounts have dropped to zero.
10693  */
10694 /* ARGSUSED */
10695 int
ip_sioctl_flags_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10696 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10697     ip_ioctl_cmd_t *ipip, void *if_req)
10698 {
10699 	uint64_t flags;
10700 	struct ifreq *ifr = if_req;
10701 	struct lifreq *lifr = if_req;
10702 	uint64_t turn_on, turn_off;
10703 
10704 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
10705 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10706 
10707 	if (ipip->ipi_cmd_type == IF_CMD) {
10708 		/* cast to uint16_t prevents unwanted sign extension */
10709 		flags = (uint16_t)ifr->ifr_flags;
10710 	} else {
10711 		flags = lifr->lifr_flags;
10712 	}
10713 
10714 	/*
10715 	 * If this function call is a result of the ILLF_NOACCEPT flag
10716 	 * change, do not call ipif_down_tail(). See ip_sioctl_flags().
10717 	 */
10718 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10719 	if (!((turn_on|turn_off) & ILLF_NOACCEPT))
10720 		(void) ipif_down_tail(ipif);
10721 
10722 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10723 }
10724 
10725 /*
10726  * Can operate on either a module or a driver queue.
10727  */
10728 /* ARGSUSED */
10729 int
ip_sioctl_get_flags(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10730 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10731     ip_ioctl_cmd_t *ipip, void *if_req)
10732 {
10733 	/*
10734 	 * Has the flags been set correctly till now ?
10735 	 */
10736 	ill_t *ill = ipif->ipif_ill;
10737 	phyint_t *phyi = ill->ill_phyint;
10738 
10739 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
10740 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10741 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10742 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10743 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10744 
10745 	/*
10746 	 * Need a lock since some flags can be set even when there are
10747 	 * references to the ipif.
10748 	 */
10749 	mutex_enter(&ill->ill_lock);
10750 	if (ipip->ipi_cmd_type == IF_CMD) {
10751 		struct ifreq *ifr = (struct ifreq *)if_req;
10752 
10753 		/* Get interface flags (low 16 only). */
10754 		ifr->ifr_flags = ((ipif->ipif_flags |
10755 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
10756 	} else {
10757 		struct lifreq *lifr = (struct lifreq *)if_req;
10758 
10759 		/* Get interface flags. */
10760 		lifr->lifr_flags = ipif->ipif_flags |
10761 		    ill->ill_flags | phyi->phyint_flags;
10762 	}
10763 	mutex_exit(&ill->ill_lock);
10764 	return (0);
10765 }
10766 
10767 /*
10768  * We allow the MTU to be set on an ILL, but not have it be different
10769  * for different IPIFs since we don't actually send packets on IPIFs.
10770  */
10771 /* ARGSUSED */
10772 int
ip_sioctl_mtu(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10773 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10774     ip_ioctl_cmd_t *ipip, void *if_req)
10775 {
10776 	int mtu;
10777 	int ip_min_mtu;
10778 	struct ifreq	*ifr;
10779 	struct lifreq *lifr;
10780 	ill_t	*ill;
10781 
10782 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
10783 	    ipif->ipif_id, (void *)ipif));
10784 	if (ipip->ipi_cmd_type == IF_CMD) {
10785 		ifr = (struct ifreq *)if_req;
10786 		mtu = ifr->ifr_metric;
10787 	} else {
10788 		lifr = (struct lifreq *)if_req;
10789 		mtu = lifr->lifr_mtu;
10790 	}
10791 	/* Only allow for logical unit zero i.e. not on "bge0:17" */
10792 	if (ipif->ipif_id != 0)
10793 		return (EINVAL);
10794 
10795 	ill = ipif->ipif_ill;
10796 	if (ipif->ipif_isv6)
10797 		ip_min_mtu = IPV6_MIN_MTU;
10798 	else
10799 		ip_min_mtu = IP_MIN_MTU;
10800 
10801 	mutex_enter(&ill->ill_lock);
10802 	if (mtu > ill->ill_max_frag || mtu < ip_min_mtu) {
10803 		mutex_exit(&ill->ill_lock);
10804 		return (EINVAL);
10805 	}
10806 	/* Avoid increasing ill_mc_mtu */
10807 	if (ill->ill_mc_mtu > mtu)
10808 		ill->ill_mc_mtu = mtu;
10809 
10810 	/*
10811 	 * The dce and fragmentation code can handle changes to ill_mtu
10812 	 * concurrent with sending/fragmenting packets.
10813 	 */
10814 	ill->ill_mtu = mtu;
10815 	ill->ill_flags |= ILLF_FIXEDMTU;
10816 	mutex_exit(&ill->ill_lock);
10817 
10818 	/*
10819 	 * Make sure all dce_generation checks find out
10820 	 * that ill_mtu/ill_mc_mtu has changed.
10821 	 */
10822 	dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
10823 
10824 	/*
10825 	 * Refresh IPMP meta-interface MTU if necessary.
10826 	 */
10827 	if (IS_UNDER_IPMP(ill))
10828 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
10829 
10830 	/* Update the MTU in SCTP's list */
10831 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10832 	return (0);
10833 }
10834 
10835 /* Get interface MTU. */
10836 /* ARGSUSED */
10837 int
ip_sioctl_get_mtu(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10838 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10839     ip_ioctl_cmd_t *ipip, void *if_req)
10840 {
10841 	struct ifreq	*ifr;
10842 	struct lifreq	*lifr;
10843 
10844 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
10845 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10846 
10847 	/*
10848 	 * We allow a get on any logical interface even though the set
10849 	 * can only be done on logical unit 0.
10850 	 */
10851 	if (ipip->ipi_cmd_type == IF_CMD) {
10852 		ifr = (struct ifreq *)if_req;
10853 		ifr->ifr_metric = ipif->ipif_ill->ill_mtu;
10854 	} else {
10855 		lifr = (struct lifreq *)if_req;
10856 		lifr->lifr_mtu = ipif->ipif_ill->ill_mtu;
10857 	}
10858 	return (0);
10859 }
10860 
10861 /* Set interface broadcast address. */
10862 /* ARGSUSED2 */
10863 int
ip_sioctl_brdaddr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10864 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10865     ip_ioctl_cmd_t *ipip, void *if_req)
10866 {
10867 	ipaddr_t addr;
10868 	ire_t	*ire;
10869 	ill_t		*ill = ipif->ipif_ill;
10870 	ip_stack_t	*ipst = ill->ill_ipst;
10871 
10872 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ill->ill_name,
10873 	    ipif->ipif_id));
10874 
10875 	ASSERT(IAM_WRITER_IPIF(ipif));
10876 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
10877 		return (EADDRNOTAVAIL);
10878 
10879 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
10880 
10881 	if (sin->sin_family != AF_INET)
10882 		return (EAFNOSUPPORT);
10883 
10884 	addr = sin->sin_addr.s_addr;
10885 
10886 	if (ipif->ipif_flags & IPIF_UP) {
10887 		/*
10888 		 * If we are already up, make sure the new
10889 		 * broadcast address makes sense.  If it does,
10890 		 * there should be an IRE for it already.
10891 		 */
10892 		ire = ire_ftable_lookup_v4(addr, 0, 0, IRE_BROADCAST,
10893 		    ill, ipif->ipif_zoneid, NULL,
10894 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE), 0, ipst, NULL);
10895 		if (ire == NULL) {
10896 			return (EINVAL);
10897 		} else {
10898 			ire_refrele(ire);
10899 		}
10900 	}
10901 	/*
10902 	 * Changing the broadcast addr for this ipif. Since the IRE_BROADCAST
10903 	 * needs to already exist we never need to change the set of
10904 	 * IRE_BROADCASTs when we are UP.
10905 	 */
10906 	if (addr != ipif->ipif_brd_addr)
10907 		IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
10908 
10909 	return (0);
10910 }
10911 
10912 /* Get interface broadcast address. */
10913 /* ARGSUSED */
10914 int
ip_sioctl_get_brdaddr(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10915 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10916     ip_ioctl_cmd_t *ipip, void *if_req)
10917 {
10918 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
10919 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10920 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
10921 		return (EADDRNOTAVAIL);
10922 
10923 	/* IPIF_BROADCAST not possible with IPv6 */
10924 	ASSERT(!ipif->ipif_isv6);
10925 	*sin = sin_null;
10926 	sin->sin_family = AF_INET;
10927 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
10928 	return (0);
10929 }
10930 
10931 /*
10932  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
10933  */
10934 /* ARGSUSED */
10935 int
ip_sioctl_netmask(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)10936 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10937     ip_ioctl_cmd_t *ipip, void *if_req)
10938 {
10939 	int err = 0;
10940 	in6_addr_t v6mask;
10941 
10942 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
10943 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10944 
10945 	ASSERT(IAM_WRITER_IPIF(ipif));
10946 
10947 	if (ipif->ipif_isv6) {
10948 		sin6_t *sin6;
10949 
10950 		if (sin->sin_family != AF_INET6)
10951 			return (EAFNOSUPPORT);
10952 
10953 		sin6 = (sin6_t *)sin;
10954 		v6mask = sin6->sin6_addr;
10955 	} else {
10956 		ipaddr_t mask;
10957 
10958 		if (sin->sin_family != AF_INET)
10959 			return (EAFNOSUPPORT);
10960 
10961 		mask = sin->sin_addr.s_addr;
10962 		if (!ip_contiguous_mask(ntohl(mask)))
10963 			return (ENOTSUP);
10964 		V4MASK_TO_V6(mask, v6mask);
10965 	}
10966 
10967 	/*
10968 	 * No big deal if the interface isn't already up, or the mask
10969 	 * isn't really changing, or this is pt-pt.
10970 	 */
10971 	if (!(ipif->ipif_flags & IPIF_UP) ||
10972 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
10973 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
10974 		ipif->ipif_v6net_mask = v6mask;
10975 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10976 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
10977 			    ipif->ipif_v6net_mask,
10978 			    ipif->ipif_v6subnet);
10979 		}
10980 		return (0);
10981 	}
10982 	/*
10983 	 * Make sure we have valid net and subnet broadcast ire's
10984 	 * for the old netmask, if needed by other logical interfaces.
10985 	 */
10986 	err = ipif_logical_down(ipif, q, mp);
10987 	if (err == EINPROGRESS)
10988 		return (err);
10989 	(void) ipif_down_tail(ipif);
10990 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
10991 	return (err);
10992 }
10993 
10994 static int
ip_sioctl_netmask_tail(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp)10995 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
10996 {
10997 	in6_addr_t v6mask;
10998 	int err = 0;
10999 
11000 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
11001 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11002 
11003 	if (ipif->ipif_isv6) {
11004 		sin6_t *sin6;
11005 
11006 		sin6 = (sin6_t *)sin;
11007 		v6mask = sin6->sin6_addr;
11008 	} else {
11009 		ipaddr_t mask;
11010 
11011 		mask = sin->sin_addr.s_addr;
11012 		V4MASK_TO_V6(mask, v6mask);
11013 	}
11014 
11015 	ipif->ipif_v6net_mask = v6mask;
11016 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11017 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
11018 		    ipif->ipif_v6subnet);
11019 	}
11020 	err = ipif_up(ipif, q, mp);
11021 
11022 	if (err == 0 || err == EINPROGRESS) {
11023 		/*
11024 		 * The interface must be DL_BOUND if this packet has to
11025 		 * go out on the wire. Since we only go through a logical
11026 		 * down and are bound with the driver during an internal
11027 		 * down/up that is satisfied.
11028 		 */
11029 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
11030 			/* Potentially broadcast an address mask reply. */
11031 			ipif_mask_reply(ipif);
11032 		}
11033 	}
11034 	return (err);
11035 }
11036 
11037 /* ARGSUSED */
11038 int
ip_sioctl_netmask_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11039 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11040     ip_ioctl_cmd_t *ipip, void *if_req)
11041 {
11042 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
11043 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11044 	(void) ipif_down_tail(ipif);
11045 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
11046 }
11047 
11048 /* Get interface net mask. */
11049 /* ARGSUSED */
11050 int
ip_sioctl_get_netmask(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11051 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11052     ip_ioctl_cmd_t *ipip, void *if_req)
11053 {
11054 	struct lifreq *lifr = (struct lifreq *)if_req;
11055 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
11056 
11057 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
11058 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11059 
11060 	/*
11061 	 * net mask can't change since we have a reference to the ipif.
11062 	 */
11063 	if (ipif->ipif_isv6) {
11064 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11065 		*sin6 = sin6_null;
11066 		sin6->sin6_family = AF_INET6;
11067 		sin6->sin6_addr = ipif->ipif_v6net_mask;
11068 		lifr->lifr_addrlen =
11069 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11070 	} else {
11071 		*sin = sin_null;
11072 		sin->sin_family = AF_INET;
11073 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
11074 		if (ipip->ipi_cmd_type == LIF_CMD) {
11075 			lifr->lifr_addrlen =
11076 			    ip_mask_to_plen(ipif->ipif_net_mask);
11077 		}
11078 	}
11079 	return (0);
11080 }
11081 
11082 /* ARGSUSED */
11083 int
ip_sioctl_metric(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11084 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11085     ip_ioctl_cmd_t *ipip, void *if_req)
11086 {
11087 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
11088 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11089 
11090 	/*
11091 	 * Since no applications should ever be setting metrics on underlying
11092 	 * interfaces, we explicitly fail to smoke 'em out.
11093 	 */
11094 	if (IS_UNDER_IPMP(ipif->ipif_ill))
11095 		return (EINVAL);
11096 
11097 	/*
11098 	 * Set interface metric.  We don't use this for
11099 	 * anything but we keep track of it in case it is
11100 	 * important to routing applications or such.
11101 	 */
11102 	if (ipip->ipi_cmd_type == IF_CMD) {
11103 		struct ifreq    *ifr;
11104 
11105 		ifr = (struct ifreq *)if_req;
11106 		ipif->ipif_ill->ill_metric = ifr->ifr_metric;
11107 	} else {
11108 		struct lifreq   *lifr;
11109 
11110 		lifr = (struct lifreq *)if_req;
11111 		ipif->ipif_ill->ill_metric = lifr->lifr_metric;
11112 	}
11113 	return (0);
11114 }
11115 
11116 /* ARGSUSED */
11117 int
ip_sioctl_get_metric(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11118 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11119     ip_ioctl_cmd_t *ipip, void *if_req)
11120 {
11121 	/* Get interface metric. */
11122 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
11123 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11124 
11125 	if (ipip->ipi_cmd_type == IF_CMD) {
11126 		struct ifreq    *ifr;
11127 
11128 		ifr = (struct ifreq *)if_req;
11129 		ifr->ifr_metric = ipif->ipif_ill->ill_metric;
11130 	} else {
11131 		struct lifreq   *lifr;
11132 
11133 		lifr = (struct lifreq *)if_req;
11134 		lifr->lifr_metric = ipif->ipif_ill->ill_metric;
11135 	}
11136 
11137 	return (0);
11138 }
11139 
11140 /* ARGSUSED */
11141 int
ip_sioctl_muxid(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11142 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11143     ip_ioctl_cmd_t *ipip, void *if_req)
11144 {
11145 	int	arp_muxid;
11146 
11147 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
11148 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11149 	/*
11150 	 * Set the muxid returned from I_PLINK.
11151 	 */
11152 	if (ipip->ipi_cmd_type == IF_CMD) {
11153 		struct ifreq *ifr = (struct ifreq *)if_req;
11154 
11155 		ipif->ipif_ill->ill_muxid = ifr->ifr_ip_muxid;
11156 		arp_muxid = ifr->ifr_arp_muxid;
11157 	} else {
11158 		struct lifreq *lifr = (struct lifreq *)if_req;
11159 
11160 		ipif->ipif_ill->ill_muxid = lifr->lifr_ip_muxid;
11161 		arp_muxid = lifr->lifr_arp_muxid;
11162 	}
11163 	arl_set_muxid(ipif->ipif_ill, arp_muxid);
11164 	return (0);
11165 }
11166 
11167 /* ARGSUSED */
11168 int
ip_sioctl_get_muxid(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11169 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11170     ip_ioctl_cmd_t *ipip, void *if_req)
11171 {
11172 	int	arp_muxid = 0;
11173 
11174 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
11175 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11176 	/*
11177 	 * Get the muxid saved in ill for I_PUNLINK.
11178 	 */
11179 	arp_muxid = arl_get_muxid(ipif->ipif_ill);
11180 	if (ipip->ipi_cmd_type == IF_CMD) {
11181 		struct ifreq *ifr = (struct ifreq *)if_req;
11182 
11183 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11184 		ifr->ifr_arp_muxid = arp_muxid;
11185 	} else {
11186 		struct lifreq *lifr = (struct lifreq *)if_req;
11187 
11188 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11189 		lifr->lifr_arp_muxid = arp_muxid;
11190 	}
11191 	return (0);
11192 }
11193 
11194 /*
11195  * Set the subnet prefix. Does not modify the broadcast address.
11196  */
11197 /* ARGSUSED */
11198 int
ip_sioctl_subnet(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11199 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11200     ip_ioctl_cmd_t *ipip, void *if_req)
11201 {
11202 	int err = 0;
11203 	in6_addr_t v6addr;
11204 	in6_addr_t v6mask;
11205 	boolean_t need_up = B_FALSE;
11206 	int addrlen;
11207 
11208 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
11209 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11210 
11211 	ASSERT(IAM_WRITER_IPIF(ipif));
11212 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
11213 
11214 	if (ipif->ipif_isv6) {
11215 		sin6_t *sin6;
11216 
11217 		if (sin->sin_family != AF_INET6)
11218 			return (EAFNOSUPPORT);
11219 
11220 		sin6 = (sin6_t *)sin;
11221 		v6addr = sin6->sin6_addr;
11222 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
11223 			return (EADDRNOTAVAIL);
11224 	} else {
11225 		ipaddr_t addr;
11226 
11227 		if (sin->sin_family != AF_INET)
11228 			return (EAFNOSUPPORT);
11229 
11230 		addr = sin->sin_addr.s_addr;
11231 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
11232 			return (EADDRNOTAVAIL);
11233 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11234 		/* Add 96 bits */
11235 		addrlen += IPV6_ABITS - IP_ABITS;
11236 	}
11237 
11238 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
11239 		return (EINVAL);
11240 
11241 	/* Check if bits in the address is set past the mask */
11242 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
11243 		return (EINVAL);
11244 
11245 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
11246 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
11247 		return (0);	/* No change */
11248 
11249 	if (ipif->ipif_flags & IPIF_UP) {
11250 		/*
11251 		 * If the interface is already marked up,
11252 		 * we call ipif_down which will take care
11253 		 * of ditching any IREs that have been set
11254 		 * up based on the old interface address.
11255 		 */
11256 		err = ipif_logical_down(ipif, q, mp);
11257 		if (err == EINPROGRESS)
11258 			return (err);
11259 		(void) ipif_down_tail(ipif);
11260 		need_up = B_TRUE;
11261 	}
11262 
11263 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
11264 	return (err);
11265 }
11266 
11267 static int
ip_sioctl_subnet_tail(ipif_t * ipif,in6_addr_t v6addr,in6_addr_t v6mask,queue_t * q,mblk_t * mp,boolean_t need_up)11268 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
11269     queue_t *q, mblk_t *mp, boolean_t need_up)
11270 {
11271 	ill_t	*ill = ipif->ipif_ill;
11272 	int	err = 0;
11273 
11274 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
11275 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11276 
11277 	/* Set the new address. */
11278 	mutex_enter(&ill->ill_lock);
11279 	ipif->ipif_v6net_mask = v6mask;
11280 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11281 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
11282 		    ipif->ipif_v6subnet);
11283 	}
11284 	mutex_exit(&ill->ill_lock);
11285 
11286 	if (need_up) {
11287 		/*
11288 		 * Now bring the interface back up.  If this
11289 		 * is the only IPIF for the ILL, ipif_up
11290 		 * will have to re-bind to the device, so
11291 		 * we may get back EINPROGRESS, in which
11292 		 * case, this IOCTL will get completed in
11293 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11294 		 */
11295 		err = ipif_up(ipif, q, mp);
11296 		if (err == EINPROGRESS)
11297 			return (err);
11298 	}
11299 	return (err);
11300 }
11301 
11302 /* ARGSUSED */
11303 int
ip_sioctl_subnet_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11304 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11305     ip_ioctl_cmd_t *ipip, void *if_req)
11306 {
11307 	int	addrlen;
11308 	in6_addr_t v6addr;
11309 	in6_addr_t v6mask;
11310 	struct lifreq *lifr = (struct lifreq *)if_req;
11311 
11312 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
11313 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11314 	(void) ipif_down_tail(ipif);
11315 
11316 	addrlen = lifr->lifr_addrlen;
11317 	if (ipif->ipif_isv6) {
11318 		sin6_t *sin6;
11319 
11320 		sin6 = (sin6_t *)sin;
11321 		v6addr = sin6->sin6_addr;
11322 	} else {
11323 		ipaddr_t addr;
11324 
11325 		addr = sin->sin_addr.s_addr;
11326 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11327 		addrlen += IPV6_ABITS - IP_ABITS;
11328 	}
11329 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
11330 
11331 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
11332 }
11333 
11334 /* ARGSUSED */
11335 int
ip_sioctl_get_subnet(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)11336 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11337     ip_ioctl_cmd_t *ipip, void *if_req)
11338 {
11339 	struct lifreq *lifr = (struct lifreq *)if_req;
11340 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
11341 
11342 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
11343 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11344 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11345 
11346 	if (ipif->ipif_isv6) {
11347 		*sin6 = sin6_null;
11348 		sin6->sin6_family = AF_INET6;
11349 		sin6->sin6_addr = ipif->ipif_v6subnet;
11350 		lifr->lifr_addrlen =
11351 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11352 	} else {
11353 		*sin = sin_null;
11354 		sin->sin_family = AF_INET;
11355 		sin->sin_addr.s_addr = ipif->ipif_subnet;
11356 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
11357 	}
11358 	return (0);
11359 }
11360 
11361 /*
11362  * Set the IPv6 address token.
11363  */
11364 /* ARGSUSED */
11365 int
ip_sioctl_token(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipi,void * if_req)11366 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11367     ip_ioctl_cmd_t *ipi, void *if_req)
11368 {
11369 	ill_t *ill = ipif->ipif_ill;
11370 	int err;
11371 	in6_addr_t v6addr;
11372 	in6_addr_t v6mask;
11373 	boolean_t need_up = B_FALSE;
11374 	int i;
11375 	sin6_t *sin6 = (sin6_t *)sin;
11376 	struct lifreq *lifr = (struct lifreq *)if_req;
11377 	int addrlen;
11378 
11379 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
11380 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11381 	ASSERT(IAM_WRITER_IPIF(ipif));
11382 
11383 	addrlen = lifr->lifr_addrlen;
11384 	/* Only allow for logical unit zero i.e. not on "le0:17" */
11385 	if (ipif->ipif_id != 0)
11386 		return (EINVAL);
11387 
11388 	if (!ipif->ipif_isv6)
11389 		return (EINVAL);
11390 
11391 	if (addrlen > IPV6_ABITS)
11392 		return (EINVAL);
11393 
11394 	v6addr = sin6->sin6_addr;
11395 
11396 	/*
11397 	 * The length of the token is the length from the end.  To get
11398 	 * the proper mask for this, compute the mask of the bits not
11399 	 * in the token; ie. the prefix, and then xor to get the mask.
11400 	 */
11401 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
11402 		return (EINVAL);
11403 	for (i = 0; i < 4; i++) {
11404 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11405 	}
11406 
11407 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
11408 	    ill->ill_token_length == addrlen)
11409 		return (0);	/* No change */
11410 
11411 	if (ipif->ipif_flags & IPIF_UP) {
11412 		err = ipif_logical_down(ipif, q, mp);
11413 		if (err == EINPROGRESS)
11414 			return (err);
11415 		(void) ipif_down_tail(ipif);
11416 		need_up = B_TRUE;
11417 	}
11418 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
11419 	return (err);
11420 }
11421 
11422 static int
ip_sioctl_token_tail(ipif_t * ipif,sin6_t * sin6,int addrlen,queue_t * q,mblk_t * mp,boolean_t need_up)11423 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
11424     mblk_t *mp, boolean_t need_up)
11425 {
11426 	in6_addr_t v6addr;
11427 	in6_addr_t v6mask;
11428 	ill_t	*ill = ipif->ipif_ill;
11429 	int	i;
11430 	int	err = 0;
11431 
11432 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
11433 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11434 	v6addr = sin6->sin6_addr;
11435 	/*
11436 	 * The length of the token is the length from the end.  To get
11437 	 * the proper mask for this, compute the mask of the bits not
11438 	 * in the token; ie. the prefix, and then xor to get the mask.
11439 	 */
11440 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
11441 	for (i = 0; i < 4; i++)
11442 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11443 
11444 	mutex_enter(&ill->ill_lock);
11445 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
11446 	ill->ill_token_length = addrlen;
11447 	ill->ill_manual_token = 1;
11448 
11449 	/* Reconfigure the link-local address based on this new token */
11450 	ipif_setlinklocal(ill->ill_ipif);
11451 
11452 	mutex_exit(&ill->ill_lock);
11453 
11454 	if (need_up) {
11455 		/*
11456 		 * Now bring the interface back up.  If this
11457 		 * is the only IPIF for the ILL, ipif_up
11458 		 * will have to re-bind to the device, so
11459 		 * we may get back EINPROGRESS, in which
11460 		 * case, this IOCTL will get completed in
11461 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11462 		 */
11463 		err = ipif_up(ipif, q, mp);
11464 		if (err == EINPROGRESS)
11465 			return (err);
11466 	}
11467 	return (err);
11468 }
11469 
11470 /* ARGSUSED */
11471 int
ip_sioctl_get_token(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipi,void * if_req)11472 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11473     ip_ioctl_cmd_t *ipi, void *if_req)
11474 {
11475 	ill_t *ill;
11476 	sin6_t *sin6 = (sin6_t *)sin;
11477 	struct lifreq *lifr = (struct lifreq *)if_req;
11478 
11479 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
11480 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11481 	if (ipif->ipif_id != 0)
11482 		return (EINVAL);
11483 
11484 	ill = ipif->ipif_ill;
11485 	if (!ill->ill_isv6)
11486 		return (ENXIO);
11487 
11488 	*sin6 = sin6_null;
11489 	sin6->sin6_family = AF_INET6;
11490 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
11491 	sin6->sin6_addr = ill->ill_token;
11492 	lifr->lifr_addrlen = ill->ill_token_length;
11493 	return (0);
11494 }
11495 
11496 /*
11497  * Set (hardware) link specific information that might override
11498  * what was acquired through the DL_INFO_ACK.
11499  */
11500 /* ARGSUSED */
11501 int
ip_sioctl_lnkinfo(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipi,void * if_req)11502 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11503     ip_ioctl_cmd_t *ipi, void *if_req)
11504 {
11505 	ill_t		*ill = ipif->ipif_ill;
11506 	int		ip_min_mtu;
11507 	struct lifreq	*lifr = (struct lifreq *)if_req;
11508 	lif_ifinfo_req_t *lir;
11509 
11510 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
11511 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11512 	lir = &lifr->lifr_ifinfo;
11513 	ASSERT(IAM_WRITER_IPIF(ipif));
11514 
11515 	/* Only allow for logical unit zero i.e. not on "bge0:17" */
11516 	if (ipif->ipif_id != 0)
11517 		return (EINVAL);
11518 
11519 	/* Set interface MTU. */
11520 	if (ipif->ipif_isv6)
11521 		ip_min_mtu = IPV6_MIN_MTU;
11522 	else
11523 		ip_min_mtu = IP_MIN_MTU;
11524 
11525 	/*
11526 	 * Verify values before we set anything. Allow zero to
11527 	 * mean unspecified.
11528 	 *
11529 	 * XXX We should be able to set the user-defined lir_mtu to some value
11530 	 * that is greater than ill_current_frag but less than ill_max_frag- the
11531 	 * ill_max_frag value tells us the max MTU that can be handled by the
11532 	 * datalink, whereas the ill_current_frag is dynamically computed for
11533 	 * some link-types like tunnels, based on the tunnel PMTU. However,
11534 	 * since there is currently no way of distinguishing between
11535 	 * administratively fixed link mtu values (e.g., those set via
11536 	 * /sbin/dladm) and dynamically discovered MTUs (e.g., those discovered
11537 	 * for tunnels) we conservatively choose the  ill_current_frag as the
11538 	 * upper-bound.
11539 	 */
11540 	if (lir->lir_maxmtu != 0 &&
11541 	    (lir->lir_maxmtu > ill->ill_current_frag ||
11542 	    lir->lir_maxmtu < ip_min_mtu))
11543 		return (EINVAL);
11544 	if (lir->lir_reachtime != 0 &&
11545 	    lir->lir_reachtime > ND_MAX_REACHTIME)
11546 		return (EINVAL);
11547 	if (lir->lir_reachretrans != 0 &&
11548 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
11549 		return (EINVAL);
11550 
11551 	mutex_enter(&ill->ill_lock);
11552 	/*
11553 	 * The dce and fragmentation code can handle changes to ill_mtu
11554 	 * concurrent with sending/fragmenting packets.
11555 	 */
11556 	if (lir->lir_maxmtu != 0)
11557 		ill->ill_user_mtu = lir->lir_maxmtu;
11558 
11559 	if (lir->lir_reachtime != 0)
11560 		ill->ill_reachable_time = lir->lir_reachtime;
11561 
11562 	if (lir->lir_reachretrans != 0)
11563 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
11564 
11565 	ill->ill_max_hops = lir->lir_maxhops;
11566 	ill->ill_max_buf = ND_MAX_Q;
11567 	if (!(ill->ill_flags & ILLF_FIXEDMTU) && ill->ill_user_mtu != 0) {
11568 		/*
11569 		 * ill_mtu is the actual interface MTU, obtained as the min
11570 		 * of user-configured mtu and the value announced by the
11571 		 * driver (via DL_NOTE_SDU_SIZE/DL_INFO_ACK). Note that since
11572 		 * we have already made the choice of requiring
11573 		 * ill_user_mtu < ill_current_frag by the time we get here,
11574 		 * the ill_mtu effectively gets assigned to the ill_user_mtu
11575 		 * here.
11576 		 */
11577 		ill->ill_mtu = MIN(ill->ill_current_frag, ill->ill_user_mtu);
11578 		ill->ill_mc_mtu = MIN(ill->ill_mc_mtu, ill->ill_user_mtu);
11579 	}
11580 	mutex_exit(&ill->ill_lock);
11581 
11582 	/*
11583 	 * Make sure all dce_generation checks find out
11584 	 * that ill_mtu/ill_mc_mtu has changed.
11585 	 */
11586 	if (!(ill->ill_flags & ILLF_FIXEDMTU) && (lir->lir_maxmtu != 0))
11587 		dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
11588 
11589 	/*
11590 	 * Refresh IPMP meta-interface MTU if necessary.
11591 	 */
11592 	if (IS_UNDER_IPMP(ill))
11593 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
11594 
11595 	return (0);
11596 }
11597 
11598 /* ARGSUSED */
11599 int
ip_sioctl_get_lnkinfo(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipi,void * if_req)11600 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11601     ip_ioctl_cmd_t *ipi, void *if_req)
11602 {
11603 	struct lif_ifinfo_req *lir;
11604 	ill_t *ill = ipif->ipif_ill;
11605 
11606 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
11607 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11608 	if (ipif->ipif_id != 0)
11609 		return (EINVAL);
11610 
11611 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
11612 	lir->lir_maxhops = ill->ill_max_hops;
11613 	lir->lir_reachtime = ill->ill_reachable_time;
11614 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
11615 	lir->lir_maxmtu = ill->ill_mtu;
11616 
11617 	return (0);
11618 }
11619 
11620 /*
11621  * Return best guess as to the subnet mask for the specified address.
11622  * Based on the subnet masks for all the configured interfaces.
11623  *
11624  * We end up returning a zero mask in the case of default, multicast or
11625  * experimental.
11626  */
11627 static ipaddr_t
ip_subnet_mask(ipaddr_t addr,ipif_t ** ipifp,ip_stack_t * ipst)11628 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp, ip_stack_t *ipst)
11629 {
11630 	ipaddr_t net_mask;
11631 	ill_t	*ill;
11632 	ipif_t	*ipif;
11633 	ill_walk_context_t ctx;
11634 	ipif_t	*fallback_ipif = NULL;
11635 
11636 	net_mask = ip_net_mask(addr);
11637 	if (net_mask == 0) {
11638 		*ipifp = NULL;
11639 		return (0);
11640 	}
11641 
11642 	/* Let's check to see if this is maybe a local subnet route. */
11643 	/* this function only applies to IPv4 interfaces */
11644 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
11645 	ill = ILL_START_WALK_V4(&ctx, ipst);
11646 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
11647 		mutex_enter(&ill->ill_lock);
11648 		for (ipif = ill->ill_ipif; ipif != NULL;
11649 		    ipif = ipif->ipif_next) {
11650 			if (IPIF_IS_CONDEMNED(ipif))
11651 				continue;
11652 			if (!(ipif->ipif_flags & IPIF_UP))
11653 				continue;
11654 			if ((ipif->ipif_subnet & net_mask) ==
11655 			    (addr & net_mask)) {
11656 				/*
11657 				 * Don't trust pt-pt interfaces if there are
11658 				 * other interfaces.
11659 				 */
11660 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
11661 					if (fallback_ipif == NULL) {
11662 						ipif_refhold_locked(ipif);
11663 						fallback_ipif = ipif;
11664 					}
11665 					continue;
11666 				}
11667 
11668 				/*
11669 				 * Fine. Just assume the same net mask as the
11670 				 * directly attached subnet interface is using.
11671 				 */
11672 				ipif_refhold_locked(ipif);
11673 				mutex_exit(&ill->ill_lock);
11674 				rw_exit(&ipst->ips_ill_g_lock);
11675 				if (fallback_ipif != NULL)
11676 					ipif_refrele(fallback_ipif);
11677 				*ipifp = ipif;
11678 				return (ipif->ipif_net_mask);
11679 			}
11680 		}
11681 		mutex_exit(&ill->ill_lock);
11682 	}
11683 	rw_exit(&ipst->ips_ill_g_lock);
11684 
11685 	*ipifp = fallback_ipif;
11686 	return ((fallback_ipif != NULL) ?
11687 	    fallback_ipif->ipif_net_mask : net_mask);
11688 }
11689 
11690 /*
11691  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
11692  */
11693 static void
ip_wput_ioctl(queue_t * q,mblk_t * mp)11694 ip_wput_ioctl(queue_t *q, mblk_t *mp)
11695 {
11696 	IOCP	iocp;
11697 	ipft_t	*ipft;
11698 	ipllc_t	*ipllc;
11699 	mblk_t	*mp1;
11700 	cred_t	*cr;
11701 	int	error = 0;
11702 	conn_t	*connp;
11703 
11704 	ip1dbg(("ip_wput_ioctl"));
11705 	iocp = (IOCP)mp->b_rptr;
11706 	mp1 = mp->b_cont;
11707 	if (mp1 == NULL) {
11708 		iocp->ioc_error = EINVAL;
11709 		mp->b_datap->db_type = M_IOCNAK;
11710 		iocp->ioc_count = 0;
11711 		qreply(q, mp);
11712 		return;
11713 	}
11714 
11715 	/*
11716 	 * These IOCTLs provide various control capabilities to
11717 	 * upstream agents such as ULPs and processes.	There
11718 	 * are currently two such IOCTLs implemented.  They
11719 	 * are used by TCP to provide update information for
11720 	 * existing IREs and to forcibly delete an IRE for a
11721 	 * host that is not responding, thereby forcing an
11722 	 * attempt at a new route.
11723 	 */
11724 	iocp->ioc_error = EINVAL;
11725 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
11726 		goto done;
11727 
11728 	ipllc = (ipllc_t *)mp1->b_rptr;
11729 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
11730 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
11731 			break;
11732 	}
11733 	/*
11734 	 * prefer credential from mblk over ioctl;
11735 	 * see ip_sioctl_copyin_setup
11736 	 */
11737 	cr = msg_getcred(mp, NULL);
11738 	if (cr == NULL)
11739 		cr = iocp->ioc_cr;
11740 
11741 	/*
11742 	 * Refhold the conn in case the request gets queued up in some lookup
11743 	 */
11744 	ASSERT(CONN_Q(q));
11745 	connp = Q_TO_CONN(q);
11746 	CONN_INC_REF(connp);
11747 	CONN_INC_IOCTLREF(connp);
11748 	if (ipft->ipft_pfi &&
11749 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
11750 	    pullupmsg(mp1, ipft->ipft_min_size))) {
11751 		error = (*ipft->ipft_pfi)(q,
11752 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
11753 	}
11754 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
11755 		/*
11756 		 * CONN_OPER_PENDING_DONE happens in the function called
11757 		 * through ipft_pfi above.
11758 		 */
11759 		return;
11760 	}
11761 
11762 	CONN_DEC_IOCTLREF(connp);
11763 	CONN_OPER_PENDING_DONE(connp);
11764 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
11765 		freemsg(mp);
11766 		return;
11767 	}
11768 	iocp->ioc_error = error;
11769 
11770 done:
11771 	mp->b_datap->db_type = M_IOCACK;
11772 	if (iocp->ioc_error)
11773 		iocp->ioc_count = 0;
11774 	qreply(q, mp);
11775 }
11776 
11777 /*
11778  * Assign a unique id for the ipif. This is used by sctp_addr.c
11779  * Note: remove if sctp_addr.c is redone to not shadow ill/ipif data structures.
11780  */
11781 static void
ipif_assign_seqid(ipif_t * ipif)11782 ipif_assign_seqid(ipif_t *ipif)
11783 {
11784 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
11785 
11786 	ipif->ipif_seqid = atomic_inc_64_nv(&ipst->ips_ipif_g_seqid);
11787 }
11788 
11789 /*
11790  * Clone the contents of `sipif' to `dipif'.  Requires that both ipifs are
11791  * administratively down (i.e., no DAD), of the same type, and locked.  Note
11792  * that the clone is complete -- including the seqid -- and the expectation is
11793  * that the caller will either free or overwrite `sipif' before it's unlocked.
11794  */
11795 static void
ipif_clone(const ipif_t * sipif,ipif_t * dipif)11796 ipif_clone(const ipif_t *sipif, ipif_t *dipif)
11797 {
11798 	ASSERT(MUTEX_HELD(&sipif->ipif_ill->ill_lock));
11799 	ASSERT(MUTEX_HELD(&dipif->ipif_ill->ill_lock));
11800 	ASSERT(!(sipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11801 	ASSERT(!(dipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11802 	ASSERT(sipif->ipif_ire_type == dipif->ipif_ire_type);
11803 
11804 	dipif->ipif_flags = sipif->ipif_flags;
11805 	dipif->ipif_zoneid = sipif->ipif_zoneid;
11806 	dipif->ipif_v6subnet = sipif->ipif_v6subnet;
11807 	dipif->ipif_v6lcl_addr = sipif->ipif_v6lcl_addr;
11808 	dipif->ipif_v6net_mask = sipif->ipif_v6net_mask;
11809 	dipif->ipif_v6brd_addr = sipif->ipif_v6brd_addr;
11810 	dipif->ipif_v6pp_dst_addr = sipif->ipif_v6pp_dst_addr;
11811 
11812 	/*
11813 	 * As per the comment atop the function, we assume that these sipif
11814 	 * fields will be changed before sipif is unlocked.
11815 	 */
11816 	dipif->ipif_seqid = sipif->ipif_seqid;
11817 	dipif->ipif_state_flags = sipif->ipif_state_flags;
11818 }
11819 
11820 /*
11821  * Transfer the contents of `sipif' to `dipif', and then free (if `virgipif'
11822  * is NULL) or overwrite `sipif' with `virgipif', which must be a virgin
11823  * (unreferenced) ipif.  Also, if `sipif' is used by the current xop, then
11824  * transfer the xop to `dipif'.  Requires that all ipifs are administratively
11825  * down (i.e., no DAD), of the same type, and unlocked.
11826  */
11827 static void
ipif_transfer(ipif_t * sipif,ipif_t * dipif,ipif_t * virgipif)11828 ipif_transfer(ipif_t *sipif, ipif_t *dipif, ipif_t *virgipif)
11829 {
11830 	ipsq_t *ipsq = sipif->ipif_ill->ill_phyint->phyint_ipsq;
11831 	ipxop_t *ipx = ipsq->ipsq_xop;
11832 
11833 	ASSERT(sipif != dipif);
11834 	ASSERT(sipif != virgipif);
11835 
11836 	/*
11837 	 * Grab all of the locks that protect the ipif in a defined order.
11838 	 */
11839 	GRAB_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11840 
11841 	ipif_clone(sipif, dipif);
11842 	if (virgipif != NULL) {
11843 		ipif_clone(virgipif, sipif);
11844 		mi_free(virgipif);
11845 	}
11846 
11847 	RELEASE_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11848 
11849 	/*
11850 	 * Transfer ownership of the current xop, if necessary.
11851 	 */
11852 	if (ipx->ipx_current_ipif == sipif) {
11853 		ASSERT(ipx->ipx_pending_ipif == NULL);
11854 		mutex_enter(&ipx->ipx_lock);
11855 		ipx->ipx_current_ipif = dipif;
11856 		mutex_exit(&ipx->ipx_lock);
11857 	}
11858 
11859 	if (virgipif == NULL)
11860 		mi_free(sipif);
11861 }
11862 
11863 /*
11864  * checks if:
11865  *	- <ill_name>:<ipif_id> is at most LIFNAMSIZ - 1 and
11866  *	- logical interface is within the allowed range
11867  */
11868 static int
is_lifname_valid(ill_t * ill,unsigned int ipif_id)11869 is_lifname_valid(ill_t *ill, unsigned int ipif_id)
11870 {
11871 	if (snprintf(NULL, 0, "%s:%d", ill->ill_name, ipif_id) >= LIFNAMSIZ)
11872 		return (ENAMETOOLONG);
11873 
11874 	if (ipif_id >= ill->ill_ipst->ips_ip_addrs_per_if)
11875 		return (ERANGE);
11876 	return (0);
11877 }
11878 
11879 /*
11880  * Insert the ipif, so that the list of ipifs on the ill will be sorted
11881  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
11882  * be inserted into the first space available in the list. The value of
11883  * ipif_id will then be set to the appropriate value for its position.
11884  */
11885 static int
ipif_insert(ipif_t * ipif,boolean_t acquire_g_lock)11886 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock)
11887 {
11888 	ill_t *ill;
11889 	ipif_t *tipif;
11890 	ipif_t **tipifp;
11891 	int id, err;
11892 	ip_stack_t	*ipst;
11893 
11894 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
11895 	    IAM_WRITER_IPIF(ipif));
11896 
11897 	ill = ipif->ipif_ill;
11898 	ASSERT(ill != NULL);
11899 	ipst = ill->ill_ipst;
11900 
11901 	/*
11902 	 * In the case of lo0:0 we already hold the ill_g_lock.
11903 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
11904 	 * ipif_insert.
11905 	 */
11906 	if (acquire_g_lock)
11907 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
11908 	mutex_enter(&ill->ill_lock);
11909 	id = ipif->ipif_id;
11910 	tipifp = &(ill->ill_ipif);
11911 	if (id == -1) {	/* need to find a real id */
11912 		id = 0;
11913 		while ((tipif = *tipifp) != NULL) {
11914 			ASSERT(tipif->ipif_id >= id);
11915 			if (tipif->ipif_id != id)
11916 				break; /* non-consecutive id */
11917 			id++;
11918 			tipifp = &(tipif->ipif_next);
11919 		}
11920 		if ((err = is_lifname_valid(ill, id)) != 0) {
11921 			mutex_exit(&ill->ill_lock);
11922 			if (acquire_g_lock)
11923 				rw_exit(&ipst->ips_ill_g_lock);
11924 			return (err);
11925 		}
11926 		ipif->ipif_id = id; /* assign new id */
11927 	} else if ((err = is_lifname_valid(ill, id)) == 0) {
11928 		/* we have a real id; insert ipif in the right place */
11929 		while ((tipif = *tipifp) != NULL) {
11930 			ASSERT(tipif->ipif_id != id);
11931 			if (tipif->ipif_id > id)
11932 				break; /* found correct location */
11933 			tipifp = &(tipif->ipif_next);
11934 		}
11935 	} else {
11936 		mutex_exit(&ill->ill_lock);
11937 		if (acquire_g_lock)
11938 			rw_exit(&ipst->ips_ill_g_lock);
11939 		return (err);
11940 	}
11941 
11942 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
11943 
11944 	ipif->ipif_next = tipif;
11945 	*tipifp = ipif;
11946 	mutex_exit(&ill->ill_lock);
11947 	if (acquire_g_lock)
11948 		rw_exit(&ipst->ips_ill_g_lock);
11949 
11950 	return (0);
11951 }
11952 
11953 static void
ipif_remove(ipif_t * ipif)11954 ipif_remove(ipif_t *ipif)
11955 {
11956 	ipif_t	**ipifp;
11957 	ill_t	*ill = ipif->ipif_ill;
11958 
11959 	ASSERT(RW_WRITE_HELD(&ill->ill_ipst->ips_ill_g_lock));
11960 
11961 	mutex_enter(&ill->ill_lock);
11962 	ipifp = &ill->ill_ipif;
11963 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
11964 		if (*ipifp == ipif) {
11965 			*ipifp = ipif->ipif_next;
11966 			break;
11967 		}
11968 	}
11969 	mutex_exit(&ill->ill_lock);
11970 }
11971 
11972 /*
11973  * Allocate and initialize a new interface control structure.  (Always
11974  * called as writer.)
11975  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
11976  * is not part of the global linked list of ills. ipif_seqid is unique
11977  * in the system and to preserve the uniqueness, it is assigned only
11978  * when ill becomes part of the global list. At that point ill will
11979  * have a name. If it doesn't get assigned here, it will get assigned
11980  * in ipif_set_values() as part of SIOCSLIFNAME processing.
11981  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
11982  * the interface flags or any other information from the DL_INFO_ACK for
11983  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
11984  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
11985  * second DL_INFO_ACK comes in from the driver.
11986  */
11987 static ipif_t *
ipif_allocate(ill_t * ill,int id,uint_t ire_type,boolean_t initialize,boolean_t insert,int * errorp)11988 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize,
11989     boolean_t insert, int *errorp)
11990 {
11991 	int err;
11992 	ipif_t	*ipif;
11993 	ip_stack_t *ipst = ill->ill_ipst;
11994 
11995 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
11996 	    ill->ill_name, id, (void *)ill));
11997 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
11998 
11999 	if (errorp != NULL)
12000 		*errorp = 0;
12001 
12002 	if ((ipif = mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL) {
12003 		if (errorp != NULL)
12004 			*errorp = ENOMEM;
12005 		return (NULL);
12006 	}
12007 	*ipif = ipif_zero;	/* start clean */
12008 
12009 	ipif->ipif_ill = ill;
12010 	ipif->ipif_id = id;	/* could be -1 */
12011 	/*
12012 	 * Inherit the zoneid from the ill; for the shared stack instance
12013 	 * this is always the global zone
12014 	 */
12015 	ipif->ipif_zoneid = ill->ill_zoneid;
12016 
12017 	ipif->ipif_refcnt = 0;
12018 
12019 	if (insert) {
12020 		if ((err = ipif_insert(ipif, ire_type != IRE_LOOPBACK)) != 0) {
12021 			mi_free(ipif);
12022 			if (errorp != NULL)
12023 				*errorp = err;
12024 			return (NULL);
12025 		}
12026 		/* -1 id should have been replaced by real id */
12027 		id = ipif->ipif_id;
12028 		ASSERT(id >= 0);
12029 	}
12030 
12031 	if (ill->ill_name[0] != '\0')
12032 		ipif_assign_seqid(ipif);
12033 
12034 	/*
12035 	 * If this is the zeroth ipif on the IPMP ill, create the illgrp
12036 	 * (which must not exist yet because the zeroth ipif is created once
12037 	 * per ill).  However, do not not link it to the ipmp_grp_t until
12038 	 * I_PLINK is called; see ip_sioctl_plink_ipmp() for details.
12039 	 */
12040 	if (id == 0 && IS_IPMP(ill)) {
12041 		if (ipmp_illgrp_create(ill) == NULL) {
12042 			if (insert) {
12043 				rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
12044 				ipif_remove(ipif);
12045 				rw_exit(&ipst->ips_ill_g_lock);
12046 			}
12047 			mi_free(ipif);
12048 			if (errorp != NULL)
12049 				*errorp = ENOMEM;
12050 			return (NULL);
12051 		}
12052 	}
12053 
12054 	/*
12055 	 * We grab ill_lock to protect the flag changes.  The ipif is still
12056 	 * not up and can't be looked up until the ioctl completes and the
12057 	 * IPIF_CHANGING flag is cleared.
12058 	 */
12059 	mutex_enter(&ill->ill_lock);
12060 
12061 	ipif->ipif_ire_type = ire_type;
12062 
12063 	if (ipif->ipif_isv6) {
12064 		ill->ill_flags |= ILLF_IPV6;
12065 	} else {
12066 		ipaddr_t inaddr_any = INADDR_ANY;
12067 
12068 		ill->ill_flags |= ILLF_IPV4;
12069 
12070 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
12071 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12072 		    &ipif->ipif_v6lcl_addr);
12073 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12074 		    &ipif->ipif_v6subnet);
12075 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12076 		    &ipif->ipif_v6net_mask);
12077 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12078 		    &ipif->ipif_v6brd_addr);
12079 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12080 		    &ipif->ipif_v6pp_dst_addr);
12081 	}
12082 
12083 	/*
12084 	 * Don't set the interface flags etc. now, will do it in
12085 	 * ip_ll_subnet_defaults.
12086 	 */
12087 	if (!initialize)
12088 		goto out;
12089 
12090 	/*
12091 	 * NOTE: The IPMP meta-interface is special-cased because it starts
12092 	 * with no underlying interfaces (and thus an unknown broadcast
12093 	 * address length), but all interfaces that can be placed into an IPMP
12094 	 * group are required to be broadcast-capable.
12095 	 */
12096 	if (ill->ill_bcast_addr_length != 0 || IS_IPMP(ill)) {
12097 		/*
12098 		 * Later detect lack of DLPI driver multicast capability by
12099 		 * catching DL_ENABMULTI_REQ errors in ip_rput_dlpi().
12100 		 */
12101 		ill->ill_flags |= ILLF_MULTICAST;
12102 		if (!ipif->ipif_isv6)
12103 			ipif->ipif_flags |= IPIF_BROADCAST;
12104 	} else {
12105 		if (ill->ill_net_type != IRE_LOOPBACK) {
12106 			if (ipif->ipif_isv6)
12107 				/*
12108 				 * Note: xresolv interfaces will eventually need
12109 				 * NOARP set here as well, but that will require
12110 				 * those external resolvers to have some
12111 				 * knowledge of that flag and act appropriately.
12112 				 * Not to be changed at present.
12113 				 */
12114 				ill->ill_flags |= ILLF_NONUD;
12115 			else
12116 				ill->ill_flags |= ILLF_NOARP;
12117 		}
12118 		if (ill->ill_phys_addr_length == 0) {
12119 			if (IS_VNI(ill)) {
12120 				ipif->ipif_flags |= IPIF_NOXMIT;
12121 			} else {
12122 				/* pt-pt supports multicast. */
12123 				ill->ill_flags |= ILLF_MULTICAST;
12124 				if (ill->ill_net_type != IRE_LOOPBACK)
12125 					ipif->ipif_flags |= IPIF_POINTOPOINT;
12126 			}
12127 		}
12128 	}
12129 out:
12130 	mutex_exit(&ill->ill_lock);
12131 	return (ipif);
12132 }
12133 
12134 /*
12135  * Remove the neighbor cache entries associated with this logical
12136  * interface.
12137  */
12138 int
ipif_arp_down(ipif_t * ipif)12139 ipif_arp_down(ipif_t *ipif)
12140 {
12141 	ill_t	*ill = ipif->ipif_ill;
12142 	int	err = 0;
12143 
12144 	ip1dbg(("ipif_arp_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
12145 	ASSERT(IAM_WRITER_IPIF(ipif));
12146 
12147 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_down",
12148 	    ill_t *, ill, ipif_t *, ipif);
12149 	ipif_nce_down(ipif);
12150 
12151 	/*
12152 	 * If this is the last ipif that is going down and there are no
12153 	 * duplicate addresses we may yet attempt to re-probe, then we need to
12154 	 * clean up ARP completely.
12155 	 */
12156 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
12157 	    !ill->ill_logical_down && ill->ill_net_type == IRE_IF_RESOLVER) {
12158 		/*
12159 		 * If this was the last ipif on an IPMP interface, purge any
12160 		 * static ARP entries associated with it.
12161 		 */
12162 		if (IS_IPMP(ill))
12163 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
12164 
12165 		/* UNBIND, DETACH */
12166 		err = arp_ll_down(ill);
12167 	}
12168 
12169 	return (err);
12170 }
12171 
12172 /*
12173  * Get the resolver set up for a new IP address.  (Always called as writer.)
12174  * Called both for IPv4 and IPv6 interfaces, though it only does some
12175  * basic DAD related initialization for IPv6. Honors ILLF_NOARP.
12176  *
12177  * The enumerated value res_act tunes the behavior:
12178  *	* Res_act_initial: set up all the resolver structures for a new
12179  *	  IP address.
12180  *	* Res_act_defend: tell ARP that it needs to send a single gratuitous
12181  *	  ARP message in defense of the address.
12182  *	* Res_act_rebind: tell ARP to change the hardware address for an IP
12183  *	  address (and issue gratuitous ARPs).  Used by ipmp_ill_bind_ipif().
12184  *
12185  * Returns zero on success, or an errno upon failure.
12186  */
12187 int
ipif_resolver_up(ipif_t * ipif,enum ip_resolver_action res_act)12188 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
12189 {
12190 	ill_t		*ill = ipif->ipif_ill;
12191 	int		err;
12192 	boolean_t	was_dup;
12193 
12194 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
12195 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
12196 	ASSERT(IAM_WRITER_IPIF(ipif));
12197 
12198 	was_dup = B_FALSE;
12199 	if (res_act == Res_act_initial) {
12200 		ipif->ipif_addr_ready = 0;
12201 		/*
12202 		 * We're bringing an interface up here.  There's no way that we
12203 		 * should need to shut down ARP now.
12204 		 */
12205 		mutex_enter(&ill->ill_lock);
12206 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
12207 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
12208 			ill->ill_ipif_dup_count--;
12209 			was_dup = B_TRUE;
12210 		}
12211 		mutex_exit(&ill->ill_lock);
12212 	}
12213 	if (ipif->ipif_recovery_id != 0)
12214 		(void) untimeout(ipif->ipif_recovery_id);
12215 	ipif->ipif_recovery_id = 0;
12216 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
12217 		ipif->ipif_addr_ready = 1;
12218 		return (0);
12219 	}
12220 	/* NDP will set the ipif_addr_ready flag when it's ready */
12221 	if (ill->ill_isv6)
12222 		return (0);
12223 
12224 	err = ipif_arp_up(ipif, res_act, was_dup);
12225 	return (err);
12226 }
12227 
12228 /*
12229  * This routine restarts IPv4/IPv6 duplicate address detection (DAD)
12230  * when a link has just gone back up.
12231  */
12232 static void
ipif_nce_start_dad(ipif_t * ipif)12233 ipif_nce_start_dad(ipif_t *ipif)
12234 {
12235 	ncec_t *ncec;
12236 	ill_t *ill = ipif->ipif_ill;
12237 	boolean_t isv6 = ill->ill_isv6;
12238 
12239 	if (isv6) {
12240 		ncec = ncec_lookup_illgrp_v6(ipif->ipif_ill,
12241 		    &ipif->ipif_v6lcl_addr);
12242 	} else {
12243 		ipaddr_t v4addr;
12244 
12245 		if (ill->ill_net_type != IRE_IF_RESOLVER ||
12246 		    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
12247 		    ipif->ipif_lcl_addr == INADDR_ANY) {
12248 			/*
12249 			 * If we can't contact ARP for some reason,
12250 			 * that's not really a problem.  Just send
12251 			 * out the routing socket notification that
12252 			 * DAD completion would have done, and continue.
12253 			 */
12254 			ipif_mask_reply(ipif);
12255 			ipif_up_notify(ipif);
12256 			ipif->ipif_addr_ready = 1;
12257 			return;
12258 		}
12259 
12260 		IN6_V4MAPPED_TO_IPADDR(&ipif->ipif_v6lcl_addr, v4addr);
12261 		ncec = ncec_lookup_illgrp_v4(ipif->ipif_ill, &v4addr);
12262 	}
12263 
12264 	if (ncec == NULL) {
12265 		ip1dbg(("couldn't find ncec for ipif %p leaving !ready\n",
12266 		    (void *)ipif));
12267 		return;
12268 	}
12269 	if (!nce_restart_dad(ncec)) {
12270 		/*
12271 		 * If we can't restart DAD for some reason, that's not really a
12272 		 * problem.  Just send out the routing socket notification that
12273 		 * DAD completion would have done, and continue.
12274 		 */
12275 		ipif_up_notify(ipif);
12276 		ipif->ipif_addr_ready = 1;
12277 	}
12278 	ncec_refrele(ncec);
12279 }
12280 
12281 /*
12282  * Restart duplicate address detection on all interfaces on the given ill.
12283  *
12284  * This is called when an interface transitions from down to up
12285  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
12286  *
12287  * Note that since the underlying physical link has transitioned, we must cause
12288  * at least one routing socket message to be sent here, either via DAD
12289  * completion or just by default on the first ipif.  (If we don't do this, then
12290  * in.mpathd will see long delays when doing link-based failure recovery.)
12291  */
12292 void
ill_restart_dad(ill_t * ill,boolean_t went_up)12293 ill_restart_dad(ill_t *ill, boolean_t went_up)
12294 {
12295 	ipif_t *ipif;
12296 
12297 	if (ill == NULL)
12298 		return;
12299 
12300 	/*
12301 	 * If layer two doesn't support duplicate address detection, then just
12302 	 * send the routing socket message now and be done with it.
12303 	 */
12304 	if (!ill->ill_isv6 && arp_no_defense) {
12305 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12306 		return;
12307 	}
12308 
12309 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12310 		if (went_up) {
12311 
12312 			if (ipif->ipif_flags & IPIF_UP) {
12313 				ipif_nce_start_dad(ipif);
12314 			} else if (ipif->ipif_flags & IPIF_DUPLICATE) {
12315 				/*
12316 				 * kick off the bring-up process now.
12317 				 */
12318 				ipif_do_recovery(ipif);
12319 			} else {
12320 				/*
12321 				 * Unfortunately, the first ipif is "special"
12322 				 * and represents the underlying ill in the
12323 				 * routing socket messages.  Thus, when this
12324 				 * one ipif is down, we must still notify so
12325 				 * that the user knows the IFF_RUNNING status
12326 				 * change.  (If the first ipif is up, then
12327 				 * we'll handle eventual routing socket
12328 				 * notification via DAD completion.)
12329 				 */
12330 				if (ipif == ill->ill_ipif) {
12331 					ip_rts_ifmsg(ill->ill_ipif,
12332 					    RTSQ_DEFAULT);
12333 				}
12334 			}
12335 		} else {
12336 			/*
12337 			 * After link down, we'll need to send a new routing
12338 			 * message when the link comes back, so clear
12339 			 * ipif_addr_ready.
12340 			 */
12341 			ipif->ipif_addr_ready = 0;
12342 		}
12343 	}
12344 
12345 	/*
12346 	 * If we've torn down links, then notify the user right away.
12347 	 */
12348 	if (!went_up)
12349 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12350 }
12351 
12352 static void
ipsq_delete(ipsq_t * ipsq)12353 ipsq_delete(ipsq_t *ipsq)
12354 {
12355 	ipxop_t *ipx = ipsq->ipsq_xop;
12356 
12357 	ipsq->ipsq_ipst = NULL;
12358 	ASSERT(ipsq->ipsq_phyint == NULL);
12359 	ASSERT(ipsq->ipsq_xop != NULL);
12360 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipx->ipx_mphead == NULL);
12361 	ASSERT(ipx->ipx_pending_mp == NULL);
12362 	kmem_free(ipsq, sizeof (ipsq_t));
12363 }
12364 
12365 static int
ill_up_ipifs_on_ill(ill_t * ill,queue_t * q,mblk_t * mp)12366 ill_up_ipifs_on_ill(ill_t *ill, queue_t *q, mblk_t *mp)
12367 {
12368 	int err = 0;
12369 	ipif_t *ipif;
12370 
12371 	if (ill == NULL)
12372 		return (0);
12373 
12374 	ASSERT(IAM_WRITER_ILL(ill));
12375 	ill->ill_up_ipifs = B_TRUE;
12376 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12377 		if (ipif->ipif_was_up) {
12378 			if (!(ipif->ipif_flags & IPIF_UP))
12379 				err = ipif_up(ipif, q, mp);
12380 			ipif->ipif_was_up = B_FALSE;
12381 			if (err != 0) {
12382 				ASSERT(err == EINPROGRESS);
12383 				return (err);
12384 			}
12385 		}
12386 	}
12387 	ill->ill_up_ipifs = B_FALSE;
12388 	return (0);
12389 }
12390 
12391 /*
12392  * This function is called to bring up all the ipifs that were up before
12393  * bringing the ill down via ill_down_ipifs().
12394  */
12395 int
ill_up_ipifs(ill_t * ill,queue_t * q,mblk_t * mp)12396 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
12397 {
12398 	int err;
12399 
12400 	ASSERT(IAM_WRITER_ILL(ill));
12401 
12402 	if (ill->ill_replumbing) {
12403 		ill->ill_replumbing = 0;
12404 		/*
12405 		 * Send down REPLUMB_DONE notification followed by the
12406 		 * BIND_REQ on the arp stream.
12407 		 */
12408 		if (!ill->ill_isv6)
12409 			arp_send_replumb_conf(ill);
12410 	}
12411 	err = ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv4, q, mp);
12412 	if (err != 0)
12413 		return (err);
12414 
12415 	return (ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv6, q, mp));
12416 }
12417 
12418 /*
12419  * Bring down any IPIF_UP ipifs on ill. If "logical" is B_TRUE, we bring
12420  * down the ipifs without sending DL_UNBIND_REQ to the driver.
12421  */
12422 static void
ill_down_ipifs(ill_t * ill,boolean_t logical)12423 ill_down_ipifs(ill_t *ill, boolean_t logical)
12424 {
12425 	ipif_t *ipif;
12426 
12427 	ASSERT(IAM_WRITER_ILL(ill));
12428 
12429 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12430 		/*
12431 		 * We go through the ipif_down logic even if the ipif
12432 		 * is already down, since routes can be added based
12433 		 * on down ipifs. Going through ipif_down once again
12434 		 * will delete any IREs created based on these routes.
12435 		 */
12436 		if (ipif->ipif_flags & IPIF_UP)
12437 			ipif->ipif_was_up = B_TRUE;
12438 
12439 		if (logical) {
12440 			(void) ipif_logical_down(ipif, NULL, NULL);
12441 			ipif_non_duplicate(ipif);
12442 			(void) ipif_down_tail(ipif);
12443 		} else {
12444 			(void) ipif_down(ipif, NULL, NULL);
12445 		}
12446 	}
12447 }
12448 
12449 /*
12450  * Redo source address selection.  This makes IXAF_VERIFY_SOURCE take
12451  * a look again at valid source addresses.
12452  * This should be called each time after the set of source addresses has been
12453  * changed.
12454  */
12455 void
ip_update_source_selection(ip_stack_t * ipst)12456 ip_update_source_selection(ip_stack_t *ipst)
12457 {
12458 	/* We skip past SRC_GENERATION_VERIFY */
12459 	if (atomic_inc_32_nv(&ipst->ips_src_generation) ==
12460 	    SRC_GENERATION_VERIFY)
12461 		atomic_inc_32(&ipst->ips_src_generation);
12462 }
12463 
12464 /*
12465  * Finish the group join started in ip_sioctl_groupname().
12466  */
12467 /* ARGSUSED */
12468 static void
ip_join_illgrps(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * dummy)12469 ip_join_illgrps(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
12470 {
12471 	ill_t		*ill = q->q_ptr;
12472 	phyint_t	*phyi = ill->ill_phyint;
12473 	ipmp_grp_t	*grp = phyi->phyint_grp;
12474 	ip_stack_t	*ipst = ill->ill_ipst;
12475 
12476 	/* IS_UNDER_IPMP() won't work until ipmp_ill_join_illgrp() is called */
12477 	ASSERT(!IS_IPMP(ill) && grp != NULL);
12478 	ASSERT(IAM_WRITER_IPSQ(ipsq));
12479 
12480 	if (phyi->phyint_illv4 != NULL) {
12481 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12482 		VERIFY(grp->gr_pendv4-- > 0);
12483 		rw_exit(&ipst->ips_ipmp_lock);
12484 		ipmp_ill_join_illgrp(phyi->phyint_illv4, grp->gr_v4);
12485 	}
12486 	if (phyi->phyint_illv6 != NULL) {
12487 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12488 		VERIFY(grp->gr_pendv6-- > 0);
12489 		rw_exit(&ipst->ips_ipmp_lock);
12490 		ipmp_ill_join_illgrp(phyi->phyint_illv6, grp->gr_v6);
12491 	}
12492 	freemsg(mp);
12493 }
12494 
12495 /*
12496  * Process an SIOCSLIFGROUPNAME request.
12497  */
12498 /* ARGSUSED */
12499 int
ip_sioctl_groupname(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)12500 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12501     ip_ioctl_cmd_t *ipip, void *ifreq)
12502 {
12503 	struct lifreq	*lifr = ifreq;
12504 	ill_t		*ill = ipif->ipif_ill;
12505 	ip_stack_t	*ipst = ill->ill_ipst;
12506 	phyint_t	*phyi = ill->ill_phyint;
12507 	ipmp_grp_t	*grp = phyi->phyint_grp;
12508 	mblk_t		*ipsq_mp;
12509 	int		err = 0;
12510 
12511 	/*
12512 	 * Note that phyint_grp can only change here, where we're exclusive.
12513 	 */
12514 	ASSERT(IAM_WRITER_ILL(ill));
12515 
12516 	if (ipif->ipif_id != 0 || ill->ill_usesrc_grp_next != NULL ||
12517 	    (phyi->phyint_flags & PHYI_VIRTUAL))
12518 		return (EINVAL);
12519 
12520 	lifr->lifr_groupname[LIFGRNAMSIZ - 1] = '\0';
12521 
12522 	rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12523 
12524 	/*
12525 	 * If the name hasn't changed, there's nothing to do.
12526 	 */
12527 	if (grp != NULL && strcmp(grp->gr_name, lifr->lifr_groupname) == 0)
12528 		goto unlock;
12529 
12530 	/*
12531 	 * Handle requests to rename an IPMP meta-interface.
12532 	 *
12533 	 * Note that creation of the IPMP meta-interface is handled in
12534 	 * userland through the standard plumbing sequence.  As part of the
12535 	 * plumbing the IPMP meta-interface, its initial groupname is set to
12536 	 * the name of the interface (see ipif_set_values_tail()).
12537 	 */
12538 	if (IS_IPMP(ill)) {
12539 		err = ipmp_grp_rename(grp, lifr->lifr_groupname);
12540 		goto unlock;
12541 	}
12542 
12543 	/*
12544 	 * Handle requests to add or remove an IP interface from a group.
12545 	 */
12546 	if (lifr->lifr_groupname[0] != '\0') {			/* add */
12547 		/*
12548 		 * Moves are handled by first removing the interface from
12549 		 * its existing group, and then adding it to another group.
12550 		 * So, fail if it's already in a group.
12551 		 */
12552 		if (IS_UNDER_IPMP(ill)) {
12553 			err = EALREADY;
12554 			goto unlock;
12555 		}
12556 
12557 		grp = ipmp_grp_lookup(lifr->lifr_groupname, ipst);
12558 		if (grp == NULL) {
12559 			err = ENOENT;
12560 			goto unlock;
12561 		}
12562 
12563 		/*
12564 		 * Check if the phyint and its ills are suitable for
12565 		 * inclusion into the group.
12566 		 */
12567 		if ((err = ipmp_grp_vet_phyint(grp, phyi)) != 0)
12568 			goto unlock;
12569 
12570 		/*
12571 		 * Checks pass; join the group, and enqueue the remaining
12572 		 * illgrp joins for when we've become part of the group xop
12573 		 * and are exclusive across its IPSQs.  Since qwriter_ip()
12574 		 * requires an mblk_t to scribble on, and since `mp' will be
12575 		 * freed as part of completing the ioctl, allocate another.
12576 		 */
12577 		if ((ipsq_mp = allocb(0, BPRI_MED)) == NULL) {
12578 			err = ENOMEM;
12579 			goto unlock;
12580 		}
12581 
12582 		/*
12583 		 * Before we drop ipmp_lock, bump gr_pend* to ensure that the
12584 		 * IPMP meta-interface ills needed by `phyi' cannot go away
12585 		 * before ip_join_illgrps() is called back.  See the comments
12586 		 * in ip_sioctl_plink_ipmp() for more.
12587 		 */
12588 		if (phyi->phyint_illv4 != NULL)
12589 			grp->gr_pendv4++;
12590 		if (phyi->phyint_illv6 != NULL)
12591 			grp->gr_pendv6++;
12592 
12593 		rw_exit(&ipst->ips_ipmp_lock);
12594 
12595 		ipmp_phyint_join_grp(phyi, grp);
12596 		ill_refhold(ill);
12597 		qwriter_ip(ill, ill->ill_rq, ipsq_mp, ip_join_illgrps,
12598 		    SWITCH_OP, B_FALSE);
12599 		return (0);
12600 	} else {
12601 		/*
12602 		 * Request to remove the interface from a group.  If the
12603 		 * interface is not in a group, this trivially succeeds.
12604 		 */
12605 		rw_exit(&ipst->ips_ipmp_lock);
12606 		if (IS_UNDER_IPMP(ill))
12607 			ipmp_phyint_leave_grp(phyi);
12608 		return (0);
12609 	}
12610 unlock:
12611 	rw_exit(&ipst->ips_ipmp_lock);
12612 	return (err);
12613 }
12614 
12615 /*
12616  * Process an SIOCGLIFBINDING request.
12617  */
12618 /* ARGSUSED */
12619 int
ip_sioctl_get_binding(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)12620 ip_sioctl_get_binding(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12621     ip_ioctl_cmd_t *ipip, void *ifreq)
12622 {
12623 	ill_t		*ill;
12624 	struct lifreq	*lifr = ifreq;
12625 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12626 
12627 	if (!IS_IPMP(ipif->ipif_ill))
12628 		return (EINVAL);
12629 
12630 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12631 	if ((ill = ipif->ipif_bound_ill) == NULL)
12632 		lifr->lifr_binding[0] = '\0';
12633 	else
12634 		(void) strlcpy(lifr->lifr_binding, ill->ill_name, LIFNAMSIZ);
12635 	rw_exit(&ipst->ips_ipmp_lock);
12636 	return (0);
12637 }
12638 
12639 /*
12640  * Process an SIOCGLIFGROUPNAME request.
12641  */
12642 /* ARGSUSED */
12643 int
ip_sioctl_get_groupname(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)12644 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12645     ip_ioctl_cmd_t *ipip, void *ifreq)
12646 {
12647 	ipmp_grp_t	*grp;
12648 	struct lifreq	*lifr = ifreq;
12649 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12650 
12651 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12652 	if ((grp = ipif->ipif_ill->ill_phyint->phyint_grp) == NULL)
12653 		lifr->lifr_groupname[0] = '\0';
12654 	else
12655 		(void) strlcpy(lifr->lifr_groupname, grp->gr_name, LIFGRNAMSIZ);
12656 	rw_exit(&ipst->ips_ipmp_lock);
12657 	return (0);
12658 }
12659 
12660 /*
12661  * Process an SIOCGLIFGROUPINFO request.
12662  */
12663 /* ARGSUSED */
12664 int
ip_sioctl_groupinfo(ipif_t * dummy_ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy)12665 ip_sioctl_groupinfo(ipif_t *dummy_ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12666     ip_ioctl_cmd_t *ipip, void *dummy)
12667 {
12668 	ipmp_grp_t	*grp;
12669 	lifgroupinfo_t	*lifgr;
12670 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
12671 
12672 	/* ip_wput_nondata() verified mp->b_cont->b_cont */
12673 	lifgr = (lifgroupinfo_t *)mp->b_cont->b_cont->b_rptr;
12674 	lifgr->gi_grname[LIFGRNAMSIZ - 1] = '\0';
12675 
12676 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12677 	if ((grp = ipmp_grp_lookup(lifgr->gi_grname, ipst)) == NULL) {
12678 		rw_exit(&ipst->ips_ipmp_lock);
12679 		return (ENOENT);
12680 	}
12681 	ipmp_grp_info(grp, lifgr);
12682 	rw_exit(&ipst->ips_ipmp_lock);
12683 	return (0);
12684 }
12685 
12686 static void
ill_dl_down(ill_t * ill)12687 ill_dl_down(ill_t *ill)
12688 {
12689 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_down", ill_t *, ill);
12690 
12691 	/*
12692 	 * The ill is down; unbind but stay attached since we're still
12693 	 * associated with a PPA. If we have negotiated DLPI capabilites
12694 	 * with the data link service provider (IDS_OK) then reset them.
12695 	 * The interval between unbinding and rebinding is potentially
12696 	 * unbounded hence we cannot assume things will be the same.
12697 	 * The DLPI capabilities will be probed again when the data link
12698 	 * is brought up.
12699 	 */
12700 	mblk_t	*mp = ill->ill_unbind_mp;
12701 
12702 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
12703 
12704 	if (!ill->ill_replumbing) {
12705 		/* Free all ilms for this ill */
12706 		update_conn_ill(ill, ill->ill_ipst);
12707 	} else {
12708 		ill_leave_multicast(ill);
12709 	}
12710 
12711 	ill->ill_unbind_mp = NULL;
12712 	if (mp != NULL) {
12713 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
12714 		    dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
12715 		    ill->ill_name));
12716 		mutex_enter(&ill->ill_lock);
12717 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
12718 		mutex_exit(&ill->ill_lock);
12719 		/*
12720 		 * ip_rput does not pass up normal (M_PROTO) DLPI messages
12721 		 * after ILL_CONDEMNED is set. So in the unplumb case, we call
12722 		 * ill_capability_dld_disable disable rightaway. If this is not
12723 		 * an unplumb operation then the disable happens on receipt of
12724 		 * the capab ack via ip_rput_dlpi_writer ->
12725 		 * ill_capability_ack_thr. In both cases the order of
12726 		 * the operations seen by DLD is capability disable followed
12727 		 * by DL_UNBIND. Also the DLD capability disable needs a
12728 		 * cv_wait'able context.
12729 		 */
12730 		if (ill->ill_state_flags & ILL_CONDEMNED)
12731 			ill_capability_dld_disable(ill);
12732 		ill_capability_reset(ill, B_FALSE);
12733 		ill_dlpi_send(ill, mp);
12734 	}
12735 	mutex_enter(&ill->ill_lock);
12736 	ill->ill_dl_up = 0;
12737 	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
12738 	mutex_exit(&ill->ill_lock);
12739 }
12740 
12741 void
ill_dlpi_dispatch(ill_t * ill,mblk_t * mp)12742 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
12743 {
12744 	union DL_primitives *dlp;
12745 	t_uscalar_t prim;
12746 	boolean_t waitack = B_FALSE;
12747 
12748 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12749 
12750 	dlp = (union DL_primitives *)mp->b_rptr;
12751 	prim = dlp->dl_primitive;
12752 
12753 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
12754 	    dl_primstr(prim), prim, ill->ill_name));
12755 
12756 	switch (prim) {
12757 	case DL_PHYS_ADDR_REQ:
12758 	{
12759 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
12760 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
12761 		break;
12762 	}
12763 	case DL_BIND_REQ:
12764 		mutex_enter(&ill->ill_lock);
12765 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
12766 		mutex_exit(&ill->ill_lock);
12767 		break;
12768 	}
12769 
12770 	/*
12771 	 * Except for the ACKs for the M_PCPROTO messages, all other ACKs
12772 	 * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
12773 	 * we only wait for the ACK of the DL_UNBIND_REQ.
12774 	 */
12775 	mutex_enter(&ill->ill_lock);
12776 	if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
12777 	    (prim == DL_UNBIND_REQ)) {
12778 		ill->ill_dlpi_pending = prim;
12779 		waitack = B_TRUE;
12780 	}
12781 
12782 	mutex_exit(&ill->ill_lock);
12783 	DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_dispatch",
12784 	    char *, dl_primstr(prim), ill_t *, ill);
12785 	putnext(ill->ill_wq, mp);
12786 
12787 	/*
12788 	 * There is no ack for DL_NOTIFY_CONF messages
12789 	 */
12790 	if (waitack && prim == DL_NOTIFY_CONF)
12791 		ill_dlpi_done(ill, prim);
12792 }
12793 
12794 /*
12795  * Helper function for ill_dlpi_send().
12796  */
12797 /* ARGSUSED */
12798 static void
ill_dlpi_send_writer(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * arg)12799 ill_dlpi_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
12800 {
12801 	ill_dlpi_send(q->q_ptr, mp);
12802 }
12803 
12804 /*
12805  * Send a DLPI control message to the driver but make sure there
12806  * is only one outstanding message. Uses ill_dlpi_pending to tell
12807  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
12808  * when an ACK or a NAK is received to process the next queued message.
12809  */
12810 void
ill_dlpi_send(ill_t * ill,mblk_t * mp)12811 ill_dlpi_send(ill_t *ill, mblk_t *mp)
12812 {
12813 	mblk_t **mpp;
12814 
12815 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12816 
12817 	/*
12818 	 * To ensure that any DLPI requests for current exclusive operation
12819 	 * are always completely sent before any DLPI messages for other
12820 	 * operations, require writer access before enqueuing.
12821 	 */
12822 	if (!IAM_WRITER_ILL(ill)) {
12823 		ill_refhold(ill);
12824 		/* qwriter_ip() does the ill_refrele() */
12825 		qwriter_ip(ill, ill->ill_wq, mp, ill_dlpi_send_writer,
12826 		    NEW_OP, B_TRUE);
12827 		return;
12828 	}
12829 
12830 	mutex_enter(&ill->ill_lock);
12831 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
12832 		/* Must queue message. Tail insertion */
12833 		mpp = &ill->ill_dlpi_deferred;
12834 		while (*mpp != NULL)
12835 			mpp = &((*mpp)->b_next);
12836 
12837 		ip1dbg(("ill_dlpi_send: deferring request for %s "
12838 		    "while %s pending\n", ill->ill_name,
12839 		    dl_primstr(ill->ill_dlpi_pending)));
12840 
12841 		*mpp = mp;
12842 		mutex_exit(&ill->ill_lock);
12843 		return;
12844 	}
12845 	mutex_exit(&ill->ill_lock);
12846 	ill_dlpi_dispatch(ill, mp);
12847 }
12848 
12849 void
ill_capability_send(ill_t * ill,mblk_t * mp)12850 ill_capability_send(ill_t *ill, mblk_t *mp)
12851 {
12852 	ill->ill_capab_pending_cnt++;
12853 	ill_dlpi_send(ill, mp);
12854 }
12855 
12856 void
ill_capability_done(ill_t * ill)12857 ill_capability_done(ill_t *ill)
12858 {
12859 	ASSERT(ill->ill_capab_pending_cnt != 0);
12860 
12861 	ill_dlpi_done(ill, DL_CAPABILITY_REQ);
12862 
12863 	ill->ill_capab_pending_cnt--;
12864 	if (ill->ill_capab_pending_cnt == 0 &&
12865 	    ill->ill_dlpi_capab_state == IDCS_OK)
12866 		ill_capability_reset_alloc(ill);
12867 }
12868 
12869 /*
12870  * Send all deferred DLPI messages without waiting for their ACKs.
12871  */
12872 void
ill_dlpi_send_deferred(ill_t * ill)12873 ill_dlpi_send_deferred(ill_t *ill)
12874 {
12875 	mblk_t *mp, *nextmp;
12876 
12877 	/*
12878 	 * Clear ill_dlpi_pending so that the message is not queued in
12879 	 * ill_dlpi_send().
12880 	 */
12881 	mutex_enter(&ill->ill_lock);
12882 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
12883 	mp = ill->ill_dlpi_deferred;
12884 	ill->ill_dlpi_deferred = NULL;
12885 	mutex_exit(&ill->ill_lock);
12886 
12887 	for (; mp != NULL; mp = nextmp) {
12888 		nextmp = mp->b_next;
12889 		mp->b_next = NULL;
12890 		ill_dlpi_send(ill, mp);
12891 	}
12892 }
12893 
12894 /*
12895  * Clear all the deferred DLPI messages. Called on receiving an M_ERROR
12896  * or M_HANGUP
12897  */
12898 static void
ill_dlpi_clear_deferred(ill_t * ill)12899 ill_dlpi_clear_deferred(ill_t *ill)
12900 {
12901 	mblk_t	*mp, *nextmp;
12902 
12903 	mutex_enter(&ill->ill_lock);
12904 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
12905 	mp = ill->ill_dlpi_deferred;
12906 	ill->ill_dlpi_deferred = NULL;
12907 	mutex_exit(&ill->ill_lock);
12908 
12909 	for (; mp != NULL; mp = nextmp) {
12910 		nextmp = mp->b_next;
12911 		inet_freemsg(mp);
12912 	}
12913 }
12914 
12915 /*
12916  * Check if the DLPI primitive `prim' is pending; print a warning if not.
12917  */
12918 boolean_t
ill_dlpi_pending(ill_t * ill,t_uscalar_t prim)12919 ill_dlpi_pending(ill_t *ill, t_uscalar_t prim)
12920 {
12921 	t_uscalar_t pending;
12922 
12923 	mutex_enter(&ill->ill_lock);
12924 	if (ill->ill_dlpi_pending == prim) {
12925 		mutex_exit(&ill->ill_lock);
12926 		return (B_TRUE);
12927 	}
12928 
12929 	/*
12930 	 * During teardown, ill_dlpi_dispatch() will send DLPI requests
12931 	 * without waiting, so don't print any warnings in that case.
12932 	 */
12933 	if (ill->ill_state_flags & ILL_CONDEMNED) {
12934 		mutex_exit(&ill->ill_lock);
12935 		return (B_FALSE);
12936 	}
12937 	pending = ill->ill_dlpi_pending;
12938 	mutex_exit(&ill->ill_lock);
12939 
12940 	if (pending == DL_PRIM_INVAL) {
12941 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12942 		    "received unsolicited ack for %s on %s\n",
12943 		    dl_primstr(prim), ill->ill_name);
12944 	} else {
12945 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12946 		    "received unexpected ack for %s on %s (expecting %s)\n",
12947 		    dl_primstr(prim), ill->ill_name, dl_primstr(pending));
12948 	}
12949 	return (B_FALSE);
12950 }
12951 
12952 /*
12953  * Complete the current DLPI operation associated with `prim' on `ill' and
12954  * start the next queued DLPI operation (if any).  If there are no queued DLPI
12955  * operations and the ill's current exclusive IPSQ operation has finished
12956  * (i.e., ipsq_current_finish() was called), then clear ipsq_current_ipif to
12957  * allow the next exclusive IPSQ operation to begin upon ipsq_exit().  See
12958  * the comments above ipsq_current_finish() for details.
12959  */
12960 void
ill_dlpi_done(ill_t * ill,t_uscalar_t prim)12961 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
12962 {
12963 	mblk_t *mp;
12964 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
12965 	ipxop_t *ipx = ipsq->ipsq_xop;
12966 
12967 	ASSERT(IAM_WRITER_IPSQ(ipsq));
12968 	mutex_enter(&ill->ill_lock);
12969 
12970 	ASSERT(prim != DL_PRIM_INVAL);
12971 	ASSERT(ill->ill_dlpi_pending == prim);
12972 
12973 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
12974 	    dl_primstr(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
12975 
12976 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
12977 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
12978 		if (ipx->ipx_current_done) {
12979 			mutex_enter(&ipx->ipx_lock);
12980 			ipx->ipx_current_ipif = NULL;
12981 			mutex_exit(&ipx->ipx_lock);
12982 		}
12983 		cv_signal(&ill->ill_cv);
12984 		mutex_exit(&ill->ill_lock);
12985 		return;
12986 	}
12987 
12988 	ill->ill_dlpi_deferred = mp->b_next;
12989 	mp->b_next = NULL;
12990 	mutex_exit(&ill->ill_lock);
12991 
12992 	ill_dlpi_dispatch(ill, mp);
12993 }
12994 
12995 /*
12996  * Queue a (multicast) DLPI control message to be sent to the driver by
12997  * later calling ill_dlpi_send_queued.
12998  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
12999  * are sent in order i.e., prevent a DL_DISABMULTI_REQ and DL_ENABMULTI_REQ
13000  * for the same group to race.
13001  * We send DLPI control messages in order using ill_lock.
13002  * For IPMP we should be called on the cast_ill.
13003  */
13004 void
ill_dlpi_queue(ill_t * ill,mblk_t * mp)13005 ill_dlpi_queue(ill_t *ill, mblk_t *mp)
13006 {
13007 	mblk_t **mpp;
13008 
13009 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
13010 
13011 	mutex_enter(&ill->ill_lock);
13012 	/* Must queue message. Tail insertion */
13013 	mpp = &ill->ill_dlpi_deferred;
13014 	while (*mpp != NULL)
13015 		mpp = &((*mpp)->b_next);
13016 
13017 	*mpp = mp;
13018 	mutex_exit(&ill->ill_lock);
13019 }
13020 
13021 /*
13022  * Send the messages that were queued. Make sure there is only
13023  * one outstanding message. ip_rput_dlpi_writer calls ill_dlpi_done()
13024  * when an ACK or a NAK is received to process the next queued message.
13025  * For IPMP we are called on the upper ill, but when send what is queued
13026  * on the cast_ill.
13027  */
13028 void
ill_dlpi_send_queued(ill_t * ill)13029 ill_dlpi_send_queued(ill_t *ill)
13030 {
13031 	mblk_t	*mp;
13032 	union DL_primitives *dlp;
13033 	t_uscalar_t prim;
13034 	ill_t *release_ill = NULL;
13035 
13036 	if (IS_IPMP(ill)) {
13037 		/* On the upper IPMP ill. */
13038 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13039 		if (release_ill == NULL) {
13040 			/* Avoid ever sending anything down to the ipmpstub */
13041 			return;
13042 		}
13043 		ill = release_ill;
13044 	}
13045 	mutex_enter(&ill->ill_lock);
13046 	while ((mp = ill->ill_dlpi_deferred) != NULL) {
13047 		if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
13048 			/* Can't send. Somebody else will send it */
13049 			mutex_exit(&ill->ill_lock);
13050 			goto done;
13051 		}
13052 		ill->ill_dlpi_deferred = mp->b_next;
13053 		mp->b_next = NULL;
13054 		if (!ill->ill_dl_up) {
13055 			/*
13056 			 * Nobody there. All multicast addresses will be
13057 			 * re-joined when we get the DL_BIND_ACK bringing the
13058 			 * interface up.
13059 			 */
13060 			freemsg(mp);
13061 			continue;
13062 		}
13063 		dlp = (union DL_primitives *)mp->b_rptr;
13064 		prim = dlp->dl_primitive;
13065 
13066 		if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
13067 		    (prim == DL_UNBIND_REQ)) {
13068 			ill->ill_dlpi_pending = prim;
13069 		}
13070 		mutex_exit(&ill->ill_lock);
13071 
13072 		DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_send_queued",
13073 		    char *, dl_primstr(prim), ill_t *, ill);
13074 		putnext(ill->ill_wq, mp);
13075 		mutex_enter(&ill->ill_lock);
13076 	}
13077 	mutex_exit(&ill->ill_lock);
13078 done:
13079 	if (release_ill != NULL)
13080 		ill_refrele(release_ill);
13081 }
13082 
13083 /*
13084  * Queue an IP (IGMP/MLD) message to be sent by IP from
13085  * ill_mcast_send_queued
13086  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
13087  * are sent in order i.e., prevent a IGMP leave and IGMP join for the same
13088  * group to race.
13089  * We send them in order using ill_lock.
13090  * For IPMP we are called on the upper ill, but we queue on the cast_ill.
13091  */
13092 void
ill_mcast_queue(ill_t * ill,mblk_t * mp)13093 ill_mcast_queue(ill_t *ill, mblk_t *mp)
13094 {
13095 	mblk_t **mpp;
13096 	ill_t *release_ill = NULL;
13097 
13098 	ASSERT(RW_LOCK_HELD(&ill->ill_mcast_lock));
13099 
13100 	if (IS_IPMP(ill)) {
13101 		/* On the upper IPMP ill. */
13102 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13103 		if (release_ill == NULL) {
13104 			/* Discard instead of queuing for the ipmp interface */
13105 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
13106 			ip_drop_output("ipIfStatsOutDiscards - no cast_ill",
13107 			    mp, ill);
13108 			freemsg(mp);
13109 			return;
13110 		}
13111 		ill = release_ill;
13112 	}
13113 
13114 	mutex_enter(&ill->ill_lock);
13115 	/* Must queue message. Tail insertion */
13116 	mpp = &ill->ill_mcast_deferred;
13117 	while (*mpp != NULL)
13118 		mpp = &((*mpp)->b_next);
13119 
13120 	*mpp = mp;
13121 	mutex_exit(&ill->ill_lock);
13122 	if (release_ill != NULL)
13123 		ill_refrele(release_ill);
13124 }
13125 
13126 /*
13127  * Send the IP packets that were queued by ill_mcast_queue.
13128  * These are IGMP/MLD packets.
13129  *
13130  * For IPMP we are called on the upper ill, but when send what is queued
13131  * on the cast_ill.
13132  *
13133  * Request loopback of the report if we are acting as a multicast
13134  * router, so that the process-level routing demon can hear it.
13135  * This will run multiple times for the same group if there are members
13136  * on the same group for multiple ipif's on the same ill. The
13137  * igmp_input/mld_input code will suppress this due to the loopback thus we
13138  * always loopback membership report.
13139  *
13140  * We also need to make sure that this does not get load balanced
13141  * by IPMP. We do this by passing an ill to ip_output_simple.
13142  */
13143 void
ill_mcast_send_queued(ill_t * ill)13144 ill_mcast_send_queued(ill_t *ill)
13145 {
13146 	mblk_t	*mp;
13147 	ip_xmit_attr_t ixas;
13148 	ill_t *release_ill = NULL;
13149 
13150 	if (IS_IPMP(ill)) {
13151 		/* On the upper IPMP ill. */
13152 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13153 		if (release_ill == NULL) {
13154 			/*
13155 			 * We should have no messages on the ipmp interface
13156 			 * but no point in trying to send them.
13157 			 */
13158 			return;
13159 		}
13160 		ill = release_ill;
13161 	}
13162 	bzero(&ixas, sizeof (ixas));
13163 	ixas.ixa_zoneid = ALL_ZONES;
13164 	ixas.ixa_cred = kcred;
13165 	ixas.ixa_cpid = NOPID;
13166 	ixas.ixa_tsl = NULL;
13167 	/*
13168 	 * Here we set ixa_ifindex. If IPMP it will be the lower ill which
13169 	 * makes ip_select_route pick the IRE_MULTICAST for the cast_ill.
13170 	 * That is necessary to handle IGMP/MLD snooping switches.
13171 	 */
13172 	ixas.ixa_ifindex = ill->ill_phyint->phyint_ifindex;
13173 	ixas.ixa_ipst = ill->ill_ipst;
13174 
13175 	mutex_enter(&ill->ill_lock);
13176 	while ((mp = ill->ill_mcast_deferred) != NULL) {
13177 		ill->ill_mcast_deferred = mp->b_next;
13178 		mp->b_next = NULL;
13179 		if (!ill->ill_dl_up) {
13180 			/*
13181 			 * Nobody there. Just drop the ip packets.
13182 			 * IGMP/MLD will resend later, if this is a replumb.
13183 			 */
13184 			freemsg(mp);
13185 			continue;
13186 		}
13187 		mutex_enter(&ill->ill_phyint->phyint_lock);
13188 		if (IS_UNDER_IPMP(ill) && !ipmp_ill_is_active(ill)) {
13189 			/*
13190 			 * When the ill is getting deactivated, we only want to
13191 			 * send the DLPI messages, so drop IGMP/MLD packets.
13192 			 * DLPI messages are handled by ill_dlpi_send_queued()
13193 			 */
13194 			mutex_exit(&ill->ill_phyint->phyint_lock);
13195 			freemsg(mp);
13196 			continue;
13197 		}
13198 		mutex_exit(&ill->ill_phyint->phyint_lock);
13199 		mutex_exit(&ill->ill_lock);
13200 
13201 		/* Check whether we are sending IPv4 or IPv6. */
13202 		if (ill->ill_isv6) {
13203 			ip6_t  *ip6h = (ip6_t *)mp->b_rptr;
13204 
13205 			ixas.ixa_multicast_ttl = ip6h->ip6_hops;
13206 			ixas.ixa_flags = IXAF_BASIC_SIMPLE_V6;
13207 		} else {
13208 			ipha_t *ipha = (ipha_t *)mp->b_rptr;
13209 
13210 			ixas.ixa_multicast_ttl = ipha->ipha_ttl;
13211 			ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13212 			ixas.ixa_flags &= ~IXAF_SET_ULP_CKSUM;
13213 		}
13214 		ixas.ixa_flags &= ~IXAF_VERIFY_SOURCE;
13215 		ixas.ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_SOURCE;
13216 		(void) ip_output_simple(mp, &ixas);
13217 		ixa_cleanup(&ixas);
13218 
13219 		mutex_enter(&ill->ill_lock);
13220 	}
13221 	mutex_exit(&ill->ill_lock);
13222 
13223 done:
13224 	if (release_ill != NULL)
13225 		ill_refrele(release_ill);
13226 }
13227 
13228 /*
13229  * Take down a specific interface, but don't lose any information about it.
13230  * (Always called as writer.)
13231  * This function goes through the down sequence even if the interface is
13232  * already down. There are 2 reasons.
13233  * a. Currently we permit interface routes that depend on down interfaces
13234  *    to be added. This behaviour itself is questionable. However it appears
13235  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
13236  *    time. We go thru the cleanup in order to remove these routes.
13237  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
13238  *    DL_ERROR_ACK in response to the DL_BIND request. The interface is
13239  *    down, but we need to cleanup i.e. do ill_dl_down and
13240  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
13241  *
13242  * IP-MT notes:
13243  *
13244  * Model of reference to interfaces.
13245  *
13246  * The following members in ipif_t track references to the ipif.
13247  *	int     ipif_refcnt;    Active reference count
13248  *
13249  * The following members in ill_t track references to the ill.
13250  *	int             ill_refcnt;     active refcnt
13251  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
13252  *	uint_t          ill_ncec_cnt;	Number of ncecs referencing ill
13253  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
13254  *	uint_t          ill_ilm_cnt;	Number of ilms referencing ill
13255  *
13256  * Reference to an ipif or ill can be obtained in any of the following ways.
13257  *
13258  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
13259  * Pointers to ipif / ill from other data structures viz ire and conn.
13260  * Implicit reference to the ipif / ill by holding a reference to the ire.
13261  *
13262  * The ipif/ill lookup functions return a reference held ipif / ill.
13263  * ipif_refcnt and ill_refcnt track the reference counts respectively.
13264  * This is a purely dynamic reference count associated with threads holding
13265  * references to the ipif / ill. Pointers from other structures do not
13266  * count towards this reference count.
13267  *
13268  * ill_ire_cnt is the number of ire's associated with the
13269  * ill. This is incremented whenever a new ire is created referencing the
13270  * ill. This is done atomically inside ire_add_v[46] where the ire is
13271  * actually added to the ire hash table. The count is decremented in
13272  * ire_inactive where the ire is destroyed.
13273  *
13274  * ill_ncec_cnt is the number of ncec's referencing the ill thru ncec_ill.
13275  * This is incremented atomically in
13276  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
13277  * table. Similarly it is decremented in ncec_inactive() where the ncec
13278  * is destroyed.
13279  *
13280  * ill_nce_cnt is the number of nce's referencing the ill thru nce_ill. This is
13281  * incremented atomically in nce_add() where the nce is actually added to the
13282  * ill_nce. Similarly it is decremented in nce_inactive() where the nce
13283  * is destroyed.
13284  *
13285  * ill_ilm_cnt is the ilm's reference to the ill. It is incremented in
13286  * ilm_add() and decremented before the ilm is freed in ilm_delete().
13287  *
13288  * Flow of ioctls involving interface down/up
13289  *
13290  * The following is the sequence of an attempt to set some critical flags on an
13291  * up interface.
13292  * ip_sioctl_flags
13293  * ipif_down
13294  * wait for ipif to be quiescent
13295  * ipif_down_tail
13296  * ip_sioctl_flags_tail
13297  *
13298  * All set ioctls that involve down/up sequence would have a skeleton similar
13299  * to the above. All the *tail functions are called after the refcounts have
13300  * dropped to the appropriate values.
13301  *
13302  * SIOC ioctls during the IPIF_CHANGING interval.
13303  *
13304  * Threads handling SIOC set ioctls serialize on the squeue, but this
13305  * is not done for SIOC get ioctls. Since a set ioctl can cause several
13306  * steps of internal changes to the state, some of which are visible in
13307  * ipif_flags (such as IFF_UP being cleared and later set), and we want
13308  * the set ioctl to be atomic related to the get ioctls, the SIOC get code
13309  * will wait and restart ioctls if IPIF_CHANGING is set. The mblk is then
13310  * enqueued in the ipsq and the operation is restarted by ipsq_exit() when
13311  * the current exclusive operation completes. The IPIF_CHANGING check
13312  * and enqueue is atomic using the ill_lock and ipsq_lock. The
13313  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
13314  * change while the ill_lock is held. Before dropping the ill_lock we acquire
13315  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
13316  * until we release the ipsq_lock, even though the ill/ipif state flags
13317  * can change after we drop the ill_lock.
13318  */
13319 int
ipif_down(ipif_t * ipif,queue_t * q,mblk_t * mp)13320 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13321 {
13322 	ill_t		*ill = ipif->ipif_ill;
13323 	conn_t		*connp;
13324 	boolean_t	success;
13325 	boolean_t	ipif_was_up = B_FALSE;
13326 	ip_stack_t	*ipst = ill->ill_ipst;
13327 
13328 	ASSERT(IAM_WRITER_IPIF(ipif));
13329 
13330 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13331 
13332 	DTRACE_PROBE3(ipif__downup, char *, "ipif_down",
13333 	    ill_t *, ill, ipif_t *, ipif);
13334 
13335 	if (ipif->ipif_flags & IPIF_UP) {
13336 		mutex_enter(&ill->ill_lock);
13337 		ipif->ipif_flags &= ~IPIF_UP;
13338 		ASSERT(ill->ill_ipif_up_count > 0);
13339 		--ill->ill_ipif_up_count;
13340 		mutex_exit(&ill->ill_lock);
13341 		ipif_was_up = B_TRUE;
13342 		/* Update status in SCTP's list */
13343 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
13344 		ill_nic_event_dispatch(ipif->ipif_ill,
13345 		    MAP_IPIF_ID(ipif->ipif_id), NE_LIF_DOWN, NULL, 0);
13346 	}
13347 
13348 	/*
13349 	 * Removal of the last ipif from an ill may result in a DL_UNBIND
13350 	 * being sent to the driver, and we must not send any data packets to
13351 	 * the driver after the DL_UNBIND_REQ. To ensure this, all the
13352 	 * ire and nce entries used in the data path will be cleaned
13353 	 * up, and we also set  the ILL_DOWN_IN_PROGRESS bit to make
13354 	 * sure on new entries will be added until the ill is bound
13355 	 * again. The ILL_DOWN_IN_PROGRESS bit is turned off upon
13356 	 * receipt of a DL_BIND_ACK.
13357 	 */
13358 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13359 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13360 	    ill->ill_dl_up) {
13361 		ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
13362 	}
13363 
13364 	/*
13365 	 * Blow away memberships we established in ipif_multicast_up().
13366 	 */
13367 	ipif_multicast_down(ipif);
13368 
13369 	/*
13370 	 * Remove from the mapping for __sin6_src_id. We insert only
13371 	 * when the address is not INADDR_ANY. As IPv4 addresses are
13372 	 * stored as mapped addresses, we need to check for mapped
13373 	 * INADDR_ANY also.
13374 	 */
13375 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
13376 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
13377 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
13378 		int err;
13379 
13380 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
13381 		    ipif->ipif_zoneid, ipst);
13382 		if (err != 0) {
13383 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
13384 		}
13385 	}
13386 
13387 	if (ipif_was_up) {
13388 		/* only delete if we'd added ire's before */
13389 		if (ipif->ipif_isv6)
13390 			ipif_delete_ires_v6(ipif);
13391 		else
13392 			ipif_delete_ires_v4(ipif);
13393 	}
13394 
13395 	if (ipif_was_up && ill->ill_ipif_up_count == 0) {
13396 		/*
13397 		 * Since the interface is now down, it may have just become
13398 		 * inactive.  Note that this needs to be done even for a
13399 		 * lll_logical_down(), or ARP entries will not get correctly
13400 		 * restored when the interface comes back up.
13401 		 */
13402 		if (IS_UNDER_IPMP(ill))
13403 			ipmp_ill_refresh_active(ill);
13404 	}
13405 
13406 	/*
13407 	 * neighbor-discovery or arp entries for this interface. The ipif
13408 	 * has to be quiesced, so we walk all the nce's and delete those
13409 	 * that point at the ipif->ipif_ill. At the same time, we also
13410 	 * update IPMP so that ipifs for data addresses are unbound. We dont
13411 	 * call ipif_arp_down to DL_UNBIND the arp stream itself here, but defer
13412 	 * that for ipif_down_tail()
13413 	 */
13414 	ipif_nce_down(ipif);
13415 
13416 	/*
13417 	 * If this is the last ipif on the ill, we also need to remove
13418 	 * any IREs with ire_ill set. Otherwise ipif_is_quiescent() will
13419 	 * never succeed.
13420 	 */
13421 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0)
13422 		ire_walk_ill(0, 0, ill_downi, ill, ill);
13423 
13424 	/*
13425 	 * Walk all CONNs that can have a reference on an ire for this
13426 	 * ipif (we actually walk all that now have stale references).
13427 	 */
13428 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
13429 
13430 	/*
13431 	 * If mp is NULL the caller will wait for the appropriate refcnt.
13432 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
13433 	 * and ill_delete -> ipif_free -> ipif_down
13434 	 */
13435 	if (mp == NULL) {
13436 		ASSERT(q == NULL);
13437 		return (0);
13438 	}
13439 
13440 	if (CONN_Q(q)) {
13441 		connp = Q_TO_CONN(q);
13442 		mutex_enter(&connp->conn_lock);
13443 	} else {
13444 		connp = NULL;
13445 	}
13446 	mutex_enter(&ill->ill_lock);
13447 	/*
13448 	 * Are there any ire's pointing to this ipif that are still active ?
13449 	 * If this is the last ipif going down, are there any ire's pointing
13450 	 * to this ill that are still active ?
13451 	 */
13452 	if (ipif_is_quiescent(ipif)) {
13453 		mutex_exit(&ill->ill_lock);
13454 		if (connp != NULL)
13455 			mutex_exit(&connp->conn_lock);
13456 		return (0);
13457 	}
13458 
13459 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
13460 	    ill->ill_name, (void *)ill));
13461 	/*
13462 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
13463 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
13464 	 * which in turn is called by the last refrele on the ipif/ill/ire.
13465 	 */
13466 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
13467 	if (!success) {
13468 		/* The conn is closing. So just return */
13469 		ASSERT(connp != NULL);
13470 		mutex_exit(&ill->ill_lock);
13471 		mutex_exit(&connp->conn_lock);
13472 		return (EINTR);
13473 	}
13474 
13475 	mutex_exit(&ill->ill_lock);
13476 	if (connp != NULL)
13477 		mutex_exit(&connp->conn_lock);
13478 	return (EINPROGRESS);
13479 }
13480 
13481 int
ipif_down_tail(ipif_t * ipif)13482 ipif_down_tail(ipif_t *ipif)
13483 {
13484 	ill_t	*ill = ipif->ipif_ill;
13485 	int	err = 0;
13486 
13487 	DTRACE_PROBE3(ipif__downup, char *, "ipif_down_tail",
13488 	    ill_t *, ill, ipif_t *, ipif);
13489 
13490 	/*
13491 	 * Skip any loopback interface (null wq).
13492 	 * If this is the last logical interface on the ill
13493 	 * have ill_dl_down tell the driver we are gone (unbind)
13494 	 * Note that lun 0 can ipif_down even though
13495 	 * there are other logical units that are up.
13496 	 * This occurs e.g. when we change a "significant" IFF_ flag.
13497 	 */
13498 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13499 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13500 	    ill->ill_dl_up) {
13501 		ill_dl_down(ill);
13502 	}
13503 	if (!ipif->ipif_isv6)
13504 		err = ipif_arp_down(ipif);
13505 
13506 	ill->ill_logical_down = 0;
13507 
13508 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
13509 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif, RTSQ_DEFAULT);
13510 	return (err);
13511 }
13512 
13513 /*
13514  * Bring interface logically down without bringing the physical interface
13515  * down e.g. when the netmask is changed. This avoids long lasting link
13516  * negotiations between an ethernet interface and a certain switches.
13517  */
13518 static int
ipif_logical_down(ipif_t * ipif,queue_t * q,mblk_t * mp)13519 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13520 {
13521 	DTRACE_PROBE3(ipif__downup, char *, "ipif_logical_down",
13522 	    ill_t *, ipif->ipif_ill, ipif_t *, ipif);
13523 
13524 	/*
13525 	 * The ill_logical_down flag is a transient flag. It is set here
13526 	 * and is cleared once the down has completed in ipif_down_tail.
13527 	 * This flag does not indicate whether the ill stream is in the
13528 	 * DL_BOUND state with the driver. Instead this flag is used by
13529 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
13530 	 * the driver. The state of the ill stream i.e. whether it is
13531 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
13532 	 */
13533 	ipif->ipif_ill->ill_logical_down = 1;
13534 	return (ipif_down(ipif, q, mp));
13535 }
13536 
13537 /*
13538  * Initiate deallocate of an IPIF. Always called as writer. Called by
13539  * ill_delete or ip_sioctl_removeif.
13540  */
13541 static void
ipif_free(ipif_t * ipif)13542 ipif_free(ipif_t *ipif)
13543 {
13544 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13545 
13546 	ASSERT(IAM_WRITER_IPIF(ipif));
13547 
13548 	if (ipif->ipif_recovery_id != 0)
13549 		(void) untimeout(ipif->ipif_recovery_id);
13550 	ipif->ipif_recovery_id = 0;
13551 
13552 	/*
13553 	 * Take down the interface. We can be called either from ill_delete
13554 	 * or from ip_sioctl_removeif.
13555 	 */
13556 	(void) ipif_down(ipif, NULL, NULL);
13557 
13558 	/*
13559 	 * Now that the interface is down, there's no chance it can still
13560 	 * become a duplicate.  Cancel any timer that may have been set while
13561 	 * tearing down.
13562 	 */
13563 	if (ipif->ipif_recovery_id != 0)
13564 		(void) untimeout(ipif->ipif_recovery_id);
13565 	ipif->ipif_recovery_id = 0;
13566 
13567 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13568 	/* Remove pointers to this ill in the multicast routing tables */
13569 	reset_mrt_vif_ipif(ipif);
13570 	/* If necessary, clear the cached source ipif rotor. */
13571 	if (ipif->ipif_ill->ill_src_ipif == ipif)
13572 		ipif->ipif_ill->ill_src_ipif = NULL;
13573 	rw_exit(&ipst->ips_ill_g_lock);
13574 }
13575 
13576 static void
ipif_free_tail(ipif_t * ipif)13577 ipif_free_tail(ipif_t *ipif)
13578 {
13579 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
13580 
13581 	/*
13582 	 * Need to hold both ill_g_lock and ill_lock while
13583 	 * inserting or removing an ipif from the linked list
13584 	 * of ipifs hanging off the ill.
13585 	 */
13586 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13587 
13588 #ifdef DEBUG
13589 	ipif_trace_cleanup(ipif);
13590 #endif
13591 
13592 	/* Ask SCTP to take it out of it list */
13593 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
13594 	ip_rts_newaddrmsg(RTM_FREEADDR, 0, ipif, RTSQ_DEFAULT);
13595 
13596 	/* Get it out of the ILL interface list. */
13597 	ipif_remove(ipif);
13598 	rw_exit(&ipst->ips_ill_g_lock);
13599 
13600 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
13601 	ASSERT(ipif->ipif_recovery_id == 0);
13602 	ASSERT(ipif->ipif_ire_local == NULL);
13603 	ASSERT(ipif->ipif_ire_if == NULL);
13604 
13605 	/* Free the memory. */
13606 	mi_free(ipif);
13607 }
13608 
13609 /*
13610  * Sets `buf' to an ipif name of the form "ill_name:id", or "ill_name" if "id"
13611  * is zero.
13612  */
13613 void
ipif_get_name(const ipif_t * ipif,char * buf,int len)13614 ipif_get_name(const ipif_t *ipif, char *buf, int len)
13615 {
13616 	char	lbuf[LIFNAMSIZ];
13617 	char	*name;
13618 	size_t	name_len;
13619 
13620 	buf[0] = '\0';
13621 	name = ipif->ipif_ill->ill_name;
13622 	name_len = ipif->ipif_ill->ill_name_length;
13623 	if (ipif->ipif_id != 0) {
13624 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
13625 		    ipif->ipif_id);
13626 		name = lbuf;
13627 		name_len = mi_strlen(name) + 1;
13628 	}
13629 	len -= 1;
13630 	buf[len] = '\0';
13631 	len = MIN(len, name_len);
13632 	bcopy(name, buf, len);
13633 }
13634 
13635 /*
13636  * Sets `buf' to an ill name.
13637  */
13638 void
ill_get_name(const ill_t * ill,char * buf,int len)13639 ill_get_name(const ill_t *ill, char *buf, int len)
13640 {
13641 	char	*name;
13642 	size_t	name_len;
13643 
13644 	name = ill->ill_name;
13645 	name_len = ill->ill_name_length;
13646 	len -= 1;
13647 	buf[len] = '\0';
13648 	len = MIN(len, name_len);
13649 	bcopy(name, buf, len);
13650 }
13651 
13652 /*
13653  * Find an IPIF based on the name passed in.  Names can be of the form <phys>
13654  * (e.g., le0) or <phys>:<#> (e.g., le0:1).  When there is no colon, the
13655  * implied unit id is zero. <phys> must correspond to the name of an ILL.
13656  * (May be called as writer.)
13657  */
13658 static ipif_t *
ipif_lookup_on_name(char * name,size_t namelen,boolean_t do_alloc,boolean_t * exists,boolean_t isv6,zoneid_t zoneid,ip_stack_t * ipst)13659 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
13660     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, ip_stack_t *ipst)
13661 {
13662 	char	*cp;
13663 	char	*endp;
13664 	long	id;
13665 	ill_t	*ill;
13666 	ipif_t	*ipif;
13667 	uint_t	ire_type;
13668 	boolean_t did_alloc = B_FALSE;
13669 	char	last;
13670 
13671 	/*
13672 	 * If the caller wants to us to create the ipif, make sure we have a
13673 	 * valid zoneid
13674 	 */
13675 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
13676 
13677 	if (namelen == 0) {
13678 		return (NULL);
13679 	}
13680 
13681 	*exists = B_FALSE;
13682 	/* Look for a colon in the name. */
13683 	endp = &name[namelen];
13684 	for (cp = endp; --cp > name; ) {
13685 		if (*cp == IPIF_SEPARATOR_CHAR)
13686 			break;
13687 	}
13688 
13689 	if (*cp == IPIF_SEPARATOR_CHAR) {
13690 		/*
13691 		 * Reject any non-decimal aliases for logical
13692 		 * interfaces. Aliases with leading zeroes
13693 		 * are also rejected as they introduce ambiguity
13694 		 * in the naming of the interfaces.
13695 		 * In order to confirm with existing semantics,
13696 		 * and to not break any programs/script relying
13697 		 * on that behaviour, if<0>:0 is considered to be
13698 		 * a valid interface.
13699 		 *
13700 		 * If alias has two or more digits and the first
13701 		 * is zero, fail.
13702 		 */
13703 		if (&cp[2] < endp && cp[1] == '0') {
13704 			return (NULL);
13705 		}
13706 	}
13707 
13708 	if (cp <= name) {
13709 		cp = endp;
13710 	}
13711 	last = *cp;
13712 	*cp = '\0';
13713 
13714 	/*
13715 	 * Look up the ILL, based on the portion of the name
13716 	 * before the slash. ill_lookup_on_name returns a held ill.
13717 	 * Temporary to check whether ill exists already. If so
13718 	 * ill_lookup_on_name will clear it.
13719 	 */
13720 	ill = ill_lookup_on_name(name, do_alloc, isv6,
13721 	    &did_alloc, ipst);
13722 	*cp = last;
13723 	if (ill == NULL)
13724 		return (NULL);
13725 
13726 	/* Establish the unit number in the name. */
13727 	id = 0;
13728 	if (cp < endp && *endp == '\0') {
13729 		/* If there was a colon, the unit number follows. */
13730 		cp++;
13731 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13732 			ill_refrele(ill);
13733 			return (NULL);
13734 		}
13735 	}
13736 
13737 	mutex_enter(&ill->ill_lock);
13738 	/* Now see if there is an IPIF with this unit number. */
13739 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13740 		if (ipif->ipif_id == id) {
13741 			if (zoneid != ALL_ZONES &&
13742 			    zoneid != ipif->ipif_zoneid &&
13743 			    ipif->ipif_zoneid != ALL_ZONES) {
13744 				mutex_exit(&ill->ill_lock);
13745 				ill_refrele(ill);
13746 				return (NULL);
13747 			}
13748 			if (IPIF_CAN_LOOKUP(ipif)) {
13749 				ipif_refhold_locked(ipif);
13750 				mutex_exit(&ill->ill_lock);
13751 				if (!did_alloc)
13752 					*exists = B_TRUE;
13753 				/*
13754 				 * Drop locks before calling ill_refrele
13755 				 * since it can potentially call into
13756 				 * ipif_ill_refrele_tail which can end up
13757 				 * in trying to acquire any lock.
13758 				 */
13759 				ill_refrele(ill);
13760 				return (ipif);
13761 			}
13762 		}
13763 	}
13764 
13765 	if (!do_alloc) {
13766 		mutex_exit(&ill->ill_lock);
13767 		ill_refrele(ill);
13768 		return (NULL);
13769 	}
13770 
13771 	/*
13772 	 * If none found, atomically allocate and return a new one.
13773 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
13774 	 * to support "receive only" use of lo0:1 etc. as is still done
13775 	 * below as an initial guess.
13776 	 * However, this is now likely to be overriden later in ipif_up_done()
13777 	 * when we know for sure what address has been configured on the
13778 	 * interface, since we might have more than one loopback interface
13779 	 * with a loopback address, e.g. in the case of zones, and all the
13780 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
13781 	 */
13782 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
13783 		ire_type = IRE_LOOPBACK;
13784 	else
13785 		ire_type = IRE_LOCAL;
13786 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE, B_TRUE, NULL);
13787 	if (ipif != NULL)
13788 		ipif_refhold_locked(ipif);
13789 	mutex_exit(&ill->ill_lock);
13790 	ill_refrele(ill);
13791 	return (ipif);
13792 }
13793 
13794 /*
13795  * Variant of the above that queues the request on the ipsq when
13796  * IPIF_CHANGING is set.
13797  */
13798 static ipif_t *
ipif_lookup_on_name_async(char * name,size_t namelen,boolean_t isv6,zoneid_t zoneid,queue_t * q,mblk_t * mp,ipsq_func_t func,int * error,ip_stack_t * ipst)13799 ipif_lookup_on_name_async(char *name, size_t namelen, boolean_t isv6,
13800     zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func, int *error,
13801     ip_stack_t *ipst)
13802 {
13803 	char	*cp;
13804 	char	*endp;
13805 	long	id;
13806 	ill_t	*ill;
13807 	ipif_t	*ipif;
13808 	boolean_t did_alloc = B_FALSE;
13809 	ipsq_t	*ipsq;
13810 
13811 	if (error != NULL)
13812 		*error = 0;
13813 
13814 	if (namelen == 0) {
13815 		if (error != NULL)
13816 			*error = ENXIO;
13817 		return (NULL);
13818 	}
13819 
13820 	/* Look for a colon in the name. */
13821 	endp = &name[namelen];
13822 	for (cp = endp; --cp > name; ) {
13823 		if (*cp == IPIF_SEPARATOR_CHAR)
13824 			break;
13825 	}
13826 
13827 	if (*cp == IPIF_SEPARATOR_CHAR) {
13828 		/*
13829 		 * Reject any non-decimal aliases for logical
13830 		 * interfaces. Aliases with leading zeroes
13831 		 * are also rejected as they introduce ambiguity
13832 		 * in the naming of the interfaces.
13833 		 * In order to confirm with existing semantics,
13834 		 * and to not break any programs/script relying
13835 		 * on that behaviour, if<0>:0 is considered to be
13836 		 * a valid interface.
13837 		 *
13838 		 * If alias has two or more digits and the first
13839 		 * is zero, fail.
13840 		 */
13841 		if (&cp[2] < endp && cp[1] == '0') {
13842 			if (error != NULL)
13843 				*error = EINVAL;
13844 			return (NULL);
13845 		}
13846 	}
13847 
13848 	if (cp <= name) {
13849 		cp = endp;
13850 	} else {
13851 		*cp = '\0';
13852 	}
13853 
13854 	/*
13855 	 * Look up the ILL, based on the portion of the name
13856 	 * before the slash. ill_lookup_on_name returns a held ill.
13857 	 * Temporary to check whether ill exists already. If so
13858 	 * ill_lookup_on_name will clear it.
13859 	 */
13860 	ill = ill_lookup_on_name(name, B_FALSE, isv6, &did_alloc, ipst);
13861 	if (cp != endp)
13862 		*cp = IPIF_SEPARATOR_CHAR;
13863 	if (ill == NULL)
13864 		return (NULL);
13865 
13866 	/* Establish the unit number in the name. */
13867 	id = 0;
13868 	if (cp < endp && *endp == '\0') {
13869 		/* If there was a colon, the unit number follows. */
13870 		cp++;
13871 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13872 			ill_refrele(ill);
13873 			if (error != NULL)
13874 				*error = ENXIO;
13875 			return (NULL);
13876 		}
13877 	}
13878 
13879 	GRAB_CONN_LOCK(q);
13880 	mutex_enter(&ill->ill_lock);
13881 	/* Now see if there is an IPIF with this unit number. */
13882 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13883 		if (ipif->ipif_id == id) {
13884 			if (zoneid != ALL_ZONES &&
13885 			    zoneid != ipif->ipif_zoneid &&
13886 			    ipif->ipif_zoneid != ALL_ZONES) {
13887 				mutex_exit(&ill->ill_lock);
13888 				RELEASE_CONN_LOCK(q);
13889 				ill_refrele(ill);
13890 				if (error != NULL)
13891 					*error = ENXIO;
13892 				return (NULL);
13893 			}
13894 
13895 			if (!(IPIF_IS_CHANGING(ipif) ||
13896 			    IPIF_IS_CONDEMNED(ipif)) ||
13897 			    IAM_WRITER_IPIF(ipif)) {
13898 				ipif_refhold_locked(ipif);
13899 				mutex_exit(&ill->ill_lock);
13900 				/*
13901 				 * Drop locks before calling ill_refrele
13902 				 * since it can potentially call into
13903 				 * ipif_ill_refrele_tail which can end up
13904 				 * in trying to acquire any lock.
13905 				 */
13906 				RELEASE_CONN_LOCK(q);
13907 				ill_refrele(ill);
13908 				return (ipif);
13909 			} else if (q != NULL && !IPIF_IS_CONDEMNED(ipif)) {
13910 				ipsq = ill->ill_phyint->phyint_ipsq;
13911 				mutex_enter(&ipsq->ipsq_lock);
13912 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
13913 				mutex_exit(&ill->ill_lock);
13914 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
13915 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
13916 				mutex_exit(&ipsq->ipsq_lock);
13917 				RELEASE_CONN_LOCK(q);
13918 				ill_refrele(ill);
13919 				if (error != NULL)
13920 					*error = EINPROGRESS;
13921 				return (NULL);
13922 			}
13923 		}
13924 	}
13925 	RELEASE_CONN_LOCK(q);
13926 	mutex_exit(&ill->ill_lock);
13927 	ill_refrele(ill);
13928 	if (error != NULL)
13929 		*error = ENXIO;
13930 	return (NULL);
13931 }
13932 
13933 /*
13934  * This routine is called whenever a new address comes up on an ipif.  If
13935  * we are configured to respond to address mask requests, then we are supposed
13936  * to broadcast an address mask reply at this time.  This routine is also
13937  * called if we are already up, but a netmask change is made.  This is legal
13938  * but might not make the system manager very popular.	(May be called
13939  * as writer.)
13940  */
13941 void
ipif_mask_reply(ipif_t * ipif)13942 ipif_mask_reply(ipif_t *ipif)
13943 {
13944 	icmph_t	*icmph;
13945 	ipha_t	*ipha;
13946 	mblk_t	*mp;
13947 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13948 	ip_xmit_attr_t ixas;
13949 
13950 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
13951 
13952 	if (!ipst->ips_ip_respond_to_address_mask_broadcast)
13953 		return;
13954 
13955 	/* ICMP mask reply is IPv4 only */
13956 	ASSERT(!ipif->ipif_isv6);
13957 	/* ICMP mask reply is not for a loopback interface */
13958 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
13959 
13960 	if (ipif->ipif_lcl_addr == INADDR_ANY)
13961 		return;
13962 
13963 	mp = allocb(REPLY_LEN, BPRI_HI);
13964 	if (mp == NULL)
13965 		return;
13966 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
13967 
13968 	ipha = (ipha_t *)mp->b_rptr;
13969 	bzero(ipha, REPLY_LEN);
13970 	*ipha = icmp_ipha;
13971 	ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
13972 	ipha->ipha_src = ipif->ipif_lcl_addr;
13973 	ipha->ipha_dst = ipif->ipif_brd_addr;
13974 	ipha->ipha_length = htons(REPLY_LEN);
13975 	ipha->ipha_ident = 0;
13976 
13977 	icmph = (icmph_t *)&ipha[1];
13978 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
13979 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
13980 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
13981 
13982 	bzero(&ixas, sizeof (ixas));
13983 	ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13984 	ixas.ixa_zoneid = ALL_ZONES;
13985 	ixas.ixa_ifindex = 0;
13986 	ixas.ixa_ipst = ipst;
13987 	ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
13988 	(void) ip_output_simple(mp, &ixas);
13989 	ixa_cleanup(&ixas);
13990 #undef	REPLY_LEN
13991 }
13992 
13993 /*
13994  * Join the ipif specific multicast groups.
13995  * Must be called after a mapping has been set up in the resolver.  (Always
13996  * called as writer.)
13997  */
13998 void
ipif_multicast_up(ipif_t * ipif)13999 ipif_multicast_up(ipif_t *ipif)
14000 {
14001 	int err;
14002 	ill_t *ill;
14003 	ilm_t *ilm;
14004 
14005 	ASSERT(IAM_WRITER_IPIF(ipif));
14006 
14007 	ill = ipif->ipif_ill;
14008 
14009 	ip1dbg(("ipif_multicast_up\n"));
14010 	if (!(ill->ill_flags & ILLF_MULTICAST) ||
14011 	    ipif->ipif_allhosts_ilm != NULL)
14012 		return;
14013 
14014 	if (ipif->ipif_isv6) {
14015 		in6_addr_t v6allmc = ipv6_all_hosts_mcast;
14016 		in6_addr_t v6solmc = ipv6_solicited_node_mcast;
14017 
14018 		v6solmc.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
14019 
14020 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
14021 			return;
14022 
14023 		ip1dbg(("ipif_multicast_up - addmulti\n"));
14024 
14025 		/*
14026 		 * Join the all hosts multicast address.  We skip this for
14027 		 * underlying IPMP interfaces since they should be invisible.
14028 		 */
14029 		if (!IS_UNDER_IPMP(ill)) {
14030 			ilm = ip_addmulti(&v6allmc, ill, ipif->ipif_zoneid,
14031 			    &err);
14032 			if (ilm == NULL) {
14033 				ASSERT(err != 0);
14034 				ip0dbg(("ipif_multicast_up: "
14035 				    "all_hosts_mcast failed %d\n", err));
14036 				return;
14037 			}
14038 			ipif->ipif_allhosts_ilm = ilm;
14039 		}
14040 
14041 		/*
14042 		 * Enable multicast for the solicited node multicast address.
14043 		 * If IPMP we need to put the membership on the upper ill.
14044 		 */
14045 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
14046 			ill_t *mcast_ill = NULL;
14047 			boolean_t need_refrele;
14048 
14049 			if (IS_UNDER_IPMP(ill) &&
14050 			    (mcast_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL) {
14051 				need_refrele = B_TRUE;
14052 			} else {
14053 				mcast_ill = ill;
14054 				need_refrele = B_FALSE;
14055 			}
14056 
14057 			ilm = ip_addmulti(&v6solmc, mcast_ill,
14058 			    ipif->ipif_zoneid, &err);
14059 			if (need_refrele)
14060 				ill_refrele(mcast_ill);
14061 
14062 			if (ilm == NULL) {
14063 				ASSERT(err != 0);
14064 				ip0dbg(("ipif_multicast_up: solicited MC"
14065 				    " failed %d\n", err));
14066 				if ((ilm = ipif->ipif_allhosts_ilm) != NULL) {
14067 					ipif->ipif_allhosts_ilm = NULL;
14068 					(void) ip_delmulti(ilm);
14069 				}
14070 				return;
14071 			}
14072 			ipif->ipif_solmulti_ilm = ilm;
14073 		}
14074 	} else {
14075 		in6_addr_t v6group;
14076 
14077 		if (ipif->ipif_lcl_addr == INADDR_ANY || IS_UNDER_IPMP(ill))
14078 			return;
14079 
14080 		/* Join the all hosts multicast address */
14081 		ip1dbg(("ipif_multicast_up - addmulti\n"));
14082 		IN6_IPADDR_TO_V4MAPPED(htonl(INADDR_ALLHOSTS_GROUP), &v6group);
14083 
14084 		ilm = ip_addmulti(&v6group, ill, ipif->ipif_zoneid, &err);
14085 		if (ilm == NULL) {
14086 			ASSERT(err != 0);
14087 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
14088 			return;
14089 		}
14090 		ipif->ipif_allhosts_ilm = ilm;
14091 	}
14092 }
14093 
14094 /*
14095  * Blow away any multicast groups that we joined in ipif_multicast_up().
14096  * (ilms from explicit memberships are handled in conn_update_ill.)
14097  */
14098 void
ipif_multicast_down(ipif_t * ipif)14099 ipif_multicast_down(ipif_t *ipif)
14100 {
14101 	ASSERT(IAM_WRITER_IPIF(ipif));
14102 
14103 	ip1dbg(("ipif_multicast_down\n"));
14104 
14105 	if (ipif->ipif_allhosts_ilm != NULL) {
14106 		(void) ip_delmulti(ipif->ipif_allhosts_ilm);
14107 		ipif->ipif_allhosts_ilm = NULL;
14108 	}
14109 	if (ipif->ipif_solmulti_ilm != NULL) {
14110 		(void) ip_delmulti(ipif->ipif_solmulti_ilm);
14111 		ipif->ipif_solmulti_ilm = NULL;
14112 	}
14113 }
14114 
14115 /*
14116  * Used when an interface comes up to recreate any extra routes on this
14117  * interface.
14118  */
14119 int
ill_recover_saved_ire(ill_t * ill)14120 ill_recover_saved_ire(ill_t *ill)
14121 {
14122 	mblk_t		*mp;
14123 	ip_stack_t	*ipst = ill->ill_ipst;
14124 
14125 	ip1dbg(("ill_recover_saved_ire(%s)", ill->ill_name));
14126 
14127 	mutex_enter(&ill->ill_saved_ire_lock);
14128 	for (mp = ill->ill_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
14129 		ire_t		*ire, *nire;
14130 		ifrt_t		*ifrt;
14131 
14132 		ifrt = (ifrt_t *)mp->b_rptr;
14133 		/*
14134 		 * Create a copy of the IRE with the saved address and netmask.
14135 		 */
14136 		if (ill->ill_isv6) {
14137 			ire = ire_create_v6(
14138 			    &ifrt->ifrt_v6addr,
14139 			    &ifrt->ifrt_v6mask,
14140 			    &ifrt->ifrt_v6gateway_addr,
14141 			    ifrt->ifrt_type,
14142 			    ill,
14143 			    ifrt->ifrt_zoneid,
14144 			    ifrt->ifrt_flags,
14145 			    NULL,
14146 			    ipst);
14147 		} else {
14148 			ire = ire_create(
14149 			    (uint8_t *)&ifrt->ifrt_addr,
14150 			    (uint8_t *)&ifrt->ifrt_mask,
14151 			    (uint8_t *)&ifrt->ifrt_gateway_addr,
14152 			    ifrt->ifrt_type,
14153 			    ill,
14154 			    ifrt->ifrt_zoneid,
14155 			    ifrt->ifrt_flags,
14156 			    NULL,
14157 			    ipst);
14158 		}
14159 		if (ire == NULL) {
14160 			mutex_exit(&ill->ill_saved_ire_lock);
14161 			return (ENOMEM);
14162 		}
14163 
14164 		if (ifrt->ifrt_flags & RTF_SETSRC) {
14165 			if (ill->ill_isv6) {
14166 				ire->ire_setsrc_addr_v6 =
14167 				    ifrt->ifrt_v6setsrc_addr;
14168 			} else {
14169 				ire->ire_setsrc_addr = ifrt->ifrt_setsrc_addr;
14170 			}
14171 		}
14172 
14173 		/*
14174 		 * Some software (for example, GateD and Sun Cluster) attempts
14175 		 * to create (what amount to) IRE_PREFIX routes with the
14176 		 * loopback address as the gateway.  This is primarily done to
14177 		 * set up prefixes with the RTF_REJECT flag set (for example,
14178 		 * when generating aggregate routes.)
14179 		 *
14180 		 * If the IRE type (as defined by ill->ill_net_type) is
14181 		 * IRE_LOOPBACK, then we map the request into a
14182 		 * IRE_IF_NORESOLVER.
14183 		 */
14184 		if (ill->ill_net_type == IRE_LOOPBACK)
14185 			ire->ire_type = IRE_IF_NORESOLVER;
14186 
14187 		/*
14188 		 * ire held by ire_add, will be refreled' towards the
14189 		 * the end of ipif_up_done
14190 		 */
14191 		nire = ire_add(ire);
14192 		/*
14193 		 * Check if it was a duplicate entry. This handles
14194 		 * the case of two racing route adds for the same route
14195 		 */
14196 		if (nire == NULL) {
14197 			ip1dbg(("ill_recover_saved_ire: FAILED\n"));
14198 		} else if (nire != ire) {
14199 			ip1dbg(("ill_recover_saved_ire: duplicate ire %p\n",
14200 			    (void *)nire));
14201 			ire_delete(nire);
14202 		} else {
14203 			ip1dbg(("ill_recover_saved_ire: added ire %p\n",
14204 			    (void *)nire));
14205 		}
14206 		if (nire != NULL)
14207 			ire_refrele(nire);
14208 	}
14209 	mutex_exit(&ill->ill_saved_ire_lock);
14210 	return (0);
14211 }
14212 
14213 /*
14214  * Used to set the netmask and broadcast address to default values when the
14215  * interface is brought up.  (Always called as writer.)
14216  */
14217 static void
ipif_set_default(ipif_t * ipif)14218 ipif_set_default(ipif_t *ipif)
14219 {
14220 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14221 
14222 	if (!ipif->ipif_isv6) {
14223 		/*
14224 		 * Interface holds an IPv4 address. Default
14225 		 * mask is the natural netmask.
14226 		 */
14227 		if (!ipif->ipif_net_mask) {
14228 			ipaddr_t	v4mask;
14229 
14230 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
14231 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
14232 		}
14233 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14234 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14235 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14236 		} else {
14237 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14238 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14239 		}
14240 		/*
14241 		 * NOTE: SunOS 4.X does this even if the broadcast address
14242 		 * has been already set thus we do the same here.
14243 		 */
14244 		if (ipif->ipif_flags & IPIF_BROADCAST) {
14245 			ipaddr_t	v4addr;
14246 
14247 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
14248 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
14249 		}
14250 	} else {
14251 		/*
14252 		 * Interface holds an IPv6-only address.  Default
14253 		 * mask is all-ones.
14254 		 */
14255 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
14256 			ipif->ipif_v6net_mask = ipv6_all_ones;
14257 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14258 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14259 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14260 		} else {
14261 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14262 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14263 		}
14264 	}
14265 }
14266 
14267 /*
14268  * Return 0 if this address can be used as local address without causing
14269  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
14270  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
14271  * Note that the same IPv6 link-local address is allowed as long as the ills
14272  * are not on the same link.
14273  */
14274 int
ip_addr_availability_check(ipif_t * new_ipif)14275 ip_addr_availability_check(ipif_t *new_ipif)
14276 {
14277 	in6_addr_t our_v6addr;
14278 	ill_t *ill;
14279 	ipif_t *ipif;
14280 	ill_walk_context_t ctx;
14281 	ip_stack_t	*ipst = new_ipif->ipif_ill->ill_ipst;
14282 
14283 	ASSERT(IAM_WRITER_IPIF(new_ipif));
14284 	ASSERT(MUTEX_HELD(&ipst->ips_ip_addr_avail_lock));
14285 	ASSERT(RW_READ_HELD(&ipst->ips_ill_g_lock));
14286 
14287 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
14288 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
14289 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
14290 		return (0);
14291 
14292 	our_v6addr = new_ipif->ipif_v6lcl_addr;
14293 
14294 	if (new_ipif->ipif_isv6)
14295 		ill = ILL_START_WALK_V6(&ctx, ipst);
14296 	else
14297 		ill = ILL_START_WALK_V4(&ctx, ipst);
14298 
14299 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
14300 		for (ipif = ill->ill_ipif; ipif != NULL;
14301 		    ipif = ipif->ipif_next) {
14302 			if ((ipif == new_ipif) ||
14303 			    !(ipif->ipif_flags & IPIF_UP) ||
14304 			    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
14305 			    !IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
14306 			    &our_v6addr))
14307 				continue;
14308 
14309 			if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
14310 				new_ipif->ipif_flags |= IPIF_UNNUMBERED;
14311 			else if (ipif->ipif_flags & IPIF_POINTOPOINT)
14312 				ipif->ipif_flags |= IPIF_UNNUMBERED;
14313 			else if ((IN6_IS_ADDR_LINKLOCAL(&our_v6addr) ||
14314 			    IN6_IS_ADDR_SITELOCAL(&our_v6addr)) &&
14315 			    !IS_ON_SAME_LAN(ill, new_ipif->ipif_ill))
14316 				continue;
14317 			else if (new_ipif->ipif_zoneid != ipif->ipif_zoneid &&
14318 			    ipif->ipif_zoneid != ALL_ZONES && IS_LOOPBACK(ill))
14319 				continue;
14320 			else if (new_ipif->ipif_ill == ill)
14321 				return (EADDRINUSE);
14322 			else
14323 				return (EADDRNOTAVAIL);
14324 		}
14325 	}
14326 
14327 	return (0);
14328 }
14329 
14330 /*
14331  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
14332  * IREs for the ipif.
14333  * When the routine returns EINPROGRESS then mp has been consumed and
14334  * the ioctl will be acked from ip_rput_dlpi.
14335  */
14336 int
ipif_up(ipif_t * ipif,queue_t * q,mblk_t * mp)14337 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
14338 {
14339 	ill_t		*ill = ipif->ipif_ill;
14340 	boolean_t	isv6 = ipif->ipif_isv6;
14341 	int		err = 0;
14342 	boolean_t	success;
14343 	uint_t		ipif_orig_id;
14344 	ip_stack_t	*ipst = ill->ill_ipst;
14345 
14346 	ASSERT(IAM_WRITER_IPIF(ipif));
14347 
14348 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
14349 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up",
14350 	    ill_t *, ill, ipif_t *, ipif);
14351 
14352 	/* Shouldn't get here if it is already up. */
14353 	if (ipif->ipif_flags & IPIF_UP)
14354 		return (EALREADY);
14355 
14356 	/*
14357 	 * If this is a request to bring up a data address on an interface
14358 	 * under IPMP, then move the address to its IPMP meta-interface and
14359 	 * try to bring it up.  One complication is that the zeroth ipif for
14360 	 * an ill is special, in that every ill always has one, and that code
14361 	 * throughout IP deferences ill->ill_ipif without holding any locks.
14362 	 */
14363 	if (IS_UNDER_IPMP(ill) && ipmp_ipif_is_dataaddr(ipif) &&
14364 	    (!ipif->ipif_isv6 || !V6_IPIF_LINKLOCAL(ipif))) {
14365 		ipif_t	*stubipif = NULL, *moveipif = NULL;
14366 		ill_t	*ipmp_ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
14367 
14368 		/*
14369 		 * The ipif being brought up should be quiesced.  If it's not,
14370 		 * something has gone amiss and we need to bail out.  (If it's
14371 		 * quiesced, we know it will remain so via IPIF_CONDEMNED.)
14372 		 */
14373 		mutex_enter(&ill->ill_lock);
14374 		if (!ipif_is_quiescent(ipif)) {
14375 			mutex_exit(&ill->ill_lock);
14376 			return (EINVAL);
14377 		}
14378 		mutex_exit(&ill->ill_lock);
14379 
14380 		/*
14381 		 * If we're going to need to allocate ipifs, do it prior
14382 		 * to starting the move (and grabbing locks).
14383 		 */
14384 		if (ipif->ipif_id == 0) {
14385 			if ((moveipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14386 			    B_FALSE, &err)) == NULL) {
14387 				return (err);
14388 			}
14389 			if ((stubipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14390 			    B_FALSE, &err)) == NULL) {
14391 				mi_free(moveipif);
14392 				return (err);
14393 			}
14394 		}
14395 
14396 		/*
14397 		 * Grab or transfer the ipif to move.  During the move, keep
14398 		 * ill_g_lock held to prevent any ill walker threads from
14399 		 * seeing things in an inconsistent state.
14400 		 */
14401 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
14402 		if (ipif->ipif_id != 0) {
14403 			ipif_remove(ipif);
14404 		} else {
14405 			ipif_transfer(ipif, moveipif, stubipif);
14406 			ipif = moveipif;
14407 		}
14408 
14409 		/*
14410 		 * Place the ipif on the IPMP ill.  If the zeroth ipif on
14411 		 * the IPMP ill is a stub (0.0.0.0 down address) then we
14412 		 * replace that one.  Otherwise, pick the next available slot.
14413 		 */
14414 		ipif->ipif_ill = ipmp_ill;
14415 		ipif_orig_id = ipif->ipif_id;
14416 
14417 		if (ipmp_ipif_is_stubaddr(ipmp_ill->ill_ipif)) {
14418 			ipif_transfer(ipif, ipmp_ill->ill_ipif, NULL);
14419 			ipif = ipmp_ill->ill_ipif;
14420 		} else {
14421 			ipif->ipif_id = -1;
14422 			if ((err = ipif_insert(ipif, B_FALSE)) != 0) {
14423 				/*
14424 				 * No more available ipif_id's -- put it back
14425 				 * on the original ill and fail the operation.
14426 				 * Since we're writer on the ill, we can be
14427 				 * sure our old slot is still available.
14428 				 */
14429 				ipif->ipif_id = ipif_orig_id;
14430 				ipif->ipif_ill = ill;
14431 				if (ipif_orig_id == 0) {
14432 					ipif_transfer(ipif, ill->ill_ipif,
14433 					    NULL);
14434 				} else {
14435 					VERIFY(ipif_insert(ipif, B_FALSE) == 0);
14436 				}
14437 				rw_exit(&ipst->ips_ill_g_lock);
14438 				return (err);
14439 			}
14440 		}
14441 		rw_exit(&ipst->ips_ill_g_lock);
14442 
14443 		/*
14444 		 * Tell SCTP that the ipif has moved.  Note that even if we
14445 		 * had to allocate a new ipif, the original sequence id was
14446 		 * preserved and therefore SCTP won't know.
14447 		 */
14448 		sctp_move_ipif(ipif, ill, ipmp_ill);
14449 
14450 		/*
14451 		 * If the ipif being brought up was on slot zero, then we
14452 		 * first need to bring up the placeholder we stuck there.  In
14453 		 * ip_rput_dlpi_writer(), arp_bringup_done(), or the recursive
14454 		 * call to ipif_up() itself, if we successfully bring up the
14455 		 * placeholder, we'll check ill_move_ipif and bring it up too.
14456 		 */
14457 		if (ipif_orig_id == 0) {
14458 			ASSERT(ill->ill_move_ipif == NULL);
14459 			ill->ill_move_ipif = ipif;
14460 			if ((err = ipif_up(ill->ill_ipif, q, mp)) == 0)
14461 				ASSERT(ill->ill_move_ipif == NULL);
14462 			if (err != EINPROGRESS)
14463 				ill->ill_move_ipif = NULL;
14464 			return (err);
14465 		}
14466 
14467 		/*
14468 		 * Bring it up on the IPMP ill.
14469 		 */
14470 		return (ipif_up(ipif, q, mp));
14471 	}
14472 
14473 	/* Skip arp/ndp for any loopback interface. */
14474 	if (ill->ill_wq != NULL) {
14475 		conn_t *connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14476 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
14477 
14478 		if (!ill->ill_dl_up) {
14479 			/*
14480 			 * ill_dl_up is not yet set. i.e. we are yet to
14481 			 * DL_BIND with the driver and this is the first
14482 			 * logical interface on the ill to become "up".
14483 			 * Tell the driver to get going (via DL_BIND_REQ).
14484 			 * Note that changing "significant" IFF_ flags
14485 			 * address/netmask etc cause a down/up dance, but
14486 			 * does not cause an unbind (DL_UNBIND) with the driver
14487 			 */
14488 			return (ill_dl_up(ill, ipif, mp, q));
14489 		}
14490 
14491 		/*
14492 		 * ipif_resolver_up may end up needeing to bind/attach
14493 		 * the ARP stream, which in turn necessitates a
14494 		 * DLPI message exchange with the driver. ioctls are
14495 		 * serialized and so we cannot send more than one
14496 		 * interface up message at a time. If ipif_resolver_up
14497 		 * does need to wait for the DLPI handshake for the ARP stream,
14498 		 * we get EINPROGRESS and we will complete in arp_bringup_done.
14499 		 */
14500 
14501 		ASSERT(connp != NULL || !CONN_Q(q));
14502 		if (connp != NULL)
14503 			mutex_enter(&connp->conn_lock);
14504 		mutex_enter(&ill->ill_lock);
14505 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14506 		mutex_exit(&ill->ill_lock);
14507 		if (connp != NULL)
14508 			mutex_exit(&connp->conn_lock);
14509 		if (!success)
14510 			return (EINTR);
14511 
14512 		/*
14513 		 * Crank up IPv6 neighbor discovery. Unlike ARP, this should
14514 		 * complete when ipif_ndp_up returns.
14515 		 */
14516 		err = ipif_resolver_up(ipif, Res_act_initial);
14517 		if (err == EINPROGRESS) {
14518 			/* We will complete it in arp_bringup_done() */
14519 			return (err);
14520 		}
14521 
14522 		if (isv6 && err == 0)
14523 			err = ipif_ndp_up(ipif, B_TRUE);
14524 
14525 		ASSERT(err != EINPROGRESS);
14526 		mp = ipsq_pending_mp_get(ipsq, &connp);
14527 		ASSERT(mp != NULL);
14528 		if (err != 0)
14529 			return (err);
14530 	} else {
14531 		/*
14532 		 * Interfaces without underlying hardware don't do duplicate
14533 		 * address detection.
14534 		 */
14535 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
14536 		ipif->ipif_addr_ready = 1;
14537 		err = ill_add_ires(ill);
14538 		/* allocation failure? */
14539 		if (err != 0)
14540 			return (err);
14541 	}
14542 
14543 	err = (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
14544 	if (err == 0 && ill->ill_move_ipif != NULL) {
14545 		ipif = ill->ill_move_ipif;
14546 		ill->ill_move_ipif = NULL;
14547 		return (ipif_up(ipif, q, mp));
14548 	}
14549 	return (err);
14550 }
14551 
14552 /*
14553  * Add any IREs tied to the ill. For now this is just an IRE_MULTICAST.
14554  * The identical set of IREs need to be removed in ill_delete_ires().
14555  */
14556 int
ill_add_ires(ill_t * ill)14557 ill_add_ires(ill_t *ill)
14558 {
14559 	ire_t	*ire;
14560 	in6_addr_t dummy6 = {(uint32_t)V6_MCAST, 0, 0, 1};
14561 	in_addr_t dummy4 = htonl(INADDR_ALLHOSTS_GROUP);
14562 
14563 	if (ill->ill_ire_multicast != NULL)
14564 		return (0);
14565 
14566 	/*
14567 	 * provide some dummy ire_addr for creating the ire.
14568 	 */
14569 	if (ill->ill_isv6) {
14570 		ire = ire_create_v6(&dummy6, 0, 0, IRE_MULTICAST, ill,
14571 		    ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14572 	} else {
14573 		ire = ire_create((uchar_t *)&dummy4, 0, 0, IRE_MULTICAST, ill,
14574 		    ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14575 	}
14576 	if (ire == NULL)
14577 		return (ENOMEM);
14578 
14579 	ill->ill_ire_multicast = ire;
14580 	return (0);
14581 }
14582 
14583 void
ill_delete_ires(ill_t * ill)14584 ill_delete_ires(ill_t *ill)
14585 {
14586 	if (ill->ill_ire_multicast != NULL) {
14587 		/*
14588 		 * BIND/ATTACH completed; Release the ref for ill_ire_multicast
14589 		 * which was taken without any th_tracing enabled.
14590 		 * We also mark it as condemned (note that it was never added)
14591 		 * so that caching conn's can move off of it.
14592 		 */
14593 		ire_make_condemned(ill->ill_ire_multicast);
14594 		ire_refrele_notr(ill->ill_ire_multicast);
14595 		ill->ill_ire_multicast = NULL;
14596 	}
14597 }
14598 
14599 /*
14600  * Perform a bind for the physical device.
14601  * When the routine returns EINPROGRESS then mp has been consumed and
14602  * the ioctl will be acked from ip_rput_dlpi.
14603  * Allocate an unbind message and save it until ipif_down.
14604  */
14605 static int
ill_dl_up(ill_t * ill,ipif_t * ipif,mblk_t * mp,queue_t * q)14606 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
14607 {
14608 	mblk_t	*bind_mp = NULL;
14609 	mblk_t	*unbind_mp = NULL;
14610 	conn_t	*connp;
14611 	boolean_t success;
14612 	int	err;
14613 
14614 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_up", ill_t *, ill);
14615 
14616 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
14617 	ASSERT(IAM_WRITER_ILL(ill));
14618 	ASSERT(mp != NULL);
14619 
14620 	/*
14621 	 * Make sure we have an IRE_MULTICAST in case we immediately
14622 	 * start receiving packets.
14623 	 */
14624 	err = ill_add_ires(ill);
14625 	if (err != 0)
14626 		goto bad;
14627 
14628 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
14629 	    DL_BIND_REQ);
14630 	if (bind_mp == NULL)
14631 		goto bad;
14632 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
14633 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
14634 
14635 	/*
14636 	 * ill_unbind_mp would be non-null if the following sequence had
14637 	 * happened:
14638 	 * - send DL_BIND_REQ to driver, wait for response
14639 	 * - multiple ioctls that need to bring the ipif up are encountered,
14640 	 *   but they cannot enter the ipsq due to the outstanding DL_BIND_REQ.
14641 	 *   These ioctls will then be enqueued on the ipsq
14642 	 * - a DL_ERROR_ACK is returned for the DL_BIND_REQ
14643 	 * At this point, the pending ioctls in the ipsq will be drained, and
14644 	 * since ill->ill_dl_up was not set, ill_dl_up would be invoked with
14645 	 * a non-null ill->ill_unbind_mp
14646 	 */
14647 	if (ill->ill_unbind_mp == NULL) {
14648 		unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t),
14649 		    DL_UNBIND_REQ);
14650 		if (unbind_mp == NULL)
14651 			goto bad;
14652 	}
14653 	/*
14654 	 * Record state needed to complete this operation when the
14655 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
14656 	 */
14657 	connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14658 	ASSERT(connp != NULL || !CONN_Q(q));
14659 	GRAB_CONN_LOCK(q);
14660 	mutex_enter(&ipif->ipif_ill->ill_lock);
14661 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14662 	mutex_exit(&ipif->ipif_ill->ill_lock);
14663 	RELEASE_CONN_LOCK(q);
14664 	if (!success)
14665 		goto bad;
14666 
14667 	/*
14668 	 * Save the unbind message for ill_dl_down(); it will be consumed when
14669 	 * the interface goes down.
14670 	 */
14671 	if (ill->ill_unbind_mp == NULL)
14672 		ill->ill_unbind_mp = unbind_mp;
14673 
14674 	ill_dlpi_send(ill, bind_mp);
14675 	/* Send down link-layer capabilities probe if not already done. */
14676 	ill_capability_probe(ill);
14677 
14678 	/*
14679 	 * Sysid used to rely on the fact that netboots set domainname
14680 	 * and the like. Now that miniroot boots aren't strictly netboots
14681 	 * and miniroot network configuration is driven from userland
14682 	 * these things still need to be set. This situation can be detected
14683 	 * by comparing the interface being configured here to the one
14684 	 * dhcifname was set to reference by the boot loader. Once sysid is
14685 	 * converted to use dhcp_ipc_getinfo() this call can go away.
14686 	 */
14687 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) &&
14688 	    (strcmp(ill->ill_name, dhcifname) == 0) &&
14689 	    (strlen(srpc_domain) == 0)) {
14690 		if (dhcpinit() != 0)
14691 			cmn_err(CE_WARN, "no cached dhcp response");
14692 	}
14693 
14694 	/*
14695 	 * This operation will complete in ip_rput_dlpi with either
14696 	 * a DL_BIND_ACK or DL_ERROR_ACK.
14697 	 */
14698 	return (EINPROGRESS);
14699 bad:
14700 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
14701 
14702 	freemsg(bind_mp);
14703 	freemsg(unbind_mp);
14704 	return (ENOMEM);
14705 }
14706 
14707 /* Add room for tcp+ip headers */
14708 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
14709 
14710 /*
14711  * DLPI and ARP is up.
14712  * Create all the IREs associated with an interface. Bring up multicast.
14713  * Set the interface flag and finish other initialization
14714  * that potentially had to be deferred to after DL_BIND_ACK.
14715  */
14716 int
ipif_up_done(ipif_t * ipif)14717 ipif_up_done(ipif_t *ipif)
14718 {
14719 	ill_t		*ill = ipif->ipif_ill;
14720 	int		err = 0;
14721 	boolean_t	loopback = B_FALSE;
14722 	boolean_t	update_src_selection = B_TRUE;
14723 	ipif_t		*tmp_ipif;
14724 
14725 	ip1dbg(("ipif_up_done(%s:%u)\n",
14726 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
14727 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done",
14728 	    ill_t *, ill, ipif_t *, ipif);
14729 
14730 	/* Check if this is a loopback interface */
14731 	if (ipif->ipif_ill->ill_wq == NULL)
14732 		loopback = B_TRUE;
14733 
14734 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14735 
14736 	/*
14737 	 * If all other interfaces for this ill are down or DEPRECATED,
14738 	 * or otherwise unsuitable for source address selection,
14739 	 * reset the src generation numbers to make sure source
14740 	 * address selection gets to take this new ipif into account.
14741 	 * No need to hold ill_lock while traversing the ipif list since
14742 	 * we are writer
14743 	 */
14744 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
14745 	    tmp_ipif = tmp_ipif->ipif_next) {
14746 		if (((tmp_ipif->ipif_flags &
14747 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
14748 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
14749 		    (tmp_ipif == ipif))
14750 			continue;
14751 		/* first useable pre-existing interface */
14752 		update_src_selection = B_FALSE;
14753 		break;
14754 	}
14755 	if (update_src_selection)
14756 		ip_update_source_selection(ill->ill_ipst);
14757 
14758 	if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) {
14759 		nce_t *loop_nce = NULL;
14760 		uint16_t flags = (NCE_F_MYADDR | NCE_F_AUTHORITY | NCE_F_NONUD);
14761 
14762 		/*
14763 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
14764 		 * ipif_lookup_on_name(), but in the case of zones we can have
14765 		 * several loopback addresses on lo0. So all the interfaces with
14766 		 * loopback addresses need to be marked IRE_LOOPBACK.
14767 		 */
14768 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
14769 		    htonl(INADDR_LOOPBACK))
14770 			ipif->ipif_ire_type = IRE_LOOPBACK;
14771 		else
14772 			ipif->ipif_ire_type = IRE_LOCAL;
14773 		if (ill->ill_net_type != IRE_LOOPBACK)
14774 			flags |= NCE_F_PUBLISH;
14775 
14776 		/* add unicast nce for the local addr */
14777 		err = nce_lookup_then_add_v4(ill, NULL,
14778 		    ill->ill_phys_addr_length, &ipif->ipif_lcl_addr, flags,
14779 		    ND_REACHABLE, &loop_nce);
14780 		/* A shared-IP zone sees EEXIST for lo0:N */
14781 		if (err == 0 || err == EEXIST) {
14782 			ipif->ipif_added_nce = 1;
14783 			loop_nce->nce_ipif_cnt++;
14784 			nce_refrele(loop_nce);
14785 			err = 0;
14786 		} else {
14787 			ASSERT(loop_nce == NULL);
14788 			return (err);
14789 		}
14790 	}
14791 
14792 	/* Create all the IREs associated with this interface */
14793 	err = ipif_add_ires_v4(ipif, loopback);
14794 	if (err != 0) {
14795 		/*
14796 		 * see comments about return value from
14797 		 * ip_addr_availability_check() in ipif_add_ires_v4().
14798 		 */
14799 		if (err != EADDRINUSE) {
14800 			(void) ipif_arp_down(ipif);
14801 		} else {
14802 			/*
14803 			 * Make IPMP aware of the deleted ipif so that
14804 			 * the needed ipmp cleanup (e.g., of ipif_bound_ill)
14805 			 * can be completed. Note that we do not want to
14806 			 * destroy the nce that was created on the ipmp_ill
14807 			 * for the active copy of the duplicate address in
14808 			 * use.
14809 			 */
14810 			if (IS_IPMP(ill))
14811 				ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
14812 			err = EADDRNOTAVAIL;
14813 		}
14814 		return (err);
14815 	}
14816 
14817 	if (ill->ill_ipif_up_count == 1 && !loopback) {
14818 		/* Recover any additional IREs entries for this ill */
14819 		(void) ill_recover_saved_ire(ill);
14820 	}
14821 
14822 	if (ill->ill_need_recover_multicast) {
14823 		/*
14824 		 * Need to recover all multicast memberships in the driver.
14825 		 * This had to be deferred until we had attached.  The same
14826 		 * code exists in ipif_up_done_v6() to recover IPv6
14827 		 * memberships.
14828 		 *
14829 		 * Note that it would be preferable to unconditionally do the
14830 		 * ill_recover_multicast() in ill_dl_up(), but we cannot do
14831 		 * that since ill_join_allmulti() depends on ill_dl_up being
14832 		 * set, and it is not set until we receive a DL_BIND_ACK after
14833 		 * having called ill_dl_up().
14834 		 */
14835 		ill_recover_multicast(ill);
14836 	}
14837 
14838 	if (ill->ill_ipif_up_count == 1) {
14839 		/*
14840 		 * Since the interface is now up, it may now be active.
14841 		 */
14842 		if (IS_UNDER_IPMP(ill))
14843 			ipmp_ill_refresh_active(ill);
14844 
14845 		/*
14846 		 * If this is an IPMP interface, we may now be able to
14847 		 * establish ARP entries.
14848 		 */
14849 		if (IS_IPMP(ill))
14850 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
14851 	}
14852 
14853 	/* Join the allhosts multicast address */
14854 	ipif_multicast_up(ipif);
14855 
14856 	if (!loopback && !update_src_selection &&
14857 	    !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)))
14858 		ip_update_source_selection(ill->ill_ipst);
14859 
14860 	if (!loopback && ipif->ipif_addr_ready) {
14861 		/* Broadcast an address mask reply. */
14862 		ipif_mask_reply(ipif);
14863 	}
14864 	/* Perhaps ilgs should use this ill */
14865 	update_conn_ill(NULL, ill->ill_ipst);
14866 
14867 	/*
14868 	 * This had to be deferred until we had bound.  Tell routing sockets and
14869 	 * others that this interface is up if it looks like the address has
14870 	 * been validated.  Otherwise, if it isn't ready yet, wait for
14871 	 * duplicate address detection to do its thing.
14872 	 */
14873 	if (ipif->ipif_addr_ready)
14874 		ipif_up_notify(ipif);
14875 	return (0);
14876 }
14877 
14878 /*
14879  * Add the IREs associated with the ipif.
14880  * Those MUST be explicitly removed in ipif_delete_ires_v4.
14881  */
14882 static int
ipif_add_ires_v4(ipif_t * ipif,boolean_t loopback)14883 ipif_add_ires_v4(ipif_t *ipif, boolean_t loopback)
14884 {
14885 	ill_t		*ill = ipif->ipif_ill;
14886 	ip_stack_t	*ipst = ill->ill_ipst;
14887 	ire_t		*ire_array[20];
14888 	ire_t		**irep = ire_array;
14889 	ire_t		**irep1;
14890 	ipaddr_t	net_mask = 0;
14891 	ipaddr_t	subnet_mask, route_mask;
14892 	int		err;
14893 	ire_t		*ire_local = NULL;	/* LOCAL or LOOPBACK */
14894 	ire_t		*ire_if = NULL;
14895 	uchar_t		*gw;
14896 
14897 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14898 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14899 		/*
14900 		 * If we're on a labeled system then make sure that zone-
14901 		 * private addresses have proper remote host database entries.
14902 		 */
14903 		if (is_system_labeled() &&
14904 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
14905 		    !tsol_check_interface_address(ipif))
14906 			return (EINVAL);
14907 
14908 		/* Register the source address for __sin6_src_id */
14909 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
14910 		    ipif->ipif_zoneid, ipst);
14911 		if (err != 0) {
14912 			ip0dbg(("ipif_add_ires: srcid_insert %d\n", err));
14913 			return (err);
14914 		}
14915 
14916 		if (loopback)
14917 			gw = (uchar_t *)&ipif->ipif_lcl_addr;
14918 		else
14919 			gw = NULL;
14920 
14921 		/* If the interface address is set, create the local IRE. */
14922 		ire_local = ire_create(
14923 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
14924 		    (uchar_t *)&ip_g_all_ones,		/* mask */
14925 		    gw,					/* gateway */
14926 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
14927 		    ipif->ipif_ill,
14928 		    ipif->ipif_zoneid,
14929 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
14930 		    RTF_PRIVATE : 0) | RTF_KERNEL,
14931 		    NULL,
14932 		    ipst);
14933 		ip1dbg(("ipif_add_ires: 0x%p creating IRE %p type 0x%x"
14934 		    " for 0x%x\n", (void *)ipif, (void *)ire_local,
14935 		    ipif->ipif_ire_type,
14936 		    ntohl(ipif->ipif_lcl_addr)));
14937 		if (ire_local == NULL) {
14938 			ip1dbg(("ipif_up_done: NULL ire_local\n"));
14939 			err = ENOMEM;
14940 			goto bad;
14941 		}
14942 	} else {
14943 		ip1dbg((
14944 		    "ipif_add_ires: not creating IRE %d for 0x%x: flags 0x%x\n",
14945 		    ipif->ipif_ire_type,
14946 		    ntohl(ipif->ipif_lcl_addr),
14947 		    (uint_t)ipif->ipif_flags));
14948 	}
14949 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14950 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14951 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14952 	} else {
14953 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
14954 	}
14955 
14956 	subnet_mask = ipif->ipif_net_mask;
14957 
14958 	/*
14959 	 * If mask was not specified, use natural netmask of
14960 	 * interface address. Also, store this mask back into the
14961 	 * ipif struct.
14962 	 */
14963 	if (subnet_mask == 0) {
14964 		subnet_mask = net_mask;
14965 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
14966 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
14967 		    ipif->ipif_v6subnet);
14968 	}
14969 
14970 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
14971 	if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
14972 	    ipif->ipif_subnet != INADDR_ANY) {
14973 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14974 
14975 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14976 			route_mask = IP_HOST_MASK;
14977 		} else {
14978 			route_mask = subnet_mask;
14979 		}
14980 
14981 		ip1dbg(("ipif_add_ires: ipif 0x%p ill 0x%p "
14982 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
14983 		    (void *)ipif, (void *)ill, ill->ill_net_type,
14984 		    ntohl(ipif->ipif_subnet)));
14985 		ire_if = ire_create(
14986 		    (uchar_t *)&ipif->ipif_subnet,
14987 		    (uchar_t *)&route_mask,
14988 		    (uchar_t *)&ipif->ipif_lcl_addr,
14989 		    ill->ill_net_type,
14990 		    ill,
14991 		    ipif->ipif_zoneid,
14992 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
14993 		    RTF_PRIVATE: 0) | RTF_KERNEL,
14994 		    NULL,
14995 		    ipst);
14996 		if (ire_if == NULL) {
14997 			ip1dbg(("ipif_up_done: NULL ire_if\n"));
14998 			err = ENOMEM;
14999 			goto bad;
15000 		}
15001 	}
15002 
15003 	/*
15004 	 * Create any necessary broadcast IREs.
15005 	 */
15006 	if ((ipif->ipif_flags & IPIF_BROADCAST) &&
15007 	    !(ipif->ipif_flags & IPIF_NOXMIT))
15008 		irep = ipif_create_bcast_ires(ipif, irep);
15009 
15010 	/* If an earlier ire_create failed, get out now */
15011 	for (irep1 = irep; irep1 > ire_array; ) {
15012 		irep1--;
15013 		if (*irep1 == NULL) {
15014 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
15015 			err = ENOMEM;
15016 			goto bad;
15017 		}
15018 	}
15019 
15020 	/*
15021 	 * Need to atomically check for IP address availability under
15022 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
15023 	 * ills or new ipifs can be added while we are checking availability.
15024 	 */
15025 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15026 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
15027 	/* Mark it up, and increment counters. */
15028 	ipif->ipif_flags |= IPIF_UP;
15029 	ill->ill_ipif_up_count++;
15030 	err = ip_addr_availability_check(ipif);
15031 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
15032 	rw_exit(&ipst->ips_ill_g_lock);
15033 
15034 	if (err != 0) {
15035 		/*
15036 		 * Our address may already be up on the same ill. In this case,
15037 		 * the ARP entry for our ipif replaced the one for the other
15038 		 * ipif. So we don't want to delete it (otherwise the other ipif
15039 		 * would be unable to send packets).
15040 		 * ip_addr_availability_check() identifies this case for us and
15041 		 * returns EADDRINUSE; Caller should turn it into EADDRNOTAVAIL
15042 		 * which is the expected error code.
15043 		 */
15044 		ill->ill_ipif_up_count--;
15045 		ipif->ipif_flags &= ~IPIF_UP;
15046 		goto bad;
15047 	}
15048 
15049 	/*
15050 	 * Add in all newly created IREs.  ire_create_bcast() has
15051 	 * already checked for duplicates of the IRE_BROADCAST type.
15052 	 * We add the IRE_INTERFACE before the IRE_LOCAL to ensure
15053 	 * that lookups find the IRE_LOCAL even if the IRE_INTERFACE is
15054 	 * a /32 route.
15055 	 */
15056 	if (ire_if != NULL) {
15057 		ire_if = ire_add(ire_if);
15058 		if (ire_if == NULL) {
15059 			err = ENOMEM;
15060 			goto bad2;
15061 		}
15062 #ifdef DEBUG
15063 		ire_refhold_notr(ire_if);
15064 		ire_refrele(ire_if);
15065 #endif
15066 	}
15067 	if (ire_local != NULL) {
15068 		ire_local = ire_add(ire_local);
15069 		if (ire_local == NULL) {
15070 			err = ENOMEM;
15071 			goto bad2;
15072 		}
15073 #ifdef DEBUG
15074 		ire_refhold_notr(ire_local);
15075 		ire_refrele(ire_local);
15076 #endif
15077 	}
15078 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15079 	if (ire_local != NULL)
15080 		ipif->ipif_ire_local = ire_local;
15081 	if (ire_if != NULL)
15082 		ipif->ipif_ire_if = ire_if;
15083 	rw_exit(&ipst->ips_ill_g_lock);
15084 	ire_local = NULL;
15085 	ire_if = NULL;
15086 
15087 	/*
15088 	 * We first add all of them, and if that succeeds we refrele the
15089 	 * bunch. That enables us to delete all of them should any of the
15090 	 * ire_adds fail.
15091 	 */
15092 	for (irep1 = irep; irep1 > ire_array; ) {
15093 		irep1--;
15094 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ill->ill_lock)));
15095 		*irep1 = ire_add(*irep1);
15096 		if (*irep1 == NULL) {
15097 			err = ENOMEM;
15098 			goto bad2;
15099 		}
15100 	}
15101 
15102 	for (irep1 = irep; irep1 > ire_array; ) {
15103 		irep1--;
15104 		/* refheld by ire_add. */
15105 		if (*irep1 != NULL) {
15106 			ire_refrele(*irep1);
15107 			*irep1 = NULL;
15108 		}
15109 	}
15110 
15111 	if (!loopback) {
15112 		/*
15113 		 * If the broadcast address has been set, make sure it makes
15114 		 * sense based on the interface address.
15115 		 * Only match on ill since we are sharing broadcast addresses.
15116 		 */
15117 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
15118 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
15119 			ire_t	*ire;
15120 
15121 			ire = ire_ftable_lookup_v4(ipif->ipif_brd_addr, 0, 0,
15122 			    IRE_BROADCAST, ipif->ipif_ill, ALL_ZONES, NULL,
15123 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL), 0, ipst, NULL);
15124 
15125 			if (ire == NULL) {
15126 				/*
15127 				 * If there isn't a matching broadcast IRE,
15128 				 * revert to the default for this netmask.
15129 				 */
15130 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
15131 				mutex_enter(&ipif->ipif_ill->ill_lock);
15132 				ipif_set_default(ipif);
15133 				mutex_exit(&ipif->ipif_ill->ill_lock);
15134 			} else {
15135 				ire_refrele(ire);
15136 			}
15137 		}
15138 
15139 	}
15140 	return (0);
15141 
15142 bad2:
15143 	ill->ill_ipif_up_count--;
15144 	ipif->ipif_flags &= ~IPIF_UP;
15145 
15146 bad:
15147 	ip1dbg(("ipif_add_ires: FAILED \n"));
15148 	if (ire_local != NULL)
15149 		ire_delete(ire_local);
15150 	if (ire_if != NULL)
15151 		ire_delete(ire_if);
15152 
15153 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15154 	ire_local = ipif->ipif_ire_local;
15155 	ipif->ipif_ire_local = NULL;
15156 	ire_if = ipif->ipif_ire_if;
15157 	ipif->ipif_ire_if = NULL;
15158 	rw_exit(&ipst->ips_ill_g_lock);
15159 	if (ire_local != NULL) {
15160 		ire_delete(ire_local);
15161 		ire_refrele_notr(ire_local);
15162 	}
15163 	if (ire_if != NULL) {
15164 		ire_delete(ire_if);
15165 		ire_refrele_notr(ire_if);
15166 	}
15167 
15168 	while (irep > ire_array) {
15169 		irep--;
15170 		if (*irep != NULL) {
15171 			ire_delete(*irep);
15172 		}
15173 	}
15174 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
15175 
15176 	return (err);
15177 }
15178 
15179 /* Remove all the IREs created by ipif_add_ires_v4 */
15180 void
ipif_delete_ires_v4(ipif_t * ipif)15181 ipif_delete_ires_v4(ipif_t *ipif)
15182 {
15183 	ill_t		*ill = ipif->ipif_ill;
15184 	ip_stack_t	*ipst = ill->ill_ipst;
15185 	ire_t		*ire;
15186 
15187 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15188 	ire = ipif->ipif_ire_local;
15189 	ipif->ipif_ire_local = NULL;
15190 	rw_exit(&ipst->ips_ill_g_lock);
15191 	if (ire != NULL) {
15192 		/*
15193 		 * Move count to ipif so we don't loose the count due to
15194 		 * a down/up dance.
15195 		 */
15196 		atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count);
15197 
15198 		ire_delete(ire);
15199 		ire_refrele_notr(ire);
15200 	}
15201 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15202 	ire = ipif->ipif_ire_if;
15203 	ipif->ipif_ire_if = NULL;
15204 	rw_exit(&ipst->ips_ill_g_lock);
15205 	if (ire != NULL) {
15206 		ire_delete(ire);
15207 		ire_refrele_notr(ire);
15208 	}
15209 
15210 	/*
15211 	 * Delete the broadcast IREs.
15212 	 */
15213 	if ((ipif->ipif_flags & IPIF_BROADCAST) &&
15214 	    !(ipif->ipif_flags & IPIF_NOXMIT))
15215 		ipif_delete_bcast_ires(ipif);
15216 }
15217 
15218 /*
15219  * Checks for availbility of a usable source address (if there is one) when the
15220  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
15221  * this selection is done regardless of the destination.
15222  */
15223 boolean_t
ipif_zone_avail(uint_t ifindex,boolean_t isv6,zoneid_t zoneid,ip_stack_t * ipst)15224 ipif_zone_avail(uint_t ifindex, boolean_t isv6, zoneid_t zoneid,
15225     ip_stack_t *ipst)
15226 {
15227 	ipif_t		*ipif = NULL;
15228 	ill_t		*uill;
15229 
15230 	ASSERT(ifindex != 0);
15231 
15232 	uill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
15233 	if (uill == NULL)
15234 		return (B_FALSE);
15235 
15236 	mutex_enter(&uill->ill_lock);
15237 	for (ipif = uill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15238 		if (IPIF_IS_CONDEMNED(ipif))
15239 			continue;
15240 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15241 			continue;
15242 		if (!(ipif->ipif_flags & IPIF_UP))
15243 			continue;
15244 		if (ipif->ipif_zoneid != zoneid)
15245 			continue;
15246 		if (isv6 ? IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15247 		    ipif->ipif_lcl_addr == INADDR_ANY)
15248 			continue;
15249 		mutex_exit(&uill->ill_lock);
15250 		ill_refrele(uill);
15251 		return (B_TRUE);
15252 	}
15253 	mutex_exit(&uill->ill_lock);
15254 	ill_refrele(uill);
15255 	return (B_FALSE);
15256 }
15257 
15258 /*
15259  * Find an ipif with a good local address on the ill+zoneid.
15260  */
15261 ipif_t *
ipif_good_addr(ill_t * ill,zoneid_t zoneid)15262 ipif_good_addr(ill_t *ill, zoneid_t zoneid)
15263 {
15264 	ipif_t		*ipif;
15265 
15266 	mutex_enter(&ill->ill_lock);
15267 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15268 		if (IPIF_IS_CONDEMNED(ipif))
15269 			continue;
15270 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15271 			continue;
15272 		if (!(ipif->ipif_flags & IPIF_UP))
15273 			continue;
15274 		if (ipif->ipif_zoneid != zoneid &&
15275 		    ipif->ipif_zoneid != ALL_ZONES && zoneid != ALL_ZONES)
15276 			continue;
15277 		if (ill->ill_isv6 ?
15278 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15279 		    ipif->ipif_lcl_addr == INADDR_ANY)
15280 			continue;
15281 		ipif_refhold_locked(ipif);
15282 		mutex_exit(&ill->ill_lock);
15283 		return (ipif);
15284 	}
15285 	mutex_exit(&ill->ill_lock);
15286 	return (NULL);
15287 }
15288 
15289 /*
15290  * IP source address type, sorted from worst to best.  For a given type,
15291  * always prefer IP addresses on the same subnet.  All-zones addresses are
15292  * suboptimal because they pose problems with unlabeled destinations.
15293  */
15294 typedef enum {
15295 	IPIF_NONE,
15296 	IPIF_DIFFNET_DEPRECATED,	/* deprecated and different subnet */
15297 	IPIF_SAMENET_DEPRECATED,	/* deprecated and same subnet */
15298 	IPIF_DIFFNET_ALLZONES,		/* allzones and different subnet */
15299 	IPIF_SAMENET_ALLZONES,		/* allzones and same subnet */
15300 	IPIF_DIFFNET,			/* normal and different subnet */
15301 	IPIF_SAMENET,			/* normal and same subnet */
15302 	IPIF_LOCALADDR			/* local loopback */
15303 } ipif_type_t;
15304 
15305 /*
15306  * Pick the optimal ipif on `ill' for sending to destination `dst' from zone
15307  * `zoneid'.  We rate usable ipifs from low -> high as per the ipif_type_t
15308  * enumeration, and return the highest-rated ipif.  If there's a tie, we pick
15309  * the first one, unless IPMP is used in which case we round-robin among them;
15310  * see below for more.
15311  *
15312  * Returns NULL if there is no suitable source address for the ill.
15313  * This only occurs when there is no valid source address for the ill.
15314  */
15315 ipif_t *
ipif_select_source_v4(ill_t * ill,ipaddr_t dst,zoneid_t zoneid,boolean_t allow_usesrc,boolean_t * notreadyp)15316 ipif_select_source_v4(ill_t *ill, ipaddr_t dst, zoneid_t zoneid,
15317     boolean_t allow_usesrc, boolean_t *notreadyp)
15318 {
15319 	ill_t	*usill = NULL;
15320 	ill_t	*ipmp_ill = NULL;
15321 	ipif_t	*start_ipif, *next_ipif, *ipif, *best_ipif;
15322 	ipif_type_t type, best_type;
15323 	tsol_tpc_t *src_rhtp, *dst_rhtp;
15324 	ip_stack_t *ipst = ill->ill_ipst;
15325 	boolean_t samenet;
15326 
15327 	if (ill->ill_usesrc_ifindex != 0 && allow_usesrc) {
15328 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex,
15329 		    B_FALSE, ipst);
15330 		if (usill != NULL)
15331 			ill = usill;	/* Select source from usesrc ILL */
15332 		else
15333 			return (NULL);
15334 	}
15335 
15336 	/*
15337 	 * Test addresses should never be used for source address selection,
15338 	 * so if we were passed one, switch to the IPMP meta-interface.
15339 	 */
15340 	if (IS_UNDER_IPMP(ill)) {
15341 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL)
15342 			ill = ipmp_ill;	/* Select source from IPMP ill */
15343 		else
15344 			return (NULL);
15345 	}
15346 
15347 	/*
15348 	 * If we're dealing with an unlabeled destination on a labeled system,
15349 	 * make sure that we ignore source addresses that are incompatible with
15350 	 * the destination's default label.  That destination's default label
15351 	 * must dominate the minimum label on the source address.
15352 	 */
15353 	dst_rhtp = NULL;
15354 	if (is_system_labeled()) {
15355 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
15356 		if (dst_rhtp == NULL)
15357 			return (NULL);
15358 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
15359 			TPC_RELE(dst_rhtp);
15360 			dst_rhtp = NULL;
15361 		}
15362 	}
15363 
15364 	/*
15365 	 * Hold the ill_g_lock as reader. This makes sure that no ipif/ill
15366 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
15367 	 * After selecting the right ipif, under ill_lock make sure ipif is
15368 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
15369 	 * we retry. Inside the loop we still need to check for CONDEMNED,
15370 	 * but not under a lock.
15371 	 */
15372 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15373 retry:
15374 	/*
15375 	 * For source address selection, we treat the ipif list as circular
15376 	 * and continue until we get back to where we started.  This allows
15377 	 * IPMP to vary source address selection (which improves inbound load
15378 	 * spreading) by caching its last ending point and starting from
15379 	 * there.  NOTE: we don't have to worry about ill_src_ipif changing
15380 	 * ills since that can't happen on the IPMP ill.
15381 	 */
15382 	start_ipif = ill->ill_ipif;
15383 	if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
15384 		start_ipif = ill->ill_src_ipif;
15385 
15386 	ipif = start_ipif;
15387 	best_ipif = NULL;
15388 	best_type = IPIF_NONE;
15389 	do {
15390 		if ((next_ipif = ipif->ipif_next) == NULL)
15391 			next_ipif = ill->ill_ipif;
15392 
15393 		if (IPIF_IS_CONDEMNED(ipif))
15394 			continue;
15395 		/* Always skip NOLOCAL and ANYCAST interfaces */
15396 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15397 			continue;
15398 		/* Always skip NOACCEPT interfaces */
15399 		if (ipif->ipif_ill->ill_flags & ILLF_NOACCEPT)
15400 			continue;
15401 		if (!(ipif->ipif_flags & IPIF_UP))
15402 			continue;
15403 
15404 		if (!ipif->ipif_addr_ready) {
15405 			if (notreadyp != NULL)
15406 				*notreadyp = B_TRUE;
15407 			continue;
15408 		}
15409 
15410 		if (zoneid != ALL_ZONES &&
15411 		    ipif->ipif_zoneid != zoneid &&
15412 		    ipif->ipif_zoneid != ALL_ZONES)
15413 			continue;
15414 
15415 		/*
15416 		 * Interfaces with 0.0.0.0 address are allowed to be UP, but
15417 		 * are not valid as source addresses.
15418 		 */
15419 		if (ipif->ipif_lcl_addr == INADDR_ANY)
15420 			continue;
15421 
15422 		/*
15423 		 * Check compatibility of local address for destination's
15424 		 * default label if we're on a labeled system.	Incompatible
15425 		 * addresses can't be used at all.
15426 		 */
15427 		if (dst_rhtp != NULL) {
15428 			boolean_t incompat;
15429 
15430 			src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
15431 			    IPV4_VERSION, B_FALSE);
15432 			if (src_rhtp == NULL)
15433 				continue;
15434 			incompat = src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
15435 			    src_rhtp->tpc_tp.tp_doi !=
15436 			    dst_rhtp->tpc_tp.tp_doi ||
15437 			    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
15438 			    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
15439 			    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
15440 			    src_rhtp->tpc_tp.tp_sl_set_cipso));
15441 			TPC_RELE(src_rhtp);
15442 			if (incompat)
15443 				continue;
15444 		}
15445 
15446 		samenet = ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet);
15447 
15448 		if (ipif->ipif_lcl_addr == dst) {
15449 			type = IPIF_LOCALADDR;
15450 		} else if (ipif->ipif_flags & IPIF_DEPRECATED) {
15451 			type = samenet ? IPIF_SAMENET_DEPRECATED :
15452 			    IPIF_DIFFNET_DEPRECATED;
15453 		} else if (ipif->ipif_zoneid == ALL_ZONES) {
15454 			type = samenet ? IPIF_SAMENET_ALLZONES :
15455 			    IPIF_DIFFNET_ALLZONES;
15456 		} else {
15457 			type = samenet ? IPIF_SAMENET : IPIF_DIFFNET;
15458 		}
15459 
15460 		if (type > best_type) {
15461 			best_type = type;
15462 			best_ipif = ipif;
15463 			if (best_type == IPIF_LOCALADDR)
15464 				break; /* can't get better */
15465 		}
15466 	} while ((ipif = next_ipif) != start_ipif);
15467 
15468 	if ((ipif = best_ipif) != NULL) {
15469 		mutex_enter(&ipif->ipif_ill->ill_lock);
15470 		if (IPIF_IS_CONDEMNED(ipif)) {
15471 			mutex_exit(&ipif->ipif_ill->ill_lock);
15472 			goto retry;
15473 		}
15474 		ipif_refhold_locked(ipif);
15475 
15476 		/*
15477 		 * For IPMP, update the source ipif rotor to the next ipif,
15478 		 * provided we can look it up.  (We must not use it if it's
15479 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
15480 		 * ipif_free() checked ill_src_ipif.)
15481 		 */
15482 		if (IS_IPMP(ill) && ipif != NULL) {
15483 			next_ipif = ipif->ipif_next;
15484 			if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif))
15485 				ill->ill_src_ipif = next_ipif;
15486 			else
15487 				ill->ill_src_ipif = NULL;
15488 		}
15489 		mutex_exit(&ipif->ipif_ill->ill_lock);
15490 	}
15491 
15492 	rw_exit(&ipst->ips_ill_g_lock);
15493 	if (usill != NULL)
15494 		ill_refrele(usill);
15495 	if (ipmp_ill != NULL)
15496 		ill_refrele(ipmp_ill);
15497 	if (dst_rhtp != NULL)
15498 		TPC_RELE(dst_rhtp);
15499 
15500 #ifdef DEBUG
15501 	if (ipif == NULL) {
15502 		char buf1[INET6_ADDRSTRLEN];
15503 
15504 		ip1dbg(("ipif_select_source_v4(%s, %s) -> NULL\n",
15505 		    ill->ill_name,
15506 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
15507 	} else {
15508 		char buf1[INET6_ADDRSTRLEN];
15509 		char buf2[INET6_ADDRSTRLEN];
15510 
15511 		ip1dbg(("ipif_select_source_v4(%s, %s) -> %s\n",
15512 		    ipif->ipif_ill->ill_name,
15513 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
15514 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
15515 		    buf2, sizeof (buf2))));
15516 	}
15517 #endif /* DEBUG */
15518 	return (ipif);
15519 }
15520 
15521 /*
15522  * Pick a source address based on the destination ill and an optional setsrc
15523  * address.
15524  * The result is stored in srcp. If generation is set, then put the source
15525  * generation number there before we look for the source address (to avoid
15526  * missing changes in the set of source addresses.
15527  * If flagsp is set, then us it to pass back ipif_flags.
15528  *
15529  * If the caller wants to cache the returned source address and detect when
15530  * that might be stale, the caller should pass in a generation argument,
15531  * which the caller can later compare against ips_src_generation
15532  *
15533  * The precedence order for selecting an IPv4 source address is:
15534  *  - RTF_SETSRC on the offlink ire always wins.
15535  *  - If usrsrc is set, swap the ill to be the usesrc one.
15536  *  - If IPMP is used on the ill, select a random address from the most
15537  *    preferred ones below:
15538  * 1. If onlink destination, same subnet and not deprecated, not ALL_ZONES
15539  * 2. Not deprecated, not ALL_ZONES
15540  * 3. If onlink destination, same subnet and not deprecated, ALL_ZONES
15541  * 4. Not deprecated, ALL_ZONES
15542  * 5. If onlink destination, same subnet and deprecated
15543  * 6. Deprecated.
15544  *
15545  * We have lower preference for ALL_ZONES IP addresses,
15546  * as they pose problems with unlabeled destinations.
15547  *
15548  * Note that when multiple IP addresses match e.g., #1 we pick
15549  * the first one if IPMP is not in use. With IPMP we randomize.
15550  */
15551 int
ip_select_source_v4(ill_t * ill,ipaddr_t setsrc,ipaddr_t dst,ipaddr_t multicast_ifaddr,zoneid_t zoneid,ip_stack_t * ipst,ipaddr_t * srcp,uint32_t * generation,uint64_t * flagsp)15552 ip_select_source_v4(ill_t *ill, ipaddr_t setsrc, ipaddr_t dst,
15553     ipaddr_t multicast_ifaddr,
15554     zoneid_t zoneid, ip_stack_t *ipst, ipaddr_t *srcp,
15555     uint32_t *generation, uint64_t *flagsp)
15556 {
15557 	ipif_t *ipif;
15558 	boolean_t notready = B_FALSE;	/* Set if !ipif_addr_ready found */
15559 
15560 	if (flagsp != NULL)
15561 		*flagsp = 0;
15562 
15563 	/*
15564 	 * Need to grab the generation number before we check to
15565 	 * avoid a race with a change to the set of local addresses.
15566 	 * No lock needed since the thread which updates the set of local
15567 	 * addresses use ipif/ill locks and exit those (hence a store memory
15568 	 * barrier) before doing the atomic increase of ips_src_generation.
15569 	 */
15570 	if (generation != NULL) {
15571 		*generation = ipst->ips_src_generation;
15572 	}
15573 
15574 	if (CLASSD(dst) && multicast_ifaddr != INADDR_ANY) {
15575 		*srcp = multicast_ifaddr;
15576 		return (0);
15577 	}
15578 
15579 	/* Was RTF_SETSRC set on the first IRE in the recursive lookup? */
15580 	if (setsrc != INADDR_ANY) {
15581 		*srcp = setsrc;
15582 		return (0);
15583 	}
15584 	ipif = ipif_select_source_v4(ill, dst, zoneid, B_TRUE, &notready);
15585 	if (ipif == NULL) {
15586 		if (notready)
15587 			return (ENETDOWN);
15588 		else
15589 			return (EADDRNOTAVAIL);
15590 	}
15591 	*srcp = ipif->ipif_lcl_addr;
15592 	if (flagsp != NULL)
15593 		*flagsp = ipif->ipif_flags;
15594 	ipif_refrele(ipif);
15595 	return (0);
15596 }
15597 
15598 /* ARGSUSED */
15599 int
if_unitsel_restart(ipif_t * ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)15600 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15601     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15602 {
15603 	/*
15604 	 * ill_phyint_reinit merged the v4 and v6 into a single
15605 	 * ipsq.  We might not have been able to complete the
15606 	 * operation in ipif_set_values, if we could not become
15607 	 * exclusive.  If so restart it here.
15608 	 */
15609 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15610 }
15611 
15612 /*
15613  * Can operate on either a module or a driver queue.
15614  * Returns an error if not a module queue.
15615  */
15616 /* ARGSUSED */
15617 int
if_unitsel(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)15618 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15619     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15620 {
15621 	queue_t		*q1 = q;
15622 	char		*cp;
15623 	char		interf_name[LIFNAMSIZ];
15624 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
15625 
15626 	if (q->q_next == NULL) {
15627 		ip1dbg((
15628 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
15629 		return (EINVAL);
15630 	}
15631 
15632 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
15633 		return (EALREADY);
15634 
15635 	do {
15636 		q1 = q1->q_next;
15637 	} while (q1->q_next);
15638 	cp = q1->q_qinfo->qi_minfo->mi_idname;
15639 	(void) sprintf(interf_name, "%s%d", cp, ppa);
15640 
15641 	/*
15642 	 * Here we are not going to delay the ioack until after
15643 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
15644 	 * original ioctl message before sending the requests.
15645 	 */
15646 	return (ipif_set_values(q, mp, interf_name, &ppa));
15647 }
15648 
15649 /* ARGSUSED */
15650 int
ip_sioctl_sifname(ipif_t * dummy_ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * dummy_ifreq)15651 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15652     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15653 {
15654 	return (ENXIO);
15655 }
15656 
15657 /*
15658  * Create any IRE_BROADCAST entries for `ipif', and store those entries in
15659  * `irep'.  Returns a pointer to the next free `irep' entry
15660  * A mirror exists in ipif_delete_bcast_ires().
15661  *
15662  * The management of any "extra" or seemingly duplicate IRE_BROADCASTs is
15663  * done in ire_add.
15664  */
15665 static ire_t **
ipif_create_bcast_ires(ipif_t * ipif,ire_t ** irep)15666 ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep)
15667 {
15668 	ipaddr_t addr;
15669 	ipaddr_t netmask = ip_net_mask(ipif->ipif_lcl_addr);
15670 	ipaddr_t subnetmask = ipif->ipif_net_mask;
15671 	ill_t *ill = ipif->ipif_ill;
15672 	zoneid_t zoneid = ipif->ipif_zoneid;
15673 
15674 	ip1dbg(("ipif_create_bcast_ires: creating broadcast IREs\n"));
15675 
15676 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15677 	ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15678 
15679 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
15680 	    (ipif->ipif_flags & IPIF_NOLOCAL))
15681 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
15682 
15683 	irep = ire_create_bcast(ill, 0, zoneid, irep);
15684 	irep = ire_create_bcast(ill, INADDR_BROADCAST, zoneid, irep);
15685 
15686 	/*
15687 	 * For backward compatibility, we create net broadcast IREs based on
15688 	 * the old "IP address class system", since some old machines only
15689 	 * respond to these class derived net broadcast.  However, we must not
15690 	 * create these net broadcast IREs if the subnetmask is shorter than
15691 	 * the IP address class based derived netmask.  Otherwise, we may
15692 	 * create a net broadcast address which is the same as an IP address
15693 	 * on the subnet -- and then TCP will refuse to talk to that address.
15694 	 */
15695 	if (netmask < subnetmask) {
15696 		addr = netmask & ipif->ipif_subnet;
15697 		irep = ire_create_bcast(ill, addr, zoneid, irep);
15698 		irep = ire_create_bcast(ill, ~netmask | addr, zoneid, irep);
15699 	}
15700 
15701 	/*
15702 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15703 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15704 	 * created.  Creating these broadcast IREs will only create confusion
15705 	 * as `addr' will be the same as the IP address.
15706 	 */
15707 	if (subnetmask != 0xFFFFFFFF) {
15708 		addr = ipif->ipif_subnet;
15709 		irep = ire_create_bcast(ill, addr, zoneid, irep);
15710 		irep = ire_create_bcast(ill, ~subnetmask | addr, zoneid, irep);
15711 	}
15712 
15713 	return (irep);
15714 }
15715 
15716 /*
15717  * Mirror of ipif_create_bcast_ires()
15718  */
15719 static void
ipif_delete_bcast_ires(ipif_t * ipif)15720 ipif_delete_bcast_ires(ipif_t *ipif)
15721 {
15722 	ipaddr_t	addr;
15723 	ipaddr_t	netmask = ip_net_mask(ipif->ipif_lcl_addr);
15724 	ipaddr_t	subnetmask = ipif->ipif_net_mask;
15725 	ill_t		*ill = ipif->ipif_ill;
15726 	zoneid_t	zoneid = ipif->ipif_zoneid;
15727 	ire_t		*ire;
15728 
15729 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15730 	ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15731 
15732 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
15733 	    (ipif->ipif_flags & IPIF_NOLOCAL))
15734 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
15735 
15736 	ire = ire_lookup_bcast(ill, 0, zoneid);
15737 	ASSERT(ire != NULL);
15738 	ire_delete(ire); ire_refrele(ire);
15739 	ire = ire_lookup_bcast(ill, INADDR_BROADCAST, zoneid);
15740 	ASSERT(ire != NULL);
15741 	ire_delete(ire); ire_refrele(ire);
15742 
15743 	/*
15744 	 * For backward compatibility, we create net broadcast IREs based on
15745 	 * the old "IP address class system", since some old machines only
15746 	 * respond to these class derived net broadcast.  However, we must not
15747 	 * create these net broadcast IREs if the subnetmask is shorter than
15748 	 * the IP address class based derived netmask.  Otherwise, we may
15749 	 * create a net broadcast address which is the same as an IP address
15750 	 * on the subnet -- and then TCP will refuse to talk to that address.
15751 	 */
15752 	if (netmask < subnetmask) {
15753 		addr = netmask & ipif->ipif_subnet;
15754 		ire = ire_lookup_bcast(ill, addr, zoneid);
15755 		ASSERT(ire != NULL);
15756 		ire_delete(ire); ire_refrele(ire);
15757 		ire = ire_lookup_bcast(ill, ~netmask | addr, zoneid);
15758 		ASSERT(ire != NULL);
15759 		ire_delete(ire); ire_refrele(ire);
15760 	}
15761 
15762 	/*
15763 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15764 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15765 	 * created.  Creating these broadcast IREs will only create confusion
15766 	 * as `addr' will be the same as the IP address.
15767 	 */
15768 	if (subnetmask != 0xFFFFFFFF) {
15769 		addr = ipif->ipif_subnet;
15770 		ire = ire_lookup_bcast(ill, addr, zoneid);
15771 		ASSERT(ire != NULL);
15772 		ire_delete(ire); ire_refrele(ire);
15773 		ire = ire_lookup_bcast(ill, ~subnetmask | addr, zoneid);
15774 		ASSERT(ire != NULL);
15775 		ire_delete(ire); ire_refrele(ire);
15776 	}
15777 }
15778 
15779 /*
15780  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
15781  * from lifr_flags and the name from lifr_name.
15782  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
15783  * since ipif_lookup_on_name uses the _isv6 flags when matching.
15784  * Returns EINPROGRESS when mp has been consumed by queueing it on
15785  * ipx_pending_mp and the ioctl will complete in ip_rput.
15786  *
15787  * Can operate on either a module or a driver queue.
15788  * Returns an error if not a module queue.
15789  */
15790 /* ARGSUSED */
15791 int
ip_sioctl_slifname(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)15792 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15793     ip_ioctl_cmd_t *ipip, void *if_req)
15794 {
15795 	ill_t	*ill = q->q_ptr;
15796 	phyint_t *phyi;
15797 	ip_stack_t *ipst;
15798 	struct lifreq *lifr = if_req;
15799 	uint64_t new_flags;
15800 
15801 	ASSERT(ipif != NULL);
15802 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
15803 
15804 	if (q->q_next == NULL) {
15805 		ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: no q_next\n"));
15806 		return (EINVAL);
15807 	}
15808 
15809 	/*
15810 	 * If we are not writer on 'q' then this interface exists already
15811 	 * and previous lookups (ip_extract_lifreq()) found this ipif --
15812 	 * so return EALREADY.
15813 	 */
15814 	if (ill != ipif->ipif_ill)
15815 		return (EALREADY);
15816 
15817 	if (ill->ill_name[0] != '\0')
15818 		return (EALREADY);
15819 
15820 	/*
15821 	 * If there's another ill already with the requested name, ensure
15822 	 * that it's of the same type.  Otherwise, ill_phyint_reinit() will
15823 	 * fuse together two unrelated ills, which will cause chaos.
15824 	 */
15825 	ipst = ill->ill_ipst;
15826 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
15827 	    lifr->lifr_name, NULL);
15828 	if (phyi != NULL) {
15829 		ill_t *ill_mate = phyi->phyint_illv4;
15830 
15831 		if (ill_mate == NULL)
15832 			ill_mate = phyi->phyint_illv6;
15833 		ASSERT(ill_mate != NULL);
15834 
15835 		if (ill_mate->ill_media->ip_m_mac_type !=
15836 		    ill->ill_media->ip_m_mac_type) {
15837 			ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: attempt to "
15838 			    "use the same ill name on differing media\n"));
15839 			return (EINVAL);
15840 		}
15841 	}
15842 
15843 	/*
15844 	 * We start off as IFF_IPV4 in ipif_allocate and become
15845 	 * IFF_IPV4 or IFF_IPV6 here depending  on lifr_flags value.
15846 	 * The only flags that we read from user space are IFF_IPV4,
15847 	 * IFF_IPV6, and IFF_BROADCAST.
15848 	 *
15849 	 * This ill has not been inserted into the global list.
15850 	 * So we are still single threaded and don't need any lock
15851 	 *
15852 	 * Saniy check the flags.
15853 	 */
15854 
15855 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
15856 	    ((lifr->lifr_flags & IFF_IPV6) ||
15857 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
15858 		ip1dbg(("ip_sioctl_slifname: link not broadcast capable "
15859 		    "or IPv6 i.e., no broadcast \n"));
15860 		return (EINVAL);
15861 	}
15862 
15863 	new_flags =
15864 	    lifr->lifr_flags & (IFF_IPV6|IFF_IPV4|IFF_BROADCAST);
15865 
15866 	if ((new_flags ^ (IFF_IPV6|IFF_IPV4)) == 0) {
15867 		ip1dbg(("ip_sioctl_slifname: flags must be exactly one of "
15868 		    "IFF_IPV4 or IFF_IPV6\n"));
15869 		return (EINVAL);
15870 	}
15871 
15872 	/*
15873 	 * We always start off as IPv4, so only need to check for IPv6.
15874 	 */
15875 	if ((new_flags & IFF_IPV6) != 0) {
15876 		ill->ill_flags |= ILLF_IPV6;
15877 		ill->ill_flags &= ~ILLF_IPV4;
15878 
15879 		if (lifr->lifr_flags & IFF_NOLINKLOCAL)
15880 			ill->ill_flags |= ILLF_NOLINKLOCAL;
15881 	}
15882 
15883 	if ((new_flags & IFF_BROADCAST) != 0)
15884 		ipif->ipif_flags |= IPIF_BROADCAST;
15885 	else
15886 		ipif->ipif_flags &= ~IPIF_BROADCAST;
15887 
15888 	/* We started off as V4. */
15889 	if (ill->ill_flags & ILLF_IPV6) {
15890 		ill->ill_phyint->phyint_illv6 = ill;
15891 		ill->ill_phyint->phyint_illv4 = NULL;
15892 	}
15893 
15894 	return (ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa));
15895 }
15896 
15897 /* ARGSUSED */
15898 int
ip_sioctl_slifname_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)15899 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15900     ip_ioctl_cmd_t *ipip, void *if_req)
15901 {
15902 	/*
15903 	 * ill_phyint_reinit merged the v4 and v6 into a single
15904 	 * ipsq.  We might not have been able to complete the
15905 	 * slifname in ipif_set_values, if we could not become
15906 	 * exclusive.  If so restart it here
15907 	 */
15908 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15909 }
15910 
15911 /*
15912  * Return a pointer to the ipif which matches the index, IP version type and
15913  * zoneid.
15914  */
15915 ipif_t *
ipif_lookup_on_ifindex(uint_t index,boolean_t isv6,zoneid_t zoneid,ip_stack_t * ipst)15916 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
15917     ip_stack_t *ipst)
15918 {
15919 	ill_t	*ill;
15920 	ipif_t	*ipif = NULL;
15921 
15922 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
15923 	if (ill != NULL) {
15924 		mutex_enter(&ill->ill_lock);
15925 		for (ipif = ill->ill_ipif; ipif != NULL;
15926 		    ipif = ipif->ipif_next) {
15927 			if (!IPIF_IS_CONDEMNED(ipif) && (zoneid == ALL_ZONES ||
15928 			    zoneid == ipif->ipif_zoneid ||
15929 			    ipif->ipif_zoneid == ALL_ZONES)) {
15930 				ipif_refhold_locked(ipif);
15931 				break;
15932 			}
15933 		}
15934 		mutex_exit(&ill->ill_lock);
15935 		ill_refrele(ill);
15936 	}
15937 	return (ipif);
15938 }
15939 
15940 /*
15941  * Change an existing physical interface's index. If the new index
15942  * is acceptable we update the index and the phyint_list_avl_by_index tree.
15943  * Finally, we update other systems which may have a dependence on the
15944  * index value.
15945  */
15946 /* ARGSUSED */
15947 int
ip_sioctl_slifindex(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)15948 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15949     ip_ioctl_cmd_t *ipip, void *ifreq)
15950 {
15951 	ill_t		*ill;
15952 	phyint_t	*phyi;
15953 	struct ifreq	*ifr = (struct ifreq *)ifreq;
15954 	struct lifreq	*lifr = (struct lifreq *)ifreq;
15955 	uint_t	old_index, index;
15956 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15957 	avl_index_t	where;
15958 
15959 	if (ipip->ipi_cmd_type == IF_CMD)
15960 		index = ifr->ifr_index;
15961 	else
15962 		index = lifr->lifr_index;
15963 
15964 	/*
15965 	 * Only allow on physical interface. Also, index zero is illegal.
15966 	 */
15967 	ill = ipif->ipif_ill;
15968 	phyi = ill->ill_phyint;
15969 	if (ipif->ipif_id != 0 || index == 0 || index > IF_INDEX_MAX) {
15970 		return (EINVAL);
15971 	}
15972 
15973 	/* If the index is not changing, no work to do */
15974 	if (phyi->phyint_ifindex == index)
15975 		return (0);
15976 
15977 	/*
15978 	 * Use phyint_exists() to determine if the new interface index
15979 	 * is already in use. If the index is unused then we need to
15980 	 * change the phyint's position in the phyint_list_avl_by_index
15981 	 * tree. If we do not do this, subsequent lookups (using the new
15982 	 * index value) will not find the phyint.
15983 	 */
15984 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15985 	if (phyint_exists(index, ipst)) {
15986 		rw_exit(&ipst->ips_ill_g_lock);
15987 		return (EEXIST);
15988 	}
15989 
15990 	/*
15991 	 * The new index is unused. Set it in the phyint. However we must not
15992 	 * forget to trigger NE_IFINDEX_CHANGE event before the ifindex
15993 	 * changes. The event must be bound to old ifindex value.
15994 	 */
15995 	ill_nic_event_dispatch(ill, 0, NE_IFINDEX_CHANGE,
15996 	    &index, sizeof (index));
15997 
15998 	old_index = phyi->phyint_ifindex;
15999 	phyi->phyint_ifindex = index;
16000 
16001 	avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index, phyi);
16002 	(void) avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16003 	    &index, &where);
16004 	avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16005 	    phyi, where);
16006 	rw_exit(&ipst->ips_ill_g_lock);
16007 
16008 	/* Update SCTP's ILL list */
16009 	sctp_ill_reindex(ill, old_index);
16010 
16011 	/* Send the routing sockets message */
16012 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
16013 	if (ILL_OTHER(ill))
16014 		ip_rts_ifmsg(ILL_OTHER(ill)->ill_ipif, RTSQ_DEFAULT);
16015 
16016 	/* Perhaps ilgs should use this ill */
16017 	update_conn_ill(NULL, ill->ill_ipst);
16018 	return (0);
16019 }
16020 
16021 /* ARGSUSED */
16022 int
ip_sioctl_get_lifindex(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16023 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16024     ip_ioctl_cmd_t *ipip, void *ifreq)
16025 {
16026 	struct ifreq	*ifr = (struct ifreq *)ifreq;
16027 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16028 
16029 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
16030 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16031 	/* Get the interface index */
16032 	if (ipip->ipi_cmd_type == IF_CMD) {
16033 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16034 	} else {
16035 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16036 	}
16037 	return (0);
16038 }
16039 
16040 /* ARGSUSED */
16041 int
ip_sioctl_get_lifzone(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16042 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16043     ip_ioctl_cmd_t *ipip, void *ifreq)
16044 {
16045 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16046 
16047 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
16048 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16049 	/* Get the interface zone */
16050 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16051 	lifr->lifr_zoneid = ipif->ipif_zoneid;
16052 	return (0);
16053 }
16054 
16055 /*
16056  * Set the zoneid of an interface.
16057  */
16058 /* ARGSUSED */
16059 int
ip_sioctl_slifzone(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16060 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16061     ip_ioctl_cmd_t *ipip, void *ifreq)
16062 {
16063 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16064 	int err = 0;
16065 	boolean_t need_up = B_FALSE;
16066 	zone_t *zptr;
16067 	zone_status_t status;
16068 	zoneid_t zoneid;
16069 
16070 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16071 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
16072 		if (!is_system_labeled())
16073 			return (ENOTSUP);
16074 		zoneid = GLOBAL_ZONEID;
16075 	}
16076 
16077 	/* cannot assign instance zero to a non-global zone */
16078 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
16079 		return (ENOTSUP);
16080 
16081 	/*
16082 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
16083 	 * the event of a race with the zone shutdown processing, since IP
16084 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
16085 	 * interface will be cleaned up even if the zone is shut down
16086 	 * immediately after the status check. If the interface can't be brought
16087 	 * down right away, and the zone is shut down before the restart
16088 	 * function is called, we resolve the possible races by rechecking the
16089 	 * zone status in the restart function.
16090 	 */
16091 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
16092 		return (EINVAL);
16093 	status = zone_status_get(zptr);
16094 	zone_rele(zptr);
16095 
16096 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
16097 		return (EINVAL);
16098 
16099 	if (ipif->ipif_flags & IPIF_UP) {
16100 		/*
16101 		 * If the interface is already marked up,
16102 		 * we call ipif_down which will take care
16103 		 * of ditching any IREs that have been set
16104 		 * up based on the old interface address.
16105 		 */
16106 		err = ipif_logical_down(ipif, q, mp);
16107 		if (err == EINPROGRESS)
16108 			return (err);
16109 		(void) ipif_down_tail(ipif);
16110 		need_up = B_TRUE;
16111 	}
16112 
16113 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
16114 	return (err);
16115 }
16116 
16117 static int
ip_sioctl_slifzone_tail(ipif_t * ipif,zoneid_t zoneid,queue_t * q,mblk_t * mp,boolean_t need_up)16118 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
16119     queue_t *q, mblk_t *mp, boolean_t need_up)
16120 {
16121 	int	err = 0;
16122 	ip_stack_t	*ipst;
16123 
16124 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
16125 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16126 
16127 	if (CONN_Q(q))
16128 		ipst = CONNQ_TO_IPST(q);
16129 	else
16130 		ipst = ILLQ_TO_IPST(q);
16131 
16132 	/*
16133 	 * For exclusive stacks we don't allow a different zoneid than
16134 	 * global.
16135 	 */
16136 	if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID &&
16137 	    zoneid != GLOBAL_ZONEID)
16138 		return (EINVAL);
16139 
16140 	/* Set the new zone id. */
16141 	ipif->ipif_zoneid = zoneid;
16142 
16143 	/* Update sctp list */
16144 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
16145 
16146 	/* The default multicast interface might have changed */
16147 	ire_increment_multicast_generation(ipst, ipif->ipif_ill->ill_isv6);
16148 
16149 	if (need_up) {
16150 		/*
16151 		 * Now bring the interface back up.  If this
16152 		 * is the only IPIF for the ILL, ipif_up
16153 		 * will have to re-bind to the device, so
16154 		 * we may get back EINPROGRESS, in which
16155 		 * case, this IOCTL will get completed in
16156 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
16157 		 */
16158 		err = ipif_up(ipif, q, mp);
16159 	}
16160 	return (err);
16161 }
16162 
16163 /* ARGSUSED */
16164 int
ip_sioctl_slifzone_restart(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)16165 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16166     ip_ioctl_cmd_t *ipip, void *if_req)
16167 {
16168 	struct lifreq *lifr = (struct lifreq *)if_req;
16169 	zoneid_t zoneid;
16170 	zone_t *zptr;
16171 	zone_status_t status;
16172 
16173 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16174 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
16175 		zoneid = GLOBAL_ZONEID;
16176 
16177 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
16178 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16179 
16180 	/*
16181 	 * We recheck the zone status to resolve the following race condition:
16182 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
16183 	 * 2) hme0:1 is up and can't be brought down right away;
16184 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
16185 	 * 3) zone "myzone" is halted; the zone status switches to
16186 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
16187 	 * the interfaces to remove - hme0:1 is not returned because it's not
16188 	 * yet in "myzone", so it won't be removed;
16189 	 * 4) the restart function for SIOCSLIFZONE is called; without the
16190 	 * status check here, we would have hme0:1 in "myzone" after it's been
16191 	 * destroyed.
16192 	 * Note that if the status check fails, we need to bring the interface
16193 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
16194 	 * ipif_up_done[_v6]().
16195 	 */
16196 	status = ZONE_IS_UNINITIALIZED;
16197 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
16198 		status = zone_status_get(zptr);
16199 		zone_rele(zptr);
16200 	}
16201 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
16202 		if (ipif->ipif_isv6) {
16203 			(void) ipif_up_done_v6(ipif);
16204 		} else {
16205 			(void) ipif_up_done(ipif);
16206 		}
16207 		return (EINVAL);
16208 	}
16209 
16210 	(void) ipif_down_tail(ipif);
16211 
16212 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
16213 	    B_TRUE));
16214 }
16215 
16216 /*
16217  * Return the number of addresses on `ill' with one or more of the values
16218  * in `set' set and all of the values in `clear' clear.
16219  */
16220 static uint_t
ill_flagaddr_cnt(const ill_t * ill,uint64_t set,uint64_t clear)16221 ill_flagaddr_cnt(const ill_t *ill, uint64_t set, uint64_t clear)
16222 {
16223 	ipif_t	*ipif;
16224 	uint_t	cnt = 0;
16225 
16226 	ASSERT(IAM_WRITER_ILL(ill));
16227 
16228 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
16229 		if ((ipif->ipif_flags & set) && !(ipif->ipif_flags & clear))
16230 			cnt++;
16231 
16232 	return (cnt);
16233 }
16234 
16235 /*
16236  * Return the number of migratable addresses on `ill' that are under
16237  * application control.
16238  */
16239 uint_t
ill_appaddr_cnt(const ill_t * ill)16240 ill_appaddr_cnt(const ill_t *ill)
16241 {
16242 	return (ill_flagaddr_cnt(ill, IPIF_DHCPRUNNING | IPIF_ADDRCONF,
16243 	    IPIF_NOFAILOVER));
16244 }
16245 
16246 /*
16247  * Return the number of point-to-point addresses on `ill'.
16248  */
16249 uint_t
ill_ptpaddr_cnt(const ill_t * ill)16250 ill_ptpaddr_cnt(const ill_t *ill)
16251 {
16252 	return (ill_flagaddr_cnt(ill, IPIF_POINTOPOINT, 0));
16253 }
16254 
16255 /* ARGSUSED */
16256 int
ip_sioctl_get_lifusesrc(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16257 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16258     ip_ioctl_cmd_t *ipip, void *ifreq)
16259 {
16260 	struct lifreq	*lifr = ifreq;
16261 
16262 	ASSERT(q->q_next == NULL);
16263 	ASSERT(CONN_Q(q));
16264 
16265 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
16266 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16267 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
16268 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
16269 
16270 	return (0);
16271 }
16272 
16273 /* Find the previous ILL in this usesrc group */
16274 static ill_t *
ill_prev_usesrc(ill_t * uill)16275 ill_prev_usesrc(ill_t *uill)
16276 {
16277 	ill_t *ill;
16278 
16279 	for (ill = uill->ill_usesrc_grp_next;
16280 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
16281 	    ill = ill->ill_usesrc_grp_next)
16282 		/* do nothing */;
16283 	return (ill);
16284 }
16285 
16286 /*
16287  * Release all members of the usesrc group. This routine is called
16288  * from ill_delete when the interface being unplumbed is the
16289  * group head.
16290  *
16291  * This silently clears the usesrc that ifconfig setup.
16292  * An alternative would be to keep that ifindex, and drop packets on the floor
16293  * since no source address can be selected.
16294  * Even if we keep the current semantics, don't need a lock and a linked list.
16295  * Can walk all the ills checking if they have a ill_usesrc_ifindex matching
16296  * the one that is being removed. Issue is how we return the usesrc users
16297  * (SIOCGLIFSRCOF). We want to be able to find the ills which have an
16298  * ill_usesrc_ifindex matching a target ill. We could also do that with an
16299  * ill walk, but the walker would need to insert in the ioctl response.
16300  */
16301 static void
ill_disband_usesrc_group(ill_t * uill)16302 ill_disband_usesrc_group(ill_t *uill)
16303 {
16304 	ill_t *next_ill, *tmp_ill;
16305 	ip_stack_t	*ipst = uill->ill_ipst;
16306 
16307 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16308 	next_ill = uill->ill_usesrc_grp_next;
16309 
16310 	do {
16311 		ASSERT(next_ill != NULL);
16312 		tmp_ill = next_ill->ill_usesrc_grp_next;
16313 		ASSERT(tmp_ill != NULL);
16314 		next_ill->ill_usesrc_grp_next = NULL;
16315 		next_ill->ill_usesrc_ifindex = 0;
16316 		next_ill = tmp_ill;
16317 	} while (next_ill->ill_usesrc_ifindex != 0);
16318 	uill->ill_usesrc_grp_next = NULL;
16319 }
16320 
16321 /*
16322  * Remove the client usesrc ILL from the list and relink to a new list
16323  */
16324 int
ill_relink_usesrc_ills(ill_t * ucill,ill_t * uill,uint_t ifindex)16325 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
16326 {
16327 	ill_t *ill, *tmp_ill;
16328 	ip_stack_t	*ipst = ucill->ill_ipst;
16329 
16330 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
16331 	    (uill != NULL) && RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16332 
16333 	/*
16334 	 * Check if the usesrc client ILL passed in is not already
16335 	 * in use as a usesrc ILL i.e one whose source address is
16336 	 * in use OR a usesrc ILL is not already in use as a usesrc
16337 	 * client ILL
16338 	 */
16339 	if ((ucill->ill_usesrc_ifindex == 0) ||
16340 	    (uill->ill_usesrc_ifindex != 0)) {
16341 		return (-1);
16342 	}
16343 
16344 	ill = ill_prev_usesrc(ucill);
16345 	ASSERT(ill->ill_usesrc_grp_next != NULL);
16346 
16347 	/* Remove from the current list */
16348 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
16349 		/* Only two elements in the list */
16350 		ASSERT(ill->ill_usesrc_ifindex == 0);
16351 		ill->ill_usesrc_grp_next = NULL;
16352 	} else {
16353 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
16354 	}
16355 
16356 	if (ifindex == 0) {
16357 		ucill->ill_usesrc_ifindex = 0;
16358 		ucill->ill_usesrc_grp_next = NULL;
16359 		return (0);
16360 	}
16361 
16362 	ucill->ill_usesrc_ifindex = ifindex;
16363 	tmp_ill = uill->ill_usesrc_grp_next;
16364 	uill->ill_usesrc_grp_next = ucill;
16365 	ucill->ill_usesrc_grp_next =
16366 	    (tmp_ill != NULL) ? tmp_ill : uill;
16367 	return (0);
16368 }
16369 
16370 /*
16371  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
16372  * ip.c for locking details.
16373  */
16374 /* ARGSUSED */
16375 int
ip_sioctl_slifusesrc(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * ifreq)16376 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16377     ip_ioctl_cmd_t *ipip, void *ifreq)
16378 {
16379 	struct lifreq *lifr = (struct lifreq *)ifreq;
16380 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE;
16381 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
16382 	int err = 0, ret;
16383 	uint_t ifindex;
16384 	ipsq_t *ipsq = NULL;
16385 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
16386 
16387 	ASSERT(IAM_WRITER_IPIF(ipif));
16388 	ASSERT(q->q_next == NULL);
16389 	ASSERT(CONN_Q(q));
16390 
16391 	isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
16392 
16393 	ifindex = lifr->lifr_index;
16394 	if (ifindex == 0) {
16395 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
16396 			/* non usesrc group interface, nothing to reset */
16397 			return (0);
16398 		}
16399 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
16400 		/* valid reset request */
16401 		reset_flg = B_TRUE;
16402 	}
16403 
16404 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
16405 	if (usesrc_ill == NULL)
16406 		return (ENXIO);
16407 	if (usesrc_ill == ipif->ipif_ill) {
16408 		ill_refrele(usesrc_ill);
16409 		return (EINVAL);
16410 	}
16411 
16412 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
16413 	    NEW_OP, B_TRUE);
16414 	if (ipsq == NULL) {
16415 		err = EINPROGRESS;
16416 		/* Operation enqueued on the ipsq of the usesrc ILL */
16417 		goto done;
16418 	}
16419 
16420 	/* USESRC isn't currently supported with IPMP */
16421 	if (IS_IPMP(usesrc_ill) || IS_UNDER_IPMP(usesrc_ill)) {
16422 		err = ENOTSUP;
16423 		goto done;
16424 	}
16425 
16426 	/*
16427 	 * USESRC isn't compatible with the STANDBY flag.  (STANDBY is only
16428 	 * used by IPMP underlying interfaces, but someone might think it's
16429 	 * more general and try to use it independently with VNI.)
16430 	 */
16431 	if (usesrc_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
16432 		err = ENOTSUP;
16433 		goto done;
16434 	}
16435 
16436 	/*
16437 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
16438 	 * already a client then return EINVAL
16439 	 */
16440 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
16441 		err = EINVAL;
16442 		goto done;
16443 	}
16444 
16445 	/*
16446 	 * If the ill_usesrc_ifindex field is already set to what it needs to
16447 	 * be then this is a duplicate operation.
16448 	 */
16449 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
16450 		err = 0;
16451 		goto done;
16452 	}
16453 
16454 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
16455 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
16456 	    usesrc_ill->ill_isv6));
16457 
16458 	/*
16459 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
16460 	 * and the ill_usesrc_ifindex fields
16461 	 */
16462 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
16463 
16464 	if (reset_flg) {
16465 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
16466 		if (ret != 0) {
16467 			err = EINVAL;
16468 		}
16469 		rw_exit(&ipst->ips_ill_g_usesrc_lock);
16470 		goto done;
16471 	}
16472 
16473 	/*
16474 	 * Four possibilities to consider:
16475 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
16476 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
16477 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
16478 	 * 4. Both are part of their respective usesrc groups
16479 	 */
16480 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
16481 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16482 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
16483 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16484 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16485 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
16486 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
16487 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16488 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16489 		/* Insert at head of list */
16490 		usesrc_cli_ill->ill_usesrc_grp_next =
16491 		    usesrc_ill->ill_usesrc_grp_next;
16492 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16493 	} else {
16494 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
16495 		    ifindex);
16496 		if (ret != 0)
16497 			err = EINVAL;
16498 	}
16499 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
16500 
16501 done:
16502 	if (ipsq != NULL)
16503 		ipsq_exit(ipsq);
16504 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
16505 	ill_refrele(usesrc_ill);
16506 
16507 	/* Let conn_ixa caching know that source address selection changed */
16508 	ip_update_source_selection(ipst);
16509 
16510 	return (err);
16511 }
16512 
16513 /* ARGSUSED */
16514 int
ip_sioctl_get_dadstate(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)16515 ip_sioctl_get_dadstate(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16516     ip_ioctl_cmd_t *ipip, void *if_req)
16517 {
16518 	struct lifreq	*lifr = (struct lifreq *)if_req;
16519 	ill_t		*ill = ipif->ipif_ill;
16520 
16521 	/*
16522 	 * Need a lock since IFF_UP can be set even when there are
16523 	 * references to the ipif.
16524 	 */
16525 	mutex_enter(&ill->ill_lock);
16526 	if ((ipif->ipif_flags & IPIF_UP) && ipif->ipif_addr_ready == 0)
16527 		lifr->lifr_dadstate = DAD_IN_PROGRESS;
16528 	else
16529 		lifr->lifr_dadstate = DAD_DONE;
16530 	mutex_exit(&ill->ill_lock);
16531 	return (0);
16532 }
16533 
16534 /*
16535  * comparison function used by avl.
16536  */
16537 static int
ill_phyint_compare_index(const void * index_ptr,const void * phyip)16538 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
16539 {
16540 
16541 	uint_t index;
16542 
16543 	ASSERT(phyip != NULL && index_ptr != NULL);
16544 
16545 	index = *((uint_t *)index_ptr);
16546 	/*
16547 	 * let the phyint with the lowest index be on top.
16548 	 */
16549 	if (((phyint_t *)phyip)->phyint_ifindex < index)
16550 		return (1);
16551 	if (((phyint_t *)phyip)->phyint_ifindex > index)
16552 		return (-1);
16553 	return (0);
16554 }
16555 
16556 /*
16557  * comparison function used by avl.
16558  */
16559 static int
ill_phyint_compare_name(const void * name_ptr,const void * phyip)16560 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
16561 {
16562 	ill_t *ill;
16563 	int res = 0;
16564 
16565 	ASSERT(phyip != NULL && name_ptr != NULL);
16566 
16567 	if (((phyint_t *)phyip)->phyint_illv4)
16568 		ill = ((phyint_t *)phyip)->phyint_illv4;
16569 	else
16570 		ill = ((phyint_t *)phyip)->phyint_illv6;
16571 	ASSERT(ill != NULL);
16572 
16573 	res = strcmp(ill->ill_name, (char *)name_ptr);
16574 	if (res > 0)
16575 		return (1);
16576 	else if (res < 0)
16577 		return (-1);
16578 	return (0);
16579 }
16580 
16581 /*
16582  * This function is called on the unplumb path via ill_glist_delete() when
16583  * there are no ills left on the phyint and thus the phyint can be freed.
16584  */
16585 static void
phyint_free(phyint_t * phyi)16586 phyint_free(phyint_t *phyi)
16587 {
16588 	ip_stack_t *ipst = PHYINT_TO_IPST(phyi);
16589 
16590 	ASSERT(phyi->phyint_illv4 == NULL && phyi->phyint_illv6 == NULL);
16591 
16592 	/*
16593 	 * If this phyint was an IPMP meta-interface, blow away the group.
16594 	 * This is safe to do because all of the illgrps have already been
16595 	 * removed by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find us.
16596 	 * If we're cleaning up as a result of failed initialization,
16597 	 * phyint_grp may be NULL.
16598 	 */
16599 	if ((phyi->phyint_flags & PHYI_IPMP) && (phyi->phyint_grp != NULL)) {
16600 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16601 		ipmp_grp_destroy(phyi->phyint_grp);
16602 		phyi->phyint_grp = NULL;
16603 		rw_exit(&ipst->ips_ipmp_lock);
16604 	}
16605 
16606 	/*
16607 	 * If this interface was under IPMP, take it out of the group.
16608 	 */
16609 	if (phyi->phyint_grp != NULL)
16610 		ipmp_phyint_leave_grp(phyi);
16611 
16612 	/*
16613 	 * Delete the phyint and disassociate its ipsq.  The ipsq itself
16614 	 * will be freed in ipsq_exit().
16615 	 */
16616 	phyi->phyint_ipsq->ipsq_phyint = NULL;
16617 	phyi->phyint_name[0] = '\0';
16618 
16619 	mi_free(phyi);
16620 }
16621 
16622 /*
16623  * Attach the ill to the phyint structure which can be shared by both
16624  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
16625  * function is called from ipif_set_values and ill_lookup_on_name (for
16626  * loopback) where we know the name of the ill. We lookup the ill and if
16627  * there is one present already with the name use that phyint. Otherwise
16628  * reuse the one allocated by ill_init.
16629  */
16630 static void
ill_phyint_reinit(ill_t * ill)16631 ill_phyint_reinit(ill_t *ill)
16632 {
16633 	boolean_t isv6 = ill->ill_isv6;
16634 	phyint_t *phyi_old;
16635 	phyint_t *phyi;
16636 	avl_index_t where = 0;
16637 	ill_t	*ill_other = NULL;
16638 	ip_stack_t	*ipst = ill->ill_ipst;
16639 
16640 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
16641 
16642 	phyi_old = ill->ill_phyint;
16643 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
16644 	    phyi_old->phyint_illv6 == NULL));
16645 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
16646 	    phyi_old->phyint_illv4 == NULL));
16647 	ASSERT(phyi_old->phyint_ifindex == 0);
16648 
16649 	/*
16650 	 * Now that our ill has a name, set it in the phyint.
16651 	 */
16652 	(void) strlcpy(ill->ill_phyint->phyint_name, ill->ill_name, LIFNAMSIZ);
16653 
16654 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16655 	    ill->ill_name, &where);
16656 
16657 	/*
16658 	 * 1. We grabbed the ill_g_lock before inserting this ill into
16659 	 *    the global list of ills. So no other thread could have located
16660 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
16661 	 * 2. Now locate the other protocol instance of this ill.
16662 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
16663 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
16664 	 *    of neither ill can change.
16665 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
16666 	 *    other ill.
16667 	 * 5. Release all locks.
16668 	 */
16669 
16670 	/*
16671 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
16672 	 * we are initializing IPv4.
16673 	 */
16674 	if (phyi != NULL) {
16675 		ill_other = (isv6) ? phyi->phyint_illv4 : phyi->phyint_illv6;
16676 		ASSERT(ill_other->ill_phyint != NULL);
16677 		ASSERT((isv6 && !ill_other->ill_isv6) ||
16678 		    (!isv6 && ill_other->ill_isv6));
16679 		GRAB_ILL_LOCKS(ill, ill_other);
16680 		/*
16681 		 * We are potentially throwing away phyint_flags which
16682 		 * could be different from the one that we obtain from
16683 		 * ill_other->ill_phyint. But it is okay as we are assuming
16684 		 * that the state maintained within IP is correct.
16685 		 */
16686 		mutex_enter(&phyi->phyint_lock);
16687 		if (isv6) {
16688 			ASSERT(phyi->phyint_illv6 == NULL);
16689 			phyi->phyint_illv6 = ill;
16690 		} else {
16691 			ASSERT(phyi->phyint_illv4 == NULL);
16692 			phyi->phyint_illv4 = ill;
16693 		}
16694 
16695 		/*
16696 		 * Delete the old phyint and make its ipsq eligible
16697 		 * to be freed in ipsq_exit().
16698 		 */
16699 		phyi_old->phyint_illv4 = NULL;
16700 		phyi_old->phyint_illv6 = NULL;
16701 		phyi_old->phyint_ipsq->ipsq_phyint = NULL;
16702 		phyi_old->phyint_name[0] = '\0';
16703 		mi_free(phyi_old);
16704 	} else {
16705 		mutex_enter(&ill->ill_lock);
16706 		/*
16707 		 * We don't need to acquire any lock, since
16708 		 * the ill is not yet visible globally  and we
16709 		 * have not yet released the ill_g_lock.
16710 		 */
16711 		phyi = phyi_old;
16712 		mutex_enter(&phyi->phyint_lock);
16713 		/* XXX We need a recovery strategy here. */
16714 		if (!phyint_assign_ifindex(phyi, ipst))
16715 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
16716 
16717 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16718 		    (void *)phyi, where);
16719 
16720 		(void) avl_find(&ipst->ips_phyint_g_list->
16721 		    phyint_list_avl_by_index,
16722 		    &phyi->phyint_ifindex, &where);
16723 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16724 		    (void *)phyi, where);
16725 	}
16726 
16727 	/*
16728 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
16729 	 * pending mp is not affected because that is per ill basis.
16730 	 */
16731 	ill->ill_phyint = phyi;
16732 
16733 	/*
16734 	 * Now that the phyint's ifindex has been assigned, complete the
16735 	 * remaining
16736 	 */
16737 	ill->ill_ip_mib->ipIfStatsIfIndex = ill->ill_phyint->phyint_ifindex;
16738 	if (ill->ill_isv6) {
16739 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
16740 		    ill->ill_phyint->phyint_ifindex;
16741 		ill->ill_mcast_type = ipst->ips_mld_max_version;
16742 	} else {
16743 		ill->ill_mcast_type = ipst->ips_igmp_max_version;
16744 	}
16745 
16746 	/*
16747 	 * Generate an event within the hooks framework to indicate that
16748 	 * a new interface has just been added to IP.  For this event to
16749 	 * be generated, the network interface must, at least, have an
16750 	 * ifindex assigned to it.  (We don't generate the event for
16751 	 * loopback since ill_lookup_on_name() has its own NE_PLUMB event.)
16752 	 *
16753 	 * This needs to be run inside the ill_g_lock perimeter to ensure
16754 	 * that the ordering of delivered events to listeners matches the
16755 	 * order of them in the kernel.
16756 	 */
16757 	if (!IS_LOOPBACK(ill)) {
16758 		ill_nic_event_dispatch(ill, 0, NE_PLUMB, ill->ill_name,
16759 		    ill->ill_name_length);
16760 	}
16761 	RELEASE_ILL_LOCKS(ill, ill_other);
16762 	mutex_exit(&phyi->phyint_lock);
16763 }
16764 
16765 /*
16766  * Notify any downstream modules of the name of this interface.
16767  * An M_IOCTL is used even though we don't expect a successful reply.
16768  * Any reply message from the driver (presumably an M_IOCNAK) will
16769  * eventually get discarded somewhere upstream.  The message format is
16770  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
16771  * to IP.
16772  */
16773 static void
ip_ifname_notify(ill_t * ill,queue_t * q)16774 ip_ifname_notify(ill_t *ill, queue_t *q)
16775 {
16776 	mblk_t *mp1, *mp2;
16777 	struct iocblk *iocp;
16778 	struct lifreq *lifr;
16779 
16780 	mp1 = mkiocb(SIOCSLIFNAME);
16781 	if (mp1 == NULL)
16782 		return;
16783 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
16784 	if (mp2 == NULL) {
16785 		freeb(mp1);
16786 		return;
16787 	}
16788 
16789 	mp1->b_cont = mp2;
16790 	iocp = (struct iocblk *)mp1->b_rptr;
16791 	iocp->ioc_count = sizeof (struct lifreq);
16792 
16793 	lifr = (struct lifreq *)mp2->b_rptr;
16794 	mp2->b_wptr += sizeof (struct lifreq);
16795 	bzero(lifr, sizeof (struct lifreq));
16796 
16797 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
16798 	lifr->lifr_ppa = ill->ill_ppa;
16799 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
16800 
16801 	DTRACE_PROBE3(ill__dlpi, char *, "ip_ifname_notify",
16802 	    char *, "SIOCSLIFNAME", ill_t *, ill);
16803 	putnext(q, mp1);
16804 }
16805 
16806 static int
ipif_set_values_tail(ill_t * ill,ipif_t * ipif,mblk_t * mp,queue_t * q)16807 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
16808 {
16809 	int		err;
16810 	ip_stack_t	*ipst = ill->ill_ipst;
16811 	phyint_t	*phyi = ill->ill_phyint;
16812 
16813 	/*
16814 	 * Now that ill_name is set, the configuration for the IPMP
16815 	 * meta-interface can be performed.
16816 	 */
16817 	if (IS_IPMP(ill)) {
16818 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16819 		/*
16820 		 * If phyi->phyint_grp is NULL, then this is the first IPMP
16821 		 * meta-interface and we need to create the IPMP group.
16822 		 */
16823 		if (phyi->phyint_grp == NULL) {
16824 			/*
16825 			 * If someone has renamed another IPMP group to have
16826 			 * the same name as our interface, bail.
16827 			 */
16828 			if (ipmp_grp_lookup(ill->ill_name, ipst) != NULL) {
16829 				rw_exit(&ipst->ips_ipmp_lock);
16830 				return (EEXIST);
16831 			}
16832 			phyi->phyint_grp = ipmp_grp_create(ill->ill_name, phyi);
16833 			if (phyi->phyint_grp == NULL) {
16834 				rw_exit(&ipst->ips_ipmp_lock);
16835 				return (ENOMEM);
16836 			}
16837 		}
16838 		rw_exit(&ipst->ips_ipmp_lock);
16839 	}
16840 
16841 	/* Tell downstream modules where they are. */
16842 	ip_ifname_notify(ill, q);
16843 
16844 	/*
16845 	 * ill_dl_phys returns EINPROGRESS in the usual case.
16846 	 * Error cases are ENOMEM ...
16847 	 */
16848 	err = ill_dl_phys(ill, ipif, mp, q);
16849 
16850 	if (ill->ill_isv6) {
16851 		mutex_enter(&ipst->ips_mld_slowtimeout_lock);
16852 		if (ipst->ips_mld_slowtimeout_id == 0) {
16853 			ipst->ips_mld_slowtimeout_id = timeout(mld_slowtimo,
16854 			    (void *)ipst,
16855 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16856 		}
16857 		mutex_exit(&ipst->ips_mld_slowtimeout_lock);
16858 	} else {
16859 		mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
16860 		if (ipst->ips_igmp_slowtimeout_id == 0) {
16861 			ipst->ips_igmp_slowtimeout_id = timeout(igmp_slowtimo,
16862 			    (void *)ipst,
16863 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16864 		}
16865 		mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
16866 	}
16867 
16868 	return (err);
16869 }
16870 
16871 /*
16872  * Common routine for ppa and ifname setting. Should be called exclusive.
16873  *
16874  * Returns EINPROGRESS when mp has been consumed by queueing it on
16875  * ipx_pending_mp and the ioctl will complete in ip_rput.
16876  *
16877  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
16878  * the new name and new ppa in lifr_name and lifr_ppa respectively.
16879  * For SLIFNAME, we pass these values back to the userland.
16880  */
16881 static int
ipif_set_values(queue_t * q,mblk_t * mp,char * interf_name,uint_t * new_ppa_ptr)16882 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
16883 {
16884 	ill_t	*ill;
16885 	ipif_t	*ipif;
16886 	ipsq_t	*ipsq;
16887 	char	*ppa_ptr;
16888 	char	*old_ptr;
16889 	char	old_char;
16890 	int	error;
16891 	ip_stack_t	*ipst;
16892 
16893 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
16894 	ASSERT(q->q_next != NULL);
16895 	ASSERT(interf_name != NULL);
16896 
16897 	ill = (ill_t *)q->q_ptr;
16898 	ipst = ill->ill_ipst;
16899 
16900 	ASSERT(ill->ill_ipst != NULL);
16901 	ASSERT(ill->ill_name[0] == '\0');
16902 	ASSERT(IAM_WRITER_ILL(ill));
16903 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
16904 	ASSERT(ill->ill_ppa == UINT_MAX);
16905 
16906 	ill->ill_defend_start = ill->ill_defend_count = 0;
16907 	/* The ppa is sent down by ifconfig or is chosen */
16908 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
16909 		return (EINVAL);
16910 	}
16911 
16912 	/*
16913 	 * make sure ppa passed in is same as ppa in the name.
16914 	 * This check is not made when ppa == UINT_MAX in that case ppa
16915 	 * in the name could be anything. System will choose a ppa and
16916 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
16917 	 */
16918 	if (*new_ppa_ptr != UINT_MAX) {
16919 		/* stoi changes the pointer */
16920 		old_ptr = ppa_ptr;
16921 		/*
16922 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
16923 		 * (they don't have an externally visible ppa).  We assign one
16924 		 * here so that we can manage the interface.  Note that in
16925 		 * the past this value was always 0 for DLPI 1 drivers.
16926 		 */
16927 		if (*new_ppa_ptr == 0)
16928 			*new_ppa_ptr = stoi(&old_ptr);
16929 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
16930 			return (EINVAL);
16931 	}
16932 	/*
16933 	 * terminate string before ppa
16934 	 * save char at that location.
16935 	 */
16936 	old_char = ppa_ptr[0];
16937 	ppa_ptr[0] = '\0';
16938 
16939 	ill->ill_ppa = *new_ppa_ptr;
16940 	/*
16941 	 * Finish as much work now as possible before calling ill_glist_insert
16942 	 * which makes the ill globally visible and also merges it with the
16943 	 * other protocol instance of this phyint. The remaining work is
16944 	 * done after entering the ipsq which may happen sometime later.
16945 	 */
16946 	ipif = ill->ill_ipif;
16947 
16948 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
16949 	ipif_assign_seqid(ipif);
16950 
16951 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
16952 		ill->ill_flags |= ILLF_IPV4;
16953 
16954 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
16955 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
16956 
16957 	if (ill->ill_flags & ILLF_IPV6) {
16958 
16959 		ill->ill_isv6 = B_TRUE;
16960 		ill_set_inputfn(ill);
16961 		if (ill->ill_rq != NULL) {
16962 			ill->ill_rq->q_qinfo = &iprinitv6;
16963 		}
16964 
16965 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
16966 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
16967 		ipif->ipif_v6subnet = ipv6_all_zeros;
16968 		ipif->ipif_v6net_mask = ipv6_all_zeros;
16969 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
16970 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
16971 		ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
16972 		/*
16973 		 * point-to-point or Non-mulicast capable
16974 		 * interfaces won't do NUD unless explicitly
16975 		 * configured to do so.
16976 		 */
16977 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
16978 		    !(ill->ill_flags & ILLF_MULTICAST)) {
16979 			ill->ill_flags |= ILLF_NONUD;
16980 		}
16981 		/* Make sure IPv4 specific flag is not set on IPv6 if */
16982 		if (ill->ill_flags & ILLF_NOARP) {
16983 			/*
16984 			 * Note: xresolv interfaces will eventually need
16985 			 * NOARP set here as well, but that will require
16986 			 * those external resolvers to have some
16987 			 * knowledge of that flag and act appropriately.
16988 			 * Not to be changed at present.
16989 			 */
16990 			ill->ill_flags &= ~ILLF_NOARP;
16991 		}
16992 		/*
16993 		 * Set the ILLF_ROUTER flag according to the global
16994 		 * IPv6 forwarding policy.
16995 		 */
16996 		if (ipst->ips_ipv6_forwarding != 0)
16997 			ill->ill_flags |= ILLF_ROUTER;
16998 	} else if (ill->ill_flags & ILLF_IPV4) {
16999 		ill->ill_isv6 = B_FALSE;
17000 		ill_set_inputfn(ill);
17001 		ill->ill_reachable_retrans_time = ARP_RETRANS_TIMER;
17002 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
17003 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
17004 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
17005 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
17006 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
17007 		/*
17008 		 * Set the ILLF_ROUTER flag according to the global
17009 		 * IPv4 forwarding policy.
17010 		 */
17011 		if (ipst->ips_ip_forwarding != 0)
17012 			ill->ill_flags |= ILLF_ROUTER;
17013 	}
17014 
17015 	ASSERT(ill->ill_phyint != NULL);
17016 
17017 	/*
17018 	 * The ipIfStatsIfindex and ipv6IfIcmpIfIndex assignments will
17019 	 * be completed in ill_glist_insert -> ill_phyint_reinit
17020 	 */
17021 	if (!ill_allocate_mibs(ill))
17022 		return (ENOMEM);
17023 
17024 	/*
17025 	 * Pick a default sap until we get the DL_INFO_ACK back from
17026 	 * the driver.
17027 	 */
17028 	ill->ill_sap = (ill->ill_isv6) ? ill->ill_media->ip_m_ipv6sap :
17029 	    ill->ill_media->ip_m_ipv4sap;
17030 
17031 	ill->ill_ifname_pending = 1;
17032 	ill->ill_ifname_pending_err = 0;
17033 
17034 	/*
17035 	 * When the first ipif comes up in ipif_up_done(), multicast groups
17036 	 * that were joined while this ill was not bound to the DLPI link need
17037 	 * to be recovered by ill_recover_multicast().
17038 	 */
17039 	ill->ill_need_recover_multicast = 1;
17040 
17041 	ill_refhold(ill);
17042 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
17043 	if ((error = ill_glist_insert(ill, interf_name,
17044 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
17045 		ill->ill_ppa = UINT_MAX;
17046 		ill->ill_name[0] = '\0';
17047 		/*
17048 		 * undo null termination done above.
17049 		 */
17050 		ppa_ptr[0] = old_char;
17051 		rw_exit(&ipst->ips_ill_g_lock);
17052 		ill_refrele(ill);
17053 		return (error);
17054 	}
17055 
17056 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
17057 
17058 	/*
17059 	 * When we return the buffer pointed to by interf_name should contain
17060 	 * the same name as in ill_name.
17061 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
17062 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
17063 	 * so copy full name and update the ppa ptr.
17064 	 * When ppa passed in != UINT_MAX all values are correct just undo
17065 	 * null termination, this saves a bcopy.
17066 	 */
17067 	if (*new_ppa_ptr == UINT_MAX) {
17068 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
17069 		*new_ppa_ptr = ill->ill_ppa;
17070 	} else {
17071 		/*
17072 		 * undo null termination done above.
17073 		 */
17074 		ppa_ptr[0] = old_char;
17075 	}
17076 
17077 	/* Let SCTP know about this ILL */
17078 	sctp_update_ill(ill, SCTP_ILL_INSERT);
17079 
17080 	/*
17081 	 * ill_glist_insert has made the ill visible globally, and
17082 	 * ill_phyint_reinit could have changed the ipsq. At this point,
17083 	 * we need to hold the ips_ill_g_lock across the call to enter the
17084 	 * ipsq to enforce atomicity and prevent reordering. In the event
17085 	 * the ipsq has changed, and if the new ipsq is currently busy,
17086 	 * we need to make sure that this half-completed ioctl is ahead of
17087 	 * any subsequent ioctl. We achieve this by not dropping the
17088 	 * ips_ill_g_lock which prevents any ill lookup itself thereby
17089 	 * ensuring that new ioctls can't start.
17090 	 */
17091 	ipsq = ipsq_try_enter_internal(ill, q, mp, ip_reprocess_ioctl, NEW_OP,
17092 	    B_TRUE);
17093 
17094 	rw_exit(&ipst->ips_ill_g_lock);
17095 	ill_refrele(ill);
17096 	if (ipsq == NULL)
17097 		return (EINPROGRESS);
17098 
17099 	/*
17100 	 * If ill_phyint_reinit() changed our ipsq, then start on the new ipsq.
17101 	 */
17102 	if (ipsq->ipsq_xop->ipx_current_ipif == NULL)
17103 		ipsq_current_start(ipsq, ipif, SIOCSLIFNAME);
17104 	else
17105 		ASSERT(ipsq->ipsq_xop->ipx_current_ipif == ipif);
17106 
17107 	error = ipif_set_values_tail(ill, ipif, mp, q);
17108 	ipsq_exit(ipsq);
17109 	if (error != 0 && error != EINPROGRESS) {
17110 		/*
17111 		 * restore previous values
17112 		 */
17113 		ill->ill_isv6 = B_FALSE;
17114 		ill_set_inputfn(ill);
17115 	}
17116 	return (error);
17117 }
17118 
17119 void
ipif_init(ip_stack_t * ipst)17120 ipif_init(ip_stack_t *ipst)
17121 {
17122 	int i;
17123 
17124 	for (i = 0; i < MAX_G_HEADS; i++) {
17125 		ipst->ips_ill_g_heads[i].ill_g_list_head =
17126 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
17127 		ipst->ips_ill_g_heads[i].ill_g_list_tail =
17128 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
17129 	}
17130 
17131 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17132 	    ill_phyint_compare_index,
17133 	    sizeof (phyint_t),
17134 	    offsetof(struct phyint, phyint_avl_by_index));
17135 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
17136 	    ill_phyint_compare_name,
17137 	    sizeof (phyint_t),
17138 	    offsetof(struct phyint, phyint_avl_by_name));
17139 }
17140 
17141 /*
17142  * Save enough information so that we can recreate the IRE if
17143  * the interface goes down and then up.
17144  */
17145 void
ill_save_ire(ill_t * ill,ire_t * ire)17146 ill_save_ire(ill_t *ill, ire_t *ire)
17147 {
17148 	mblk_t	*save_mp;
17149 
17150 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
17151 	if (save_mp != NULL) {
17152 		ifrt_t	*ifrt;
17153 
17154 		save_mp->b_wptr += sizeof (ifrt_t);
17155 		ifrt = (ifrt_t *)save_mp->b_rptr;
17156 		bzero(ifrt, sizeof (ifrt_t));
17157 		ifrt->ifrt_type = ire->ire_type;
17158 		if (ire->ire_ipversion == IPV4_VERSION) {
17159 			ASSERT(!ill->ill_isv6);
17160 			ifrt->ifrt_addr = ire->ire_addr;
17161 			ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
17162 			ifrt->ifrt_setsrc_addr = ire->ire_setsrc_addr;
17163 			ifrt->ifrt_mask = ire->ire_mask;
17164 		} else {
17165 			ASSERT(ill->ill_isv6);
17166 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
17167 			/* ire_gateway_addr_v6 can change due to RTM_CHANGE */
17168 			mutex_enter(&ire->ire_lock);
17169 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
17170 			mutex_exit(&ire->ire_lock);
17171 			ifrt->ifrt_v6setsrc_addr = ire->ire_setsrc_addr_v6;
17172 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
17173 		}
17174 		ifrt->ifrt_flags = ire->ire_flags;
17175 		ifrt->ifrt_zoneid = ire->ire_zoneid;
17176 		mutex_enter(&ill->ill_saved_ire_lock);
17177 		save_mp->b_cont = ill->ill_saved_ire_mp;
17178 		ill->ill_saved_ire_mp = save_mp;
17179 		ill->ill_saved_ire_cnt++;
17180 		mutex_exit(&ill->ill_saved_ire_lock);
17181 	}
17182 }
17183 
17184 /*
17185  * Remove one entry from ill_saved_ire_mp.
17186  */
17187 void
ill_remove_saved_ire(ill_t * ill,ire_t * ire)17188 ill_remove_saved_ire(ill_t *ill, ire_t *ire)
17189 {
17190 	mblk_t	**mpp;
17191 	mblk_t	*mp;
17192 	ifrt_t	*ifrt;
17193 
17194 	/* Remove from ill_saved_ire_mp list if it is there */
17195 	mutex_enter(&ill->ill_saved_ire_lock);
17196 	for (mpp = &ill->ill_saved_ire_mp; *mpp != NULL;
17197 	    mpp = &(*mpp)->b_cont) {
17198 		in6_addr_t	gw_addr_v6;
17199 
17200 		/*
17201 		 * On a given ill, the tuple of address, gateway, mask,
17202 		 * ire_type, and zoneid is unique for each saved IRE.
17203 		 */
17204 		mp = *mpp;
17205 		ifrt = (ifrt_t *)mp->b_rptr;
17206 		/* ire_gateway_addr_v6 can change - need lock */
17207 		mutex_enter(&ire->ire_lock);
17208 		gw_addr_v6 = ire->ire_gateway_addr_v6;
17209 		mutex_exit(&ire->ire_lock);
17210 
17211 		if (ifrt->ifrt_zoneid != ire->ire_zoneid ||
17212 		    ifrt->ifrt_type != ire->ire_type)
17213 			continue;
17214 
17215 		if (ill->ill_isv6 ?
17216 		    (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
17217 		    &ire->ire_addr_v6) &&
17218 		    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
17219 		    &gw_addr_v6) &&
17220 		    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
17221 		    &ire->ire_mask_v6)) :
17222 		    (ifrt->ifrt_addr == ire->ire_addr &&
17223 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
17224 		    ifrt->ifrt_mask == ire->ire_mask)) {
17225 			*mpp = mp->b_cont;
17226 			ill->ill_saved_ire_cnt--;
17227 			freeb(mp);
17228 			break;
17229 		}
17230 	}
17231 	mutex_exit(&ill->ill_saved_ire_lock);
17232 }
17233 
17234 /*
17235  * IP multirouting broadcast routes handling
17236  * Append CGTP broadcast IREs to regular ones created
17237  * at ifconfig time.
17238  * The usage is a route add <cgtp_bc> <nic_bc> -multirt i.e., both
17239  * the destination and the gateway are broadcast addresses.
17240  * The caller has verified that the destination is an IRE_BROADCAST and that
17241  * RTF_MULTIRT was set. Here if the gateway is a broadcast address, then
17242  * we create a MULTIRT IRE_BROADCAST.
17243  * Note that the IRE_HOST created by ire_rt_add doesn't get found by anything
17244  * since the IRE_BROADCAST takes precedence; ire_add_v4 does head insertion.
17245  */
17246 static void
ip_cgtp_bcast_add(ire_t * ire,ip_stack_t * ipst)17247 ip_cgtp_bcast_add(ire_t *ire, ip_stack_t *ipst)
17248 {
17249 	ire_t *ire_prim;
17250 
17251 	ASSERT(ire != NULL);
17252 
17253 	ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17254 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
17255 	    NULL);
17256 	if (ire_prim != NULL) {
17257 		/*
17258 		 * We are in the special case of broadcasts for
17259 		 * CGTP. We add an IRE_BROADCAST that holds
17260 		 * the RTF_MULTIRT flag, the destination
17261 		 * address and the low level
17262 		 * info of ire_prim. In other words, CGTP
17263 		 * broadcast is added to the redundant ipif.
17264 		 */
17265 		ill_t *ill_prim;
17266 		ire_t  *bcast_ire;
17267 
17268 		ill_prim = ire_prim->ire_ill;
17269 
17270 		ip2dbg(("ip_cgtp_filter_bcast_add: ire_prim %p, ill_prim %p\n",
17271 		    (void *)ire_prim, (void *)ill_prim));
17272 
17273 		bcast_ire = ire_create(
17274 		    (uchar_t *)&ire->ire_addr,
17275 		    (uchar_t *)&ip_g_all_ones,
17276 		    (uchar_t *)&ire->ire_gateway_addr,
17277 		    IRE_BROADCAST,
17278 		    ill_prim,
17279 		    GLOBAL_ZONEID,	/* CGTP is only for the global zone */
17280 		    ire->ire_flags | RTF_KERNEL,
17281 		    NULL,
17282 		    ipst);
17283 
17284 		/*
17285 		 * Here we assume that ire_add does head insertion so that
17286 		 * the added IRE_BROADCAST comes before the existing IRE_HOST.
17287 		 */
17288 		if (bcast_ire != NULL) {
17289 			if (ire->ire_flags & RTF_SETSRC) {
17290 				bcast_ire->ire_setsrc_addr =
17291 				    ire->ire_setsrc_addr;
17292 			}
17293 			bcast_ire = ire_add(bcast_ire);
17294 			if (bcast_ire != NULL) {
17295 				ip2dbg(("ip_cgtp_filter_bcast_add: "
17296 				    "added bcast_ire %p\n",
17297 				    (void *)bcast_ire));
17298 
17299 				ill_save_ire(ill_prim, bcast_ire);
17300 				ire_refrele(bcast_ire);
17301 			}
17302 		}
17303 		ire_refrele(ire_prim);
17304 	}
17305 }
17306 
17307 /*
17308  * IP multirouting broadcast routes handling
17309  * Remove the broadcast ire.
17310  * The usage is a route delete <cgtp_bc> <nic_bc> -multirt i.e., both
17311  * the destination and the gateway are broadcast addresses.
17312  * The caller has only verified that RTF_MULTIRT was set. We check
17313  * that the destination is broadcast and that the gateway is a broadcast
17314  * address, and if so delete the IRE added by ip_cgtp_bcast_add().
17315  */
17316 static void
ip_cgtp_bcast_delete(ire_t * ire,ip_stack_t * ipst)17317 ip_cgtp_bcast_delete(ire_t *ire, ip_stack_t *ipst)
17318 {
17319 	ASSERT(ire != NULL);
17320 
17321 	if (ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST) {
17322 		ire_t *ire_prim;
17323 
17324 		ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17325 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0,
17326 		    ipst, NULL);
17327 		if (ire_prim != NULL) {
17328 			ill_t *ill_prim;
17329 			ire_t  *bcast_ire;
17330 
17331 			ill_prim = ire_prim->ire_ill;
17332 
17333 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
17334 			    "ire_prim %p, ill_prim %p\n",
17335 			    (void *)ire_prim, (void *)ill_prim));
17336 
17337 			bcast_ire = ire_ftable_lookup_v4(ire->ire_addr, 0,
17338 			    ire->ire_gateway_addr, IRE_BROADCAST,
17339 			    ill_prim, ALL_ZONES, NULL,
17340 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_ILL |
17341 			    MATCH_IRE_MASK, 0, ipst, NULL);
17342 
17343 			if (bcast_ire != NULL) {
17344 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
17345 				    "looked up bcast_ire %p\n",
17346 				    (void *)bcast_ire));
17347 				ill_remove_saved_ire(bcast_ire->ire_ill,
17348 				    bcast_ire);
17349 				ire_delete(bcast_ire);
17350 				ire_refrele(bcast_ire);
17351 			}
17352 			ire_refrele(ire_prim);
17353 		}
17354 	}
17355 }
17356 
17357 /*
17358  * Derive an interface id from the link layer address.
17359  * Knows about IEEE 802 and IEEE EUI-64 mappings.
17360  */
17361 static void
ip_ether_v6intfid(ill_t * ill,in6_addr_t * v6addr)17362 ip_ether_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17363 {
17364 	char		*addr;
17365 
17366 	/*
17367 	 * Note that some IPv6 interfaces get plumbed over links that claim to
17368 	 * be DL_ETHER, but don't actually have Ethernet MAC addresses (e.g.
17369 	 * PPP links).  The ETHERADDRL check here ensures that we only set the
17370 	 * interface ID on IPv6 interfaces above links that actually have real
17371 	 * Ethernet addresses.
17372 	 */
17373 	if (ill->ill_phys_addr_length == ETHERADDRL) {
17374 		/* Form EUI-64 like address */
17375 		addr = (char *)&v6addr->s6_addr32[2];
17376 		bcopy(ill->ill_phys_addr, addr, 3);
17377 		addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
17378 		addr[3] = (char)0xff;
17379 		addr[4] = (char)0xfe;
17380 		bcopy(ill->ill_phys_addr + 3, addr + 5, 3);
17381 	}
17382 }
17383 
17384 /* ARGSUSED */
17385 static void
ip_nodef_v6intfid(ill_t * ill,in6_addr_t * v6addr)17386 ip_nodef_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17387 {
17388 }
17389 
17390 typedef struct ipmp_ifcookie {
17391 	uint32_t	ic_hostid;
17392 	char		ic_ifname[LIFNAMSIZ];
17393 	char		ic_zonename[ZONENAME_MAX];
17394 } ipmp_ifcookie_t;
17395 
17396 /*
17397  * Construct a pseudo-random interface ID for the IPMP interface that's both
17398  * predictable and (almost) guaranteed to be unique.
17399  */
17400 static void
ip_ipmp_v6intfid(ill_t * ill,in6_addr_t * v6addr)17401 ip_ipmp_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17402 {
17403 	zone_t		*zp;
17404 	uint8_t		*addr;
17405 	uchar_t		hash[16];
17406 	ulong_t		hostid;
17407 	MD5_CTX		ctx;
17408 	ipmp_ifcookie_t	ic = { 0 };
17409 
17410 	ASSERT(IS_IPMP(ill));
17411 
17412 	(void) ddi_strtoul(hw_serial, NULL, 10, &hostid);
17413 	ic.ic_hostid = htonl((uint32_t)hostid);
17414 
17415 	(void) strlcpy(ic.ic_ifname, ill->ill_name, LIFNAMSIZ);
17416 
17417 	if ((zp = zone_find_by_id(ill->ill_zoneid)) != NULL) {
17418 		(void) strlcpy(ic.ic_zonename, zp->zone_name, ZONENAME_MAX);
17419 		zone_rele(zp);
17420 	}
17421 
17422 	MD5Init(&ctx);
17423 	MD5Update(&ctx, &ic, sizeof (ic));
17424 	MD5Final(hash, &ctx);
17425 
17426 	/*
17427 	 * Map the hash to an interface ID per the basic approach in RFC3041.
17428 	 */
17429 	addr = &v6addr->s6_addr8[8];
17430 	bcopy(hash + 8, addr, sizeof (uint64_t));
17431 	addr[0] &= ~0x2;				/* set local bit */
17432 }
17433 
17434 /*
17435  * Map the multicast in6_addr_t in m_ip6addr to the physaddr for ethernet.
17436  */
17437 static void
ip_ether_v6_mapping(ill_t * ill,uchar_t * m_ip6addr,uchar_t * m_physaddr)17438 ip_ether_v6_mapping(ill_t *ill, uchar_t *m_ip6addr, uchar_t *m_physaddr)
17439 {
17440 	phyint_t *phyi = ill->ill_phyint;
17441 
17442 	/*
17443 	 * Check PHYI_MULTI_BCAST and length of physical
17444 	 * address to determine if we use the mapping or the
17445 	 * broadcast address.
17446 	 */
17447 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17448 	    ill->ill_phys_addr_length != ETHERADDRL) {
17449 		ip_mbcast_mapping(ill, m_ip6addr, m_physaddr);
17450 		return;
17451 	}
17452 	m_physaddr[0] = 0x33;
17453 	m_physaddr[1] = 0x33;
17454 	m_physaddr[2] = m_ip6addr[12];
17455 	m_physaddr[3] = m_ip6addr[13];
17456 	m_physaddr[4] = m_ip6addr[14];
17457 	m_physaddr[5] = m_ip6addr[15];
17458 }
17459 
17460 /*
17461  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for ethernet.
17462  */
17463 static void
ip_ether_v4_mapping(ill_t * ill,uchar_t * m_ipaddr,uchar_t * m_physaddr)17464 ip_ether_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17465 {
17466 	phyint_t *phyi = ill->ill_phyint;
17467 
17468 	/*
17469 	 * Check PHYI_MULTI_BCAST and length of physical
17470 	 * address to determine if we use the mapping or the
17471 	 * broadcast address.
17472 	 */
17473 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17474 	    ill->ill_phys_addr_length != ETHERADDRL) {
17475 		ip_mbcast_mapping(ill, m_ipaddr, m_physaddr);
17476 		return;
17477 	}
17478 	m_physaddr[0] = 0x01;
17479 	m_physaddr[1] = 0x00;
17480 	m_physaddr[2] = 0x5e;
17481 	m_physaddr[3] = m_ipaddr[1] & 0x7f;
17482 	m_physaddr[4] = m_ipaddr[2];
17483 	m_physaddr[5] = m_ipaddr[3];
17484 }
17485 
17486 /* ARGSUSED */
17487 static void
ip_mbcast_mapping(ill_t * ill,uchar_t * m_ipaddr,uchar_t * m_physaddr)17488 ip_mbcast_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17489 {
17490 	/*
17491 	 * for the MULTI_BCAST case and other cases when we want to
17492 	 * use the link-layer broadcast address for multicast.
17493 	 */
17494 	uint8_t	*bphys_addr;
17495 	dl_unitdata_req_t *dlur;
17496 
17497 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17498 	if (ill->ill_sap_length < 0) {
17499 		bphys_addr = (uchar_t *)dlur +
17500 		    dlur->dl_dest_addr_offset;
17501 	} else  {
17502 		bphys_addr = (uchar_t *)dlur +
17503 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
17504 	}
17505 
17506 	bcopy(bphys_addr, m_physaddr, ill->ill_phys_addr_length);
17507 }
17508 
17509 /*
17510  * Derive IPoIB interface id from the link layer address.
17511  */
17512 static void
ip_ib_v6intfid(ill_t * ill,in6_addr_t * v6addr)17513 ip_ib_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17514 {
17515 	char		*addr;
17516 
17517 	ASSERT(ill->ill_phys_addr_length == 20);
17518 	addr = (char *)&v6addr->s6_addr32[2];
17519 	bcopy(ill->ill_phys_addr + 12, addr, 8);
17520 	/*
17521 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
17522 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
17523 	 * rules. In these cases, the IBA considers these GUIDs to be in
17524 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
17525 	 * required; vendors are required not to assign global EUI-64's
17526 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
17527 	 * of the interface identifier. Whether the GUID is in modified
17528 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
17529 	 * bit set to 1.
17530 	 */
17531 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
17532 }
17533 
17534 /*
17535  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for InfiniBand.
17536  * Note on mapping from multicast IP addresses to IPoIB multicast link
17537  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
17538  * The format of an IPoIB multicast address is:
17539  *
17540  *  4 byte QPN      Scope Sign.  Pkey
17541  * +--------------------------------------------+
17542  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
17543  * +--------------------------------------------+
17544  *
17545  * The Scope and Pkey components are properties of the IBA port and
17546  * network interface. They can be ascertained from the broadcast address.
17547  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
17548  */
17549 static void
ip_ib_v4_mapping(ill_t * ill,uchar_t * m_ipaddr,uchar_t * m_physaddr)17550 ip_ib_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17551 {
17552 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17553 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
17554 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17555 	uint8_t	*bphys_addr;
17556 	dl_unitdata_req_t *dlur;
17557 
17558 	bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17559 
17560 	/*
17561 	 * RFC 4391: IPv4 MGID is 28-bit long.
17562 	 */
17563 	m_physaddr[16] = m_ipaddr[0] & 0x0f;
17564 	m_physaddr[17] = m_ipaddr[1];
17565 	m_physaddr[18] = m_ipaddr[2];
17566 	m_physaddr[19] = m_ipaddr[3];
17567 
17568 
17569 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17570 	if (ill->ill_sap_length < 0) {
17571 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17572 	} else  {
17573 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17574 		    ill->ill_sap_length;
17575 	}
17576 	/*
17577 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
17578 	 */
17579 	m_physaddr[5] = bphys_addr[5];
17580 	m_physaddr[8] = bphys_addr[8];
17581 	m_physaddr[9] = bphys_addr[9];
17582 }
17583 
17584 static void
ip_ib_v6_mapping(ill_t * ill,uchar_t * m_ipaddr,uchar_t * m_physaddr)17585 ip_ib_v6_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17586 {
17587 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17588 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
17589 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17590 	uint8_t	*bphys_addr;
17591 	dl_unitdata_req_t *dlur;
17592 
17593 	bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17594 
17595 	/*
17596 	 * RFC 4391: IPv4 MGID is 80-bit long.
17597 	 */
17598 	bcopy(&m_ipaddr[6], &m_physaddr[10], 10);
17599 
17600 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17601 	if (ill->ill_sap_length < 0) {
17602 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17603 	} else  {
17604 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17605 		    ill->ill_sap_length;
17606 	}
17607 	/*
17608 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
17609 	 */
17610 	m_physaddr[5] = bphys_addr[5];
17611 	m_physaddr[8] = bphys_addr[8];
17612 	m_physaddr[9] = bphys_addr[9];
17613 }
17614 
17615 /*
17616  * Derive IPv6 interface id from an IPv4 link-layer address (e.g. from an IPv4
17617  * tunnel).  The IPv4 address simply get placed in the lower 4 bytes of the
17618  * IPv6 interface id.  This is a suggested mechanism described in section 3.7
17619  * of RFC4213.
17620  */
17621 static void
ip_ipv4_genv6intfid(ill_t * ill,uint8_t * physaddr,in6_addr_t * v6addr)17622 ip_ipv4_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17623 {
17624 	ASSERT(ill->ill_phys_addr_length == sizeof (ipaddr_t));
17625 	v6addr->s6_addr32[2] = 0;
17626 	bcopy(physaddr, &v6addr->s6_addr32[3], sizeof (ipaddr_t));
17627 }
17628 
17629 /*
17630  * Derive IPv6 interface id from an IPv6 link-layer address (e.g. from an IPv6
17631  * tunnel).  The lower 8 bytes of the IPv6 address simply become the interface
17632  * id.
17633  */
17634 static void
ip_ipv6_genv6intfid(ill_t * ill,uint8_t * physaddr,in6_addr_t * v6addr)17635 ip_ipv6_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17636 {
17637 	in6_addr_t *v6lladdr = (in6_addr_t *)physaddr;
17638 
17639 	ASSERT(ill->ill_phys_addr_length == sizeof (in6_addr_t));
17640 	bcopy(&v6lladdr->s6_addr32[2], &v6addr->s6_addr32[2], 8);
17641 }
17642 
17643 static void
ip_ipv6_v6intfid(ill_t * ill,in6_addr_t * v6addr)17644 ip_ipv6_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17645 {
17646 	ip_ipv6_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17647 }
17648 
17649 static void
ip_ipv6_v6destintfid(ill_t * ill,in6_addr_t * v6addr)17650 ip_ipv6_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17651 {
17652 	ip_ipv6_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17653 }
17654 
17655 static void
ip_ipv4_v6intfid(ill_t * ill,in6_addr_t * v6addr)17656 ip_ipv4_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17657 {
17658 	ip_ipv4_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17659 }
17660 
17661 static void
ip_ipv4_v6destintfid(ill_t * ill,in6_addr_t * v6addr)17662 ip_ipv4_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17663 {
17664 	ip_ipv4_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17665 }
17666 
17667 /*
17668  * Lookup an ill and verify that the zoneid has an ipif on that ill.
17669  * Returns an held ill, or NULL.
17670  */
17671 ill_t *
ill_lookup_on_ifindex_zoneid(uint_t index,zoneid_t zoneid,boolean_t isv6,ip_stack_t * ipst)17672 ill_lookup_on_ifindex_zoneid(uint_t index, zoneid_t zoneid, boolean_t isv6,
17673     ip_stack_t *ipst)
17674 {
17675 	ill_t	*ill;
17676 	ipif_t	*ipif;
17677 
17678 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
17679 	if (ill == NULL)
17680 		return (NULL);
17681 
17682 	mutex_enter(&ill->ill_lock);
17683 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17684 		if (IPIF_IS_CONDEMNED(ipif))
17685 			continue;
17686 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
17687 		    ipif->ipif_zoneid != ALL_ZONES)
17688 			continue;
17689 
17690 		mutex_exit(&ill->ill_lock);
17691 		return (ill);
17692 	}
17693 	mutex_exit(&ill->ill_lock);
17694 	ill_refrele(ill);
17695 	return (NULL);
17696 }
17697 
17698 /*
17699  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
17700  * If a pointer to an ipif_t is returned then the caller will need to do
17701  * an ill_refrele().
17702  */
17703 ipif_t *
ipif_getby_indexes(uint_t ifindex,uint_t lifidx,boolean_t isv6,ip_stack_t * ipst)17704 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6,
17705     ip_stack_t *ipst)
17706 {
17707 	ipif_t *ipif;
17708 	ill_t *ill;
17709 
17710 	ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
17711 	if (ill == NULL)
17712 		return (NULL);
17713 
17714 	mutex_enter(&ill->ill_lock);
17715 	if (ill->ill_state_flags & ILL_CONDEMNED) {
17716 		mutex_exit(&ill->ill_lock);
17717 		ill_refrele(ill);
17718 		return (NULL);
17719 	}
17720 
17721 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17722 		if (!IPIF_CAN_LOOKUP(ipif))
17723 			continue;
17724 		if (lifidx == ipif->ipif_id) {
17725 			ipif_refhold_locked(ipif);
17726 			break;
17727 		}
17728 	}
17729 
17730 	mutex_exit(&ill->ill_lock);
17731 	ill_refrele(ill);
17732 	return (ipif);
17733 }
17734 
17735 /*
17736  * Set ill_inputfn based on the current know state.
17737  * This needs to be called when any of the factors taken into
17738  * account changes.
17739  */
17740 void
ill_set_inputfn(ill_t * ill)17741 ill_set_inputfn(ill_t *ill)
17742 {
17743 	ip_stack_t	*ipst = ill->ill_ipst;
17744 
17745 	if (ill->ill_isv6) {
17746 		if (is_system_labeled())
17747 			ill->ill_inputfn = ill_input_full_v6;
17748 		else
17749 			ill->ill_inputfn = ill_input_short_v6;
17750 	} else {
17751 		if (is_system_labeled())
17752 			ill->ill_inputfn = ill_input_full_v4;
17753 		else if (ill->ill_dhcpinit != 0)
17754 			ill->ill_inputfn = ill_input_full_v4;
17755 		else if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head
17756 		    != NULL)
17757 			ill->ill_inputfn = ill_input_full_v4;
17758 		else if (ipst->ips_ip_cgtp_filter &&
17759 		    ipst->ips_ip_cgtp_filter_ops != NULL)
17760 			ill->ill_inputfn = ill_input_full_v4;
17761 		else
17762 			ill->ill_inputfn = ill_input_short_v4;
17763 	}
17764 }
17765 
17766 /*
17767  * Re-evaluate ill_inputfn for all the IPv4 ills.
17768  * Used when RSVP and CGTP comes and goes.
17769  */
17770 void
ill_set_inputfn_all(ip_stack_t * ipst)17771 ill_set_inputfn_all(ip_stack_t *ipst)
17772 {
17773 	ill_walk_context_t	ctx;
17774 	ill_t			*ill;
17775 
17776 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
17777 	ill = ILL_START_WALK_V4(&ctx, ipst);
17778 	for (; ill != NULL; ill = ill_next(&ctx, ill))
17779 		ill_set_inputfn(ill);
17780 
17781 	rw_exit(&ipst->ips_ill_g_lock);
17782 }
17783 
17784 /*
17785  * Set the physical address information for `ill' to the contents of the
17786  * dl_notify_ind_t pointed to by `mp'.  Must be called as writer, and will be
17787  * asynchronous if `ill' cannot immediately be quiesced -- in which case
17788  * EINPROGRESS will be returned.
17789  */
17790 int
ill_set_phys_addr(ill_t * ill,mblk_t * mp)17791 ill_set_phys_addr(ill_t *ill, mblk_t *mp)
17792 {
17793 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17794 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)mp->b_rptr;
17795 
17796 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17797 
17798 	if (dlindp->dl_data != DL_IPV6_LINK_LAYER_ADDR &&
17799 	    dlindp->dl_data != DL_CURR_DEST_ADDR &&
17800 	    dlindp->dl_data != DL_CURR_PHYS_ADDR) {
17801 		/* Changing DL_IPV6_TOKEN is not yet supported */
17802 		return (0);
17803 	}
17804 
17805 	/*
17806 	 * We need to store up to two copies of `mp' in `ill'.  Due to the
17807 	 * design of ipsq_pending_mp_add(), we can't pass them as separate
17808 	 * arguments to ill_set_phys_addr_tail().  Instead, chain them
17809 	 * together here, then pull 'em apart in ill_set_phys_addr_tail().
17810 	 */
17811 	if ((mp = copyb(mp)) == NULL || (mp->b_cont = copyb(mp)) == NULL) {
17812 		freemsg(mp);
17813 		return (ENOMEM);
17814 	}
17815 
17816 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
17817 
17818 	/*
17819 	 * Since we'll only do a logical down, we can't rely on ipif_down
17820 	 * to turn on ILL_DOWN_IN_PROGRESS, or for the DL_BIND_ACK to reset
17821 	 * ILL_DOWN_IN_PROGRESS. We instead manage this separately for this
17822 	 * case, to quiesce ire's and nce's for ill_is_quiescent.
17823 	 */
17824 	mutex_enter(&ill->ill_lock);
17825 	ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
17826 	/* no more ire/nce addition allowed */
17827 	mutex_exit(&ill->ill_lock);
17828 
17829 	/*
17830 	 * If we can quiesce the ill, then set the address.  If not, then
17831 	 * ill_set_phys_addr_tail() will be called from ipif_ill_refrele_tail().
17832 	 */
17833 	ill_down_ipifs(ill, B_TRUE);
17834 	mutex_enter(&ill->ill_lock);
17835 	if (!ill_is_quiescent(ill)) {
17836 		/* call cannot fail since `conn_t *' argument is NULL */
17837 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
17838 		    mp, ILL_DOWN);
17839 		mutex_exit(&ill->ill_lock);
17840 		return (EINPROGRESS);
17841 	}
17842 	mutex_exit(&ill->ill_lock);
17843 
17844 	ill_set_phys_addr_tail(ipsq, ill->ill_rq, mp, NULL);
17845 	return (0);
17846 }
17847 
17848 /*
17849  * When the allowed-ips link property is set on the datalink, IP receives a
17850  * DL_NOTE_ALLOWED_IPS notification that is processed in ill_set_allowed_ips()
17851  * to initialize the ill_allowed_ips[] array in the ill_t. This array is then
17852  * used to vet addresses passed to ip_sioctl_addr() and to ensure that the
17853  * only IP addresses configured on the ill_t are those in the ill_allowed_ips[]
17854  * array.
17855  */
17856 void
ill_set_allowed_ips(ill_t * ill,mblk_t * mp)17857 ill_set_allowed_ips(ill_t *ill, mblk_t *mp)
17858 {
17859 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17860 	dl_notify_ind_t	*dlip = (dl_notify_ind_t *)mp->b_rptr;
17861 	mac_protect_t *mrp;
17862 	int i;
17863 
17864 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17865 	mrp = (mac_protect_t *)&dlip[1];
17866 
17867 	if (mrp->mp_ipaddrcnt == 0) { /* reset allowed-ips */
17868 		kmem_free(ill->ill_allowed_ips,
17869 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17870 		ill->ill_allowed_ips_cnt = 0;
17871 		ill->ill_allowed_ips = NULL;
17872 		mutex_enter(&ill->ill_phyint->phyint_lock);
17873 		ill->ill_phyint->phyint_flags &= ~PHYI_L3PROTECT;
17874 		mutex_exit(&ill->ill_phyint->phyint_lock);
17875 		return;
17876 	}
17877 
17878 	if (ill->ill_allowed_ips != NULL) {
17879 		kmem_free(ill->ill_allowed_ips,
17880 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17881 	}
17882 	ill->ill_allowed_ips_cnt = mrp->mp_ipaddrcnt;
17883 	ill->ill_allowed_ips = kmem_alloc(
17884 	    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t), KM_SLEEP);
17885 	for (i = 0; i < mrp->mp_ipaddrcnt;  i++)
17886 		ill->ill_allowed_ips[i] = mrp->mp_ipaddrs[i].ip_addr;
17887 
17888 	mutex_enter(&ill->ill_phyint->phyint_lock);
17889 	ill->ill_phyint->phyint_flags |= PHYI_L3PROTECT;
17890 	mutex_exit(&ill->ill_phyint->phyint_lock);
17891 }
17892 
17893 /*
17894  * Once the ill associated with `q' has quiesced, set its physical address
17895  * information to the values in `addrmp'.  Note that two copies of `addrmp'
17896  * are passed (linked by b_cont), since we sometimes need to save two distinct
17897  * copies in the ill_t, and our context doesn't permit sleeping or allocation
17898  * failure (we'll free the other copy if it's not needed).  Since the ill_t
17899  * is quiesced, we know any stale nce's with the old address information have
17900  * already been removed, so we don't need to call nce_flush().
17901  */
17902 /* ARGSUSED */
17903 static void
ill_set_phys_addr_tail(ipsq_t * ipsq,queue_t * q,mblk_t * addrmp,void * dummy)17904 ill_set_phys_addr_tail(ipsq_t *ipsq, queue_t *q, mblk_t *addrmp, void *dummy)
17905 {
17906 	ill_t		*ill = q->q_ptr;
17907 	mblk_t		*addrmp2 = unlinkb(addrmp);
17908 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)addrmp->b_rptr;
17909 	uint_t		addrlen, addroff;
17910 	int		status;
17911 
17912 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17913 
17914 	addroff	= dlindp->dl_addr_offset;
17915 	addrlen = dlindp->dl_addr_length - ABS(ill->ill_sap_length);
17916 
17917 	switch (dlindp->dl_data) {
17918 	case DL_IPV6_LINK_LAYER_ADDR:
17919 		ill_set_ndmp(ill, addrmp, addroff, addrlen);
17920 		freemsg(addrmp2);
17921 		break;
17922 
17923 	case DL_CURR_DEST_ADDR:
17924 		freemsg(ill->ill_dest_addr_mp);
17925 		ill->ill_dest_addr = addrmp->b_rptr + addroff;
17926 		ill->ill_dest_addr_mp = addrmp;
17927 		if (ill->ill_isv6) {
17928 			ill_setdesttoken(ill);
17929 			ipif_setdestlinklocal(ill->ill_ipif);
17930 		}
17931 		freemsg(addrmp2);
17932 		break;
17933 
17934 	case DL_CURR_PHYS_ADDR:
17935 		freemsg(ill->ill_phys_addr_mp);
17936 		ill->ill_phys_addr = addrmp->b_rptr + addroff;
17937 		ill->ill_phys_addr_mp = addrmp;
17938 		ill->ill_phys_addr_length = addrlen;
17939 		if (ill->ill_isv6)
17940 			ill_set_ndmp(ill, addrmp2, addroff, addrlen);
17941 		else
17942 			freemsg(addrmp2);
17943 		if (ill->ill_isv6) {
17944 			ill_setdefaulttoken(ill);
17945 			ipif_setlinklocal(ill->ill_ipif);
17946 		}
17947 		break;
17948 	default:
17949 		ASSERT(0);
17950 	}
17951 
17952 	/*
17953 	 * reset ILL_DOWN_IN_PROGRESS so that we can successfully add ires
17954 	 * as we bring the ipifs up again.
17955 	 */
17956 	mutex_enter(&ill->ill_lock);
17957 	ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
17958 	mutex_exit(&ill->ill_lock);
17959 	/*
17960 	 * If there are ipifs to bring up, ill_up_ipifs() will return
17961 	 * EINPROGRESS, and ipsq_current_finish() will be called by
17962 	 * ip_rput_dlpi_writer() or arp_bringup_done() when the last ipif is
17963 	 * brought up.
17964 	 */
17965 	status = ill_up_ipifs(ill, q, addrmp);
17966 	if (status != EINPROGRESS)
17967 		ipsq_current_finish(ipsq);
17968 }
17969 
17970 /*
17971  * Helper routine for setting the ill_nd_lla fields.
17972  */
17973 void
ill_set_ndmp(ill_t * ill,mblk_t * ndmp,uint_t addroff,uint_t addrlen)17974 ill_set_ndmp(ill_t *ill, mblk_t *ndmp, uint_t addroff, uint_t addrlen)
17975 {
17976 	freemsg(ill->ill_nd_lla_mp);
17977 	ill->ill_nd_lla = ndmp->b_rptr + addroff;
17978 	ill->ill_nd_lla_mp = ndmp;
17979 	ill->ill_nd_lla_len = addrlen;
17980 }
17981 
17982 /*
17983  * Replumb the ill.
17984  */
17985 int
ill_replumb(ill_t * ill,mblk_t * mp)17986 ill_replumb(ill_t *ill, mblk_t *mp)
17987 {
17988 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17989 
17990 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17991 
17992 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
17993 
17994 	/*
17995 	 * If we can quiesce the ill, then continue.  If not, then
17996 	 * ill_replumb_tail() will be called from ipif_ill_refrele_tail().
17997 	 */
17998 	ill_down_ipifs(ill, B_FALSE);
17999 
18000 	mutex_enter(&ill->ill_lock);
18001 	if (!ill_is_quiescent(ill)) {
18002 		/* call cannot fail since `conn_t *' argument is NULL */
18003 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
18004 		    mp, ILL_DOWN);
18005 		mutex_exit(&ill->ill_lock);
18006 		return (EINPROGRESS);
18007 	}
18008 	mutex_exit(&ill->ill_lock);
18009 
18010 	ill_replumb_tail(ipsq, ill->ill_rq, mp, NULL);
18011 	return (0);
18012 }
18013 
18014 /* ARGSUSED */
18015 static void
ill_replumb_tail(ipsq_t * ipsq,queue_t * q,mblk_t * mp,void * dummy)18016 ill_replumb_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
18017 {
18018 	ill_t *ill = q->q_ptr;
18019 	int err;
18020 	conn_t *connp = NULL;
18021 
18022 	ASSERT(IAM_WRITER_IPSQ(ipsq));
18023 	freemsg(ill->ill_replumb_mp);
18024 	ill->ill_replumb_mp = copyb(mp);
18025 
18026 	if (ill->ill_replumb_mp == NULL) {
18027 		/* out of memory */
18028 		ipsq_current_finish(ipsq);
18029 		return;
18030 	}
18031 
18032 	mutex_enter(&ill->ill_lock);
18033 	ill->ill_up_ipifs = ipsq_pending_mp_add(NULL, ill->ill_ipif,
18034 	    ill->ill_rq, ill->ill_replumb_mp, 0);
18035 	mutex_exit(&ill->ill_lock);
18036 
18037 	if (!ill->ill_up_ipifs) {
18038 		/* already closing */
18039 		ipsq_current_finish(ipsq);
18040 		return;
18041 	}
18042 	ill->ill_replumbing = 1;
18043 	err = ill_down_ipifs_tail(ill);
18044 
18045 	/*
18046 	 * Successfully quiesced and brought down the interface, now we send
18047 	 * the DL_NOTE_REPLUMB_DONE message down to the driver. Reuse the
18048 	 * DL_NOTE_REPLUMB message.
18049 	 */
18050 	mp = mexchange(NULL, mp, sizeof (dl_notify_conf_t), M_PROTO,
18051 	    DL_NOTIFY_CONF);
18052 	ASSERT(mp != NULL);
18053 	((dl_notify_conf_t *)mp->b_rptr)->dl_notification =
18054 	    DL_NOTE_REPLUMB_DONE;
18055 	ill_dlpi_send(ill, mp);
18056 
18057 	/*
18058 	 * For IPv4, we would usually get EINPROGRESS because the ETHERTYPE_ARP
18059 	 * streams have to be unbound. When all the DLPI exchanges are done,
18060 	 * ipsq_current_finish() will be called by arp_bringup_done(). The
18061 	 * remainder of ipif bringup via ill_up_ipifs() will also be done in
18062 	 * arp_bringup_done().
18063 	 */
18064 	ASSERT(ill->ill_replumb_mp != NULL);
18065 	if (err == EINPROGRESS)
18066 		return;
18067 	else
18068 		ill->ill_replumb_mp = ipsq_pending_mp_get(ipsq, &connp);
18069 	ASSERT(connp == NULL);
18070 	if (err == 0 && ill->ill_replumb_mp != NULL &&
18071 	    ill_up_ipifs(ill, q, ill->ill_replumb_mp) == EINPROGRESS) {
18072 		return;
18073 	}
18074 	ipsq_current_finish(ipsq);
18075 }
18076 
18077 /*
18078  * Issue ioctl `cmd' on `lh'; caller provides the initial payload in `buf'
18079  * which is `bufsize' bytes.  On success, zero is returned and `buf' updated
18080  * as per the ioctl.  On failure, an errno is returned.
18081  */
18082 static int
ip_ioctl(ldi_handle_t lh,int cmd,void * buf,uint_t bufsize,cred_t * cr)18083 ip_ioctl(ldi_handle_t lh, int cmd, void *buf, uint_t bufsize, cred_t *cr)
18084 {
18085 	int rval;
18086 	struct strioctl iocb;
18087 
18088 	iocb.ic_cmd = cmd;
18089 	iocb.ic_timout = 15;
18090 	iocb.ic_len = bufsize;
18091 	iocb.ic_dp = buf;
18092 
18093 	return (ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval));
18094 }
18095 
18096 /*
18097  * Issue an SIOCGLIFCONF for address family `af' and store the result into a
18098  * dynamically-allocated `lifcp' that will be `bufsizep' bytes on success.
18099  */
18100 static int
ip_lifconf_ioctl(ldi_handle_t lh,int af,struct lifconf * lifcp,uint_t * bufsizep,cred_t * cr)18101 ip_lifconf_ioctl(ldi_handle_t lh, int af, struct lifconf *lifcp,
18102     uint_t *bufsizep, cred_t *cr)
18103 {
18104 	int err;
18105 	struct lifnum lifn;
18106 
18107 	bzero(&lifn, sizeof (lifn));
18108 	lifn.lifn_family = af;
18109 	lifn.lifn_flags = LIFC_UNDER_IPMP;
18110 
18111 	if ((err = ip_ioctl(lh, SIOCGLIFNUM, &lifn, sizeof (lifn), cr)) != 0)
18112 		return (err);
18113 
18114 	/*
18115 	 * Pad the interface count to account for additional interfaces that
18116 	 * may have been configured between the SIOCGLIFNUM and SIOCGLIFCONF.
18117 	 */
18118 	lifn.lifn_count += 4;
18119 	bzero(lifcp, sizeof (*lifcp));
18120 	lifcp->lifc_flags = LIFC_UNDER_IPMP;
18121 	lifcp->lifc_family = af;
18122 	lifcp->lifc_len = *bufsizep = lifn.lifn_count * sizeof (struct lifreq);
18123 	lifcp->lifc_buf = kmem_zalloc(*bufsizep, KM_SLEEP);
18124 
18125 	err = ip_ioctl(lh, SIOCGLIFCONF, lifcp, sizeof (*lifcp), cr);
18126 	if (err != 0) {
18127 		kmem_free(lifcp->lifc_buf, *bufsizep);
18128 		return (err);
18129 	}
18130 
18131 	return (0);
18132 }
18133 
18134 /*
18135  * Helper for ip_interface_cleanup() that removes the loopback interface.
18136  */
18137 static void
ip_loopback_removeif(ldi_handle_t lh,boolean_t isv6,cred_t * cr)18138 ip_loopback_removeif(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18139 {
18140 	int err;
18141 	struct lifreq lifr;
18142 
18143 	bzero(&lifr, sizeof (lifr));
18144 	(void) strcpy(lifr.lifr_name, ipif_loopback_name);
18145 
18146 	/*
18147 	 * Attempt to remove the interface.  It may legitimately not exist
18148 	 * (e.g. the zone administrator unplumbed it), so ignore ENXIO.
18149 	 */
18150 	err = ip_ioctl(lh, SIOCLIFREMOVEIF, &lifr, sizeof (lifr), cr);
18151 	if (err != 0 && err != ENXIO) {
18152 		ip0dbg(("ip_loopback_removeif: IP%s SIOCLIFREMOVEIF failed: "
18153 		    "error %d\n", isv6 ? "v6" : "v4", err));
18154 	}
18155 }
18156 
18157 /*
18158  * Helper for ip_interface_cleanup() that ensures no IP interfaces are in IPMP
18159  * groups and that IPMP data addresses are down.  These conditions must be met
18160  * so that IPMP interfaces can be I_PUNLINK'd, as per ip_sioctl_plink_ipmp().
18161  */
18162 static void
ip_ipmp_cleanup(ldi_handle_t lh,boolean_t isv6,cred_t * cr)18163 ip_ipmp_cleanup(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18164 {
18165 	int af = isv6 ? AF_INET6 : AF_INET;
18166 	int i, nifs;
18167 	int err;
18168 	uint_t bufsize;
18169 	uint_t lifrsize = sizeof (struct lifreq);
18170 	struct lifconf lifc;
18171 	struct lifreq *lifrp;
18172 
18173 	if ((err = ip_lifconf_ioctl(lh, af, &lifc, &bufsize, cr)) != 0) {
18174 		cmn_err(CE_WARN, "ip_ipmp_cleanup: cannot get interface list "
18175 		    "(error %d); any IPMP interfaces cannot be shutdown", err);
18176 		return;
18177 	}
18178 
18179 	nifs = lifc.lifc_len / lifrsize;
18180 	for (lifrp = lifc.lifc_req, i = 0; i < nifs; i++, lifrp++) {
18181 		err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18182 		if (err != 0) {
18183 			cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot get "
18184 			    "flags: error %d", lifrp->lifr_name, err);
18185 			continue;
18186 		}
18187 
18188 		if (lifrp->lifr_flags & IFF_IPMP) {
18189 			if ((lifrp->lifr_flags & (IFF_UP|IFF_DUPLICATE)) == 0)
18190 				continue;
18191 
18192 			lifrp->lifr_flags &= ~IFF_UP;
18193 			err = ip_ioctl(lh, SIOCSLIFFLAGS, lifrp, lifrsize, cr);
18194 			if (err != 0) {
18195 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18196 				    "bring down (error %d); IPMP interface may "
18197 				    "not be shutdown", lifrp->lifr_name, err);
18198 			}
18199 
18200 			/*
18201 			 * Check if IFF_DUPLICATE is still set -- and if so,
18202 			 * reset the address to clear it.
18203 			 */
18204 			err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18205 			if (err != 0 || !(lifrp->lifr_flags & IFF_DUPLICATE))
18206 				continue;
18207 
18208 			err = ip_ioctl(lh, SIOCGLIFADDR, lifrp, lifrsize, cr);
18209 			if (err != 0 || (err = ip_ioctl(lh, SIOCGLIFADDR,
18210 			    lifrp, lifrsize, cr)) != 0) {
18211 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18212 				    "reset DAD (error %d); IPMP interface may "
18213 				    "not be shutdown", lifrp->lifr_name, err);
18214 			}
18215 			continue;
18216 		}
18217 
18218 		if (strchr(lifrp->lifr_name, IPIF_SEPARATOR_CHAR) == 0) {
18219 			lifrp->lifr_groupname[0] = '\0';
18220 			if ((err = ip_ioctl(lh, SIOCSLIFGROUPNAME, lifrp,
18221 			    lifrsize, cr)) != 0) {
18222 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18223 				    "leave IPMP group (error %d); associated "
18224 				    "IPMP interface may not be shutdown",
18225 				    lifrp->lifr_name, err);
18226 				continue;
18227 			}
18228 		}
18229 	}
18230 
18231 	kmem_free(lifc.lifc_buf, bufsize);
18232 }
18233 
18234 #define	UDPDEV		"/devices/pseudo/udp@0:udp"
18235 #define	UDP6DEV		"/devices/pseudo/udp6@0:udp6"
18236 
18237 /*
18238  * Remove the loopback interfaces and prep the IPMP interfaces to be torn down.
18239  * Non-loopback interfaces are either I_LINK'd or I_PLINK'd; the former go away
18240  * when the user-level processes in the zone are killed and the latter are
18241  * cleaned up by str_stack_shutdown().
18242  */
18243 void
ip_interface_cleanup(ip_stack_t * ipst)18244 ip_interface_cleanup(ip_stack_t *ipst)
18245 {
18246 	ldi_handle_t	lh;
18247 	ldi_ident_t	li;
18248 	cred_t		*cr;
18249 	int		err;
18250 	int		i;
18251 	char		*devs[] = { UDP6DEV, UDPDEV };
18252 	netstackid_t	stackid = ipst->ips_netstack->netstack_stackid;
18253 
18254 	if ((err = ldi_ident_from_major(ddi_name_to_major("ip"), &li)) != 0) {
18255 		cmn_err(CE_WARN, "ip_interface_cleanup: cannot get ldi ident:"
18256 		    " error %d", err);
18257 		return;
18258 	}
18259 
18260 	cr = zone_get_kcred(netstackid_to_zoneid(stackid));
18261 	ASSERT(cr != NULL);
18262 
18263 	/*
18264 	 * NOTE: loop executes exactly twice and is hardcoded to know that the
18265 	 * first iteration is IPv6.  (Unrolling yields repetitious code, hence
18266 	 * the loop.)
18267 	 */
18268 	for (i = 0; i < 2; i++) {
18269 		err = ldi_open_by_name(devs[i], FREAD|FWRITE, cr, &lh, li);
18270 		if (err != 0) {
18271 			cmn_err(CE_WARN, "ip_interface_cleanup: cannot open %s:"
18272 			    " error %d", devs[i], err);
18273 			continue;
18274 		}
18275 
18276 		ip_loopback_removeif(lh, i == 0, cr);
18277 		ip_ipmp_cleanup(lh, i == 0, cr);
18278 
18279 		(void) ldi_close(lh, FREAD|FWRITE, cr);
18280 	}
18281 
18282 	ldi_ident_release(li);
18283 	crfree(cr);
18284 }
18285 
18286 /*
18287  * This needs to be in-sync with nic_event_t definition
18288  */
18289 static const char *
ill_hook_event2str(nic_event_t event)18290 ill_hook_event2str(nic_event_t event)
18291 {
18292 	switch (event) {
18293 	case NE_PLUMB:
18294 		return ("PLUMB");
18295 	case NE_UNPLUMB:
18296 		return ("UNPLUMB");
18297 	case NE_UP:
18298 		return ("UP");
18299 	case NE_DOWN:
18300 		return ("DOWN");
18301 	case NE_ADDRESS_CHANGE:
18302 		return ("ADDRESS_CHANGE");
18303 	case NE_LIF_UP:
18304 		return ("LIF_UP");
18305 	case NE_LIF_DOWN:
18306 		return ("LIF_DOWN");
18307 	case NE_IFINDEX_CHANGE:
18308 		return ("IFINDEX_CHANGE");
18309 	default:
18310 		return ("UNKNOWN");
18311 	}
18312 }
18313 
18314 void
ill_nic_event_dispatch(ill_t * ill,lif_if_t lif,nic_event_t event,nic_event_data_t data,size_t datalen)18315 ill_nic_event_dispatch(ill_t *ill, lif_if_t lif, nic_event_t event,
18316     nic_event_data_t data, size_t datalen)
18317 {
18318 	ip_stack_t		*ipst = ill->ill_ipst;
18319 	hook_nic_event_int_t	*info;
18320 	const char		*str = NULL;
18321 
18322 	/* create a new nic event info */
18323 	if ((info = kmem_alloc(sizeof (*info), KM_NOSLEEP)) == NULL)
18324 		goto fail;
18325 
18326 	info->hnei_event.hne_nic = ill->ill_phyint->phyint_ifindex;
18327 	info->hnei_event.hne_lif = lif;
18328 	info->hnei_event.hne_event = event;
18329 	info->hnei_event.hne_protocol = ill->ill_isv6 ?
18330 	    ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data;
18331 	info->hnei_event.hne_data = NULL;
18332 	info->hnei_event.hne_datalen = 0;
18333 	info->hnei_stackid = ipst->ips_netstack->netstack_stackid;
18334 
18335 	if (data != NULL && datalen != 0) {
18336 		info->hnei_event.hne_data = kmem_alloc(datalen, KM_NOSLEEP);
18337 		if (info->hnei_event.hne_data == NULL)
18338 			goto fail;
18339 		bcopy(data, info->hnei_event.hne_data, datalen);
18340 		info->hnei_event.hne_datalen = datalen;
18341 	}
18342 
18343 	if (ddi_taskq_dispatch(eventq_queue_nic, ip_ne_queue_func, info,
18344 	    DDI_NOSLEEP) == DDI_SUCCESS)
18345 		return;
18346 
18347 fail:
18348 	if (info != NULL) {
18349 		if (info->hnei_event.hne_data != NULL) {
18350 			kmem_free(info->hnei_event.hne_data,
18351 			    info->hnei_event.hne_datalen);
18352 		}
18353 		kmem_free(info, sizeof (hook_nic_event_t));
18354 	}
18355 	str = ill_hook_event2str(event);
18356 	ip2dbg(("ill_nic_event_dispatch: could not dispatch %s nic event "
18357 	    "information for %s (ENOMEM)\n", str, ill->ill_name));
18358 }
18359 
18360 static int
ipif_arp_up_done_tail(ipif_t * ipif,enum ip_resolver_action res_act)18361 ipif_arp_up_done_tail(ipif_t *ipif, enum ip_resolver_action res_act)
18362 {
18363 	int		err = 0;
18364 	const in_addr_t	*addr = NULL;
18365 	nce_t		*nce = NULL;
18366 	ill_t		*ill = ipif->ipif_ill;
18367 	ill_t		*bound_ill;
18368 	boolean_t	added_ipif = B_FALSE;
18369 	uint16_t	state;
18370 	uint16_t	flags;
18371 
18372 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up_done_tail",
18373 	    ill_t *, ill, ipif_t *, ipif);
18374 	if (ipif->ipif_lcl_addr != INADDR_ANY) {
18375 		addr = &ipif->ipif_lcl_addr;
18376 	}
18377 
18378 	if ((ipif->ipif_flags & IPIF_UNNUMBERED) || addr == NULL) {
18379 		if (res_act != Res_act_initial)
18380 			return (EINVAL);
18381 	}
18382 
18383 	if (addr != NULL) {
18384 		ipmp_illgrp_t	*illg = ill->ill_grp;
18385 
18386 		/* add unicast nce for the local addr */
18387 
18388 		if (IS_IPMP(ill)) {
18389 			/*
18390 			 * If we're here via ipif_up(), then the ipif
18391 			 * won't be bound yet -- add it to the group,
18392 			 * which will bind it if possible. (We would
18393 			 * add it in ipif_up(), but deleting on failure
18394 			 * there is gruesome.)  If we're here via
18395 			 * ipmp_ill_bind_ipif(), then the ipif has
18396 			 * already been added to the group and we
18397 			 * just need to use the binding.
18398 			 */
18399 			if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
18400 				bound_ill  = ipmp_illgrp_add_ipif(illg, ipif);
18401 				if (bound_ill == NULL) {
18402 					/*
18403 					 * We couldn't bind the ipif to an ill
18404 					 * yet, so we have nothing to publish.
18405 					 * Mark the address as ready and return.
18406 					 */
18407 					ipif->ipif_addr_ready = 1;
18408 					return (0);
18409 				}
18410 				added_ipif = B_TRUE;
18411 			}
18412 		} else {
18413 			bound_ill = ill;
18414 		}
18415 
18416 		flags = (NCE_F_MYADDR | NCE_F_PUBLISH | NCE_F_AUTHORITY |
18417 		    NCE_F_NONUD);
18418 		/*
18419 		 * If this is an initial bring-up (or the ipif was never
18420 		 * completely brought up), do DAD.  Otherwise, we're here
18421 		 * because IPMP has rebound an address to this ill: send
18422 		 * unsolicited advertisements (ARP announcements) to
18423 		 * inform others.
18424 		 */
18425 		if (res_act == Res_act_initial || !ipif->ipif_addr_ready) {
18426 			state = ND_UNCHANGED; /* compute in nce_add_common() */
18427 		} else {
18428 			state = ND_REACHABLE;
18429 			flags |= NCE_F_UNSOL_ADV;
18430 		}
18431 
18432 retry:
18433 		err = nce_lookup_then_add_v4(ill,
18434 		    bound_ill->ill_phys_addr, bound_ill->ill_phys_addr_length,
18435 		    addr, flags, state, &nce);
18436 
18437 		/*
18438 		 * note that we may encounter EEXIST if we are moving
18439 		 * the nce as a result of a rebind operation.
18440 		 */
18441 		switch (err) {
18442 		case 0:
18443 			ipif->ipif_added_nce = 1;
18444 			nce->nce_ipif_cnt++;
18445 			break;
18446 		case EEXIST:
18447 			ip1dbg(("ipif_arp_up: NCE already exists for %s\n",
18448 			    ill->ill_name));
18449 			if (!NCE_MYADDR(nce->nce_common)) {
18450 				/*
18451 				 * A leftover nce from before this address
18452 				 * existed
18453 				 */
18454 				ncec_delete(nce->nce_common);
18455 				nce_refrele(nce);
18456 				nce = NULL;
18457 				goto retry;
18458 			}
18459 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
18460 				nce_refrele(nce);
18461 				nce = NULL;
18462 				ip1dbg(("ipif_arp_up: NCE already exists "
18463 				    "for %s:%u\n", ill->ill_name,
18464 				    ipif->ipif_id));
18465 				goto arp_up_done;
18466 			}
18467 			/*
18468 			 * Duplicate local addresses are permissible for
18469 			 * IPIF_POINTOPOINT interfaces which will get marked
18470 			 * IPIF_UNNUMBERED later in
18471 			 * ip_addr_availability_check().
18472 			 *
18473 			 * The nce_ipif_cnt field tracks the number of
18474 			 * ipifs that have nce_addr as their local address.
18475 			 */
18476 			ipif->ipif_addr_ready = 1;
18477 			ipif->ipif_added_nce = 1;
18478 			nce->nce_ipif_cnt++;
18479 			err = 0;
18480 			break;
18481 		default:
18482 			ASSERT(nce == NULL);
18483 			goto arp_up_done;
18484 		}
18485 		if (arp_no_defense) {
18486 			if ((ipif->ipif_flags & IPIF_UP) &&
18487 			    !ipif->ipif_addr_ready)
18488 				ipif_up_notify(ipif);
18489 			ipif->ipif_addr_ready = 1;
18490 		}
18491 	} else {
18492 		/* zero address. nothing to publish */
18493 		ipif->ipif_addr_ready = 1;
18494 	}
18495 	if (nce != NULL)
18496 		nce_refrele(nce);
18497 arp_up_done:
18498 	if (added_ipif && err != 0)
18499 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18500 	return (err);
18501 }
18502 
18503 int
ipif_arp_up(ipif_t * ipif,enum ip_resolver_action res_act,boolean_t was_dup)18504 ipif_arp_up(ipif_t *ipif, enum ip_resolver_action res_act, boolean_t was_dup)
18505 {
18506 	int		err = 0;
18507 	ill_t		*ill = ipif->ipif_ill;
18508 	boolean_t	first_interface, wait_for_dlpi = B_FALSE;
18509 
18510 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up",
18511 	    ill_t *, ill, ipif_t *, ipif);
18512 
18513 	/*
18514 	 * need to bring up ARP or setup mcast mapping only
18515 	 * when the first interface is coming UP.
18516 	 */
18517 	first_interface = (ill->ill_ipif_up_count == 0 &&
18518 	    ill->ill_ipif_dup_count == 0 && !was_dup);
18519 
18520 	if (res_act == Res_act_initial && first_interface) {
18521 		/*
18522 		 * Send ATTACH + BIND
18523 		 */
18524 		err = arp_ll_up(ill);
18525 		if (err != EINPROGRESS && err != 0)
18526 			return (err);
18527 
18528 		/*
18529 		 * Add NCE for local address. Start DAD.
18530 		 * we'll wait to hear that DAD has finished
18531 		 * before using the interface.
18532 		 */
18533 		if (err == EINPROGRESS)
18534 			wait_for_dlpi = B_TRUE;
18535 	}
18536 
18537 	if (!wait_for_dlpi)
18538 		(void) ipif_arp_up_done_tail(ipif, res_act);
18539 
18540 	return (!wait_for_dlpi ? 0 : EINPROGRESS);
18541 }
18542 
18543 /*
18544  * Finish processing of "arp_up" after all the DLPI message
18545  * exchanges have completed between arp and the driver.
18546  */
18547 void
arp_bringup_done(ill_t * ill,int err)18548 arp_bringup_done(ill_t *ill, int err)
18549 {
18550 	mblk_t	*mp1;
18551 	ipif_t  *ipif;
18552 	conn_t *connp = NULL;
18553 	ipsq_t	*ipsq;
18554 	queue_t *q;
18555 
18556 	ip1dbg(("arp_bringup_done(%s)\n", ill->ill_name));
18557 
18558 	ASSERT(IAM_WRITER_ILL(ill));
18559 
18560 	ipsq = ill->ill_phyint->phyint_ipsq;
18561 	ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18562 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
18563 	ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18564 	if (mp1 == NULL) /* bringup was aborted by the user */
18565 		return;
18566 
18567 	/*
18568 	 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18569 	 * must have an associated conn_t.  Otherwise, we're bringing this
18570 	 * interface back up as part of handling an asynchronous event (e.g.,
18571 	 * physical address change).
18572 	 */
18573 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18574 		ASSERT(connp != NULL);
18575 		q = CONNP_TO_WQ(connp);
18576 	} else {
18577 		ASSERT(connp == NULL);
18578 		q = ill->ill_rq;
18579 	}
18580 	if (err == 0) {
18581 		if (ipif->ipif_isv6) {
18582 			if ((err = ipif_up_done_v6(ipif)) != 0)
18583 				ip0dbg(("arp_bringup_done: init failed\n"));
18584 		} else {
18585 			err = ipif_arp_up_done_tail(ipif, Res_act_initial);
18586 			if (err != 0 ||
18587 			    (err = ipif_up_done(ipif)) != 0) {
18588 				ip0dbg(("arp_bringup_done: "
18589 				    "init failed err %x\n", err));
18590 				(void) ipif_arp_down(ipif);
18591 			}
18592 
18593 		}
18594 	} else {
18595 		ip0dbg(("arp_bringup_done: DL_BIND_REQ failed\n"));
18596 	}
18597 
18598 	if ((err == 0) && (ill->ill_up_ipifs)) {
18599 		err = ill_up_ipifs(ill, q, mp1);
18600 		if (err == EINPROGRESS)
18601 			return;
18602 	}
18603 
18604 	/*
18605 	 * If we have a moved ipif to bring up, and everything has succeeded
18606 	 * to this point, bring it up on the IPMP ill.  Otherwise, leave it
18607 	 * down -- the admin can try to bring it up by hand if need be.
18608 	 */
18609 	if (ill->ill_move_ipif != NULL) {
18610 		ipif = ill->ill_move_ipif;
18611 		ip1dbg(("bringing up ipif %p on ill %s\n", (void *)ipif,
18612 		    ipif->ipif_ill->ill_name));
18613 		ill->ill_move_ipif = NULL;
18614 		if (err == 0) {
18615 			err = ipif_up(ipif, q, mp1);
18616 			if (err == EINPROGRESS)
18617 				return;
18618 		}
18619 	}
18620 
18621 	/*
18622 	 * The operation must complete without EINPROGRESS since
18623 	 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18624 	 * Otherwise, the operation will be stuck forever in the ipsq.
18625 	 */
18626 	ASSERT(err != EINPROGRESS);
18627 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18628 		DTRACE_PROBE4(ipif__ioctl, char *, "arp_bringup_done finish",
18629 		    int, ipsq->ipsq_xop->ipx_current_ioctl,
18630 		    ill_t *, ill, ipif_t *, ipif);
18631 		ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18632 	} else {
18633 		ipsq_current_finish(ipsq);
18634 	}
18635 }
18636 
18637 /*
18638  * Finish processing of arp replumb after all the DLPI message
18639  * exchanges have completed between arp and the driver.
18640  */
18641 void
arp_replumb_done(ill_t * ill,int err)18642 arp_replumb_done(ill_t *ill, int err)
18643 {
18644 	mblk_t	*mp1;
18645 	ipif_t  *ipif;
18646 	conn_t *connp = NULL;
18647 	ipsq_t	*ipsq;
18648 	queue_t *q;
18649 
18650 	ASSERT(IAM_WRITER_ILL(ill));
18651 
18652 	ipsq = ill->ill_phyint->phyint_ipsq;
18653 	ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18654 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
18655 	ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18656 	if (mp1 == NULL) {
18657 		ip0dbg(("arp_replumb_done: bringup aborted ioctl %x\n",
18658 		    ipsq->ipsq_xop->ipx_current_ioctl));
18659 		/* bringup was aborted by the user */
18660 		return;
18661 	}
18662 	/*
18663 	 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18664 	 * must have an associated conn_t.  Otherwise, we're bringing this
18665 	 * interface back up as part of handling an asynchronous event (e.g.,
18666 	 * physical address change).
18667 	 */
18668 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18669 		ASSERT(connp != NULL);
18670 		q = CONNP_TO_WQ(connp);
18671 	} else {
18672 		ASSERT(connp == NULL);
18673 		q = ill->ill_rq;
18674 	}
18675 	if ((err == 0) && (ill->ill_up_ipifs)) {
18676 		err = ill_up_ipifs(ill, q, mp1);
18677 		if (err == EINPROGRESS)
18678 			return;
18679 	}
18680 	/*
18681 	 * The operation must complete without EINPROGRESS since
18682 	 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18683 	 * Otherwise, the operation will be stuck forever in the ipsq.
18684 	 */
18685 	ASSERT(err != EINPROGRESS);
18686 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18687 		DTRACE_PROBE4(ipif__ioctl, char *,
18688 		    "arp_replumb_done finish",
18689 		    int, ipsq->ipsq_xop->ipx_current_ioctl,
18690 		    ill_t *, ill, ipif_t *, ipif);
18691 		ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18692 	} else {
18693 		ipsq_current_finish(ipsq);
18694 	}
18695 }
18696 
18697 void
ipif_up_notify(ipif_t * ipif)18698 ipif_up_notify(ipif_t *ipif)
18699 {
18700 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
18701 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif, RTSQ_DEFAULT);
18702 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
18703 	ill_nic_event_dispatch(ipif->ipif_ill, MAP_IPIF_ID(ipif->ipif_id),
18704 	    NE_LIF_UP, NULL, 0);
18705 }
18706 
18707 /*
18708  * ILB ioctl uses cv_wait (such as deleting a rule or adding a server) and
18709  * this assumes the context is cv_wait'able.  Hence it shouldnt' be used on
18710  * TPI end points with STREAMS modules pushed above.  This is assured by not
18711  * having the IPI_MODOK flag for the ioctl.  And IP ensures the ILB ioctl
18712  * never ends up on an ipsq, otherwise we may end up processing the ioctl
18713  * while unwinding from the ispq and that could be a thread from the bottom.
18714  */
18715 /* ARGSUSED */
18716 int
ip_sioctl_ilb_cmd(ipif_t * ipif,sin_t * sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * arg)18717 ip_sioctl_ilb_cmd(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18718     ip_ioctl_cmd_t *ipip, void *arg)
18719 {
18720 	mblk_t *cmd_mp = mp->b_cont->b_cont;
18721 	ilb_cmd_t command = *((ilb_cmd_t *)cmd_mp->b_rptr);
18722 	int ret = 0;
18723 	int i;
18724 	size_t size;
18725 	ip_stack_t *ipst;
18726 	zoneid_t zoneid;
18727 	ilb_stack_t *ilbs;
18728 
18729 	ipst = CONNQ_TO_IPST(q);
18730 	ilbs = ipst->ips_netstack->netstack_ilb;
18731 	zoneid = Q_TO_CONN(q)->conn_zoneid;
18732 
18733 	switch (command) {
18734 	case ILB_CREATE_RULE: {
18735 		ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18736 
18737 		if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18738 			ret = EINVAL;
18739 			break;
18740 		}
18741 
18742 		ret = ilb_rule_add(ilbs, zoneid, cmd);
18743 		break;
18744 	}
18745 	case ILB_DESTROY_RULE:
18746 	case ILB_ENABLE_RULE:
18747 	case ILB_DISABLE_RULE: {
18748 		ilb_name_cmd_t *cmd = (ilb_name_cmd_t *)cmd_mp->b_rptr;
18749 
18750 		if (MBLKL(cmd_mp) != sizeof (ilb_name_cmd_t)) {
18751 			ret = EINVAL;
18752 			break;
18753 		}
18754 
18755 		if (cmd->flags & ILB_RULE_ALLRULES) {
18756 			if (command == ILB_DESTROY_RULE) {
18757 				ilb_rule_del_all(ilbs, zoneid);
18758 				break;
18759 			} else if (command == ILB_ENABLE_RULE) {
18760 				ilb_rule_enable_all(ilbs, zoneid);
18761 				break;
18762 			} else if (command == ILB_DISABLE_RULE) {
18763 				ilb_rule_disable_all(ilbs, zoneid);
18764 				break;
18765 			}
18766 		} else {
18767 			if (command == ILB_DESTROY_RULE) {
18768 				ret = ilb_rule_del(ilbs, zoneid, cmd->name);
18769 			} else if (command == ILB_ENABLE_RULE) {
18770 				ret = ilb_rule_enable(ilbs, zoneid, cmd->name,
18771 				    NULL);
18772 			} else if (command == ILB_DISABLE_RULE) {
18773 				ret = ilb_rule_disable(ilbs, zoneid, cmd->name,
18774 				    NULL);
18775 			}
18776 		}
18777 		break;
18778 	}
18779 	case ILB_NUM_RULES: {
18780 		ilb_num_rules_cmd_t *cmd;
18781 
18782 		if (MBLKL(cmd_mp) != sizeof (ilb_num_rules_cmd_t)) {
18783 			ret = EINVAL;
18784 			break;
18785 		}
18786 		cmd = (ilb_num_rules_cmd_t *)cmd_mp->b_rptr;
18787 		ilb_get_num_rules(ilbs, zoneid, &(cmd->num));
18788 		break;
18789 	}
18790 	case ILB_RULE_NAMES: {
18791 		ilb_rule_names_cmd_t *cmd;
18792 
18793 		cmd = (ilb_rule_names_cmd_t *)cmd_mp->b_rptr;
18794 		if (MBLKL(cmd_mp) < sizeof (ilb_rule_names_cmd_t) ||
18795 		    cmd->num_names == 0) {
18796 			ret = EINVAL;
18797 			break;
18798 		}
18799 		size = cmd->num_names * ILB_RULE_NAMESZ;
18800 		if (cmd_mp->b_rptr + offsetof(ilb_rule_names_cmd_t, buf) +
18801 		    size != cmd_mp->b_wptr) {
18802 			ret = EINVAL;
18803 			break;
18804 		}
18805 		ilb_get_rulenames(ilbs, zoneid, &cmd->num_names, cmd->buf);
18806 		break;
18807 	}
18808 	case ILB_NUM_SERVERS: {
18809 		ilb_num_servers_cmd_t *cmd;
18810 
18811 		if (MBLKL(cmd_mp) != sizeof (ilb_num_servers_cmd_t)) {
18812 			ret = EINVAL;
18813 			break;
18814 		}
18815 		cmd = (ilb_num_servers_cmd_t *)cmd_mp->b_rptr;
18816 		ret = ilb_get_num_servers(ilbs, zoneid, cmd->name,
18817 		    &(cmd->num));
18818 		break;
18819 	}
18820 	case ILB_LIST_RULE: {
18821 		ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18822 
18823 		if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18824 			ret = EINVAL;
18825 			break;
18826 		}
18827 		ret = ilb_rule_list(ilbs, zoneid, cmd);
18828 		break;
18829 	}
18830 	case ILB_LIST_SERVERS: {
18831 		ilb_servers_info_cmd_t *cmd;
18832 
18833 		cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18834 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t) ||
18835 		    cmd->num_servers == 0) {
18836 			ret = EINVAL;
18837 			break;
18838 		}
18839 		size = cmd->num_servers * sizeof (ilb_server_info_t);
18840 		if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18841 		    size != cmd_mp->b_wptr) {
18842 			ret = EINVAL;
18843 			break;
18844 		}
18845 
18846 		ret = ilb_get_servers(ilbs, zoneid, cmd->name, cmd->servers,
18847 		    &cmd->num_servers);
18848 		break;
18849 	}
18850 	case ILB_ADD_SERVERS: {
18851 		ilb_servers_info_cmd_t *cmd;
18852 		ilb_rule_t *rule;
18853 
18854 		cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18855 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t)) {
18856 			ret = EINVAL;
18857 			break;
18858 		}
18859 		size = cmd->num_servers * sizeof (ilb_server_info_t);
18860 		if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18861 		    size != cmd_mp->b_wptr) {
18862 			ret = EINVAL;
18863 			break;
18864 		}
18865 		rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18866 		if (rule == NULL) {
18867 			ASSERT(ret != 0);
18868 			break;
18869 		}
18870 		for (i = 0; i < cmd->num_servers; i++) {
18871 			ilb_server_info_t *s;
18872 
18873 			s = &cmd->servers[i];
18874 			s->err = ilb_server_add(ilbs, rule, s);
18875 		}
18876 		ILB_RULE_REFRELE(rule);
18877 		break;
18878 	}
18879 	case ILB_DEL_SERVERS:
18880 	case ILB_ENABLE_SERVERS:
18881 	case ILB_DISABLE_SERVERS: {
18882 		ilb_servers_cmd_t *cmd;
18883 		ilb_rule_t *rule;
18884 		int (*f)();
18885 
18886 		cmd = (ilb_servers_cmd_t *)cmd_mp->b_rptr;
18887 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_cmd_t)) {
18888 			ret = EINVAL;
18889 			break;
18890 		}
18891 		size = cmd->num_servers * sizeof (ilb_server_arg_t);
18892 		if (cmd_mp->b_rptr + offsetof(ilb_servers_cmd_t, servers) +
18893 		    size != cmd_mp->b_wptr) {
18894 			ret = EINVAL;
18895 			break;
18896 		}
18897 
18898 		if (command == ILB_DEL_SERVERS)
18899 			f = ilb_server_del;
18900 		else if (command == ILB_ENABLE_SERVERS)
18901 			f = ilb_server_enable;
18902 		else if (command == ILB_DISABLE_SERVERS)
18903 			f = ilb_server_disable;
18904 
18905 		rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18906 		if (rule == NULL) {
18907 			ASSERT(ret != 0);
18908 			break;
18909 		}
18910 
18911 		for (i = 0; i < cmd->num_servers; i++) {
18912 			ilb_server_arg_t *s;
18913 
18914 			s = &cmd->servers[i];
18915 			s->err = f(ilbs, zoneid, NULL, rule, &s->addr);
18916 		}
18917 		ILB_RULE_REFRELE(rule);
18918 		break;
18919 	}
18920 	case ILB_LIST_NAT_TABLE: {
18921 		ilb_list_nat_cmd_t *cmd;
18922 
18923 		cmd = (ilb_list_nat_cmd_t *)cmd_mp->b_rptr;
18924 		if (MBLKL(cmd_mp) < sizeof (ilb_list_nat_cmd_t)) {
18925 			ret = EINVAL;
18926 			break;
18927 		}
18928 		size = cmd->num_nat * sizeof (ilb_nat_entry_t);
18929 		if (cmd_mp->b_rptr + offsetof(ilb_list_nat_cmd_t, entries) +
18930 		    size != cmd_mp->b_wptr) {
18931 			ret = EINVAL;
18932 			break;
18933 		}
18934 
18935 		ret = ilb_list_nat(ilbs, zoneid, cmd->entries, &cmd->num_nat,
18936 		    &cmd->flags);
18937 		break;
18938 	}
18939 	case ILB_LIST_STICKY_TABLE: {
18940 		ilb_list_sticky_cmd_t *cmd;
18941 
18942 		cmd = (ilb_list_sticky_cmd_t *)cmd_mp->b_rptr;
18943 		if (MBLKL(cmd_mp) < sizeof (ilb_list_sticky_cmd_t)) {
18944 			ret = EINVAL;
18945 			break;
18946 		}
18947 		size = cmd->num_sticky * sizeof (ilb_sticky_entry_t);
18948 		if (cmd_mp->b_rptr + offsetof(ilb_list_sticky_cmd_t, entries) +
18949 		    size != cmd_mp->b_wptr) {
18950 			ret = EINVAL;
18951 			break;
18952 		}
18953 
18954 		ret = ilb_list_sticky(ilbs, zoneid, cmd->entries,
18955 		    &cmd->num_sticky, &cmd->flags);
18956 		break;
18957 	}
18958 	default:
18959 		ret = EINVAL;
18960 		break;
18961 	}
18962 done:
18963 	return (ret);
18964 }
18965 
18966 /* Remove all cache entries for this logical interface */
18967 void
ipif_nce_down(ipif_t * ipif)18968 ipif_nce_down(ipif_t *ipif)
18969 {
18970 	ill_t *ill = ipif->ipif_ill;
18971 	nce_t *nce;
18972 
18973 	DTRACE_PROBE3(ipif__downup, char *, "ipif_nce_down",
18974 	    ill_t *, ill, ipif_t *, ipif);
18975 	if (ipif->ipif_added_nce) {
18976 		if (ipif->ipif_isv6)
18977 			nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
18978 		else
18979 			nce = nce_lookup_v4(ill, &ipif->ipif_lcl_addr);
18980 		if (nce != NULL) {
18981 			if (--nce->nce_ipif_cnt == 0)
18982 				ncec_delete(nce->nce_common);
18983 			ipif->ipif_added_nce = 0;
18984 			nce_refrele(nce);
18985 		} else {
18986 			/*
18987 			 * nce may already be NULL because it was already
18988 			 * flushed, e.g., due to a call to nce_flush
18989 			 */
18990 			ipif->ipif_added_nce = 0;
18991 		}
18992 	}
18993 	/*
18994 	 * Make IPMP aware of the deleted data address.
18995 	 */
18996 	if (IS_IPMP(ill))
18997 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18998 
18999 	/*
19000 	 * Remove all other nces dependent on this ill when the last ipif
19001 	 * is going away.
19002 	 */
19003 	if (ill->ill_ipif_up_count == 0) {
19004 		ncec_walk(ill, ncec_delete_per_ill, ill, ill->ill_ipst);
19005 		if (IS_UNDER_IPMP(ill))
19006 			nce_flush(ill, B_TRUE);
19007 	}
19008 }
19009 
19010 /*
19011  * find the first interface that uses usill for its source address.
19012  */
19013 ill_t *
ill_lookup_usesrc(ill_t * usill)19014 ill_lookup_usesrc(ill_t *usill)
19015 {
19016 	ip_stack_t *ipst = usill->ill_ipst;
19017 	ill_t *ill;
19018 
19019 	ASSERT(usill != NULL);
19020 
19021 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
19022 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
19023 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
19024 	for (ill = usill->ill_usesrc_grp_next; ill != NULL && ill != usill;
19025 	    ill = ill->ill_usesrc_grp_next) {
19026 		if (!IS_UNDER_IPMP(ill) && (ill->ill_flags & ILLF_MULTICAST) &&
19027 		    !ILL_IS_CONDEMNED(ill)) {
19028 			ill_refhold(ill);
19029 			break;
19030 		}
19031 	}
19032 	rw_exit(&ipst->ips_ill_g_lock);
19033 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
19034 	return (ill);
19035 }
19036 
19037 /*
19038  * This comment applies to both ip_sioctl_get_ifhwaddr and
19039  * ip_sioctl_get_lifhwaddr as the basic function of these two functions
19040  * is the same.
19041  *
19042  * The goal here is to find an IP interface that corresponds to the name
19043  * provided by the caller in the ifreq/lifreq structure held in the mblk_t
19044  * chain and to fill out a sockaddr/sockaddr_storage structure with the
19045  * mac address.
19046  *
19047  * The SIOCGIFHWADDR/SIOCGLIFHWADDR ioctl may return an error for a number
19048  * of different reasons:
19049  * ENXIO - the device name is not known to IP.
19050  * EADDRNOTAVAIL - the device has no hardware address. This is indicated
19051  * by ill_phys_addr not pointing to an actual address.
19052  * EPFNOSUPPORT - this will indicate that a request is being made for a
19053  * mac address that will not fit in the data structure supplier (struct
19054  * sockaddr).
19055  *
19056  */
19057 /* ARGSUSED */
19058 int
ip_sioctl_get_ifhwaddr(ipif_t * ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)19059 ip_sioctl_get_ifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19060     ip_ioctl_cmd_t *ipip, void *if_req)
19061 {
19062 	struct sockaddr *sock;
19063 	struct ifreq *ifr;
19064 	mblk_t *mp1;
19065 	ill_t *ill;
19066 
19067 	ASSERT(ipif != NULL);
19068 	ill = ipif->ipif_ill;
19069 
19070 	if (ill->ill_phys_addr == NULL) {
19071 		return (EADDRNOTAVAIL);
19072 	}
19073 	if (ill->ill_phys_addr_length > sizeof (sock->sa_data)) {
19074 		return (EPFNOSUPPORT);
19075 	}
19076 
19077 	ip1dbg(("ip_sioctl_get_hwaddr(%s)\n", ill->ill_name));
19078 
19079 	/* Existence of mp1 has been checked in ip_wput_nondata */
19080 	mp1 = mp->b_cont->b_cont;
19081 	ifr = (struct ifreq *)mp1->b_rptr;
19082 
19083 	sock = &ifr->ifr_addr;
19084 	/*
19085 	 * The "family" field in the returned structure is set to a value
19086 	 * that represents the type of device to which the address belongs.
19087 	 * The value returned may differ to that on Linux but it will still
19088 	 * represent the correct symbol on Solaris.
19089 	 */
19090 	sock->sa_family = arp_hw_type(ill->ill_mactype);
19091 	bcopy(ill->ill_phys_addr, &sock->sa_data, ill->ill_phys_addr_length);
19092 
19093 	return (0);
19094 }
19095 
19096 /*
19097  * The expection of applications using SIOCGIFHWADDR is that data will
19098  * be returned in the sa_data field of the sockaddr structure. With
19099  * SIOCGLIFHWADDR, we're breaking new ground as there is no Linux
19100  * equivalent. In light of this, struct sockaddr_dl is used as it
19101  * offers more space for address storage in sll_data.
19102  */
19103 /* ARGSUSED */
19104 int
ip_sioctl_get_lifhwaddr(ipif_t * ipif,sin_t * dummy_sin,queue_t * q,mblk_t * mp,ip_ioctl_cmd_t * ipip,void * if_req)19105 ip_sioctl_get_lifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19106     ip_ioctl_cmd_t *ipip, void *if_req)
19107 {
19108 	struct sockaddr_dl *sock;
19109 	struct lifreq *lifr;
19110 	mblk_t *mp1;
19111 	ill_t *ill;
19112 
19113 	ASSERT(ipif != NULL);
19114 	ill = ipif->ipif_ill;
19115 
19116 	if (ill->ill_phys_addr == NULL) {
19117 		return (EADDRNOTAVAIL);
19118 	}
19119 	if (ill->ill_phys_addr_length > sizeof (sock->sdl_data)) {
19120 		return (EPFNOSUPPORT);
19121 	}
19122 
19123 	ip1dbg(("ip_sioctl_get_lifhwaddr(%s)\n", ill->ill_name));
19124 
19125 	/* Existence of mp1 has been checked in ip_wput_nondata */
19126 	mp1 = mp->b_cont->b_cont;
19127 	lifr = (struct lifreq *)mp1->b_rptr;
19128 
19129 	/*
19130 	 * sockaddr_ll is used here because it is also the structure used in
19131 	 * responding to the same ioctl in sockpfp. The only other choice is
19132 	 * sockaddr_dl which contains fields that are not required here
19133 	 * because its purpose is different.
19134 	 */
19135 	lifr->lifr_type = ill->ill_type;
19136 	sock = (struct sockaddr_dl *)&lifr->lifr_addr;
19137 	sock->sdl_family = AF_LINK;
19138 	sock->sdl_index = ill->ill_phyint->phyint_ifindex;
19139 	sock->sdl_type = ill->ill_mactype;
19140 	sock->sdl_nlen = 0;
19141 	sock->sdl_slen = 0;
19142 	sock->sdl_alen = ill->ill_phys_addr_length;
19143 	bcopy(ill->ill_phys_addr, sock->sdl_data, ill->ill_phys_addr_length);
19144 
19145 	return (0);
19146 }
19147