xref: /illumos-gate/usr/src/uts/common/inet/ip/ip_if.c (revision a6911619)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 1990 Mentat Inc.
24  */
25 
26 /*
27  * This file contains the interface control functions for IP.
28  */
29 
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/dlpi.h>
33 #include <sys/stropts.h>
34 #include <sys/strsun.h>
35 #include <sys/sysmacros.h>
36 #include <sys/strsubr.h>
37 #include <sys/strlog.h>
38 #include <sys/ddi.h>
39 #include <sys/sunddi.h>
40 #include <sys/cmn_err.h>
41 #include <sys/kstat.h>
42 #include <sys/debug.h>
43 #include <sys/zone.h>
44 #include <sys/sunldi.h>
45 #include <sys/file.h>
46 #include <sys/bitmap.h>
47 #include <sys/cpuvar.h>
48 #include <sys/time.h>
49 #include <sys/ctype.h>
50 #include <sys/kmem.h>
51 #include <sys/systm.h>
52 #include <sys/param.h>
53 #include <sys/socket.h>
54 #include <sys/isa_defs.h>
55 #include <net/if.h>
56 #include <net/if_arp.h>
57 #include <net/if_types.h>
58 #include <net/if_dl.h>
59 #include <net/route.h>
60 #include <sys/sockio.h>
61 #include <netinet/in.h>
62 #include <netinet/ip6.h>
63 #include <netinet/icmp6.h>
64 #include <netinet/igmp_var.h>
65 #include <sys/policy.h>
66 #include <sys/ethernet.h>
67 #include <sys/callb.h>
68 #include <sys/md5.h>
69 
70 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
71 #include <inet/mi.h>
72 #include <inet/nd.h>
73 #include <inet/tunables.h>
74 #include <inet/arp.h>
75 #include <inet/ip_arp.h>
76 #include <inet/mib2.h>
77 #include <inet/ip.h>
78 #include <inet/ip6.h>
79 #include <inet/ip6_asp.h>
80 #include <inet/tcp.h>
81 #include <inet/ip_multi.h>
82 #include <inet/ip_ire.h>
83 #include <inet/ip_ftable.h>
84 #include <inet/ip_rts.h>
85 #include <inet/ip_ndp.h>
86 #include <inet/ip_if.h>
87 #include <inet/ip_impl.h>
88 #include <inet/sctp_ip.h>
89 #include <inet/ip_netinfo.h>
90 #include <inet/ilb_ip.h>
91 
92 #include <netinet/igmp.h>
93 #include <inet/ip_listutils.h>
94 #include <inet/ipclassifier.h>
95 #include <sys/mac_client.h>
96 #include <sys/dld.h>
97 #include <sys/mac_flow.h>
98 
99 #include <sys/systeminfo.h>
100 #include <sys/bootconf.h>
101 
102 #include <sys/tsol/tndb.h>
103 #include <sys/tsol/tnet.h>
104 
105 #include <inet/rawip_impl.h> /* needed for icmp_stack_t */
106 #include <inet/udp_impl.h> /* needed for udp_stack_t */
107 
108 /* The character which tells where the ill_name ends */
109 #define	IPIF_SEPARATOR_CHAR	':'
110 
111 /* IP ioctl function table entry */
112 typedef struct ipft_s {
113 	int	ipft_cmd;
114 	pfi_t	ipft_pfi;
115 	int	ipft_min_size;
116 	int	ipft_flags;
117 } ipft_t;
118 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
119 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
120 
121 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
122 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
123 		    char *value, caddr_t cp, cred_t *ioc_cr);
124 
125 static boolean_t ill_is_quiescent(ill_t *);
126 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
127 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
128 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
129     mblk_t *mp, boolean_t need_up);
130 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
131     mblk_t *mp, boolean_t need_up);
132 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
133     queue_t *q, mblk_t *mp, boolean_t need_up);
134 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
135     mblk_t *mp);
136 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
137     mblk_t *mp);
138 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
139     queue_t *q, mblk_t *mp, boolean_t need_up);
140 static int	ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
141     int ioccmd, struct linkblk *li);
142 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **, ip_stack_t *);
143 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
144 static void	ipsq_flush(ill_t *ill);
145 
146 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
147     queue_t *q, mblk_t *mp, boolean_t need_up);
148 static void	ipsq_delete(ipsq_t *);
149 
150 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
151     boolean_t initialize, boolean_t insert, int *errorp);
152 static ire_t	**ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep);
153 static void	ipif_delete_bcast_ires(ipif_t *ipif);
154 static int	ipif_add_ires_v4(ipif_t *, boolean_t);
155 static boolean_t ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif,
156 		    boolean_t isv6);
157 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
158 static void	ipif_free(ipif_t *ipif);
159 static void	ipif_free_tail(ipif_t *ipif);
160 static void	ipif_set_default(ipif_t *ipif);
161 static int	ipif_set_values(queue_t *q, mblk_t *mp,
162     char *interf_name, uint_t *ppa);
163 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
164     queue_t *q);
165 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
166     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
167     ip_stack_t *);
168 static ipif_t	*ipif_lookup_on_name_async(char *name, size_t namelen,
169     boolean_t isv6, zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func,
170     int *error, ip_stack_t *);
171 
172 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
173 static void	ill_delete_interface_type(ill_if_t *);
174 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
175 static void	ill_dl_down(ill_t *ill);
176 static void	ill_down(ill_t *ill);
177 static void	ill_down_ipifs(ill_t *, boolean_t);
178 static void	ill_free_mib(ill_t *ill);
179 static void	ill_glist_delete(ill_t *);
180 static void	ill_phyint_reinit(ill_t *ill);
181 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
182 static void	ill_set_phys_addr_tail(ipsq_t *, queue_t *, mblk_t *, void *);
183 static void	ill_replumb_tail(ipsq_t *, queue_t *, mblk_t *, void *);
184 
185 static ip_v6intfid_func_t ip_ether_v6intfid, ip_ib_v6intfid;
186 static ip_v6intfid_func_t ip_ipv4_v6intfid, ip_ipv6_v6intfid;
187 static ip_v6intfid_func_t ip_ipmp_v6intfid, ip_nodef_v6intfid;
188 static ip_v6intfid_func_t ip_ipv4_v6destintfid, ip_ipv6_v6destintfid;
189 static ip_v4mapinfo_func_t ip_ether_v4_mapping;
190 static ip_v6mapinfo_func_t ip_ether_v6_mapping;
191 static ip_v4mapinfo_func_t ip_ib_v4_mapping;
192 static ip_v6mapinfo_func_t ip_ib_v6_mapping;
193 static ip_v4mapinfo_func_t ip_mbcast_mapping;
194 static void 	ip_cgtp_bcast_add(ire_t *, ip_stack_t *);
195 static void 	ip_cgtp_bcast_delete(ire_t *, ip_stack_t *);
196 static void	phyint_free(phyint_t *);
197 
198 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *);
199 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
200 static void ill_capability_vrrp_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
201 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
202 static void ill_capability_hcksum_reset_fill(ill_t *, mblk_t *);
203 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
204     dl_capability_sub_t *);
205 static void ill_capability_zerocopy_reset_fill(ill_t *, mblk_t *);
206 static void	ill_capability_dld_reset_fill(ill_t *, mblk_t *);
207 static void	ill_capability_dld_ack(ill_t *, mblk_t *,
208 		    dl_capability_sub_t *);
209 static void	ill_capability_dld_enable(ill_t *);
210 static void	ill_capability_ack_thr(void *);
211 static void	ill_capability_lso_enable(ill_t *);
212 
213 static ill_t	*ill_prev_usesrc(ill_t *);
214 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
215 static void	ill_disband_usesrc_group(ill_t *);
216 static void	ip_sioctl_garp_reply(mblk_t *, ill_t *, void *, int);
217 
218 #ifdef DEBUG
219 static	void	ill_trace_cleanup(const ill_t *);
220 static	void	ipif_trace_cleanup(const ipif_t *);
221 #endif
222 
223 static	void	ill_dlpi_clear_deferred(ill_t *ill);
224 
225 /*
226  * if we go over the memory footprint limit more than once in this msec
227  * interval, we'll start pruning aggressively.
228  */
229 int ip_min_frag_prune_time = 0;
230 
231 static ipft_t	ip_ioctl_ftbl[] = {
232 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
233 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
234 		IPFT_F_NO_REPLY },
235 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
236 	{ 0 }
237 };
238 
239 /* Simple ICMP IP Header Template */
240 static ipha_t icmp_ipha = {
241 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
242 };
243 
244 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
245 
246 static ip_m_t   ip_m_tbl[] = {
247 	{ DL_ETHER, IFT_ETHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
248 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
249 	    ip_nodef_v6intfid },
250 	{ DL_CSMACD, IFT_ISO88023, ETHERTYPE_IP, ETHERTYPE_IPV6,
251 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
252 	    ip_nodef_v6intfid },
253 	{ DL_TPB, IFT_ISO88024, ETHERTYPE_IP, ETHERTYPE_IPV6,
254 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
255 	    ip_nodef_v6intfid },
256 	{ DL_TPR, IFT_ISO88025, ETHERTYPE_IP, ETHERTYPE_IPV6,
257 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
258 	    ip_nodef_v6intfid },
259 	{ DL_FDDI, IFT_FDDI, ETHERTYPE_IP, ETHERTYPE_IPV6,
260 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
261 	    ip_nodef_v6intfid },
262 	{ DL_IB, IFT_IB, ETHERTYPE_IP, ETHERTYPE_IPV6,
263 	    ip_ib_v4_mapping, ip_ib_v6_mapping, ip_ib_v6intfid,
264 	    ip_nodef_v6intfid },
265 	{ DL_IPV4, IFT_IPV4, IPPROTO_ENCAP, IPPROTO_IPV6,
266 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
267 	    ip_ipv4_v6destintfid },
268 	{ DL_IPV6, IFT_IPV6, IPPROTO_ENCAP, IPPROTO_IPV6,
269 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv6_v6intfid,
270 	    ip_ipv6_v6destintfid },
271 	{ DL_6TO4, IFT_6TO4, IPPROTO_ENCAP, IPPROTO_IPV6,
272 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
273 	    ip_nodef_v6intfid },
274 	{ SUNW_DL_VNI, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
275 	    NULL, NULL, ip_nodef_v6intfid, ip_nodef_v6intfid },
276 	{ SUNW_DL_IPMP, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
277 	    NULL, NULL, ip_ipmp_v6intfid, ip_nodef_v6intfid },
278 	{ DL_OTHER, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
279 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
280 	    ip_nodef_v6intfid }
281 };
282 
283 static ill_t	ill_null;		/* Empty ILL for init. */
284 char	ipif_loopback_name[] = "lo0";
285 
286 /* These are used by all IP network modules. */
287 sin6_t	sin6_null;	/* Zero address for quick clears */
288 sin_t	sin_null;	/* Zero address for quick clears */
289 
290 /* When set search for unused ipif_seqid */
291 static ipif_t	ipif_zero;
292 
293 /*
294  * ppa arena is created after these many
295  * interfaces have been plumbed.
296  */
297 uint_t	ill_no_arena = 12;	/* Setable in /etc/system */
298 
299 /*
300  * Allocate per-interface mibs.
301  * Returns true if ok. False otherwise.
302  *  ipsq  may not yet be allocated (loopback case ).
303  */
304 static boolean_t
305 ill_allocate_mibs(ill_t *ill)
306 {
307 	/* Already allocated? */
308 	if (ill->ill_ip_mib != NULL) {
309 		if (ill->ill_isv6)
310 			ASSERT(ill->ill_icmp6_mib != NULL);
311 		return (B_TRUE);
312 	}
313 
314 	ill->ill_ip_mib = kmem_zalloc(sizeof (*ill->ill_ip_mib),
315 	    KM_NOSLEEP);
316 	if (ill->ill_ip_mib == NULL) {
317 		return (B_FALSE);
318 	}
319 
320 	/* Setup static information */
321 	SET_MIB(ill->ill_ip_mib->ipIfStatsEntrySize,
322 	    sizeof (mib2_ipIfStatsEntry_t));
323 	if (ill->ill_isv6) {
324 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
325 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
326 		    sizeof (mib2_ipv6AddrEntry_t));
327 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
328 		    sizeof (mib2_ipv6RouteEntry_t));
329 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
330 		    sizeof (mib2_ipv6NetToMediaEntry_t));
331 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
332 		    sizeof (ipv6_member_t));
333 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
334 		    sizeof (ipv6_grpsrc_t));
335 	} else {
336 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
337 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
338 		    sizeof (mib2_ipAddrEntry_t));
339 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
340 		    sizeof (mib2_ipRouteEntry_t));
341 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
342 		    sizeof (mib2_ipNetToMediaEntry_t));
343 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
344 		    sizeof (ip_member_t));
345 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
346 		    sizeof (ip_grpsrc_t));
347 
348 		/*
349 		 * For a v4 ill, we are done at this point, because per ill
350 		 * icmp mibs are only used for v6.
351 		 */
352 		return (B_TRUE);
353 	}
354 
355 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
356 	    KM_NOSLEEP);
357 	if (ill->ill_icmp6_mib == NULL) {
358 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
359 		ill->ill_ip_mib = NULL;
360 		return (B_FALSE);
361 	}
362 	/* static icmp info */
363 	ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
364 	    sizeof (mib2_ipv6IfIcmpEntry_t);
365 	/*
366 	 * The ipIfStatsIfindex and ipv6IfIcmpIndex will be assigned later
367 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
368 	 * -> ill_phyint_reinit
369 	 */
370 	return (B_TRUE);
371 }
372 
373 /*
374  * Completely vaporize a lower level tap and all associated interfaces.
375  * ill_delete is called only out of ip_close when the device control
376  * stream is being closed.
377  */
378 void
379 ill_delete(ill_t *ill)
380 {
381 	ipif_t	*ipif;
382 	ill_t	*prev_ill;
383 	ip_stack_t	*ipst = ill->ill_ipst;
384 
385 	/*
386 	 * ill_delete may be forcibly entering the ipsq. The previous
387 	 * ioctl may not have completed and may need to be aborted.
388 	 * ipsq_flush takes care of it. If we don't need to enter the
389 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
390 	 * ill_delete_tail is sufficient.
391 	 */
392 	ipsq_flush(ill);
393 
394 	/*
395 	 * Nuke all interfaces.  ipif_free will take down the interface,
396 	 * remove it from the list, and free the data structure.
397 	 * Walk down the ipif list and remove the logical interfaces
398 	 * first before removing the main ipif. We can't unplumb
399 	 * zeroth interface first in the case of IPv6 as update_conn_ill
400 	 * -> ip_ll_multireq de-references ill_ipif for checking
401 	 * POINTOPOINT.
402 	 *
403 	 * If ill_ipif was not properly initialized (i.e low on memory),
404 	 * then no interfaces to clean up. In this case just clean up the
405 	 * ill.
406 	 */
407 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
408 		ipif_free(ipif);
409 
410 	/*
411 	 * clean out all the nce_t entries that depend on this
412 	 * ill for the ill_phys_addr.
413 	 */
414 	nce_flush(ill, B_TRUE);
415 
416 	/* Clean up msgs on pending upcalls for mrouted */
417 	reset_mrt_ill(ill);
418 
419 	update_conn_ill(ill, ipst);
420 
421 	/*
422 	 * Remove multicast references added as a result of calls to
423 	 * ip_join_allmulti().
424 	 */
425 	ip_purge_allmulti(ill);
426 
427 	/*
428 	 * If the ill being deleted is under IPMP, boot it out of the illgrp.
429 	 */
430 	if (IS_UNDER_IPMP(ill))
431 		ipmp_ill_leave_illgrp(ill);
432 
433 	/*
434 	 * ill_down will arrange to blow off any IRE's dependent on this
435 	 * ILL, and shut down fragmentation reassembly.
436 	 */
437 	ill_down(ill);
438 
439 	/* Let SCTP know, so that it can remove this from its list. */
440 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
441 
442 	/*
443 	 * Walk all CONNs that can have a reference on an ire or nce for this
444 	 * ill (we actually walk all that now have stale references).
445 	 */
446 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
447 
448 	/* With IPv6 we have dce_ifindex. Cleanup for neatness */
449 	if (ill->ill_isv6)
450 		dce_cleanup(ill->ill_phyint->phyint_ifindex, ipst);
451 
452 	/*
453 	 * If an address on this ILL is being used as a source address then
454 	 * clear out the pointers in other ILLs that point to this ILL.
455 	 */
456 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
457 	if (ill->ill_usesrc_grp_next != NULL) {
458 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
459 			ill_disband_usesrc_group(ill);
460 		} else {	/* consumer of the usesrc ILL */
461 			prev_ill = ill_prev_usesrc(ill);
462 			prev_ill->ill_usesrc_grp_next =
463 			    ill->ill_usesrc_grp_next;
464 		}
465 	}
466 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
467 }
468 
469 static void
470 ipif_non_duplicate(ipif_t *ipif)
471 {
472 	ill_t *ill = ipif->ipif_ill;
473 	mutex_enter(&ill->ill_lock);
474 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
475 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
476 		ASSERT(ill->ill_ipif_dup_count > 0);
477 		ill->ill_ipif_dup_count--;
478 	}
479 	mutex_exit(&ill->ill_lock);
480 }
481 
482 /*
483  * ill_delete_tail is called from ip_modclose after all references
484  * to the closing ill are gone. The wait is done in ip_modclose
485  */
486 void
487 ill_delete_tail(ill_t *ill)
488 {
489 	mblk_t	**mpp;
490 	ipif_t	*ipif;
491 	ip_stack_t *ipst = ill->ill_ipst;
492 
493 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
494 		ipif_non_duplicate(ipif);
495 		(void) ipif_down_tail(ipif);
496 	}
497 
498 	ASSERT(ill->ill_ipif_dup_count == 0);
499 
500 	/*
501 	 * If polling capability is enabled (which signifies direct
502 	 * upcall into IP and driver has ill saved as a handle),
503 	 * we need to make sure that unbind has completed before we
504 	 * let the ill disappear and driver no longer has any reference
505 	 * to this ill.
506 	 */
507 	mutex_enter(&ill->ill_lock);
508 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
509 		cv_wait(&ill->ill_cv, &ill->ill_lock);
510 	mutex_exit(&ill->ill_lock);
511 	ASSERT(!(ill->ill_capabilities &
512 	    (ILL_CAPAB_DLD | ILL_CAPAB_DLD_POLL | ILL_CAPAB_DLD_DIRECT)));
513 
514 	if (ill->ill_net_type != IRE_LOOPBACK)
515 		qprocsoff(ill->ill_rq);
516 
517 	/*
518 	 * We do an ipsq_flush once again now. New messages could have
519 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
520 	 * could also have landed up if an ioctl thread had looked up
521 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
522 	 * enqueued the ioctl when we did the ipsq_flush last time.
523 	 */
524 	ipsq_flush(ill);
525 
526 	/*
527 	 * Free capabilities.
528 	 */
529 	if (ill->ill_hcksum_capab != NULL) {
530 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
531 		ill->ill_hcksum_capab = NULL;
532 	}
533 
534 	if (ill->ill_zerocopy_capab != NULL) {
535 		kmem_free(ill->ill_zerocopy_capab,
536 		    sizeof (ill_zerocopy_capab_t));
537 		ill->ill_zerocopy_capab = NULL;
538 	}
539 
540 	if (ill->ill_lso_capab != NULL) {
541 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
542 		ill->ill_lso_capab = NULL;
543 	}
544 
545 	if (ill->ill_dld_capab != NULL) {
546 		kmem_free(ill->ill_dld_capab, sizeof (ill_dld_capab_t));
547 		ill->ill_dld_capab = NULL;
548 	}
549 
550 	/* Clean up ill_allowed_ips* related state */
551 	if (ill->ill_allowed_ips != NULL) {
552 		ASSERT(ill->ill_allowed_ips_cnt > 0);
553 		kmem_free(ill->ill_allowed_ips,
554 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
555 		ill->ill_allowed_ips = NULL;
556 		ill->ill_allowed_ips_cnt = 0;
557 	}
558 
559 	while (ill->ill_ipif != NULL)
560 		ipif_free_tail(ill->ill_ipif);
561 
562 	/*
563 	 * We have removed all references to ilm from conn and the ones joined
564 	 * within the kernel.
565 	 *
566 	 * We don't walk conns, mrts and ires because
567 	 *
568 	 * 1) update_conn_ill and reset_mrt_ill cleans up conns and mrts.
569 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
570 	 *    ill references.
571 	 */
572 
573 	/*
574 	 * If this ill is an IPMP meta-interface, blow away the illgrp.  This
575 	 * is safe to do because the illgrp has already been unlinked from the
576 	 * group by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find it.
577 	 */
578 	if (IS_IPMP(ill)) {
579 		ipmp_illgrp_destroy(ill->ill_grp);
580 		ill->ill_grp = NULL;
581 	}
582 
583 	if (ill->ill_mphysaddr_list != NULL) {
584 		multiphysaddr_t *mpa, *tmpa;
585 
586 		mpa = ill->ill_mphysaddr_list;
587 		ill->ill_mphysaddr_list = NULL;
588 		while (mpa) {
589 			tmpa = mpa->mpa_next;
590 			kmem_free(mpa, sizeof (*mpa));
591 			mpa = tmpa;
592 		}
593 	}
594 	/*
595 	 * Take us out of the list of ILLs. ill_glist_delete -> phyint_free
596 	 * could free the phyint. No more reference to the phyint after this
597 	 * point.
598 	 */
599 	(void) ill_glist_delete(ill);
600 
601 	if (ill->ill_frag_ptr != NULL) {
602 		uint_t count;
603 
604 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
605 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
606 		}
607 		mi_free(ill->ill_frag_ptr);
608 		ill->ill_frag_ptr = NULL;
609 		ill->ill_frag_hash_tbl = NULL;
610 	}
611 
612 	freemsg(ill->ill_nd_lla_mp);
613 	/* Free all retained control messages. */
614 	mpp = &ill->ill_first_mp_to_free;
615 	do {
616 		while (mpp[0]) {
617 			mblk_t  *mp;
618 			mblk_t  *mp1;
619 
620 			mp = mpp[0];
621 			mpp[0] = mp->b_next;
622 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
623 				mp1->b_next = NULL;
624 				mp1->b_prev = NULL;
625 			}
626 			freemsg(mp);
627 		}
628 	} while (mpp++ != &ill->ill_last_mp_to_free);
629 
630 	ill_free_mib(ill);
631 
632 #ifdef DEBUG
633 	ill_trace_cleanup(ill);
634 #endif
635 
636 	/* The default multicast interface might have changed */
637 	ire_increment_multicast_generation(ipst, ill->ill_isv6);
638 
639 	/* Drop refcnt here */
640 	netstack_rele(ill->ill_ipst->ips_netstack);
641 	ill->ill_ipst = NULL;
642 }
643 
644 static void
645 ill_free_mib(ill_t *ill)
646 {
647 	ip_stack_t *ipst = ill->ill_ipst;
648 
649 	/*
650 	 * MIB statistics must not be lost, so when an interface
651 	 * goes away the counter values will be added to the global
652 	 * MIBs.
653 	 */
654 	if (ill->ill_ip_mib != NULL) {
655 		if (ill->ill_isv6) {
656 			ip_mib2_add_ip_stats(&ipst->ips_ip6_mib,
657 			    ill->ill_ip_mib);
658 		} else {
659 			ip_mib2_add_ip_stats(&ipst->ips_ip_mib,
660 			    ill->ill_ip_mib);
661 		}
662 
663 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
664 		ill->ill_ip_mib = NULL;
665 	}
666 	if (ill->ill_icmp6_mib != NULL) {
667 		ip_mib2_add_icmp6_stats(&ipst->ips_icmp6_mib,
668 		    ill->ill_icmp6_mib);
669 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
670 		ill->ill_icmp6_mib = NULL;
671 	}
672 }
673 
674 /*
675  * Concatenate together a physical address and a sap.
676  *
677  * Sap_lengths are interpreted as follows:
678  *   sap_length == 0	==>	no sap
679  *   sap_length > 0	==>	sap is at the head of the dlpi address
680  *   sap_length < 0	==>	sap is at the tail of the dlpi address
681  */
682 static void
683 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
684     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
685 {
686 	uint16_t sap_addr = (uint16_t)sap_src;
687 
688 	if (sap_length == 0) {
689 		if (phys_src == NULL)
690 			bzero(dst, phys_length);
691 		else
692 			bcopy(phys_src, dst, phys_length);
693 	} else if (sap_length < 0) {
694 		if (phys_src == NULL)
695 			bzero(dst, phys_length);
696 		else
697 			bcopy(phys_src, dst, phys_length);
698 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
699 	} else {
700 		bcopy(&sap_addr, dst, sizeof (sap_addr));
701 		if (phys_src == NULL)
702 			bzero((char *)dst + sap_length, phys_length);
703 		else
704 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
705 	}
706 }
707 
708 /*
709  * Generate a dl_unitdata_req mblk for the device and address given.
710  * addr_length is the length of the physical portion of the address.
711  * If addr is NULL include an all zero address of the specified length.
712  * TRUE? In any case, addr_length is taken to be the entire length of the
713  * dlpi address, including the absolute value of sap_length.
714  */
715 mblk_t *
716 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
717 		t_scalar_t sap_length)
718 {
719 	dl_unitdata_req_t *dlur;
720 	mblk_t	*mp;
721 	t_scalar_t	abs_sap_length;		/* absolute value */
722 
723 	abs_sap_length = ABS(sap_length);
724 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
725 	    DL_UNITDATA_REQ);
726 	if (mp == NULL)
727 		return (NULL);
728 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
729 	/* HACK: accomodate incompatible DLPI drivers */
730 	if (addr_length == 8)
731 		addr_length = 6;
732 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
733 	dlur->dl_dest_addr_offset = sizeof (*dlur);
734 	dlur->dl_priority.dl_min = 0;
735 	dlur->dl_priority.dl_max = 0;
736 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
737 	    (uchar_t *)&dlur[1]);
738 	return (mp);
739 }
740 
741 /*
742  * Add the pending mp to the list. There can be only 1 pending mp
743  * in the list. Any exclusive ioctl that needs to wait for a response
744  * from another module or driver needs to use this function to set
745  * the ipx_pending_mp to the ioctl mblk and wait for the response from
746  * the other module/driver. This is also used while waiting for the
747  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
748  */
749 boolean_t
750 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
751     int waitfor)
752 {
753 	ipxop_t	*ipx = ipif->ipif_ill->ill_phyint->phyint_ipsq->ipsq_xop;
754 
755 	ASSERT(IAM_WRITER_IPIF(ipif));
756 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
757 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
758 	ASSERT(ipx->ipx_pending_mp == NULL);
759 	/*
760 	 * The caller may be using a different ipif than the one passed into
761 	 * ipsq_current_start() (e.g., suppose an ioctl that came in on the V4
762 	 * ill needs to wait for the V6 ill to quiesce).  So we can't ASSERT
763 	 * that `ipx_current_ipif == ipif'.
764 	 */
765 	ASSERT(ipx->ipx_current_ipif != NULL);
766 
767 	/*
768 	 * M_IOCDATA from ioctls, M_ERROR/M_HANGUP/M_PROTO/M_PCPROTO from the
769 	 * driver.
770 	 */
771 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_ERROR) ||
772 	    (DB_TYPE(add_mp) == M_HANGUP) || (DB_TYPE(add_mp) == M_PROTO) ||
773 	    (DB_TYPE(add_mp) == M_PCPROTO));
774 
775 	if (connp != NULL) {
776 		ASSERT(MUTEX_HELD(&connp->conn_lock));
777 		/*
778 		 * Return error if the conn has started closing. The conn
779 		 * could have finished cleaning up the pending mp list,
780 		 * If so we should not add another mp to the list negating
781 		 * the cleanup.
782 		 */
783 		if (connp->conn_state_flags & CONN_CLOSING)
784 			return (B_FALSE);
785 	}
786 	mutex_enter(&ipx->ipx_lock);
787 	ipx->ipx_pending_ipif = ipif;
788 	/*
789 	 * Note down the queue in b_queue. This will be returned by
790 	 * ipsq_pending_mp_get. Caller will then use these values to restart
791 	 * the processing
792 	 */
793 	add_mp->b_next = NULL;
794 	add_mp->b_queue = q;
795 	ipx->ipx_pending_mp = add_mp;
796 	ipx->ipx_waitfor = waitfor;
797 	mutex_exit(&ipx->ipx_lock);
798 
799 	if (connp != NULL)
800 		connp->conn_oper_pending_ill = ipif->ipif_ill;
801 
802 	return (B_TRUE);
803 }
804 
805 /*
806  * Retrieve the ipx_pending_mp and return it. There can be only 1 mp
807  * queued in the list.
808  */
809 mblk_t *
810 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
811 {
812 	mblk_t	*curr = NULL;
813 	ipxop_t	*ipx = ipsq->ipsq_xop;
814 
815 	*connpp = NULL;
816 	mutex_enter(&ipx->ipx_lock);
817 	if (ipx->ipx_pending_mp == NULL) {
818 		mutex_exit(&ipx->ipx_lock);
819 		return (NULL);
820 	}
821 
822 	/* There can be only 1 such excl message */
823 	curr = ipx->ipx_pending_mp;
824 	ASSERT(curr->b_next == NULL);
825 	ipx->ipx_pending_ipif = NULL;
826 	ipx->ipx_pending_mp = NULL;
827 	ipx->ipx_waitfor = 0;
828 	mutex_exit(&ipx->ipx_lock);
829 
830 	if (CONN_Q(curr->b_queue)) {
831 		/*
832 		 * This mp did a refhold on the conn, at the start of the ioctl.
833 		 * So we can safely return a pointer to the conn to the caller.
834 		 */
835 		*connpp = Q_TO_CONN(curr->b_queue);
836 	} else {
837 		*connpp = NULL;
838 	}
839 	curr->b_next = NULL;
840 	curr->b_prev = NULL;
841 	return (curr);
842 }
843 
844 /*
845  * Cleanup the ioctl mp queued in ipx_pending_mp
846  * - Called in the ill_delete path
847  * - Called in the M_ERROR or M_HANGUP path on the ill.
848  * - Called in the conn close path.
849  *
850  * Returns success on finding the pending mblk associated with the ioctl or
851  * exclusive operation in progress, failure otherwise.
852  */
853 boolean_t
854 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
855 {
856 	mblk_t	*mp;
857 	ipxop_t	*ipx;
858 	queue_t	*q;
859 	ipif_t	*ipif;
860 	int	cmd;
861 
862 	ASSERT(IAM_WRITER_ILL(ill));
863 	ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
864 
865 	mutex_enter(&ipx->ipx_lock);
866 	mp = ipx->ipx_pending_mp;
867 	if (connp != NULL) {
868 		if (mp == NULL || mp->b_queue != CONNP_TO_WQ(connp)) {
869 			/*
870 			 * Nothing to clean since the conn that is closing
871 			 * does not have a matching pending mblk in
872 			 * ipx_pending_mp.
873 			 */
874 			mutex_exit(&ipx->ipx_lock);
875 			return (B_FALSE);
876 		}
877 	} else {
878 		/*
879 		 * A non-zero ill_error signifies we are called in the
880 		 * M_ERROR or M_HANGUP path and we need to unconditionally
881 		 * abort any current ioctl and do the corresponding cleanup.
882 		 * A zero ill_error means we are in the ill_delete path and
883 		 * we do the cleanup only if there is a pending mp.
884 		 */
885 		if (mp == NULL && ill->ill_error == 0) {
886 			mutex_exit(&ipx->ipx_lock);
887 			return (B_FALSE);
888 		}
889 	}
890 
891 	/* Now remove from the ipx_pending_mp */
892 	ipx->ipx_pending_mp = NULL;
893 	ipif = ipx->ipx_pending_ipif;
894 	ipx->ipx_pending_ipif = NULL;
895 	ipx->ipx_waitfor = 0;
896 	ipx->ipx_current_ipif = NULL;
897 	cmd = ipx->ipx_current_ioctl;
898 	ipx->ipx_current_ioctl = 0;
899 	ipx->ipx_current_done = B_TRUE;
900 	mutex_exit(&ipx->ipx_lock);
901 
902 	if (mp == NULL)
903 		return (B_FALSE);
904 
905 	q = mp->b_queue;
906 	mp->b_next = NULL;
907 	mp->b_prev = NULL;
908 	mp->b_queue = NULL;
909 
910 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
911 		DTRACE_PROBE4(ipif__ioctl,
912 		    char *, "ipsq_pending_mp_cleanup",
913 		    int, cmd, ill_t *, ipif == NULL ? NULL : ipif->ipif_ill,
914 		    ipif_t *, ipif);
915 		if (connp == NULL) {
916 			ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
917 		} else {
918 			ip_ioctl_finish(q, mp, ENXIO, CONN_CLOSE, NULL);
919 			mutex_enter(&ipif->ipif_ill->ill_lock);
920 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
921 			mutex_exit(&ipif->ipif_ill->ill_lock);
922 		}
923 	} else {
924 		inet_freemsg(mp);
925 	}
926 	return (B_TRUE);
927 }
928 
929 /*
930  * Called in the conn close path and ill delete path
931  */
932 static void
933 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
934 {
935 	ipsq_t	*ipsq;
936 	mblk_t	*prev;
937 	mblk_t	*curr;
938 	mblk_t	*next;
939 	queue_t	*wq, *rq = NULL;
940 	mblk_t	*tmp_list = NULL;
941 
942 	ASSERT(IAM_WRITER_ILL(ill));
943 	if (connp != NULL)
944 		wq = CONNP_TO_WQ(connp);
945 	else
946 		wq = ill->ill_wq;
947 
948 	/*
949 	 * In the case of lo0 being unplumbed, ill_wq will be NULL. Guard
950 	 * against this here.
951 	 */
952 	if (wq != NULL)
953 		rq = RD(wq);
954 
955 	ipsq = ill->ill_phyint->phyint_ipsq;
956 	/*
957 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
958 	 * In the case of ioctl from a conn, there can be only 1 mp
959 	 * queued on the ipsq. If an ill is being unplumbed flush all
960 	 * the messages.
961 	 */
962 	mutex_enter(&ipsq->ipsq_lock);
963 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
964 	    curr = next) {
965 		next = curr->b_next;
966 		if (connp == NULL ||
967 		    (curr->b_queue == wq || curr->b_queue == rq)) {
968 			/* Unlink the mblk from the pending mp list */
969 			if (prev != NULL) {
970 				prev->b_next = curr->b_next;
971 			} else {
972 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
973 				ipsq->ipsq_xopq_mphead = curr->b_next;
974 			}
975 			if (ipsq->ipsq_xopq_mptail == curr)
976 				ipsq->ipsq_xopq_mptail = prev;
977 			/*
978 			 * Create a temporary list and release the ipsq lock
979 			 * New elements are added to the head of the tmp_list
980 			 */
981 			curr->b_next = tmp_list;
982 			tmp_list = curr;
983 		} else {
984 			prev = curr;
985 		}
986 	}
987 	mutex_exit(&ipsq->ipsq_lock);
988 
989 	while (tmp_list != NULL) {
990 		curr = tmp_list;
991 		tmp_list = curr->b_next;
992 		curr->b_next = NULL;
993 		curr->b_prev = NULL;
994 		wq = curr->b_queue;
995 		curr->b_queue = NULL;
996 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
997 			DTRACE_PROBE4(ipif__ioctl,
998 			    char *, "ipsq_xopq_mp_cleanup",
999 			    int, 0, ill_t *, NULL, ipif_t *, NULL);
1000 			ip_ioctl_finish(wq, curr, ENXIO, connp != NULL ?
1001 			    CONN_CLOSE : NO_COPYOUT, NULL);
1002 		} else {
1003 			/*
1004 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1005 			 * this can't be just inet_freemsg. we have to
1006 			 * restart it otherwise the thread will be stuck.
1007 			 */
1008 			inet_freemsg(curr);
1009 		}
1010 	}
1011 }
1012 
1013 /*
1014  * This conn has started closing. Cleanup any pending ioctl from this conn.
1015  * STREAMS ensures that there can be at most 1 active ioctl on a stream.
1016  */
1017 void
1018 conn_ioctl_cleanup(conn_t *connp)
1019 {
1020 	ipsq_t	*ipsq;
1021 	ill_t	*ill;
1022 	boolean_t refheld;
1023 
1024 	/*
1025 	 * Check for a queued ioctl. If the ioctl has not yet started, the mp
1026 	 * is pending in the list headed by ipsq_xopq_head. If the ioctl has
1027 	 * started the mp could be present in ipx_pending_mp. Note that if
1028 	 * conn_oper_pending_ill is NULL, the ioctl may still be in flight and
1029 	 * not yet queued anywhere. In this case, the conn close code will wait
1030 	 * until the conn_ref is dropped. If the stream was a tcp stream, then
1031 	 * tcp_close will wait first until all ioctls have completed for this
1032 	 * conn.
1033 	 */
1034 	mutex_enter(&connp->conn_lock);
1035 	ill = connp->conn_oper_pending_ill;
1036 	if (ill == NULL) {
1037 		mutex_exit(&connp->conn_lock);
1038 		return;
1039 	}
1040 
1041 	/*
1042 	 * We may not be able to refhold the ill if the ill/ipif
1043 	 * is changing. But we need to make sure that the ill will
1044 	 * not vanish. So we just bump up the ill_waiter count.
1045 	 */
1046 	refheld = ill_waiter_inc(ill);
1047 	mutex_exit(&connp->conn_lock);
1048 	if (refheld) {
1049 		if (ipsq_enter(ill, B_TRUE, NEW_OP)) {
1050 			ill_waiter_dcr(ill);
1051 			/*
1052 			 * Check whether this ioctl has started and is
1053 			 * pending. If it is not found there then check
1054 			 * whether this ioctl has not even started and is in
1055 			 * the ipsq_xopq list.
1056 			 */
1057 			if (!ipsq_pending_mp_cleanup(ill, connp))
1058 				ipsq_xopq_mp_cleanup(ill, connp);
1059 			ipsq = ill->ill_phyint->phyint_ipsq;
1060 			ipsq_exit(ipsq);
1061 			return;
1062 		}
1063 	}
1064 
1065 	/*
1066 	 * The ill is also closing and we could not bump up the
1067 	 * ill_waiter_count or we could not enter the ipsq. Leave
1068 	 * the cleanup to ill_delete
1069 	 */
1070 	mutex_enter(&connp->conn_lock);
1071 	while (connp->conn_oper_pending_ill != NULL)
1072 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1073 	mutex_exit(&connp->conn_lock);
1074 	if (refheld)
1075 		ill_waiter_dcr(ill);
1076 }
1077 
1078 /*
1079  * ipcl_walk function for cleaning up conn_*_ill fields.
1080  * Note that we leave ixa_multicast_ifindex, conn_incoming_ifindex, and
1081  * conn_bound_if in place. We prefer dropping
1082  * packets instead of sending them out the wrong interface, or accepting
1083  * packets from the wrong ifindex.
1084  */
1085 static void
1086 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1087 {
1088 	ill_t	*ill = (ill_t *)arg;
1089 
1090 	mutex_enter(&connp->conn_lock);
1091 	if (connp->conn_dhcpinit_ill == ill) {
1092 		connp->conn_dhcpinit_ill = NULL;
1093 		ASSERT(ill->ill_dhcpinit != 0);
1094 		atomic_dec_32(&ill->ill_dhcpinit);
1095 		ill_set_inputfn(ill);
1096 	}
1097 	mutex_exit(&connp->conn_lock);
1098 }
1099 
1100 static int
1101 ill_down_ipifs_tail(ill_t *ill)
1102 {
1103 	ipif_t	*ipif;
1104 	int err;
1105 
1106 	ASSERT(IAM_WRITER_ILL(ill));
1107 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1108 		ipif_non_duplicate(ipif);
1109 		/*
1110 		 * ipif_down_tail will call arp_ll_down on the last ipif
1111 		 * and typically return EINPROGRESS when the DL_UNBIND is sent.
1112 		 */
1113 		if ((err = ipif_down_tail(ipif)) != 0)
1114 			return (err);
1115 	}
1116 	return (0);
1117 }
1118 
1119 /* ARGSUSED */
1120 void
1121 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1122 {
1123 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1124 	(void) ill_down_ipifs_tail(q->q_ptr);
1125 	freemsg(mp);
1126 	ipsq_current_finish(ipsq);
1127 }
1128 
1129 /*
1130  * ill_down_start is called when we want to down this ill and bring it up again
1131  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1132  * all interfaces, but don't tear down any plumbing.
1133  */
1134 boolean_t
1135 ill_down_start(queue_t *q, mblk_t *mp)
1136 {
1137 	ill_t	*ill = q->q_ptr;
1138 	ipif_t	*ipif;
1139 
1140 	ASSERT(IAM_WRITER_ILL(ill));
1141 	/*
1142 	 * It is possible that some ioctl is already in progress while we
1143 	 * received the M_ERROR / M_HANGUP in which case, we need to abort
1144 	 * the ioctl. ill_down_start() is being processed as CUR_OP rather
1145 	 * than as NEW_OP since the cause of the M_ERROR / M_HANGUP may prevent
1146 	 * the in progress ioctl from ever completing.
1147 	 *
1148 	 * The thread that started the ioctl (if any) must have returned,
1149 	 * since we are now executing as writer. After the 2 calls below,
1150 	 * the state of the ipsq and the ill would reflect no trace of any
1151 	 * pending operation. Subsequently if there is any response to the
1152 	 * original ioctl from the driver, it would be discarded as an
1153 	 * unsolicited message from the driver.
1154 	 */
1155 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1156 	ill_dlpi_clear_deferred(ill);
1157 
1158 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1159 		(void) ipif_down(ipif, NULL, NULL);
1160 
1161 	ill_down(ill);
1162 
1163 	/*
1164 	 * Walk all CONNs that can have a reference on an ire or nce for this
1165 	 * ill (we actually walk all that now have stale references).
1166 	 */
1167 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ill->ill_ipst);
1168 
1169 	/* With IPv6 we have dce_ifindex. Cleanup for neatness */
1170 	if (ill->ill_isv6)
1171 		dce_cleanup(ill->ill_phyint->phyint_ifindex, ill->ill_ipst);
1172 
1173 	ipsq_current_start(ill->ill_phyint->phyint_ipsq, ill->ill_ipif, 0);
1174 
1175 	/*
1176 	 * Atomically test and add the pending mp if references are active.
1177 	 */
1178 	mutex_enter(&ill->ill_lock);
1179 	if (!ill_is_quiescent(ill)) {
1180 		/* call cannot fail since `conn_t *' argument is NULL */
1181 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1182 		    mp, ILL_DOWN);
1183 		mutex_exit(&ill->ill_lock);
1184 		return (B_FALSE);
1185 	}
1186 	mutex_exit(&ill->ill_lock);
1187 	return (B_TRUE);
1188 }
1189 
1190 static void
1191 ill_down(ill_t *ill)
1192 {
1193 	mblk_t	*mp;
1194 	ip_stack_t	*ipst = ill->ill_ipst;
1195 
1196 	/*
1197 	 * Blow off any IREs dependent on this ILL.
1198 	 * The caller needs to handle conn_ixa_cleanup
1199 	 */
1200 	ill_delete_ires(ill);
1201 
1202 	ire_walk_ill(0, 0, ill_downi, ill, ill);
1203 
1204 	/* Remove any conn_*_ill depending on this ill */
1205 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill, ipst);
1206 
1207 	/*
1208 	 * Free state for additional IREs.
1209 	 */
1210 	mutex_enter(&ill->ill_saved_ire_lock);
1211 	mp = ill->ill_saved_ire_mp;
1212 	ill->ill_saved_ire_mp = NULL;
1213 	ill->ill_saved_ire_cnt = 0;
1214 	mutex_exit(&ill->ill_saved_ire_lock);
1215 	freemsg(mp);
1216 }
1217 
1218 /*
1219  * ire_walk routine used to delete every IRE that depends on
1220  * 'ill'.  (Always called as writer, and may only be called from ire_walk.)
1221  *
1222  * Note: since the routes added by the kernel are deleted separately,
1223  * this will only be 1) IRE_IF_CLONE and 2) manually added IRE_INTERFACE.
1224  *
1225  * We also remove references on ire_nce_cache entries that refer to the ill.
1226  */
1227 void
1228 ill_downi(ire_t *ire, char *ill_arg)
1229 {
1230 	ill_t	*ill = (ill_t *)ill_arg;
1231 	nce_t	*nce;
1232 
1233 	mutex_enter(&ire->ire_lock);
1234 	nce = ire->ire_nce_cache;
1235 	if (nce != NULL && nce->nce_ill == ill)
1236 		ire->ire_nce_cache = NULL;
1237 	else
1238 		nce = NULL;
1239 	mutex_exit(&ire->ire_lock);
1240 	if (nce != NULL)
1241 		nce_refrele(nce);
1242 	if (ire->ire_ill == ill) {
1243 		/*
1244 		 * The existing interface binding for ire must be
1245 		 * deleted before trying to bind the route to another
1246 		 * interface. However, since we are using the contents of the
1247 		 * ire after ire_delete, the caller has to ensure that
1248 		 * CONDEMNED (deleted) ire's are not removed from the list
1249 		 * when ire_delete() returns. Currently ill_downi() is
1250 		 * only called as part of ire_walk*() routines, so that
1251 		 * the irb_refhold() done by ire_walk*() will ensure that
1252 		 * ire_delete() does not lead to ire_inactive().
1253 		 */
1254 		ASSERT(ire->ire_bucket->irb_refcnt > 0);
1255 		ire_delete(ire);
1256 		if (ire->ire_unbound)
1257 			ire_rebind(ire);
1258 	}
1259 }
1260 
1261 /* Remove IRE_IF_CLONE on this ill */
1262 void
1263 ill_downi_if_clone(ire_t *ire, char *ill_arg)
1264 {
1265 	ill_t	*ill = (ill_t *)ill_arg;
1266 
1267 	ASSERT(ire->ire_type & IRE_IF_CLONE);
1268 	if (ire->ire_ill == ill)
1269 		ire_delete(ire);
1270 }
1271 
1272 /* Consume an M_IOCACK of the fastpath probe. */
1273 void
1274 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1275 {
1276 	mblk_t	*mp1 = mp;
1277 
1278 	/*
1279 	 * If this was the first attempt turn on the fastpath probing.
1280 	 */
1281 	mutex_enter(&ill->ill_lock);
1282 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1283 		ill->ill_dlpi_fastpath_state = IDS_OK;
1284 	mutex_exit(&ill->ill_lock);
1285 
1286 	/* Free the M_IOCACK mblk, hold on to the data */
1287 	mp = mp->b_cont;
1288 	freeb(mp1);
1289 	if (mp == NULL)
1290 		return;
1291 	if (mp->b_cont != NULL)
1292 		nce_fastpath_update(ill, mp);
1293 	else
1294 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1295 	freemsg(mp);
1296 }
1297 
1298 /*
1299  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1300  * The data portion of the request is a dl_unitdata_req_t template for
1301  * what we would send downstream in the absence of a fastpath confirmation.
1302  */
1303 int
1304 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1305 {
1306 	struct iocblk	*ioc;
1307 	mblk_t	*mp;
1308 
1309 	if (dlur_mp == NULL)
1310 		return (EINVAL);
1311 
1312 	mutex_enter(&ill->ill_lock);
1313 	switch (ill->ill_dlpi_fastpath_state) {
1314 	case IDS_FAILED:
1315 		/*
1316 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1317 		 * support it.
1318 		 */
1319 		mutex_exit(&ill->ill_lock);
1320 		return (ENOTSUP);
1321 	case IDS_UNKNOWN:
1322 		/* This is the first probe */
1323 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1324 		break;
1325 	default:
1326 		break;
1327 	}
1328 	mutex_exit(&ill->ill_lock);
1329 
1330 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1331 		return (EAGAIN);
1332 
1333 	mp->b_cont = copyb(dlur_mp);
1334 	if (mp->b_cont == NULL) {
1335 		freeb(mp);
1336 		return (EAGAIN);
1337 	}
1338 
1339 	ioc = (struct iocblk *)mp->b_rptr;
1340 	ioc->ioc_count = msgdsize(mp->b_cont);
1341 
1342 	DTRACE_PROBE3(ill__dlpi, char *, "ill_fastpath_probe",
1343 	    char *, "DL_IOC_HDR_INFO", ill_t *, ill);
1344 	putnext(ill->ill_wq, mp);
1345 	return (0);
1346 }
1347 
1348 void
1349 ill_capability_probe(ill_t *ill)
1350 {
1351 	mblk_t	*mp;
1352 
1353 	ASSERT(IAM_WRITER_ILL(ill));
1354 
1355 	if (ill->ill_dlpi_capab_state != IDCS_UNKNOWN &&
1356 	    ill->ill_dlpi_capab_state != IDCS_FAILED)
1357 		return;
1358 
1359 	/*
1360 	 * We are starting a new cycle of capability negotiation.
1361 	 * Free up the capab reset messages of any previous incarnation.
1362 	 * We will do a fresh allocation when we get the response to our probe
1363 	 */
1364 	if (ill->ill_capab_reset_mp != NULL) {
1365 		freemsg(ill->ill_capab_reset_mp);
1366 		ill->ill_capab_reset_mp = NULL;
1367 	}
1368 
1369 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1370 
1371 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
1372 	if (mp == NULL)
1373 		return;
1374 
1375 	ill_capability_send(ill, mp);
1376 	ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
1377 }
1378 
1379 void
1380 ill_capability_reset(ill_t *ill, boolean_t reneg)
1381 {
1382 	ASSERT(IAM_WRITER_ILL(ill));
1383 
1384 	if (ill->ill_dlpi_capab_state != IDCS_OK)
1385 		return;
1386 
1387 	ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
1388 
1389 	ill_capability_send(ill, ill->ill_capab_reset_mp);
1390 	ill->ill_capab_reset_mp = NULL;
1391 	/*
1392 	 * We turn off all capabilities except those pertaining to
1393 	 * direct function call capabilities viz. ILL_CAPAB_DLD*
1394 	 * which will be turned off by the corresponding reset functions.
1395 	 */
1396 	ill->ill_capabilities &= ~(ILL_CAPAB_HCKSUM  | ILL_CAPAB_ZEROCOPY);
1397 }
1398 
1399 static void
1400 ill_capability_reset_alloc(ill_t *ill)
1401 {
1402 	mblk_t *mp;
1403 	size_t	size = 0;
1404 	int	err;
1405 	dl_capability_req_t	*capb;
1406 
1407 	ASSERT(IAM_WRITER_ILL(ill));
1408 	ASSERT(ill->ill_capab_reset_mp == NULL);
1409 
1410 	if (ILL_HCKSUM_CAPABLE(ill)) {
1411 		size += sizeof (dl_capability_sub_t) +
1412 		    sizeof (dl_capab_hcksum_t);
1413 	}
1414 
1415 	if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) {
1416 		size += sizeof (dl_capability_sub_t) +
1417 		    sizeof (dl_capab_zerocopy_t);
1418 	}
1419 
1420 	if (ill->ill_capabilities & ILL_CAPAB_DLD) {
1421 		size += sizeof (dl_capability_sub_t) +
1422 		    sizeof (dl_capab_dld_t);
1423 	}
1424 
1425 	mp = allocb_wait(size + sizeof (dl_capability_req_t), BPRI_MED,
1426 	    STR_NOSIG, &err);
1427 
1428 	mp->b_datap->db_type = M_PROTO;
1429 	bzero(mp->b_rptr, size + sizeof (dl_capability_req_t));
1430 
1431 	capb = (dl_capability_req_t *)mp->b_rptr;
1432 	capb->dl_primitive = DL_CAPABILITY_REQ;
1433 	capb->dl_sub_offset = sizeof (dl_capability_req_t);
1434 	capb->dl_sub_length = size;
1435 
1436 	mp->b_wptr += sizeof (dl_capability_req_t);
1437 
1438 	/*
1439 	 * Each handler fills in the corresponding dl_capability_sub_t
1440 	 * inside the mblk,
1441 	 */
1442 	ill_capability_hcksum_reset_fill(ill, mp);
1443 	ill_capability_zerocopy_reset_fill(ill, mp);
1444 	ill_capability_dld_reset_fill(ill, mp);
1445 
1446 	ill->ill_capab_reset_mp = mp;
1447 }
1448 
1449 static void
1450 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1451 {
1452 	dl_capab_id_t *id_ic;
1453 	uint_t sub_dl_cap = outers->dl_cap;
1454 	dl_capability_sub_t *inners;
1455 	uint8_t *capend;
1456 
1457 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1458 
1459 	/*
1460 	 * Note: range checks here are not absolutely sufficient to
1461 	 * make us robust against malformed messages sent by drivers;
1462 	 * this is in keeping with the rest of IP's dlpi handling.
1463 	 * (Remember, it's coming from something else in the kernel
1464 	 * address space)
1465 	 */
1466 
1467 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1468 	if (capend > mp->b_wptr) {
1469 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1470 		    "malformed sub-capability too long for mblk");
1471 		return;
1472 	}
1473 
1474 	id_ic = (dl_capab_id_t *)(outers + 1);
1475 
1476 	if (outers->dl_length < sizeof (*id_ic) ||
1477 	    (inners = &id_ic->id_subcap,
1478 	    inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1479 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1480 		    "encapsulated capab type %d too long for mblk",
1481 		    inners->dl_cap);
1482 		return;
1483 	}
1484 
1485 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1486 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1487 		    "isn't as expected; pass-thru module(s) detected, "
1488 		    "discarding capability\n", inners->dl_cap));
1489 		return;
1490 	}
1491 
1492 	/* Process the encapsulated sub-capability */
1493 	ill_capability_dispatch(ill, mp, inners);
1494 }
1495 
1496 static void
1497 ill_capability_dld_reset_fill(ill_t *ill, mblk_t *mp)
1498 {
1499 	dl_capability_sub_t *dl_subcap;
1500 
1501 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
1502 		return;
1503 
1504 	/*
1505 	 * The dl_capab_dld_t that follows the dl_capability_sub_t is not
1506 	 * initialized below since it is not used by DLD.
1507 	 */
1508 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1509 	dl_subcap->dl_cap = DL_CAPAB_DLD;
1510 	dl_subcap->dl_length = sizeof (dl_capab_dld_t);
1511 
1512 	mp->b_wptr += sizeof (dl_capability_sub_t) + sizeof (dl_capab_dld_t);
1513 }
1514 
1515 static void
1516 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp)
1517 {
1518 	/*
1519 	 * If no ipif was brought up over this ill, this DL_CAPABILITY_REQ/ACK
1520 	 * is only to get the VRRP capability.
1521 	 *
1522 	 * Note that we cannot check ill_ipif_up_count here since
1523 	 * ill_ipif_up_count is only incremented when the resolver is setup.
1524 	 * That is done asynchronously, and can race with this function.
1525 	 */
1526 	if (!ill->ill_dl_up) {
1527 		if (subp->dl_cap == DL_CAPAB_VRRP)
1528 			ill_capability_vrrp_ack(ill, mp, subp);
1529 		return;
1530 	}
1531 
1532 	switch (subp->dl_cap) {
1533 	case DL_CAPAB_HCKSUM:
1534 		ill_capability_hcksum_ack(ill, mp, subp);
1535 		break;
1536 	case DL_CAPAB_ZEROCOPY:
1537 		ill_capability_zerocopy_ack(ill, mp, subp);
1538 		break;
1539 	case DL_CAPAB_DLD:
1540 		ill_capability_dld_ack(ill, mp, subp);
1541 		break;
1542 	case DL_CAPAB_VRRP:
1543 		break;
1544 	default:
1545 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
1546 		    subp->dl_cap));
1547 	}
1548 }
1549 
1550 /*
1551  * Process the vrrp capability received from a DLS Provider. isub must point
1552  * to the sub-capability (DL_CAPAB_VRRP) of a DL_CAPABILITY_ACK message.
1553  */
1554 static void
1555 ill_capability_vrrp_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1556 {
1557 	dl_capab_vrrp_t	*vrrp;
1558 	uint_t		sub_dl_cap = isub->dl_cap;
1559 	uint8_t		*capend;
1560 
1561 	ASSERT(IAM_WRITER_ILL(ill));
1562 	ASSERT(sub_dl_cap == DL_CAPAB_VRRP);
1563 
1564 	/*
1565 	 * Note: range checks here are not absolutely sufficient to
1566 	 * make us robust against malformed messages sent by drivers;
1567 	 * this is in keeping with the rest of IP's dlpi handling.
1568 	 * (Remember, it's coming from something else in the kernel
1569 	 * address space)
1570 	 */
1571 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1572 	if (capend > mp->b_wptr) {
1573 		cmn_err(CE_WARN, "ill_capability_vrrp_ack: "
1574 		    "malformed sub-capability too long for mblk");
1575 		return;
1576 	}
1577 	vrrp = (dl_capab_vrrp_t *)(isub + 1);
1578 
1579 	/*
1580 	 * Compare the IP address family and set ILLF_VRRP for the right ill.
1581 	 */
1582 	if ((vrrp->vrrp_af == AF_INET6 && ill->ill_isv6) ||
1583 	    (vrrp->vrrp_af == AF_INET && !ill->ill_isv6)) {
1584 		ill->ill_flags |= ILLF_VRRP;
1585 	}
1586 }
1587 
1588 /*
1589  * Process a hardware checksum offload capability negotiation ack received
1590  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
1591  * of a DL_CAPABILITY_ACK message.
1592  */
1593 static void
1594 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1595 {
1596 	dl_capability_req_t	*ocap;
1597 	dl_capab_hcksum_t	*ihck, *ohck;
1598 	ill_hcksum_capab_t	**ill_hcksum;
1599 	mblk_t			*nmp = NULL;
1600 	uint_t			sub_dl_cap = isub->dl_cap;
1601 	uint8_t			*capend;
1602 
1603 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
1604 
1605 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
1606 
1607 	/*
1608 	 * Note: range checks here are not absolutely sufficient to
1609 	 * make us robust against malformed messages sent by drivers;
1610 	 * this is in keeping with the rest of IP's dlpi handling.
1611 	 * (Remember, it's coming from something else in the kernel
1612 	 * address space)
1613 	 */
1614 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1615 	if (capend > mp->b_wptr) {
1616 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1617 		    "malformed sub-capability too long for mblk");
1618 		return;
1619 	}
1620 
1621 	/*
1622 	 * There are two types of acks we process here:
1623 	 * 1. acks in reply to a (first form) generic capability req
1624 	 *    (no ENABLE flag set)
1625 	 * 2. acks in reply to a ENABLE capability req.
1626 	 *    (ENABLE flag set)
1627 	 */
1628 	ihck = (dl_capab_hcksum_t *)(isub + 1);
1629 
1630 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
1631 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
1632 		    "unsupported hardware checksum "
1633 		    "sub-capability (version %d, expected %d)",
1634 		    ihck->hcksum_version, HCKSUM_VERSION_1);
1635 		return;
1636 	}
1637 
1638 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
1639 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
1640 		    "checksum capability isn't as expected; pass-thru "
1641 		    "module(s) detected, discarding capability\n"));
1642 		return;
1643 	}
1644 
1645 #define	CURR_HCKSUM_CAPAB				\
1646 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
1647 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
1648 
1649 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
1650 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
1651 		/* do ENABLE processing */
1652 		if (*ill_hcksum == NULL) {
1653 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
1654 			    KM_NOSLEEP);
1655 
1656 			if (*ill_hcksum == NULL) {
1657 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1658 				    "could not enable hcksum version %d "
1659 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
1660 				    ill->ill_name);
1661 				return;
1662 			}
1663 		}
1664 
1665 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
1666 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
1667 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
1668 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
1669 		    "has enabled hardware checksumming\n ",
1670 		    ill->ill_name));
1671 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
1672 		/*
1673 		 * Enabling hardware checksum offload
1674 		 * Currently IP supports {TCP,UDP}/IPv4
1675 		 * partial and full cksum offload and
1676 		 * IPv4 header checksum offload.
1677 		 * Allocate new mblk which will
1678 		 * contain a new capability request
1679 		 * to enable hardware checksum offload.
1680 		 */
1681 		uint_t	size;
1682 		uchar_t	*rptr;
1683 
1684 		size = sizeof (dl_capability_req_t) +
1685 		    sizeof (dl_capability_sub_t) + isub->dl_length;
1686 
1687 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1688 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1689 			    "could not enable hardware cksum for %s (ENOMEM)\n",
1690 			    ill->ill_name);
1691 			return;
1692 		}
1693 
1694 		rptr = nmp->b_rptr;
1695 		/* initialize dl_capability_req_t */
1696 		ocap = (dl_capability_req_t *)nmp->b_rptr;
1697 		ocap->dl_sub_offset =
1698 		    sizeof (dl_capability_req_t);
1699 		ocap->dl_sub_length =
1700 		    sizeof (dl_capability_sub_t) +
1701 		    isub->dl_length;
1702 		nmp->b_rptr += sizeof (dl_capability_req_t);
1703 
1704 		/* initialize dl_capability_sub_t */
1705 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
1706 		nmp->b_rptr += sizeof (*isub);
1707 
1708 		/* initialize dl_capab_hcksum_t */
1709 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
1710 		bcopy(ihck, ohck, sizeof (*ihck));
1711 
1712 		nmp->b_rptr = rptr;
1713 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
1714 
1715 		/* Set ENABLE flag */
1716 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
1717 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
1718 
1719 		/*
1720 		 * nmp points to a DL_CAPABILITY_REQ message to enable
1721 		 * hardware checksum acceleration.
1722 		 */
1723 		ill_capability_send(ill, nmp);
1724 	} else {
1725 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
1726 		    "advertised %x hardware checksum capability flags\n",
1727 		    ill->ill_name, ihck->hcksum_txflags));
1728 	}
1729 }
1730 
1731 static void
1732 ill_capability_hcksum_reset_fill(ill_t *ill, mblk_t *mp)
1733 {
1734 	dl_capab_hcksum_t *hck_subcap;
1735 	dl_capability_sub_t *dl_subcap;
1736 
1737 	if (!ILL_HCKSUM_CAPABLE(ill))
1738 		return;
1739 
1740 	ASSERT(ill->ill_hcksum_capab != NULL);
1741 
1742 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1743 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
1744 	dl_subcap->dl_length = sizeof (*hck_subcap);
1745 
1746 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
1747 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
1748 	hck_subcap->hcksum_txflags = 0;
1749 
1750 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*hck_subcap);
1751 }
1752 
1753 static void
1754 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1755 {
1756 	mblk_t *nmp = NULL;
1757 	dl_capability_req_t *oc;
1758 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
1759 	ill_zerocopy_capab_t **ill_zerocopy_capab;
1760 	uint_t sub_dl_cap = isub->dl_cap;
1761 	uint8_t *capend;
1762 
1763 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
1764 
1765 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
1766 
1767 	/*
1768 	 * Note: range checks here are not absolutely sufficient to
1769 	 * make us robust against malformed messages sent by drivers;
1770 	 * this is in keeping with the rest of IP's dlpi handling.
1771 	 * (Remember, it's coming from something else in the kernel
1772 	 * address space)
1773 	 */
1774 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1775 	if (capend > mp->b_wptr) {
1776 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1777 		    "malformed sub-capability too long for mblk");
1778 		return;
1779 	}
1780 
1781 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
1782 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
1783 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
1784 		    "unsupported ZEROCOPY sub-capability (version %d, "
1785 		    "expected %d)", zc_ic->zerocopy_version,
1786 		    ZEROCOPY_VERSION_1);
1787 		return;
1788 	}
1789 
1790 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
1791 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
1792 		    "capability isn't as expected; pass-thru module(s) "
1793 		    "detected, discarding capability\n"));
1794 		return;
1795 	}
1796 
1797 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
1798 		if (*ill_zerocopy_capab == NULL) {
1799 			*ill_zerocopy_capab =
1800 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
1801 			    KM_NOSLEEP);
1802 
1803 			if (*ill_zerocopy_capab == NULL) {
1804 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1805 				    "could not enable Zero-copy version %d "
1806 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
1807 				    ill->ill_name);
1808 				return;
1809 			}
1810 		}
1811 
1812 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
1813 		    "supports Zero-copy version %d\n", ill->ill_name,
1814 		    ZEROCOPY_VERSION_1));
1815 
1816 		(*ill_zerocopy_capab)->ill_zerocopy_version =
1817 		    zc_ic->zerocopy_version;
1818 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
1819 		    zc_ic->zerocopy_flags;
1820 
1821 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
1822 	} else {
1823 		uint_t size;
1824 		uchar_t *rptr;
1825 
1826 		size = sizeof (dl_capability_req_t) +
1827 		    sizeof (dl_capability_sub_t) +
1828 		    sizeof (dl_capab_zerocopy_t);
1829 
1830 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1831 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1832 			    "could not enable zerocopy for %s (ENOMEM)\n",
1833 			    ill->ill_name);
1834 			return;
1835 		}
1836 
1837 		rptr = nmp->b_rptr;
1838 		/* initialize dl_capability_req_t */
1839 		oc = (dl_capability_req_t *)rptr;
1840 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
1841 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
1842 		    sizeof (dl_capab_zerocopy_t);
1843 		rptr += sizeof (dl_capability_req_t);
1844 
1845 		/* initialize dl_capability_sub_t */
1846 		bcopy(isub, rptr, sizeof (*isub));
1847 		rptr += sizeof (*isub);
1848 
1849 		/* initialize dl_capab_zerocopy_t */
1850 		zc_oc = (dl_capab_zerocopy_t *)rptr;
1851 		*zc_oc = *zc_ic;
1852 
1853 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
1854 		    "to enable zero-copy version %d\n", ill->ill_name,
1855 		    ZEROCOPY_VERSION_1));
1856 
1857 		/* set VMSAFE_MEM flag */
1858 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
1859 
1860 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
1861 		ill_capability_send(ill, nmp);
1862 	}
1863 }
1864 
1865 static void
1866 ill_capability_zerocopy_reset_fill(ill_t *ill, mblk_t *mp)
1867 {
1868 	dl_capab_zerocopy_t *zerocopy_subcap;
1869 	dl_capability_sub_t *dl_subcap;
1870 
1871 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
1872 		return;
1873 
1874 	ASSERT(ill->ill_zerocopy_capab != NULL);
1875 
1876 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1877 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
1878 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
1879 
1880 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
1881 	zerocopy_subcap->zerocopy_version =
1882 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
1883 	zerocopy_subcap->zerocopy_flags = 0;
1884 
1885 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
1886 }
1887 
1888 /*
1889  * DLD capability
1890  * Refer to dld.h for more information regarding the purpose and usage
1891  * of this capability.
1892  */
1893 static void
1894 ill_capability_dld_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1895 {
1896 	dl_capab_dld_t		*dld_ic, dld;
1897 	uint_t			sub_dl_cap = isub->dl_cap;
1898 	uint8_t			*capend;
1899 	ill_dld_capab_t		*idc;
1900 
1901 	ASSERT(IAM_WRITER_ILL(ill));
1902 	ASSERT(sub_dl_cap == DL_CAPAB_DLD);
1903 
1904 	/*
1905 	 * Note: range checks here are not absolutely sufficient to
1906 	 * make us robust against malformed messages sent by drivers;
1907 	 * this is in keeping with the rest of IP's dlpi handling.
1908 	 * (Remember, it's coming from something else in the kernel
1909 	 * address space)
1910 	 */
1911 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1912 	if (capend > mp->b_wptr) {
1913 		cmn_err(CE_WARN, "ill_capability_dld_ack: "
1914 		    "malformed sub-capability too long for mblk");
1915 		return;
1916 	}
1917 	dld_ic = (dl_capab_dld_t *)(isub + 1);
1918 	if (dld_ic->dld_version != DLD_CURRENT_VERSION) {
1919 		cmn_err(CE_CONT, "ill_capability_dld_ack: "
1920 		    "unsupported DLD sub-capability (version %d, "
1921 		    "expected %d)", dld_ic->dld_version,
1922 		    DLD_CURRENT_VERSION);
1923 		return;
1924 	}
1925 	if (!dlcapabcheckqid(&dld_ic->dld_mid, ill->ill_lmod_rq)) {
1926 		ip1dbg(("ill_capability_dld_ack: mid token for dld "
1927 		    "capability isn't as expected; pass-thru module(s) "
1928 		    "detected, discarding capability\n"));
1929 		return;
1930 	}
1931 
1932 	/*
1933 	 * Copy locally to ensure alignment.
1934 	 */
1935 	bcopy(dld_ic, &dld, sizeof (dl_capab_dld_t));
1936 
1937 	if ((idc = ill->ill_dld_capab) == NULL) {
1938 		idc = kmem_zalloc(sizeof (ill_dld_capab_t), KM_NOSLEEP);
1939 		if (idc == NULL) {
1940 			cmn_err(CE_WARN, "ill_capability_dld_ack: "
1941 			    "could not enable DLD version %d "
1942 			    "for %s (ENOMEM)\n", DLD_CURRENT_VERSION,
1943 			    ill->ill_name);
1944 			return;
1945 		}
1946 		ill->ill_dld_capab = idc;
1947 	}
1948 	idc->idc_capab_df = (ip_capab_func_t)dld.dld_capab;
1949 	idc->idc_capab_dh = (void *)dld.dld_capab_handle;
1950 	ip1dbg(("ill_capability_dld_ack: interface %s "
1951 	    "supports DLD version %d\n", ill->ill_name, DLD_CURRENT_VERSION));
1952 
1953 	ill_capability_dld_enable(ill);
1954 }
1955 
1956 /*
1957  * Typically capability negotiation between IP and the driver happens via
1958  * DLPI message exchange. However GLD also offers a direct function call
1959  * mechanism to exchange the DLD_DIRECT_CAPAB and DLD_POLL_CAPAB capabilities,
1960  * But arbitrary function calls into IP or GLD are not permitted, since both
1961  * of them are protected by their own perimeter mechanism. The perimeter can
1962  * be viewed as a coarse lock or serialization mechanism. The hierarchy of
1963  * these perimeters is IP -> MAC. Thus for example to enable the squeue
1964  * polling, IP needs to enter its perimeter, then call ill_mac_perim_enter
1965  * to enter the mac perimeter and then do the direct function calls into
1966  * GLD to enable squeue polling. The ring related callbacks from the mac into
1967  * the stack to add, bind, quiesce, restart or cleanup a ring are all
1968  * protected by the mac perimeter.
1969  */
1970 static void
1971 ill_mac_perim_enter(ill_t *ill, mac_perim_handle_t *mphp)
1972 {
1973 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1974 	int			err;
1975 
1976 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mphp,
1977 	    DLD_ENABLE);
1978 	ASSERT(err == 0);
1979 }
1980 
1981 static void
1982 ill_mac_perim_exit(ill_t *ill, mac_perim_handle_t mph)
1983 {
1984 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1985 	int			err;
1986 
1987 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mph,
1988 	    DLD_DISABLE);
1989 	ASSERT(err == 0);
1990 }
1991 
1992 boolean_t
1993 ill_mac_perim_held(ill_t *ill)
1994 {
1995 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1996 
1997 	return (idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, NULL,
1998 	    DLD_QUERY));
1999 }
2000 
2001 static void
2002 ill_capability_direct_enable(ill_t *ill)
2003 {
2004 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2005 	ill_dld_direct_t	*idd = &idc->idc_direct;
2006 	dld_capab_direct_t	direct;
2007 	int			rc;
2008 
2009 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2010 
2011 	bzero(&direct, sizeof (direct));
2012 	direct.di_rx_cf = (uintptr_t)ip_input;
2013 	direct.di_rx_ch = ill;
2014 
2015 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT, &direct,
2016 	    DLD_ENABLE);
2017 	if (rc == 0) {
2018 		idd->idd_tx_df = (ip_dld_tx_t)direct.di_tx_df;
2019 		idd->idd_tx_dh = direct.di_tx_dh;
2020 		idd->idd_tx_cb_df = (ip_dld_callb_t)direct.di_tx_cb_df;
2021 		idd->idd_tx_cb_dh = direct.di_tx_cb_dh;
2022 		idd->idd_tx_fctl_df = (ip_dld_fctl_t)direct.di_tx_fctl_df;
2023 		idd->idd_tx_fctl_dh = direct.di_tx_fctl_dh;
2024 		ASSERT(idd->idd_tx_cb_df != NULL);
2025 		ASSERT(idd->idd_tx_fctl_df != NULL);
2026 		ASSERT(idd->idd_tx_df != NULL);
2027 		/*
2028 		 * One time registration of flow enable callback function
2029 		 */
2030 		ill->ill_flownotify_mh = idd->idd_tx_cb_df(idd->idd_tx_cb_dh,
2031 		    ill_flow_enable, ill);
2032 		ill->ill_capabilities |= ILL_CAPAB_DLD_DIRECT;
2033 		DTRACE_PROBE1(direct_on, (ill_t *), ill);
2034 	} else {
2035 		cmn_err(CE_WARN, "warning: could not enable DIRECT "
2036 		    "capability, rc = %d\n", rc);
2037 		DTRACE_PROBE2(direct_off, (ill_t *), ill, (int), rc);
2038 	}
2039 }
2040 
2041 static void
2042 ill_capability_poll_enable(ill_t *ill)
2043 {
2044 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2045 	dld_capab_poll_t	poll;
2046 	int			rc;
2047 
2048 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2049 
2050 	bzero(&poll, sizeof (poll));
2051 	poll.poll_ring_add_cf = (uintptr_t)ip_squeue_add_ring;
2052 	poll.poll_ring_remove_cf = (uintptr_t)ip_squeue_clean_ring;
2053 	poll.poll_ring_quiesce_cf = (uintptr_t)ip_squeue_quiesce_ring;
2054 	poll.poll_ring_restart_cf = (uintptr_t)ip_squeue_restart_ring;
2055 	poll.poll_ring_bind_cf = (uintptr_t)ip_squeue_bind_ring;
2056 	poll.poll_ring_ch = ill;
2057 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL, &poll,
2058 	    DLD_ENABLE);
2059 	if (rc == 0) {
2060 		ill->ill_capabilities |= ILL_CAPAB_DLD_POLL;
2061 		DTRACE_PROBE1(poll_on, (ill_t *), ill);
2062 	} else {
2063 		ip1dbg(("warning: could not enable POLL "
2064 		    "capability, rc = %d\n", rc));
2065 		DTRACE_PROBE2(poll_off, (ill_t *), ill, (int), rc);
2066 	}
2067 }
2068 
2069 /*
2070  * Enable the LSO capability.
2071  */
2072 static void
2073 ill_capability_lso_enable(ill_t *ill)
2074 {
2075 	ill_dld_capab_t	*idc = ill->ill_dld_capab;
2076 	dld_capab_lso_t	lso;
2077 	int rc;
2078 
2079 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2080 
2081 	if (ill->ill_lso_capab == NULL) {
2082 		ill->ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
2083 		    KM_NOSLEEP);
2084 		if (ill->ill_lso_capab == NULL) {
2085 			cmn_err(CE_WARN, "ill_capability_lso_enable: "
2086 			    "could not enable LSO for %s (ENOMEM)\n",
2087 			    ill->ill_name);
2088 			return;
2089 		}
2090 	}
2091 
2092 	bzero(&lso, sizeof (lso));
2093 	if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO, &lso,
2094 	    DLD_ENABLE)) == 0) {
2095 		ill->ill_lso_capab->ill_lso_flags = lso.lso_flags;
2096 		ill->ill_lso_capab->ill_lso_max = lso.lso_max;
2097 		ill->ill_capabilities |= ILL_CAPAB_LSO;
2098 		ip1dbg(("ill_capability_lso_enable: interface %s "
2099 		    "has enabled LSO\n ", ill->ill_name));
2100 	} else {
2101 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
2102 		ill->ill_lso_capab = NULL;
2103 		DTRACE_PROBE2(lso_off, (ill_t *), ill, (int), rc);
2104 	}
2105 }
2106 
2107 static void
2108 ill_capability_dld_enable(ill_t *ill)
2109 {
2110 	mac_perim_handle_t mph;
2111 
2112 	ASSERT(IAM_WRITER_ILL(ill));
2113 
2114 	if (ill->ill_isv6)
2115 		return;
2116 
2117 	ill_mac_perim_enter(ill, &mph);
2118 	if (!ill->ill_isv6) {
2119 		ill_capability_direct_enable(ill);
2120 		ill_capability_poll_enable(ill);
2121 		ill_capability_lso_enable(ill);
2122 	}
2123 	ill->ill_capabilities |= ILL_CAPAB_DLD;
2124 	ill_mac_perim_exit(ill, mph);
2125 }
2126 
2127 static void
2128 ill_capability_dld_disable(ill_t *ill)
2129 {
2130 	ill_dld_capab_t	*idc;
2131 	ill_dld_direct_t *idd;
2132 	mac_perim_handle_t	mph;
2133 
2134 	ASSERT(IAM_WRITER_ILL(ill));
2135 
2136 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
2137 		return;
2138 
2139 	ill_mac_perim_enter(ill, &mph);
2140 
2141 	idc = ill->ill_dld_capab;
2142 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT) != 0) {
2143 		/*
2144 		 * For performance we avoid locks in the transmit data path
2145 		 * and don't maintain a count of the number of threads using
2146 		 * direct calls. Thus some threads could be using direct
2147 		 * transmit calls to GLD, even after the capability mechanism
2148 		 * turns it off. This is still safe since the handles used in
2149 		 * the direct calls continue to be valid until the unplumb is
2150 		 * completed. Remove the callback that was added (1-time) at
2151 		 * capab enable time.
2152 		 */
2153 		mutex_enter(&ill->ill_lock);
2154 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_DIRECT;
2155 		mutex_exit(&ill->ill_lock);
2156 		if (ill->ill_flownotify_mh != NULL) {
2157 			idd = &idc->idc_direct;
2158 			idd->idd_tx_cb_df(idd->idd_tx_cb_dh, NULL,
2159 			    ill->ill_flownotify_mh);
2160 			ill->ill_flownotify_mh = NULL;
2161 		}
2162 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT,
2163 		    NULL, DLD_DISABLE);
2164 	}
2165 
2166 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_POLL) != 0) {
2167 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_POLL;
2168 		ip_squeue_clean_all(ill);
2169 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL,
2170 		    NULL, DLD_DISABLE);
2171 	}
2172 
2173 	if ((ill->ill_capabilities & ILL_CAPAB_LSO) != 0) {
2174 		ASSERT(ill->ill_lso_capab != NULL);
2175 		/*
2176 		 * Clear the capability flag for LSO but retain the
2177 		 * ill_lso_capab structure since it's possible that another
2178 		 * thread is still referring to it.  The structure only gets
2179 		 * deallocated when we destroy the ill.
2180 		 */
2181 
2182 		ill->ill_capabilities &= ~ILL_CAPAB_LSO;
2183 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO,
2184 		    NULL, DLD_DISABLE);
2185 	}
2186 
2187 	ill->ill_capabilities &= ~ILL_CAPAB_DLD;
2188 	ill_mac_perim_exit(ill, mph);
2189 }
2190 
2191 /*
2192  * Capability Negotiation protocol
2193  *
2194  * We don't wait for DLPI capability operations to finish during interface
2195  * bringup or teardown. Doing so would introduce more asynchrony and the
2196  * interface up/down operations will need multiple return and restarts.
2197  * Instead the 'ipsq_current_ipif' of the ipsq is not cleared as long as
2198  * the 'ill_dlpi_deferred' chain is non-empty. This ensures that the next
2199  * exclusive operation won't start until the DLPI operations of the previous
2200  * exclusive operation complete.
2201  *
2202  * The capability state machine is shown below.
2203  *
2204  * state		next state		event, action
2205  *
2206  * IDCS_UNKNOWN 	IDCS_PROBE_SENT		ill_capability_probe
2207  * IDCS_PROBE_SENT	IDCS_OK			ill_capability_ack
2208  * IDCS_PROBE_SENT	IDCS_FAILED		ip_rput_dlpi_writer (nack)
2209  * IDCS_OK		IDCS_RENEG		Receipt of DL_NOTE_CAPAB_RENEG
2210  * IDCS_OK		IDCS_RESET_SENT		ill_capability_reset
2211  * IDCS_RESET_SENT	IDCS_UNKNOWN		ill_capability_ack_thr
2212  * IDCS_RENEG		IDCS_PROBE_SENT		ill_capability_ack_thr ->
2213  *						    ill_capability_probe.
2214  */
2215 
2216 /*
2217  * Dedicated thread started from ip_stack_init that handles capability
2218  * disable. This thread ensures the taskq dispatch does not fail by waiting
2219  * for resources using TQ_SLEEP. The taskq mechanism is used to ensure
2220  * that direct calls to DLD are done in a cv_waitable context.
2221  */
2222 void
2223 ill_taskq_dispatch(ip_stack_t *ipst)
2224 {
2225 	callb_cpr_t cprinfo;
2226 	char 	name[64];
2227 	mblk_t	*mp;
2228 
2229 	(void) snprintf(name, sizeof (name), "ill_taskq_dispatch_%d",
2230 	    ipst->ips_netstack->netstack_stackid);
2231 	CALLB_CPR_INIT(&cprinfo, &ipst->ips_capab_taskq_lock, callb_generic_cpr,
2232 	    name);
2233 	mutex_enter(&ipst->ips_capab_taskq_lock);
2234 
2235 	for (;;) {
2236 		mp = ipst->ips_capab_taskq_head;
2237 		while (mp != NULL) {
2238 			ipst->ips_capab_taskq_head = mp->b_next;
2239 			if (ipst->ips_capab_taskq_head == NULL)
2240 				ipst->ips_capab_taskq_tail = NULL;
2241 			mutex_exit(&ipst->ips_capab_taskq_lock);
2242 			mp->b_next = NULL;
2243 
2244 			VERIFY(taskq_dispatch(system_taskq,
2245 			    ill_capability_ack_thr, mp, TQ_SLEEP) != 0);
2246 			mutex_enter(&ipst->ips_capab_taskq_lock);
2247 			mp = ipst->ips_capab_taskq_head;
2248 		}
2249 
2250 		if (ipst->ips_capab_taskq_quit)
2251 			break;
2252 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
2253 		cv_wait(&ipst->ips_capab_taskq_cv, &ipst->ips_capab_taskq_lock);
2254 		CALLB_CPR_SAFE_END(&cprinfo, &ipst->ips_capab_taskq_lock);
2255 	}
2256 	VERIFY(ipst->ips_capab_taskq_head == NULL);
2257 	VERIFY(ipst->ips_capab_taskq_tail == NULL);
2258 	CALLB_CPR_EXIT(&cprinfo);
2259 	thread_exit();
2260 }
2261 
2262 /*
2263  * Consume a new-style hardware capabilities negotiation ack.
2264  * Called via taskq on receipt of DL_CAPABILITY_ACK.
2265  */
2266 static void
2267 ill_capability_ack_thr(void *arg)
2268 {
2269 	mblk_t	*mp = arg;
2270 	dl_capability_ack_t *capp;
2271 	dl_capability_sub_t *subp, *endp;
2272 	ill_t	*ill;
2273 	boolean_t reneg;
2274 
2275 	ill = (ill_t *)mp->b_prev;
2276 	mp->b_prev = NULL;
2277 
2278 	VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
2279 
2280 	if (ill->ill_dlpi_capab_state == IDCS_RESET_SENT ||
2281 	    ill->ill_dlpi_capab_state == IDCS_RENEG) {
2282 		/*
2283 		 * We have received the ack for our DL_CAPAB reset request.
2284 		 * There isnt' anything in the message that needs processing.
2285 		 * All message based capabilities have been disabled, now
2286 		 * do the function call based capability disable.
2287 		 */
2288 		reneg = ill->ill_dlpi_capab_state == IDCS_RENEG;
2289 		ill_capability_dld_disable(ill);
2290 		ill->ill_dlpi_capab_state = IDCS_UNKNOWN;
2291 		if (reneg)
2292 			ill_capability_probe(ill);
2293 		goto done;
2294 	}
2295 
2296 	if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
2297 		ill->ill_dlpi_capab_state = IDCS_OK;
2298 
2299 	capp = (dl_capability_ack_t *)mp->b_rptr;
2300 
2301 	if (capp->dl_sub_length == 0) {
2302 		/* no new-style capabilities */
2303 		goto done;
2304 	}
2305 
2306 	/* make sure the driver supplied correct dl_sub_length */
2307 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
2308 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
2309 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
2310 		goto done;
2311 	}
2312 
2313 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
2314 	/*
2315 	 * There are sub-capabilities. Process the ones we know about.
2316 	 * Loop until we don't have room for another sub-cap header..
2317 	 */
2318 	for (subp = SC(capp, capp->dl_sub_offset),
2319 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
2320 	    subp <= endp;
2321 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
2322 
2323 		switch (subp->dl_cap) {
2324 		case DL_CAPAB_ID_WRAPPER:
2325 			ill_capability_id_ack(ill, mp, subp);
2326 			break;
2327 		default:
2328 			ill_capability_dispatch(ill, mp, subp);
2329 			break;
2330 		}
2331 	}
2332 #undef SC
2333 done:
2334 	inet_freemsg(mp);
2335 	ill_capability_done(ill);
2336 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
2337 }
2338 
2339 /*
2340  * This needs to be started in a taskq thread to provide a cv_waitable
2341  * context.
2342  */
2343 void
2344 ill_capability_ack(ill_t *ill, mblk_t *mp)
2345 {
2346 	ip_stack_t	*ipst = ill->ill_ipst;
2347 
2348 	mp->b_prev = (mblk_t *)ill;
2349 	ASSERT(mp->b_next == NULL);
2350 
2351 	if (taskq_dispatch(system_taskq, ill_capability_ack_thr, mp,
2352 	    TQ_NOSLEEP) != 0)
2353 		return;
2354 
2355 	/*
2356 	 * The taskq dispatch failed. Signal the ill_taskq_dispatch thread
2357 	 * which will do the dispatch using TQ_SLEEP to guarantee success.
2358 	 */
2359 	mutex_enter(&ipst->ips_capab_taskq_lock);
2360 	if (ipst->ips_capab_taskq_head == NULL) {
2361 		ASSERT(ipst->ips_capab_taskq_tail == NULL);
2362 		ipst->ips_capab_taskq_head = mp;
2363 	} else {
2364 		ipst->ips_capab_taskq_tail->b_next = mp;
2365 	}
2366 	ipst->ips_capab_taskq_tail = mp;
2367 
2368 	cv_signal(&ipst->ips_capab_taskq_cv);
2369 	mutex_exit(&ipst->ips_capab_taskq_lock);
2370 }
2371 
2372 /*
2373  * This routine is called to scan the fragmentation reassembly table for
2374  * the specified ILL for any packets that are starting to smell.
2375  * dead_interval is the maximum time in seconds that will be tolerated.  It
2376  * will either be the value specified in ip_g_frag_timeout, or zero if the
2377  * ILL is shutting down and it is time to blow everything off.
2378  *
2379  * It returns the number of seconds (as a time_t) that the next frag timer
2380  * should be scheduled for, 0 meaning that the timer doesn't need to be
2381  * re-started.  Note that the method of calculating next_timeout isn't
2382  * entirely accurate since time will flow between the time we grab
2383  * current_time and the time we schedule the next timeout.  This isn't a
2384  * big problem since this is the timer for sending an ICMP reassembly time
2385  * exceeded messages, and it doesn't have to be exactly accurate.
2386  *
2387  * This function is
2388  * sometimes called as writer, although this is not required.
2389  */
2390 time_t
2391 ill_frag_timeout(ill_t *ill, time_t dead_interval)
2392 {
2393 	ipfb_t	*ipfb;
2394 	ipfb_t	*endp;
2395 	ipf_t	*ipf;
2396 	ipf_t	*ipfnext;
2397 	mblk_t	*mp;
2398 	time_t	current_time = gethrestime_sec();
2399 	time_t	next_timeout = 0;
2400 	uint32_t	hdr_length;
2401 	mblk_t	*send_icmp_head;
2402 	mblk_t	*send_icmp_head_v6;
2403 	ip_stack_t *ipst = ill->ill_ipst;
2404 	ip_recv_attr_t iras;
2405 
2406 	bzero(&iras, sizeof (iras));
2407 	iras.ira_flags = 0;
2408 	iras.ira_ill = iras.ira_rill = ill;
2409 	iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
2410 	iras.ira_rifindex = iras.ira_ruifindex;
2411 
2412 	ipfb = ill->ill_frag_hash_tbl;
2413 	if (ipfb == NULL)
2414 		return (B_FALSE);
2415 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
2416 	/* Walk the frag hash table. */
2417 	for (; ipfb < endp; ipfb++) {
2418 		send_icmp_head = NULL;
2419 		send_icmp_head_v6 = NULL;
2420 		mutex_enter(&ipfb->ipfb_lock);
2421 		while ((ipf = ipfb->ipfb_ipf) != 0) {
2422 			time_t frag_time = current_time - ipf->ipf_timestamp;
2423 			time_t frag_timeout;
2424 
2425 			if (frag_time < dead_interval) {
2426 				/*
2427 				 * There are some outstanding fragments
2428 				 * that will timeout later.  Make note of
2429 				 * the time so that we can reschedule the
2430 				 * next timeout appropriately.
2431 				 */
2432 				frag_timeout = dead_interval - frag_time;
2433 				if (next_timeout == 0 ||
2434 				    frag_timeout < next_timeout) {
2435 					next_timeout = frag_timeout;
2436 				}
2437 				break;
2438 			}
2439 			/* Time's up.  Get it out of here. */
2440 			hdr_length = ipf->ipf_nf_hdr_len;
2441 			ipfnext = ipf->ipf_hash_next;
2442 			if (ipfnext)
2443 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
2444 			*ipf->ipf_ptphn = ipfnext;
2445 			mp = ipf->ipf_mp->b_cont;
2446 			for (; mp; mp = mp->b_cont) {
2447 				/* Extra points for neatness. */
2448 				IP_REASS_SET_START(mp, 0);
2449 				IP_REASS_SET_END(mp, 0);
2450 			}
2451 			mp = ipf->ipf_mp->b_cont;
2452 			atomic_add_32(&ill->ill_frag_count, -ipf->ipf_count);
2453 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
2454 			ipfb->ipfb_count -= ipf->ipf_count;
2455 			ASSERT(ipfb->ipfb_frag_pkts > 0);
2456 			ipfb->ipfb_frag_pkts--;
2457 			/*
2458 			 * We do not send any icmp message from here because
2459 			 * we currently are holding the ipfb_lock for this
2460 			 * hash chain. If we try and send any icmp messages
2461 			 * from here we may end up via a put back into ip
2462 			 * trying to get the same lock, causing a recursive
2463 			 * mutex panic. Instead we build a list and send all
2464 			 * the icmp messages after we have dropped the lock.
2465 			 */
2466 			if (ill->ill_isv6) {
2467 				if (hdr_length != 0) {
2468 					mp->b_next = send_icmp_head_v6;
2469 					send_icmp_head_v6 = mp;
2470 				} else {
2471 					freemsg(mp);
2472 				}
2473 			} else {
2474 				if (hdr_length != 0) {
2475 					mp->b_next = send_icmp_head;
2476 					send_icmp_head = mp;
2477 				} else {
2478 					freemsg(mp);
2479 				}
2480 			}
2481 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2482 			ip_drop_input("ipIfStatsReasmFails", ipf->ipf_mp, ill);
2483 			freeb(ipf->ipf_mp);
2484 		}
2485 		mutex_exit(&ipfb->ipfb_lock);
2486 		/*
2487 		 * Now need to send any icmp messages that we delayed from
2488 		 * above.
2489 		 */
2490 		while (send_icmp_head_v6 != NULL) {
2491 			ip6_t *ip6h;
2492 
2493 			mp = send_icmp_head_v6;
2494 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
2495 			mp->b_next = NULL;
2496 			ip6h = (ip6_t *)mp->b_rptr;
2497 			iras.ira_flags = 0;
2498 			/*
2499 			 * This will result in an incorrect ALL_ZONES zoneid
2500 			 * for multicast packets, but we
2501 			 * don't send ICMP errors for those in any case.
2502 			 */
2503 			iras.ira_zoneid =
2504 			    ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
2505 			    ill, ipst);
2506 			ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2507 			icmp_time_exceeded_v6(mp,
2508 			    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
2509 			    &iras);
2510 			ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2511 		}
2512 		while (send_icmp_head != NULL) {
2513 			ipaddr_t dst;
2514 
2515 			mp = send_icmp_head;
2516 			send_icmp_head = send_icmp_head->b_next;
2517 			mp->b_next = NULL;
2518 
2519 			dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
2520 
2521 			iras.ira_flags = IRAF_IS_IPV4;
2522 			/*
2523 			 * This will result in an incorrect ALL_ZONES zoneid
2524 			 * for broadcast and multicast packets, but we
2525 			 * don't send ICMP errors for those in any case.
2526 			 */
2527 			iras.ira_zoneid = ipif_lookup_addr_zoneid(dst,
2528 			    ill, ipst);
2529 			ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2530 			icmp_time_exceeded(mp,
2531 			    ICMP_REASSEMBLY_TIME_EXCEEDED, &iras);
2532 			ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2533 		}
2534 	}
2535 	/*
2536 	 * A non-dying ILL will use the return value to decide whether to
2537 	 * restart the frag timer, and for how long.
2538 	 */
2539 	return (next_timeout);
2540 }
2541 
2542 /*
2543  * This routine is called when the approximate count of mblk memory used
2544  * for the specified ILL has exceeded max_count.
2545  */
2546 void
2547 ill_frag_prune(ill_t *ill, uint_t max_count)
2548 {
2549 	ipfb_t	*ipfb;
2550 	ipf_t	*ipf;
2551 	size_t	count;
2552 	clock_t now;
2553 
2554 	/*
2555 	 * If we are here within ip_min_frag_prune_time msecs remove
2556 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
2557 	 * ill_frag_free_num_pkts.
2558 	 */
2559 	mutex_enter(&ill->ill_lock);
2560 	now = ddi_get_lbolt();
2561 	if (TICK_TO_MSEC(now - ill->ill_last_frag_clean_time) <=
2562 	    (ip_min_frag_prune_time != 0 ?
2563 	    ip_min_frag_prune_time : msec_per_tick)) {
2564 
2565 		ill->ill_frag_free_num_pkts++;
2566 
2567 	} else {
2568 		ill->ill_frag_free_num_pkts = 0;
2569 	}
2570 	ill->ill_last_frag_clean_time = now;
2571 	mutex_exit(&ill->ill_lock);
2572 
2573 	/*
2574 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
2575 	 */
2576 	if (ill->ill_frag_free_num_pkts != 0) {
2577 		int ix;
2578 
2579 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2580 			ipfb = &ill->ill_frag_hash_tbl[ix];
2581 			mutex_enter(&ipfb->ipfb_lock);
2582 			if (ipfb->ipfb_ipf != NULL) {
2583 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
2584 				    ill->ill_frag_free_num_pkts);
2585 			}
2586 			mutex_exit(&ipfb->ipfb_lock);
2587 		}
2588 	}
2589 	/*
2590 	 * While the reassembly list for this ILL is too big, prune a fragment
2591 	 * queue by age, oldest first.
2592 	 */
2593 	while (ill->ill_frag_count > max_count) {
2594 		int	ix;
2595 		ipfb_t	*oipfb = NULL;
2596 		uint_t	oldest = UINT_MAX;
2597 
2598 		count = 0;
2599 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2600 			ipfb = &ill->ill_frag_hash_tbl[ix];
2601 			mutex_enter(&ipfb->ipfb_lock);
2602 			ipf = ipfb->ipfb_ipf;
2603 			if (ipf != NULL && ipf->ipf_gen < oldest) {
2604 				oldest = ipf->ipf_gen;
2605 				oipfb = ipfb;
2606 			}
2607 			count += ipfb->ipfb_count;
2608 			mutex_exit(&ipfb->ipfb_lock);
2609 		}
2610 		if (oipfb == NULL)
2611 			break;
2612 
2613 		if (count <= max_count)
2614 			return;	/* Somebody beat us to it, nothing to do */
2615 		mutex_enter(&oipfb->ipfb_lock);
2616 		ipf = oipfb->ipfb_ipf;
2617 		if (ipf != NULL) {
2618 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
2619 		}
2620 		mutex_exit(&oipfb->ipfb_lock);
2621 	}
2622 }
2623 
2624 /*
2625  * free 'free_cnt' fragmented packets starting at ipf.
2626  */
2627 void
2628 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
2629 {
2630 	size_t	count;
2631 	mblk_t	*mp;
2632 	mblk_t	*tmp;
2633 	ipf_t **ipfp = ipf->ipf_ptphn;
2634 
2635 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
2636 	ASSERT(ipfp != NULL);
2637 	ASSERT(ipf != NULL);
2638 
2639 	while (ipf != NULL && free_cnt-- > 0) {
2640 		count = ipf->ipf_count;
2641 		mp = ipf->ipf_mp;
2642 		ipf = ipf->ipf_hash_next;
2643 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
2644 			IP_REASS_SET_START(tmp, 0);
2645 			IP_REASS_SET_END(tmp, 0);
2646 		}
2647 		atomic_add_32(&ill->ill_frag_count, -count);
2648 		ASSERT(ipfb->ipfb_count >= count);
2649 		ipfb->ipfb_count -= count;
2650 		ASSERT(ipfb->ipfb_frag_pkts > 0);
2651 		ipfb->ipfb_frag_pkts--;
2652 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2653 		ip_drop_input("ipIfStatsReasmFails", mp, ill);
2654 		freemsg(mp);
2655 	}
2656 
2657 	if (ipf)
2658 		ipf->ipf_ptphn = ipfp;
2659 	ipfp[0] = ipf;
2660 }
2661 
2662 /*
2663  * Helper function for ill_forward_set().
2664  */
2665 static void
2666 ill_forward_set_on_ill(ill_t *ill, boolean_t enable)
2667 {
2668 	ip_stack_t	*ipst = ill->ill_ipst;
2669 
2670 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2671 
2672 	ip1dbg(("ill_forward_set: %s %s forwarding on %s",
2673 	    (enable ? "Enabling" : "Disabling"),
2674 	    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
2675 	mutex_enter(&ill->ill_lock);
2676 	if (enable)
2677 		ill->ill_flags |= ILLF_ROUTER;
2678 	else
2679 		ill->ill_flags &= ~ILLF_ROUTER;
2680 	mutex_exit(&ill->ill_lock);
2681 	if (ill->ill_isv6)
2682 		ill_set_nce_router_flags(ill, enable);
2683 	/* Notify routing socket listeners of this change. */
2684 	if (ill->ill_ipif != NULL)
2685 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
2686 }
2687 
2688 /*
2689  * Set an ill's ILLF_ROUTER flag appropriately.  Send up RTS_IFINFO routing
2690  * socket messages for each interface whose flags we change.
2691  */
2692 int
2693 ill_forward_set(ill_t *ill, boolean_t enable)
2694 {
2695 	ipmp_illgrp_t *illg;
2696 	ip_stack_t *ipst = ill->ill_ipst;
2697 
2698 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2699 
2700 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
2701 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)))
2702 		return (0);
2703 
2704 	if (IS_LOOPBACK(ill))
2705 		return (EINVAL);
2706 
2707 	if (enable && ill->ill_allowed_ips_cnt > 0)
2708 		return (EPERM);
2709 
2710 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
2711 		/*
2712 		 * Update all of the interfaces in the group.
2713 		 */
2714 		illg = ill->ill_grp;
2715 		ill = list_head(&illg->ig_if);
2716 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill))
2717 			ill_forward_set_on_ill(ill, enable);
2718 
2719 		/*
2720 		 * Update the IPMP meta-interface.
2721 		 */
2722 		ill_forward_set_on_ill(ipmp_illgrp_ipmp_ill(illg), enable);
2723 		return (0);
2724 	}
2725 
2726 	ill_forward_set_on_ill(ill, enable);
2727 	return (0);
2728 }
2729 
2730 /*
2731  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
2732  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
2733  * set or clear.
2734  */
2735 static void
2736 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
2737 {
2738 	ipif_t *ipif;
2739 	ncec_t *ncec;
2740 	nce_t *nce;
2741 
2742 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
2743 		/*
2744 		 * NOTE: we match across the illgrp because nce's for
2745 		 * addresses on IPMP interfaces have an nce_ill that points to
2746 		 * the bound underlying ill.
2747 		 */
2748 		nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
2749 		if (nce != NULL) {
2750 			ncec = nce->nce_common;
2751 			mutex_enter(&ncec->ncec_lock);
2752 			if (enable)
2753 				ncec->ncec_flags |= NCE_F_ISROUTER;
2754 			else
2755 				ncec->ncec_flags &= ~NCE_F_ISROUTER;
2756 			mutex_exit(&ncec->ncec_lock);
2757 			nce_refrele(nce);
2758 		}
2759 	}
2760 }
2761 
2762 /*
2763  * Intializes the context structure and returns the first ill in the list
2764  * cuurently start_list and end_list can have values:
2765  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
2766  * IP_V4_G_HEAD		Traverse IPV4 list only.
2767  * IP_V6_G_HEAD		Traverse IPV6 list only.
2768  */
2769 
2770 /*
2771  * We don't check for CONDEMNED ills here. Caller must do that if
2772  * necessary under the ill lock.
2773  */
2774 ill_t *
2775 ill_first(int start_list, int end_list, ill_walk_context_t *ctx,
2776     ip_stack_t *ipst)
2777 {
2778 	ill_if_t *ifp;
2779 	ill_t *ill;
2780 	avl_tree_t *avl_tree;
2781 
2782 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
2783 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
2784 
2785 	/*
2786 	 * setup the lists to search
2787 	 */
2788 	if (end_list != MAX_G_HEADS) {
2789 		ctx->ctx_current_list = start_list;
2790 		ctx->ctx_last_list = end_list;
2791 	} else {
2792 		ctx->ctx_last_list = MAX_G_HEADS - 1;
2793 		ctx->ctx_current_list = 0;
2794 	}
2795 
2796 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
2797 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2798 		if (ifp != (ill_if_t *)
2799 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2800 			avl_tree = &ifp->illif_avl_by_ppa;
2801 			ill = avl_first(avl_tree);
2802 			/*
2803 			 * ill is guaranteed to be non NULL or ifp should have
2804 			 * not existed.
2805 			 */
2806 			ASSERT(ill != NULL);
2807 			return (ill);
2808 		}
2809 		ctx->ctx_current_list++;
2810 	}
2811 
2812 	return (NULL);
2813 }
2814 
2815 /*
2816  * returns the next ill in the list. ill_first() must have been called
2817  * before calling ill_next() or bad things will happen.
2818  */
2819 
2820 /*
2821  * We don't check for CONDEMNED ills here. Caller must do that if
2822  * necessary under the ill lock.
2823  */
2824 ill_t *
2825 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
2826 {
2827 	ill_if_t *ifp;
2828 	ill_t *ill;
2829 	ip_stack_t	*ipst = lastill->ill_ipst;
2830 
2831 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
2832 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst));
2833 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
2834 	    AVL_AFTER)) != NULL) {
2835 		return (ill);
2836 	}
2837 
2838 	/* goto next ill_ifp in the list. */
2839 	ifp = lastill->ill_ifptr->illif_next;
2840 
2841 	/* make sure not at end of circular list */
2842 	while (ifp ==
2843 	    (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2844 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
2845 			return (NULL);
2846 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2847 	}
2848 
2849 	return (avl_first(&ifp->illif_avl_by_ppa));
2850 }
2851 
2852 /*
2853  * Check interface name for correct format: [a-zA-Z]+[a-zA-Z0-9._]*[0-9]+
2854  * The final number (PPA) must not have any leading zeros.  Upon success, a
2855  * pointer to the start of the PPA is returned; otherwise NULL is returned.
2856  */
2857 static char *
2858 ill_get_ppa_ptr(char *name)
2859 {
2860 	int namelen = strlen(name);
2861 	int end_ndx = namelen - 1;
2862 	int ppa_ndx, i;
2863 
2864 	/*
2865 	 * Check that the first character is [a-zA-Z], and that the last
2866 	 * character is [0-9].
2867 	 */
2868 	if (namelen == 0 || !isalpha(name[0]) || !isdigit(name[end_ndx]))
2869 		return (NULL);
2870 
2871 	/*
2872 	 * Set `ppa_ndx' to the PPA start, and check for leading zeroes.
2873 	 */
2874 	for (ppa_ndx = end_ndx; ppa_ndx > 0; ppa_ndx--)
2875 		if (!isdigit(name[ppa_ndx - 1]))
2876 			break;
2877 
2878 	if (name[ppa_ndx] == '0' && ppa_ndx < end_ndx)
2879 		return (NULL);
2880 
2881 	/*
2882 	 * Check that the intermediate characters are [a-z0-9.]
2883 	 */
2884 	for (i = 1; i < ppa_ndx; i++) {
2885 		if (!isalpha(name[i]) && !isdigit(name[i]) &&
2886 		    name[i] != '.' && name[i] != '_') {
2887 			return (NULL);
2888 		}
2889 	}
2890 
2891 	return (name + ppa_ndx);
2892 }
2893 
2894 /*
2895  * use avl tree to locate the ill.
2896  */
2897 static ill_t *
2898 ill_find_by_name(char *name, boolean_t isv6, ip_stack_t *ipst)
2899 {
2900 	char *ppa_ptr = NULL;
2901 	int len;
2902 	uint_t ppa;
2903 	ill_t *ill = NULL;
2904 	ill_if_t *ifp;
2905 	int list;
2906 
2907 	/*
2908 	 * get ppa ptr
2909 	 */
2910 	if (isv6)
2911 		list = IP_V6_G_HEAD;
2912 	else
2913 		list = IP_V4_G_HEAD;
2914 
2915 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
2916 		return (NULL);
2917 	}
2918 
2919 	len = ppa_ptr - name + 1;
2920 
2921 	ppa = stoi(&ppa_ptr);
2922 
2923 	ifp = IP_VX_ILL_G_LIST(list, ipst);
2924 
2925 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2926 		/*
2927 		 * match is done on len - 1 as the name is not null
2928 		 * terminated it contains ppa in addition to the interface
2929 		 * name.
2930 		 */
2931 		if ((ifp->illif_name_len == len) &&
2932 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
2933 			break;
2934 		} else {
2935 			ifp = ifp->illif_next;
2936 		}
2937 	}
2938 
2939 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2940 		/*
2941 		 * Even the interface type does not exist.
2942 		 */
2943 		return (NULL);
2944 	}
2945 
2946 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
2947 	if (ill != NULL) {
2948 		mutex_enter(&ill->ill_lock);
2949 		if (ILL_CAN_LOOKUP(ill)) {
2950 			ill_refhold_locked(ill);
2951 			mutex_exit(&ill->ill_lock);
2952 			return (ill);
2953 		}
2954 		mutex_exit(&ill->ill_lock);
2955 	}
2956 	return (NULL);
2957 }
2958 
2959 /*
2960  * comparison function for use with avl.
2961  */
2962 static int
2963 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
2964 {
2965 	uint_t ppa;
2966 	uint_t ill_ppa;
2967 
2968 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
2969 
2970 	ppa = *((uint_t *)ppa_ptr);
2971 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
2972 	/*
2973 	 * We want the ill with the lowest ppa to be on the
2974 	 * top.
2975 	 */
2976 	if (ill_ppa < ppa)
2977 		return (1);
2978 	if (ill_ppa > ppa)
2979 		return (-1);
2980 	return (0);
2981 }
2982 
2983 /*
2984  * remove an interface type from the global list.
2985  */
2986 static void
2987 ill_delete_interface_type(ill_if_t *interface)
2988 {
2989 	ASSERT(interface != NULL);
2990 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
2991 
2992 	avl_destroy(&interface->illif_avl_by_ppa);
2993 	if (interface->illif_ppa_arena != NULL)
2994 		vmem_destroy(interface->illif_ppa_arena);
2995 
2996 	remque(interface);
2997 
2998 	mi_free(interface);
2999 }
3000 
3001 /*
3002  * remove ill from the global list.
3003  */
3004 static void
3005 ill_glist_delete(ill_t *ill)
3006 {
3007 	ip_stack_t	*ipst;
3008 	phyint_t	*phyi;
3009 
3010 	if (ill == NULL)
3011 		return;
3012 	ipst = ill->ill_ipst;
3013 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3014 
3015 	/*
3016 	 * If the ill was never inserted into the AVL tree
3017 	 * we skip the if branch.
3018 	 */
3019 	if (ill->ill_ifptr != NULL) {
3020 		/*
3021 		 * remove from AVL tree and free ppa number
3022 		 */
3023 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
3024 
3025 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
3026 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
3027 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3028 		}
3029 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
3030 			ill_delete_interface_type(ill->ill_ifptr);
3031 		}
3032 
3033 		/*
3034 		 * Indicate ill is no longer in the list.
3035 		 */
3036 		ill->ill_ifptr = NULL;
3037 		ill->ill_name_length = 0;
3038 		ill->ill_name[0] = '\0';
3039 		ill->ill_ppa = UINT_MAX;
3040 	}
3041 
3042 	/* Generate one last event for this ill. */
3043 	ill_nic_event_dispatch(ill, 0, NE_UNPLUMB, ill->ill_name,
3044 	    ill->ill_name_length);
3045 
3046 	ASSERT(ill->ill_phyint != NULL);
3047 	phyi = ill->ill_phyint;
3048 	ill->ill_phyint = NULL;
3049 
3050 	/*
3051 	 * ill_init allocates a phyint always to store the copy
3052 	 * of flags relevant to phyint. At that point in time, we could
3053 	 * not assign the name and hence phyint_illv4/v6 could not be
3054 	 * initialized. Later in ipif_set_values, we assign the name to
3055 	 * the ill, at which point in time we assign phyint_illv4/v6.
3056 	 * Thus we don't rely on phyint_illv6 to be initialized always.
3057 	 */
3058 	if (ill->ill_flags & ILLF_IPV6)
3059 		phyi->phyint_illv6 = NULL;
3060 	else
3061 		phyi->phyint_illv4 = NULL;
3062 
3063 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL) {
3064 		rw_exit(&ipst->ips_ill_g_lock);
3065 		return;
3066 	}
3067 
3068 	/*
3069 	 * There are no ills left on this phyint; pull it out of the phyint
3070 	 * avl trees, and free it.
3071 	 */
3072 	if (phyi->phyint_ifindex > 0) {
3073 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3074 		    phyi);
3075 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
3076 		    phyi);
3077 	}
3078 	rw_exit(&ipst->ips_ill_g_lock);
3079 
3080 	phyint_free(phyi);
3081 }
3082 
3083 /*
3084  * allocate a ppa, if the number of plumbed interfaces of this type are
3085  * less than ill_no_arena do a linear search to find a unused ppa.
3086  * When the number goes beyond ill_no_arena switch to using an arena.
3087  * Note: ppa value of zero cannot be allocated from vmem_arena as it
3088  * is the return value for an error condition, so allocation starts at one
3089  * and is decremented by one.
3090  */
3091 static int
3092 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
3093 {
3094 	ill_t *tmp_ill;
3095 	uint_t start, end;
3096 	int ppa;
3097 
3098 	if (ifp->illif_ppa_arena == NULL &&
3099 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
3100 		/*
3101 		 * Create an arena.
3102 		 */
3103 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
3104 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
3105 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
3106 			/* allocate what has already been assigned */
3107 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
3108 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
3109 		    tmp_ill, AVL_AFTER)) {
3110 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3111 			    1,		/* size */
3112 			    1,		/* align/quantum */
3113 			    0,		/* phase */
3114 			    0,		/* nocross */
3115 			    /* minaddr */
3116 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 1),
3117 			    /* maxaddr */
3118 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 2),
3119 			    VM_NOSLEEP|VM_FIRSTFIT);
3120 			if (ppa == 0) {
3121 				ip1dbg(("ill_alloc_ppa: ppa allocation"
3122 				    " failed while switching"));
3123 				vmem_destroy(ifp->illif_ppa_arena);
3124 				ifp->illif_ppa_arena = NULL;
3125 				break;
3126 			}
3127 		}
3128 	}
3129 
3130 	if (ifp->illif_ppa_arena != NULL) {
3131 		if (ill->ill_ppa == UINT_MAX) {
3132 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
3133 			    1, VM_NOSLEEP|VM_FIRSTFIT);
3134 			if (ppa == 0)
3135 				return (EAGAIN);
3136 			ill->ill_ppa = --ppa;
3137 		} else {
3138 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3139 			    1, 		/* size */
3140 			    1, 		/* align/quantum */
3141 			    0, 		/* phase */
3142 			    0, 		/* nocross */
3143 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
3144 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
3145 			    VM_NOSLEEP|VM_FIRSTFIT);
3146 			/*
3147 			 * Most likely the allocation failed because
3148 			 * the requested ppa was in use.
3149 			 */
3150 			if (ppa == 0)
3151 				return (EEXIST);
3152 		}
3153 		return (0);
3154 	}
3155 
3156 	/*
3157 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
3158 	 * been plumbed to create one. Do a linear search to get a unused ppa.
3159 	 */
3160 	if (ill->ill_ppa == UINT_MAX) {
3161 		end = UINT_MAX - 1;
3162 		start = 0;
3163 	} else {
3164 		end = start = ill->ill_ppa;
3165 	}
3166 
3167 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
3168 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
3169 		if (start++ >= end) {
3170 			if (ill->ill_ppa == UINT_MAX)
3171 				return (EAGAIN);
3172 			else
3173 				return (EEXIST);
3174 		}
3175 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
3176 	}
3177 	ill->ill_ppa = start;
3178 	return (0);
3179 }
3180 
3181 /*
3182  * Insert ill into the list of configured ill's. Once this function completes,
3183  * the ill is globally visible and is available through lookups. More precisely
3184  * this happens after the caller drops the ill_g_lock.
3185  */
3186 static int
3187 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
3188 {
3189 	ill_if_t *ill_interface;
3190 	avl_index_t where = 0;
3191 	int error;
3192 	int name_length;
3193 	int index;
3194 	boolean_t check_length = B_FALSE;
3195 	ip_stack_t	*ipst = ill->ill_ipst;
3196 
3197 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
3198 
3199 	name_length = mi_strlen(name) + 1;
3200 
3201 	if (isv6)
3202 		index = IP_V6_G_HEAD;
3203 	else
3204 		index = IP_V4_G_HEAD;
3205 
3206 	ill_interface = IP_VX_ILL_G_LIST(index, ipst);
3207 	/*
3208 	 * Search for interface type based on name
3209 	 */
3210 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3211 		if ((ill_interface->illif_name_len == name_length) &&
3212 		    (strcmp(ill_interface->illif_name, name) == 0)) {
3213 			break;
3214 		}
3215 		ill_interface = ill_interface->illif_next;
3216 	}
3217 
3218 	/*
3219 	 * Interface type not found, create one.
3220 	 */
3221 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3222 		ill_g_head_t ghead;
3223 
3224 		/*
3225 		 * allocate ill_if_t structure
3226 		 */
3227 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
3228 		if (ill_interface == NULL) {
3229 			return (ENOMEM);
3230 		}
3231 
3232 		(void) strcpy(ill_interface->illif_name, name);
3233 		ill_interface->illif_name_len = name_length;
3234 
3235 		avl_create(&ill_interface->illif_avl_by_ppa,
3236 		    ill_compare_ppa, sizeof (ill_t),
3237 		    offsetof(struct ill_s, ill_avl_byppa));
3238 
3239 		/*
3240 		 * link the structure in the back to maintain order
3241 		 * of configuration for ifconfig output.
3242 		 */
3243 		ghead = ipst->ips_ill_g_heads[index];
3244 		insque(ill_interface, ghead.ill_g_list_tail);
3245 	}
3246 
3247 	if (ill->ill_ppa == UINT_MAX)
3248 		check_length = B_TRUE;
3249 
3250 	error = ill_alloc_ppa(ill_interface, ill);
3251 	if (error != 0) {
3252 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3253 			ill_delete_interface_type(ill->ill_ifptr);
3254 		return (error);
3255 	}
3256 
3257 	/*
3258 	 * When the ppa is choosen by the system, check that there is
3259 	 * enough space to insert ppa. if a specific ppa was passed in this
3260 	 * check is not required as the interface name passed in will have
3261 	 * the right ppa in it.
3262 	 */
3263 	if (check_length) {
3264 		/*
3265 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
3266 		 */
3267 		char buf[sizeof (uint_t) * 3];
3268 
3269 		/*
3270 		 * convert ppa to string to calculate the amount of space
3271 		 * required for it in the name.
3272 		 */
3273 		numtos(ill->ill_ppa, buf);
3274 
3275 		/* Do we have enough space to insert ppa ? */
3276 
3277 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
3278 			/* Free ppa and interface type struct */
3279 			if (ill_interface->illif_ppa_arena != NULL) {
3280 				vmem_free(ill_interface->illif_ppa_arena,
3281 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3282 			}
3283 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3284 				ill_delete_interface_type(ill->ill_ifptr);
3285 
3286 			return (EINVAL);
3287 		}
3288 	}
3289 
3290 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
3291 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
3292 
3293 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
3294 	    &where);
3295 	ill->ill_ifptr = ill_interface;
3296 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
3297 
3298 	ill_phyint_reinit(ill);
3299 	return (0);
3300 }
3301 
3302 /* Initialize the per phyint ipsq used for serialization */
3303 static boolean_t
3304 ipsq_init(ill_t *ill, boolean_t enter)
3305 {
3306 	ipsq_t  *ipsq;
3307 	ipxop_t	*ipx;
3308 
3309 	if ((ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP)) == NULL)
3310 		return (B_FALSE);
3311 
3312 	ill->ill_phyint->phyint_ipsq = ipsq;
3313 	ipx = ipsq->ipsq_xop = &ipsq->ipsq_ownxop;
3314 	ipx->ipx_ipsq = ipsq;
3315 	ipsq->ipsq_next = ipsq;
3316 	ipsq->ipsq_phyint = ill->ill_phyint;
3317 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
3318 	mutex_init(&ipx->ipx_lock, NULL, MUTEX_DEFAULT, 0);
3319 	ipsq->ipsq_ipst = ill->ill_ipst;	/* No netstack_hold */
3320 	if (enter) {
3321 		ipx->ipx_writer = curthread;
3322 		ipx->ipx_forced = B_FALSE;
3323 		ipx->ipx_reentry_cnt = 1;
3324 #ifdef DEBUG
3325 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
3326 #endif
3327 	}
3328 	return (B_TRUE);
3329 }
3330 
3331 /*
3332  * ill_init is called by ip_open when a device control stream is opened.
3333  * It does a few initializations, and shoots a DL_INFO_REQ message down
3334  * to the driver.  The response is later picked up in ip_rput_dlpi and
3335  * used to set up default mechanisms for talking to the driver.  (Always
3336  * called as writer.)
3337  *
3338  * If this function returns error, ip_open will call ip_close which in
3339  * turn will call ill_delete to clean up any memory allocated here that
3340  * is not yet freed.
3341  */
3342 int
3343 ill_init(queue_t *q, ill_t *ill)
3344 {
3345 	int	count;
3346 	dl_info_req_t	*dlir;
3347 	mblk_t	*info_mp;
3348 	uchar_t *frag_ptr;
3349 
3350 	/*
3351 	 * The ill is initialized to zero by mi_alloc*(). In addition
3352 	 * some fields already contain valid values, initialized in
3353 	 * ip_open(), before we reach here.
3354 	 */
3355 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
3356 	mutex_init(&ill->ill_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
3357 	ill->ill_saved_ire_cnt = 0;
3358 
3359 	ill->ill_rq = q;
3360 	ill->ill_wq = WR(q);
3361 
3362 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
3363 	    BPRI_HI);
3364 	if (info_mp == NULL)
3365 		return (ENOMEM);
3366 
3367 	/*
3368 	 * Allocate sufficient space to contain our fragment hash table and
3369 	 * the device name.
3370 	 */
3371 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE + 2 * LIFNAMSIZ);
3372 	if (frag_ptr == NULL) {
3373 		freemsg(info_mp);
3374 		return (ENOMEM);
3375 	}
3376 	ill->ill_frag_ptr = frag_ptr;
3377 	ill->ill_frag_free_num_pkts = 0;
3378 	ill->ill_last_frag_clean_time = 0;
3379 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
3380 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
3381 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
3382 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
3383 		    NULL, MUTEX_DEFAULT, NULL);
3384 	}
3385 
3386 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
3387 	if (ill->ill_phyint == NULL) {
3388 		freemsg(info_mp);
3389 		mi_free(frag_ptr);
3390 		return (ENOMEM);
3391 	}
3392 
3393 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
3394 	/*
3395 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
3396 	 * at this point because of the following reason. If we can't
3397 	 * enter the ipsq at some point and cv_wait, the writer that
3398 	 * wakes us up tries to locate us using the list of all phyints
3399 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
3400 	 * If we don't set it now, we risk a missed wakeup.
3401 	 */
3402 	ill->ill_phyint->phyint_illv4 = ill;
3403 	ill->ill_ppa = UINT_MAX;
3404 	list_create(&ill->ill_nce, sizeof (nce_t), offsetof(nce_t, nce_node));
3405 
3406 	ill_set_inputfn(ill);
3407 
3408 	if (!ipsq_init(ill, B_TRUE)) {
3409 		freemsg(info_mp);
3410 		mi_free(frag_ptr);
3411 		mi_free(ill->ill_phyint);
3412 		return (ENOMEM);
3413 	}
3414 
3415 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
3416 
3417 	/* Frag queue limit stuff */
3418 	ill->ill_frag_count = 0;
3419 	ill->ill_ipf_gen = 0;
3420 
3421 	rw_init(&ill->ill_mcast_lock, NULL, RW_DEFAULT, NULL);
3422 	mutex_init(&ill->ill_mcast_serializer, NULL, MUTEX_DEFAULT, NULL);
3423 	ill->ill_global_timer = INFINITY;
3424 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
3425 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
3426 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
3427 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
3428 
3429 	/*
3430 	 * Initialize IPv6 configuration variables.  The IP module is always
3431 	 * opened as an IPv4 module.  Instead tracking down the cases where
3432 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
3433 	 * here for convenience, this has no effect until the ill is set to do
3434 	 * IPv6.
3435 	 */
3436 	ill->ill_reachable_time = ND_REACHABLE_TIME;
3437 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
3438 	ill->ill_max_buf = ND_MAX_Q;
3439 	ill->ill_refcnt = 0;
3440 
3441 	/* Send down the Info Request to the driver. */
3442 	info_mp->b_datap->db_type = M_PCPROTO;
3443 	dlir = (dl_info_req_t *)info_mp->b_rptr;
3444 	info_mp->b_wptr = (uchar_t *)&dlir[1];
3445 	dlir->dl_primitive = DL_INFO_REQ;
3446 
3447 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
3448 
3449 	qprocson(q);
3450 	ill_dlpi_send(ill, info_mp);
3451 
3452 	return (0);
3453 }
3454 
3455 /*
3456  * ill_dls_info
3457  * creates datalink socket info from the device.
3458  */
3459 int
3460 ill_dls_info(struct sockaddr_dl *sdl, const ill_t *ill)
3461 {
3462 	size_t	len;
3463 
3464 	sdl->sdl_family = AF_LINK;
3465 	sdl->sdl_index = ill_get_upper_ifindex(ill);
3466 	sdl->sdl_type = ill->ill_type;
3467 	ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3468 	len = strlen(sdl->sdl_data);
3469 	ASSERT(len < 256);
3470 	sdl->sdl_nlen = (uchar_t)len;
3471 	sdl->sdl_alen = ill->ill_phys_addr_length;
3472 	sdl->sdl_slen = 0;
3473 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL)
3474 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[len], sdl->sdl_alen);
3475 
3476 	return (sizeof (struct sockaddr_dl));
3477 }
3478 
3479 /*
3480  * ill_xarp_info
3481  * creates xarp info from the device.
3482  */
3483 static int
3484 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
3485 {
3486 	sdl->sdl_family = AF_LINK;
3487 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
3488 	sdl->sdl_type = ill->ill_type;
3489 	ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3490 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
3491 	sdl->sdl_alen = ill->ill_phys_addr_length;
3492 	sdl->sdl_slen = 0;
3493 	return (sdl->sdl_nlen);
3494 }
3495 
3496 static int
3497 loopback_kstat_update(kstat_t *ksp, int rw)
3498 {
3499 	kstat_named_t *kn;
3500 	netstackid_t	stackid;
3501 	netstack_t	*ns;
3502 	ip_stack_t	*ipst;
3503 
3504 	if (ksp == NULL || ksp->ks_data == NULL)
3505 		return (EIO);
3506 
3507 	if (rw == KSTAT_WRITE)
3508 		return (EACCES);
3509 
3510 	kn = KSTAT_NAMED_PTR(ksp);
3511 	stackid = (zoneid_t)(uintptr_t)ksp->ks_private;
3512 
3513 	ns = netstack_find_by_stackid(stackid);
3514 	if (ns == NULL)
3515 		return (-1);
3516 
3517 	ipst = ns->netstack_ip;
3518 	if (ipst == NULL) {
3519 		netstack_rele(ns);
3520 		return (-1);
3521 	}
3522 	kn[0].value.ui32 = ipst->ips_loopback_packets;
3523 	kn[1].value.ui32 = ipst->ips_loopback_packets;
3524 	netstack_rele(ns);
3525 	return (0);
3526 }
3527 
3528 /*
3529  * Has ifindex been plumbed already?
3530  */
3531 static boolean_t
3532 phyint_exists(uint_t index, ip_stack_t *ipst)
3533 {
3534 	ASSERT(index != 0);
3535 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
3536 
3537 	return (avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3538 	    &index, NULL) != NULL);
3539 }
3540 
3541 /*
3542  * Pick a unique ifindex.
3543  * When the index counter passes IF_INDEX_MAX for the first time, the wrap
3544  * flag is set so that next time time ip_assign_ifindex() is called, it
3545  * falls through and resets the index counter back to 1, the minimum value
3546  * for the interface index. The logic below assumes that ips_ill_index
3547  * can hold a value of IF_INDEX_MAX+1 without there being any loss
3548  * (i.e. reset back to 0.)
3549  */
3550 boolean_t
3551 ip_assign_ifindex(uint_t *indexp, ip_stack_t *ipst)
3552 {
3553 	uint_t loops;
3554 
3555 	if (!ipst->ips_ill_index_wrap) {
3556 		*indexp = ipst->ips_ill_index++;
3557 		if (ipst->ips_ill_index > IF_INDEX_MAX) {
3558 			/*
3559 			 * Reached the maximum ifindex value, set the wrap
3560 			 * flag to indicate that it is no longer possible
3561 			 * to assume that a given index is unallocated.
3562 			 */
3563 			ipst->ips_ill_index_wrap = B_TRUE;
3564 		}
3565 		return (B_TRUE);
3566 	}
3567 
3568 	if (ipst->ips_ill_index > IF_INDEX_MAX)
3569 		ipst->ips_ill_index = 1;
3570 
3571 	/*
3572 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
3573 	 * at this point and don't want to call any function that attempts
3574 	 * to get the lock again.
3575 	 */
3576 	for (loops = IF_INDEX_MAX; loops > 0; loops--) {
3577 		if (!phyint_exists(ipst->ips_ill_index, ipst)) {
3578 			/* found unused index - use it */
3579 			*indexp = ipst->ips_ill_index;
3580 			return (B_TRUE);
3581 		}
3582 
3583 		ipst->ips_ill_index++;
3584 		if (ipst->ips_ill_index > IF_INDEX_MAX)
3585 			ipst->ips_ill_index = 1;
3586 	}
3587 
3588 	/*
3589 	 * all interface indicies are inuse.
3590 	 */
3591 	return (B_FALSE);
3592 }
3593 
3594 /*
3595  * Assign a unique interface index for the phyint.
3596  */
3597 static boolean_t
3598 phyint_assign_ifindex(phyint_t *phyi, ip_stack_t *ipst)
3599 {
3600 	ASSERT(phyi->phyint_ifindex == 0);
3601 	return (ip_assign_ifindex(&phyi->phyint_ifindex, ipst));
3602 }
3603 
3604 /*
3605  * Initialize the flags on `phyi' as per the provided mactype.
3606  */
3607 static void
3608 phyint_flags_init(phyint_t *phyi, t_uscalar_t mactype)
3609 {
3610 	uint64_t flags = 0;
3611 
3612 	/*
3613 	 * Initialize PHYI_RUNNING and PHYI_FAILED.  For non-IPMP interfaces,
3614 	 * we always presume the underlying hardware is working and set
3615 	 * PHYI_RUNNING (if it's not, the driver will subsequently send a
3616 	 * DL_NOTE_LINK_DOWN message).  For IPMP interfaces, at initialization
3617 	 * there are no active interfaces in the group so we set PHYI_FAILED.
3618 	 */
3619 	if (mactype == SUNW_DL_IPMP)
3620 		flags |= PHYI_FAILED;
3621 	else
3622 		flags |= PHYI_RUNNING;
3623 
3624 	switch (mactype) {
3625 	case SUNW_DL_VNI:
3626 		flags |= PHYI_VIRTUAL;
3627 		break;
3628 	case SUNW_DL_IPMP:
3629 		flags |= PHYI_IPMP;
3630 		break;
3631 	case DL_LOOP:
3632 		flags |= (PHYI_LOOPBACK | PHYI_VIRTUAL);
3633 		break;
3634 	}
3635 
3636 	mutex_enter(&phyi->phyint_lock);
3637 	phyi->phyint_flags |= flags;
3638 	mutex_exit(&phyi->phyint_lock);
3639 }
3640 
3641 /*
3642  * Return a pointer to the ill which matches the supplied name.  Note that
3643  * the ill name length includes the null termination character.  (May be
3644  * called as writer.)
3645  * If do_alloc and the interface is "lo0" it will be automatically created.
3646  * Cannot bump up reference on condemned ills. So dup detect can't be done
3647  * using this func.
3648  */
3649 ill_t *
3650 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
3651     boolean_t *did_alloc, ip_stack_t *ipst)
3652 {
3653 	ill_t	*ill;
3654 	ipif_t	*ipif;
3655 	ipsq_t	*ipsq;
3656 	kstat_named_t	*kn;
3657 	boolean_t isloopback;
3658 	in6_addr_t ov6addr;
3659 
3660 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
3661 
3662 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3663 	ill = ill_find_by_name(name, isv6, ipst);
3664 	rw_exit(&ipst->ips_ill_g_lock);
3665 	if (ill != NULL)
3666 		return (ill);
3667 
3668 	/*
3669 	 * Couldn't find it.  Does this happen to be a lookup for the
3670 	 * loopback device and are we allowed to allocate it?
3671 	 */
3672 	if (!isloopback || !do_alloc)
3673 		return (NULL);
3674 
3675 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3676 	ill = ill_find_by_name(name, isv6, ipst);
3677 	if (ill != NULL) {
3678 		rw_exit(&ipst->ips_ill_g_lock);
3679 		return (ill);
3680 	}
3681 
3682 	/* Create the loopback device on demand */
3683 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
3684 	    sizeof (ipif_loopback_name), BPRI_MED));
3685 	if (ill == NULL)
3686 		goto done;
3687 
3688 	*ill = ill_null;
3689 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, NULL);
3690 	ill->ill_ipst = ipst;
3691 	list_create(&ill->ill_nce, sizeof (nce_t), offsetof(nce_t, nce_node));
3692 	netstack_hold(ipst->ips_netstack);
3693 	/*
3694 	 * For exclusive stacks we set the zoneid to zero
3695 	 * to make IP operate as if in the global zone.
3696 	 */
3697 	ill->ill_zoneid = GLOBAL_ZONEID;
3698 
3699 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
3700 	if (ill->ill_phyint == NULL)
3701 		goto done;
3702 
3703 	if (isv6)
3704 		ill->ill_phyint->phyint_illv6 = ill;
3705 	else
3706 		ill->ill_phyint->phyint_illv4 = ill;
3707 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
3708 	phyint_flags_init(ill->ill_phyint, DL_LOOP);
3709 
3710 	if (isv6) {
3711 		ill->ill_isv6 = B_TRUE;
3712 		ill->ill_max_frag = ip_loopback_mtu_v6plus;
3713 	} else {
3714 		ill->ill_max_frag = ip_loopback_mtuplus;
3715 	}
3716 	if (!ill_allocate_mibs(ill))
3717 		goto done;
3718 	ill->ill_current_frag = ill->ill_max_frag;
3719 	ill->ill_mtu = ill->ill_max_frag;	/* Initial value */
3720 	/*
3721 	 * ipif_loopback_name can't be pointed at directly because its used
3722 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
3723 	 * from the glist, ill_glist_delete() sets the first character of
3724 	 * ill_name to '\0'.
3725 	 */
3726 	ill->ill_name = (char *)ill + sizeof (*ill);
3727 	(void) strcpy(ill->ill_name, ipif_loopback_name);
3728 	ill->ill_name_length = sizeof (ipif_loopback_name);
3729 	/* Set ill_dlpi_pending for ipsq_current_finish() to work properly */
3730 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
3731 
3732 	rw_init(&ill->ill_mcast_lock, NULL, RW_DEFAULT, NULL);
3733 	mutex_init(&ill->ill_mcast_serializer, NULL, MUTEX_DEFAULT, NULL);
3734 	ill->ill_global_timer = INFINITY;
3735 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
3736 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
3737 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
3738 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
3739 
3740 	/* No resolver here. */
3741 	ill->ill_net_type = IRE_LOOPBACK;
3742 
3743 	/* Initialize the ipsq */
3744 	if (!ipsq_init(ill, B_FALSE))
3745 		goto done;
3746 
3747 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE, B_TRUE, NULL);
3748 	if (ipif == NULL)
3749 		goto done;
3750 
3751 	ill->ill_flags = ILLF_MULTICAST;
3752 
3753 	ov6addr = ipif->ipif_v6lcl_addr;
3754 	/* Set up default loopback address and mask. */
3755 	if (!isv6) {
3756 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
3757 
3758 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
3759 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
3760 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3761 		    ipif->ipif_v6subnet);
3762 		ill->ill_flags |= ILLF_IPV4;
3763 	} else {
3764 		ipif->ipif_v6lcl_addr = ipv6_loopback;
3765 		ipif->ipif_v6net_mask = ipv6_all_ones;
3766 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3767 		    ipif->ipif_v6subnet);
3768 		ill->ill_flags |= ILLF_IPV6;
3769 	}
3770 
3771 	/*
3772 	 * Chain us in at the end of the ill list. hold the ill
3773 	 * before we make it globally visible. 1 for the lookup.
3774 	 */
3775 	ill->ill_refcnt = 0;
3776 	ill_refhold(ill);
3777 
3778 	ill->ill_frag_count = 0;
3779 	ill->ill_frag_free_num_pkts = 0;
3780 	ill->ill_last_frag_clean_time = 0;
3781 
3782 	ipsq = ill->ill_phyint->phyint_ipsq;
3783 
3784 	ill_set_inputfn(ill);
3785 
3786 	if (ill_glist_insert(ill, "lo", isv6) != 0)
3787 		cmn_err(CE_PANIC, "cannot insert loopback interface");
3788 
3789 	/* Let SCTP know so that it can add this to its list */
3790 	sctp_update_ill(ill, SCTP_ILL_INSERT);
3791 
3792 	/*
3793 	 * We have already assigned ipif_v6lcl_addr above, but we need to
3794 	 * call sctp_update_ipif_addr() after SCTP_ILL_INSERT, which
3795 	 * requires to be after ill_glist_insert() since we need the
3796 	 * ill_index set. Pass on ipv6_loopback as the old address.
3797 	 */
3798 	sctp_update_ipif_addr(ipif, ov6addr);
3799 
3800 	ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
3801 
3802 	/*
3803 	 * ill_glist_insert() -> ill_phyint_reinit() may have merged IPSQs.
3804 	 * If so, free our original one.
3805 	 */
3806 	if (ipsq != ill->ill_phyint->phyint_ipsq)
3807 		ipsq_delete(ipsq);
3808 
3809 	if (ipst->ips_loopback_ksp == NULL) {
3810 		/* Export loopback interface statistics */
3811 		ipst->ips_loopback_ksp = kstat_create_netstack("lo", 0,
3812 		    ipif_loopback_name, "net",
3813 		    KSTAT_TYPE_NAMED, 2, 0,
3814 		    ipst->ips_netstack->netstack_stackid);
3815 		if (ipst->ips_loopback_ksp != NULL) {
3816 			ipst->ips_loopback_ksp->ks_update =
3817 			    loopback_kstat_update;
3818 			kn = KSTAT_NAMED_PTR(ipst->ips_loopback_ksp);
3819 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
3820 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
3821 			ipst->ips_loopback_ksp->ks_private =
3822 			    (void *)(uintptr_t)ipst->ips_netstack->
3823 			    netstack_stackid;
3824 			kstat_install(ipst->ips_loopback_ksp);
3825 		}
3826 	}
3827 
3828 	*did_alloc = B_TRUE;
3829 	rw_exit(&ipst->ips_ill_g_lock);
3830 	ill_nic_event_dispatch(ill, MAP_IPIF_ID(ill->ill_ipif->ipif_id),
3831 	    NE_PLUMB, ill->ill_name, ill->ill_name_length);
3832 	return (ill);
3833 done:
3834 	if (ill != NULL) {
3835 		if (ill->ill_phyint != NULL) {
3836 			ipsq = ill->ill_phyint->phyint_ipsq;
3837 			if (ipsq != NULL) {
3838 				ipsq->ipsq_phyint = NULL;
3839 				ipsq_delete(ipsq);
3840 			}
3841 			mi_free(ill->ill_phyint);
3842 		}
3843 		ill_free_mib(ill);
3844 		if (ill->ill_ipst != NULL)
3845 			netstack_rele(ill->ill_ipst->ips_netstack);
3846 		mi_free(ill);
3847 	}
3848 	rw_exit(&ipst->ips_ill_g_lock);
3849 	return (NULL);
3850 }
3851 
3852 /*
3853  * For IPP calls - use the ip_stack_t for global stack.
3854  */
3855 ill_t *
3856 ill_lookup_on_ifindex_global_instance(uint_t index, boolean_t isv6)
3857 {
3858 	ip_stack_t	*ipst;
3859 	ill_t		*ill;
3860 
3861 	ipst = netstack_find_by_stackid(GLOBAL_NETSTACKID)->netstack_ip;
3862 	if (ipst == NULL) {
3863 		cmn_err(CE_WARN, "No ip_stack_t for zoneid zero!\n");
3864 		return (NULL);
3865 	}
3866 
3867 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
3868 	netstack_rele(ipst->ips_netstack);
3869 	return (ill);
3870 }
3871 
3872 /*
3873  * Return a pointer to the ill which matches the index and IP version type.
3874  */
3875 ill_t *
3876 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3877 {
3878 	ill_t	*ill;
3879 	phyint_t *phyi;
3880 
3881 	/*
3882 	 * Indexes are stored in the phyint - a common structure
3883 	 * to both IPv4 and IPv6.
3884 	 */
3885 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3886 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3887 	    (void *) &index, NULL);
3888 	if (phyi != NULL) {
3889 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
3890 		if (ill != NULL) {
3891 			mutex_enter(&ill->ill_lock);
3892 			if (!ILL_IS_CONDEMNED(ill)) {
3893 				ill_refhold_locked(ill);
3894 				mutex_exit(&ill->ill_lock);
3895 				rw_exit(&ipst->ips_ill_g_lock);
3896 				return (ill);
3897 			}
3898 			mutex_exit(&ill->ill_lock);
3899 		}
3900 	}
3901 	rw_exit(&ipst->ips_ill_g_lock);
3902 	return (NULL);
3903 }
3904 
3905 /*
3906  * Verify whether or not an interface index is valid for the specified zoneid
3907  * to transmit packets.
3908  * It can be zero (meaning "reset") or an interface index assigned
3909  * to a non-VNI interface. (We don't use VNI interface to send packets.)
3910  */
3911 boolean_t
3912 ip_xmit_ifindex_valid(uint_t ifindex, zoneid_t zoneid, boolean_t isv6,
3913     ip_stack_t *ipst)
3914 {
3915 	ill_t		*ill;
3916 
3917 	if (ifindex == 0)
3918 		return (B_TRUE);
3919 
3920 	ill = ill_lookup_on_ifindex_zoneid(ifindex, zoneid, isv6, ipst);
3921 	if (ill == NULL)
3922 		return (B_FALSE);
3923 	if (IS_VNI(ill)) {
3924 		ill_refrele(ill);
3925 		return (B_FALSE);
3926 	}
3927 	ill_refrele(ill);
3928 	return (B_TRUE);
3929 }
3930 
3931 /*
3932  * Return the ifindex next in sequence after the passed in ifindex.
3933  * If there is no next ifindex for the given protocol, return 0.
3934  */
3935 uint_t
3936 ill_get_next_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3937 {
3938 	phyint_t *phyi;
3939 	phyint_t *phyi_initial;
3940 	uint_t   ifindex;
3941 
3942 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3943 
3944 	if (index == 0) {
3945 		phyi = avl_first(
3946 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index);
3947 	} else {
3948 		phyi = phyi_initial = avl_find(
3949 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3950 		    (void *) &index, NULL);
3951 	}
3952 
3953 	for (; phyi != NULL;
3954 	    phyi = avl_walk(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3955 	    phyi, AVL_AFTER)) {
3956 		/*
3957 		 * If we're not returning the first interface in the tree
3958 		 * and we still haven't moved past the phyint_t that
3959 		 * corresponds to index, avl_walk needs to be called again
3960 		 */
3961 		if (!((index != 0) && (phyi == phyi_initial))) {
3962 			if (isv6) {
3963 				if ((phyi->phyint_illv6) &&
3964 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
3965 				    (phyi->phyint_illv6->ill_isv6 == 1))
3966 					break;
3967 			} else {
3968 				if ((phyi->phyint_illv4) &&
3969 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
3970 				    (phyi->phyint_illv4->ill_isv6 == 0))
3971 					break;
3972 			}
3973 		}
3974 	}
3975 
3976 	rw_exit(&ipst->ips_ill_g_lock);
3977 
3978 	if (phyi != NULL)
3979 		ifindex = phyi->phyint_ifindex;
3980 	else
3981 		ifindex = 0;
3982 
3983 	return (ifindex);
3984 }
3985 
3986 /*
3987  * Return the ifindex for the named interface.
3988  * If there is no next ifindex for the interface, return 0.
3989  */
3990 uint_t
3991 ill_get_ifindex_by_name(char *name, ip_stack_t *ipst)
3992 {
3993 	phyint_t	*phyi;
3994 	avl_index_t	where = 0;
3995 	uint_t		ifindex;
3996 
3997 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3998 
3999 	if ((phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
4000 	    name, &where)) == NULL) {
4001 		rw_exit(&ipst->ips_ill_g_lock);
4002 		return (0);
4003 	}
4004 
4005 	ifindex = phyi->phyint_ifindex;
4006 
4007 	rw_exit(&ipst->ips_ill_g_lock);
4008 
4009 	return (ifindex);
4010 }
4011 
4012 /*
4013  * Return the ifindex to be used by upper layer protocols for instance
4014  * for IPV6_RECVPKTINFO. If IPMP this is the one for the upper ill.
4015  */
4016 uint_t
4017 ill_get_upper_ifindex(const ill_t *ill)
4018 {
4019 	if (IS_UNDER_IPMP(ill))
4020 		return (ipmp_ill_get_ipmp_ifindex(ill));
4021 	else
4022 		return (ill->ill_phyint->phyint_ifindex);
4023 }
4024 
4025 
4026 /*
4027  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
4028  * that gives a running thread a reference to the ill. This reference must be
4029  * released by the thread when it is done accessing the ill and related
4030  * objects. ill_refcnt can not be used to account for static references
4031  * such as other structures pointing to an ill. Callers must generally
4032  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
4033  * or be sure that the ill is not being deleted or changing state before
4034  * calling the refhold functions. A non-zero ill_refcnt ensures that the
4035  * ill won't change any of its critical state such as address, netmask etc.
4036  */
4037 void
4038 ill_refhold(ill_t *ill)
4039 {
4040 	mutex_enter(&ill->ill_lock);
4041 	ill->ill_refcnt++;
4042 	ILL_TRACE_REF(ill);
4043 	mutex_exit(&ill->ill_lock);
4044 }
4045 
4046 void
4047 ill_refhold_locked(ill_t *ill)
4048 {
4049 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4050 	ill->ill_refcnt++;
4051 	ILL_TRACE_REF(ill);
4052 }
4053 
4054 /* Returns true if we managed to get a refhold */
4055 boolean_t
4056 ill_check_and_refhold(ill_t *ill)
4057 {
4058 	mutex_enter(&ill->ill_lock);
4059 	if (!ILL_IS_CONDEMNED(ill)) {
4060 		ill_refhold_locked(ill);
4061 		mutex_exit(&ill->ill_lock);
4062 		return (B_TRUE);
4063 	}
4064 	mutex_exit(&ill->ill_lock);
4065 	return (B_FALSE);
4066 }
4067 
4068 /*
4069  * Must not be called while holding any locks. Otherwise if this is
4070  * the last reference to be released, there is a chance of recursive mutex
4071  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
4072  * to restart an ioctl.
4073  */
4074 void
4075 ill_refrele(ill_t *ill)
4076 {
4077 	mutex_enter(&ill->ill_lock);
4078 	ASSERT(ill->ill_refcnt != 0);
4079 	ill->ill_refcnt--;
4080 	ILL_UNTRACE_REF(ill);
4081 	if (ill->ill_refcnt != 0) {
4082 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
4083 		mutex_exit(&ill->ill_lock);
4084 		return;
4085 	}
4086 
4087 	/* Drops the ill_lock */
4088 	ipif_ill_refrele_tail(ill);
4089 }
4090 
4091 /*
4092  * Obtain a weak reference count on the ill. This reference ensures the
4093  * ill won't be freed, but the ill may change any of its critical state
4094  * such as netmask, address etc. Returns an error if the ill has started
4095  * closing.
4096  */
4097 boolean_t
4098 ill_waiter_inc(ill_t *ill)
4099 {
4100 	mutex_enter(&ill->ill_lock);
4101 	if (ill->ill_state_flags & ILL_CONDEMNED) {
4102 		mutex_exit(&ill->ill_lock);
4103 		return (B_FALSE);
4104 	}
4105 	ill->ill_waiters++;
4106 	mutex_exit(&ill->ill_lock);
4107 	return (B_TRUE);
4108 }
4109 
4110 void
4111 ill_waiter_dcr(ill_t *ill)
4112 {
4113 	mutex_enter(&ill->ill_lock);
4114 	ill->ill_waiters--;
4115 	if (ill->ill_waiters == 0)
4116 		cv_broadcast(&ill->ill_cv);
4117 	mutex_exit(&ill->ill_lock);
4118 }
4119 
4120 /*
4121  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
4122  * driver.  We construct best guess defaults for lower level information that
4123  * we need.  If an interface is brought up without injection of any overriding
4124  * information from outside, we have to be ready to go with these defaults.
4125  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
4126  * we primarely want the dl_provider_style.
4127  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
4128  * at which point we assume the other part of the information is valid.
4129  */
4130 void
4131 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
4132 {
4133 	uchar_t		*brdcst_addr;
4134 	uint_t		brdcst_addr_length, phys_addr_length;
4135 	t_scalar_t	sap_length;
4136 	dl_info_ack_t	*dlia;
4137 	ip_m_t		*ipm;
4138 	dl_qos_cl_sel1_t *sel1;
4139 	int		min_mtu;
4140 
4141 	ASSERT(IAM_WRITER_ILL(ill));
4142 
4143 	/*
4144 	 * Till the ill is fully up  the ill is not globally visible.
4145 	 * So no need for a lock.
4146 	 */
4147 	dlia = (dl_info_ack_t *)mp->b_rptr;
4148 	ill->ill_mactype = dlia->dl_mac_type;
4149 
4150 	ipm = ip_m_lookup(dlia->dl_mac_type);
4151 	if (ipm == NULL) {
4152 		ipm = ip_m_lookup(DL_OTHER);
4153 		ASSERT(ipm != NULL);
4154 	}
4155 	ill->ill_media = ipm;
4156 
4157 	/*
4158 	 * When the new DLPI stuff is ready we'll pull lengths
4159 	 * from dlia.
4160 	 */
4161 	if (dlia->dl_version == DL_VERSION_2) {
4162 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
4163 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
4164 		    brdcst_addr_length);
4165 		if (brdcst_addr == NULL) {
4166 			brdcst_addr_length = 0;
4167 		}
4168 		sap_length = dlia->dl_sap_length;
4169 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
4170 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
4171 		    brdcst_addr_length, sap_length, phys_addr_length));
4172 	} else {
4173 		brdcst_addr_length = 6;
4174 		brdcst_addr = ip_six_byte_all_ones;
4175 		sap_length = -2;
4176 		phys_addr_length = brdcst_addr_length;
4177 	}
4178 
4179 	ill->ill_bcast_addr_length = brdcst_addr_length;
4180 	ill->ill_phys_addr_length = phys_addr_length;
4181 	ill->ill_sap_length = sap_length;
4182 
4183 	/*
4184 	 * Synthetic DLPI types such as SUNW_DL_IPMP specify a zero SDU,
4185 	 * but we must ensure a minimum IP MTU is used since other bits of
4186 	 * IP will fly apart otherwise.
4187 	 */
4188 	min_mtu = ill->ill_isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
4189 	ill->ill_max_frag = MAX(min_mtu, dlia->dl_max_sdu);
4190 	ill->ill_current_frag = ill->ill_max_frag;
4191 	ill->ill_mtu = ill->ill_max_frag;
4192 
4193 	ill->ill_type = ipm->ip_m_type;
4194 
4195 	if (!ill->ill_dlpi_style_set) {
4196 		if (dlia->dl_provider_style == DL_STYLE2)
4197 			ill->ill_needs_attach = 1;
4198 
4199 		phyint_flags_init(ill->ill_phyint, ill->ill_mactype);
4200 
4201 		/*
4202 		 * Allocate the first ipif on this ill.  We don't delay it
4203 		 * further as ioctl handling assumes at least one ipif exists.
4204 		 *
4205 		 * At this point we don't know whether the ill is v4 or v6.
4206 		 * We will know this whan the SIOCSLIFNAME happens and
4207 		 * the correct value for ill_isv6 will be assigned in
4208 		 * ipif_set_values(). We need to hold the ill lock and
4209 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
4210 		 * the wakeup.
4211 		 */
4212 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
4213 		    dlia->dl_provider_style != DL_STYLE2, B_TRUE, NULL);
4214 		mutex_enter(&ill->ill_lock);
4215 		ASSERT(ill->ill_dlpi_style_set == 0);
4216 		ill->ill_dlpi_style_set = 1;
4217 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
4218 		cv_broadcast(&ill->ill_cv);
4219 		mutex_exit(&ill->ill_lock);
4220 		freemsg(mp);
4221 		return;
4222 	}
4223 	ASSERT(ill->ill_ipif != NULL);
4224 	/*
4225 	 * We know whether it is IPv4 or IPv6 now, as this is the
4226 	 * second DL_INFO_ACK we are recieving in response to the
4227 	 * DL_INFO_REQ sent in ipif_set_values.
4228 	 */
4229 	ill->ill_sap = (ill->ill_isv6) ? ipm->ip_m_ipv6sap : ipm->ip_m_ipv4sap;
4230 	/*
4231 	 * Clear all the flags that were set based on ill_bcast_addr_length
4232 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
4233 	 * changed now and we need to re-evaluate.
4234 	 */
4235 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
4236 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
4237 
4238 	/*
4239 	 * Free ill_bcast_mp as things could have changed now.
4240 	 *
4241 	 * NOTE: The IPMP meta-interface is special-cased because it starts
4242 	 * with no underlying interfaces (and thus an unknown broadcast
4243 	 * address length), but we enforce that an interface is broadcast-
4244 	 * capable as part of allowing it to join a group.
4245 	 */
4246 	if (ill->ill_bcast_addr_length == 0 && !IS_IPMP(ill)) {
4247 		if (ill->ill_bcast_mp != NULL)
4248 			freemsg(ill->ill_bcast_mp);
4249 		ill->ill_net_type = IRE_IF_NORESOLVER;
4250 
4251 		ill->ill_bcast_mp = ill_dlur_gen(NULL,
4252 		    ill->ill_phys_addr_length,
4253 		    ill->ill_sap,
4254 		    ill->ill_sap_length);
4255 
4256 		if (ill->ill_isv6)
4257 			/*
4258 			 * Note: xresolv interfaces will eventually need NOARP
4259 			 * set here as well, but that will require those
4260 			 * external resolvers to have some knowledge of
4261 			 * that flag and act appropriately. Not to be changed
4262 			 * at present.
4263 			 */
4264 			ill->ill_flags |= ILLF_NONUD;
4265 		else
4266 			ill->ill_flags |= ILLF_NOARP;
4267 
4268 		if (ill->ill_mactype == SUNW_DL_VNI) {
4269 			ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
4270 		} else if (ill->ill_phys_addr_length == 0 ||
4271 		    ill->ill_mactype == DL_IPV4 ||
4272 		    ill->ill_mactype == DL_IPV6) {
4273 			/*
4274 			 * The underying link is point-to-point, so mark the
4275 			 * interface as such.  We can do IP multicast over
4276 			 * such a link since it transmits all network-layer
4277 			 * packets to the remote side the same way.
4278 			 */
4279 			ill->ill_flags |= ILLF_MULTICAST;
4280 			ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
4281 		}
4282 	} else {
4283 		ill->ill_net_type = IRE_IF_RESOLVER;
4284 		if (ill->ill_bcast_mp != NULL)
4285 			freemsg(ill->ill_bcast_mp);
4286 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
4287 		    ill->ill_bcast_addr_length, ill->ill_sap,
4288 		    ill->ill_sap_length);
4289 		/*
4290 		 * Later detect lack of DLPI driver multicast
4291 		 * capability by catching DL_ENABMULTI errors in
4292 		 * ip_rput_dlpi.
4293 		 */
4294 		ill->ill_flags |= ILLF_MULTICAST;
4295 		if (!ill->ill_isv6)
4296 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
4297 	}
4298 
4299 	/* For IPMP, PHYI_IPMP should already be set by phyint_flags_init() */
4300 	if (ill->ill_mactype == SUNW_DL_IPMP)
4301 		ASSERT(ill->ill_phyint->phyint_flags & PHYI_IPMP);
4302 
4303 	/* By default an interface does not support any CoS marking */
4304 	ill->ill_flags &= ~ILLF_COS_ENABLED;
4305 
4306 	/*
4307 	 * If we get QoS information in DL_INFO_ACK, the device supports
4308 	 * some form of CoS marking, set ILLF_COS_ENABLED.
4309 	 */
4310 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
4311 	    dlia->dl_qos_length);
4312 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
4313 		ill->ill_flags |= ILLF_COS_ENABLED;
4314 	}
4315 
4316 	/* Clear any previous error indication. */
4317 	ill->ill_error = 0;
4318 	freemsg(mp);
4319 }
4320 
4321 /*
4322  * Perform various checks to verify that an address would make sense as a
4323  * local, remote, or subnet interface address.
4324  */
4325 static boolean_t
4326 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
4327 {
4328 	ipaddr_t	net_mask;
4329 
4330 	/*
4331 	 * Don't allow all zeroes, or all ones, but allow
4332 	 * all ones netmask.
4333 	 */
4334 	if ((net_mask = ip_net_mask(addr)) == 0)
4335 		return (B_FALSE);
4336 	/* A given netmask overrides the "guess" netmask */
4337 	if (subnet_mask != 0)
4338 		net_mask = subnet_mask;
4339 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
4340 	    (addr == (addr | ~net_mask)))) {
4341 		return (B_FALSE);
4342 	}
4343 
4344 	/*
4345 	 * Even if the netmask is all ones, we do not allow address to be
4346 	 * 255.255.255.255
4347 	 */
4348 	if (addr == INADDR_BROADCAST)
4349 		return (B_FALSE);
4350 
4351 	if (CLASSD(addr))
4352 		return (B_FALSE);
4353 
4354 	return (B_TRUE);
4355 }
4356 
4357 #define	V6_IPIF_LINKLOCAL(p)	\
4358 	IN6_IS_ADDR_LINKLOCAL(&(p)->ipif_v6lcl_addr)
4359 
4360 /*
4361  * Compare two given ipifs and check if the second one is better than
4362  * the first one using the order of preference (not taking deprecated
4363  * into acount) specified in ipif_lookup_multicast().
4364  */
4365 static boolean_t
4366 ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif, boolean_t isv6)
4367 {
4368 	/* Check the least preferred first. */
4369 	if (IS_LOOPBACK(old_ipif->ipif_ill)) {
4370 		/* If both ipifs are the same, use the first one. */
4371 		if (IS_LOOPBACK(new_ipif->ipif_ill))
4372 			return (B_FALSE);
4373 		else
4374 			return (B_TRUE);
4375 	}
4376 
4377 	/* For IPv6, check for link local address. */
4378 	if (isv6 && V6_IPIF_LINKLOCAL(old_ipif)) {
4379 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4380 		    V6_IPIF_LINKLOCAL(new_ipif)) {
4381 			/* The second one is equal or less preferred. */
4382 			return (B_FALSE);
4383 		} else {
4384 			return (B_TRUE);
4385 		}
4386 	}
4387 
4388 	/* Then check for point to point interface. */
4389 	if (old_ipif->ipif_flags & IPIF_POINTOPOINT) {
4390 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4391 		    (isv6 && V6_IPIF_LINKLOCAL(new_ipif)) ||
4392 		    (new_ipif->ipif_flags & IPIF_POINTOPOINT)) {
4393 			return (B_FALSE);
4394 		} else {
4395 			return (B_TRUE);
4396 		}
4397 	}
4398 
4399 	/* old_ipif is a normal interface, so no need to use the new one. */
4400 	return (B_FALSE);
4401 }
4402 
4403 /*
4404  * Find a mulitcast-capable ipif given an IP instance and zoneid.
4405  * The ipif must be up, and its ill must multicast-capable, not
4406  * condemned, not an underlying interface in an IPMP group, and
4407  * not a VNI interface.  Order of preference:
4408  *
4409  * 	1a. normal
4410  * 	1b. normal, but deprecated
4411  * 	2a. point to point
4412  * 	2b. point to point, but deprecated
4413  * 	3a. link local
4414  * 	3b. link local, but deprecated
4415  * 	4. loopback.
4416  */
4417 static ipif_t *
4418 ipif_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4419 {
4420 	ill_t			*ill;
4421 	ill_walk_context_t	ctx;
4422 	ipif_t			*ipif;
4423 	ipif_t			*saved_ipif = NULL;
4424 	ipif_t			*dep_ipif = NULL;
4425 
4426 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4427 	if (isv6)
4428 		ill = ILL_START_WALK_V6(&ctx, ipst);
4429 	else
4430 		ill = ILL_START_WALK_V4(&ctx, ipst);
4431 
4432 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4433 		mutex_enter(&ill->ill_lock);
4434 		if (IS_VNI(ill) || IS_UNDER_IPMP(ill) ||
4435 		    ILL_IS_CONDEMNED(ill) ||
4436 		    !(ill->ill_flags & ILLF_MULTICAST)) {
4437 			mutex_exit(&ill->ill_lock);
4438 			continue;
4439 		}
4440 		for (ipif = ill->ill_ipif; ipif != NULL;
4441 		    ipif = ipif->ipif_next) {
4442 			if (zoneid != ipif->ipif_zoneid &&
4443 			    zoneid != ALL_ZONES &&
4444 			    ipif->ipif_zoneid != ALL_ZONES) {
4445 				continue;
4446 			}
4447 			if (!(ipif->ipif_flags & IPIF_UP) ||
4448 			    IPIF_IS_CONDEMNED(ipif)) {
4449 				continue;
4450 			}
4451 
4452 			/*
4453 			 * Found one candidate.  If it is deprecated,
4454 			 * remember it in dep_ipif.  If it is not deprecated,
4455 			 * remember it in saved_ipif.
4456 			 */
4457 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
4458 				if (dep_ipif == NULL) {
4459 					dep_ipif = ipif;
4460 				} else if (ipif_comp_multi(dep_ipif, ipif,
4461 				    isv6)) {
4462 					/*
4463 					 * If the previous dep_ipif does not
4464 					 * belong to the same ill, we've done
4465 					 * a ipif_refhold() on it.  So we need
4466 					 * to release it.
4467 					 */
4468 					if (dep_ipif->ipif_ill != ill)
4469 						ipif_refrele(dep_ipif);
4470 					dep_ipif = ipif;
4471 				}
4472 				continue;
4473 			}
4474 			if (saved_ipif == NULL) {
4475 				saved_ipif = ipif;
4476 			} else {
4477 				if (ipif_comp_multi(saved_ipif, ipif, isv6)) {
4478 					if (saved_ipif->ipif_ill != ill)
4479 						ipif_refrele(saved_ipif);
4480 					saved_ipif = ipif;
4481 				}
4482 			}
4483 		}
4484 		/*
4485 		 * Before going to the next ill, do a ipif_refhold() on the
4486 		 * saved ones.
4487 		 */
4488 		if (saved_ipif != NULL && saved_ipif->ipif_ill == ill)
4489 			ipif_refhold_locked(saved_ipif);
4490 		if (dep_ipif != NULL && dep_ipif->ipif_ill == ill)
4491 			ipif_refhold_locked(dep_ipif);
4492 		mutex_exit(&ill->ill_lock);
4493 	}
4494 	rw_exit(&ipst->ips_ill_g_lock);
4495 
4496 	/*
4497 	 * If we have only the saved_ipif, return it.  But if we have both
4498 	 * saved_ipif and dep_ipif, check to see which one is better.
4499 	 */
4500 	if (saved_ipif != NULL) {
4501 		if (dep_ipif != NULL) {
4502 			if (ipif_comp_multi(saved_ipif, dep_ipif, isv6)) {
4503 				ipif_refrele(saved_ipif);
4504 				return (dep_ipif);
4505 			} else {
4506 				ipif_refrele(dep_ipif);
4507 				return (saved_ipif);
4508 			}
4509 		}
4510 		return (saved_ipif);
4511 	} else {
4512 		return (dep_ipif);
4513 	}
4514 }
4515 
4516 ill_t *
4517 ill_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4518 {
4519 	ipif_t *ipif;
4520 	ill_t *ill;
4521 
4522 	ipif = ipif_lookup_multicast(ipst, zoneid, isv6);
4523 	if (ipif == NULL)
4524 		return (NULL);
4525 
4526 	ill = ipif->ipif_ill;
4527 	ill_refhold(ill);
4528 	ipif_refrele(ipif);
4529 	return (ill);
4530 }
4531 
4532 /*
4533  * This function is called when an application does not specify an interface
4534  * to be used for multicast traffic (joining a group/sending data).  It
4535  * calls ire_lookup_multi() to look for an interface route for the
4536  * specified multicast group.  Doing this allows the administrator to add
4537  * prefix routes for multicast to indicate which interface to be used for
4538  * multicast traffic in the above scenario.  The route could be for all
4539  * multicast (224.0/4), for a single multicast group (a /32 route) or
4540  * anything in between.  If there is no such multicast route, we just find
4541  * any multicast capable interface and return it.  The returned ipif
4542  * is refhold'ed.
4543  *
4544  * We support MULTIRT and RTF_SETSRC on the multicast routes added to the
4545  * unicast table. This is used by CGTP.
4546  */
4547 ill_t *
4548 ill_lookup_group_v4(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst,
4549     boolean_t *multirtp, ipaddr_t *setsrcp)
4550 {
4551 	ill_t			*ill;
4552 
4553 	ill = ire_lookup_multi_ill_v4(group, zoneid, ipst, multirtp, setsrcp);
4554 	if (ill != NULL)
4555 		return (ill);
4556 
4557 	return (ill_lookup_multicast(ipst, zoneid, B_FALSE));
4558 }
4559 
4560 /*
4561  * Look for an ipif with the specified interface address and destination.
4562  * The destination address is used only for matching point-to-point interfaces.
4563  */
4564 ipif_t *
4565 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, ip_stack_t *ipst)
4566 {
4567 	ipif_t	*ipif;
4568 	ill_t	*ill;
4569 	ill_walk_context_t ctx;
4570 
4571 	/*
4572 	 * First match all the point-to-point interfaces
4573 	 * before looking at non-point-to-point interfaces.
4574 	 * This is done to avoid returning non-point-to-point
4575 	 * ipif instead of unnumbered point-to-point ipif.
4576 	 */
4577 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4578 	ill = ILL_START_WALK_V4(&ctx, ipst);
4579 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4580 		mutex_enter(&ill->ill_lock);
4581 		for (ipif = ill->ill_ipif; ipif != NULL;
4582 		    ipif = ipif->ipif_next) {
4583 			/* Allow the ipif to be down */
4584 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
4585 			    (ipif->ipif_lcl_addr == if_addr) &&
4586 			    (ipif->ipif_pp_dst_addr == dst)) {
4587 				if (!IPIF_IS_CONDEMNED(ipif)) {
4588 					ipif_refhold_locked(ipif);
4589 					mutex_exit(&ill->ill_lock);
4590 					rw_exit(&ipst->ips_ill_g_lock);
4591 					return (ipif);
4592 				}
4593 			}
4594 		}
4595 		mutex_exit(&ill->ill_lock);
4596 	}
4597 	rw_exit(&ipst->ips_ill_g_lock);
4598 
4599 	/* lookup the ipif based on interface address */
4600 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, ipst);
4601 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
4602 	return (ipif);
4603 }
4604 
4605 /*
4606  * Common function for ipif_lookup_addr() and ipif_lookup_addr_exact().
4607  */
4608 static ipif_t *
4609 ipif_lookup_addr_common(ipaddr_t addr, ill_t *match_ill, uint32_t match_flags,
4610     zoneid_t zoneid, ip_stack_t *ipst)
4611 {
4612 	ipif_t  *ipif;
4613 	ill_t   *ill;
4614 	boolean_t ptp = B_FALSE;
4615 	ill_walk_context_t	ctx;
4616 	boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP);
4617 	boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP);
4618 
4619 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4620 	/*
4621 	 * Repeat twice, first based on local addresses and
4622 	 * next time for pointopoint.
4623 	 */
4624 repeat:
4625 	ill = ILL_START_WALK_V4(&ctx, ipst);
4626 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4627 		if (match_ill != NULL && ill != match_ill &&
4628 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
4629 			continue;
4630 		}
4631 		mutex_enter(&ill->ill_lock);
4632 		for (ipif = ill->ill_ipif; ipif != NULL;
4633 		    ipif = ipif->ipif_next) {
4634 			if (zoneid != ALL_ZONES &&
4635 			    zoneid != ipif->ipif_zoneid &&
4636 			    ipif->ipif_zoneid != ALL_ZONES)
4637 				continue;
4638 
4639 			if (no_duplicate && !(ipif->ipif_flags & IPIF_UP))
4640 				continue;
4641 
4642 			/* Allow the ipif to be down */
4643 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4644 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4645 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4646 			    (ipif->ipif_pp_dst_addr == addr))) {
4647 				if (!IPIF_IS_CONDEMNED(ipif)) {
4648 					ipif_refhold_locked(ipif);
4649 					mutex_exit(&ill->ill_lock);
4650 					rw_exit(&ipst->ips_ill_g_lock);
4651 					return (ipif);
4652 				}
4653 			}
4654 		}
4655 		mutex_exit(&ill->ill_lock);
4656 	}
4657 
4658 	/* If we already did the ptp case, then we are done */
4659 	if (ptp) {
4660 		rw_exit(&ipst->ips_ill_g_lock);
4661 		return (NULL);
4662 	}
4663 	ptp = B_TRUE;
4664 	goto repeat;
4665 }
4666 
4667 /*
4668  * Lookup an ipif with the specified address.  For point-to-point links we
4669  * look for matches on either the destination address or the local address,
4670  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
4671  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
4672  * (or illgrp if `match_ill' is in an IPMP group).
4673  */
4674 ipif_t *
4675 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4676     ip_stack_t *ipst)
4677 {
4678 	return (ipif_lookup_addr_common(addr, match_ill, IPIF_MATCH_ILLGRP,
4679 	    zoneid, ipst));
4680 }
4681 
4682 /*
4683  * Lookup an ipif with the specified address. Similar to ipif_lookup_addr,
4684  * except that we will only return an address if it is not marked as
4685  * IPIF_DUPLICATE
4686  */
4687 ipif_t *
4688 ipif_lookup_addr_nondup(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4689     ip_stack_t *ipst)
4690 {
4691 	return (ipif_lookup_addr_common(addr, match_ill,
4692 	    (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP),
4693 	    zoneid, ipst));
4694 }
4695 
4696 /*
4697  * Special abbreviated version of ipif_lookup_addr() that doesn't match
4698  * `match_ill' across the IPMP group.  This function is only needed in some
4699  * corner-cases; almost everything should use ipif_lookup_addr().
4700  */
4701 ipif_t *
4702 ipif_lookup_addr_exact(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4703 {
4704 	ASSERT(match_ill != NULL);
4705 	return (ipif_lookup_addr_common(addr, match_ill, 0, ALL_ZONES,
4706 	    ipst));
4707 }
4708 
4709 /*
4710  * Look for an ipif with the specified address. For point-point links
4711  * we look for matches on either the destination address and the local
4712  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
4713  * is set.
4714  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
4715  * ill (or illgrp if `match_ill' is in an IPMP group).
4716  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
4717  */
4718 zoneid_t
4719 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4720 {
4721 	zoneid_t zoneid;
4722 	ipif_t  *ipif;
4723 	ill_t   *ill;
4724 	boolean_t ptp = B_FALSE;
4725 	ill_walk_context_t	ctx;
4726 
4727 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4728 	/*
4729 	 * Repeat twice, first based on local addresses and
4730 	 * next time for pointopoint.
4731 	 */
4732 repeat:
4733 	ill = ILL_START_WALK_V4(&ctx, ipst);
4734 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4735 		if (match_ill != NULL && ill != match_ill &&
4736 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
4737 			continue;
4738 		}
4739 		mutex_enter(&ill->ill_lock);
4740 		for (ipif = ill->ill_ipif; ipif != NULL;
4741 		    ipif = ipif->ipif_next) {
4742 			/* Allow the ipif to be down */
4743 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4744 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4745 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4746 			    (ipif->ipif_pp_dst_addr == addr)) &&
4747 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
4748 				zoneid = ipif->ipif_zoneid;
4749 				mutex_exit(&ill->ill_lock);
4750 				rw_exit(&ipst->ips_ill_g_lock);
4751 				/*
4752 				 * If ipif_zoneid was ALL_ZONES then we have
4753 				 * a trusted extensions shared IP address.
4754 				 * In that case GLOBAL_ZONEID works to send.
4755 				 */
4756 				if (zoneid == ALL_ZONES)
4757 					zoneid = GLOBAL_ZONEID;
4758 				return (zoneid);
4759 			}
4760 		}
4761 		mutex_exit(&ill->ill_lock);
4762 	}
4763 
4764 	/* If we already did the ptp case, then we are done */
4765 	if (ptp) {
4766 		rw_exit(&ipst->ips_ill_g_lock);
4767 		return (ALL_ZONES);
4768 	}
4769 	ptp = B_TRUE;
4770 	goto repeat;
4771 }
4772 
4773 /*
4774  * Look for an ipif that matches the specified remote address i.e. the
4775  * ipif that would receive the specified packet.
4776  * First look for directly connected interfaces and then do a recursive
4777  * IRE lookup and pick the first ipif corresponding to the source address in the
4778  * ire.
4779  * Returns: held ipif
4780  *
4781  * This is only used for ICMP_ADDRESS_MASK_REQUESTs
4782  */
4783 ipif_t *
4784 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
4785 {
4786 	ipif_t	*ipif;
4787 
4788 	ASSERT(!ill->ill_isv6);
4789 
4790 	/*
4791 	 * Someone could be changing this ipif currently or change it
4792 	 * after we return this. Thus  a few packets could use the old
4793 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
4794 	 * will atomically be updated or cleaned up with the new value
4795 	 * Thus we don't need a lock to check the flags or other attrs below.
4796 	 */
4797 	mutex_enter(&ill->ill_lock);
4798 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4799 		if (IPIF_IS_CONDEMNED(ipif))
4800 			continue;
4801 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
4802 		    ipif->ipif_zoneid != ALL_ZONES)
4803 			continue;
4804 		/* Allow the ipif to be down */
4805 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
4806 			if ((ipif->ipif_pp_dst_addr == addr) ||
4807 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
4808 			    ipif->ipif_lcl_addr == addr)) {
4809 				ipif_refhold_locked(ipif);
4810 				mutex_exit(&ill->ill_lock);
4811 				return (ipif);
4812 			}
4813 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
4814 			ipif_refhold_locked(ipif);
4815 			mutex_exit(&ill->ill_lock);
4816 			return (ipif);
4817 		}
4818 	}
4819 	mutex_exit(&ill->ill_lock);
4820 	/*
4821 	 * For a remote destination it isn't possible to nail down a particular
4822 	 * ipif.
4823 	 */
4824 
4825 	/* Pick the first interface */
4826 	ipif = ipif_get_next_ipif(NULL, ill);
4827 	return (ipif);
4828 }
4829 
4830 /*
4831  * This func does not prevent refcnt from increasing. But if
4832  * the caller has taken steps to that effect, then this func
4833  * can be used to determine whether the ill has become quiescent
4834  */
4835 static boolean_t
4836 ill_is_quiescent(ill_t *ill)
4837 {
4838 	ipif_t	*ipif;
4839 
4840 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4841 
4842 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4843 		if (ipif->ipif_refcnt != 0)
4844 			return (B_FALSE);
4845 	}
4846 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
4847 		return (B_FALSE);
4848 	}
4849 	return (B_TRUE);
4850 }
4851 
4852 boolean_t
4853 ill_is_freeable(ill_t *ill)
4854 {
4855 	ipif_t	*ipif;
4856 
4857 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4858 
4859 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4860 		if (ipif->ipif_refcnt != 0) {
4861 			return (B_FALSE);
4862 		}
4863 	}
4864 	if (!ILL_FREE_OK(ill) || ill->ill_refcnt != 0) {
4865 		return (B_FALSE);
4866 	}
4867 	return (B_TRUE);
4868 }
4869 
4870 /*
4871  * This func does not prevent refcnt from increasing. But if
4872  * the caller has taken steps to that effect, then this func
4873  * can be used to determine whether the ipif has become quiescent
4874  */
4875 static boolean_t
4876 ipif_is_quiescent(ipif_t *ipif)
4877 {
4878 	ill_t *ill;
4879 
4880 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4881 
4882 	if (ipif->ipif_refcnt != 0)
4883 		return (B_FALSE);
4884 
4885 	ill = ipif->ipif_ill;
4886 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
4887 	    ill->ill_logical_down) {
4888 		return (B_TRUE);
4889 	}
4890 
4891 	/* This is the last ipif going down or being deleted on this ill */
4892 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0) {
4893 		return (B_FALSE);
4894 	}
4895 
4896 	return (B_TRUE);
4897 }
4898 
4899 /*
4900  * return true if the ipif can be destroyed: the ipif has to be quiescent
4901  * with zero references from ire/ilm to it.
4902  */
4903 static boolean_t
4904 ipif_is_freeable(ipif_t *ipif)
4905 {
4906 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4907 	ASSERT(ipif->ipif_id != 0);
4908 	return (ipif->ipif_refcnt == 0);
4909 }
4910 
4911 /*
4912  * The ipif/ill/ire has been refreled. Do the tail processing.
4913  * Determine if the ipif or ill in question has become quiescent and if so
4914  * wakeup close and/or restart any queued pending ioctl that is waiting
4915  * for the ipif_down (or ill_down)
4916  */
4917 void
4918 ipif_ill_refrele_tail(ill_t *ill)
4919 {
4920 	mblk_t	*mp;
4921 	conn_t	*connp;
4922 	ipsq_t	*ipsq;
4923 	ipxop_t	*ipx;
4924 	ipif_t	*ipif;
4925 	dl_notify_ind_t *dlindp;
4926 
4927 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4928 
4929 	if ((ill->ill_state_flags & ILL_CONDEMNED) && ill_is_freeable(ill)) {
4930 		/* ip_modclose() may be waiting */
4931 		cv_broadcast(&ill->ill_cv);
4932 	}
4933 
4934 	ipsq = ill->ill_phyint->phyint_ipsq;
4935 	mutex_enter(&ipsq->ipsq_lock);
4936 	ipx = ipsq->ipsq_xop;
4937 	mutex_enter(&ipx->ipx_lock);
4938 	if (ipx->ipx_waitfor == 0)	/* no one's waiting; bail */
4939 		goto unlock;
4940 
4941 	ASSERT(ipx->ipx_pending_mp != NULL && ipx->ipx_pending_ipif != NULL);
4942 
4943 	ipif = ipx->ipx_pending_ipif;
4944 	if (ipif->ipif_ill != ill) 	/* wait is for another ill; bail */
4945 		goto unlock;
4946 
4947 	switch (ipx->ipx_waitfor) {
4948 	case IPIF_DOWN:
4949 		if (!ipif_is_quiescent(ipif))
4950 			goto unlock;
4951 		break;
4952 	case IPIF_FREE:
4953 		if (!ipif_is_freeable(ipif))
4954 			goto unlock;
4955 		break;
4956 	case ILL_DOWN:
4957 		if (!ill_is_quiescent(ill))
4958 			goto unlock;
4959 		break;
4960 	case ILL_FREE:
4961 		/*
4962 		 * ILL_FREE is only for loopback; normal ill teardown waits
4963 		 * synchronously in ip_modclose() without using ipx_waitfor,
4964 		 * handled by the cv_broadcast() at the top of this function.
4965 		 */
4966 		if (!ill_is_freeable(ill))
4967 			goto unlock;
4968 		break;
4969 	default:
4970 		cmn_err(CE_PANIC, "ipsq: %p unknown ipx_waitfor %d\n",
4971 		    (void *)ipsq, ipx->ipx_waitfor);
4972 	}
4973 
4974 	ill_refhold_locked(ill);	/* for qwriter_ip() call below */
4975 	mutex_exit(&ipx->ipx_lock);
4976 	mp = ipsq_pending_mp_get(ipsq, &connp);
4977 	mutex_exit(&ipsq->ipsq_lock);
4978 	mutex_exit(&ill->ill_lock);
4979 
4980 	ASSERT(mp != NULL);
4981 	/*
4982 	 * NOTE: all of the qwriter_ip() calls below use CUR_OP since
4983 	 * we can only get here when the current operation decides it
4984 	 * it needs to quiesce via ipsq_pending_mp_add().
4985 	 */
4986 	switch (mp->b_datap->db_type) {
4987 	case M_PCPROTO:
4988 	case M_PROTO:
4989 		/*
4990 		 * For now, only DL_NOTIFY_IND messages can use this facility.
4991 		 */
4992 		dlindp = (dl_notify_ind_t *)mp->b_rptr;
4993 		ASSERT(dlindp->dl_primitive == DL_NOTIFY_IND);
4994 
4995 		switch (dlindp->dl_notification) {
4996 		case DL_NOTE_PHYS_ADDR:
4997 			qwriter_ip(ill, ill->ill_rq, mp,
4998 			    ill_set_phys_addr_tail, CUR_OP, B_TRUE);
4999 			return;
5000 		case DL_NOTE_REPLUMB:
5001 			qwriter_ip(ill, ill->ill_rq, mp,
5002 			    ill_replumb_tail, CUR_OP, B_TRUE);
5003 			return;
5004 		default:
5005 			ASSERT(0);
5006 			ill_refrele(ill);
5007 		}
5008 		break;
5009 
5010 	case M_ERROR:
5011 	case M_HANGUP:
5012 		qwriter_ip(ill, ill->ill_rq, mp, ipif_all_down_tail, CUR_OP,
5013 		    B_TRUE);
5014 		return;
5015 
5016 	case M_IOCTL:
5017 	case M_IOCDATA:
5018 		qwriter_ip(ill, (connp != NULL ? CONNP_TO_WQ(connp) :
5019 		    ill->ill_wq), mp, ip_reprocess_ioctl, CUR_OP, B_TRUE);
5020 		return;
5021 
5022 	default:
5023 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
5024 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
5025 	}
5026 	return;
5027 unlock:
5028 	mutex_exit(&ipsq->ipsq_lock);
5029 	mutex_exit(&ipx->ipx_lock);
5030 	mutex_exit(&ill->ill_lock);
5031 }
5032 
5033 #ifdef DEBUG
5034 /* Reuse trace buffer from beginning (if reached the end) and record trace */
5035 static void
5036 th_trace_rrecord(th_trace_t *th_trace)
5037 {
5038 	tr_buf_t *tr_buf;
5039 	uint_t lastref;
5040 
5041 	lastref = th_trace->th_trace_lastref;
5042 	lastref++;
5043 	if (lastref == TR_BUF_MAX)
5044 		lastref = 0;
5045 	th_trace->th_trace_lastref = lastref;
5046 	tr_buf = &th_trace->th_trbuf[lastref];
5047 	tr_buf->tr_time = ddi_get_lbolt();
5048 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, TR_STACK_DEPTH);
5049 }
5050 
5051 static void
5052 th_trace_free(void *value)
5053 {
5054 	th_trace_t *th_trace = value;
5055 
5056 	ASSERT(th_trace->th_refcnt == 0);
5057 	kmem_free(th_trace, sizeof (*th_trace));
5058 }
5059 
5060 /*
5061  * Find or create the per-thread hash table used to track object references.
5062  * The ipst argument is NULL if we shouldn't allocate.
5063  *
5064  * Accesses per-thread data, so there's no need to lock here.
5065  */
5066 static mod_hash_t *
5067 th_trace_gethash(ip_stack_t *ipst)
5068 {
5069 	th_hash_t *thh;
5070 
5071 	if ((thh = tsd_get(ip_thread_data)) == NULL && ipst != NULL) {
5072 		mod_hash_t *mh;
5073 		char name[256];
5074 		size_t objsize, rshift;
5075 		int retv;
5076 
5077 		if ((thh = kmem_alloc(sizeof (*thh), KM_NOSLEEP)) == NULL)
5078 			return (NULL);
5079 		(void) snprintf(name, sizeof (name), "th_trace_%p",
5080 		    (void *)curthread);
5081 
5082 		/*
5083 		 * We use mod_hash_create_extended here rather than the more
5084 		 * obvious mod_hash_create_ptrhash because the latter has a
5085 		 * hard-coded KM_SLEEP, and we'd prefer to fail rather than
5086 		 * block.
5087 		 */
5088 		objsize = MAX(MAX(sizeof (ill_t), sizeof (ipif_t)),
5089 		    MAX(sizeof (ire_t), sizeof (ncec_t)));
5090 		rshift = highbit(objsize);
5091 		mh = mod_hash_create_extended(name, 64, mod_hash_null_keydtor,
5092 		    th_trace_free, mod_hash_byptr, (void *)rshift,
5093 		    mod_hash_ptrkey_cmp, KM_NOSLEEP);
5094 		if (mh == NULL) {
5095 			kmem_free(thh, sizeof (*thh));
5096 			return (NULL);
5097 		}
5098 		thh->thh_hash = mh;
5099 		thh->thh_ipst = ipst;
5100 		/*
5101 		 * We trace ills, ipifs, ires, and nces.  All of these are
5102 		 * per-IP-stack, so the lock on the thread list is as well.
5103 		 */
5104 		rw_enter(&ip_thread_rwlock, RW_WRITER);
5105 		list_insert_tail(&ip_thread_list, thh);
5106 		rw_exit(&ip_thread_rwlock);
5107 		retv = tsd_set(ip_thread_data, thh);
5108 		ASSERT(retv == 0);
5109 	}
5110 	return (thh != NULL ? thh->thh_hash : NULL);
5111 }
5112 
5113 boolean_t
5114 th_trace_ref(const void *obj, ip_stack_t *ipst)
5115 {
5116 	th_trace_t *th_trace;
5117 	mod_hash_t *mh;
5118 	mod_hash_val_t val;
5119 
5120 	if ((mh = th_trace_gethash(ipst)) == NULL)
5121 		return (B_FALSE);
5122 
5123 	/*
5124 	 * Attempt to locate the trace buffer for this obj and thread.
5125 	 * If it does not exist, then allocate a new trace buffer and
5126 	 * insert into the hash.
5127 	 */
5128 	if (mod_hash_find(mh, (mod_hash_key_t)obj, &val) == MH_ERR_NOTFOUND) {
5129 		th_trace = kmem_zalloc(sizeof (th_trace_t), KM_NOSLEEP);
5130 		if (th_trace == NULL)
5131 			return (B_FALSE);
5132 
5133 		th_trace->th_id = curthread;
5134 		if (mod_hash_insert(mh, (mod_hash_key_t)obj,
5135 		    (mod_hash_val_t)th_trace) != 0) {
5136 			kmem_free(th_trace, sizeof (th_trace_t));
5137 			return (B_FALSE);
5138 		}
5139 	} else {
5140 		th_trace = (th_trace_t *)val;
5141 	}
5142 
5143 	ASSERT(th_trace->th_refcnt >= 0 &&
5144 	    th_trace->th_refcnt < TR_BUF_MAX - 1);
5145 
5146 	th_trace->th_refcnt++;
5147 	th_trace_rrecord(th_trace);
5148 	return (B_TRUE);
5149 }
5150 
5151 /*
5152  * For the purpose of tracing a reference release, we assume that global
5153  * tracing is always on and that the same thread initiated the reference hold
5154  * is releasing.
5155  */
5156 void
5157 th_trace_unref(const void *obj)
5158 {
5159 	int retv;
5160 	mod_hash_t *mh;
5161 	th_trace_t *th_trace;
5162 	mod_hash_val_t val;
5163 
5164 	mh = th_trace_gethash(NULL);
5165 	retv = mod_hash_find(mh, (mod_hash_key_t)obj, &val);
5166 	ASSERT(retv == 0);
5167 	th_trace = (th_trace_t *)val;
5168 
5169 	ASSERT(th_trace->th_refcnt > 0);
5170 	th_trace->th_refcnt--;
5171 	th_trace_rrecord(th_trace);
5172 }
5173 
5174 /*
5175  * If tracing has been disabled, then we assume that the reference counts are
5176  * now useless, and we clear them out before destroying the entries.
5177  */
5178 void
5179 th_trace_cleanup(const void *obj, boolean_t trace_disable)
5180 {
5181 	th_hash_t	*thh;
5182 	mod_hash_t	*mh;
5183 	mod_hash_val_t	val;
5184 	th_trace_t	*th_trace;
5185 	int		retv;
5186 
5187 	rw_enter(&ip_thread_rwlock, RW_READER);
5188 	for (thh = list_head(&ip_thread_list); thh != NULL;
5189 	    thh = list_next(&ip_thread_list, thh)) {
5190 		if (mod_hash_find(mh = thh->thh_hash, (mod_hash_key_t)obj,
5191 		    &val) == 0) {
5192 			th_trace = (th_trace_t *)val;
5193 			if (trace_disable)
5194 				th_trace->th_refcnt = 0;
5195 			retv = mod_hash_destroy(mh, (mod_hash_key_t)obj);
5196 			ASSERT(retv == 0);
5197 		}
5198 	}
5199 	rw_exit(&ip_thread_rwlock);
5200 }
5201 
5202 void
5203 ipif_trace_ref(ipif_t *ipif)
5204 {
5205 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5206 
5207 	if (ipif->ipif_trace_disable)
5208 		return;
5209 
5210 	if (!th_trace_ref(ipif, ipif->ipif_ill->ill_ipst)) {
5211 		ipif->ipif_trace_disable = B_TRUE;
5212 		ipif_trace_cleanup(ipif);
5213 	}
5214 }
5215 
5216 void
5217 ipif_untrace_ref(ipif_t *ipif)
5218 {
5219 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5220 
5221 	if (!ipif->ipif_trace_disable)
5222 		th_trace_unref(ipif);
5223 }
5224 
5225 void
5226 ill_trace_ref(ill_t *ill)
5227 {
5228 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5229 
5230 	if (ill->ill_trace_disable)
5231 		return;
5232 
5233 	if (!th_trace_ref(ill, ill->ill_ipst)) {
5234 		ill->ill_trace_disable = B_TRUE;
5235 		ill_trace_cleanup(ill);
5236 	}
5237 }
5238 
5239 void
5240 ill_untrace_ref(ill_t *ill)
5241 {
5242 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5243 
5244 	if (!ill->ill_trace_disable)
5245 		th_trace_unref(ill);
5246 }
5247 
5248 /*
5249  * Called when ipif is unplumbed or when memory alloc fails.  Note that on
5250  * failure, ipif_trace_disable is set.
5251  */
5252 static void
5253 ipif_trace_cleanup(const ipif_t *ipif)
5254 {
5255 	th_trace_cleanup(ipif, ipif->ipif_trace_disable);
5256 }
5257 
5258 /*
5259  * Called when ill is unplumbed or when memory alloc fails.  Note that on
5260  * failure, ill_trace_disable is set.
5261  */
5262 static void
5263 ill_trace_cleanup(const ill_t *ill)
5264 {
5265 	th_trace_cleanup(ill, ill->ill_trace_disable);
5266 }
5267 #endif /* DEBUG */
5268 
5269 void
5270 ipif_refhold_locked(ipif_t *ipif)
5271 {
5272 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5273 	ipif->ipif_refcnt++;
5274 	IPIF_TRACE_REF(ipif);
5275 }
5276 
5277 void
5278 ipif_refhold(ipif_t *ipif)
5279 {
5280 	ill_t	*ill;
5281 
5282 	ill = ipif->ipif_ill;
5283 	mutex_enter(&ill->ill_lock);
5284 	ipif->ipif_refcnt++;
5285 	IPIF_TRACE_REF(ipif);
5286 	mutex_exit(&ill->ill_lock);
5287 }
5288 
5289 /*
5290  * Must not be called while holding any locks. Otherwise if this is
5291  * the last reference to be released there is a chance of recursive mutex
5292  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5293  * to restart an ioctl.
5294  */
5295 void
5296 ipif_refrele(ipif_t *ipif)
5297 {
5298 	ill_t	*ill;
5299 
5300 	ill = ipif->ipif_ill;
5301 
5302 	mutex_enter(&ill->ill_lock);
5303 	ASSERT(ipif->ipif_refcnt != 0);
5304 	ipif->ipif_refcnt--;
5305 	IPIF_UNTRACE_REF(ipif);
5306 	if (ipif->ipif_refcnt != 0) {
5307 		mutex_exit(&ill->ill_lock);
5308 		return;
5309 	}
5310 
5311 	/* Drops the ill_lock */
5312 	ipif_ill_refrele_tail(ill);
5313 }
5314 
5315 ipif_t *
5316 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
5317 {
5318 	ipif_t	*ipif;
5319 
5320 	mutex_enter(&ill->ill_lock);
5321 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
5322 	    ipif != NULL; ipif = ipif->ipif_next) {
5323 		if (IPIF_IS_CONDEMNED(ipif))
5324 			continue;
5325 		ipif_refhold_locked(ipif);
5326 		mutex_exit(&ill->ill_lock);
5327 		return (ipif);
5328 	}
5329 	mutex_exit(&ill->ill_lock);
5330 	return (NULL);
5331 }
5332 
5333 /*
5334  * TODO: make this table extendible at run time
5335  * Return a pointer to the mac type info for 'mac_type'
5336  */
5337 static ip_m_t *
5338 ip_m_lookup(t_uscalar_t mac_type)
5339 {
5340 	ip_m_t	*ipm;
5341 
5342 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
5343 		if (ipm->ip_m_mac_type == mac_type)
5344 			return (ipm);
5345 	return (NULL);
5346 }
5347 
5348 /*
5349  * Make a link layer address from the multicast IP address *addr.
5350  * To form the link layer address, invoke the ip_m_v*mapping function
5351  * associated with the link-layer type.
5352  */
5353 void
5354 ip_mcast_mapping(ill_t *ill, uchar_t *addr, uchar_t *hwaddr)
5355 {
5356 	ip_m_t *ipm;
5357 
5358 	if (ill->ill_net_type == IRE_IF_NORESOLVER)
5359 		return;
5360 
5361 	ASSERT(addr != NULL);
5362 
5363 	ipm = ip_m_lookup(ill->ill_mactype);
5364 	if (ipm == NULL ||
5365 	    (ill->ill_isv6 && ipm->ip_m_v6mapping == NULL) ||
5366 	    (!ill->ill_isv6 && ipm->ip_m_v4mapping == NULL)) {
5367 		ip0dbg(("no mapping for ill %s mactype 0x%x\n",
5368 		    ill->ill_name, ill->ill_mactype));
5369 		return;
5370 	}
5371 	if (ill->ill_isv6)
5372 		(*ipm->ip_m_v6mapping)(ill, addr, hwaddr);
5373 	else
5374 		(*ipm->ip_m_v4mapping)(ill, addr, hwaddr);
5375 }
5376 
5377 /*
5378  * Returns B_FALSE if the IPv4 netmask pointed by `mask' is non-contiguous.
5379  * Otherwise returns B_TRUE.
5380  *
5381  * The netmask can be verified to be contiguous with 32 shifts and or
5382  * operations. Take the contiguous mask (in host byte order) and compute
5383  * 	mask | mask << 1 | mask << 2 | ... | mask << 31
5384  * the result will be the same as the 'mask' for contiguous mask.
5385  */
5386 static boolean_t
5387 ip_contiguous_mask(uint32_t mask)
5388 {
5389 	uint32_t	m = mask;
5390 	int		i;
5391 
5392 	for (i = 1; i < 32; i++)
5393 		m |= (mask << i);
5394 
5395 	return (m == mask);
5396 }
5397 
5398 /*
5399  * ip_rt_add is called to add an IPv4 route to the forwarding table.
5400  * ill is passed in to associate it with the correct interface.
5401  * If ire_arg is set, then we return the held IRE in that location.
5402  */
5403 int
5404 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5405     ipaddr_t src_addr, int flags, ill_t *ill, ire_t **ire_arg,
5406     boolean_t ioctl_msg, struct rtsa_s *sp, ip_stack_t *ipst, zoneid_t zoneid)
5407 {
5408 	ire_t	*ire, *nire;
5409 	ire_t	*gw_ire = NULL;
5410 	ipif_t	*ipif = NULL;
5411 	uint_t	type;
5412 	int	match_flags = MATCH_IRE_TYPE;
5413 	tsol_gc_t *gc = NULL;
5414 	tsol_gcgrp_t *gcgrp = NULL;
5415 	boolean_t gcgrp_xtraref = B_FALSE;
5416 	boolean_t cgtp_broadcast;
5417 	boolean_t unbound = B_FALSE;
5418 
5419 	ip1dbg(("ip_rt_add:"));
5420 
5421 	if (ire_arg != NULL)
5422 		*ire_arg = NULL;
5423 
5424 	/* disallow non-contiguous netmasks */
5425 	if (!ip_contiguous_mask(ntohl(mask)))
5426 		return (ENOTSUP);
5427 
5428 	/*
5429 	 * If this is the case of RTF_HOST being set, then we set the netmask
5430 	 * to all ones (regardless if one was supplied).
5431 	 */
5432 	if (flags & RTF_HOST)
5433 		mask = IP_HOST_MASK;
5434 
5435 	/*
5436 	 * Prevent routes with a zero gateway from being created (since
5437 	 * interfaces can currently be plumbed and brought up no assigned
5438 	 * address).
5439 	 */
5440 	if (gw_addr == 0)
5441 		return (ENETUNREACH);
5442 	/*
5443 	 * Get the ipif, if any, corresponding to the gw_addr
5444 	 * If -ifp was specified we restrict ourselves to the ill, otherwise
5445 	 * we match on the gatway and destination to handle unnumbered pt-pt
5446 	 * interfaces.
5447 	 */
5448 	if (ill != NULL)
5449 		ipif = ipif_lookup_addr(gw_addr, ill, ALL_ZONES, ipst);
5450 	else
5451 		ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
5452 	if (ipif != NULL) {
5453 		if (IS_VNI(ipif->ipif_ill)) {
5454 			ipif_refrele(ipif);
5455 			return (EINVAL);
5456 		}
5457 	}
5458 
5459 	/*
5460 	 * GateD will attempt to create routes with a loopback interface
5461 	 * address as the gateway and with RTF_GATEWAY set.  We allow
5462 	 * these routes to be added, but create them as interface routes
5463 	 * since the gateway is an interface address.
5464 	 */
5465 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
5466 		flags &= ~RTF_GATEWAY;
5467 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
5468 		    mask == IP_HOST_MASK) {
5469 			ire = ire_ftable_lookup_v4(dst_addr, 0, 0, IRE_LOOPBACK,
5470 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
5471 			    NULL);
5472 			if (ire != NULL) {
5473 				ire_refrele(ire);
5474 				ipif_refrele(ipif);
5475 				return (EEXIST);
5476 			}
5477 			ip1dbg(("ip_rt_add: 0x%p creating IRE 0x%x"
5478 			    "for 0x%x\n", (void *)ipif,
5479 			    ipif->ipif_ire_type,
5480 			    ntohl(ipif->ipif_lcl_addr)));
5481 			ire = ire_create(
5482 			    (uchar_t *)&dst_addr,	/* dest address */
5483 			    (uchar_t *)&mask,		/* mask */
5484 			    NULL,			/* no gateway */
5485 			    ipif->ipif_ire_type,	/* LOOPBACK */
5486 			    ipif->ipif_ill,
5487 			    zoneid,
5488 			    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
5489 			    NULL,
5490 			    ipst);
5491 
5492 			if (ire == NULL) {
5493 				ipif_refrele(ipif);
5494 				return (ENOMEM);
5495 			}
5496 			/* src address assigned by the caller? */
5497 			if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5498 				ire->ire_setsrc_addr = src_addr;
5499 
5500 			nire = ire_add(ire);
5501 			if (nire == NULL) {
5502 				/*
5503 				 * In the result of failure, ire_add() will have
5504 				 * already deleted the ire in question, so there
5505 				 * is no need to do that here.
5506 				 */
5507 				ipif_refrele(ipif);
5508 				return (ENOMEM);
5509 			}
5510 			/*
5511 			 * Check if it was a duplicate entry. This handles
5512 			 * the case of two racing route adds for the same route
5513 			 */
5514 			if (nire != ire) {
5515 				ASSERT(nire->ire_identical_ref > 1);
5516 				ire_delete(nire);
5517 				ire_refrele(nire);
5518 				ipif_refrele(ipif);
5519 				return (EEXIST);
5520 			}
5521 			ire = nire;
5522 			goto save_ire;
5523 		}
5524 	}
5525 
5526 	/*
5527 	 * The routes for multicast with CGTP are quite special in that
5528 	 * the gateway is the local interface address, yet RTF_GATEWAY
5529 	 * is set. We turn off RTF_GATEWAY to provide compatibility with
5530 	 * this undocumented and unusual use of multicast routes.
5531 	 */
5532 	if ((flags & RTF_MULTIRT) && ipif != NULL)
5533 		flags &= ~RTF_GATEWAY;
5534 
5535 	/*
5536 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
5537 	 * and the gateway address provided is one of the system's interface
5538 	 * addresses.  By using the routing socket interface and supplying an
5539 	 * RTA_IFP sockaddr with an interface index, an alternate method of
5540 	 * specifying an interface route to be created is available which uses
5541 	 * the interface index that specifies the outgoing interface rather than
5542 	 * the address of an outgoing interface (which may not be able to
5543 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
5544 	 * flag, routes can be specified which not only specify the next-hop to
5545 	 * be used when routing to a certain prefix, but also which outgoing
5546 	 * interface should be used.
5547 	 *
5548 	 * Previously, interfaces would have unique addresses assigned to them
5549 	 * and so the address assigned to a particular interface could be used
5550 	 * to identify a particular interface.  One exception to this was the
5551 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
5552 	 *
5553 	 * With the advent of IPv6 and its link-local addresses, this
5554 	 * restriction was relaxed and interfaces could share addresses between
5555 	 * themselves.  In fact, typically all of the link-local interfaces on
5556 	 * an IPv6 node or router will have the same link-local address.  In
5557 	 * order to differentiate between these interfaces, the use of an
5558 	 * interface index is necessary and this index can be carried inside a
5559 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
5560 	 * of using the interface index, however, is that all of the ipif's that
5561 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
5562 	 * cannot be used to differentiate between ipif's (or logical
5563 	 * interfaces) that belong to the same ill (physical interface).
5564 	 *
5565 	 * For example, in the following case involving IPv4 interfaces and
5566 	 * logical interfaces
5567 	 *
5568 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
5569 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0
5570 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0
5571 	 *
5572 	 * the ipif's corresponding to each of these interface routes can be
5573 	 * uniquely identified by the "gateway" (actually interface address).
5574 	 *
5575 	 * In this case involving multiple IPv6 default routes to a particular
5576 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
5577 	 * default route is of interest:
5578 	 *
5579 	 *	default		fe80::123:4567:89ab:cdef	U	if0
5580 	 *	default		fe80::123:4567:89ab:cdef	U	if1
5581 	 */
5582 
5583 	/* RTF_GATEWAY not set */
5584 	if (!(flags & RTF_GATEWAY)) {
5585 		if (sp != NULL) {
5586 			ip2dbg(("ip_rt_add: gateway security attributes "
5587 			    "cannot be set with interface route\n"));
5588 			if (ipif != NULL)
5589 				ipif_refrele(ipif);
5590 			return (EINVAL);
5591 		}
5592 
5593 		/*
5594 		 * Whether or not ill (RTA_IFP) is set, we require that
5595 		 * the gateway is one of our local addresses.
5596 		 */
5597 		if (ipif == NULL)
5598 			return (ENETUNREACH);
5599 
5600 		/*
5601 		 * We use MATCH_IRE_ILL here. If the caller specified an
5602 		 * interface (from the RTA_IFP sockaddr) we use it, otherwise
5603 		 * we use the ill derived from the gateway address.
5604 		 * We can always match the gateway address since we record it
5605 		 * in ire_gateway_addr.
5606 		 * We don't allow RTA_IFP to specify a different ill than the
5607 		 * one matching the ipif to make sure we can delete the route.
5608 		 */
5609 		match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL;
5610 		if (ill == NULL) {
5611 			ill = ipif->ipif_ill;
5612 		} else if (ill != ipif->ipif_ill) {
5613 			ipif_refrele(ipif);
5614 			return (EINVAL);
5615 		}
5616 
5617 		/*
5618 		 * We check for an existing entry at this point.
5619 		 *
5620 		 * Since a netmask isn't passed in via the ioctl interface
5621 		 * (SIOCADDRT), we don't check for a matching netmask in that
5622 		 * case.
5623 		 */
5624 		if (!ioctl_msg)
5625 			match_flags |= MATCH_IRE_MASK;
5626 		ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
5627 		    IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst,
5628 		    NULL);
5629 		if (ire != NULL) {
5630 			ire_refrele(ire);
5631 			ipif_refrele(ipif);
5632 			return (EEXIST);
5633 		}
5634 
5635 		/*
5636 		 * Some software (for example, GateD and Sun Cluster) attempts
5637 		 * to create (what amount to) IRE_PREFIX routes with the
5638 		 * loopback address as the gateway.  This is primarily done to
5639 		 * set up prefixes with the RTF_REJECT flag set (for example,
5640 		 * when generating aggregate routes.)
5641 		 *
5642 		 * If the IRE type (as defined by ill->ill_net_type) would be
5643 		 * IRE_LOOPBACK, then we map the request into a
5644 		 * IRE_IF_NORESOLVER. We also OR in the RTF_BLACKHOLE flag as
5645 		 * these interface routes, by definition, can only be that.
5646 		 *
5647 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
5648 		 * routine, but rather using ire_create() directly.
5649 		 *
5650 		 */
5651 		type = ill->ill_net_type;
5652 		if (type == IRE_LOOPBACK) {
5653 			type = IRE_IF_NORESOLVER;
5654 			flags |= RTF_BLACKHOLE;
5655 		}
5656 
5657 		/*
5658 		 * Create a copy of the IRE_IF_NORESOLVER or
5659 		 * IRE_IF_RESOLVER with the modified address, netmask, and
5660 		 * gateway.
5661 		 */
5662 		ire = ire_create(
5663 		    (uchar_t *)&dst_addr,
5664 		    (uint8_t *)&mask,
5665 		    (uint8_t *)&gw_addr,
5666 		    type,
5667 		    ill,
5668 		    zoneid,
5669 		    flags,
5670 		    NULL,
5671 		    ipst);
5672 		if (ire == NULL) {
5673 			ipif_refrele(ipif);
5674 			return (ENOMEM);
5675 		}
5676 
5677 		/* src address assigned by the caller? */
5678 		if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5679 			ire->ire_setsrc_addr = src_addr;
5680 
5681 		nire = ire_add(ire);
5682 		if (nire == NULL) {
5683 			/*
5684 			 * In the result of failure, ire_add() will have
5685 			 * already deleted the ire in question, so there
5686 			 * is no need to do that here.
5687 			 */
5688 			ipif_refrele(ipif);
5689 			return (ENOMEM);
5690 		}
5691 		/*
5692 		 * Check if it was a duplicate entry. This handles
5693 		 * the case of two racing route adds for the same route
5694 		 */
5695 		if (nire != ire) {
5696 			ire_delete(nire);
5697 			ire_refrele(nire);
5698 			ipif_refrele(ipif);
5699 			return (EEXIST);
5700 		}
5701 		ire = nire;
5702 		goto save_ire;
5703 	}
5704 
5705 	/*
5706 	 * Get an interface IRE for the specified gateway.
5707 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
5708 	 * gateway, it is currently unreachable and we fail the request
5709 	 * accordingly. We reject any RTF_GATEWAY routes where the gateway
5710 	 * is an IRE_LOCAL or IRE_LOOPBACK.
5711 	 * If RTA_IFP was specified we look on that particular ill.
5712 	 */
5713 	if (ill != NULL)
5714 		match_flags |= MATCH_IRE_ILL;
5715 
5716 	/* Check whether the gateway is reachable. */
5717 again:
5718 	type = IRE_INTERFACE | IRE_LOCAL | IRE_LOOPBACK;
5719 	if (flags & RTF_INDIRECT)
5720 		type |= IRE_OFFLINK;
5721 
5722 	gw_ire = ire_ftable_lookup_v4(gw_addr, 0, 0, type, ill,
5723 	    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
5724 	if (gw_ire == NULL) {
5725 		/*
5726 		 * With IPMP, we allow host routes to influence in.mpathd's
5727 		 * target selection.  However, if the test addresses are on
5728 		 * their own network, the above lookup will fail since the
5729 		 * underlying IRE_INTERFACEs are marked hidden.  So allow
5730 		 * hidden test IREs to be found and try again.
5731 		 */
5732 		if (!(match_flags & MATCH_IRE_TESTHIDDEN))  {
5733 			match_flags |= MATCH_IRE_TESTHIDDEN;
5734 			goto again;
5735 		}
5736 		if (ipif != NULL)
5737 			ipif_refrele(ipif);
5738 		return (ENETUNREACH);
5739 	}
5740 	if (gw_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
5741 		ire_refrele(gw_ire);
5742 		if (ipif != NULL)
5743 			ipif_refrele(ipif);
5744 		return (ENETUNREACH);
5745 	}
5746 
5747 	if (ill == NULL && !(flags & RTF_INDIRECT)) {
5748 		unbound = B_TRUE;
5749 		if (ipst->ips_ip_strict_src_multihoming > 0)
5750 			ill = gw_ire->ire_ill;
5751 	}
5752 
5753 	/*
5754 	 * We create one of three types of IREs as a result of this request
5755 	 * based on the netmask.  A netmask of all ones (which is automatically
5756 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
5757 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
5758 	 * created.  Otherwise, an IRE_PREFIX route is created for the
5759 	 * destination prefix.
5760 	 */
5761 	if (mask == IP_HOST_MASK)
5762 		type = IRE_HOST;
5763 	else if (mask == 0)
5764 		type = IRE_DEFAULT;
5765 	else
5766 		type = IRE_PREFIX;
5767 
5768 	/* check for a duplicate entry */
5769 	ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
5770 	    ALL_ZONES, NULL, match_flags | MATCH_IRE_MASK | MATCH_IRE_GW,
5771 	    0, ipst, NULL);
5772 	if (ire != NULL) {
5773 		if (ipif != NULL)
5774 			ipif_refrele(ipif);
5775 		ire_refrele(gw_ire);
5776 		ire_refrele(ire);
5777 		return (EEXIST);
5778 	}
5779 
5780 	/* Security attribute exists */
5781 	if (sp != NULL) {
5782 		tsol_gcgrp_addr_t ga;
5783 
5784 		/* find or create the gateway credentials group */
5785 		ga.ga_af = AF_INET;
5786 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
5787 
5788 		/* we hold reference to it upon success */
5789 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
5790 		if (gcgrp == NULL) {
5791 			if (ipif != NULL)
5792 				ipif_refrele(ipif);
5793 			ire_refrele(gw_ire);
5794 			return (ENOMEM);
5795 		}
5796 
5797 		/*
5798 		 * Create and add the security attribute to the group; a
5799 		 * reference to the group is made upon allocating a new
5800 		 * entry successfully.  If it finds an already-existing
5801 		 * entry for the security attribute in the group, it simply
5802 		 * returns it and no new reference is made to the group.
5803 		 */
5804 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
5805 		if (gc == NULL) {
5806 			if (ipif != NULL)
5807 				ipif_refrele(ipif);
5808 			/* release reference held by gcgrp_lookup */
5809 			GCGRP_REFRELE(gcgrp);
5810 			ire_refrele(gw_ire);
5811 			return (ENOMEM);
5812 		}
5813 	}
5814 
5815 	/* Create the IRE. */
5816 	ire = ire_create(
5817 	    (uchar_t *)&dst_addr,		/* dest address */
5818 	    (uchar_t *)&mask,			/* mask */
5819 	    (uchar_t *)&gw_addr,		/* gateway address */
5820 	    (ushort_t)type,			/* IRE type */
5821 	    ill,
5822 	    zoneid,
5823 	    flags,
5824 	    gc,					/* security attribute */
5825 	    ipst);
5826 
5827 	/*
5828 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
5829 	 * reference to the 'gcgrp'. We can now release the extra reference
5830 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
5831 	 */
5832 	if (gcgrp_xtraref)
5833 		GCGRP_REFRELE(gcgrp);
5834 	if (ire == NULL) {
5835 		if (gc != NULL)
5836 			GC_REFRELE(gc);
5837 		if (ipif != NULL)
5838 			ipif_refrele(ipif);
5839 		ire_refrele(gw_ire);
5840 		return (ENOMEM);
5841 	}
5842 
5843 	/* Before we add, check if an extra CGTP broadcast is needed */
5844 	cgtp_broadcast = ((flags & RTF_MULTIRT) &&
5845 	    ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST);
5846 
5847 	/* src address assigned by the caller? */
5848 	if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5849 		ire->ire_setsrc_addr = src_addr;
5850 
5851 	ire->ire_unbound = unbound;
5852 
5853 	/*
5854 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
5855 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
5856 	 */
5857 
5858 	/* Add the new IRE. */
5859 	nire = ire_add(ire);
5860 	if (nire == NULL) {
5861 		/*
5862 		 * In the result of failure, ire_add() will have
5863 		 * already deleted the ire in question, so there
5864 		 * is no need to do that here.
5865 		 */
5866 		if (ipif != NULL)
5867 			ipif_refrele(ipif);
5868 		ire_refrele(gw_ire);
5869 		return (ENOMEM);
5870 	}
5871 	/*
5872 	 * Check if it was a duplicate entry. This handles
5873 	 * the case of two racing route adds for the same route
5874 	 */
5875 	if (nire != ire) {
5876 		ire_delete(nire);
5877 		ire_refrele(nire);
5878 		if (ipif != NULL)
5879 			ipif_refrele(ipif);
5880 		ire_refrele(gw_ire);
5881 		return (EEXIST);
5882 	}
5883 	ire = nire;
5884 
5885 	if (flags & RTF_MULTIRT) {
5886 		/*
5887 		 * Invoke the CGTP (multirouting) filtering module
5888 		 * to add the dst address in the filtering database.
5889 		 * Replicated inbound packets coming from that address
5890 		 * will be filtered to discard the duplicates.
5891 		 * It is not necessary to call the CGTP filter hook
5892 		 * when the dst address is a broadcast or multicast,
5893 		 * because an IP source address cannot be a broadcast
5894 		 * or a multicast.
5895 		 */
5896 		if (cgtp_broadcast) {
5897 			ip_cgtp_bcast_add(ire, ipst);
5898 			goto save_ire;
5899 		}
5900 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
5901 		    !CLASSD(ire->ire_addr)) {
5902 			int res;
5903 			ipif_t *src_ipif;
5904 
5905 			/* Find the source address corresponding to gw_ire */
5906 			src_ipif = ipif_lookup_addr(gw_ire->ire_gateway_addr,
5907 			    NULL, zoneid, ipst);
5908 			if (src_ipif != NULL) {
5909 				res = ipst->ips_ip_cgtp_filter_ops->
5910 				    cfo_add_dest_v4(
5911 				    ipst->ips_netstack->netstack_stackid,
5912 				    ire->ire_addr,
5913 				    ire->ire_gateway_addr,
5914 				    ire->ire_setsrc_addr,
5915 				    src_ipif->ipif_lcl_addr);
5916 				ipif_refrele(src_ipif);
5917 			} else {
5918 				res = EADDRNOTAVAIL;
5919 			}
5920 			if (res != 0) {
5921 				if (ipif != NULL)
5922 					ipif_refrele(ipif);
5923 				ire_refrele(gw_ire);
5924 				ire_delete(ire);
5925 				ire_refrele(ire);	/* Held in ire_add */
5926 				return (res);
5927 			}
5928 		}
5929 	}
5930 
5931 save_ire:
5932 	if (gw_ire != NULL) {
5933 		ire_refrele(gw_ire);
5934 		gw_ire = NULL;
5935 	}
5936 	if (ill != NULL) {
5937 		/*
5938 		 * Save enough information so that we can recreate the IRE if
5939 		 * the interface goes down and then up.  The metrics associated
5940 		 * with the route will be saved as well when rts_setmetrics() is
5941 		 * called after the IRE has been created.  In the case where
5942 		 * memory cannot be allocated, none of this information will be
5943 		 * saved.
5944 		 */
5945 		ill_save_ire(ill, ire);
5946 	}
5947 	if (ioctl_msg)
5948 		ip_rts_rtmsg(RTM_OLDADD, ire, 0, ipst);
5949 	if (ire_arg != NULL) {
5950 		/*
5951 		 * Store the ire that was successfully added into where ire_arg
5952 		 * points to so that callers don't have to look it up
5953 		 * themselves (but they are responsible for ire_refrele()ing
5954 		 * the ire when they are finished with it).
5955 		 */
5956 		*ire_arg = ire;
5957 	} else {
5958 		ire_refrele(ire);		/* Held in ire_add */
5959 	}
5960 	if (ipif != NULL)
5961 		ipif_refrele(ipif);
5962 	return (0);
5963 }
5964 
5965 /*
5966  * ip_rt_delete is called to delete an IPv4 route.
5967  * ill is passed in to associate it with the correct interface.
5968  */
5969 /* ARGSUSED4 */
5970 int
5971 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5972     uint_t rtm_addrs, int flags, ill_t *ill, boolean_t ioctl_msg,
5973     ip_stack_t *ipst, zoneid_t zoneid)
5974 {
5975 	ire_t	*ire = NULL;
5976 	ipif_t	*ipif;
5977 	uint_t	type;
5978 	uint_t	match_flags = MATCH_IRE_TYPE;
5979 	int	err = 0;
5980 
5981 	ip1dbg(("ip_rt_delete:"));
5982 	/*
5983 	 * If this is the case of RTF_HOST being set, then we set the netmask
5984 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
5985 	 */
5986 	if (flags & RTF_HOST) {
5987 		mask = IP_HOST_MASK;
5988 		match_flags |= MATCH_IRE_MASK;
5989 	} else if (rtm_addrs & RTA_NETMASK) {
5990 		match_flags |= MATCH_IRE_MASK;
5991 	}
5992 
5993 	/*
5994 	 * Note that RTF_GATEWAY is never set on a delete, therefore
5995 	 * we check if the gateway address is one of our interfaces first,
5996 	 * and fall back on RTF_GATEWAY routes.
5997 	 *
5998 	 * This makes it possible to delete an original
5999 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
6000 	 * However, we have RTF_KERNEL set on the ones created by ipif_up
6001 	 * and those can not be deleted here.
6002 	 *
6003 	 * We use MATCH_IRE_ILL if we know the interface. If the caller
6004 	 * specified an interface (from the RTA_IFP sockaddr) we use it,
6005 	 * otherwise we use the ill derived from the gateway address.
6006 	 * We can always match the gateway address since we record it
6007 	 * in ire_gateway_addr.
6008 	 *
6009 	 * For more detail on specifying routes by gateway address and by
6010 	 * interface index, see the comments in ip_rt_add().
6011 	 */
6012 	ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
6013 	if (ipif != NULL) {
6014 		ill_t	*ill_match;
6015 
6016 		if (ill != NULL)
6017 			ill_match = ill;
6018 		else
6019 			ill_match = ipif->ipif_ill;
6020 
6021 		match_flags |= MATCH_IRE_ILL;
6022 		if (ipif->ipif_ire_type == IRE_LOOPBACK) {
6023 			ire = ire_ftable_lookup_v4(dst_addr, mask, 0,
6024 			    IRE_LOOPBACK, ill_match, ALL_ZONES, NULL,
6025 			    match_flags, 0, ipst, NULL);
6026 		}
6027 		if (ire == NULL) {
6028 			match_flags |= MATCH_IRE_GW;
6029 			ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
6030 			    IRE_INTERFACE, ill_match, ALL_ZONES, NULL,
6031 			    match_flags, 0, ipst, NULL);
6032 		}
6033 		/* Avoid deleting routes created by kernel from an ipif */
6034 		if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) {
6035 			ire_refrele(ire);
6036 			ire = NULL;
6037 		}
6038 
6039 		/* Restore in case we didn't find a match */
6040 		match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL);
6041 	}
6042 
6043 	if (ire == NULL) {
6044 		/*
6045 		 * At this point, the gateway address is not one of our own
6046 		 * addresses or a matching interface route was not found.  We
6047 		 * set the IRE type to lookup based on whether
6048 		 * this is a host route, a default route or just a prefix.
6049 		 *
6050 		 * If an ill was passed in, then the lookup is based on an
6051 		 * interface index so MATCH_IRE_ILL is added to match_flags.
6052 		 */
6053 		match_flags |= MATCH_IRE_GW;
6054 		if (ill != NULL)
6055 			match_flags |= MATCH_IRE_ILL;
6056 		if (mask == IP_HOST_MASK)
6057 			type = IRE_HOST;
6058 		else if (mask == 0)
6059 			type = IRE_DEFAULT;
6060 		else
6061 			type = IRE_PREFIX;
6062 		ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
6063 		    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
6064 	}
6065 
6066 	if (ipif != NULL) {
6067 		ipif_refrele(ipif);
6068 		ipif = NULL;
6069 	}
6070 
6071 	if (ire == NULL)
6072 		return (ESRCH);
6073 
6074 	if (ire->ire_flags & RTF_MULTIRT) {
6075 		/*
6076 		 * Invoke the CGTP (multirouting) filtering module
6077 		 * to remove the dst address from the filtering database.
6078 		 * Packets coming from that address will no longer be
6079 		 * filtered to remove duplicates.
6080 		 */
6081 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
6082 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v4(
6083 			    ipst->ips_netstack->netstack_stackid,
6084 			    ire->ire_addr, ire->ire_gateway_addr);
6085 		}
6086 		ip_cgtp_bcast_delete(ire, ipst);
6087 	}
6088 
6089 	ill = ire->ire_ill;
6090 	if (ill != NULL)
6091 		ill_remove_saved_ire(ill, ire);
6092 	if (ioctl_msg)
6093 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0, ipst);
6094 	ire_delete(ire);
6095 	ire_refrele(ire);
6096 	return (err);
6097 }
6098 
6099 /*
6100  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
6101  */
6102 /* ARGSUSED */
6103 int
6104 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6105     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6106 {
6107 	ipaddr_t dst_addr;
6108 	ipaddr_t gw_addr;
6109 	ipaddr_t mask;
6110 	int error = 0;
6111 	mblk_t *mp1;
6112 	struct rtentry *rt;
6113 	ipif_t *ipif = NULL;
6114 	ip_stack_t	*ipst;
6115 
6116 	ASSERT(q->q_next == NULL);
6117 	ipst = CONNQ_TO_IPST(q);
6118 
6119 	ip1dbg(("ip_siocaddrt:"));
6120 	/* Existence of mp1 verified in ip_wput_nondata */
6121 	mp1 = mp->b_cont->b_cont;
6122 	rt = (struct rtentry *)mp1->b_rptr;
6123 
6124 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6125 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6126 
6127 	/*
6128 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
6129 	 * to a particular host address.  In this case, we set the netmask to
6130 	 * all ones for the particular destination address.  Otherwise,
6131 	 * determine the netmask to be used based on dst_addr and the interfaces
6132 	 * in use.
6133 	 */
6134 	if (rt->rt_flags & RTF_HOST) {
6135 		mask = IP_HOST_MASK;
6136 	} else {
6137 		/*
6138 		 * Note that ip_subnet_mask returns a zero mask in the case of
6139 		 * default (an all-zeroes address).
6140 		 */
6141 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6142 	}
6143 
6144 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
6145 	    B_TRUE, NULL, ipst, ALL_ZONES);
6146 	if (ipif != NULL)
6147 		ipif_refrele(ipif);
6148 	return (error);
6149 }
6150 
6151 /*
6152  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
6153  */
6154 /* ARGSUSED */
6155 int
6156 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6157     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6158 {
6159 	ipaddr_t dst_addr;
6160 	ipaddr_t gw_addr;
6161 	ipaddr_t mask;
6162 	int error;
6163 	mblk_t *mp1;
6164 	struct rtentry *rt;
6165 	ipif_t *ipif = NULL;
6166 	ip_stack_t	*ipst;
6167 
6168 	ASSERT(q->q_next == NULL);
6169 	ipst = CONNQ_TO_IPST(q);
6170 
6171 	ip1dbg(("ip_siocdelrt:"));
6172 	/* Existence of mp1 verified in ip_wput_nondata */
6173 	mp1 = mp->b_cont->b_cont;
6174 	rt = (struct rtentry *)mp1->b_rptr;
6175 
6176 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6177 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6178 
6179 	/*
6180 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
6181 	 * to a particular host address.  In this case, we set the netmask to
6182 	 * all ones for the particular destination address.  Otherwise,
6183 	 * determine the netmask to be used based on dst_addr and the interfaces
6184 	 * in use.
6185 	 */
6186 	if (rt->rt_flags & RTF_HOST) {
6187 		mask = IP_HOST_MASK;
6188 	} else {
6189 		/*
6190 		 * Note that ip_subnet_mask returns a zero mask in the case of
6191 		 * default (an all-zeroes address).
6192 		 */
6193 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6194 	}
6195 
6196 	error = ip_rt_delete(dst_addr, mask, gw_addr,
6197 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, B_TRUE,
6198 	    ipst, ALL_ZONES);
6199 	if (ipif != NULL)
6200 		ipif_refrele(ipif);
6201 	return (error);
6202 }
6203 
6204 /*
6205  * Enqueue the mp onto the ipsq, chained by b_next.
6206  * b_prev stores the function to be executed later, and b_queue the queue
6207  * where this mp originated.
6208  */
6209 void
6210 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6211     ill_t *pending_ill)
6212 {
6213 	conn_t	*connp;
6214 	ipxop_t *ipx = ipsq->ipsq_xop;
6215 
6216 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6217 	ASSERT(MUTEX_HELD(&ipx->ipx_lock));
6218 	ASSERT(func != NULL);
6219 
6220 	mp->b_queue = q;
6221 	mp->b_prev = (void *)func;
6222 	mp->b_next = NULL;
6223 
6224 	switch (type) {
6225 	case CUR_OP:
6226 		if (ipx->ipx_mptail != NULL) {
6227 			ASSERT(ipx->ipx_mphead != NULL);
6228 			ipx->ipx_mptail->b_next = mp;
6229 		} else {
6230 			ASSERT(ipx->ipx_mphead == NULL);
6231 			ipx->ipx_mphead = mp;
6232 		}
6233 		ipx->ipx_mptail = mp;
6234 		break;
6235 
6236 	case NEW_OP:
6237 		if (ipsq->ipsq_xopq_mptail != NULL) {
6238 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
6239 			ipsq->ipsq_xopq_mptail->b_next = mp;
6240 		} else {
6241 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
6242 			ipsq->ipsq_xopq_mphead = mp;
6243 		}
6244 		ipsq->ipsq_xopq_mptail = mp;
6245 		ipx->ipx_ipsq_queued = B_TRUE;
6246 		break;
6247 
6248 	case SWITCH_OP:
6249 		ASSERT(ipsq->ipsq_swxop != NULL);
6250 		/* only one switch operation is currently allowed */
6251 		ASSERT(ipsq->ipsq_switch_mp == NULL);
6252 		ipsq->ipsq_switch_mp = mp;
6253 		ipx->ipx_ipsq_queued = B_TRUE;
6254 		break;
6255 	default:
6256 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
6257 	}
6258 
6259 	if (CONN_Q(q) && pending_ill != NULL) {
6260 		connp = Q_TO_CONN(q);
6261 		ASSERT(MUTEX_HELD(&connp->conn_lock));
6262 		connp->conn_oper_pending_ill = pending_ill;
6263 	}
6264 }
6265 
6266 /*
6267  * Dequeue the next message that requested exclusive access to this IPSQ's
6268  * xop.  Specifically:
6269  *
6270  *  1. If we're still processing the current operation on `ipsq', then
6271  *     dequeue the next message for the operation (from ipx_mphead), or
6272  *     return NULL if there are no queued messages for the operation.
6273  *     These messages are queued via CUR_OP to qwriter_ip() and friends.
6274  *
6275  *  2. If the current operation on `ipsq' has completed (ipx_current_ipif is
6276  *     not set) see if the ipsq has requested an xop switch.  If so, switch
6277  *     `ipsq' to a different xop.  Xop switches only happen when joining or
6278  *     leaving IPMP groups and require a careful dance -- see the comments
6279  *     in-line below for details.  If we're leaving a group xop or if we're
6280  *     joining a group xop and become writer on it, then we proceed to (3).
6281  *     Otherwise, we return NULL and exit the xop.
6282  *
6283  *  3. For each IPSQ in the xop, return any switch operation stored on
6284  *     ipsq_switch_mp (set via SWITCH_OP); these must be processed before
6285  *     any other messages queued on the IPSQ.  Otherwise, dequeue the next
6286  *     exclusive operation (queued via NEW_OP) stored on ipsq_xopq_mphead.
6287  *     Note that if the phyint tied to `ipsq' is not using IPMP there will
6288  *     only be one IPSQ in the xop.  Otherwise, there will be one IPSQ for
6289  *     each phyint in the group, including the IPMP meta-interface phyint.
6290  */
6291 static mblk_t *
6292 ipsq_dq(ipsq_t *ipsq)
6293 {
6294 	ill_t	*illv4, *illv6;
6295 	mblk_t	*mp;
6296 	ipsq_t	*xopipsq;
6297 	ipsq_t	*leftipsq = NULL;
6298 	ipxop_t *ipx;
6299 	phyint_t *phyi = ipsq->ipsq_phyint;
6300 	ip_stack_t *ipst = ipsq->ipsq_ipst;
6301 	boolean_t emptied = B_FALSE;
6302 
6303 	/*
6304 	 * Grab all the locks we need in the defined order (ill_g_lock ->
6305 	 * ipsq_lock -> ipx_lock); ill_g_lock is needed to use ipsq_next.
6306 	 */
6307 	rw_enter(&ipst->ips_ill_g_lock,
6308 	    ipsq->ipsq_swxop != NULL ? RW_WRITER : RW_READER);
6309 	mutex_enter(&ipsq->ipsq_lock);
6310 	ipx = ipsq->ipsq_xop;
6311 	mutex_enter(&ipx->ipx_lock);
6312 
6313 	/*
6314 	 * Dequeue the next message associated with the current exclusive
6315 	 * operation, if any.
6316 	 */
6317 	if ((mp = ipx->ipx_mphead) != NULL) {
6318 		ipx->ipx_mphead = mp->b_next;
6319 		if (ipx->ipx_mphead == NULL)
6320 			ipx->ipx_mptail = NULL;
6321 		mp->b_next = (void *)ipsq;
6322 		goto out;
6323 	}
6324 
6325 	if (ipx->ipx_current_ipif != NULL)
6326 		goto empty;
6327 
6328 	if (ipsq->ipsq_swxop != NULL) {
6329 		/*
6330 		 * The exclusive operation that is now being completed has
6331 		 * requested a switch to a different xop.  This happens
6332 		 * when an interface joins or leaves an IPMP group.  Joins
6333 		 * happen through SIOCSLIFGROUPNAME (ip_sioctl_groupname()).
6334 		 * Leaves happen via SIOCSLIFGROUPNAME, interface unplumb
6335 		 * (phyint_free()), or interface plumb for an ill type
6336 		 * not in the IPMP group (ip_rput_dlpi_writer()).
6337 		 *
6338 		 * Xop switches are not allowed on the IPMP meta-interface.
6339 		 */
6340 		ASSERT(phyi == NULL || !(phyi->phyint_flags & PHYI_IPMP));
6341 		ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
6342 		DTRACE_PROBE1(ipsq__switch, (ipsq_t *), ipsq);
6343 
6344 		if (ipsq->ipsq_swxop == &ipsq->ipsq_ownxop) {
6345 			/*
6346 			 * We're switching back to our own xop, so we have two
6347 			 * xop's to drain/exit: our own, and the group xop
6348 			 * that we are leaving.
6349 			 *
6350 			 * First, pull ourselves out of the group ipsq list.
6351 			 * This is safe since we're writer on ill_g_lock.
6352 			 */
6353 			ASSERT(ipsq->ipsq_xop != &ipsq->ipsq_ownxop);
6354 
6355 			xopipsq = ipx->ipx_ipsq;
6356 			while (xopipsq->ipsq_next != ipsq)
6357 				xopipsq = xopipsq->ipsq_next;
6358 
6359 			xopipsq->ipsq_next = ipsq->ipsq_next;
6360 			ipsq->ipsq_next = ipsq;
6361 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
6362 			ipsq->ipsq_swxop = NULL;
6363 
6364 			/*
6365 			 * Second, prepare to exit the group xop.  The actual
6366 			 * ipsq_exit() is done at the end of this function
6367 			 * since we cannot hold any locks across ipsq_exit().
6368 			 * Note that although we drop the group's ipx_lock, no
6369 			 * threads can proceed since we're still ipx_writer.
6370 			 */
6371 			leftipsq = xopipsq;
6372 			mutex_exit(&ipx->ipx_lock);
6373 
6374 			/*
6375 			 * Third, set ipx to point to our own xop (which was
6376 			 * inactive and therefore can be entered).
6377 			 */
6378 			ipx = ipsq->ipsq_xop;
6379 			mutex_enter(&ipx->ipx_lock);
6380 			ASSERT(ipx->ipx_writer == NULL);
6381 			ASSERT(ipx->ipx_current_ipif == NULL);
6382 		} else {
6383 			/*
6384 			 * We're switching from our own xop to a group xop.
6385 			 * The requestor of the switch must ensure that the
6386 			 * group xop cannot go away (e.g. by ensuring the
6387 			 * phyint associated with the xop cannot go away).
6388 			 *
6389 			 * If we can become writer on our new xop, then we'll
6390 			 * do the drain.  Otherwise, the current writer of our
6391 			 * new xop will do the drain when it exits.
6392 			 *
6393 			 * First, splice ourselves into the group IPSQ list.
6394 			 * This is safe since we're writer on ill_g_lock.
6395 			 */
6396 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6397 
6398 			xopipsq = ipsq->ipsq_swxop->ipx_ipsq;
6399 			while (xopipsq->ipsq_next != ipsq->ipsq_swxop->ipx_ipsq)
6400 				xopipsq = xopipsq->ipsq_next;
6401 
6402 			xopipsq->ipsq_next = ipsq;
6403 			ipsq->ipsq_next = ipsq->ipsq_swxop->ipx_ipsq;
6404 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
6405 			ipsq->ipsq_swxop = NULL;
6406 
6407 			/*
6408 			 * Second, exit our own xop, since it's now unused.
6409 			 * This is safe since we've got the only reference.
6410 			 */
6411 			ASSERT(ipx->ipx_writer == curthread);
6412 			ipx->ipx_writer = NULL;
6413 			VERIFY(--ipx->ipx_reentry_cnt == 0);
6414 			ipx->ipx_ipsq_queued = B_FALSE;
6415 			mutex_exit(&ipx->ipx_lock);
6416 
6417 			/*
6418 			 * Third, set ipx to point to our new xop, and check
6419 			 * if we can become writer on it.  If we cannot, then
6420 			 * the current writer will drain the IPSQ group when
6421 			 * it exits.  Our ipsq_xop is guaranteed to be stable
6422 			 * because we're still holding ipsq_lock.
6423 			 */
6424 			ipx = ipsq->ipsq_xop;
6425 			mutex_enter(&ipx->ipx_lock);
6426 			if (ipx->ipx_writer != NULL ||
6427 			    ipx->ipx_current_ipif != NULL) {
6428 				goto out;
6429 			}
6430 		}
6431 
6432 		/*
6433 		 * Fourth, become writer on our new ipx before we continue
6434 		 * with the drain.  Note that we never dropped ipsq_lock
6435 		 * above, so no other thread could've raced with us to
6436 		 * become writer first.  Also, we're holding ipx_lock, so
6437 		 * no other thread can examine the ipx right now.
6438 		 */
6439 		ASSERT(ipx->ipx_current_ipif == NULL);
6440 		ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6441 		VERIFY(ipx->ipx_reentry_cnt++ == 0);
6442 		ipx->ipx_writer = curthread;
6443 		ipx->ipx_forced = B_FALSE;
6444 #ifdef DEBUG
6445 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6446 #endif
6447 	}
6448 
6449 	xopipsq = ipsq;
6450 	do {
6451 		/*
6452 		 * So that other operations operate on a consistent and
6453 		 * complete phyint, a switch message on an IPSQ must be
6454 		 * handled prior to any other operations on that IPSQ.
6455 		 */
6456 		if ((mp = xopipsq->ipsq_switch_mp) != NULL) {
6457 			xopipsq->ipsq_switch_mp = NULL;
6458 			ASSERT(mp->b_next == NULL);
6459 			mp->b_next = (void *)xopipsq;
6460 			goto out;
6461 		}
6462 
6463 		if ((mp = xopipsq->ipsq_xopq_mphead) != NULL) {
6464 			xopipsq->ipsq_xopq_mphead = mp->b_next;
6465 			if (xopipsq->ipsq_xopq_mphead == NULL)
6466 				xopipsq->ipsq_xopq_mptail = NULL;
6467 			mp->b_next = (void *)xopipsq;
6468 			goto out;
6469 		}
6470 	} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6471 empty:
6472 	/*
6473 	 * There are no messages.  Further, we are holding ipx_lock, hence no
6474 	 * new messages can end up on any IPSQ in the xop.
6475 	 */
6476 	ipx->ipx_writer = NULL;
6477 	ipx->ipx_forced = B_FALSE;
6478 	VERIFY(--ipx->ipx_reentry_cnt == 0);
6479 	ipx->ipx_ipsq_queued = B_FALSE;
6480 	emptied = B_TRUE;
6481 #ifdef	DEBUG
6482 	ipx->ipx_depth = 0;
6483 #endif
6484 out:
6485 	mutex_exit(&ipx->ipx_lock);
6486 	mutex_exit(&ipsq->ipsq_lock);
6487 
6488 	/*
6489 	 * If we completely emptied the xop, then wake up any threads waiting
6490 	 * to enter any of the IPSQ's associated with it.
6491 	 */
6492 	if (emptied) {
6493 		xopipsq = ipsq;
6494 		do {
6495 			if ((phyi = xopipsq->ipsq_phyint) == NULL)
6496 				continue;
6497 
6498 			illv4 = phyi->phyint_illv4;
6499 			illv6 = phyi->phyint_illv6;
6500 
6501 			GRAB_ILL_LOCKS(illv4, illv6);
6502 			if (illv4 != NULL)
6503 				cv_broadcast(&illv4->ill_cv);
6504 			if (illv6 != NULL)
6505 				cv_broadcast(&illv6->ill_cv);
6506 			RELEASE_ILL_LOCKS(illv4, illv6);
6507 		} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6508 	}
6509 	rw_exit(&ipst->ips_ill_g_lock);
6510 
6511 	/*
6512 	 * Now that all locks are dropped, exit the IPSQ we left.
6513 	 */
6514 	if (leftipsq != NULL)
6515 		ipsq_exit(leftipsq);
6516 
6517 	return (mp);
6518 }
6519 
6520 /*
6521  * Return completion status of previously initiated DLPI operations on
6522  * ills in the purview of an ipsq.
6523  */
6524 static boolean_t
6525 ipsq_dlpi_done(ipsq_t *ipsq)
6526 {
6527 	ipsq_t		*ipsq_start;
6528 	phyint_t	*phyi;
6529 	ill_t		*ill;
6530 
6531 	ASSERT(RW_LOCK_HELD(&ipsq->ipsq_ipst->ips_ill_g_lock));
6532 	ipsq_start = ipsq;
6533 
6534 	do {
6535 		/*
6536 		 * The only current users of this function are ipsq_try_enter
6537 		 * and ipsq_enter which have made sure that ipsq_writer is
6538 		 * NULL before we reach here. ill_dlpi_pending is modified
6539 		 * only by an ipsq writer
6540 		 */
6541 		ASSERT(ipsq->ipsq_xop->ipx_writer == NULL);
6542 		phyi = ipsq->ipsq_phyint;
6543 		/*
6544 		 * phyi could be NULL if a phyint that is part of an
6545 		 * IPMP group is being unplumbed. A more detailed
6546 		 * comment is in ipmp_grp_update_kstats()
6547 		 */
6548 		if (phyi != NULL) {
6549 			ill = phyi->phyint_illv4;
6550 			if (ill != NULL &&
6551 			    (ill->ill_dlpi_pending != DL_PRIM_INVAL ||
6552 			    ill->ill_arl_dlpi_pending))
6553 				return (B_FALSE);
6554 
6555 			ill = phyi->phyint_illv6;
6556 			if (ill != NULL &&
6557 			    ill->ill_dlpi_pending != DL_PRIM_INVAL)
6558 				return (B_FALSE);
6559 		}
6560 
6561 	} while ((ipsq = ipsq->ipsq_next) != ipsq_start);
6562 
6563 	return (B_TRUE);
6564 }
6565 
6566 /*
6567  * Enter the ipsq corresponding to ill, by waiting synchronously till
6568  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
6569  * will have to drain completely before ipsq_enter returns success.
6570  * ipx_current_ipif will be set if some exclusive op is in progress,
6571  * and the ipsq_exit logic will start the next enqueued op after
6572  * completion of the current op. If 'force' is used, we don't wait
6573  * for the enqueued ops. This is needed when a conn_close wants to
6574  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
6575  * of an ill can also use this option. But we dont' use it currently.
6576  */
6577 #define	ENTER_SQ_WAIT_TICKS 100
6578 boolean_t
6579 ipsq_enter(ill_t *ill, boolean_t force, int type)
6580 {
6581 	ipsq_t	*ipsq;
6582 	ipxop_t *ipx;
6583 	boolean_t waited_enough = B_FALSE;
6584 	ip_stack_t *ipst = ill->ill_ipst;
6585 
6586 	/*
6587 	 * Note that the relationship between ill and ipsq is fixed as long as
6588 	 * the ill is not ILL_CONDEMNED.  Holding ipsq_lock ensures the
6589 	 * relationship between the IPSQ and xop cannot change.  However,
6590 	 * since we cannot hold ipsq_lock across the cv_wait(), it may change
6591 	 * while we're waiting.  We wait on ill_cv and rely on ipsq_exit()
6592 	 * waking up all ills in the xop when it becomes available.
6593 	 */
6594 	for (;;) {
6595 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6596 		mutex_enter(&ill->ill_lock);
6597 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6598 			mutex_exit(&ill->ill_lock);
6599 			rw_exit(&ipst->ips_ill_g_lock);
6600 			return (B_FALSE);
6601 		}
6602 
6603 		ipsq = ill->ill_phyint->phyint_ipsq;
6604 		mutex_enter(&ipsq->ipsq_lock);
6605 		ipx = ipsq->ipsq_xop;
6606 		mutex_enter(&ipx->ipx_lock);
6607 
6608 		if (ipx->ipx_writer == NULL && (type == CUR_OP ||
6609 		    (ipx->ipx_current_ipif == NULL && ipsq_dlpi_done(ipsq)) ||
6610 		    waited_enough))
6611 			break;
6612 
6613 		rw_exit(&ipst->ips_ill_g_lock);
6614 
6615 		if (!force || ipx->ipx_writer != NULL) {
6616 			mutex_exit(&ipx->ipx_lock);
6617 			mutex_exit(&ipsq->ipsq_lock);
6618 			cv_wait(&ill->ill_cv, &ill->ill_lock);
6619 		} else {
6620 			mutex_exit(&ipx->ipx_lock);
6621 			mutex_exit(&ipsq->ipsq_lock);
6622 			(void) cv_reltimedwait(&ill->ill_cv,
6623 			    &ill->ill_lock, ENTER_SQ_WAIT_TICKS, TR_CLOCK_TICK);
6624 			waited_enough = B_TRUE;
6625 		}
6626 		mutex_exit(&ill->ill_lock);
6627 	}
6628 
6629 	ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6630 	ASSERT(ipx->ipx_reentry_cnt == 0);
6631 	ipx->ipx_writer = curthread;
6632 	ipx->ipx_forced = (ipx->ipx_current_ipif != NULL);
6633 	ipx->ipx_reentry_cnt++;
6634 #ifdef DEBUG
6635 	ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6636 #endif
6637 	mutex_exit(&ipx->ipx_lock);
6638 	mutex_exit(&ipsq->ipsq_lock);
6639 	mutex_exit(&ill->ill_lock);
6640 	rw_exit(&ipst->ips_ill_g_lock);
6641 
6642 	return (B_TRUE);
6643 }
6644 
6645 /*
6646  * ipif_set_values() has a constraint that it cannot drop the ips_ill_g_lock
6647  * across the call to the core interface ipsq_try_enter() and hence calls this
6648  * function directly. This is explained more fully in ipif_set_values().
6649  * In order to support the above constraint, ipsq_try_enter is implemented as
6650  * a wrapper that grabs the ips_ill_g_lock and calls this function subsequently
6651  */
6652 static ipsq_t *
6653 ipsq_try_enter_internal(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func,
6654     int type, boolean_t reentry_ok)
6655 {
6656 	ipsq_t	*ipsq;
6657 	ipxop_t	*ipx;
6658 	ip_stack_t *ipst = ill->ill_ipst;
6659 
6660 	/*
6661 	 * lock ordering:
6662 	 * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock.
6663 	 *
6664 	 * ipx of an ipsq can't change when ipsq_lock is held.
6665 	 */
6666 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
6667 	GRAB_CONN_LOCK(q);
6668 	mutex_enter(&ill->ill_lock);
6669 	ipsq = ill->ill_phyint->phyint_ipsq;
6670 	mutex_enter(&ipsq->ipsq_lock);
6671 	ipx = ipsq->ipsq_xop;
6672 	mutex_enter(&ipx->ipx_lock);
6673 
6674 	/*
6675 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
6676 	 *    (Note: If the caller does not specify reentry_ok then neither
6677 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
6678 	 *    again. Otherwise it can lead to an infinite loop
6679 	 * 2. Enter the ipsq if there is no current writer and this attempted
6680 	 *    entry is part of the current operation
6681 	 * 3. Enter the ipsq if there is no current writer and this is a new
6682 	 *    operation and the operation queue is empty and there is no
6683 	 *    operation currently in progress and if all previously initiated
6684 	 *    DLPI operations have completed.
6685 	 */
6686 	if ((ipx->ipx_writer == curthread && reentry_ok) ||
6687 	    (ipx->ipx_writer == NULL && (type == CUR_OP || (type == NEW_OP &&
6688 	    !ipx->ipx_ipsq_queued && ipx->ipx_current_ipif == NULL &&
6689 	    ipsq_dlpi_done(ipsq))))) {
6690 		/* Success. */
6691 		ipx->ipx_reentry_cnt++;
6692 		ipx->ipx_writer = curthread;
6693 		ipx->ipx_forced = B_FALSE;
6694 		mutex_exit(&ipx->ipx_lock);
6695 		mutex_exit(&ipsq->ipsq_lock);
6696 		mutex_exit(&ill->ill_lock);
6697 		RELEASE_CONN_LOCK(q);
6698 #ifdef DEBUG
6699 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6700 #endif
6701 		return (ipsq);
6702 	}
6703 
6704 	if (func != NULL)
6705 		ipsq_enq(ipsq, q, mp, func, type, ill);
6706 
6707 	mutex_exit(&ipx->ipx_lock);
6708 	mutex_exit(&ipsq->ipsq_lock);
6709 	mutex_exit(&ill->ill_lock);
6710 	RELEASE_CONN_LOCK(q);
6711 	return (NULL);
6712 }
6713 
6714 /*
6715  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
6716  * certain critical operations like plumbing (i.e. most set ioctls), etc.
6717  * There is one ipsq per phyint. The ipsq
6718  * serializes exclusive ioctls issued by applications on a per ipsq basis in
6719  * ipsq_xopq_mphead. It also protects against multiple threads executing in
6720  * the ipsq. Responses from the driver pertain to the current ioctl (say a
6721  * DL_BIND_ACK in response to a DL_BIND_REQ initiated as part of bringing
6722  * up the interface) and are enqueued in ipx_mphead.
6723  *
6724  * If a thread does not want to reenter the ipsq when it is already writer,
6725  * it must make sure that the specified reentry point to be called later
6726  * when the ipsq is empty, nor any code path starting from the specified reentry
6727  * point must never ever try to enter the ipsq again. Otherwise it can lead
6728  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
6729  * When the thread that is currently exclusive finishes, it (ipsq_exit)
6730  * dequeues the requests waiting to become exclusive in ipx_mphead and calls
6731  * the reentry point. When the list at ipx_mphead becomes empty ipsq_exit
6732  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
6733  * ioctl if the current ioctl has completed. If the current ioctl is still
6734  * in progress it simply returns. The current ioctl could be waiting for
6735  * a response from another module (the driver or could be waiting for
6736  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipx_pending_mp
6737  * and ipx_pending_ipif are set. ipx_current_ipif is set throughout the
6738  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
6739  * ipx_current_ipif is NULL which happens only once the ioctl is complete and
6740  * all associated DLPI operations have completed.
6741  */
6742 
6743 /*
6744  * Try to enter the IPSQ corresponding to `ipif' or `ill' exclusively (`ipif'
6745  * and `ill' cannot both be specified).  Returns a pointer to the entered IPSQ
6746  * on success, or NULL on failure.  The caller ensures ipif/ill is valid by
6747  * refholding it as necessary.  If the IPSQ cannot be entered and `func' is
6748  * non-NULL, then `func' will be called back with `q' and `mp' once the IPSQ
6749  * can be entered.  If `func' is NULL, then `q' and `mp' are ignored.
6750  */
6751 ipsq_t *
6752 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
6753     ipsq_func_t func, int type, boolean_t reentry_ok)
6754 {
6755 	ip_stack_t	*ipst;
6756 	ipsq_t		*ipsq;
6757 
6758 	/* Only 1 of ipif or ill can be specified */
6759 	ASSERT((ipif != NULL) ^ (ill != NULL));
6760 
6761 	if (ipif != NULL)
6762 		ill = ipif->ipif_ill;
6763 	ipst = ill->ill_ipst;
6764 
6765 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6766 	ipsq = ipsq_try_enter_internal(ill, q, mp, func, type, reentry_ok);
6767 	rw_exit(&ipst->ips_ill_g_lock);
6768 
6769 	return (ipsq);
6770 }
6771 
6772 /*
6773  * Try to enter the IPSQ corresponding to `ill' as writer.  The caller ensures
6774  * ill is valid by refholding it if necessary; we will refrele.  If the IPSQ
6775  * cannot be entered, the mp is queued for completion.
6776  */
6777 void
6778 qwriter_ip(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6779     boolean_t reentry_ok)
6780 {
6781 	ipsq_t	*ipsq;
6782 
6783 	ipsq = ipsq_try_enter(NULL, ill, q, mp, func, type, reentry_ok);
6784 
6785 	/*
6786 	 * Drop the caller's refhold on the ill.  This is safe since we either
6787 	 * entered the IPSQ (and thus are exclusive), or failed to enter the
6788 	 * IPSQ, in which case we return without accessing ill anymore.  This
6789 	 * is needed because func needs to see the correct refcount.
6790 	 * e.g. removeif can work only then.
6791 	 */
6792 	ill_refrele(ill);
6793 	if (ipsq != NULL) {
6794 		(*func)(ipsq, q, mp, NULL);
6795 		ipsq_exit(ipsq);
6796 	}
6797 }
6798 
6799 /*
6800  * Exit the specified IPSQ.  If this is the final exit on it then drain it
6801  * prior to exiting.  Caller must be writer on the specified IPSQ.
6802  */
6803 void
6804 ipsq_exit(ipsq_t *ipsq)
6805 {
6806 	mblk_t *mp;
6807 	ipsq_t *mp_ipsq;
6808 	queue_t	*q;
6809 	phyint_t *phyi;
6810 	ipsq_func_t func;
6811 
6812 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6813 
6814 	ASSERT(ipsq->ipsq_xop->ipx_reentry_cnt >= 1);
6815 	if (ipsq->ipsq_xop->ipx_reentry_cnt != 1) {
6816 		ipsq->ipsq_xop->ipx_reentry_cnt--;
6817 		return;
6818 	}
6819 
6820 	for (;;) {
6821 		phyi = ipsq->ipsq_phyint;
6822 		mp = ipsq_dq(ipsq);
6823 		mp_ipsq = (mp == NULL) ? NULL : (ipsq_t *)mp->b_next;
6824 
6825 		/*
6826 		 * If we've changed to a new IPSQ, and the phyint associated
6827 		 * with the old one has gone away, free the old IPSQ.  Note
6828 		 * that this cannot happen while the IPSQ is in a group.
6829 		 */
6830 		if (mp_ipsq != ipsq && phyi == NULL) {
6831 			ASSERT(ipsq->ipsq_next == ipsq);
6832 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6833 			ipsq_delete(ipsq);
6834 		}
6835 
6836 		if (mp == NULL)
6837 			break;
6838 
6839 		q = mp->b_queue;
6840 		func = (ipsq_func_t)mp->b_prev;
6841 		ipsq = mp_ipsq;
6842 		mp->b_next = mp->b_prev = NULL;
6843 		mp->b_queue = NULL;
6844 
6845 		/*
6846 		 * If 'q' is an conn queue, it is valid, since we did a
6847 		 * a refhold on the conn at the start of the ioctl.
6848 		 * If 'q' is an ill queue, it is valid, since close of an
6849 		 * ill will clean up its IPSQ.
6850 		 */
6851 		(*func)(ipsq, q, mp, NULL);
6852 	}
6853 }
6854 
6855 /*
6856  * Used to start any igmp or mld timers that could not be started
6857  * while holding ill_mcast_lock. The timers can't be started while holding
6858  * the lock, since mld/igmp_start_timers may need to call untimeout()
6859  * which can't be done while holding the lock which the timeout handler
6860  * acquires. Otherwise
6861  * there could be a deadlock since the timeout handlers
6862  * mld_timeout_handler_per_ill/igmp_timeout_handler_per_ill also acquire
6863  * ill_mcast_lock.
6864  */
6865 void
6866 ill_mcast_timer_start(ip_stack_t *ipst)
6867 {
6868 	int		next;
6869 
6870 	mutex_enter(&ipst->ips_igmp_timer_lock);
6871 	next = ipst->ips_igmp_deferred_next;
6872 	ipst->ips_igmp_deferred_next = INFINITY;
6873 	mutex_exit(&ipst->ips_igmp_timer_lock);
6874 
6875 	if (next != INFINITY)
6876 		igmp_start_timers(next, ipst);
6877 
6878 	mutex_enter(&ipst->ips_mld_timer_lock);
6879 	next = ipst->ips_mld_deferred_next;
6880 	ipst->ips_mld_deferred_next = INFINITY;
6881 	mutex_exit(&ipst->ips_mld_timer_lock);
6882 
6883 	if (next != INFINITY)
6884 		mld_start_timers(next, ipst);
6885 }
6886 
6887 /*
6888  * Start the current exclusive operation on `ipsq'; associate it with `ipif'
6889  * and `ioccmd'.
6890  */
6891 void
6892 ipsq_current_start(ipsq_t *ipsq, ipif_t *ipif, int ioccmd)
6893 {
6894 	ill_t *ill = ipif->ipif_ill;
6895 	ipxop_t *ipx = ipsq->ipsq_xop;
6896 
6897 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6898 	ASSERT(ipx->ipx_current_ipif == NULL);
6899 	ASSERT(ipx->ipx_current_ioctl == 0);
6900 
6901 	ipx->ipx_current_done = B_FALSE;
6902 	ipx->ipx_current_ioctl = ioccmd;
6903 	mutex_enter(&ipx->ipx_lock);
6904 	ipx->ipx_current_ipif = ipif;
6905 	mutex_exit(&ipx->ipx_lock);
6906 
6907 	/*
6908 	 * Set IPIF_CHANGING on one or more ipifs associated with the
6909 	 * current exclusive operation.  IPIF_CHANGING prevents any new
6910 	 * references to the ipif (so that the references will eventually
6911 	 * drop to zero) and also prevents any "get" operations (e.g.,
6912 	 * SIOCGLIFFLAGS) from being able to access the ipif until the
6913 	 * operation has completed and the ipif is again in a stable state.
6914 	 *
6915 	 * For ioctls, IPIF_CHANGING is set on the ipif associated with the
6916 	 * ioctl.  For internal operations (where ioccmd is zero), all ipifs
6917 	 * on the ill are marked with IPIF_CHANGING since it's unclear which
6918 	 * ipifs will be affected.
6919 	 *
6920 	 * Note that SIOCLIFREMOVEIF is a special case as it sets
6921 	 * IPIF_CONDEMNED internally after identifying the right ipif to
6922 	 * operate on.
6923 	 */
6924 	switch (ioccmd) {
6925 	case SIOCLIFREMOVEIF:
6926 		break;
6927 	case 0:
6928 		mutex_enter(&ill->ill_lock);
6929 		ipif = ipif->ipif_ill->ill_ipif;
6930 		for (; ipif != NULL; ipif = ipif->ipif_next)
6931 			ipif->ipif_state_flags |= IPIF_CHANGING;
6932 		mutex_exit(&ill->ill_lock);
6933 		break;
6934 	default:
6935 		mutex_enter(&ill->ill_lock);
6936 		ipif->ipif_state_flags |= IPIF_CHANGING;
6937 		mutex_exit(&ill->ill_lock);
6938 	}
6939 }
6940 
6941 /*
6942  * Finish the current exclusive operation on `ipsq'.  Usually, this will allow
6943  * the next exclusive operation to begin once we ipsq_exit().  However, if
6944  * pending DLPI operations remain, then we will wait for the queue to drain
6945  * before allowing the next exclusive operation to begin.  This ensures that
6946  * DLPI operations from one exclusive operation are never improperly processed
6947  * as part of a subsequent exclusive operation.
6948  */
6949 void
6950 ipsq_current_finish(ipsq_t *ipsq)
6951 {
6952 	ipxop_t	*ipx = ipsq->ipsq_xop;
6953 	t_uscalar_t dlpi_pending = DL_PRIM_INVAL;
6954 	ipif_t	*ipif = ipx->ipx_current_ipif;
6955 
6956 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6957 
6958 	/*
6959 	 * For SIOCLIFREMOVEIF, the ipif has been already been blown away
6960 	 * (but in that case, IPIF_CHANGING will already be clear and no
6961 	 * pending DLPI messages can remain).
6962 	 */
6963 	if (ipx->ipx_current_ioctl != SIOCLIFREMOVEIF) {
6964 		ill_t *ill = ipif->ipif_ill;
6965 
6966 		mutex_enter(&ill->ill_lock);
6967 		dlpi_pending = ill->ill_dlpi_pending;
6968 		if (ipx->ipx_current_ioctl == 0) {
6969 			ipif = ill->ill_ipif;
6970 			for (; ipif != NULL; ipif = ipif->ipif_next)
6971 				ipif->ipif_state_flags &= ~IPIF_CHANGING;
6972 		} else {
6973 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
6974 		}
6975 		mutex_exit(&ill->ill_lock);
6976 	}
6977 
6978 	ASSERT(!ipx->ipx_current_done);
6979 	ipx->ipx_current_done = B_TRUE;
6980 	ipx->ipx_current_ioctl = 0;
6981 	if (dlpi_pending == DL_PRIM_INVAL) {
6982 		mutex_enter(&ipx->ipx_lock);
6983 		ipx->ipx_current_ipif = NULL;
6984 		mutex_exit(&ipx->ipx_lock);
6985 	}
6986 }
6987 
6988 /*
6989  * The ill is closing. Flush all messages on the ipsq that originated
6990  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
6991  * for this ill since ipsq_enter could not have entered until then.
6992  * New messages can't be queued since the CONDEMNED flag is set.
6993  */
6994 static void
6995 ipsq_flush(ill_t *ill)
6996 {
6997 	queue_t	*q;
6998 	mblk_t	*prev;
6999 	mblk_t	*mp;
7000 	mblk_t	*mp_next;
7001 	ipxop_t	*ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
7002 
7003 	ASSERT(IAM_WRITER_ILL(ill));
7004 
7005 	/*
7006 	 * Flush any messages sent up by the driver.
7007 	 */
7008 	mutex_enter(&ipx->ipx_lock);
7009 	for (prev = NULL, mp = ipx->ipx_mphead; mp != NULL; mp = mp_next) {
7010 		mp_next = mp->b_next;
7011 		q = mp->b_queue;
7012 		if (q == ill->ill_rq || q == ill->ill_wq) {
7013 			/* dequeue mp */
7014 			if (prev == NULL)
7015 				ipx->ipx_mphead = mp->b_next;
7016 			else
7017 				prev->b_next = mp->b_next;
7018 			if (ipx->ipx_mptail == mp) {
7019 				ASSERT(mp_next == NULL);
7020 				ipx->ipx_mptail = prev;
7021 			}
7022 			inet_freemsg(mp);
7023 		} else {
7024 			prev = mp;
7025 		}
7026 	}
7027 	mutex_exit(&ipx->ipx_lock);
7028 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7029 	ipsq_xopq_mp_cleanup(ill, NULL);
7030 }
7031 
7032 /*
7033  * Parse an ifreq or lifreq struct coming down ioctls and refhold
7034  * and return the associated ipif.
7035  * Return value:
7036  *	Non zero: An error has occurred. ci may not be filled out.
7037  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
7038  *	a held ipif in ci.ci_ipif.
7039  */
7040 int
7041 ip_extract_lifreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
7042     cmd_info_t *ci)
7043 {
7044 	char		*name;
7045 	struct ifreq    *ifr;
7046 	struct lifreq    *lifr;
7047 	ipif_t		*ipif = NULL;
7048 	ill_t		*ill;
7049 	conn_t		*connp;
7050 	boolean_t	isv6;
7051 	int		err;
7052 	mblk_t		*mp1;
7053 	zoneid_t	zoneid;
7054 	ip_stack_t	*ipst;
7055 
7056 	if (q->q_next != NULL) {
7057 		ill = (ill_t *)q->q_ptr;
7058 		isv6 = ill->ill_isv6;
7059 		connp = NULL;
7060 		zoneid = ALL_ZONES;
7061 		ipst = ill->ill_ipst;
7062 	} else {
7063 		ill = NULL;
7064 		connp = Q_TO_CONN(q);
7065 		isv6 = (connp->conn_family == AF_INET6);
7066 		zoneid = connp->conn_zoneid;
7067 		if (zoneid == GLOBAL_ZONEID) {
7068 			/* global zone can access ipifs in all zones */
7069 			zoneid = ALL_ZONES;
7070 		}
7071 		ipst = connp->conn_netstack->netstack_ip;
7072 	}
7073 
7074 	/* Has been checked in ip_wput_nondata */
7075 	mp1 = mp->b_cont->b_cont;
7076 
7077 	if (ipip->ipi_cmd_type == IF_CMD) {
7078 		/* This a old style SIOC[GS]IF* command */
7079 		ifr = (struct ifreq *)mp1->b_rptr;
7080 		/*
7081 		 * Null terminate the string to protect against buffer
7082 		 * overrun. String was generated by user code and may not
7083 		 * be trusted.
7084 		 */
7085 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
7086 		name = ifr->ifr_name;
7087 		ci->ci_sin = (sin_t *)&ifr->ifr_addr;
7088 		ci->ci_sin6 = NULL;
7089 		ci->ci_lifr = (struct lifreq *)ifr;
7090 	} else {
7091 		/* This a new style SIOC[GS]LIF* command */
7092 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
7093 		lifr = (struct lifreq *)mp1->b_rptr;
7094 		/*
7095 		 * Null terminate the string to protect against buffer
7096 		 * overrun. String was generated by user code and may not
7097 		 * be trusted.
7098 		 */
7099 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
7100 		name = lifr->lifr_name;
7101 		ci->ci_sin = (sin_t *)&lifr->lifr_addr;
7102 		ci->ci_sin6 = (sin6_t *)&lifr->lifr_addr;
7103 		ci->ci_lifr = lifr;
7104 	}
7105 
7106 	if (ipip->ipi_cmd == SIOCSLIFNAME) {
7107 		/*
7108 		 * The ioctl will be failed if the ioctl comes down
7109 		 * an conn stream
7110 		 */
7111 		if (ill == NULL) {
7112 			/*
7113 			 * Not an ill queue, return EINVAL same as the
7114 			 * old error code.
7115 			 */
7116 			return (ENXIO);
7117 		}
7118 		ipif = ill->ill_ipif;
7119 		ipif_refhold(ipif);
7120 	} else {
7121 		/*
7122 		 * Ensure that ioctls don't see any internal state changes
7123 		 * caused by set ioctls by deferring them if IPIF_CHANGING is
7124 		 * set.
7125 		 */
7126 		ipif = ipif_lookup_on_name_async(name, mi_strlen(name),
7127 		    isv6, zoneid, q, mp, ip_process_ioctl, &err, ipst);
7128 		if (ipif == NULL) {
7129 			if (err == EINPROGRESS)
7130 				return (err);
7131 			err = 0;	/* Ensure we don't use it below */
7132 		}
7133 	}
7134 
7135 	/*
7136 	 * Old style [GS]IFCMD does not admit IPv6 ipif
7137 	 */
7138 	if (ipif != NULL && ipif->ipif_isv6 && ipip->ipi_cmd_type == IF_CMD) {
7139 		ipif_refrele(ipif);
7140 		return (ENXIO);
7141 	}
7142 
7143 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
7144 	    name[0] == '\0') {
7145 		/*
7146 		 * Handle a or a SIOC?IF* with a null name
7147 		 * during plumb (on the ill queue before the I_PLINK).
7148 		 */
7149 		ipif = ill->ill_ipif;
7150 		ipif_refhold(ipif);
7151 	}
7152 
7153 	if (ipif == NULL)
7154 		return (ENXIO);
7155 
7156 	DTRACE_PROBE4(ipif__ioctl, char *, "ip_extract_lifreq",
7157 	    int, ipip->ipi_cmd, ill_t *, ipif->ipif_ill, ipif_t *, ipif);
7158 
7159 	ci->ci_ipif = ipif;
7160 	return (0);
7161 }
7162 
7163 /*
7164  * Return the total number of ipifs.
7165  */
7166 static uint_t
7167 ip_get_numifs(zoneid_t zoneid, ip_stack_t *ipst)
7168 {
7169 	uint_t numifs = 0;
7170 	ill_t	*ill;
7171 	ill_walk_context_t	ctx;
7172 	ipif_t	*ipif;
7173 
7174 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7175 	ill = ILL_START_WALK_V4(&ctx, ipst);
7176 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7177 		if (IS_UNDER_IPMP(ill))
7178 			continue;
7179 		for (ipif = ill->ill_ipif; ipif != NULL;
7180 		    ipif = ipif->ipif_next) {
7181 			if (ipif->ipif_zoneid == zoneid ||
7182 			    ipif->ipif_zoneid == ALL_ZONES)
7183 				numifs++;
7184 		}
7185 	}
7186 	rw_exit(&ipst->ips_ill_g_lock);
7187 	return (numifs);
7188 }
7189 
7190 /*
7191  * Return the total number of ipifs.
7192  */
7193 static uint_t
7194 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid, ip_stack_t *ipst)
7195 {
7196 	uint_t numifs = 0;
7197 	ill_t	*ill;
7198 	ipif_t	*ipif;
7199 	ill_walk_context_t	ctx;
7200 
7201 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
7202 
7203 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7204 	if (family == AF_INET)
7205 		ill = ILL_START_WALK_V4(&ctx, ipst);
7206 	else if (family == AF_INET6)
7207 		ill = ILL_START_WALK_V6(&ctx, ipst);
7208 	else
7209 		ill = ILL_START_WALK_ALL(&ctx, ipst);
7210 
7211 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7212 		if (IS_UNDER_IPMP(ill) && !(lifn_flags & LIFC_UNDER_IPMP))
7213 			continue;
7214 
7215 		for (ipif = ill->ill_ipif; ipif != NULL;
7216 		    ipif = ipif->ipif_next) {
7217 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7218 			    !(lifn_flags & LIFC_NOXMIT))
7219 				continue;
7220 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7221 			    !(lifn_flags & LIFC_TEMPORARY))
7222 				continue;
7223 			if (((ipif->ipif_flags &
7224 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7225 			    IPIF_DEPRECATED)) ||
7226 			    IS_LOOPBACK(ill) ||
7227 			    !(ipif->ipif_flags & IPIF_UP)) &&
7228 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
7229 				continue;
7230 
7231 			if (zoneid != ipif->ipif_zoneid &&
7232 			    ipif->ipif_zoneid != ALL_ZONES &&
7233 			    (zoneid != GLOBAL_ZONEID ||
7234 			    !(lifn_flags & LIFC_ALLZONES)))
7235 				continue;
7236 
7237 			numifs++;
7238 		}
7239 	}
7240 	rw_exit(&ipst->ips_ill_g_lock);
7241 	return (numifs);
7242 }
7243 
7244 uint_t
7245 ip_get_lifsrcofnum(ill_t *ill)
7246 {
7247 	uint_t numifs = 0;
7248 	ill_t	*ill_head = ill;
7249 	ip_stack_t	*ipst = ill->ill_ipst;
7250 
7251 	/*
7252 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
7253 	 * other thread may be trying to relink the ILLs in this usesrc group
7254 	 * and adjusting the ill_usesrc_grp_next pointers
7255 	 */
7256 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7257 	if ((ill->ill_usesrc_ifindex == 0) &&
7258 	    (ill->ill_usesrc_grp_next != NULL)) {
7259 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
7260 		    ill = ill->ill_usesrc_grp_next)
7261 			numifs++;
7262 	}
7263 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
7264 
7265 	return (numifs);
7266 }
7267 
7268 /* Null values are passed in for ipif, sin, and ifreq */
7269 /* ARGSUSED */
7270 int
7271 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7272     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7273 {
7274 	int *nump;
7275 	conn_t *connp = Q_TO_CONN(q);
7276 
7277 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7278 
7279 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
7280 	nump = (int *)mp->b_cont->b_cont->b_rptr;
7281 
7282 	*nump = ip_get_numifs(connp->conn_zoneid,
7283 	    connp->conn_netstack->netstack_ip);
7284 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
7285 	return (0);
7286 }
7287 
7288 /* Null values are passed in for ipif, sin, and ifreq */
7289 /* ARGSUSED */
7290 int
7291 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
7292     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7293 {
7294 	struct lifnum *lifn;
7295 	mblk_t	*mp1;
7296 	conn_t *connp = Q_TO_CONN(q);
7297 
7298 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7299 
7300 	/* Existence checked in ip_wput_nondata */
7301 	mp1 = mp->b_cont->b_cont;
7302 
7303 	lifn = (struct lifnum *)mp1->b_rptr;
7304 	switch (lifn->lifn_family) {
7305 	case AF_UNSPEC:
7306 	case AF_INET:
7307 	case AF_INET6:
7308 		break;
7309 	default:
7310 		return (EAFNOSUPPORT);
7311 	}
7312 
7313 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
7314 	    connp->conn_zoneid, connp->conn_netstack->netstack_ip);
7315 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
7316 	return (0);
7317 }
7318 
7319 /* ARGSUSED */
7320 int
7321 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7322     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7323 {
7324 	STRUCT_HANDLE(ifconf, ifc);
7325 	mblk_t *mp1;
7326 	struct iocblk *iocp;
7327 	struct ifreq *ifr;
7328 	ill_walk_context_t	ctx;
7329 	ill_t	*ill;
7330 	ipif_t	*ipif;
7331 	struct sockaddr_in *sin;
7332 	int32_t	ifclen;
7333 	zoneid_t zoneid;
7334 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
7335 
7336 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
7337 
7338 	ip1dbg(("ip_sioctl_get_ifconf"));
7339 	/* Existence verified in ip_wput_nondata */
7340 	mp1 = mp->b_cont->b_cont;
7341 	iocp = (struct iocblk *)mp->b_rptr;
7342 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7343 
7344 	/*
7345 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
7346 	 * the user buffer address and length into which the list of struct
7347 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
7348 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
7349 	 * the SIOCGIFCONF operation was redefined to simply provide
7350 	 * a large output buffer into which we are supposed to jam the ifreq
7351 	 * array.  The same ioctl command code was used, despite the fact that
7352 	 * both the applications and the kernel code had to change, thus making
7353 	 * it impossible to support both interfaces.
7354 	 *
7355 	 * For reasons not good enough to try to explain, the following
7356 	 * algorithm is used for deciding what to do with one of these:
7357 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
7358 	 * form with the output buffer coming down as the continuation message.
7359 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
7360 	 * and we have to copy in the ifconf structure to find out how big the
7361 	 * output buffer is and where to copy out to.  Sure no problem...
7362 	 *
7363 	 */
7364 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
7365 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
7366 		int numifs = 0;
7367 		size_t ifc_bufsize;
7368 
7369 		/*
7370 		 * Must be (better be!) continuation of a TRANSPARENT
7371 		 * IOCTL.  We just copied in the ifconf structure.
7372 		 */
7373 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
7374 		    (struct ifconf *)mp1->b_rptr);
7375 
7376 		/*
7377 		 * Allocate a buffer to hold requested information.
7378 		 *
7379 		 * If ifc_len is larger than what is needed, we only
7380 		 * allocate what we will use.
7381 		 *
7382 		 * If ifc_len is smaller than what is needed, return
7383 		 * EINVAL.
7384 		 *
7385 		 * XXX: the ill_t structure can hava 2 counters, for
7386 		 * v4 and v6 (not just ill_ipif_up_count) to store the
7387 		 * number of interfaces for a device, so we don't need
7388 		 * to count them here...
7389 		 */
7390 		numifs = ip_get_numifs(zoneid, ipst);
7391 
7392 		ifclen = STRUCT_FGET(ifc, ifc_len);
7393 		ifc_bufsize = numifs * sizeof (struct ifreq);
7394 		if (ifc_bufsize > ifclen) {
7395 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7396 				/* old behaviour */
7397 				return (EINVAL);
7398 			} else {
7399 				ifc_bufsize = ifclen;
7400 			}
7401 		}
7402 
7403 		mp1 = mi_copyout_alloc(q, mp,
7404 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
7405 		if (mp1 == NULL)
7406 			return (ENOMEM);
7407 
7408 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
7409 	}
7410 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7411 	/*
7412 	 * the SIOCGIFCONF ioctl only knows about
7413 	 * IPv4 addresses, so don't try to tell
7414 	 * it about interfaces with IPv6-only
7415 	 * addresses. (Last parm 'isv6' is B_FALSE)
7416 	 */
7417 
7418 	ifr = (struct ifreq *)mp1->b_rptr;
7419 
7420 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7421 	ill = ILL_START_WALK_V4(&ctx, ipst);
7422 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7423 		if (IS_UNDER_IPMP(ill))
7424 			continue;
7425 		for (ipif = ill->ill_ipif; ipif != NULL;
7426 		    ipif = ipif->ipif_next) {
7427 			if (zoneid != ipif->ipif_zoneid &&
7428 			    ipif->ipif_zoneid != ALL_ZONES)
7429 				continue;
7430 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
7431 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7432 					/* old behaviour */
7433 					rw_exit(&ipst->ips_ill_g_lock);
7434 					return (EINVAL);
7435 				} else {
7436 					goto if_copydone;
7437 				}
7438 			}
7439 			ipif_get_name(ipif, ifr->ifr_name,
7440 			    sizeof (ifr->ifr_name));
7441 			sin = (sin_t *)&ifr->ifr_addr;
7442 			*sin = sin_null;
7443 			sin->sin_family = AF_INET;
7444 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7445 			ifr++;
7446 		}
7447 	}
7448 if_copydone:
7449 	rw_exit(&ipst->ips_ill_g_lock);
7450 	mp1->b_wptr = (uchar_t *)ifr;
7451 
7452 	if (STRUCT_BUF(ifc) != NULL) {
7453 		STRUCT_FSET(ifc, ifc_len,
7454 		    (int)((uchar_t *)ifr - mp1->b_rptr));
7455 	}
7456 	return (0);
7457 }
7458 
7459 /*
7460  * Get the interfaces using the address hosted on the interface passed in,
7461  * as a source adddress
7462  */
7463 /* ARGSUSED */
7464 int
7465 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7466     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7467 {
7468 	mblk_t *mp1;
7469 	ill_t	*ill, *ill_head;
7470 	ipif_t	*ipif, *orig_ipif;
7471 	int	numlifs = 0;
7472 	size_t	lifs_bufsize, lifsmaxlen;
7473 	struct	lifreq *lifr;
7474 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7475 	uint_t	ifindex;
7476 	zoneid_t zoneid;
7477 	boolean_t isv6 = B_FALSE;
7478 	struct	sockaddr_in	*sin;
7479 	struct	sockaddr_in6	*sin6;
7480 	STRUCT_HANDLE(lifsrcof, lifs);
7481 	ip_stack_t		*ipst;
7482 
7483 	ipst = CONNQ_TO_IPST(q);
7484 
7485 	ASSERT(q->q_next == NULL);
7486 
7487 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7488 
7489 	/* Existence verified in ip_wput_nondata */
7490 	mp1 = mp->b_cont->b_cont;
7491 
7492 	/*
7493 	 * Must be (better be!) continuation of a TRANSPARENT
7494 	 * IOCTL.  We just copied in the lifsrcof structure.
7495 	 */
7496 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
7497 	    (struct lifsrcof *)mp1->b_rptr);
7498 
7499 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
7500 		return (EINVAL);
7501 
7502 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
7503 	isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
7504 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, ipst);
7505 	if (ipif == NULL) {
7506 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
7507 		    ifindex));
7508 		return (ENXIO);
7509 	}
7510 
7511 	/* Allocate a buffer to hold requested information */
7512 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
7513 	lifs_bufsize = numlifs * sizeof (struct lifreq);
7514 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
7515 	/* The actual size needed is always returned in lifs_len */
7516 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
7517 
7518 	/* If the amount we need is more than what is passed in, abort */
7519 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
7520 		ipif_refrele(ipif);
7521 		return (0);
7522 	}
7523 
7524 	mp1 = mi_copyout_alloc(q, mp,
7525 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
7526 	if (mp1 == NULL) {
7527 		ipif_refrele(ipif);
7528 		return (ENOMEM);
7529 	}
7530 
7531 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
7532 	bzero(mp1->b_rptr, lifs_bufsize);
7533 
7534 	lifr = (struct lifreq *)mp1->b_rptr;
7535 
7536 	ill = ill_head = ipif->ipif_ill;
7537 	orig_ipif = ipif;
7538 
7539 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
7540 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7541 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7542 
7543 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
7544 	for (; (ill != NULL) && (ill != ill_head);
7545 	    ill = ill->ill_usesrc_grp_next) {
7546 
7547 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
7548 			break;
7549 
7550 		ipif = ill->ill_ipif;
7551 		ipif_get_name(ipif, lifr->lifr_name, sizeof (lifr->lifr_name));
7552 		if (ipif->ipif_isv6) {
7553 			sin6 = (sin6_t *)&lifr->lifr_addr;
7554 			*sin6 = sin6_null;
7555 			sin6->sin6_family = AF_INET6;
7556 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
7557 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
7558 			    &ipif->ipif_v6net_mask);
7559 		} else {
7560 			sin = (sin_t *)&lifr->lifr_addr;
7561 			*sin = sin_null;
7562 			sin->sin_family = AF_INET;
7563 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7564 			lifr->lifr_addrlen = ip_mask_to_plen(
7565 			    ipif->ipif_net_mask);
7566 		}
7567 		lifr++;
7568 	}
7569 	rw_exit(&ipst->ips_ill_g_lock);
7570 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
7571 	ipif_refrele(orig_ipif);
7572 	mp1->b_wptr = (uchar_t *)lifr;
7573 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
7574 
7575 	return (0);
7576 }
7577 
7578 /* ARGSUSED */
7579 int
7580 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7581     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7582 {
7583 	mblk_t *mp1;
7584 	int	list;
7585 	ill_t	*ill;
7586 	ipif_t	*ipif;
7587 	int	flags;
7588 	int	numlifs = 0;
7589 	size_t	lifc_bufsize;
7590 	struct	lifreq *lifr;
7591 	sa_family_t	family;
7592 	struct	sockaddr_in	*sin;
7593 	struct	sockaddr_in6	*sin6;
7594 	ill_walk_context_t	ctx;
7595 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7596 	int32_t	lifclen;
7597 	zoneid_t zoneid;
7598 	STRUCT_HANDLE(lifconf, lifc);
7599 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
7600 
7601 	ip1dbg(("ip_sioctl_get_lifconf"));
7602 
7603 	ASSERT(q->q_next == NULL);
7604 
7605 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7606 
7607 	/* Existence verified in ip_wput_nondata */
7608 	mp1 = mp->b_cont->b_cont;
7609 
7610 	/*
7611 	 * An extended version of SIOCGIFCONF that takes an
7612 	 * additional address family and flags field.
7613 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
7614 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
7615 	 * interfaces are omitted.
7616 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
7617 	 * unless LIFC_TEMPORARY is specified.
7618 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
7619 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
7620 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
7621 	 * has priority over LIFC_NOXMIT.
7622 	 */
7623 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
7624 
7625 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
7626 		return (EINVAL);
7627 
7628 	/*
7629 	 * Must be (better be!) continuation of a TRANSPARENT
7630 	 * IOCTL.  We just copied in the lifconf structure.
7631 	 */
7632 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
7633 
7634 	family = STRUCT_FGET(lifc, lifc_family);
7635 	flags = STRUCT_FGET(lifc, lifc_flags);
7636 
7637 	switch (family) {
7638 	case AF_UNSPEC:
7639 		/*
7640 		 * walk all ILL's.
7641 		 */
7642 		list = MAX_G_HEADS;
7643 		break;
7644 	case AF_INET:
7645 		/*
7646 		 * walk only IPV4 ILL's.
7647 		 */
7648 		list = IP_V4_G_HEAD;
7649 		break;
7650 	case AF_INET6:
7651 		/*
7652 		 * walk only IPV6 ILL's.
7653 		 */
7654 		list = IP_V6_G_HEAD;
7655 		break;
7656 	default:
7657 		return (EAFNOSUPPORT);
7658 	}
7659 
7660 	/*
7661 	 * Allocate a buffer to hold requested information.
7662 	 *
7663 	 * If lifc_len is larger than what is needed, we only
7664 	 * allocate what we will use.
7665 	 *
7666 	 * If lifc_len is smaller than what is needed, return
7667 	 * EINVAL.
7668 	 */
7669 	numlifs = ip_get_numlifs(family, flags, zoneid, ipst);
7670 	lifc_bufsize = numlifs * sizeof (struct lifreq);
7671 	lifclen = STRUCT_FGET(lifc, lifc_len);
7672 	if (lifc_bufsize > lifclen) {
7673 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
7674 			return (EINVAL);
7675 		else
7676 			lifc_bufsize = lifclen;
7677 	}
7678 
7679 	mp1 = mi_copyout_alloc(q, mp,
7680 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
7681 	if (mp1 == NULL)
7682 		return (ENOMEM);
7683 
7684 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
7685 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7686 
7687 	lifr = (struct lifreq *)mp1->b_rptr;
7688 
7689 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7690 	ill = ill_first(list, list, &ctx, ipst);
7691 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7692 		if (IS_UNDER_IPMP(ill) && !(flags & LIFC_UNDER_IPMP))
7693 			continue;
7694 
7695 		for (ipif = ill->ill_ipif; ipif != NULL;
7696 		    ipif = ipif->ipif_next) {
7697 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7698 			    !(flags & LIFC_NOXMIT))
7699 				continue;
7700 
7701 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7702 			    !(flags & LIFC_TEMPORARY))
7703 				continue;
7704 
7705 			if (((ipif->ipif_flags &
7706 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7707 			    IPIF_DEPRECATED)) ||
7708 			    IS_LOOPBACK(ill) ||
7709 			    !(ipif->ipif_flags & IPIF_UP)) &&
7710 			    (flags & LIFC_EXTERNAL_SOURCE))
7711 				continue;
7712 
7713 			if (zoneid != ipif->ipif_zoneid &&
7714 			    ipif->ipif_zoneid != ALL_ZONES &&
7715 			    (zoneid != GLOBAL_ZONEID ||
7716 			    !(flags & LIFC_ALLZONES)))
7717 				continue;
7718 
7719 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
7720 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
7721 					rw_exit(&ipst->ips_ill_g_lock);
7722 					return (EINVAL);
7723 				} else {
7724 					goto lif_copydone;
7725 				}
7726 			}
7727 
7728 			ipif_get_name(ipif, lifr->lifr_name,
7729 			    sizeof (lifr->lifr_name));
7730 			lifr->lifr_type = ill->ill_type;
7731 			if (ipif->ipif_isv6) {
7732 				sin6 = (sin6_t *)&lifr->lifr_addr;
7733 				*sin6 = sin6_null;
7734 				sin6->sin6_family = AF_INET6;
7735 				sin6->sin6_addr =
7736 				    ipif->ipif_v6lcl_addr;
7737 				lifr->lifr_addrlen =
7738 				    ip_mask_to_plen_v6(
7739 				    &ipif->ipif_v6net_mask);
7740 			} else {
7741 				sin = (sin_t *)&lifr->lifr_addr;
7742 				*sin = sin_null;
7743 				sin->sin_family = AF_INET;
7744 				sin->sin_addr.s_addr =
7745 				    ipif->ipif_lcl_addr;
7746 				lifr->lifr_addrlen =
7747 				    ip_mask_to_plen(
7748 				    ipif->ipif_net_mask);
7749 			}
7750 			lifr++;
7751 		}
7752 	}
7753 lif_copydone:
7754 	rw_exit(&ipst->ips_ill_g_lock);
7755 
7756 	mp1->b_wptr = (uchar_t *)lifr;
7757 	if (STRUCT_BUF(lifc) != NULL) {
7758 		STRUCT_FSET(lifc, lifc_len,
7759 		    (int)((uchar_t *)lifr - mp1->b_rptr));
7760 	}
7761 	return (0);
7762 }
7763 
7764 static void
7765 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
7766 {
7767 	ip6_asp_t *table;
7768 	size_t table_size;
7769 	mblk_t *data_mp;
7770 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7771 	ip_stack_t	*ipst;
7772 
7773 	if (q->q_next == NULL)
7774 		ipst = CONNQ_TO_IPST(q);
7775 	else
7776 		ipst = ILLQ_TO_IPST(q);
7777 
7778 	/* These two ioctls are I_STR only */
7779 	if (iocp->ioc_count == TRANSPARENT) {
7780 		miocnak(q, mp, 0, EINVAL);
7781 		return;
7782 	}
7783 
7784 	data_mp = mp->b_cont;
7785 	if (data_mp == NULL) {
7786 		/* The user passed us a NULL argument */
7787 		table = NULL;
7788 		table_size = iocp->ioc_count;
7789 	} else {
7790 		/*
7791 		 * The user provided a table.  The stream head
7792 		 * may have copied in the user data in chunks,
7793 		 * so make sure everything is pulled up
7794 		 * properly.
7795 		 */
7796 		if (MBLKL(data_mp) < iocp->ioc_count) {
7797 			mblk_t *new_data_mp;
7798 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
7799 			    NULL) {
7800 				miocnak(q, mp, 0, ENOMEM);
7801 				return;
7802 			}
7803 			freemsg(data_mp);
7804 			data_mp = new_data_mp;
7805 			mp->b_cont = data_mp;
7806 		}
7807 		table = (ip6_asp_t *)data_mp->b_rptr;
7808 		table_size = iocp->ioc_count;
7809 	}
7810 
7811 	switch (iocp->ioc_cmd) {
7812 	case SIOCGIP6ADDRPOLICY:
7813 		iocp->ioc_rval = ip6_asp_get(table, table_size, ipst);
7814 		if (iocp->ioc_rval == -1)
7815 			iocp->ioc_error = EINVAL;
7816 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7817 		else if (table != NULL &&
7818 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
7819 			ip6_asp_t *src = table;
7820 			ip6_asp32_t *dst = (void *)table;
7821 			int count = table_size / sizeof (ip6_asp_t);
7822 			int i;
7823 
7824 			/*
7825 			 * We need to do an in-place shrink of the array
7826 			 * to match the alignment attributes of the
7827 			 * 32-bit ABI looking at it.
7828 			 */
7829 			/* LINTED: logical expression always true: op "||" */
7830 			ASSERT(sizeof (*src) > sizeof (*dst));
7831 			for (i = 1; i < count; i++)
7832 				bcopy(src + i, dst + i, sizeof (*dst));
7833 		}
7834 #endif
7835 		break;
7836 
7837 	case SIOCSIP6ADDRPOLICY:
7838 		ASSERT(mp->b_prev == NULL);
7839 		mp->b_prev = (void *)q;
7840 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7841 		/*
7842 		 * We pass in the datamodel here so that the ip6_asp_replace()
7843 		 * routine can handle converting from 32-bit to native formats
7844 		 * where necessary.
7845 		 *
7846 		 * A better way to handle this might be to convert the inbound
7847 		 * data structure here, and hang it off a new 'mp'; thus the
7848 		 * ip6_asp_replace() logic would always be dealing with native
7849 		 * format data structures..
7850 		 *
7851 		 * (An even simpler way to handle these ioctls is to just
7852 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
7853 		 * and just recompile everything that depends on it.)
7854 		 */
7855 #endif
7856 		ip6_asp_replace(mp, table, table_size, B_FALSE, ipst,
7857 		    iocp->ioc_flag & IOC_MODELS);
7858 		return;
7859 	}
7860 
7861 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
7862 	qreply(q, mp);
7863 }
7864 
7865 static void
7866 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
7867 {
7868 	mblk_t 		*data_mp;
7869 	struct dstinforeq	*dir;
7870 	uint8_t		*end, *cur;
7871 	in6_addr_t	*daddr, *saddr;
7872 	ipaddr_t	v4daddr;
7873 	ire_t		*ire;
7874 	ipaddr_t	v4setsrc;
7875 	in6_addr_t	v6setsrc;
7876 	char		*slabel, *dlabel;
7877 	boolean_t	isipv4;
7878 	int		match_ire;
7879 	ill_t		*dst_ill;
7880 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7881 	conn_t		*connp = Q_TO_CONN(q);
7882 	zoneid_t	zoneid = IPCL_ZONEID(connp);
7883 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
7884 	uint64_t	ipif_flags;
7885 
7886 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
7887 
7888 	/*
7889 	 * This ioctl is I_STR only, and must have a
7890 	 * data mblk following the M_IOCTL mblk.
7891 	 */
7892 	data_mp = mp->b_cont;
7893 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
7894 		miocnak(q, mp, 0, EINVAL);
7895 		return;
7896 	}
7897 
7898 	if (MBLKL(data_mp) < iocp->ioc_count) {
7899 		mblk_t *new_data_mp;
7900 
7901 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
7902 			miocnak(q, mp, 0, ENOMEM);
7903 			return;
7904 		}
7905 		freemsg(data_mp);
7906 		data_mp = new_data_mp;
7907 		mp->b_cont = data_mp;
7908 	}
7909 	match_ire = MATCH_IRE_DSTONLY;
7910 
7911 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
7912 	    end - cur >= sizeof (struct dstinforeq);
7913 	    cur += sizeof (struct dstinforeq)) {
7914 		dir = (struct dstinforeq *)cur;
7915 		daddr = &dir->dir_daddr;
7916 		saddr = &dir->dir_saddr;
7917 
7918 		/*
7919 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
7920 		 * v4 mapped addresses; ire_ftable_lookup_v6()
7921 		 * and ip_select_source_v6() do not.
7922 		 */
7923 		dir->dir_dscope = ip_addr_scope_v6(daddr);
7924 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence, ipst);
7925 
7926 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
7927 		if (isipv4) {
7928 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
7929 			v4setsrc = INADDR_ANY;
7930 			ire = ire_route_recursive_v4(v4daddr, 0, NULL, zoneid,
7931 			    NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v4setsrc,
7932 			    NULL, NULL);
7933 		} else {
7934 			v6setsrc = ipv6_all_zeros;
7935 			ire = ire_route_recursive_v6(daddr, 0, NULL, zoneid,
7936 			    NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v6setsrc,
7937 			    NULL, NULL);
7938 		}
7939 		ASSERT(ire != NULL);
7940 		if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
7941 			ire_refrele(ire);
7942 			dir->dir_dreachable = 0;
7943 
7944 			/* move on to next dst addr */
7945 			continue;
7946 		}
7947 		dir->dir_dreachable = 1;
7948 
7949 		dst_ill = ire_nexthop_ill(ire);
7950 		if (dst_ill == NULL) {
7951 			ire_refrele(ire);
7952 			continue;
7953 		}
7954 
7955 		/* With ipmp we most likely look at the ipmp ill here */
7956 		dir->dir_dmactype = dst_ill->ill_mactype;
7957 
7958 		if (isipv4) {
7959 			ipaddr_t v4saddr;
7960 
7961 			if (ip_select_source_v4(dst_ill, v4setsrc, v4daddr,
7962 			    connp->conn_ixa->ixa_multicast_ifaddr, zoneid, ipst,
7963 			    &v4saddr, NULL, &ipif_flags) != 0) {
7964 				v4saddr = INADDR_ANY;
7965 				ipif_flags = 0;
7966 			}
7967 			IN6_IPADDR_TO_V4MAPPED(v4saddr, saddr);
7968 		} else {
7969 			if (ip_select_source_v6(dst_ill, &v6setsrc, daddr,
7970 			    zoneid, ipst, B_FALSE, IPV6_PREFER_SRC_DEFAULT,
7971 			    saddr, NULL, &ipif_flags) != 0) {
7972 				*saddr = ipv6_all_zeros;
7973 				ipif_flags = 0;
7974 			}
7975 		}
7976 
7977 		dir->dir_sscope = ip_addr_scope_v6(saddr);
7978 		slabel = ip6_asp_lookup(saddr, NULL, ipst);
7979 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
7980 		dir->dir_sdeprecated = (ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
7981 		ire_refrele(ire);
7982 		ill_refrele(dst_ill);
7983 	}
7984 	miocack(q, mp, iocp->ioc_count, 0);
7985 }
7986 
7987 /*
7988  * Check if this is an address assigned to this machine.
7989  * Skips interfaces that are down by using ire checks.
7990  * Translates mapped addresses to v4 addresses and then
7991  * treats them as such, returning true if the v4 address
7992  * associated with this mapped address is configured.
7993  * Note: Applications will have to be careful what they do
7994  * with the response; use of mapped addresses limits
7995  * what can be done with the socket, especially with
7996  * respect to socket options and ioctls - neither IPv4
7997  * options nor IPv6 sticky options/ancillary data options
7998  * may be used.
7999  */
8000 /* ARGSUSED */
8001 int
8002 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8003     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8004 {
8005 	struct sioc_addrreq *sia;
8006 	sin_t *sin;
8007 	ire_t *ire;
8008 	mblk_t *mp1;
8009 	zoneid_t zoneid;
8010 	ip_stack_t	*ipst;
8011 
8012 	ip1dbg(("ip_sioctl_tmyaddr"));
8013 
8014 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8015 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8016 	ipst = CONNQ_TO_IPST(q);
8017 
8018 	/* Existence verified in ip_wput_nondata */
8019 	mp1 = mp->b_cont->b_cont;
8020 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8021 	sin = (sin_t *)&sia->sa_addr;
8022 	switch (sin->sin_family) {
8023 	case AF_INET6: {
8024 		sin6_t *sin6 = (sin6_t *)sin;
8025 
8026 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8027 			ipaddr_t v4_addr;
8028 
8029 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8030 			    v4_addr);
8031 			ire = ire_ftable_lookup_v4(v4_addr, 0, 0,
8032 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8033 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8034 		} else {
8035 			in6_addr_t v6addr;
8036 
8037 			v6addr = sin6->sin6_addr;
8038 			ire = ire_ftable_lookup_v6(&v6addr, 0, 0,
8039 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8040 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8041 		}
8042 		break;
8043 	}
8044 	case AF_INET: {
8045 		ipaddr_t v4addr;
8046 
8047 		v4addr = sin->sin_addr.s_addr;
8048 		ire = ire_ftable_lookup_v4(v4addr, 0, 0,
8049 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8050 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8051 		break;
8052 	}
8053 	default:
8054 		return (EAFNOSUPPORT);
8055 	}
8056 	if (ire != NULL) {
8057 		sia->sa_res = 1;
8058 		ire_refrele(ire);
8059 	} else {
8060 		sia->sa_res = 0;
8061 	}
8062 	return (0);
8063 }
8064 
8065 /*
8066  * Check if this is an address assigned on-link i.e. neighbor,
8067  * and makes sure it's reachable from the current zone.
8068  * Returns true for my addresses as well.
8069  * Translates mapped addresses to v4 addresses and then
8070  * treats them as such, returning true if the v4 address
8071  * associated with this mapped address is configured.
8072  * Note: Applications will have to be careful what they do
8073  * with the response; use of mapped addresses limits
8074  * what can be done with the socket, especially with
8075  * respect to socket options and ioctls - neither IPv4
8076  * options nor IPv6 sticky options/ancillary data options
8077  * may be used.
8078  */
8079 /* ARGSUSED */
8080 int
8081 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8082     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
8083 {
8084 	struct sioc_addrreq *sia;
8085 	sin_t *sin;
8086 	mblk_t	*mp1;
8087 	ire_t *ire = NULL;
8088 	zoneid_t zoneid;
8089 	ip_stack_t	*ipst;
8090 
8091 	ip1dbg(("ip_sioctl_tonlink"));
8092 
8093 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8094 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8095 	ipst = CONNQ_TO_IPST(q);
8096 
8097 	/* Existence verified in ip_wput_nondata */
8098 	mp1 = mp->b_cont->b_cont;
8099 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8100 	sin = (sin_t *)&sia->sa_addr;
8101 
8102 	/*
8103 	 * We check for IRE_ONLINK and exclude IRE_BROADCAST|IRE_MULTICAST
8104 	 * to make sure we only look at on-link unicast address.
8105 	 */
8106 	switch (sin->sin_family) {
8107 	case AF_INET6: {
8108 		sin6_t *sin6 = (sin6_t *)sin;
8109 
8110 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8111 			ipaddr_t v4_addr;
8112 
8113 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8114 			    v4_addr);
8115 			if (!CLASSD(v4_addr)) {
8116 				ire = ire_ftable_lookup_v4(v4_addr, 0, 0, 0,
8117 				    NULL, zoneid, NULL, MATCH_IRE_DSTONLY,
8118 				    0, ipst, NULL);
8119 			}
8120 		} else {
8121 			in6_addr_t v6addr;
8122 
8123 			v6addr = sin6->sin6_addr;
8124 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
8125 				ire = ire_ftable_lookup_v6(&v6addr, 0, 0, 0,
8126 				    NULL, zoneid, NULL, MATCH_IRE_DSTONLY, 0,
8127 				    ipst, NULL);
8128 			}
8129 		}
8130 		break;
8131 	}
8132 	case AF_INET: {
8133 		ipaddr_t v4addr;
8134 
8135 		v4addr = sin->sin_addr.s_addr;
8136 		if (!CLASSD(v4addr)) {
8137 			ire = ire_ftable_lookup_v4(v4addr, 0, 0, 0, NULL,
8138 			    zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
8139 		}
8140 		break;
8141 	}
8142 	default:
8143 		return (EAFNOSUPPORT);
8144 	}
8145 	sia->sa_res = 0;
8146 	if (ire != NULL) {
8147 		ASSERT(!(ire->ire_type & IRE_MULTICAST));
8148 
8149 		if ((ire->ire_type & IRE_ONLINK) &&
8150 		    !(ire->ire_type & IRE_BROADCAST))
8151 			sia->sa_res = 1;
8152 		ire_refrele(ire);
8153 	}
8154 	return (0);
8155 }
8156 
8157 /*
8158  * TBD: implement when kernel maintaines a list of site prefixes.
8159  */
8160 /* ARGSUSED */
8161 int
8162 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8163     ip_ioctl_cmd_t *ipip, void *ifreq)
8164 {
8165 	return (ENXIO);
8166 }
8167 
8168 /* ARP IOCTLs. */
8169 /* ARGSUSED */
8170 int
8171 ip_sioctl_arp(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8172     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8173 {
8174 	int		err;
8175 	ipaddr_t	ipaddr;
8176 	struct iocblk	*iocp;
8177 	conn_t		*connp;
8178 	struct arpreq	*ar;
8179 	struct xarpreq	*xar;
8180 	int		arp_flags, flags, alength;
8181 	uchar_t		*lladdr;
8182 	ip_stack_t	*ipst;
8183 	ill_t		*ill = ipif->ipif_ill;
8184 	ill_t		*proxy_ill = NULL;
8185 	ipmp_arpent_t	*entp = NULL;
8186 	boolean_t	proxyarp = B_FALSE;
8187 	boolean_t	if_arp_ioctl = B_FALSE;
8188 	ncec_t		*ncec = NULL;
8189 	nce_t		*nce;
8190 
8191 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8192 	connp = Q_TO_CONN(q);
8193 	ipst = connp->conn_netstack->netstack_ip;
8194 	iocp = (struct iocblk *)mp->b_rptr;
8195 
8196 	if (ipip->ipi_cmd_type == XARP_CMD) {
8197 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
8198 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
8199 		ar = NULL;
8200 
8201 		arp_flags = xar->xarp_flags;
8202 		lladdr = (uchar_t *)LLADDR(&xar->xarp_ha);
8203 		if_arp_ioctl = (xar->xarp_ha.sdl_nlen != 0);
8204 		/*
8205 		 * Validate against user's link layer address length
8206 		 * input and name and addr length limits.
8207 		 */
8208 		alength = ill->ill_phys_addr_length;
8209 		if (ipip->ipi_cmd == SIOCSXARP) {
8210 			if (alength != xar->xarp_ha.sdl_alen ||
8211 			    (alength + xar->xarp_ha.sdl_nlen >
8212 			    sizeof (xar->xarp_ha.sdl_data)))
8213 				return (EINVAL);
8214 		}
8215 	} else {
8216 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
8217 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
8218 		xar = NULL;
8219 
8220 		arp_flags = ar->arp_flags;
8221 		lladdr = (uchar_t *)ar->arp_ha.sa_data;
8222 		/*
8223 		 * Theoretically, the sa_family could tell us what link
8224 		 * layer type this operation is trying to deal with. By
8225 		 * common usage AF_UNSPEC means ethernet. We'll assume
8226 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
8227 		 * for now. Our new SIOC*XARP ioctls can be used more
8228 		 * generally.
8229 		 *
8230 		 * If the underlying media happens to have a non 6 byte
8231 		 * address, arp module will fail set/get, but the del
8232 		 * operation will succeed.
8233 		 */
8234 		alength = 6;
8235 		if ((ipip->ipi_cmd != SIOCDARP) &&
8236 		    (alength != ill->ill_phys_addr_length)) {
8237 			return (EINVAL);
8238 		}
8239 	}
8240 
8241 	/* Translate ATF* flags to NCE* flags */
8242 	flags = 0;
8243 	if (arp_flags & ATF_AUTHORITY)
8244 		flags |= NCE_F_AUTHORITY;
8245 	if (arp_flags & ATF_PERM)
8246 		flags |= NCE_F_NONUD; /* not subject to aging */
8247 	if (arp_flags & ATF_PUBL)
8248 		flags |= NCE_F_PUBLISH;
8249 
8250 	/*
8251 	 * IPMP ARP special handling:
8252 	 *
8253 	 * 1. Since ARP mappings must appear consistent across the group,
8254 	 *    prohibit changing ARP mappings on the underlying interfaces.
8255 	 *
8256 	 * 2. Since ARP mappings for IPMP data addresses are maintained by
8257 	 *    IP itself, prohibit changing them.
8258 	 *
8259 	 * 3. For proxy ARP, use a functioning hardware address in the group,
8260 	 *    provided one exists.  If one doesn't, just add the entry as-is;
8261 	 *    ipmp_illgrp_refresh_arpent() will refresh it if things change.
8262 	 */
8263 	if (IS_UNDER_IPMP(ill)) {
8264 		if (ipip->ipi_cmd != SIOCGARP && ipip->ipi_cmd != SIOCGXARP)
8265 			return (EPERM);
8266 	}
8267 	if (IS_IPMP(ill)) {
8268 		ipmp_illgrp_t *illg = ill->ill_grp;
8269 
8270 		switch (ipip->ipi_cmd) {
8271 		case SIOCSARP:
8272 		case SIOCSXARP:
8273 			proxy_ill = ipmp_illgrp_find_ill(illg, lladdr, alength);
8274 			if (proxy_ill != NULL) {
8275 				proxyarp = B_TRUE;
8276 				if (!ipmp_ill_is_active(proxy_ill))
8277 					proxy_ill = ipmp_illgrp_next_ill(illg);
8278 				if (proxy_ill != NULL)
8279 					lladdr = proxy_ill->ill_phys_addr;
8280 			}
8281 			/* FALLTHRU */
8282 		}
8283 	}
8284 
8285 	ipaddr = sin->sin_addr.s_addr;
8286 	/*
8287 	 * don't match across illgrp per case (1) and (2).
8288 	 * XXX use IS_IPMP(ill) like ndp_sioc_update?
8289 	 */
8290 	nce = nce_lookup_v4(ill, &ipaddr);
8291 	if (nce != NULL)
8292 		ncec = nce->nce_common;
8293 
8294 	switch (iocp->ioc_cmd) {
8295 	case SIOCDARP:
8296 	case SIOCDXARP: {
8297 		/*
8298 		 * Delete the NCE if any.
8299 		 */
8300 		if (ncec == NULL) {
8301 			iocp->ioc_error = ENXIO;
8302 			break;
8303 		}
8304 		/* Don't allow changes to arp mappings of local addresses. */
8305 		if (NCE_MYADDR(ncec)) {
8306 			nce_refrele(nce);
8307 			return (ENOTSUP);
8308 		}
8309 		iocp->ioc_error = 0;
8310 
8311 		/*
8312 		 * Delete the nce_common which has ncec_ill set to ipmp_ill.
8313 		 * This will delete all the nce entries on the under_ills.
8314 		 */
8315 		ncec_delete(ncec);
8316 		/*
8317 		 * Once the NCE has been deleted, then the ire_dep* consistency
8318 		 * mechanism will find any IRE which depended on the now
8319 		 * condemned NCE (as part of sending packets).
8320 		 * That mechanism handles redirects by deleting redirects
8321 		 * that refer to UNREACHABLE nces.
8322 		 */
8323 		break;
8324 	}
8325 	case SIOCGARP:
8326 	case SIOCGXARP:
8327 		if (ncec != NULL) {
8328 			lladdr = ncec->ncec_lladdr;
8329 			flags = ncec->ncec_flags;
8330 			iocp->ioc_error = 0;
8331 			ip_sioctl_garp_reply(mp, ncec->ncec_ill, lladdr, flags);
8332 		} else {
8333 			iocp->ioc_error = ENXIO;
8334 		}
8335 		break;
8336 	case SIOCSARP:
8337 	case SIOCSXARP:
8338 		/* Don't allow changes to arp mappings of local addresses. */
8339 		if (ncec != NULL && NCE_MYADDR(ncec)) {
8340 			nce_refrele(nce);
8341 			return (ENOTSUP);
8342 		}
8343 
8344 		/* static arp entries will undergo NUD if ATF_PERM is not set */
8345 		flags |= NCE_F_STATIC;
8346 		if (!if_arp_ioctl) {
8347 			ip_nce_lookup_and_update(&ipaddr, NULL, ipst,
8348 			    lladdr, alength, flags);
8349 		} else {
8350 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
8351 			if (ipif != NULL) {
8352 				ip_nce_lookup_and_update(&ipaddr, ipif, ipst,
8353 				    lladdr, alength, flags);
8354 				ipif_refrele(ipif);
8355 			}
8356 		}
8357 		if (nce != NULL) {
8358 			nce_refrele(nce);
8359 			nce = NULL;
8360 		}
8361 		/*
8362 		 * NCE_F_STATIC entries will be added in state ND_REACHABLE
8363 		 * by nce_add_common()
8364 		 */
8365 		err = nce_lookup_then_add_v4(ill, lladdr,
8366 		    ill->ill_phys_addr_length, &ipaddr, flags, ND_UNCHANGED,
8367 		    &nce);
8368 		if (err == EEXIST) {
8369 			ncec = nce->nce_common;
8370 			mutex_enter(&ncec->ncec_lock);
8371 			ncec->ncec_state = ND_REACHABLE;
8372 			ncec->ncec_flags = flags;
8373 			nce_update(ncec, ND_UNCHANGED, lladdr);
8374 			mutex_exit(&ncec->ncec_lock);
8375 			err = 0;
8376 		}
8377 		if (nce != NULL) {
8378 			nce_refrele(nce);
8379 			nce = NULL;
8380 		}
8381 		if (IS_IPMP(ill) && err == 0) {
8382 			entp = ipmp_illgrp_create_arpent(ill->ill_grp,
8383 			    proxyarp, ipaddr, lladdr, ill->ill_phys_addr_length,
8384 			    flags);
8385 			if (entp == NULL || (proxyarp && proxy_ill == NULL)) {
8386 				iocp->ioc_error = (entp == NULL ? ENOMEM : 0);
8387 				break;
8388 			}
8389 		}
8390 		iocp->ioc_error = err;
8391 	}
8392 
8393 	if (nce != NULL) {
8394 		nce_refrele(nce);
8395 	}
8396 
8397 	/*
8398 	 * If we created an IPMP ARP entry, mark that we've notified ARP.
8399 	 */
8400 	if (entp != NULL)
8401 		ipmp_illgrp_mark_arpent(ill->ill_grp, entp);
8402 
8403 	return (iocp->ioc_error);
8404 }
8405 
8406 /*
8407  * Parse an [x]arpreq structure coming down SIOC[GSD][X]ARP ioctls, identify
8408  * the associated sin and refhold and return the associated ipif via `ci'.
8409  */
8410 int
8411 ip_extract_arpreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8412     cmd_info_t *ci)
8413 {
8414 	mblk_t	*mp1;
8415 	sin_t	*sin;
8416 	conn_t	*connp;
8417 	ipif_t	*ipif;
8418 	ire_t	*ire = NULL;
8419 	ill_t	*ill = NULL;
8420 	boolean_t exists;
8421 	ip_stack_t *ipst;
8422 	struct arpreq *ar;
8423 	struct xarpreq *xar;
8424 	struct sockaddr_dl *sdl;
8425 
8426 	/* ioctl comes down on a conn */
8427 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8428 	connp = Q_TO_CONN(q);
8429 	if (connp->conn_family == AF_INET6)
8430 		return (ENXIO);
8431 
8432 	ipst = connp->conn_netstack->netstack_ip;
8433 
8434 	/* Verified in ip_wput_nondata */
8435 	mp1 = mp->b_cont->b_cont;
8436 
8437 	if (ipip->ipi_cmd_type == XARP_CMD) {
8438 		ASSERT(MBLKL(mp1) >= sizeof (struct xarpreq));
8439 		xar = (struct xarpreq *)mp1->b_rptr;
8440 		sin = (sin_t *)&xar->xarp_pa;
8441 		sdl = &xar->xarp_ha;
8442 
8443 		if (sdl->sdl_family != AF_LINK || sin->sin_family != AF_INET)
8444 			return (ENXIO);
8445 		if (sdl->sdl_nlen >= LIFNAMSIZ)
8446 			return (EINVAL);
8447 	} else {
8448 		ASSERT(ipip->ipi_cmd_type == ARP_CMD);
8449 		ASSERT(MBLKL(mp1) >= sizeof (struct arpreq));
8450 		ar = (struct arpreq *)mp1->b_rptr;
8451 		sin = (sin_t *)&ar->arp_pa;
8452 	}
8453 
8454 	if (ipip->ipi_cmd_type == XARP_CMD && sdl->sdl_nlen != 0) {
8455 		ipif = ipif_lookup_on_name(sdl->sdl_data, sdl->sdl_nlen,
8456 		    B_FALSE, &exists, B_FALSE, ALL_ZONES, ipst);
8457 		if (ipif == NULL)
8458 			return (ENXIO);
8459 		if (ipif->ipif_id != 0) {
8460 			ipif_refrele(ipif);
8461 			return (ENXIO);
8462 		}
8463 	} else {
8464 		/*
8465 		 * Either an SIOC[DGS]ARP or an SIOC[DGS]XARP with an sdl_nlen
8466 		 * of 0: use the IP address to find the ipif.  If the IP
8467 		 * address is an IPMP test address, ire_ftable_lookup() will
8468 		 * find the wrong ill, so we first do an ipif_lookup_addr().
8469 		 */
8470 		ipif = ipif_lookup_addr(sin->sin_addr.s_addr, NULL, ALL_ZONES,
8471 		    ipst);
8472 		if (ipif == NULL) {
8473 			ire = ire_ftable_lookup_v4(sin->sin_addr.s_addr,
8474 			    0, 0, IRE_IF_RESOLVER, NULL, ALL_ZONES,
8475 			    NULL, MATCH_IRE_TYPE, 0, ipst, NULL);
8476 			if (ire == NULL || ((ill = ire->ire_ill) == NULL)) {
8477 				if (ire != NULL)
8478 					ire_refrele(ire);
8479 				return (ENXIO);
8480 			}
8481 			ASSERT(ire != NULL && ill != NULL);
8482 			ipif = ill->ill_ipif;
8483 			ipif_refhold(ipif);
8484 			ire_refrele(ire);
8485 		}
8486 	}
8487 
8488 	if (ipif->ipif_ill->ill_net_type != IRE_IF_RESOLVER) {
8489 		ipif_refrele(ipif);
8490 		return (ENXIO);
8491 	}
8492 
8493 	ci->ci_sin = sin;
8494 	ci->ci_ipif = ipif;
8495 	return (0);
8496 }
8497 
8498 /*
8499  * Link or unlink the illgrp on IPMP meta-interface `ill' depending on the
8500  * value of `ioccmd'.  While an illgrp is linked to an ipmp_grp_t, it is
8501  * accessible from that ipmp_grp_t, which means SIOCSLIFGROUPNAME can look it
8502  * up and thus an ill can join that illgrp.
8503  *
8504  * We use I_PLINK/I_PUNLINK to do the link/unlink operations rather than
8505  * open()/close() primarily because close() is not allowed to fail or block
8506  * forever.  On the other hand, I_PUNLINK *can* fail, and there's no reason
8507  * why anyone should ever need to I_PUNLINK an in-use IPMP stream.  To ensure
8508  * symmetric behavior (e.g., doing an I_PLINK after and I_PUNLINK undoes the
8509  * I_PUNLINK) we defer linking to I_PLINK.  Separately, we also fail attempts
8510  * to I_LINK since I_UNLINK is optional and we'd end up in an inconsistent
8511  * state if I_UNLINK didn't occur.
8512  *
8513  * Note that for each plumb/unplumb operation, we may end up here more than
8514  * once because of the way ifconfig works.  However, it's OK to link the same
8515  * illgrp more than once, or unlink an illgrp that's already unlinked.
8516  */
8517 static int
8518 ip_sioctl_plink_ipmp(ill_t *ill, int ioccmd)
8519 {
8520 	int err;
8521 	ip_stack_t *ipst = ill->ill_ipst;
8522 
8523 	ASSERT(IS_IPMP(ill));
8524 	ASSERT(IAM_WRITER_ILL(ill));
8525 
8526 	switch (ioccmd) {
8527 	case I_LINK:
8528 		return (ENOTSUP);
8529 
8530 	case I_PLINK:
8531 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8532 		ipmp_illgrp_link_grp(ill->ill_grp, ill->ill_phyint->phyint_grp);
8533 		rw_exit(&ipst->ips_ipmp_lock);
8534 		break;
8535 
8536 	case I_PUNLINK:
8537 		/*
8538 		 * Require all UP ipifs be brought down prior to unlinking the
8539 		 * illgrp so any associated IREs (and other state) is torched.
8540 		 */
8541 		if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0)
8542 			return (EBUSY);
8543 
8544 		/*
8545 		 * NOTE: We hold ipmp_lock across the unlink to prevent a race
8546 		 * with an SIOCSLIFGROUPNAME request from an ill trying to
8547 		 * join this group.  Specifically: ills trying to join grab
8548 		 * ipmp_lock and bump a "pending join" counter checked by
8549 		 * ipmp_illgrp_unlink_grp().  During the unlink no new pending
8550 		 * joins can occur (since we have ipmp_lock).  Once we drop
8551 		 * ipmp_lock, subsequent SIOCSLIFGROUPNAME requests will not
8552 		 * find the illgrp (since we unlinked it) and will return
8553 		 * EAFNOSUPPORT.  This will then take them back through the
8554 		 * IPMP meta-interface plumbing logic in ifconfig, and thus
8555 		 * back through I_PLINK above.
8556 		 */
8557 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8558 		err = ipmp_illgrp_unlink_grp(ill->ill_grp);
8559 		rw_exit(&ipst->ips_ipmp_lock);
8560 		return (err);
8561 	default:
8562 		break;
8563 	}
8564 	return (0);
8565 }
8566 
8567 /*
8568  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
8569  * atomically set/clear the muxids. Also complete the ioctl by acking or
8570  * naking it.  Note that the code is structured such that the link type,
8571  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
8572  * its clones use the persistent link, while pppd(1M) and perhaps many
8573  * other daemons may use non-persistent link.  When combined with some
8574  * ill_t states, linking and unlinking lower streams may be used as
8575  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
8576  */
8577 /* ARGSUSED */
8578 void
8579 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8580 {
8581 	mblk_t		*mp1;
8582 	struct linkblk	*li;
8583 	int		ioccmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
8584 	int		err = 0;
8585 
8586 	ASSERT(ioccmd == I_PLINK || ioccmd == I_PUNLINK ||
8587 	    ioccmd == I_LINK || ioccmd == I_UNLINK);
8588 
8589 	mp1 = mp->b_cont;	/* This is the linkblk info */
8590 	li = (struct linkblk *)mp1->b_rptr;
8591 
8592 	err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li);
8593 	if (err == EINPROGRESS)
8594 		return;
8595 	if (err == 0)
8596 		miocack(q, mp, 0, 0);
8597 	else
8598 		miocnak(q, mp, 0, err);
8599 
8600 	/* Conn was refheld in ip_sioctl_copyin_setup */
8601 	if (CONN_Q(q)) {
8602 		CONN_DEC_IOCTLREF(Q_TO_CONN(q));
8603 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
8604 	}
8605 }
8606 
8607 /*
8608  * Process I_{P}LINK and I_{P}UNLINK requests named by `ioccmd' and pointed to
8609  * by `mp' and `li' for the IP module stream (if li->q_bot is in fact an IP
8610  * module stream).
8611  * Returns zero on success, EINPROGRESS if the operation is still pending, or
8612  * an error code on failure.
8613  */
8614 static int
8615 ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp, int ioccmd,
8616     struct linkblk *li)
8617 {
8618 	int		err = 0;
8619 	ill_t  		*ill;
8620 	queue_t		*ipwq, *dwq;
8621 	const char	*name;
8622 	struct qinit	*qinfo;
8623 	boolean_t	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
8624 	boolean_t	entered_ipsq = B_FALSE;
8625 	boolean_t	is_ip = B_FALSE;
8626 	arl_t		*arl;
8627 
8628 	/*
8629 	 * Walk the lower stream to verify it's the IP module stream.
8630 	 * The IP module is identified by its name, wput function,
8631 	 * and non-NULL q_next.  STREAMS ensures that the lower stream
8632 	 * (li->l_qbot) will not vanish until this ioctl completes.
8633 	 */
8634 	for (ipwq = li->l_qbot; ipwq != NULL; ipwq = ipwq->q_next) {
8635 		qinfo = ipwq->q_qinfo;
8636 		name = qinfo->qi_minfo->mi_idname;
8637 		if (name != NULL && strcmp(name, ip_mod_info.mi_idname) == 0 &&
8638 		    qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
8639 			is_ip = B_TRUE;
8640 			break;
8641 		}
8642 		if (name != NULL && strcmp(name, arp_mod_info.mi_idname) == 0 &&
8643 		    qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
8644 			break;
8645 		}
8646 	}
8647 
8648 	/*
8649 	 * If this isn't an IP module stream, bail.
8650 	 */
8651 	if (ipwq == NULL)
8652 		return (0);
8653 
8654 	if (!is_ip) {
8655 		arl = (arl_t *)ipwq->q_ptr;
8656 		ill = arl_to_ill(arl);
8657 		if (ill == NULL)
8658 			return (0);
8659 	} else {
8660 		ill = ipwq->q_ptr;
8661 	}
8662 	ASSERT(ill != NULL);
8663 
8664 	if (ipsq == NULL) {
8665 		ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
8666 		    NEW_OP, B_FALSE);
8667 		if (ipsq == NULL) {
8668 			if (!is_ip)
8669 				ill_refrele(ill);
8670 			return (EINPROGRESS);
8671 		}
8672 		entered_ipsq = B_TRUE;
8673 	}
8674 	ASSERT(IAM_WRITER_ILL(ill));
8675 	mutex_enter(&ill->ill_lock);
8676 	if (!is_ip) {
8677 		if (islink && ill->ill_muxid == 0) {
8678 			/*
8679 			 * Plumbing has to be done with IP plumbed first, arp
8680 			 * second, but here we have arp being plumbed first.
8681 			 */
8682 			mutex_exit(&ill->ill_lock);
8683 			if (entered_ipsq)
8684 				ipsq_exit(ipsq);
8685 			ill_refrele(ill);
8686 			return (EINVAL);
8687 		}
8688 	}
8689 	mutex_exit(&ill->ill_lock);
8690 	if (!is_ip) {
8691 		arl->arl_muxid = islink ? li->l_index : 0;
8692 		ill_refrele(ill);
8693 		goto done;
8694 	}
8695 
8696 	if (IS_IPMP(ill) && (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
8697 		goto done;
8698 
8699 	/*
8700 	 * As part of I_{P}LINKing, stash the number of downstream modules and
8701 	 * the read queue of the module immediately below IP in the ill.
8702 	 * These are used during the capability negotiation below.
8703 	 */
8704 	ill->ill_lmod_rq = NULL;
8705 	ill->ill_lmod_cnt = 0;
8706 	if (islink && ((dwq = ipwq->q_next) != NULL)) {
8707 		ill->ill_lmod_rq = RD(dwq);
8708 		for (; dwq != NULL; dwq = dwq->q_next)
8709 			ill->ill_lmod_cnt++;
8710 	}
8711 
8712 	ill->ill_muxid = islink ? li->l_index : 0;
8713 
8714 	/*
8715 	 * Mark the ipsq busy until the capability operations initiated below
8716 	 * complete. The PLINK/UNLINK ioctl itself completes when our caller
8717 	 * returns, but the capability operation may complete asynchronously
8718 	 * much later.
8719 	 */
8720 	ipsq_current_start(ipsq, ill->ill_ipif, ioccmd);
8721 	/*
8722 	 * If there's at least one up ipif on this ill, then we're bound to
8723 	 * the underlying driver via DLPI.  In that case, renegotiate
8724 	 * capabilities to account for any possible change in modules
8725 	 * interposed between IP and the driver.
8726 	 */
8727 	if (ill->ill_ipif_up_count > 0) {
8728 		if (islink)
8729 			ill_capability_probe(ill);
8730 		else
8731 			ill_capability_reset(ill, B_FALSE);
8732 	}
8733 	ipsq_current_finish(ipsq);
8734 done:
8735 	if (entered_ipsq)
8736 		ipsq_exit(ipsq);
8737 
8738 	return (err);
8739 }
8740 
8741 /*
8742  * Search the ioctl command in the ioctl tables and return a pointer
8743  * to the ioctl command information. The ioctl command tables are
8744  * static and fully populated at compile time.
8745  */
8746 ip_ioctl_cmd_t *
8747 ip_sioctl_lookup(int ioc_cmd)
8748 {
8749 	int index;
8750 	ip_ioctl_cmd_t *ipip;
8751 	ip_ioctl_cmd_t *ipip_end;
8752 
8753 	if (ioc_cmd == IPI_DONTCARE)
8754 		return (NULL);
8755 
8756 	/*
8757 	 * Do a 2 step search. First search the indexed table
8758 	 * based on the least significant byte of the ioctl cmd.
8759 	 * If we don't find a match, then search the misc table
8760 	 * serially.
8761 	 */
8762 	index = ioc_cmd & 0xFF;
8763 	if (index < ip_ndx_ioctl_count) {
8764 		ipip = &ip_ndx_ioctl_table[index];
8765 		if (ipip->ipi_cmd == ioc_cmd) {
8766 			/* Found a match in the ndx table */
8767 			return (ipip);
8768 		}
8769 	}
8770 
8771 	/* Search the misc table */
8772 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
8773 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
8774 		if (ipip->ipi_cmd == ioc_cmd)
8775 			/* Found a match in the misc table */
8776 			return (ipip);
8777 	}
8778 
8779 	return (NULL);
8780 }
8781 
8782 /*
8783  * helper function for ip_sioctl_getsetprop(), which does some sanity checks
8784  */
8785 static boolean_t
8786 getset_ioctl_checks(mblk_t *mp)
8787 {
8788 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8789 	mblk_t		*mp1 = mp->b_cont;
8790 	mod_ioc_prop_t	*pioc;
8791 	uint_t		flags;
8792 	uint_t		pioc_size;
8793 
8794 	/* do sanity checks on various arguments */
8795 	if (mp1 == NULL || iocp->ioc_count == 0 ||
8796 	    iocp->ioc_count == TRANSPARENT) {
8797 		return (B_FALSE);
8798 	}
8799 	if (msgdsize(mp1) < iocp->ioc_count) {
8800 		if (!pullupmsg(mp1, iocp->ioc_count))
8801 			return (B_FALSE);
8802 	}
8803 
8804 	pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8805 
8806 	/* sanity checks on mpr_valsize */
8807 	pioc_size = sizeof (mod_ioc_prop_t);
8808 	if (pioc->mpr_valsize != 0)
8809 		pioc_size += pioc->mpr_valsize - 1;
8810 
8811 	if (iocp->ioc_count != pioc_size)
8812 		return (B_FALSE);
8813 
8814 	flags = pioc->mpr_flags;
8815 	if (iocp->ioc_cmd == SIOCSETPROP) {
8816 		/*
8817 		 * One can either reset the value to it's default value or
8818 		 * change the current value or append/remove the value from
8819 		 * a multi-valued properties.
8820 		 */
8821 		if ((flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8822 		    flags != MOD_PROP_ACTIVE &&
8823 		    flags != (MOD_PROP_ACTIVE|MOD_PROP_APPEND) &&
8824 		    flags != (MOD_PROP_ACTIVE|MOD_PROP_REMOVE))
8825 			return (B_FALSE);
8826 	} else {
8827 		ASSERT(iocp->ioc_cmd == SIOCGETPROP);
8828 
8829 		/*
8830 		 * One can retrieve only one kind of property information
8831 		 * at a time.
8832 		 */
8833 		if ((flags & MOD_PROP_ACTIVE) != MOD_PROP_ACTIVE &&
8834 		    (flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8835 		    (flags & MOD_PROP_POSSIBLE) != MOD_PROP_POSSIBLE &&
8836 		    (flags & MOD_PROP_PERM) != MOD_PROP_PERM)
8837 			return (B_FALSE);
8838 	}
8839 
8840 	return (B_TRUE);
8841 }
8842 
8843 /*
8844  * process the SIOC{SET|GET}PROP ioctl's
8845  */
8846 /* ARGSUSED */
8847 static void
8848 ip_sioctl_getsetprop(queue_t *q, mblk_t *mp)
8849 {
8850 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8851 	mblk_t		*mp1 = mp->b_cont;
8852 	mod_ioc_prop_t	*pioc;
8853 	mod_prop_info_t *ptbl = NULL, *pinfo = NULL;
8854 	ip_stack_t	*ipst;
8855 	icmp_stack_t	*is;
8856 	tcp_stack_t	*tcps;
8857 	sctp_stack_t	*sctps;
8858 	udp_stack_t	*us;
8859 	netstack_t	*stack;
8860 	void		*cbarg;
8861 	cred_t		*cr;
8862 	boolean_t 	set;
8863 	int		err;
8864 
8865 	ASSERT(q->q_next == NULL);
8866 	ASSERT(CONN_Q(q));
8867 
8868 	if (!getset_ioctl_checks(mp)) {
8869 		miocnak(q, mp, 0, EINVAL);
8870 		return;
8871 	}
8872 	ipst = CONNQ_TO_IPST(q);
8873 	stack = ipst->ips_netstack;
8874 	pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8875 
8876 	switch (pioc->mpr_proto) {
8877 	case MOD_PROTO_IP:
8878 	case MOD_PROTO_IPV4:
8879 	case MOD_PROTO_IPV6:
8880 		ptbl = ipst->ips_propinfo_tbl;
8881 		cbarg = ipst;
8882 		break;
8883 	case MOD_PROTO_RAWIP:
8884 		is = stack->netstack_icmp;
8885 		ptbl = is->is_propinfo_tbl;
8886 		cbarg = is;
8887 		break;
8888 	case MOD_PROTO_TCP:
8889 		tcps = stack->netstack_tcp;
8890 		ptbl = tcps->tcps_propinfo_tbl;
8891 		cbarg = tcps;
8892 		break;
8893 	case MOD_PROTO_UDP:
8894 		us = stack->netstack_udp;
8895 		ptbl = us->us_propinfo_tbl;
8896 		cbarg = us;
8897 		break;
8898 	case MOD_PROTO_SCTP:
8899 		sctps = stack->netstack_sctp;
8900 		ptbl = sctps->sctps_propinfo_tbl;
8901 		cbarg = sctps;
8902 		break;
8903 	default:
8904 		miocnak(q, mp, 0, EINVAL);
8905 		return;
8906 	}
8907 
8908 	/* search for given property in respective protocol propinfo table */
8909 	for (pinfo = ptbl; pinfo->mpi_name != NULL; pinfo++) {
8910 		if (strcmp(pinfo->mpi_name, pioc->mpr_name) == 0 &&
8911 		    pinfo->mpi_proto == pioc->mpr_proto)
8912 			break;
8913 	}
8914 	if (pinfo->mpi_name == NULL) {
8915 		miocnak(q, mp, 0, ENOENT);
8916 		return;
8917 	}
8918 
8919 	set = (iocp->ioc_cmd == SIOCSETPROP) ? B_TRUE : B_FALSE;
8920 	if (set && pinfo->mpi_setf != NULL) {
8921 		cr = msg_getcred(mp, NULL);
8922 		if (cr == NULL)
8923 			cr = iocp->ioc_cr;
8924 		err = pinfo->mpi_setf(cbarg, cr, pinfo, pioc->mpr_ifname,
8925 		    pioc->mpr_val, pioc->mpr_flags);
8926 	} else if (!set && pinfo->mpi_getf != NULL) {
8927 		err = pinfo->mpi_getf(cbarg, pinfo, pioc->mpr_ifname,
8928 		    pioc->mpr_val, pioc->mpr_valsize, pioc->mpr_flags);
8929 	} else {
8930 		err = EPERM;
8931 	}
8932 
8933 	if (err != 0) {
8934 		miocnak(q, mp, 0, err);
8935 	} else {
8936 		if (set)
8937 			miocack(q, mp, 0, 0);
8938 		else    /* For get, we need to return back the data */
8939 			miocack(q, mp, iocp->ioc_count, 0);
8940 	}
8941 }
8942 
8943 /*
8944  * process the legacy ND_GET, ND_SET ioctl just for {ip|ip6}_forwarding
8945  * as several routing daemons have unfortunately used this 'unpublished'
8946  * but well-known ioctls.
8947  */
8948 /* ARGSUSED */
8949 static void
8950 ip_process_legacy_nddprop(queue_t *q, mblk_t *mp)
8951 {
8952 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8953 	mblk_t		*mp1 = mp->b_cont;
8954 	char		*pname, *pval, *buf;
8955 	uint_t		bufsize, proto;
8956 	mod_prop_info_t *ptbl = NULL, *pinfo = NULL;
8957 	ip_stack_t	*ipst;
8958 	int		err = 0;
8959 
8960 	ASSERT(CONN_Q(q));
8961 	ipst = CONNQ_TO_IPST(q);
8962 
8963 	if (iocp->ioc_count == 0 || mp1 == NULL) {
8964 		miocnak(q, mp, 0, EINVAL);
8965 		return;
8966 	}
8967 
8968 	mp1->b_datap->db_lim[-1] = '\0';	/* Force null termination */
8969 	pval = buf = pname = (char *)mp1->b_rptr;
8970 	bufsize = MBLKL(mp1);
8971 
8972 	if (strcmp(pname, "ip_forwarding") == 0) {
8973 		pname = "forwarding";
8974 		proto = MOD_PROTO_IPV4;
8975 	} else if (strcmp(pname, "ip6_forwarding") == 0) {
8976 		pname = "forwarding";
8977 		proto = MOD_PROTO_IPV6;
8978 	} else {
8979 		miocnak(q, mp, 0, EINVAL);
8980 		return;
8981 	}
8982 
8983 	ptbl = ipst->ips_propinfo_tbl;
8984 	for (pinfo = ptbl; pinfo->mpi_name != NULL; pinfo++) {
8985 		if (strcmp(pinfo->mpi_name, pname) == 0 &&
8986 		    pinfo->mpi_proto == proto)
8987 			break;
8988 	}
8989 
8990 	ASSERT(pinfo->mpi_name != NULL);
8991 
8992 	switch (iocp->ioc_cmd) {
8993 	case ND_GET:
8994 		if ((err = pinfo->mpi_getf(ipst, pinfo, NULL, buf, bufsize,
8995 		    0)) == 0) {
8996 			miocack(q, mp, iocp->ioc_count, 0);
8997 			return;
8998 		}
8999 		break;
9000 	case ND_SET:
9001 		/*
9002 		 * buffer will have property name and value in the following
9003 		 * format,
9004 		 * <property name>'\0'<property value>'\0', extract them;
9005 		 */
9006 		while (*pval++)
9007 			noop;
9008 
9009 		if (!*pval || pval >= (char *)mp1->b_wptr) {
9010 			err = EINVAL;
9011 		} else if ((err = pinfo->mpi_setf(ipst, NULL, pinfo, NULL,
9012 		    pval, 0)) == 0) {
9013 			miocack(q, mp, 0, 0);
9014 			return;
9015 		}
9016 		break;
9017 	default:
9018 		err = EINVAL;
9019 		break;
9020 	}
9021 	miocnak(q, mp, 0, err);
9022 }
9023 
9024 /*
9025  * Wrapper function for resuming deferred ioctl processing
9026  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9027  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9028  */
9029 /* ARGSUSED */
9030 void
9031 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9032     void *dummy_arg)
9033 {
9034 	ip_sioctl_copyin_setup(q, mp);
9035 }
9036 
9037 /*
9038  * ip_sioctl_copyin_setup is called by ip_wput_nondata with any M_IOCTL message
9039  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9040  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9041  * We establish here the size of the block to be copied in.  mi_copyin
9042  * arranges for this to happen, an processing continues in ip_wput_nondata with
9043  * an M_IOCDATA message.
9044  */
9045 void
9046 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9047 {
9048 	int	copyin_size;
9049 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9050 	ip_ioctl_cmd_t *ipip;
9051 	cred_t *cr;
9052 	ip_stack_t	*ipst;
9053 
9054 	if (CONN_Q(q))
9055 		ipst = CONNQ_TO_IPST(q);
9056 	else
9057 		ipst = ILLQ_TO_IPST(q);
9058 
9059 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9060 	if (ipip == NULL) {
9061 		/*
9062 		 * The ioctl is not one we understand or own.
9063 		 * Pass it along to be processed down stream,
9064 		 * if this is a module instance of IP, else nak
9065 		 * the ioctl.
9066 		 */
9067 		if (q->q_next == NULL) {
9068 			goto nak;
9069 		} else {
9070 			putnext(q, mp);
9071 			return;
9072 		}
9073 	}
9074 
9075 	/*
9076 	 * If this is deferred, then we will do all the checks when we
9077 	 * come back.
9078 	 */
9079 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
9080 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup(ipst)) {
9081 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
9082 		return;
9083 	}
9084 
9085 	/*
9086 	 * Only allow a very small subset of IP ioctls on this stream if
9087 	 * IP is a module and not a driver. Allowing ioctls to be processed
9088 	 * in this case may cause assert failures or data corruption.
9089 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
9090 	 * ioctls allowed on an IP module stream, after which this stream
9091 	 * normally becomes a multiplexor (at which time the stream head
9092 	 * will fail all ioctls).
9093 	 */
9094 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
9095 		goto nak;
9096 	}
9097 
9098 	/* Make sure we have ioctl data to process. */
9099 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
9100 		goto nak;
9101 
9102 	/*
9103 	 * Prefer dblk credential over ioctl credential; some synthesized
9104 	 * ioctls have kcred set because there's no way to crhold()
9105 	 * a credential in some contexts.  (ioc_cr is not crfree() by
9106 	 * the framework; the caller of ioctl needs to hold the reference
9107 	 * for the duration of the call).
9108 	 */
9109 	cr = msg_getcred(mp, NULL);
9110 	if (cr == NULL)
9111 		cr = iocp->ioc_cr;
9112 
9113 	/* Make sure normal users don't send down privileged ioctls */
9114 	if ((ipip->ipi_flags & IPI_PRIV) &&
9115 	    (cr != NULL) && secpolicy_ip_config(cr, B_TRUE) != 0) {
9116 		/* We checked the privilege earlier but log it here */
9117 		miocnak(q, mp, 0, secpolicy_ip_config(cr, B_FALSE));
9118 		return;
9119 	}
9120 
9121 	/*
9122 	 * The ioctl command tables can only encode fixed length
9123 	 * ioctl data. If the length is variable, the table will
9124 	 * encode the length as zero. Such special cases are handled
9125 	 * below in the switch.
9126 	 */
9127 	if (ipip->ipi_copyin_size != 0) {
9128 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
9129 		return;
9130 	}
9131 
9132 	switch (iocp->ioc_cmd) {
9133 	case O_SIOCGIFCONF:
9134 	case SIOCGIFCONF:
9135 		/*
9136 		 * This IOCTL is hilarious.  See comments in
9137 		 * ip_sioctl_get_ifconf for the story.
9138 		 */
9139 		if (iocp->ioc_count == TRANSPARENT)
9140 			copyin_size = SIZEOF_STRUCT(ifconf,
9141 			    iocp->ioc_flag);
9142 		else
9143 			copyin_size = iocp->ioc_count;
9144 		mi_copyin(q, mp, NULL, copyin_size);
9145 		return;
9146 
9147 	case O_SIOCGLIFCONF:
9148 	case SIOCGLIFCONF:
9149 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
9150 		mi_copyin(q, mp, NULL, copyin_size);
9151 		return;
9152 
9153 	case SIOCGLIFSRCOF:
9154 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
9155 		mi_copyin(q, mp, NULL, copyin_size);
9156 		return;
9157 
9158 	case SIOCGIP6ADDRPOLICY:
9159 		ip_sioctl_ip6addrpolicy(q, mp);
9160 		ip6_asp_table_refrele(ipst);
9161 		return;
9162 
9163 	case SIOCSIP6ADDRPOLICY:
9164 		ip_sioctl_ip6addrpolicy(q, mp);
9165 		return;
9166 
9167 	case SIOCGDSTINFO:
9168 		ip_sioctl_dstinfo(q, mp);
9169 		ip6_asp_table_refrele(ipst);
9170 		return;
9171 
9172 	case ND_SET:
9173 	case ND_GET:
9174 		ip_process_legacy_nddprop(q, mp);
9175 		return;
9176 
9177 	case SIOCSETPROP:
9178 	case SIOCGETPROP:
9179 		ip_sioctl_getsetprop(q, mp);
9180 		return;
9181 
9182 	case I_PLINK:
9183 	case I_PUNLINK:
9184 	case I_LINK:
9185 	case I_UNLINK:
9186 		/*
9187 		 * We treat non-persistent link similarly as the persistent
9188 		 * link case, in terms of plumbing/unplumbing, as well as
9189 		 * dynamic re-plumbing events indicator.  See comments
9190 		 * in ip_sioctl_plink() for more.
9191 		 *
9192 		 * Request can be enqueued in the 'ipsq' while waiting
9193 		 * to become exclusive. So bump up the conn ref.
9194 		 */
9195 		if (CONN_Q(q)) {
9196 			CONN_INC_REF(Q_TO_CONN(q));
9197 			CONN_INC_IOCTLREF(Q_TO_CONN(q))
9198 		}
9199 		ip_sioctl_plink(NULL, q, mp, NULL);
9200 		return;
9201 
9202 	case IP_IOCTL:
9203 		ip_wput_ioctl(q, mp);
9204 		return;
9205 
9206 	case SIOCILB:
9207 		/* The ioctl length varies depending on the ILB command. */
9208 		copyin_size = iocp->ioc_count;
9209 		if (copyin_size < sizeof (ilb_cmd_t))
9210 			goto nak;
9211 		mi_copyin(q, mp, NULL, copyin_size);
9212 		return;
9213 
9214 	default:
9215 		cmn_err(CE_PANIC, "should not happen ");
9216 	}
9217 nak:
9218 	if (mp->b_cont != NULL) {
9219 		freemsg(mp->b_cont);
9220 		mp->b_cont = NULL;
9221 	}
9222 	iocp->ioc_error = EINVAL;
9223 	mp->b_datap->db_type = M_IOCNAK;
9224 	iocp->ioc_count = 0;
9225 	qreply(q, mp);
9226 }
9227 
9228 static void
9229 ip_sioctl_garp_reply(mblk_t *mp, ill_t *ill, void *hwaddr, int flags)
9230 {
9231 	struct arpreq *ar;
9232 	struct xarpreq *xar;
9233 	mblk_t	*tmp;
9234 	struct iocblk *iocp;
9235 	int x_arp_ioctl = B_FALSE;
9236 	int *flagsp;
9237 	char *storage = NULL;
9238 
9239 	ASSERT(ill != NULL);
9240 
9241 	iocp = (struct iocblk *)mp->b_rptr;
9242 	ASSERT(iocp->ioc_cmd == SIOCGXARP || iocp->ioc_cmd == SIOCGARP);
9243 
9244 	tmp = (mp->b_cont)->b_cont; /* xarpreq/arpreq */
9245 	if ((iocp->ioc_cmd == SIOCGXARP) ||
9246 	    (iocp->ioc_cmd == SIOCSXARP)) {
9247 		x_arp_ioctl = B_TRUE;
9248 		xar = (struct xarpreq *)tmp->b_rptr;
9249 		flagsp = &xar->xarp_flags;
9250 		storage = xar->xarp_ha.sdl_data;
9251 	} else {
9252 		ar = (struct arpreq *)tmp->b_rptr;
9253 		flagsp = &ar->arp_flags;
9254 		storage = ar->arp_ha.sa_data;
9255 	}
9256 
9257 	/*
9258 	 * We're done if this is not an SIOCG{X}ARP
9259 	 */
9260 	if (x_arp_ioctl) {
9261 		storage += ill_xarp_info(&xar->xarp_ha, ill);
9262 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
9263 		    sizeof (xar->xarp_ha.sdl_data)) {
9264 			iocp->ioc_error = EINVAL;
9265 			return;
9266 		}
9267 	}
9268 	*flagsp = ATF_INUSE;
9269 	/*
9270 	 * If /sbin/arp told us we are the authority using the "permanent"
9271 	 * flag, or if this is one of my addresses print "permanent"
9272 	 * in the /sbin/arp output.
9273 	 */
9274 	if ((flags & NCE_F_MYADDR) || (flags & NCE_F_AUTHORITY))
9275 		*flagsp |= ATF_AUTHORITY;
9276 	if (flags & NCE_F_NONUD)
9277 		*flagsp |= ATF_PERM; /* not subject to aging */
9278 	if (flags & NCE_F_PUBLISH)
9279 		*flagsp |= ATF_PUBL;
9280 	if (hwaddr != NULL) {
9281 		*flagsp |= ATF_COM;
9282 		bcopy((char *)hwaddr, storage, ill->ill_phys_addr_length);
9283 	}
9284 }
9285 
9286 /*
9287  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
9288  * interface) create the next available logical interface for this
9289  * physical interface.
9290  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
9291  * ipif with the specified name.
9292  *
9293  * If the address family is not AF_UNSPEC then set the address as well.
9294  *
9295  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
9296  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
9297  *
9298  * Executed as a writer on the ill.
9299  * So no lock is needed to traverse the ipif chain, or examine the
9300  * phyint flags.
9301  */
9302 /* ARGSUSED */
9303 int
9304 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9305     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9306 {
9307 	mblk_t	*mp1;
9308 	struct lifreq *lifr;
9309 	boolean_t	isv6;
9310 	boolean_t	exists;
9311 	char 	*name;
9312 	char	*endp;
9313 	char	*cp;
9314 	int	namelen;
9315 	ipif_t	*ipif;
9316 	long	id;
9317 	ipsq_t	*ipsq;
9318 	ill_t	*ill;
9319 	sin_t	*sin;
9320 	int	err = 0;
9321 	boolean_t found_sep = B_FALSE;
9322 	conn_t	*connp;
9323 	zoneid_t zoneid;
9324 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
9325 
9326 	ASSERT(q->q_next == NULL);
9327 	ip1dbg(("ip_sioctl_addif\n"));
9328 	/* Existence of mp1 has been checked in ip_wput_nondata */
9329 	mp1 = mp->b_cont->b_cont;
9330 	/*
9331 	 * Null terminate the string to protect against buffer
9332 	 * overrun. String was generated by user code and may not
9333 	 * be trusted.
9334 	 */
9335 	lifr = (struct lifreq *)mp1->b_rptr;
9336 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
9337 	name = lifr->lifr_name;
9338 	ASSERT(CONN_Q(q));
9339 	connp = Q_TO_CONN(q);
9340 	isv6 = (connp->conn_family == AF_INET6);
9341 	zoneid = connp->conn_zoneid;
9342 	namelen = mi_strlen(name);
9343 	if (namelen == 0)
9344 		return (EINVAL);
9345 
9346 	exists = B_FALSE;
9347 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
9348 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
9349 		/*
9350 		 * Allow creating lo0 using SIOCLIFADDIF.
9351 		 * can't be any other writer thread. So can pass null below
9352 		 * for the last 4 args to ipif_lookup_name.
9353 		 */
9354 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen, B_TRUE,
9355 		    &exists, isv6, zoneid, ipst);
9356 		/* Prevent any further action */
9357 		if (ipif == NULL) {
9358 			return (ENOBUFS);
9359 		} else if (!exists) {
9360 			/* We created the ipif now and as writer */
9361 			ipif_refrele(ipif);
9362 			return (0);
9363 		} else {
9364 			ill = ipif->ipif_ill;
9365 			ill_refhold(ill);
9366 			ipif_refrele(ipif);
9367 		}
9368 	} else {
9369 		/* Look for a colon in the name. */
9370 		endp = &name[namelen];
9371 		for (cp = endp; --cp > name; ) {
9372 			if (*cp == IPIF_SEPARATOR_CHAR) {
9373 				found_sep = B_TRUE;
9374 				/*
9375 				 * Reject any non-decimal aliases for plumbing
9376 				 * of logical interfaces. Aliases with leading
9377 				 * zeroes are also rejected as they introduce
9378 				 * ambiguity in the naming of the interfaces.
9379 				 * Comparing with "0" takes care of all such
9380 				 * cases.
9381 				 */
9382 				if ((strncmp("0", cp+1, 1)) == 0)
9383 					return (EINVAL);
9384 
9385 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
9386 				    id <= 0 || *endp != '\0') {
9387 					return (EINVAL);
9388 				}
9389 				*cp = '\0';
9390 				break;
9391 			}
9392 		}
9393 		ill = ill_lookup_on_name(name, B_FALSE, isv6, NULL, ipst);
9394 		if (found_sep)
9395 			*cp = IPIF_SEPARATOR_CHAR;
9396 		if (ill == NULL)
9397 			return (ENXIO);
9398 	}
9399 
9400 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
9401 	    B_TRUE);
9402 
9403 	/*
9404 	 * Release the refhold due to the lookup, now that we are excl
9405 	 * or we are just returning
9406 	 */
9407 	ill_refrele(ill);
9408 
9409 	if (ipsq == NULL)
9410 		return (EINPROGRESS);
9411 
9412 	/* We are now exclusive on the IPSQ */
9413 	ASSERT(IAM_WRITER_ILL(ill));
9414 
9415 	if (found_sep) {
9416 		/* Now see if there is an IPIF with this unit number. */
9417 		for (ipif = ill->ill_ipif; ipif != NULL;
9418 		    ipif = ipif->ipif_next) {
9419 			if (ipif->ipif_id == id) {
9420 				err = EEXIST;
9421 				goto done;
9422 			}
9423 		}
9424 	}
9425 
9426 	/*
9427 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
9428 	 * of lo0.  Plumbing for lo0:0 happens in ipif_lookup_on_name()
9429 	 * instead.
9430 	 */
9431 	if ((ipif = ipif_allocate(ill, found_sep ? id : -1, IRE_LOCAL,
9432 	    B_TRUE, B_TRUE, &err)) == NULL) {
9433 		goto done;
9434 	}
9435 
9436 	/* Return created name with ioctl */
9437 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
9438 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
9439 	ip1dbg(("created %s\n", lifr->lifr_name));
9440 
9441 	/* Set address */
9442 	sin = (sin_t *)&lifr->lifr_addr;
9443 	if (sin->sin_family != AF_UNSPEC) {
9444 		err = ip_sioctl_addr(ipif, sin, q, mp,
9445 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
9446 	}
9447 
9448 done:
9449 	ipsq_exit(ipsq);
9450 	return (err);
9451 }
9452 
9453 /*
9454  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
9455  * interface) delete it based on the IP address (on this physical interface).
9456  * Otherwise delete it based on the ipif_id.
9457  * Also, special handling to allow a removeif of lo0.
9458  */
9459 /* ARGSUSED */
9460 int
9461 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9462     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9463 {
9464 	conn_t		*connp;
9465 	ill_t		*ill = ipif->ipif_ill;
9466 	boolean_t	 success;
9467 	ip_stack_t	*ipst;
9468 
9469 	ipst = CONNQ_TO_IPST(q);
9470 
9471 	ASSERT(q->q_next == NULL);
9472 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
9473 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9474 	ASSERT(IAM_WRITER_IPIF(ipif));
9475 
9476 	connp = Q_TO_CONN(q);
9477 	/*
9478 	 * Special case for unplumbing lo0 (the loopback physical interface).
9479 	 * If unplumbing lo0, the incoming address structure has been
9480 	 * initialized to all zeros. When unplumbing lo0, all its logical
9481 	 * interfaces must be removed too.
9482 	 *
9483 	 * Note that this interface may be called to remove a specific
9484 	 * loopback logical interface (eg, lo0:1). But in that case
9485 	 * ipif->ipif_id != 0 so that the code path for that case is the
9486 	 * same as any other interface (meaning it skips the code directly
9487 	 * below).
9488 	 */
9489 	if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9490 		if (sin->sin_family == AF_UNSPEC &&
9491 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
9492 			/*
9493 			 * Mark it condemned. No new ref. will be made to ill.
9494 			 */
9495 			mutex_enter(&ill->ill_lock);
9496 			ill->ill_state_flags |= ILL_CONDEMNED;
9497 			for (ipif = ill->ill_ipif; ipif != NULL;
9498 			    ipif = ipif->ipif_next) {
9499 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
9500 			}
9501 			mutex_exit(&ill->ill_lock);
9502 
9503 			ipif = ill->ill_ipif;
9504 			/* unplumb the loopback interface */
9505 			ill_delete(ill);
9506 			mutex_enter(&connp->conn_lock);
9507 			mutex_enter(&ill->ill_lock);
9508 
9509 			/* Are any references to this ill active */
9510 			if (ill_is_freeable(ill)) {
9511 				mutex_exit(&ill->ill_lock);
9512 				mutex_exit(&connp->conn_lock);
9513 				ill_delete_tail(ill);
9514 				mi_free(ill);
9515 				return (0);
9516 			}
9517 			success = ipsq_pending_mp_add(connp, ipif,
9518 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
9519 			mutex_exit(&connp->conn_lock);
9520 			mutex_exit(&ill->ill_lock);
9521 			if (success)
9522 				return (EINPROGRESS);
9523 			else
9524 				return (EINTR);
9525 		}
9526 	}
9527 
9528 	if (ipif->ipif_id == 0) {
9529 		ipsq_t *ipsq;
9530 
9531 		/* Find based on address */
9532 		if (ipif->ipif_isv6) {
9533 			sin6_t *sin6;
9534 
9535 			if (sin->sin_family != AF_INET6)
9536 				return (EAFNOSUPPORT);
9537 
9538 			sin6 = (sin6_t *)sin;
9539 			/* We are a writer, so we should be able to lookup */
9540 			ipif = ipif_lookup_addr_exact_v6(&sin6->sin6_addr, ill,
9541 			    ipst);
9542 		} else {
9543 			if (sin->sin_family != AF_INET)
9544 				return (EAFNOSUPPORT);
9545 
9546 			/* We are a writer, so we should be able to lookup */
9547 			ipif = ipif_lookup_addr_exact(sin->sin_addr.s_addr, ill,
9548 			    ipst);
9549 		}
9550 		if (ipif == NULL) {
9551 			return (EADDRNOTAVAIL);
9552 		}
9553 
9554 		/*
9555 		 * It is possible for a user to send an SIOCLIFREMOVEIF with
9556 		 * lifr_name of the physical interface but with an ip address
9557 		 * lifr_addr of a logical interface plumbed over it.
9558 		 * So update ipx_current_ipif now that ipif points to the
9559 		 * correct one.
9560 		 */
9561 		ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
9562 		ipsq->ipsq_xop->ipx_current_ipif = ipif;
9563 
9564 		/* This is a writer */
9565 		ipif_refrele(ipif);
9566 	}
9567 
9568 	/*
9569 	 * Can not delete instance zero since it is tied to the ill.
9570 	 */
9571 	if (ipif->ipif_id == 0)
9572 		return (EBUSY);
9573 
9574 	mutex_enter(&ill->ill_lock);
9575 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
9576 	mutex_exit(&ill->ill_lock);
9577 
9578 	ipif_free(ipif);
9579 
9580 	mutex_enter(&connp->conn_lock);
9581 	mutex_enter(&ill->ill_lock);
9582 
9583 	/* Are any references to this ipif active */
9584 	if (ipif_is_freeable(ipif)) {
9585 		mutex_exit(&ill->ill_lock);
9586 		mutex_exit(&connp->conn_lock);
9587 		ipif_non_duplicate(ipif);
9588 		(void) ipif_down_tail(ipif);
9589 		ipif_free_tail(ipif); /* frees ipif */
9590 		return (0);
9591 	}
9592 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
9593 	    IPIF_FREE);
9594 	mutex_exit(&ill->ill_lock);
9595 	mutex_exit(&connp->conn_lock);
9596 	if (success)
9597 		return (EINPROGRESS);
9598 	else
9599 		return (EINTR);
9600 }
9601 
9602 /*
9603  * Restart the removeif ioctl. The refcnt has gone down to 0.
9604  * The ipif is already condemned. So can't find it thru lookups.
9605  */
9606 /* ARGSUSED */
9607 int
9608 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
9609     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9610 {
9611 	ill_t *ill = ipif->ipif_ill;
9612 
9613 	ASSERT(IAM_WRITER_IPIF(ipif));
9614 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
9615 
9616 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
9617 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9618 
9619 	if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9620 		ASSERT(ill->ill_state_flags & ILL_CONDEMNED);
9621 		ill_delete_tail(ill);
9622 		mi_free(ill);
9623 		return (0);
9624 	}
9625 
9626 	ipif_non_duplicate(ipif);
9627 	(void) ipif_down_tail(ipif);
9628 	ipif_free_tail(ipif);
9629 
9630 	return (0);
9631 }
9632 
9633 /*
9634  * Set the local interface address using the given prefix and ill_token.
9635  */
9636 /* ARGSUSED */
9637 int
9638 ip_sioctl_prefix(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9639     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9640 {
9641 	int err;
9642 	in6_addr_t v6addr;
9643 	sin6_t *sin6;
9644 	ill_t *ill;
9645 	int i;
9646 
9647 	ip1dbg(("ip_sioctl_prefix(%s:%u %p)\n",
9648 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9649 
9650 	ASSERT(IAM_WRITER_IPIF(ipif));
9651 
9652 	if (!ipif->ipif_isv6)
9653 		return (EINVAL);
9654 
9655 	if (sin->sin_family != AF_INET6)
9656 		return (EAFNOSUPPORT);
9657 
9658 	sin6 = (sin6_t *)sin;
9659 	v6addr = sin6->sin6_addr;
9660 	ill = ipif->ipif_ill;
9661 
9662 	if (IN6_IS_ADDR_UNSPECIFIED(&v6addr) ||
9663 	    IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token))
9664 		return (EADDRNOTAVAIL);
9665 
9666 	for (i = 0; i < 4; i++)
9667 		sin6->sin6_addr.s6_addr32[i] |= ill->ill_token.s6_addr32[i];
9668 
9669 	err = ip_sioctl_addr(ipif, sin, q, mp,
9670 	    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], dummy_ifreq);
9671 	return (err);
9672 }
9673 
9674 /*
9675  * Restart entry point to restart the address set operation after the
9676  * refcounts have dropped to zero.
9677  */
9678 /* ARGSUSED */
9679 int
9680 ip_sioctl_prefix_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9681     ip_ioctl_cmd_t *ipip, void *ifreq)
9682 {
9683 	ip1dbg(("ip_sioctl_prefix_restart(%s:%u %p)\n",
9684 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9685 	return (ip_sioctl_addr_restart(ipif, sin, q, mp, ipip, ifreq));
9686 }
9687 
9688 /*
9689  * Set the local interface address.
9690  * Allow an address of all zero when the interface is down.
9691  */
9692 /* ARGSUSED */
9693 int
9694 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9695     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9696 {
9697 	int err = 0;
9698 	in6_addr_t v6addr;
9699 	boolean_t need_up = B_FALSE;
9700 	ill_t *ill;
9701 	int i;
9702 
9703 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
9704 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9705 
9706 	ASSERT(IAM_WRITER_IPIF(ipif));
9707 
9708 	ill = ipif->ipif_ill;
9709 	if (ipif->ipif_isv6) {
9710 		sin6_t *sin6;
9711 		phyint_t *phyi;
9712 
9713 		if (sin->sin_family != AF_INET6)
9714 			return (EAFNOSUPPORT);
9715 
9716 		sin6 = (sin6_t *)sin;
9717 		v6addr = sin6->sin6_addr;
9718 		phyi = ill->ill_phyint;
9719 
9720 		/*
9721 		 * Enforce that true multicast interfaces have a link-local
9722 		 * address for logical unit 0.
9723 		 *
9724 		 * However for those ipif's for which link-local address was
9725 		 * not created by default, also allow setting :: as the address.
9726 		 * This scenario would arise, when we delete an address on ipif
9727 		 * with logical unit 0, we would want to set :: as the address.
9728 		 */
9729 		if (ipif->ipif_id == 0 &&
9730 		    (ill->ill_flags & ILLF_MULTICAST) &&
9731 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
9732 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
9733 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
9734 
9735 			/*
9736 			 * if default link-local was not created by kernel for
9737 			 * this ill, allow setting :: as the address on ipif:0.
9738 			 */
9739 			if (ill->ill_flags & ILLF_NOLINKLOCAL) {
9740 				if (!IN6_IS_ADDR_UNSPECIFIED(&v6addr))
9741 					return (EADDRNOTAVAIL);
9742 			} else {
9743 				return (EADDRNOTAVAIL);
9744 			}
9745 		}
9746 
9747 		/*
9748 		 * up interfaces shouldn't have the unspecified address
9749 		 * unless they also have the IPIF_NOLOCAL flags set and
9750 		 * have a subnet assigned.
9751 		 */
9752 		if ((ipif->ipif_flags & IPIF_UP) &&
9753 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
9754 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
9755 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
9756 			return (EADDRNOTAVAIL);
9757 		}
9758 
9759 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
9760 			return (EADDRNOTAVAIL);
9761 	} else {
9762 		ipaddr_t addr;
9763 
9764 		if (sin->sin_family != AF_INET)
9765 			return (EAFNOSUPPORT);
9766 
9767 		addr = sin->sin_addr.s_addr;
9768 
9769 		/* Allow INADDR_ANY as the local address. */
9770 		if (addr != INADDR_ANY &&
9771 		    !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
9772 			return (EADDRNOTAVAIL);
9773 
9774 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9775 	}
9776 	/*
9777 	 * verify that the address being configured is permitted by the
9778 	 * ill_allowed_ips[] for the interface.
9779 	 */
9780 	if (ill->ill_allowed_ips_cnt > 0) {
9781 		for (i = 0; i < ill->ill_allowed_ips_cnt; i++) {
9782 			if (IN6_ARE_ADDR_EQUAL(&ill->ill_allowed_ips[i],
9783 			    &v6addr))
9784 				break;
9785 		}
9786 		if (i == ill->ill_allowed_ips_cnt) {
9787 			pr_addr_dbg("!allowed addr %s\n", AF_INET6, &v6addr);
9788 			return (EPERM);
9789 		}
9790 	}
9791 	/*
9792 	 * Even if there is no change we redo things just to rerun
9793 	 * ipif_set_default.
9794 	 */
9795 	if (ipif->ipif_flags & IPIF_UP) {
9796 		/*
9797 		 * Setting a new local address, make sure
9798 		 * we have net and subnet bcast ire's for
9799 		 * the old address if we need them.
9800 		 */
9801 		/*
9802 		 * If the interface is already marked up,
9803 		 * we call ipif_down which will take care
9804 		 * of ditching any IREs that have been set
9805 		 * up based on the old interface address.
9806 		 */
9807 		err = ipif_logical_down(ipif, q, mp);
9808 		if (err == EINPROGRESS)
9809 			return (err);
9810 		(void) ipif_down_tail(ipif);
9811 		need_up = 1;
9812 	}
9813 
9814 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
9815 	return (err);
9816 }
9817 
9818 int
9819 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9820     boolean_t need_up)
9821 {
9822 	in6_addr_t v6addr;
9823 	in6_addr_t ov6addr;
9824 	ipaddr_t addr;
9825 	sin6_t	*sin6;
9826 	int	sinlen;
9827 	int	err = 0;
9828 	ill_t	*ill = ipif->ipif_ill;
9829 	boolean_t need_dl_down;
9830 	boolean_t need_arp_down;
9831 	struct iocblk *iocp;
9832 
9833 	iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
9834 
9835 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
9836 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9837 	ASSERT(IAM_WRITER_IPIF(ipif));
9838 
9839 	/* Must cancel any pending timer before taking the ill_lock */
9840 	if (ipif->ipif_recovery_id != 0)
9841 		(void) untimeout(ipif->ipif_recovery_id);
9842 	ipif->ipif_recovery_id = 0;
9843 
9844 	if (ipif->ipif_isv6) {
9845 		sin6 = (sin6_t *)sin;
9846 		v6addr = sin6->sin6_addr;
9847 		sinlen = sizeof (struct sockaddr_in6);
9848 	} else {
9849 		addr = sin->sin_addr.s_addr;
9850 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9851 		sinlen = sizeof (struct sockaddr_in);
9852 	}
9853 	mutex_enter(&ill->ill_lock);
9854 	ov6addr = ipif->ipif_v6lcl_addr;
9855 	ipif->ipif_v6lcl_addr = v6addr;
9856 	sctp_update_ipif_addr(ipif, ov6addr);
9857 	ipif->ipif_addr_ready = 0;
9858 
9859 	ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
9860 
9861 	/*
9862 	 * If the interface was previously marked as a duplicate, then since
9863 	 * we've now got a "new" address, it should no longer be considered a
9864 	 * duplicate -- even if the "new" address is the same as the old one.
9865 	 * Note that if all ipifs are down, we may have a pending ARP down
9866 	 * event to handle.  This is because we want to recover from duplicates
9867 	 * and thus delay tearing down ARP until the duplicates have been
9868 	 * removed or disabled.
9869 	 */
9870 	need_dl_down = need_arp_down = B_FALSE;
9871 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
9872 		need_arp_down = !need_up;
9873 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
9874 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
9875 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
9876 			need_dl_down = B_TRUE;
9877 		}
9878 	}
9879 
9880 	ipif_set_default(ipif);
9881 
9882 	/*
9883 	 * If we've just manually set the IPv6 link-local address (0th ipif),
9884 	 * tag the ill so that future updates to the interface ID don't result
9885 	 * in this address getting automatically reconfigured from under the
9886 	 * administrator.
9887 	 */
9888 	if (ipif->ipif_isv6 && ipif->ipif_id == 0) {
9889 		if (iocp == NULL || (iocp->ioc_cmd == SIOCSLIFADDR &&
9890 		    !IN6_IS_ADDR_UNSPECIFIED(&v6addr)))
9891 			ill->ill_manual_linklocal = 1;
9892 	}
9893 
9894 	/*
9895 	 * When publishing an interface address change event, we only notify
9896 	 * the event listeners of the new address.  It is assumed that if they
9897 	 * actively care about the addresses assigned that they will have
9898 	 * already discovered the previous address assigned (if there was one.)
9899 	 *
9900 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
9901 	 */
9902 	if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
9903 		ill_nic_event_dispatch(ill, MAP_IPIF_ID(ipif->ipif_id),
9904 		    NE_ADDRESS_CHANGE, sin, sinlen);
9905 	}
9906 
9907 	mutex_exit(&ill->ill_lock);
9908 
9909 	if (need_up) {
9910 		/*
9911 		 * Now bring the interface back up.  If this
9912 		 * is the only IPIF for the ILL, ipif_up
9913 		 * will have to re-bind to the device, so
9914 		 * we may get back EINPROGRESS, in which
9915 		 * case, this IOCTL will get completed in
9916 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
9917 		 */
9918 		err = ipif_up(ipif, q, mp);
9919 	} else {
9920 		/* Perhaps ilgs should use this ill */
9921 		update_conn_ill(NULL, ill->ill_ipst);
9922 	}
9923 
9924 	if (need_dl_down)
9925 		ill_dl_down(ill);
9926 
9927 	if (need_arp_down && !ill->ill_isv6)
9928 		(void) ipif_arp_down(ipif);
9929 
9930 	/*
9931 	 * The default multicast interface might have changed (for
9932 	 * instance if the IPv6 scope of the address changed)
9933 	 */
9934 	ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
9935 
9936 	return (err);
9937 }
9938 
9939 /*
9940  * Restart entry point to restart the address set operation after the
9941  * refcounts have dropped to zero.
9942  */
9943 /* ARGSUSED */
9944 int
9945 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9946     ip_ioctl_cmd_t *ipip, void *ifreq)
9947 {
9948 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
9949 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9950 	ASSERT(IAM_WRITER_IPIF(ipif));
9951 	(void) ipif_down_tail(ipif);
9952 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
9953 }
9954 
9955 /* ARGSUSED */
9956 int
9957 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9958     ip_ioctl_cmd_t *ipip, void *if_req)
9959 {
9960 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
9961 	struct lifreq *lifr = (struct lifreq *)if_req;
9962 
9963 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
9964 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9965 	/*
9966 	 * The net mask and address can't change since we have a
9967 	 * reference to the ipif. So no lock is necessary.
9968 	 */
9969 	if (ipif->ipif_isv6) {
9970 		*sin6 = sin6_null;
9971 		sin6->sin6_family = AF_INET6;
9972 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
9973 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
9974 		lifr->lifr_addrlen =
9975 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
9976 	} else {
9977 		*sin = sin_null;
9978 		sin->sin_family = AF_INET;
9979 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
9980 		if (ipip->ipi_cmd_type == LIF_CMD) {
9981 			lifr->lifr_addrlen =
9982 			    ip_mask_to_plen(ipif->ipif_net_mask);
9983 		}
9984 	}
9985 	return (0);
9986 }
9987 
9988 /*
9989  * Set the destination address for a pt-pt interface.
9990  */
9991 /* ARGSUSED */
9992 int
9993 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9994     ip_ioctl_cmd_t *ipip, void *if_req)
9995 {
9996 	int err = 0;
9997 	in6_addr_t v6addr;
9998 	boolean_t need_up = B_FALSE;
9999 
10000 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
10001 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10002 	ASSERT(IAM_WRITER_IPIF(ipif));
10003 
10004 	if (ipif->ipif_isv6) {
10005 		sin6_t *sin6;
10006 
10007 		if (sin->sin_family != AF_INET6)
10008 			return (EAFNOSUPPORT);
10009 
10010 		sin6 = (sin6_t *)sin;
10011 		v6addr = sin6->sin6_addr;
10012 
10013 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
10014 			return (EADDRNOTAVAIL);
10015 	} else {
10016 		ipaddr_t addr;
10017 
10018 		if (sin->sin_family != AF_INET)
10019 			return (EAFNOSUPPORT);
10020 
10021 		addr = sin->sin_addr.s_addr;
10022 		if (addr != INADDR_ANY &&
10023 		    !ip_addr_ok_v4(addr, ipif->ipif_net_mask)) {
10024 			return (EADDRNOTAVAIL);
10025 		}
10026 
10027 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10028 	}
10029 
10030 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
10031 		return (0);	/* No change */
10032 
10033 	if (ipif->ipif_flags & IPIF_UP) {
10034 		/*
10035 		 * If the interface is already marked up,
10036 		 * we call ipif_down which will take care
10037 		 * of ditching any IREs that have been set
10038 		 * up based on the old pp dst address.
10039 		 */
10040 		err = ipif_logical_down(ipif, q, mp);
10041 		if (err == EINPROGRESS)
10042 			return (err);
10043 		(void) ipif_down_tail(ipif);
10044 		need_up = B_TRUE;
10045 	}
10046 	/*
10047 	 * could return EINPROGRESS. If so ioctl will complete in
10048 	 * ip_rput_dlpi_writer
10049 	 */
10050 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
10051 	return (err);
10052 }
10053 
10054 static int
10055 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10056     boolean_t need_up)
10057 {
10058 	in6_addr_t v6addr;
10059 	ill_t	*ill = ipif->ipif_ill;
10060 	int	err = 0;
10061 	boolean_t need_dl_down;
10062 	boolean_t need_arp_down;
10063 
10064 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
10065 	    ipif->ipif_id, (void *)ipif));
10066 
10067 	/* Must cancel any pending timer before taking the ill_lock */
10068 	if (ipif->ipif_recovery_id != 0)
10069 		(void) untimeout(ipif->ipif_recovery_id);
10070 	ipif->ipif_recovery_id = 0;
10071 
10072 	if (ipif->ipif_isv6) {
10073 		sin6_t *sin6;
10074 
10075 		sin6 = (sin6_t *)sin;
10076 		v6addr = sin6->sin6_addr;
10077 	} else {
10078 		ipaddr_t addr;
10079 
10080 		addr = sin->sin_addr.s_addr;
10081 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10082 	}
10083 	mutex_enter(&ill->ill_lock);
10084 	/* Set point to point destination address. */
10085 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10086 		/*
10087 		 * Allow this as a means of creating logical
10088 		 * pt-pt interfaces on top of e.g. an Ethernet.
10089 		 * XXX Undocumented HACK for testing.
10090 		 * pt-pt interfaces are created with NUD disabled.
10091 		 */
10092 		ipif->ipif_flags |= IPIF_POINTOPOINT;
10093 		ipif->ipif_flags &= ~IPIF_BROADCAST;
10094 		if (ipif->ipif_isv6)
10095 			ill->ill_flags |= ILLF_NONUD;
10096 	}
10097 
10098 	/*
10099 	 * If the interface was previously marked as a duplicate, then since
10100 	 * we've now got a "new" address, it should no longer be considered a
10101 	 * duplicate -- even if the "new" address is the same as the old one.
10102 	 * Note that if all ipifs are down, we may have a pending ARP down
10103 	 * event to handle.
10104 	 */
10105 	need_dl_down = need_arp_down = B_FALSE;
10106 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
10107 		need_arp_down = !need_up;
10108 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
10109 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
10110 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
10111 			need_dl_down = B_TRUE;
10112 		}
10113 	}
10114 
10115 	/*
10116 	 * If we've just manually set the IPv6 destination link-local address
10117 	 * (0th ipif), tag the ill so that future updates to the destination
10118 	 * interface ID (as can happen with interfaces over IP tunnels) don't
10119 	 * result in this address getting automatically reconfigured from
10120 	 * under the administrator.
10121 	 */
10122 	if (ipif->ipif_isv6 && ipif->ipif_id == 0)
10123 		ill->ill_manual_dst_linklocal = 1;
10124 
10125 	/* Set the new address. */
10126 	ipif->ipif_v6pp_dst_addr = v6addr;
10127 	/* Make sure subnet tracks pp_dst */
10128 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
10129 	mutex_exit(&ill->ill_lock);
10130 
10131 	if (need_up) {
10132 		/*
10133 		 * Now bring the interface back up.  If this
10134 		 * is the only IPIF for the ILL, ipif_up
10135 		 * will have to re-bind to the device, so
10136 		 * we may get back EINPROGRESS, in which
10137 		 * case, this IOCTL will get completed in
10138 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10139 		 */
10140 		err = ipif_up(ipif, q, mp);
10141 	}
10142 
10143 	if (need_dl_down)
10144 		ill_dl_down(ill);
10145 	if (need_arp_down && !ipif->ipif_isv6)
10146 		(void) ipif_arp_down(ipif);
10147 
10148 	return (err);
10149 }
10150 
10151 /*
10152  * Restart entry point to restart the dstaddress set operation after the
10153  * refcounts have dropped to zero.
10154  */
10155 /* ARGSUSED */
10156 int
10157 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10158     ip_ioctl_cmd_t *ipip, void *ifreq)
10159 {
10160 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
10161 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10162 	(void) ipif_down_tail(ipif);
10163 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
10164 }
10165 
10166 /* ARGSUSED */
10167 int
10168 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10169     ip_ioctl_cmd_t *ipip, void *if_req)
10170 {
10171 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
10172 
10173 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
10174 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10175 	/*
10176 	 * Get point to point destination address. The addresses can't
10177 	 * change since we hold a reference to the ipif.
10178 	 */
10179 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
10180 		return (EADDRNOTAVAIL);
10181 
10182 	if (ipif->ipif_isv6) {
10183 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10184 		*sin6 = sin6_null;
10185 		sin6->sin6_family = AF_INET6;
10186 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
10187 	} else {
10188 		*sin = sin_null;
10189 		sin->sin_family = AF_INET;
10190 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
10191 	}
10192 	return (0);
10193 }
10194 
10195 /*
10196  * Check which flags will change by the given flags being set
10197  * silently ignore flags which userland is not allowed to control.
10198  * (Because these flags may change between SIOCGLIFFLAGS and
10199  * SIOCSLIFFLAGS, and that's outside of userland's control,
10200  * we need to silently ignore them rather than fail.)
10201  */
10202 static void
10203 ip_sioctl_flags_onoff(ipif_t *ipif, uint64_t flags, uint64_t *onp,
10204     uint64_t *offp)
10205 {
10206 	ill_t		*ill = ipif->ipif_ill;
10207 	phyint_t 	*phyi = ill->ill_phyint;
10208 	uint64_t	cantchange_flags, intf_flags;
10209 	uint64_t	turn_on, turn_off;
10210 
10211 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10212 	cantchange_flags = IFF_CANTCHANGE;
10213 	if (IS_IPMP(ill))
10214 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
10215 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
10216 	turn_off = intf_flags & turn_on;
10217 	turn_on ^= turn_off;
10218 	*onp = turn_on;
10219 	*offp = turn_off;
10220 }
10221 
10222 /*
10223  * Set interface flags.  Many flags require special handling (e.g.,
10224  * bringing the interface down); see below for details.
10225  *
10226  * NOTE : We really don't enforce that ipif_id zero should be used
10227  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
10228  *	  is because applications generally does SICGLIFFLAGS and
10229  *	  ORs in the new flags (that affects the logical) and does a
10230  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
10231  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
10232  *	  flags that will be turned on is correct with respect to
10233  *	  ipif_id 0. For backward compatibility reasons, it is not done.
10234  */
10235 /* ARGSUSED */
10236 int
10237 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10238     ip_ioctl_cmd_t *ipip, void *if_req)
10239 {
10240 	uint64_t turn_on;
10241 	uint64_t turn_off;
10242 	int	err = 0;
10243 	phyint_t *phyi;
10244 	ill_t *ill;
10245 	conn_t *connp;
10246 	uint64_t intf_flags;
10247 	boolean_t phyint_flags_modified = B_FALSE;
10248 	uint64_t flags;
10249 	struct ifreq *ifr;
10250 	struct lifreq *lifr;
10251 	boolean_t set_linklocal = B_FALSE;
10252 
10253 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
10254 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10255 
10256 	ASSERT(IAM_WRITER_IPIF(ipif));
10257 
10258 	ill = ipif->ipif_ill;
10259 	phyi = ill->ill_phyint;
10260 
10261 	if (ipip->ipi_cmd_type == IF_CMD) {
10262 		ifr = (struct ifreq *)if_req;
10263 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
10264 	} else {
10265 		lifr = (struct lifreq *)if_req;
10266 		flags = lifr->lifr_flags;
10267 	}
10268 
10269 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10270 
10271 	/*
10272 	 * Have the flags been set correctly until now?
10273 	 */
10274 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10275 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10276 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10277 	/*
10278 	 * Compare the new flags to the old, and partition
10279 	 * into those coming on and those going off.
10280 	 * For the 16 bit command keep the bits above bit 16 unchanged.
10281 	 */
10282 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
10283 		flags |= intf_flags & ~0xFFFF;
10284 
10285 	/*
10286 	 * Explicitly fail attempts to change flags that are always invalid on
10287 	 * an IPMP meta-interface.
10288 	 */
10289 	if (IS_IPMP(ill) && ((flags ^ intf_flags) & IFF_IPMP_INVALID))
10290 		return (EINVAL);
10291 
10292 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10293 	if ((turn_on|turn_off) == 0)
10294 		return (0);	/* No change */
10295 
10296 	/*
10297 	 * All test addresses must be IFF_DEPRECATED (to ensure source address
10298 	 * selection avoids them) -- so force IFF_DEPRECATED on, and do not
10299 	 * allow it to be turned off.
10300 	 */
10301 	if ((turn_off & (IFF_DEPRECATED|IFF_NOFAILOVER)) == IFF_DEPRECATED &&
10302 	    (turn_on|intf_flags) & IFF_NOFAILOVER)
10303 		return (EINVAL);
10304 
10305 	if ((connp = Q_TO_CONN(q)) == NULL)
10306 		return (EINVAL);
10307 
10308 	/*
10309 	 * Only vrrp control socket is allowed to change IFF_UP and
10310 	 * IFF_NOACCEPT flags when IFF_VRRP is set.
10311 	 */
10312 	if ((intf_flags & IFF_VRRP) && ((turn_off | turn_on) & IFF_UP)) {
10313 		if (!connp->conn_isvrrp)
10314 			return (EINVAL);
10315 	}
10316 
10317 	/*
10318 	 * The IFF_NOACCEPT flag can only be set on an IFF_VRRP IP address by
10319 	 * VRRP control socket.
10320 	 */
10321 	if ((turn_off | turn_on) & IFF_NOACCEPT) {
10322 		if (!connp->conn_isvrrp || !(intf_flags & IFF_VRRP))
10323 			return (EINVAL);
10324 	}
10325 
10326 	if (turn_on & IFF_NOFAILOVER) {
10327 		turn_on |= IFF_DEPRECATED;
10328 		flags |= IFF_DEPRECATED;
10329 	}
10330 
10331 	/*
10332 	 * On underlying interfaces, only allow applications to manage test
10333 	 * addresses -- otherwise, they may get confused when the address
10334 	 * moves as part of being brought up.  Likewise, prevent an
10335 	 * application-managed test address from being converted to a data
10336 	 * address.  To prevent migration of administratively up addresses in
10337 	 * the kernel, we don't allow them to be converted either.
10338 	 */
10339 	if (IS_UNDER_IPMP(ill)) {
10340 		const uint64_t appflags = IFF_DHCPRUNNING | IFF_ADDRCONF;
10341 
10342 		if ((turn_on & appflags) && !(flags & IFF_NOFAILOVER))
10343 			return (EINVAL);
10344 
10345 		if ((turn_off & IFF_NOFAILOVER) &&
10346 		    (flags & (appflags | IFF_UP | IFF_DUPLICATE)))
10347 			return (EINVAL);
10348 	}
10349 
10350 	/*
10351 	 * Only allow IFF_TEMPORARY flag to be set on
10352 	 * IPv6 interfaces.
10353 	 */
10354 	if ((turn_on & IFF_TEMPORARY) && !(ipif->ipif_isv6))
10355 		return (EINVAL);
10356 
10357 	/*
10358 	 * cannot turn off IFF_NOXMIT on  VNI interfaces.
10359 	 */
10360 	if ((turn_off & IFF_NOXMIT) && IS_VNI(ipif->ipif_ill))
10361 		return (EINVAL);
10362 
10363 	/*
10364 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
10365 	 * interfaces.  It makes no sense in that context.
10366 	 */
10367 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
10368 		return (EINVAL);
10369 
10370 	/*
10371 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
10372 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
10373 	 * If the link local address isn't set, and can be set, it will get
10374 	 * set later on in this function.
10375 	 */
10376 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
10377 	    (flags & IFF_UP) && !(flags & (IFF_NOLOCAL|IFF_ANYCAST)) &&
10378 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
10379 		if (ipif_cant_setlinklocal(ipif))
10380 			return (EINVAL);
10381 		set_linklocal = B_TRUE;
10382 	}
10383 
10384 	/*
10385 	 * If we modify physical interface flags, we'll potentially need to
10386 	 * send up two routing socket messages for the changes (one for the
10387 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
10388 	 */
10389 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10390 		phyint_flags_modified = B_TRUE;
10391 
10392 	/*
10393 	 * All functioning PHYI_STANDBY interfaces start life PHYI_INACTIVE
10394 	 * (otherwise, we'd immediately use them, defeating standby).  Also,
10395 	 * since PHYI_INACTIVE has a separate meaning when PHYI_STANDBY is not
10396 	 * set, don't allow PHYI_STANDBY to be set if PHYI_INACTIVE is already
10397 	 * set, and clear PHYI_INACTIVE if PHYI_STANDBY is being cleared.  We
10398 	 * also don't allow PHYI_STANDBY if VNI is enabled since its semantics
10399 	 * will not be honored.
10400 	 */
10401 	if (turn_on & PHYI_STANDBY) {
10402 		/*
10403 		 * No need to grab ill_g_usesrc_lock here; see the
10404 		 * synchronization notes in ip.c.
10405 		 */
10406 		if (ill->ill_usesrc_grp_next != NULL ||
10407 		    intf_flags & PHYI_INACTIVE)
10408 			return (EINVAL);
10409 		if (!(flags & PHYI_FAILED)) {
10410 			flags |= PHYI_INACTIVE;
10411 			turn_on |= PHYI_INACTIVE;
10412 		}
10413 	}
10414 
10415 	if (turn_off & PHYI_STANDBY) {
10416 		flags &= ~PHYI_INACTIVE;
10417 		turn_off |= PHYI_INACTIVE;
10418 	}
10419 
10420 	/*
10421 	 * PHYI_FAILED and PHYI_INACTIVE are mutually exclusive; fail if both
10422 	 * would end up on.
10423 	 */
10424 	if ((flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
10425 	    (PHYI_FAILED | PHYI_INACTIVE))
10426 		return (EINVAL);
10427 
10428 	/*
10429 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
10430 	 * status of the interface.
10431 	 */
10432 	if ((turn_on | turn_off) & ILLF_ROUTER) {
10433 		err = ill_forward_set(ill, ((turn_on & ILLF_ROUTER) != 0));
10434 		if (err != 0)
10435 			return (err);
10436 	}
10437 
10438 	/*
10439 	 * If the interface is not UP and we are not going to
10440 	 * bring it UP, record the flags and return. When the
10441 	 * interface comes UP later, the right actions will be
10442 	 * taken.
10443 	 */
10444 	if (!(ipif->ipif_flags & IPIF_UP) &&
10445 	    !(turn_on & IPIF_UP)) {
10446 		/* Record new flags in their respective places. */
10447 		mutex_enter(&ill->ill_lock);
10448 		mutex_enter(&ill->ill_phyint->phyint_lock);
10449 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10450 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10451 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10452 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10453 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10454 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10455 		mutex_exit(&ill->ill_lock);
10456 		mutex_exit(&ill->ill_phyint->phyint_lock);
10457 
10458 		/*
10459 		 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the
10460 		 * same to the kernel: if any of them has been set by
10461 		 * userland, the interface cannot be used for data traffic.
10462 		 */
10463 		if ((turn_on|turn_off) &
10464 		    (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10465 			ASSERT(!IS_IPMP(ill));
10466 			/*
10467 			 * It's possible the ill is part of an "anonymous"
10468 			 * IPMP group rather than a real group.  In that case,
10469 			 * there are no other interfaces in the group and thus
10470 			 * no need to call ipmp_phyint_refresh_active().
10471 			 */
10472 			if (IS_UNDER_IPMP(ill))
10473 				ipmp_phyint_refresh_active(phyi);
10474 		}
10475 
10476 		if (phyint_flags_modified) {
10477 			if (phyi->phyint_illv4 != NULL) {
10478 				ip_rts_ifmsg(phyi->phyint_illv4->
10479 				    ill_ipif, RTSQ_DEFAULT);
10480 			}
10481 			if (phyi->phyint_illv6 != NULL) {
10482 				ip_rts_ifmsg(phyi->phyint_illv6->
10483 				    ill_ipif, RTSQ_DEFAULT);
10484 			}
10485 		}
10486 		/* The default multicast interface might have changed */
10487 		ire_increment_multicast_generation(ill->ill_ipst,
10488 		    ill->ill_isv6);
10489 
10490 		return (0);
10491 	} else if (set_linklocal) {
10492 		mutex_enter(&ill->ill_lock);
10493 		if (set_linklocal)
10494 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
10495 		mutex_exit(&ill->ill_lock);
10496 	}
10497 
10498 	/*
10499 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
10500 	 * or point-to-point interfaces with an unspecified destination. We do
10501 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
10502 	 * have a subnet assigned, which is how in.ndpd currently manages its
10503 	 * onlink prefix list when no addresses are configured with those
10504 	 * prefixes.
10505 	 */
10506 	if (ipif->ipif_isv6 &&
10507 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
10508 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
10509 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
10510 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10511 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
10512 		return (EINVAL);
10513 	}
10514 
10515 	/*
10516 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
10517 	 * from being brought up.
10518 	 */
10519 	if (!ipif->ipif_isv6 &&
10520 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10521 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
10522 		return (EINVAL);
10523 	}
10524 
10525 	/*
10526 	 * If we are going to change one or more of the flags that are
10527 	 * IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL, ILLF_NOARP,
10528 	 * ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, IPIF_PREFERRED, and
10529 	 * IPIF_NOFAILOVER, we will take special action.  This is
10530 	 * done by bring the ipif down, changing the flags and bringing
10531 	 * it back up again.  For IPIF_NOFAILOVER, the act of bringing it
10532 	 * back up will trigger the address to be moved.
10533 	 *
10534 	 * If we are going to change IFF_NOACCEPT, we need to bring
10535 	 * all the ipifs down then bring them up again.	 The act of
10536 	 * bringing all the ipifs back up will trigger the local
10537 	 * ires being recreated with "no_accept" set/cleared.
10538 	 *
10539 	 * Note that ILLF_NOACCEPT is always set separately from the
10540 	 * other flags.
10541 	 */
10542 	if ((turn_on|turn_off) &
10543 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
10544 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED|
10545 	    IPIF_NOFAILOVER)) {
10546 		/*
10547 		 * ipif_down() will ire_delete bcast ire's for the subnet,
10548 		 * while the ire_identical_ref tracks the case of IRE_BROADCAST
10549 		 * entries shared between multiple ipifs on the same subnet.
10550 		 */
10551 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
10552 		    !(turn_off & IPIF_UP)) {
10553 			if (ipif->ipif_flags & IPIF_UP)
10554 				ill->ill_logical_down = 1;
10555 			turn_on &= ~IPIF_UP;
10556 		}
10557 		err = ipif_down(ipif, q, mp);
10558 		ip1dbg(("ipif_down returns %d err ", err));
10559 		if (err == EINPROGRESS)
10560 			return (err);
10561 		(void) ipif_down_tail(ipif);
10562 	} else if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10563 		/*
10564 		 * If we can quiesce the ill, then continue.  If not, then
10565 		 * ip_sioctl_flags_tail() will be called from
10566 		 * ipif_ill_refrele_tail().
10567 		 */
10568 		ill_down_ipifs(ill, B_TRUE);
10569 
10570 		mutex_enter(&connp->conn_lock);
10571 		mutex_enter(&ill->ill_lock);
10572 		if (!ill_is_quiescent(ill)) {
10573 			boolean_t success;
10574 
10575 			success = ipsq_pending_mp_add(connp, ill->ill_ipif,
10576 			    q, mp, ILL_DOWN);
10577 			mutex_exit(&ill->ill_lock);
10578 			mutex_exit(&connp->conn_lock);
10579 			return (success ? EINPROGRESS : EINTR);
10580 		}
10581 		mutex_exit(&ill->ill_lock);
10582 		mutex_exit(&connp->conn_lock);
10583 	}
10584 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10585 }
10586 
10587 static int
10588 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp)
10589 {
10590 	ill_t	*ill;
10591 	phyint_t *phyi;
10592 	uint64_t turn_on, turn_off;
10593 	boolean_t phyint_flags_modified = B_FALSE;
10594 	int	err = 0;
10595 	boolean_t set_linklocal = B_FALSE;
10596 
10597 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
10598 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
10599 
10600 	ASSERT(IAM_WRITER_IPIF(ipif));
10601 
10602 	ill = ipif->ipif_ill;
10603 	phyi = ill->ill_phyint;
10604 
10605 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10606 
10607 	/*
10608 	 * IFF_UP is handled separately.
10609 	 */
10610 	turn_on &= ~IFF_UP;
10611 	turn_off &= ~IFF_UP;
10612 
10613 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10614 		phyint_flags_modified = B_TRUE;
10615 
10616 	/*
10617 	 * Now we change the flags. Track current value of
10618 	 * other flags in their respective places.
10619 	 */
10620 	mutex_enter(&ill->ill_lock);
10621 	mutex_enter(&phyi->phyint_lock);
10622 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10623 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10624 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10625 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10626 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10627 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10628 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
10629 		set_linklocal = B_TRUE;
10630 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
10631 	}
10632 
10633 	mutex_exit(&ill->ill_lock);
10634 	mutex_exit(&phyi->phyint_lock);
10635 
10636 	if (set_linklocal)
10637 		(void) ipif_setlinklocal(ipif);
10638 
10639 	/*
10640 	 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the same to
10641 	 * the kernel: if any of them has been set by userland, the interface
10642 	 * cannot be used for data traffic.
10643 	 */
10644 	if ((turn_on|turn_off) & (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10645 		ASSERT(!IS_IPMP(ill));
10646 		/*
10647 		 * It's possible the ill is part of an "anonymous" IPMP group
10648 		 * rather than a real group.  In that case, there are no other
10649 		 * interfaces in the group and thus no need for us to call
10650 		 * ipmp_phyint_refresh_active().
10651 		 */
10652 		if (IS_UNDER_IPMP(ill))
10653 			ipmp_phyint_refresh_active(phyi);
10654 	}
10655 
10656 	if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10657 		/*
10658 		 * If the ILLF_NOACCEPT flag is changed, bring up all the
10659 		 * ipifs that were brought down.
10660 		 *
10661 		 * The routing sockets messages are sent as the result
10662 		 * of ill_up_ipifs(), further, SCTP's IPIF list was updated
10663 		 * as well.
10664 		 */
10665 		err = ill_up_ipifs(ill, q, mp);
10666 	} else if ((flags & IFF_UP) && !(ipif->ipif_flags & IPIF_UP)) {
10667 		/*
10668 		 * XXX ipif_up really does not know whether a phyint flags
10669 		 * was modified or not. So, it sends up information on
10670 		 * only one routing sockets message. As we don't bring up
10671 		 * the interface and also set PHYI_ flags simultaneously
10672 		 * it should be okay.
10673 		 */
10674 		err = ipif_up(ipif, q, mp);
10675 	} else {
10676 		/*
10677 		 * Make sure routing socket sees all changes to the flags.
10678 		 * ipif_up_done* handles this when we use ipif_up.
10679 		 */
10680 		if (phyint_flags_modified) {
10681 			if (phyi->phyint_illv4 != NULL) {
10682 				ip_rts_ifmsg(phyi->phyint_illv4->
10683 				    ill_ipif, RTSQ_DEFAULT);
10684 			}
10685 			if (phyi->phyint_illv6 != NULL) {
10686 				ip_rts_ifmsg(phyi->phyint_illv6->
10687 				    ill_ipif, RTSQ_DEFAULT);
10688 			}
10689 		} else {
10690 			ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
10691 		}
10692 		/*
10693 		 * Update the flags in SCTP's IPIF list, ipif_up() will do
10694 		 * this in need_up case.
10695 		 */
10696 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10697 	}
10698 
10699 	/* The default multicast interface might have changed */
10700 	ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
10701 	return (err);
10702 }
10703 
10704 /*
10705  * Restart the flags operation now that the refcounts have dropped to zero.
10706  */
10707 /* ARGSUSED */
10708 int
10709 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10710     ip_ioctl_cmd_t *ipip, void *if_req)
10711 {
10712 	uint64_t flags;
10713 	struct ifreq *ifr = if_req;
10714 	struct lifreq *lifr = if_req;
10715 	uint64_t turn_on, turn_off;
10716 
10717 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
10718 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10719 
10720 	if (ipip->ipi_cmd_type == IF_CMD) {
10721 		/* cast to uint16_t prevents unwanted sign extension */
10722 		flags = (uint16_t)ifr->ifr_flags;
10723 	} else {
10724 		flags = lifr->lifr_flags;
10725 	}
10726 
10727 	/*
10728 	 * If this function call is a result of the ILLF_NOACCEPT flag
10729 	 * change, do not call ipif_down_tail(). See ip_sioctl_flags().
10730 	 */
10731 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10732 	if (!((turn_on|turn_off) & ILLF_NOACCEPT))
10733 		(void) ipif_down_tail(ipif);
10734 
10735 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10736 }
10737 
10738 /*
10739  * Can operate on either a module or a driver queue.
10740  */
10741 /* ARGSUSED */
10742 int
10743 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10744     ip_ioctl_cmd_t *ipip, void *if_req)
10745 {
10746 	/*
10747 	 * Has the flags been set correctly till now ?
10748 	 */
10749 	ill_t *ill = ipif->ipif_ill;
10750 	phyint_t *phyi = ill->ill_phyint;
10751 
10752 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
10753 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10754 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10755 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10756 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10757 
10758 	/*
10759 	 * Need a lock since some flags can be set even when there are
10760 	 * references to the ipif.
10761 	 */
10762 	mutex_enter(&ill->ill_lock);
10763 	if (ipip->ipi_cmd_type == IF_CMD) {
10764 		struct ifreq *ifr = (struct ifreq *)if_req;
10765 
10766 		/* Get interface flags (low 16 only). */
10767 		ifr->ifr_flags = ((ipif->ipif_flags |
10768 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
10769 	} else {
10770 		struct lifreq *lifr = (struct lifreq *)if_req;
10771 
10772 		/* Get interface flags. */
10773 		lifr->lifr_flags = ipif->ipif_flags |
10774 		    ill->ill_flags | phyi->phyint_flags;
10775 	}
10776 	mutex_exit(&ill->ill_lock);
10777 	return (0);
10778 }
10779 
10780 /*
10781  * We allow the MTU to be set on an ILL, but not have it be different
10782  * for different IPIFs since we don't actually send packets on IPIFs.
10783  */
10784 /* ARGSUSED */
10785 int
10786 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10787     ip_ioctl_cmd_t *ipip, void *if_req)
10788 {
10789 	int mtu;
10790 	int ip_min_mtu;
10791 	struct ifreq	*ifr;
10792 	struct lifreq *lifr;
10793 	ill_t	*ill;
10794 
10795 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
10796 	    ipif->ipif_id, (void *)ipif));
10797 	if (ipip->ipi_cmd_type == IF_CMD) {
10798 		ifr = (struct ifreq *)if_req;
10799 		mtu = ifr->ifr_metric;
10800 	} else {
10801 		lifr = (struct lifreq *)if_req;
10802 		mtu = lifr->lifr_mtu;
10803 	}
10804 	/* Only allow for logical unit zero i.e. not on "bge0:17" */
10805 	if (ipif->ipif_id != 0)
10806 		return (EINVAL);
10807 
10808 	ill = ipif->ipif_ill;
10809 	if (ipif->ipif_isv6)
10810 		ip_min_mtu = IPV6_MIN_MTU;
10811 	else
10812 		ip_min_mtu = IP_MIN_MTU;
10813 
10814 	mutex_enter(&ill->ill_lock);
10815 	if (mtu > ill->ill_max_frag || mtu < ip_min_mtu) {
10816 		mutex_exit(&ill->ill_lock);
10817 		return (EINVAL);
10818 	}
10819 	/*
10820 	 * The dce and fragmentation code can handle changes to ill_mtu
10821 	 * concurrent with sending/fragmenting packets.
10822 	 */
10823 	ill->ill_mtu = mtu;
10824 	ill->ill_flags |= ILLF_FIXEDMTU;
10825 	mutex_exit(&ill->ill_lock);
10826 
10827 	/*
10828 	 * Make sure all dce_generation checks find out
10829 	 * that ill_mtu has changed.
10830 	 */
10831 	dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
10832 
10833 	/*
10834 	 * Refresh IPMP meta-interface MTU if necessary.
10835 	 */
10836 	if (IS_UNDER_IPMP(ill))
10837 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
10838 
10839 	/* Update the MTU in SCTP's list */
10840 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10841 	return (0);
10842 }
10843 
10844 /* Get interface MTU. */
10845 /* ARGSUSED */
10846 int
10847 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10848 	ip_ioctl_cmd_t *ipip, void *if_req)
10849 {
10850 	struct ifreq	*ifr;
10851 	struct lifreq	*lifr;
10852 
10853 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
10854 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10855 
10856 	/*
10857 	 * We allow a get on any logical interface even though the set
10858 	 * can only be done on logical unit 0.
10859 	 */
10860 	if (ipip->ipi_cmd_type == IF_CMD) {
10861 		ifr = (struct ifreq *)if_req;
10862 		ifr->ifr_metric = ipif->ipif_ill->ill_mtu;
10863 	} else {
10864 		lifr = (struct lifreq *)if_req;
10865 		lifr->lifr_mtu = ipif->ipif_ill->ill_mtu;
10866 	}
10867 	return (0);
10868 }
10869 
10870 /* Set interface broadcast address. */
10871 /* ARGSUSED2 */
10872 int
10873 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10874 	ip_ioctl_cmd_t *ipip, void *if_req)
10875 {
10876 	ipaddr_t addr;
10877 	ire_t	*ire;
10878 	ill_t		*ill = ipif->ipif_ill;
10879 	ip_stack_t	*ipst = ill->ill_ipst;
10880 
10881 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ill->ill_name,
10882 	    ipif->ipif_id));
10883 
10884 	ASSERT(IAM_WRITER_IPIF(ipif));
10885 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
10886 		return (EADDRNOTAVAIL);
10887 
10888 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
10889 
10890 	if (sin->sin_family != AF_INET)
10891 		return (EAFNOSUPPORT);
10892 
10893 	addr = sin->sin_addr.s_addr;
10894 
10895 	if (ipif->ipif_flags & IPIF_UP) {
10896 		/*
10897 		 * If we are already up, make sure the new
10898 		 * broadcast address makes sense.  If it does,
10899 		 * there should be an IRE for it already.
10900 		 */
10901 		ire = ire_ftable_lookup_v4(addr, 0, 0, IRE_BROADCAST,
10902 		    ill, ipif->ipif_zoneid, NULL,
10903 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE), 0, ipst, NULL);
10904 		if (ire == NULL) {
10905 			return (EINVAL);
10906 		} else {
10907 			ire_refrele(ire);
10908 		}
10909 	}
10910 	/*
10911 	 * Changing the broadcast addr for this ipif. Since the IRE_BROADCAST
10912 	 * needs to already exist we never need to change the set of
10913 	 * IRE_BROADCASTs when we are UP.
10914 	 */
10915 	if (addr != ipif->ipif_brd_addr)
10916 		IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
10917 
10918 	return (0);
10919 }
10920 
10921 /* Get interface broadcast address. */
10922 /* ARGSUSED */
10923 int
10924 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10925     ip_ioctl_cmd_t *ipip, void *if_req)
10926 {
10927 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
10928 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10929 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
10930 		return (EADDRNOTAVAIL);
10931 
10932 	/* IPIF_BROADCAST not possible with IPv6 */
10933 	ASSERT(!ipif->ipif_isv6);
10934 	*sin = sin_null;
10935 	sin->sin_family = AF_INET;
10936 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
10937 	return (0);
10938 }
10939 
10940 /*
10941  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
10942  */
10943 /* ARGSUSED */
10944 int
10945 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10946     ip_ioctl_cmd_t *ipip, void *if_req)
10947 {
10948 	int err = 0;
10949 	in6_addr_t v6mask;
10950 
10951 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
10952 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10953 
10954 	ASSERT(IAM_WRITER_IPIF(ipif));
10955 
10956 	if (ipif->ipif_isv6) {
10957 		sin6_t *sin6;
10958 
10959 		if (sin->sin_family != AF_INET6)
10960 			return (EAFNOSUPPORT);
10961 
10962 		sin6 = (sin6_t *)sin;
10963 		v6mask = sin6->sin6_addr;
10964 	} else {
10965 		ipaddr_t mask;
10966 
10967 		if (sin->sin_family != AF_INET)
10968 			return (EAFNOSUPPORT);
10969 
10970 		mask = sin->sin_addr.s_addr;
10971 		if (!ip_contiguous_mask(ntohl(mask)))
10972 			return (ENOTSUP);
10973 		V4MASK_TO_V6(mask, v6mask);
10974 	}
10975 
10976 	/*
10977 	 * No big deal if the interface isn't already up, or the mask
10978 	 * isn't really changing, or this is pt-pt.
10979 	 */
10980 	if (!(ipif->ipif_flags & IPIF_UP) ||
10981 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
10982 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
10983 		ipif->ipif_v6net_mask = v6mask;
10984 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10985 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
10986 			    ipif->ipif_v6net_mask,
10987 			    ipif->ipif_v6subnet);
10988 		}
10989 		return (0);
10990 	}
10991 	/*
10992 	 * Make sure we have valid net and subnet broadcast ire's
10993 	 * for the old netmask, if needed by other logical interfaces.
10994 	 */
10995 	err = ipif_logical_down(ipif, q, mp);
10996 	if (err == EINPROGRESS)
10997 		return (err);
10998 	(void) ipif_down_tail(ipif);
10999 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
11000 	return (err);
11001 }
11002 
11003 static int
11004 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
11005 {
11006 	in6_addr_t v6mask;
11007 	int err = 0;
11008 
11009 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
11010 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11011 
11012 	if (ipif->ipif_isv6) {
11013 		sin6_t *sin6;
11014 
11015 		sin6 = (sin6_t *)sin;
11016 		v6mask = sin6->sin6_addr;
11017 	} else {
11018 		ipaddr_t mask;
11019 
11020 		mask = sin->sin_addr.s_addr;
11021 		V4MASK_TO_V6(mask, v6mask);
11022 	}
11023 
11024 	ipif->ipif_v6net_mask = v6mask;
11025 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11026 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
11027 		    ipif->ipif_v6subnet);
11028 	}
11029 	err = ipif_up(ipif, q, mp);
11030 
11031 	if (err == 0 || err == EINPROGRESS) {
11032 		/*
11033 		 * The interface must be DL_BOUND if this packet has to
11034 		 * go out on the wire. Since we only go through a logical
11035 		 * down and are bound with the driver during an internal
11036 		 * down/up that is satisfied.
11037 		 */
11038 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
11039 			/* Potentially broadcast an address mask reply. */
11040 			ipif_mask_reply(ipif);
11041 		}
11042 	}
11043 	return (err);
11044 }
11045 
11046 /* ARGSUSED */
11047 int
11048 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11049     ip_ioctl_cmd_t *ipip, void *if_req)
11050 {
11051 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
11052 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11053 	(void) ipif_down_tail(ipif);
11054 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
11055 }
11056 
11057 /* Get interface net mask. */
11058 /* ARGSUSED */
11059 int
11060 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11061     ip_ioctl_cmd_t *ipip, void *if_req)
11062 {
11063 	struct lifreq *lifr = (struct lifreq *)if_req;
11064 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
11065 
11066 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
11067 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11068 
11069 	/*
11070 	 * net mask can't change since we have a reference to the ipif.
11071 	 */
11072 	if (ipif->ipif_isv6) {
11073 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11074 		*sin6 = sin6_null;
11075 		sin6->sin6_family = AF_INET6;
11076 		sin6->sin6_addr = ipif->ipif_v6net_mask;
11077 		lifr->lifr_addrlen =
11078 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11079 	} else {
11080 		*sin = sin_null;
11081 		sin->sin_family = AF_INET;
11082 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
11083 		if (ipip->ipi_cmd_type == LIF_CMD) {
11084 			lifr->lifr_addrlen =
11085 			    ip_mask_to_plen(ipif->ipif_net_mask);
11086 		}
11087 	}
11088 	return (0);
11089 }
11090 
11091 /* ARGSUSED */
11092 int
11093 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11094     ip_ioctl_cmd_t *ipip, void *if_req)
11095 {
11096 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
11097 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11098 
11099 	/*
11100 	 * Since no applications should ever be setting metrics on underlying
11101 	 * interfaces, we explicitly fail to smoke 'em out.
11102 	 */
11103 	if (IS_UNDER_IPMP(ipif->ipif_ill))
11104 		return (EINVAL);
11105 
11106 	/*
11107 	 * Set interface metric.  We don't use this for
11108 	 * anything but we keep track of it in case it is
11109 	 * important to routing applications or such.
11110 	 */
11111 	if (ipip->ipi_cmd_type == IF_CMD) {
11112 		struct ifreq    *ifr;
11113 
11114 		ifr = (struct ifreq *)if_req;
11115 		ipif->ipif_ill->ill_metric = ifr->ifr_metric;
11116 	} else {
11117 		struct lifreq   *lifr;
11118 
11119 		lifr = (struct lifreq *)if_req;
11120 		ipif->ipif_ill->ill_metric = lifr->lifr_metric;
11121 	}
11122 	return (0);
11123 }
11124 
11125 /* ARGSUSED */
11126 int
11127 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11128     ip_ioctl_cmd_t *ipip, void *if_req)
11129 {
11130 	/* Get interface metric. */
11131 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
11132 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11133 
11134 	if (ipip->ipi_cmd_type == IF_CMD) {
11135 		struct ifreq    *ifr;
11136 
11137 		ifr = (struct ifreq *)if_req;
11138 		ifr->ifr_metric = ipif->ipif_ill->ill_metric;
11139 	} else {
11140 		struct lifreq   *lifr;
11141 
11142 		lifr = (struct lifreq *)if_req;
11143 		lifr->lifr_metric = ipif->ipif_ill->ill_metric;
11144 	}
11145 
11146 	return (0);
11147 }
11148 
11149 /* ARGSUSED */
11150 int
11151 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11152     ip_ioctl_cmd_t *ipip, void *if_req)
11153 {
11154 	int	arp_muxid;
11155 
11156 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
11157 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11158 	/*
11159 	 * Set the muxid returned from I_PLINK.
11160 	 */
11161 	if (ipip->ipi_cmd_type == IF_CMD) {
11162 		struct ifreq *ifr = (struct ifreq *)if_req;
11163 
11164 		ipif->ipif_ill->ill_muxid = ifr->ifr_ip_muxid;
11165 		arp_muxid = ifr->ifr_arp_muxid;
11166 	} else {
11167 		struct lifreq *lifr = (struct lifreq *)if_req;
11168 
11169 		ipif->ipif_ill->ill_muxid = lifr->lifr_ip_muxid;
11170 		arp_muxid = lifr->lifr_arp_muxid;
11171 	}
11172 	arl_set_muxid(ipif->ipif_ill, arp_muxid);
11173 	return (0);
11174 }
11175 
11176 /* ARGSUSED */
11177 int
11178 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11179     ip_ioctl_cmd_t *ipip, void *if_req)
11180 {
11181 	int	arp_muxid = 0;
11182 
11183 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
11184 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11185 	/*
11186 	 * Get the muxid saved in ill for I_PUNLINK.
11187 	 */
11188 	arp_muxid = arl_get_muxid(ipif->ipif_ill);
11189 	if (ipip->ipi_cmd_type == IF_CMD) {
11190 		struct ifreq *ifr = (struct ifreq *)if_req;
11191 
11192 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11193 		ifr->ifr_arp_muxid = arp_muxid;
11194 	} else {
11195 		struct lifreq *lifr = (struct lifreq *)if_req;
11196 
11197 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11198 		lifr->lifr_arp_muxid = arp_muxid;
11199 	}
11200 	return (0);
11201 }
11202 
11203 /*
11204  * Set the subnet prefix. Does not modify the broadcast address.
11205  */
11206 /* ARGSUSED */
11207 int
11208 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11209     ip_ioctl_cmd_t *ipip, void *if_req)
11210 {
11211 	int err = 0;
11212 	in6_addr_t v6addr;
11213 	in6_addr_t v6mask;
11214 	boolean_t need_up = B_FALSE;
11215 	int addrlen;
11216 
11217 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
11218 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11219 
11220 	ASSERT(IAM_WRITER_IPIF(ipif));
11221 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
11222 
11223 	if (ipif->ipif_isv6) {
11224 		sin6_t *sin6;
11225 
11226 		if (sin->sin_family != AF_INET6)
11227 			return (EAFNOSUPPORT);
11228 
11229 		sin6 = (sin6_t *)sin;
11230 		v6addr = sin6->sin6_addr;
11231 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
11232 			return (EADDRNOTAVAIL);
11233 	} else {
11234 		ipaddr_t addr;
11235 
11236 		if (sin->sin_family != AF_INET)
11237 			return (EAFNOSUPPORT);
11238 
11239 		addr = sin->sin_addr.s_addr;
11240 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
11241 			return (EADDRNOTAVAIL);
11242 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11243 		/* Add 96 bits */
11244 		addrlen += IPV6_ABITS - IP_ABITS;
11245 	}
11246 
11247 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
11248 		return (EINVAL);
11249 
11250 	/* Check if bits in the address is set past the mask */
11251 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
11252 		return (EINVAL);
11253 
11254 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
11255 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
11256 		return (0);	/* No change */
11257 
11258 	if (ipif->ipif_flags & IPIF_UP) {
11259 		/*
11260 		 * If the interface is already marked up,
11261 		 * we call ipif_down which will take care
11262 		 * of ditching any IREs that have been set
11263 		 * up based on the old interface address.
11264 		 */
11265 		err = ipif_logical_down(ipif, q, mp);
11266 		if (err == EINPROGRESS)
11267 			return (err);
11268 		(void) ipif_down_tail(ipif);
11269 		need_up = B_TRUE;
11270 	}
11271 
11272 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
11273 	return (err);
11274 }
11275 
11276 static int
11277 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
11278     queue_t *q, mblk_t *mp, boolean_t need_up)
11279 {
11280 	ill_t	*ill = ipif->ipif_ill;
11281 	int	err = 0;
11282 
11283 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
11284 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11285 
11286 	/* Set the new address. */
11287 	mutex_enter(&ill->ill_lock);
11288 	ipif->ipif_v6net_mask = v6mask;
11289 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11290 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
11291 		    ipif->ipif_v6subnet);
11292 	}
11293 	mutex_exit(&ill->ill_lock);
11294 
11295 	if (need_up) {
11296 		/*
11297 		 * Now bring the interface back up.  If this
11298 		 * is the only IPIF for the ILL, ipif_up
11299 		 * will have to re-bind to the device, so
11300 		 * we may get back EINPROGRESS, in which
11301 		 * case, this IOCTL will get completed in
11302 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11303 		 */
11304 		err = ipif_up(ipif, q, mp);
11305 		if (err == EINPROGRESS)
11306 			return (err);
11307 	}
11308 	return (err);
11309 }
11310 
11311 /* ARGSUSED */
11312 int
11313 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11314     ip_ioctl_cmd_t *ipip, void *if_req)
11315 {
11316 	int	addrlen;
11317 	in6_addr_t v6addr;
11318 	in6_addr_t v6mask;
11319 	struct lifreq *lifr = (struct lifreq *)if_req;
11320 
11321 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
11322 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11323 	(void) ipif_down_tail(ipif);
11324 
11325 	addrlen = lifr->lifr_addrlen;
11326 	if (ipif->ipif_isv6) {
11327 		sin6_t *sin6;
11328 
11329 		sin6 = (sin6_t *)sin;
11330 		v6addr = sin6->sin6_addr;
11331 	} else {
11332 		ipaddr_t addr;
11333 
11334 		addr = sin->sin_addr.s_addr;
11335 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11336 		addrlen += IPV6_ABITS - IP_ABITS;
11337 	}
11338 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
11339 
11340 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
11341 }
11342 
11343 /* ARGSUSED */
11344 int
11345 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11346     ip_ioctl_cmd_t *ipip, void *if_req)
11347 {
11348 	struct lifreq *lifr = (struct lifreq *)if_req;
11349 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
11350 
11351 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
11352 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11353 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11354 
11355 	if (ipif->ipif_isv6) {
11356 		*sin6 = sin6_null;
11357 		sin6->sin6_family = AF_INET6;
11358 		sin6->sin6_addr = ipif->ipif_v6subnet;
11359 		lifr->lifr_addrlen =
11360 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11361 	} else {
11362 		*sin = sin_null;
11363 		sin->sin_family = AF_INET;
11364 		sin->sin_addr.s_addr = ipif->ipif_subnet;
11365 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
11366 	}
11367 	return (0);
11368 }
11369 
11370 /*
11371  * Set the IPv6 address token.
11372  */
11373 /* ARGSUSED */
11374 int
11375 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11376     ip_ioctl_cmd_t *ipi, void *if_req)
11377 {
11378 	ill_t *ill = ipif->ipif_ill;
11379 	int err;
11380 	in6_addr_t v6addr;
11381 	in6_addr_t v6mask;
11382 	boolean_t need_up = B_FALSE;
11383 	int i;
11384 	sin6_t *sin6 = (sin6_t *)sin;
11385 	struct lifreq *lifr = (struct lifreq *)if_req;
11386 	int addrlen;
11387 
11388 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
11389 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11390 	ASSERT(IAM_WRITER_IPIF(ipif));
11391 
11392 	addrlen = lifr->lifr_addrlen;
11393 	/* Only allow for logical unit zero i.e. not on "le0:17" */
11394 	if (ipif->ipif_id != 0)
11395 		return (EINVAL);
11396 
11397 	if (!ipif->ipif_isv6)
11398 		return (EINVAL);
11399 
11400 	if (addrlen > IPV6_ABITS)
11401 		return (EINVAL);
11402 
11403 	v6addr = sin6->sin6_addr;
11404 
11405 	/*
11406 	 * The length of the token is the length from the end.  To get
11407 	 * the proper mask for this, compute the mask of the bits not
11408 	 * in the token; ie. the prefix, and then xor to get the mask.
11409 	 */
11410 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
11411 		return (EINVAL);
11412 	for (i = 0; i < 4; i++) {
11413 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11414 	}
11415 
11416 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
11417 	    ill->ill_token_length == addrlen)
11418 		return (0);	/* No change */
11419 
11420 	if (ipif->ipif_flags & IPIF_UP) {
11421 		err = ipif_logical_down(ipif, q, mp);
11422 		if (err == EINPROGRESS)
11423 			return (err);
11424 		(void) ipif_down_tail(ipif);
11425 		need_up = B_TRUE;
11426 	}
11427 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
11428 	return (err);
11429 }
11430 
11431 static int
11432 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
11433     mblk_t *mp, boolean_t need_up)
11434 {
11435 	in6_addr_t v6addr;
11436 	in6_addr_t v6mask;
11437 	ill_t	*ill = ipif->ipif_ill;
11438 	int	i;
11439 	int	err = 0;
11440 
11441 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
11442 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11443 	v6addr = sin6->sin6_addr;
11444 	/*
11445 	 * The length of the token is the length from the end.  To get
11446 	 * the proper mask for this, compute the mask of the bits not
11447 	 * in the token; ie. the prefix, and then xor to get the mask.
11448 	 */
11449 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
11450 	for (i = 0; i < 4; i++)
11451 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11452 
11453 	mutex_enter(&ill->ill_lock);
11454 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
11455 	ill->ill_token_length = addrlen;
11456 	ill->ill_manual_token = 1;
11457 
11458 	/* Reconfigure the link-local address based on this new token */
11459 	ipif_setlinklocal(ill->ill_ipif);
11460 
11461 	mutex_exit(&ill->ill_lock);
11462 
11463 	if (need_up) {
11464 		/*
11465 		 * Now bring the interface back up.  If this
11466 		 * is the only IPIF for the ILL, ipif_up
11467 		 * will have to re-bind to the device, so
11468 		 * we may get back EINPROGRESS, in which
11469 		 * case, this IOCTL will get completed in
11470 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11471 		 */
11472 		err = ipif_up(ipif, q, mp);
11473 		if (err == EINPROGRESS)
11474 			return (err);
11475 	}
11476 	return (err);
11477 }
11478 
11479 /* ARGSUSED */
11480 int
11481 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11482     ip_ioctl_cmd_t *ipi, void *if_req)
11483 {
11484 	ill_t *ill;
11485 	sin6_t *sin6 = (sin6_t *)sin;
11486 	struct lifreq *lifr = (struct lifreq *)if_req;
11487 
11488 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
11489 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11490 	if (ipif->ipif_id != 0)
11491 		return (EINVAL);
11492 
11493 	ill = ipif->ipif_ill;
11494 	if (!ill->ill_isv6)
11495 		return (ENXIO);
11496 
11497 	*sin6 = sin6_null;
11498 	sin6->sin6_family = AF_INET6;
11499 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
11500 	sin6->sin6_addr = ill->ill_token;
11501 	lifr->lifr_addrlen = ill->ill_token_length;
11502 	return (0);
11503 }
11504 
11505 /*
11506  * Set (hardware) link specific information that might override
11507  * what was acquired through the DL_INFO_ACK.
11508  */
11509 /* ARGSUSED */
11510 int
11511 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11512     ip_ioctl_cmd_t *ipi, void *if_req)
11513 {
11514 	ill_t		*ill = ipif->ipif_ill;
11515 	int		ip_min_mtu;
11516 	struct lifreq	*lifr = (struct lifreq *)if_req;
11517 	lif_ifinfo_req_t *lir;
11518 
11519 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
11520 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11521 	lir = &lifr->lifr_ifinfo;
11522 	ASSERT(IAM_WRITER_IPIF(ipif));
11523 
11524 	/* Only allow for logical unit zero i.e. not on "bge0:17" */
11525 	if (ipif->ipif_id != 0)
11526 		return (EINVAL);
11527 
11528 	/* Set interface MTU. */
11529 	if (ipif->ipif_isv6)
11530 		ip_min_mtu = IPV6_MIN_MTU;
11531 	else
11532 		ip_min_mtu = IP_MIN_MTU;
11533 
11534 	/*
11535 	 * Verify values before we set anything. Allow zero to
11536 	 * mean unspecified.
11537 	 *
11538 	 * XXX We should be able to set the user-defined lir_mtu to some value
11539 	 * that is greater than ill_current_frag but less than ill_max_frag- the
11540 	 * ill_max_frag value tells us the max MTU that can be handled by the
11541 	 * datalink, whereas the ill_current_frag is dynamically computed for
11542 	 * some link-types like tunnels, based on the tunnel PMTU. However,
11543 	 * since there is currently no way of distinguishing between
11544 	 * administratively fixed link mtu values (e.g., those set via
11545 	 * /sbin/dladm) and dynamically discovered MTUs (e.g., those discovered
11546 	 * for tunnels) we conservatively choose the  ill_current_frag as the
11547 	 * upper-bound.
11548 	 */
11549 	if (lir->lir_maxmtu != 0 &&
11550 	    (lir->lir_maxmtu > ill->ill_current_frag ||
11551 	    lir->lir_maxmtu < ip_min_mtu))
11552 		return (EINVAL);
11553 	if (lir->lir_reachtime != 0 &&
11554 	    lir->lir_reachtime > ND_MAX_REACHTIME)
11555 		return (EINVAL);
11556 	if (lir->lir_reachretrans != 0 &&
11557 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
11558 		return (EINVAL);
11559 
11560 	mutex_enter(&ill->ill_lock);
11561 	/*
11562 	 * The dce and fragmentation code can handle changes to ill_mtu
11563 	 * concurrent with sending/fragmenting packets.
11564 	 */
11565 	if (lir->lir_maxmtu != 0)
11566 		ill->ill_user_mtu = lir->lir_maxmtu;
11567 
11568 	if (lir->lir_reachtime != 0)
11569 		ill->ill_reachable_time = lir->lir_reachtime;
11570 
11571 	if (lir->lir_reachretrans != 0)
11572 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
11573 
11574 	ill->ill_max_hops = lir->lir_maxhops;
11575 	ill->ill_max_buf = ND_MAX_Q;
11576 	if (!(ill->ill_flags & ILLF_FIXEDMTU) && ill->ill_user_mtu != 0) {
11577 		/*
11578 		 * ill_mtu is the actual interface MTU, obtained as the min
11579 		 * of user-configured mtu and the value announced by the
11580 		 * driver (via DL_NOTE_SDU_SIZE/DL_INFO_ACK). Note that since
11581 		 * we have already made the choice of requiring
11582 		 * ill_user_mtu < ill_current_frag by the time we get here,
11583 		 * the ill_mtu effectively gets assigned to the ill_user_mtu
11584 		 * here.
11585 		 */
11586 		ill->ill_mtu = MIN(ill->ill_current_frag, ill->ill_user_mtu);
11587 	}
11588 	mutex_exit(&ill->ill_lock);
11589 
11590 	/*
11591 	 * Make sure all dce_generation checks find out
11592 	 * that ill_mtu has changed.
11593 	 */
11594 	if (!(ill->ill_flags & ILLF_FIXEDMTU) && (lir->lir_maxmtu != 0))
11595 		dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
11596 
11597 	/*
11598 	 * Refresh IPMP meta-interface MTU if necessary.
11599 	 */
11600 	if (IS_UNDER_IPMP(ill))
11601 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
11602 
11603 	return (0);
11604 }
11605 
11606 /* ARGSUSED */
11607 int
11608 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11609     ip_ioctl_cmd_t *ipi, void *if_req)
11610 {
11611 	struct lif_ifinfo_req *lir;
11612 	ill_t *ill = ipif->ipif_ill;
11613 
11614 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
11615 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11616 	if (ipif->ipif_id != 0)
11617 		return (EINVAL);
11618 
11619 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
11620 	lir->lir_maxhops = ill->ill_max_hops;
11621 	lir->lir_reachtime = ill->ill_reachable_time;
11622 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
11623 	lir->lir_maxmtu = ill->ill_mtu;
11624 
11625 	return (0);
11626 }
11627 
11628 /*
11629  * Return best guess as to the subnet mask for the specified address.
11630  * Based on the subnet masks for all the configured interfaces.
11631  *
11632  * We end up returning a zero mask in the case of default, multicast or
11633  * experimental.
11634  */
11635 static ipaddr_t
11636 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp, ip_stack_t *ipst)
11637 {
11638 	ipaddr_t net_mask;
11639 	ill_t	*ill;
11640 	ipif_t	*ipif;
11641 	ill_walk_context_t ctx;
11642 	ipif_t	*fallback_ipif = NULL;
11643 
11644 	net_mask = ip_net_mask(addr);
11645 	if (net_mask == 0) {
11646 		*ipifp = NULL;
11647 		return (0);
11648 	}
11649 
11650 	/* Let's check to see if this is maybe a local subnet route. */
11651 	/* this function only applies to IPv4 interfaces */
11652 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
11653 	ill = ILL_START_WALK_V4(&ctx, ipst);
11654 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
11655 		mutex_enter(&ill->ill_lock);
11656 		for (ipif = ill->ill_ipif; ipif != NULL;
11657 		    ipif = ipif->ipif_next) {
11658 			if (IPIF_IS_CONDEMNED(ipif))
11659 				continue;
11660 			if (!(ipif->ipif_flags & IPIF_UP))
11661 				continue;
11662 			if ((ipif->ipif_subnet & net_mask) ==
11663 			    (addr & net_mask)) {
11664 				/*
11665 				 * Don't trust pt-pt interfaces if there are
11666 				 * other interfaces.
11667 				 */
11668 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
11669 					if (fallback_ipif == NULL) {
11670 						ipif_refhold_locked(ipif);
11671 						fallback_ipif = ipif;
11672 					}
11673 					continue;
11674 				}
11675 
11676 				/*
11677 				 * Fine. Just assume the same net mask as the
11678 				 * directly attached subnet interface is using.
11679 				 */
11680 				ipif_refhold_locked(ipif);
11681 				mutex_exit(&ill->ill_lock);
11682 				rw_exit(&ipst->ips_ill_g_lock);
11683 				if (fallback_ipif != NULL)
11684 					ipif_refrele(fallback_ipif);
11685 				*ipifp = ipif;
11686 				return (ipif->ipif_net_mask);
11687 			}
11688 		}
11689 		mutex_exit(&ill->ill_lock);
11690 	}
11691 	rw_exit(&ipst->ips_ill_g_lock);
11692 
11693 	*ipifp = fallback_ipif;
11694 	return ((fallback_ipif != NULL) ?
11695 	    fallback_ipif->ipif_net_mask : net_mask);
11696 }
11697 
11698 /*
11699  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
11700  */
11701 static void
11702 ip_wput_ioctl(queue_t *q, mblk_t *mp)
11703 {
11704 	IOCP	iocp;
11705 	ipft_t	*ipft;
11706 	ipllc_t	*ipllc;
11707 	mblk_t	*mp1;
11708 	cred_t	*cr;
11709 	int	error = 0;
11710 	conn_t	*connp;
11711 
11712 	ip1dbg(("ip_wput_ioctl"));
11713 	iocp = (IOCP)mp->b_rptr;
11714 	mp1 = mp->b_cont;
11715 	if (mp1 == NULL) {
11716 		iocp->ioc_error = EINVAL;
11717 		mp->b_datap->db_type = M_IOCNAK;
11718 		iocp->ioc_count = 0;
11719 		qreply(q, mp);
11720 		return;
11721 	}
11722 
11723 	/*
11724 	 * These IOCTLs provide various control capabilities to
11725 	 * upstream agents such as ULPs and processes.	There
11726 	 * are currently two such IOCTLs implemented.  They
11727 	 * are used by TCP to provide update information for
11728 	 * existing IREs and to forcibly delete an IRE for a
11729 	 * host that is not responding, thereby forcing an
11730 	 * attempt at a new route.
11731 	 */
11732 	iocp->ioc_error = EINVAL;
11733 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
11734 		goto done;
11735 
11736 	ipllc = (ipllc_t *)mp1->b_rptr;
11737 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
11738 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
11739 			break;
11740 	}
11741 	/*
11742 	 * prefer credential from mblk over ioctl;
11743 	 * see ip_sioctl_copyin_setup
11744 	 */
11745 	cr = msg_getcred(mp, NULL);
11746 	if (cr == NULL)
11747 		cr = iocp->ioc_cr;
11748 
11749 	/*
11750 	 * Refhold the conn in case the request gets queued up in some lookup
11751 	 */
11752 	ASSERT(CONN_Q(q));
11753 	connp = Q_TO_CONN(q);
11754 	CONN_INC_REF(connp);
11755 	CONN_INC_IOCTLREF(connp);
11756 	if (ipft->ipft_pfi &&
11757 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
11758 	    pullupmsg(mp1, ipft->ipft_min_size))) {
11759 		error = (*ipft->ipft_pfi)(q,
11760 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
11761 	}
11762 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
11763 		/*
11764 		 * CONN_OPER_PENDING_DONE happens in the function called
11765 		 * through ipft_pfi above.
11766 		 */
11767 		return;
11768 	}
11769 
11770 	CONN_DEC_IOCTLREF(connp);
11771 	CONN_OPER_PENDING_DONE(connp);
11772 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
11773 		freemsg(mp);
11774 		return;
11775 	}
11776 	iocp->ioc_error = error;
11777 
11778 done:
11779 	mp->b_datap->db_type = M_IOCACK;
11780 	if (iocp->ioc_error)
11781 		iocp->ioc_count = 0;
11782 	qreply(q, mp);
11783 }
11784 
11785 /*
11786  * Assign a unique id for the ipif. This is used by sctp_addr.c
11787  * Note: remove if sctp_addr.c is redone to not shadow ill/ipif data structures.
11788  */
11789 static void
11790 ipif_assign_seqid(ipif_t *ipif)
11791 {
11792 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
11793 
11794 	ipif->ipif_seqid = atomic_add_64_nv(&ipst->ips_ipif_g_seqid, 1);
11795 }
11796 
11797 /*
11798  * Clone the contents of `sipif' to `dipif'.  Requires that both ipifs are
11799  * administratively down (i.e., no DAD), of the same type, and locked.  Note
11800  * that the clone is complete -- including the seqid -- and the expectation is
11801  * that the caller will either free or overwrite `sipif' before it's unlocked.
11802  */
11803 static void
11804 ipif_clone(const ipif_t *sipif, ipif_t *dipif)
11805 {
11806 	ASSERT(MUTEX_HELD(&sipif->ipif_ill->ill_lock));
11807 	ASSERT(MUTEX_HELD(&dipif->ipif_ill->ill_lock));
11808 	ASSERT(!(sipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11809 	ASSERT(!(dipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11810 	ASSERT(sipif->ipif_ire_type == dipif->ipif_ire_type);
11811 
11812 	dipif->ipif_flags = sipif->ipif_flags;
11813 	dipif->ipif_zoneid = sipif->ipif_zoneid;
11814 	dipif->ipif_v6subnet = sipif->ipif_v6subnet;
11815 	dipif->ipif_v6lcl_addr = sipif->ipif_v6lcl_addr;
11816 	dipif->ipif_v6net_mask = sipif->ipif_v6net_mask;
11817 	dipif->ipif_v6brd_addr = sipif->ipif_v6brd_addr;
11818 	dipif->ipif_v6pp_dst_addr = sipif->ipif_v6pp_dst_addr;
11819 
11820 	/*
11821 	 * As per the comment atop the function, we assume that these sipif
11822 	 * fields will be changed before sipif is unlocked.
11823 	 */
11824 	dipif->ipif_seqid = sipif->ipif_seqid;
11825 	dipif->ipif_state_flags = sipif->ipif_state_flags;
11826 }
11827 
11828 /*
11829  * Transfer the contents of `sipif' to `dipif', and then free (if `virgipif'
11830  * is NULL) or overwrite `sipif' with `virgipif', which must be a virgin
11831  * (unreferenced) ipif.  Also, if `sipif' is used by the current xop, then
11832  * transfer the xop to `dipif'.  Requires that all ipifs are administratively
11833  * down (i.e., no DAD), of the same type, and unlocked.
11834  */
11835 static void
11836 ipif_transfer(ipif_t *sipif, ipif_t *dipif, ipif_t *virgipif)
11837 {
11838 	ipsq_t *ipsq = sipif->ipif_ill->ill_phyint->phyint_ipsq;
11839 	ipxop_t *ipx = ipsq->ipsq_xop;
11840 
11841 	ASSERT(sipif != dipif);
11842 	ASSERT(sipif != virgipif);
11843 
11844 	/*
11845 	 * Grab all of the locks that protect the ipif in a defined order.
11846 	 */
11847 	GRAB_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11848 
11849 	ipif_clone(sipif, dipif);
11850 	if (virgipif != NULL) {
11851 		ipif_clone(virgipif, sipif);
11852 		mi_free(virgipif);
11853 	}
11854 
11855 	RELEASE_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11856 
11857 	/*
11858 	 * Transfer ownership of the current xop, if necessary.
11859 	 */
11860 	if (ipx->ipx_current_ipif == sipif) {
11861 		ASSERT(ipx->ipx_pending_ipif == NULL);
11862 		mutex_enter(&ipx->ipx_lock);
11863 		ipx->ipx_current_ipif = dipif;
11864 		mutex_exit(&ipx->ipx_lock);
11865 	}
11866 
11867 	if (virgipif == NULL)
11868 		mi_free(sipif);
11869 }
11870 
11871 /*
11872  * checks if:
11873  *	- <ill_name>:<ipif_id> is at most LIFNAMSIZ - 1 and
11874  *	- logical interface is within the allowed range
11875  */
11876 static int
11877 is_lifname_valid(ill_t *ill, unsigned int ipif_id)
11878 {
11879 	if (snprintf(NULL, 0, "%s:%d", ill->ill_name, ipif_id) >= LIFNAMSIZ)
11880 		return (ENAMETOOLONG);
11881 
11882 	if (ipif_id >= ill->ill_ipst->ips_ip_addrs_per_if)
11883 		return (ERANGE);
11884 	return (0);
11885 }
11886 
11887 /*
11888  * Insert the ipif, so that the list of ipifs on the ill will be sorted
11889  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
11890  * be inserted into the first space available in the list. The value of
11891  * ipif_id will then be set to the appropriate value for its position.
11892  */
11893 static int
11894 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock)
11895 {
11896 	ill_t *ill;
11897 	ipif_t *tipif;
11898 	ipif_t **tipifp;
11899 	int id, err;
11900 	ip_stack_t	*ipst;
11901 
11902 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
11903 	    IAM_WRITER_IPIF(ipif));
11904 
11905 	ill = ipif->ipif_ill;
11906 	ASSERT(ill != NULL);
11907 	ipst = ill->ill_ipst;
11908 
11909 	/*
11910 	 * In the case of lo0:0 we already hold the ill_g_lock.
11911 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
11912 	 * ipif_insert.
11913 	 */
11914 	if (acquire_g_lock)
11915 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
11916 	mutex_enter(&ill->ill_lock);
11917 	id = ipif->ipif_id;
11918 	tipifp = &(ill->ill_ipif);
11919 	if (id == -1) {	/* need to find a real id */
11920 		id = 0;
11921 		while ((tipif = *tipifp) != NULL) {
11922 			ASSERT(tipif->ipif_id >= id);
11923 			if (tipif->ipif_id != id)
11924 				break; /* non-consecutive id */
11925 			id++;
11926 			tipifp = &(tipif->ipif_next);
11927 		}
11928 		if ((err = is_lifname_valid(ill, id)) != 0) {
11929 			mutex_exit(&ill->ill_lock);
11930 			if (acquire_g_lock)
11931 				rw_exit(&ipst->ips_ill_g_lock);
11932 			return (err);
11933 		}
11934 		ipif->ipif_id = id; /* assign new id */
11935 	} else if ((err = is_lifname_valid(ill, id)) == 0) {
11936 		/* we have a real id; insert ipif in the right place */
11937 		while ((tipif = *tipifp) != NULL) {
11938 			ASSERT(tipif->ipif_id != id);
11939 			if (tipif->ipif_id > id)
11940 				break; /* found correct location */
11941 			tipifp = &(tipif->ipif_next);
11942 		}
11943 	} else {
11944 		mutex_exit(&ill->ill_lock);
11945 		if (acquire_g_lock)
11946 			rw_exit(&ipst->ips_ill_g_lock);
11947 		return (err);
11948 	}
11949 
11950 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
11951 
11952 	ipif->ipif_next = tipif;
11953 	*tipifp = ipif;
11954 	mutex_exit(&ill->ill_lock);
11955 	if (acquire_g_lock)
11956 		rw_exit(&ipst->ips_ill_g_lock);
11957 
11958 	return (0);
11959 }
11960 
11961 static void
11962 ipif_remove(ipif_t *ipif)
11963 {
11964 	ipif_t	**ipifp;
11965 	ill_t	*ill = ipif->ipif_ill;
11966 
11967 	ASSERT(RW_WRITE_HELD(&ill->ill_ipst->ips_ill_g_lock));
11968 
11969 	mutex_enter(&ill->ill_lock);
11970 	ipifp = &ill->ill_ipif;
11971 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
11972 		if (*ipifp == ipif) {
11973 			*ipifp = ipif->ipif_next;
11974 			break;
11975 		}
11976 	}
11977 	mutex_exit(&ill->ill_lock);
11978 }
11979 
11980 /*
11981  * Allocate and initialize a new interface control structure.  (Always
11982  * called as writer.)
11983  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
11984  * is not part of the global linked list of ills. ipif_seqid is unique
11985  * in the system and to preserve the uniqueness, it is assigned only
11986  * when ill becomes part of the global list. At that point ill will
11987  * have a name. If it doesn't get assigned here, it will get assigned
11988  * in ipif_set_values() as part of SIOCSLIFNAME processing.
11989  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
11990  * the interface flags or any other information from the DL_INFO_ACK for
11991  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
11992  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
11993  * second DL_INFO_ACK comes in from the driver.
11994  */
11995 static ipif_t *
11996 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize,
11997     boolean_t insert, int *errorp)
11998 {
11999 	int err;
12000 	ipif_t	*ipif;
12001 	ip_stack_t *ipst = ill->ill_ipst;
12002 
12003 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
12004 	    ill->ill_name, id, (void *)ill));
12005 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
12006 
12007 	if (errorp != NULL)
12008 		*errorp = 0;
12009 
12010 	if ((ipif = mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL) {
12011 		if (errorp != NULL)
12012 			*errorp = ENOMEM;
12013 		return (NULL);
12014 	}
12015 	*ipif = ipif_zero;	/* start clean */
12016 
12017 	ipif->ipif_ill = ill;
12018 	ipif->ipif_id = id;	/* could be -1 */
12019 	/*
12020 	 * Inherit the zoneid from the ill; for the shared stack instance
12021 	 * this is always the global zone
12022 	 */
12023 	ipif->ipif_zoneid = ill->ill_zoneid;
12024 
12025 	ipif->ipif_refcnt = 0;
12026 
12027 	if (insert) {
12028 		if ((err = ipif_insert(ipif, ire_type != IRE_LOOPBACK)) != 0) {
12029 			mi_free(ipif);
12030 			if (errorp != NULL)
12031 				*errorp = err;
12032 			return (NULL);
12033 		}
12034 		/* -1 id should have been replaced by real id */
12035 		id = ipif->ipif_id;
12036 		ASSERT(id >= 0);
12037 	}
12038 
12039 	if (ill->ill_name[0] != '\0')
12040 		ipif_assign_seqid(ipif);
12041 
12042 	/*
12043 	 * If this is the zeroth ipif on the IPMP ill, create the illgrp
12044 	 * (which must not exist yet because the zeroth ipif is created once
12045 	 * per ill).  However, do not not link it to the ipmp_grp_t until
12046 	 * I_PLINK is called; see ip_sioctl_plink_ipmp() for details.
12047 	 */
12048 	if (id == 0 && IS_IPMP(ill)) {
12049 		if (ipmp_illgrp_create(ill) == NULL) {
12050 			if (insert) {
12051 				rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
12052 				ipif_remove(ipif);
12053 				rw_exit(&ipst->ips_ill_g_lock);
12054 			}
12055 			mi_free(ipif);
12056 			if (errorp != NULL)
12057 				*errorp = ENOMEM;
12058 			return (NULL);
12059 		}
12060 	}
12061 
12062 	/*
12063 	 * We grab ill_lock to protect the flag changes.  The ipif is still
12064 	 * not up and can't be looked up until the ioctl completes and the
12065 	 * IPIF_CHANGING flag is cleared.
12066 	 */
12067 	mutex_enter(&ill->ill_lock);
12068 
12069 	ipif->ipif_ire_type = ire_type;
12070 
12071 	if (ipif->ipif_isv6) {
12072 		ill->ill_flags |= ILLF_IPV6;
12073 	} else {
12074 		ipaddr_t inaddr_any = INADDR_ANY;
12075 
12076 		ill->ill_flags |= ILLF_IPV4;
12077 
12078 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
12079 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12080 		    &ipif->ipif_v6lcl_addr);
12081 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12082 		    &ipif->ipif_v6subnet);
12083 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12084 		    &ipif->ipif_v6net_mask);
12085 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12086 		    &ipif->ipif_v6brd_addr);
12087 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12088 		    &ipif->ipif_v6pp_dst_addr);
12089 	}
12090 
12091 	/*
12092 	 * Don't set the interface flags etc. now, will do it in
12093 	 * ip_ll_subnet_defaults.
12094 	 */
12095 	if (!initialize)
12096 		goto out;
12097 
12098 	/*
12099 	 * NOTE: The IPMP meta-interface is special-cased because it starts
12100 	 * with no underlying interfaces (and thus an unknown broadcast
12101 	 * address length), but all interfaces that can be placed into an IPMP
12102 	 * group are required to be broadcast-capable.
12103 	 */
12104 	if (ill->ill_bcast_addr_length != 0 || IS_IPMP(ill)) {
12105 		/*
12106 		 * Later detect lack of DLPI driver multicast capability by
12107 		 * catching DL_ENABMULTI_REQ errors in ip_rput_dlpi().
12108 		 */
12109 		ill->ill_flags |= ILLF_MULTICAST;
12110 		if (!ipif->ipif_isv6)
12111 			ipif->ipif_flags |= IPIF_BROADCAST;
12112 	} else {
12113 		if (ill->ill_net_type != IRE_LOOPBACK) {
12114 			if (ipif->ipif_isv6)
12115 				/*
12116 				 * Note: xresolv interfaces will eventually need
12117 				 * NOARP set here as well, but that will require
12118 				 * those external resolvers to have some
12119 				 * knowledge of that flag and act appropriately.
12120 				 * Not to be changed at present.
12121 				 */
12122 				ill->ill_flags |= ILLF_NONUD;
12123 			else
12124 				ill->ill_flags |= ILLF_NOARP;
12125 		}
12126 		if (ill->ill_phys_addr_length == 0) {
12127 			if (IS_VNI(ill)) {
12128 				ipif->ipif_flags |= IPIF_NOXMIT;
12129 			} else {
12130 				/* pt-pt supports multicast. */
12131 				ill->ill_flags |= ILLF_MULTICAST;
12132 				if (ill->ill_net_type != IRE_LOOPBACK)
12133 					ipif->ipif_flags |= IPIF_POINTOPOINT;
12134 			}
12135 		}
12136 	}
12137 out:
12138 	mutex_exit(&ill->ill_lock);
12139 	return (ipif);
12140 }
12141 
12142 /*
12143  * Remove the neighbor cache entries associated with this logical
12144  * interface.
12145  */
12146 int
12147 ipif_arp_down(ipif_t *ipif)
12148 {
12149 	ill_t	*ill = ipif->ipif_ill;
12150 	int	err = 0;
12151 
12152 	ip1dbg(("ipif_arp_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
12153 	ASSERT(IAM_WRITER_IPIF(ipif));
12154 
12155 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_down",
12156 	    ill_t *, ill, ipif_t *, ipif);
12157 	ipif_nce_down(ipif);
12158 
12159 	/*
12160 	 * If this is the last ipif that is going down and there are no
12161 	 * duplicate addresses we may yet attempt to re-probe, then we need to
12162 	 * clean up ARP completely.
12163 	 */
12164 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
12165 	    !ill->ill_logical_down && ill->ill_net_type == IRE_IF_RESOLVER) {
12166 		/*
12167 		 * If this was the last ipif on an IPMP interface, purge any
12168 		 * static ARP entries associated with it.
12169 		 */
12170 		if (IS_IPMP(ill))
12171 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
12172 
12173 		/* UNBIND, DETACH */
12174 		err = arp_ll_down(ill);
12175 	}
12176 
12177 	return (err);
12178 }
12179 
12180 /*
12181  * Get the resolver set up for a new IP address.  (Always called as writer.)
12182  * Called both for IPv4 and IPv6 interfaces, though it only does some
12183  * basic DAD related initialization for IPv6. Honors ILLF_NOARP.
12184  *
12185  * The enumerated value res_act tunes the behavior:
12186  * 	* Res_act_initial: set up all the resolver structures for a new
12187  *	  IP address.
12188  *	* Res_act_defend: tell ARP that it needs to send a single gratuitous
12189  *	  ARP message in defense of the address.
12190  *	* Res_act_rebind: tell ARP to change the hardware address for an IP
12191  *	  address (and issue gratuitous ARPs).  Used by ipmp_ill_bind_ipif().
12192  *
12193  * Returns zero on success, or an errno upon failure.
12194  */
12195 int
12196 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
12197 {
12198 	ill_t		*ill = ipif->ipif_ill;
12199 	int		err;
12200 	boolean_t	was_dup;
12201 
12202 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
12203 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
12204 	ASSERT(IAM_WRITER_IPIF(ipif));
12205 
12206 	was_dup = B_FALSE;
12207 	if (res_act == Res_act_initial) {
12208 		ipif->ipif_addr_ready = 0;
12209 		/*
12210 		 * We're bringing an interface up here.  There's no way that we
12211 		 * should need to shut down ARP now.
12212 		 */
12213 		mutex_enter(&ill->ill_lock);
12214 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
12215 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
12216 			ill->ill_ipif_dup_count--;
12217 			was_dup = B_TRUE;
12218 		}
12219 		mutex_exit(&ill->ill_lock);
12220 	}
12221 	if (ipif->ipif_recovery_id != 0)
12222 		(void) untimeout(ipif->ipif_recovery_id);
12223 	ipif->ipif_recovery_id = 0;
12224 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
12225 		ipif->ipif_addr_ready = 1;
12226 		return (0);
12227 	}
12228 	/* NDP will set the ipif_addr_ready flag when it's ready */
12229 	if (ill->ill_isv6)
12230 		return (0);
12231 
12232 	err = ipif_arp_up(ipif, res_act, was_dup);
12233 	return (err);
12234 }
12235 
12236 /*
12237  * This routine restarts IPv4/IPv6 duplicate address detection (DAD)
12238  * when a link has just gone back up.
12239  */
12240 static void
12241 ipif_nce_start_dad(ipif_t *ipif)
12242 {
12243 	ncec_t *ncec;
12244 	ill_t *ill = ipif->ipif_ill;
12245 	boolean_t isv6 = ill->ill_isv6;
12246 
12247 	if (isv6) {
12248 		ncec = ncec_lookup_illgrp_v6(ipif->ipif_ill,
12249 		    &ipif->ipif_v6lcl_addr);
12250 	} else {
12251 		ipaddr_t v4addr;
12252 
12253 		if (ill->ill_net_type != IRE_IF_RESOLVER ||
12254 		    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
12255 		    ipif->ipif_lcl_addr == INADDR_ANY) {
12256 			/*
12257 			 * If we can't contact ARP for some reason,
12258 			 * that's not really a problem.  Just send
12259 			 * out the routing socket notification that
12260 			 * DAD completion would have done, and continue.
12261 			 */
12262 			ipif_mask_reply(ipif);
12263 			ipif_up_notify(ipif);
12264 			ipif->ipif_addr_ready = 1;
12265 			return;
12266 		}
12267 
12268 		IN6_V4MAPPED_TO_IPADDR(&ipif->ipif_v6lcl_addr, v4addr);
12269 		ncec = ncec_lookup_illgrp_v4(ipif->ipif_ill, &v4addr);
12270 	}
12271 
12272 	if (ncec == NULL) {
12273 		ip1dbg(("couldn't find ncec for ipif %p leaving !ready\n",
12274 		    (void *)ipif));
12275 		return;
12276 	}
12277 	if (!nce_restart_dad(ncec)) {
12278 		/*
12279 		 * If we can't restart DAD for some reason, that's not really a
12280 		 * problem.  Just send out the routing socket notification that
12281 		 * DAD completion would have done, and continue.
12282 		 */
12283 		ipif_up_notify(ipif);
12284 		ipif->ipif_addr_ready = 1;
12285 	}
12286 	ncec_refrele(ncec);
12287 }
12288 
12289 /*
12290  * Restart duplicate address detection on all interfaces on the given ill.
12291  *
12292  * This is called when an interface transitions from down to up
12293  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
12294  *
12295  * Note that since the underlying physical link has transitioned, we must cause
12296  * at least one routing socket message to be sent here, either via DAD
12297  * completion or just by default on the first ipif.  (If we don't do this, then
12298  * in.mpathd will see long delays when doing link-based failure recovery.)
12299  */
12300 void
12301 ill_restart_dad(ill_t *ill, boolean_t went_up)
12302 {
12303 	ipif_t *ipif;
12304 
12305 	if (ill == NULL)
12306 		return;
12307 
12308 	/*
12309 	 * If layer two doesn't support duplicate address detection, then just
12310 	 * send the routing socket message now and be done with it.
12311 	 */
12312 	if (!ill->ill_isv6 && arp_no_defense) {
12313 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12314 		return;
12315 	}
12316 
12317 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12318 		if (went_up) {
12319 
12320 			if (ipif->ipif_flags & IPIF_UP) {
12321 				ipif_nce_start_dad(ipif);
12322 			} else if (ipif->ipif_flags & IPIF_DUPLICATE) {
12323 				/*
12324 				 * kick off the bring-up process now.
12325 				 */
12326 				ipif_do_recovery(ipif);
12327 			} else {
12328 				/*
12329 				 * Unfortunately, the first ipif is "special"
12330 				 * and represents the underlying ill in the
12331 				 * routing socket messages.  Thus, when this
12332 				 * one ipif is down, we must still notify so
12333 				 * that the user knows the IFF_RUNNING status
12334 				 * change.  (If the first ipif is up, then
12335 				 * we'll handle eventual routing socket
12336 				 * notification via DAD completion.)
12337 				 */
12338 				if (ipif == ill->ill_ipif) {
12339 					ip_rts_ifmsg(ill->ill_ipif,
12340 					    RTSQ_DEFAULT);
12341 				}
12342 			}
12343 		} else {
12344 			/*
12345 			 * After link down, we'll need to send a new routing
12346 			 * message when the link comes back, so clear
12347 			 * ipif_addr_ready.
12348 			 */
12349 			ipif->ipif_addr_ready = 0;
12350 		}
12351 	}
12352 
12353 	/*
12354 	 * If we've torn down links, then notify the user right away.
12355 	 */
12356 	if (!went_up)
12357 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12358 }
12359 
12360 static void
12361 ipsq_delete(ipsq_t *ipsq)
12362 {
12363 	ipxop_t *ipx = ipsq->ipsq_xop;
12364 
12365 	ipsq->ipsq_ipst = NULL;
12366 	ASSERT(ipsq->ipsq_phyint == NULL);
12367 	ASSERT(ipsq->ipsq_xop != NULL);
12368 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipx->ipx_mphead == NULL);
12369 	ASSERT(ipx->ipx_pending_mp == NULL);
12370 	kmem_free(ipsq, sizeof (ipsq_t));
12371 }
12372 
12373 static int
12374 ill_up_ipifs_on_ill(ill_t *ill, queue_t *q, mblk_t *mp)
12375 {
12376 	int err = 0;
12377 	ipif_t *ipif;
12378 
12379 	if (ill == NULL)
12380 		return (0);
12381 
12382 	ASSERT(IAM_WRITER_ILL(ill));
12383 	ill->ill_up_ipifs = B_TRUE;
12384 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12385 		if (ipif->ipif_was_up) {
12386 			if (!(ipif->ipif_flags & IPIF_UP))
12387 				err = ipif_up(ipif, q, mp);
12388 			ipif->ipif_was_up = B_FALSE;
12389 			if (err != 0) {
12390 				ASSERT(err == EINPROGRESS);
12391 				return (err);
12392 			}
12393 		}
12394 	}
12395 	ill->ill_up_ipifs = B_FALSE;
12396 	return (0);
12397 }
12398 
12399 /*
12400  * This function is called to bring up all the ipifs that were up before
12401  * bringing the ill down via ill_down_ipifs().
12402  */
12403 int
12404 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
12405 {
12406 	int err;
12407 
12408 	ASSERT(IAM_WRITER_ILL(ill));
12409 
12410 	if (ill->ill_replumbing) {
12411 		ill->ill_replumbing = 0;
12412 		/*
12413 		 * Send down REPLUMB_DONE notification followed by the
12414 		 * BIND_REQ on the arp stream.
12415 		 */
12416 		if (!ill->ill_isv6)
12417 			arp_send_replumb_conf(ill);
12418 	}
12419 	err = ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv4, q, mp);
12420 	if (err != 0)
12421 		return (err);
12422 
12423 	return (ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv6, q, mp));
12424 }
12425 
12426 /*
12427  * Bring down any IPIF_UP ipifs on ill. If "logical" is B_TRUE, we bring
12428  * down the ipifs without sending DL_UNBIND_REQ to the driver.
12429  */
12430 static void
12431 ill_down_ipifs(ill_t *ill, boolean_t logical)
12432 {
12433 	ipif_t *ipif;
12434 
12435 	ASSERT(IAM_WRITER_ILL(ill));
12436 
12437 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12438 		/*
12439 		 * We go through the ipif_down logic even if the ipif
12440 		 * is already down, since routes can be added based
12441 		 * on down ipifs. Going through ipif_down once again
12442 		 * will delete any IREs created based on these routes.
12443 		 */
12444 		if (ipif->ipif_flags & IPIF_UP)
12445 			ipif->ipif_was_up = B_TRUE;
12446 
12447 		if (logical) {
12448 			(void) ipif_logical_down(ipif, NULL, NULL);
12449 			ipif_non_duplicate(ipif);
12450 			(void) ipif_down_tail(ipif);
12451 		} else {
12452 			(void) ipif_down(ipif, NULL, NULL);
12453 		}
12454 	}
12455 }
12456 
12457 /*
12458  * Redo source address selection.  This makes IXAF_VERIFY_SOURCE take
12459  * a look again at valid source addresses.
12460  * This should be called each time after the set of source addresses has been
12461  * changed.
12462  */
12463 void
12464 ip_update_source_selection(ip_stack_t *ipst)
12465 {
12466 	/* We skip past SRC_GENERATION_VERIFY */
12467 	if (atomic_add_32_nv(&ipst->ips_src_generation, 1) ==
12468 	    SRC_GENERATION_VERIFY)
12469 		atomic_add_32(&ipst->ips_src_generation, 1);
12470 }
12471 
12472 /*
12473  * Finish the group join started in ip_sioctl_groupname().
12474  */
12475 /* ARGSUSED */
12476 static void
12477 ip_join_illgrps(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
12478 {
12479 	ill_t		*ill = q->q_ptr;
12480 	phyint_t	*phyi = ill->ill_phyint;
12481 	ipmp_grp_t	*grp = phyi->phyint_grp;
12482 	ip_stack_t	*ipst = ill->ill_ipst;
12483 
12484 	/* IS_UNDER_IPMP() won't work until ipmp_ill_join_illgrp() is called */
12485 	ASSERT(!IS_IPMP(ill) && grp != NULL);
12486 	ASSERT(IAM_WRITER_IPSQ(ipsq));
12487 
12488 	if (phyi->phyint_illv4 != NULL) {
12489 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12490 		VERIFY(grp->gr_pendv4-- > 0);
12491 		rw_exit(&ipst->ips_ipmp_lock);
12492 		ipmp_ill_join_illgrp(phyi->phyint_illv4, grp->gr_v4);
12493 	}
12494 	if (phyi->phyint_illv6 != NULL) {
12495 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12496 		VERIFY(grp->gr_pendv6-- > 0);
12497 		rw_exit(&ipst->ips_ipmp_lock);
12498 		ipmp_ill_join_illgrp(phyi->phyint_illv6, grp->gr_v6);
12499 	}
12500 	freemsg(mp);
12501 }
12502 
12503 /*
12504  * Process an SIOCSLIFGROUPNAME request.
12505  */
12506 /* ARGSUSED */
12507 int
12508 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12509     ip_ioctl_cmd_t *ipip, void *ifreq)
12510 {
12511 	struct lifreq	*lifr = ifreq;
12512 	ill_t		*ill = ipif->ipif_ill;
12513 	ip_stack_t	*ipst = ill->ill_ipst;
12514 	phyint_t	*phyi = ill->ill_phyint;
12515 	ipmp_grp_t	*grp = phyi->phyint_grp;
12516 	mblk_t		*ipsq_mp;
12517 	int		err = 0;
12518 
12519 	/*
12520 	 * Note that phyint_grp can only change here, where we're exclusive.
12521 	 */
12522 	ASSERT(IAM_WRITER_ILL(ill));
12523 
12524 	if (ipif->ipif_id != 0 || ill->ill_usesrc_grp_next != NULL ||
12525 	    (phyi->phyint_flags & PHYI_VIRTUAL))
12526 		return (EINVAL);
12527 
12528 	lifr->lifr_groupname[LIFGRNAMSIZ - 1] = '\0';
12529 
12530 	rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12531 
12532 	/*
12533 	 * If the name hasn't changed, there's nothing to do.
12534 	 */
12535 	if (grp != NULL && strcmp(grp->gr_name, lifr->lifr_groupname) == 0)
12536 		goto unlock;
12537 
12538 	/*
12539 	 * Handle requests to rename an IPMP meta-interface.
12540 	 *
12541 	 * Note that creation of the IPMP meta-interface is handled in
12542 	 * userland through the standard plumbing sequence.  As part of the
12543 	 * plumbing the IPMP meta-interface, its initial groupname is set to
12544 	 * the name of the interface (see ipif_set_values_tail()).
12545 	 */
12546 	if (IS_IPMP(ill)) {
12547 		err = ipmp_grp_rename(grp, lifr->lifr_groupname);
12548 		goto unlock;
12549 	}
12550 
12551 	/*
12552 	 * Handle requests to add or remove an IP interface from a group.
12553 	 */
12554 	if (lifr->lifr_groupname[0] != '\0') {			/* add */
12555 		/*
12556 		 * Moves are handled by first removing the interface from
12557 		 * its existing group, and then adding it to another group.
12558 		 * So, fail if it's already in a group.
12559 		 */
12560 		if (IS_UNDER_IPMP(ill)) {
12561 			err = EALREADY;
12562 			goto unlock;
12563 		}
12564 
12565 		grp = ipmp_grp_lookup(lifr->lifr_groupname, ipst);
12566 		if (grp == NULL) {
12567 			err = ENOENT;
12568 			goto unlock;
12569 		}
12570 
12571 		/*
12572 		 * Check if the phyint and its ills are suitable for
12573 		 * inclusion into the group.
12574 		 */
12575 		if ((err = ipmp_grp_vet_phyint(grp, phyi)) != 0)
12576 			goto unlock;
12577 
12578 		/*
12579 		 * Checks pass; join the group, and enqueue the remaining
12580 		 * illgrp joins for when we've become part of the group xop
12581 		 * and are exclusive across its IPSQs.  Since qwriter_ip()
12582 		 * requires an mblk_t to scribble on, and since `mp' will be
12583 		 * freed as part of completing the ioctl, allocate another.
12584 		 */
12585 		if ((ipsq_mp = allocb(0, BPRI_MED)) == NULL) {
12586 			err = ENOMEM;
12587 			goto unlock;
12588 		}
12589 
12590 		/*
12591 		 * Before we drop ipmp_lock, bump gr_pend* to ensure that the
12592 		 * IPMP meta-interface ills needed by `phyi' cannot go away
12593 		 * before ip_join_illgrps() is called back.  See the comments
12594 		 * in ip_sioctl_plink_ipmp() for more.
12595 		 */
12596 		if (phyi->phyint_illv4 != NULL)
12597 			grp->gr_pendv4++;
12598 		if (phyi->phyint_illv6 != NULL)
12599 			grp->gr_pendv6++;
12600 
12601 		rw_exit(&ipst->ips_ipmp_lock);
12602 
12603 		ipmp_phyint_join_grp(phyi, grp);
12604 		ill_refhold(ill);
12605 		qwriter_ip(ill, ill->ill_rq, ipsq_mp, ip_join_illgrps,
12606 		    SWITCH_OP, B_FALSE);
12607 		return (0);
12608 	} else {
12609 		/*
12610 		 * Request to remove the interface from a group.  If the
12611 		 * interface is not in a group, this trivially succeeds.
12612 		 */
12613 		rw_exit(&ipst->ips_ipmp_lock);
12614 		if (IS_UNDER_IPMP(ill))
12615 			ipmp_phyint_leave_grp(phyi);
12616 		return (0);
12617 	}
12618 unlock:
12619 	rw_exit(&ipst->ips_ipmp_lock);
12620 	return (err);
12621 }
12622 
12623 /*
12624  * Process an SIOCGLIFBINDING request.
12625  */
12626 /* ARGSUSED */
12627 int
12628 ip_sioctl_get_binding(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12629     ip_ioctl_cmd_t *ipip, void *ifreq)
12630 {
12631 	ill_t		*ill;
12632 	struct lifreq	*lifr = ifreq;
12633 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12634 
12635 	if (!IS_IPMP(ipif->ipif_ill))
12636 		return (EINVAL);
12637 
12638 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12639 	if ((ill = ipif->ipif_bound_ill) == NULL)
12640 		lifr->lifr_binding[0] = '\0';
12641 	else
12642 		(void) strlcpy(lifr->lifr_binding, ill->ill_name, LIFNAMSIZ);
12643 	rw_exit(&ipst->ips_ipmp_lock);
12644 	return (0);
12645 }
12646 
12647 /*
12648  * Process an SIOCGLIFGROUPNAME request.
12649  */
12650 /* ARGSUSED */
12651 int
12652 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12653     ip_ioctl_cmd_t *ipip, void *ifreq)
12654 {
12655 	ipmp_grp_t	*grp;
12656 	struct lifreq	*lifr = ifreq;
12657 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12658 
12659 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12660 	if ((grp = ipif->ipif_ill->ill_phyint->phyint_grp) == NULL)
12661 		lifr->lifr_groupname[0] = '\0';
12662 	else
12663 		(void) strlcpy(lifr->lifr_groupname, grp->gr_name, LIFGRNAMSIZ);
12664 	rw_exit(&ipst->ips_ipmp_lock);
12665 	return (0);
12666 }
12667 
12668 /*
12669  * Process an SIOCGLIFGROUPINFO request.
12670  */
12671 /* ARGSUSED */
12672 int
12673 ip_sioctl_groupinfo(ipif_t *dummy_ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12674     ip_ioctl_cmd_t *ipip, void *dummy)
12675 {
12676 	ipmp_grp_t	*grp;
12677 	lifgroupinfo_t	*lifgr;
12678 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
12679 
12680 	/* ip_wput_nondata() verified mp->b_cont->b_cont */
12681 	lifgr = (lifgroupinfo_t *)mp->b_cont->b_cont->b_rptr;
12682 	lifgr->gi_grname[LIFGRNAMSIZ - 1] = '\0';
12683 
12684 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12685 	if ((grp = ipmp_grp_lookup(lifgr->gi_grname, ipst)) == NULL) {
12686 		rw_exit(&ipst->ips_ipmp_lock);
12687 		return (ENOENT);
12688 	}
12689 	ipmp_grp_info(grp, lifgr);
12690 	rw_exit(&ipst->ips_ipmp_lock);
12691 	return (0);
12692 }
12693 
12694 static void
12695 ill_dl_down(ill_t *ill)
12696 {
12697 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_down", ill_t *, ill);
12698 
12699 	/*
12700 	 * The ill is down; unbind but stay attached since we're still
12701 	 * associated with a PPA. If we have negotiated DLPI capabilites
12702 	 * with the data link service provider (IDS_OK) then reset them.
12703 	 * The interval between unbinding and rebinding is potentially
12704 	 * unbounded hence we cannot assume things will be the same.
12705 	 * The DLPI capabilities will be probed again when the data link
12706 	 * is brought up.
12707 	 */
12708 	mblk_t	*mp = ill->ill_unbind_mp;
12709 
12710 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
12711 
12712 	if (!ill->ill_replumbing) {
12713 		/* Free all ilms for this ill */
12714 		update_conn_ill(ill, ill->ill_ipst);
12715 	} else {
12716 		ill_leave_multicast(ill);
12717 	}
12718 
12719 	ill->ill_unbind_mp = NULL;
12720 	if (mp != NULL) {
12721 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
12722 		    dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
12723 		    ill->ill_name));
12724 		mutex_enter(&ill->ill_lock);
12725 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
12726 		mutex_exit(&ill->ill_lock);
12727 		/*
12728 		 * ip_rput does not pass up normal (M_PROTO) DLPI messages
12729 		 * after ILL_CONDEMNED is set. So in the unplumb case, we call
12730 		 * ill_capability_dld_disable disable rightaway. If this is not
12731 		 * an unplumb operation then the disable happens on receipt of
12732 		 * the capab ack via ip_rput_dlpi_writer ->
12733 		 * ill_capability_ack_thr. In both cases the order of
12734 		 * the operations seen by DLD is capability disable followed
12735 		 * by DL_UNBIND. Also the DLD capability disable needs a
12736 		 * cv_wait'able context.
12737 		 */
12738 		if (ill->ill_state_flags & ILL_CONDEMNED)
12739 			ill_capability_dld_disable(ill);
12740 		ill_capability_reset(ill, B_FALSE);
12741 		ill_dlpi_send(ill, mp);
12742 	}
12743 	mutex_enter(&ill->ill_lock);
12744 	ill->ill_dl_up = 0;
12745 	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
12746 	mutex_exit(&ill->ill_lock);
12747 }
12748 
12749 void
12750 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
12751 {
12752 	union DL_primitives *dlp;
12753 	t_uscalar_t prim;
12754 	boolean_t waitack = B_FALSE;
12755 
12756 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12757 
12758 	dlp = (union DL_primitives *)mp->b_rptr;
12759 	prim = dlp->dl_primitive;
12760 
12761 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
12762 	    dl_primstr(prim), prim, ill->ill_name));
12763 
12764 	switch (prim) {
12765 	case DL_PHYS_ADDR_REQ:
12766 	{
12767 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
12768 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
12769 		break;
12770 	}
12771 	case DL_BIND_REQ:
12772 		mutex_enter(&ill->ill_lock);
12773 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
12774 		mutex_exit(&ill->ill_lock);
12775 		break;
12776 	}
12777 
12778 	/*
12779 	 * Except for the ACKs for the M_PCPROTO messages, all other ACKs
12780 	 * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
12781 	 * we only wait for the ACK of the DL_UNBIND_REQ.
12782 	 */
12783 	mutex_enter(&ill->ill_lock);
12784 	if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
12785 	    (prim == DL_UNBIND_REQ)) {
12786 		ill->ill_dlpi_pending = prim;
12787 		waitack = B_TRUE;
12788 	}
12789 
12790 	mutex_exit(&ill->ill_lock);
12791 	DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_dispatch",
12792 	    char *, dl_primstr(prim), ill_t *, ill);
12793 	putnext(ill->ill_wq, mp);
12794 
12795 	/*
12796 	 * There is no ack for DL_NOTIFY_CONF messages
12797 	 */
12798 	if (waitack && prim == DL_NOTIFY_CONF)
12799 		ill_dlpi_done(ill, prim);
12800 }
12801 
12802 /*
12803  * Helper function for ill_dlpi_send().
12804  */
12805 /* ARGSUSED */
12806 static void
12807 ill_dlpi_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
12808 {
12809 	ill_dlpi_send(q->q_ptr, mp);
12810 }
12811 
12812 /*
12813  * Send a DLPI control message to the driver but make sure there
12814  * is only one outstanding message. Uses ill_dlpi_pending to tell
12815  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
12816  * when an ACK or a NAK is received to process the next queued message.
12817  */
12818 void
12819 ill_dlpi_send(ill_t *ill, mblk_t *mp)
12820 {
12821 	mblk_t **mpp;
12822 
12823 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12824 
12825 	/*
12826 	 * To ensure that any DLPI requests for current exclusive operation
12827 	 * are always completely sent before any DLPI messages for other
12828 	 * operations, require writer access before enqueuing.
12829 	 */
12830 	if (!IAM_WRITER_ILL(ill)) {
12831 		ill_refhold(ill);
12832 		/* qwriter_ip() does the ill_refrele() */
12833 		qwriter_ip(ill, ill->ill_wq, mp, ill_dlpi_send_writer,
12834 		    NEW_OP, B_TRUE);
12835 		return;
12836 	}
12837 
12838 	mutex_enter(&ill->ill_lock);
12839 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
12840 		/* Must queue message. Tail insertion */
12841 		mpp = &ill->ill_dlpi_deferred;
12842 		while (*mpp != NULL)
12843 			mpp = &((*mpp)->b_next);
12844 
12845 		ip1dbg(("ill_dlpi_send: deferring request for %s "
12846 		    "while %s pending\n", ill->ill_name,
12847 		    dl_primstr(ill->ill_dlpi_pending)));
12848 
12849 		*mpp = mp;
12850 		mutex_exit(&ill->ill_lock);
12851 		return;
12852 	}
12853 	mutex_exit(&ill->ill_lock);
12854 	ill_dlpi_dispatch(ill, mp);
12855 }
12856 
12857 void
12858 ill_capability_send(ill_t *ill, mblk_t *mp)
12859 {
12860 	ill->ill_capab_pending_cnt++;
12861 	ill_dlpi_send(ill, mp);
12862 }
12863 
12864 void
12865 ill_capability_done(ill_t *ill)
12866 {
12867 	ASSERT(ill->ill_capab_pending_cnt != 0);
12868 
12869 	ill_dlpi_done(ill, DL_CAPABILITY_REQ);
12870 
12871 	ill->ill_capab_pending_cnt--;
12872 	if (ill->ill_capab_pending_cnt == 0 &&
12873 	    ill->ill_dlpi_capab_state == IDCS_OK)
12874 		ill_capability_reset_alloc(ill);
12875 }
12876 
12877 /*
12878  * Send all deferred DLPI messages without waiting for their ACKs.
12879  */
12880 void
12881 ill_dlpi_send_deferred(ill_t *ill)
12882 {
12883 	mblk_t *mp, *nextmp;
12884 
12885 	/*
12886 	 * Clear ill_dlpi_pending so that the message is not queued in
12887 	 * ill_dlpi_send().
12888 	 */
12889 	mutex_enter(&ill->ill_lock);
12890 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
12891 	mp = ill->ill_dlpi_deferred;
12892 	ill->ill_dlpi_deferred = NULL;
12893 	mutex_exit(&ill->ill_lock);
12894 
12895 	for (; mp != NULL; mp = nextmp) {
12896 		nextmp = mp->b_next;
12897 		mp->b_next = NULL;
12898 		ill_dlpi_send(ill, mp);
12899 	}
12900 }
12901 
12902 /*
12903  * Clear all the deferred DLPI messages. Called on receiving an M_ERROR
12904  * or M_HANGUP
12905  */
12906 static void
12907 ill_dlpi_clear_deferred(ill_t *ill)
12908 {
12909 	mblk_t	*mp, *nextmp;
12910 
12911 	mutex_enter(&ill->ill_lock);
12912 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
12913 	mp = ill->ill_dlpi_deferred;
12914 	ill->ill_dlpi_deferred = NULL;
12915 	mutex_exit(&ill->ill_lock);
12916 
12917 	for (; mp != NULL; mp = nextmp) {
12918 		nextmp = mp->b_next;
12919 		inet_freemsg(mp);
12920 	}
12921 }
12922 
12923 /*
12924  * Check if the DLPI primitive `prim' is pending; print a warning if not.
12925  */
12926 boolean_t
12927 ill_dlpi_pending(ill_t *ill, t_uscalar_t prim)
12928 {
12929 	t_uscalar_t pending;
12930 
12931 	mutex_enter(&ill->ill_lock);
12932 	if (ill->ill_dlpi_pending == prim) {
12933 		mutex_exit(&ill->ill_lock);
12934 		return (B_TRUE);
12935 	}
12936 
12937 	/*
12938 	 * During teardown, ill_dlpi_dispatch() will send DLPI requests
12939 	 * without waiting, so don't print any warnings in that case.
12940 	 */
12941 	if (ill->ill_state_flags & ILL_CONDEMNED) {
12942 		mutex_exit(&ill->ill_lock);
12943 		return (B_FALSE);
12944 	}
12945 	pending = ill->ill_dlpi_pending;
12946 	mutex_exit(&ill->ill_lock);
12947 
12948 	if (pending == DL_PRIM_INVAL) {
12949 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12950 		    "received unsolicited ack for %s on %s\n",
12951 		    dl_primstr(prim), ill->ill_name);
12952 	} else {
12953 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12954 		    "received unexpected ack for %s on %s (expecting %s)\n",
12955 		    dl_primstr(prim), ill->ill_name, dl_primstr(pending));
12956 	}
12957 	return (B_FALSE);
12958 }
12959 
12960 /*
12961  * Complete the current DLPI operation associated with `prim' on `ill' and
12962  * start the next queued DLPI operation (if any).  If there are no queued DLPI
12963  * operations and the ill's current exclusive IPSQ operation has finished
12964  * (i.e., ipsq_current_finish() was called), then clear ipsq_current_ipif to
12965  * allow the next exclusive IPSQ operation to begin upon ipsq_exit().  See
12966  * the comments above ipsq_current_finish() for details.
12967  */
12968 void
12969 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
12970 {
12971 	mblk_t *mp;
12972 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
12973 	ipxop_t *ipx = ipsq->ipsq_xop;
12974 
12975 	ASSERT(IAM_WRITER_IPSQ(ipsq));
12976 	mutex_enter(&ill->ill_lock);
12977 
12978 	ASSERT(prim != DL_PRIM_INVAL);
12979 	ASSERT(ill->ill_dlpi_pending == prim);
12980 
12981 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
12982 	    dl_primstr(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
12983 
12984 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
12985 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
12986 		if (ipx->ipx_current_done) {
12987 			mutex_enter(&ipx->ipx_lock);
12988 			ipx->ipx_current_ipif = NULL;
12989 			mutex_exit(&ipx->ipx_lock);
12990 		}
12991 		cv_signal(&ill->ill_cv);
12992 		mutex_exit(&ill->ill_lock);
12993 		return;
12994 	}
12995 
12996 	ill->ill_dlpi_deferred = mp->b_next;
12997 	mp->b_next = NULL;
12998 	mutex_exit(&ill->ill_lock);
12999 
13000 	ill_dlpi_dispatch(ill, mp);
13001 }
13002 
13003 /*
13004  * Queue a (multicast) DLPI control message to be sent to the driver by
13005  * later calling ill_dlpi_send_queued.
13006  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
13007  * are sent in order i.e., prevent a DL_DISABMULTI_REQ and DL_ENABMULTI_REQ
13008  * for the same group to race.
13009  * We send DLPI control messages in order using ill_lock.
13010  * For IPMP we should be called on the cast_ill.
13011  */
13012 void
13013 ill_dlpi_queue(ill_t *ill, mblk_t *mp)
13014 {
13015 	mblk_t **mpp;
13016 
13017 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
13018 
13019 	mutex_enter(&ill->ill_lock);
13020 	/* Must queue message. Tail insertion */
13021 	mpp = &ill->ill_dlpi_deferred;
13022 	while (*mpp != NULL)
13023 		mpp = &((*mpp)->b_next);
13024 
13025 	*mpp = mp;
13026 	mutex_exit(&ill->ill_lock);
13027 }
13028 
13029 /*
13030  * Send the messages that were queued. Make sure there is only
13031  * one outstanding message. ip_rput_dlpi_writer calls ill_dlpi_done()
13032  * when an ACK or a NAK is received to process the next queued message.
13033  * For IPMP we are called on the upper ill, but when send what is queued
13034  * on the cast_ill.
13035  */
13036 void
13037 ill_dlpi_send_queued(ill_t *ill)
13038 {
13039 	mblk_t	*mp;
13040 	union DL_primitives *dlp;
13041 	t_uscalar_t prim;
13042 	ill_t *release_ill = NULL;
13043 
13044 	if (IS_IPMP(ill)) {
13045 		/* On the upper IPMP ill. */
13046 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13047 		if (release_ill == NULL) {
13048 			/* Avoid ever sending anything down to the ipmpstub */
13049 			return;
13050 		}
13051 		ill = release_ill;
13052 	}
13053 	mutex_enter(&ill->ill_lock);
13054 	while ((mp = ill->ill_dlpi_deferred) != NULL) {
13055 		if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
13056 			/* Can't send. Somebody else will send it */
13057 			mutex_exit(&ill->ill_lock);
13058 			goto done;
13059 		}
13060 		ill->ill_dlpi_deferred = mp->b_next;
13061 		mp->b_next = NULL;
13062 		if (!ill->ill_dl_up) {
13063 			/*
13064 			 * Nobody there. All multicast addresses will be
13065 			 * re-joined when we get the DL_BIND_ACK bringing the
13066 			 * interface up.
13067 			 */
13068 			freemsg(mp);
13069 			continue;
13070 		}
13071 		dlp = (union DL_primitives *)mp->b_rptr;
13072 		prim = dlp->dl_primitive;
13073 
13074 		if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
13075 		    (prim == DL_UNBIND_REQ)) {
13076 			ill->ill_dlpi_pending = prim;
13077 		}
13078 		mutex_exit(&ill->ill_lock);
13079 
13080 		DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_send_queued",
13081 		    char *, dl_primstr(prim), ill_t *, ill);
13082 		putnext(ill->ill_wq, mp);
13083 		mutex_enter(&ill->ill_lock);
13084 	}
13085 	mutex_exit(&ill->ill_lock);
13086 done:
13087 	if (release_ill != NULL)
13088 		ill_refrele(release_ill);
13089 }
13090 
13091 /*
13092  * Queue an IP (IGMP/MLD) message to be sent by IP from
13093  * ill_mcast_send_queued
13094  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
13095  * are sent in order i.e., prevent a IGMP leave and IGMP join for the same
13096  * group to race.
13097  * We send them in order using ill_lock.
13098  * For IPMP we are called on the upper ill, but we queue on the cast_ill.
13099  */
13100 void
13101 ill_mcast_queue(ill_t *ill, mblk_t *mp)
13102 {
13103 	mblk_t **mpp;
13104 	ill_t *release_ill = NULL;
13105 
13106 	ASSERT(RW_LOCK_HELD(&ill->ill_mcast_lock));
13107 
13108 	if (IS_IPMP(ill)) {
13109 		/* On the upper IPMP ill. */
13110 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13111 		if (release_ill == NULL) {
13112 			/* Discard instead of queuing for the ipmp interface */
13113 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
13114 			ip_drop_output("ipIfStatsOutDiscards - no cast_ill",
13115 			    mp, ill);
13116 			freemsg(mp);
13117 			return;
13118 		}
13119 		ill = release_ill;
13120 	}
13121 
13122 	mutex_enter(&ill->ill_lock);
13123 	/* Must queue message. Tail insertion */
13124 	mpp = &ill->ill_mcast_deferred;
13125 	while (*mpp != NULL)
13126 		mpp = &((*mpp)->b_next);
13127 
13128 	*mpp = mp;
13129 	mutex_exit(&ill->ill_lock);
13130 	if (release_ill != NULL)
13131 		ill_refrele(release_ill);
13132 }
13133 
13134 /*
13135  * Send the IP packets that were queued by ill_mcast_queue.
13136  * These are IGMP/MLD packets.
13137  *
13138  * For IPMP we are called on the upper ill, but when send what is queued
13139  * on the cast_ill.
13140  *
13141  * Request loopback of the report if we are acting as a multicast
13142  * router, so that the process-level routing demon can hear it.
13143  * This will run multiple times for the same group if there are members
13144  * on the same group for multiple ipif's on the same ill. The
13145  * igmp_input/mld_input code will suppress this due to the loopback thus we
13146  * always loopback membership report.
13147  *
13148  * We also need to make sure that this does not get load balanced
13149  * by IPMP. We do this by passing an ill to ip_output_simple.
13150  */
13151 void
13152 ill_mcast_send_queued(ill_t *ill)
13153 {
13154 	mblk_t	*mp;
13155 	ip_xmit_attr_t ixas;
13156 	ill_t *release_ill = NULL;
13157 
13158 	if (IS_IPMP(ill)) {
13159 		/* On the upper IPMP ill. */
13160 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13161 		if (release_ill == NULL) {
13162 			/*
13163 			 * We should have no messages on the ipmp interface
13164 			 * but no point in trying to send them.
13165 			 */
13166 			return;
13167 		}
13168 		ill = release_ill;
13169 	}
13170 	bzero(&ixas, sizeof (ixas));
13171 	ixas.ixa_zoneid = ALL_ZONES;
13172 	ixas.ixa_cred = kcred;
13173 	ixas.ixa_cpid = NOPID;
13174 	ixas.ixa_tsl = NULL;
13175 	/*
13176 	 * Here we set ixa_ifindex. If IPMP it will be the lower ill which
13177 	 * makes ip_select_route pick the IRE_MULTICAST for the cast_ill.
13178 	 * That is necessary to handle IGMP/MLD snooping switches.
13179 	 */
13180 	ixas.ixa_ifindex = ill->ill_phyint->phyint_ifindex;
13181 	ixas.ixa_ipst = ill->ill_ipst;
13182 
13183 	mutex_enter(&ill->ill_lock);
13184 	while ((mp = ill->ill_mcast_deferred) != NULL) {
13185 		ill->ill_mcast_deferred = mp->b_next;
13186 		mp->b_next = NULL;
13187 		if (!ill->ill_dl_up) {
13188 			/*
13189 			 * Nobody there. Just drop the ip packets.
13190 			 * IGMP/MLD will resend later, if this is a replumb.
13191 			 */
13192 			freemsg(mp);
13193 			continue;
13194 		}
13195 		mutex_enter(&ill->ill_phyint->phyint_lock);
13196 		if (IS_UNDER_IPMP(ill) && !ipmp_ill_is_active(ill)) {
13197 			/*
13198 			 * When the ill is getting deactivated, we only want to
13199 			 * send the DLPI messages, so drop IGMP/MLD packets.
13200 			 * DLPI messages are handled by ill_dlpi_send_queued()
13201 			 */
13202 			mutex_exit(&ill->ill_phyint->phyint_lock);
13203 			freemsg(mp);
13204 			continue;
13205 		}
13206 		mutex_exit(&ill->ill_phyint->phyint_lock);
13207 		mutex_exit(&ill->ill_lock);
13208 
13209 		/* Check whether we are sending IPv4 or IPv6. */
13210 		if (ill->ill_isv6) {
13211 			ip6_t  *ip6h = (ip6_t *)mp->b_rptr;
13212 
13213 			ixas.ixa_multicast_ttl = ip6h->ip6_hops;
13214 			ixas.ixa_flags = IXAF_BASIC_SIMPLE_V6;
13215 		} else {
13216 			ipha_t *ipha = (ipha_t *)mp->b_rptr;
13217 
13218 			ixas.ixa_multicast_ttl = ipha->ipha_ttl;
13219 			ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13220 			ixas.ixa_flags &= ~IXAF_SET_ULP_CKSUM;
13221 		}
13222 		ixas.ixa_flags &= ~IXAF_VERIFY_SOURCE;
13223 		ixas.ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_SOURCE;
13224 		(void) ip_output_simple(mp, &ixas);
13225 		ixa_cleanup(&ixas);
13226 
13227 		mutex_enter(&ill->ill_lock);
13228 	}
13229 	mutex_exit(&ill->ill_lock);
13230 
13231 done:
13232 	if (release_ill != NULL)
13233 		ill_refrele(release_ill);
13234 }
13235 
13236 /*
13237  * Take down a specific interface, but don't lose any information about it.
13238  * (Always called as writer.)
13239  * This function goes through the down sequence even if the interface is
13240  * already down. There are 2 reasons.
13241  * a. Currently we permit interface routes that depend on down interfaces
13242  *    to be added. This behaviour itself is questionable. However it appears
13243  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
13244  *    time. We go thru the cleanup in order to remove these routes.
13245  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
13246  *    DL_ERROR_ACK in response to the DL_BIND request. The interface is
13247  *    down, but we need to cleanup i.e. do ill_dl_down and
13248  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
13249  *
13250  * IP-MT notes:
13251  *
13252  * Model of reference to interfaces.
13253  *
13254  * The following members in ipif_t track references to the ipif.
13255  *	int     ipif_refcnt;    Active reference count
13256  *
13257  * The following members in ill_t track references to the ill.
13258  *	int             ill_refcnt;     active refcnt
13259  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
13260  *	uint_t          ill_ncec_cnt;	Number of ncecs referencing ill
13261  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
13262  *	uint_t          ill_ilm_cnt;	Number of ilms referencing ill
13263  *
13264  * Reference to an ipif or ill can be obtained in any of the following ways.
13265  *
13266  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
13267  * Pointers to ipif / ill from other data structures viz ire and conn.
13268  * Implicit reference to the ipif / ill by holding a reference to the ire.
13269  *
13270  * The ipif/ill lookup functions return a reference held ipif / ill.
13271  * ipif_refcnt and ill_refcnt track the reference counts respectively.
13272  * This is a purely dynamic reference count associated with threads holding
13273  * references to the ipif / ill. Pointers from other structures do not
13274  * count towards this reference count.
13275  *
13276  * ill_ire_cnt is the number of ire's associated with the
13277  * ill. This is incremented whenever a new ire is created referencing the
13278  * ill. This is done atomically inside ire_add_v[46] where the ire is
13279  * actually added to the ire hash table. The count is decremented in
13280  * ire_inactive where the ire is destroyed.
13281  *
13282  * ill_ncec_cnt is the number of ncec's referencing the ill thru ncec_ill.
13283  * This is incremented atomically in
13284  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
13285  * table. Similarly it is decremented in ncec_inactive() where the ncec
13286  * is destroyed.
13287  *
13288  * ill_nce_cnt is the number of nce's referencing the ill thru nce_ill. This is
13289  * incremented atomically in nce_add() where the nce is actually added to the
13290  * ill_nce. Similarly it is decremented in nce_inactive() where the nce
13291  * is destroyed.
13292  *
13293  * ill_ilm_cnt is the ilm's reference to the ill. It is incremented in
13294  * ilm_add() and decremented before the ilm is freed in ilm_delete().
13295  *
13296  * Flow of ioctls involving interface down/up
13297  *
13298  * The following is the sequence of an attempt to set some critical flags on an
13299  * up interface.
13300  * ip_sioctl_flags
13301  * ipif_down
13302  * wait for ipif to be quiescent
13303  * ipif_down_tail
13304  * ip_sioctl_flags_tail
13305  *
13306  * All set ioctls that involve down/up sequence would have a skeleton similar
13307  * to the above. All the *tail functions are called after the refcounts have
13308  * dropped to the appropriate values.
13309  *
13310  * SIOC ioctls during the IPIF_CHANGING interval.
13311  *
13312  * Threads handling SIOC set ioctls serialize on the squeue, but this
13313  * is not done for SIOC get ioctls. Since a set ioctl can cause several
13314  * steps of internal changes to the state, some of which are visible in
13315  * ipif_flags (such as IFF_UP being cleared and later set), and we want
13316  * the set ioctl to be atomic related to the get ioctls, the SIOC get code
13317  * will wait and restart ioctls if IPIF_CHANGING is set. The mblk is then
13318  * enqueued in the ipsq and the operation is restarted by ipsq_exit() when
13319  * the current exclusive operation completes. The IPIF_CHANGING check
13320  * and enqueue is atomic using the ill_lock and ipsq_lock. The
13321  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
13322  * change while the ill_lock is held. Before dropping the ill_lock we acquire
13323  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
13324  * until we release the ipsq_lock, even though the ill/ipif state flags
13325  * can change after we drop the ill_lock.
13326  */
13327 int
13328 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13329 {
13330 	ill_t		*ill = ipif->ipif_ill;
13331 	conn_t		*connp;
13332 	boolean_t	success;
13333 	boolean_t	ipif_was_up = B_FALSE;
13334 	ip_stack_t	*ipst = ill->ill_ipst;
13335 
13336 	ASSERT(IAM_WRITER_IPIF(ipif));
13337 
13338 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13339 
13340 	DTRACE_PROBE3(ipif__downup, char *, "ipif_down",
13341 	    ill_t *, ill, ipif_t *, ipif);
13342 
13343 	if (ipif->ipif_flags & IPIF_UP) {
13344 		mutex_enter(&ill->ill_lock);
13345 		ipif->ipif_flags &= ~IPIF_UP;
13346 		ASSERT(ill->ill_ipif_up_count > 0);
13347 		--ill->ill_ipif_up_count;
13348 		mutex_exit(&ill->ill_lock);
13349 		ipif_was_up = B_TRUE;
13350 		/* Update status in SCTP's list */
13351 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
13352 		ill_nic_event_dispatch(ipif->ipif_ill,
13353 		    MAP_IPIF_ID(ipif->ipif_id), NE_LIF_DOWN, NULL, 0);
13354 	}
13355 
13356 	/*
13357 	 * Removal of the last ipif from an ill may result in a DL_UNBIND
13358 	 * being sent to the driver, and we must not send any data packets to
13359 	 * the driver after the DL_UNBIND_REQ. To ensure this, all the
13360 	 * ire and nce entries used in the data path will be cleaned
13361 	 * up, and we also set  the ILL_DOWN_IN_PROGRESS bit to make
13362 	 * sure on new entries will be added until the ill is bound
13363 	 * again. The ILL_DOWN_IN_PROGRESS bit is turned off upon
13364 	 * receipt of a DL_BIND_ACK.
13365 	 */
13366 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13367 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13368 	    ill->ill_dl_up) {
13369 		ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
13370 	}
13371 
13372 	/*
13373 	 * Blow away memberships we established in ipif_multicast_up().
13374 	 */
13375 	ipif_multicast_down(ipif);
13376 
13377 	/*
13378 	 * Remove from the mapping for __sin6_src_id. We insert only
13379 	 * when the address is not INADDR_ANY. As IPv4 addresses are
13380 	 * stored as mapped addresses, we need to check for mapped
13381 	 * INADDR_ANY also.
13382 	 */
13383 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
13384 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
13385 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
13386 		int err;
13387 
13388 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
13389 		    ipif->ipif_zoneid, ipst);
13390 		if (err != 0) {
13391 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
13392 		}
13393 	}
13394 
13395 	if (ipif_was_up) {
13396 		/* only delete if we'd added ire's before */
13397 		if (ipif->ipif_isv6)
13398 			ipif_delete_ires_v6(ipif);
13399 		else
13400 			ipif_delete_ires_v4(ipif);
13401 	}
13402 
13403 	if (ipif_was_up && ill->ill_ipif_up_count == 0) {
13404 		/*
13405 		 * Since the interface is now down, it may have just become
13406 		 * inactive.  Note that this needs to be done even for a
13407 		 * lll_logical_down(), or ARP entries will not get correctly
13408 		 * restored when the interface comes back up.
13409 		 */
13410 		if (IS_UNDER_IPMP(ill))
13411 			ipmp_ill_refresh_active(ill);
13412 	}
13413 
13414 	/*
13415 	 * neighbor-discovery or arp entries for this interface. The ipif
13416 	 * has to be quiesced, so we walk all the nce's and delete those
13417 	 * that point at the ipif->ipif_ill. At the same time, we also
13418 	 * update IPMP so that ipifs for data addresses are unbound. We dont
13419 	 * call ipif_arp_down to DL_UNBIND the arp stream itself here, but defer
13420 	 * that for ipif_down_tail()
13421 	 */
13422 	ipif_nce_down(ipif);
13423 
13424 	/*
13425 	 * If this is the last ipif on the ill, we also need to remove
13426 	 * any IREs with ire_ill set. Otherwise ipif_is_quiescent() will
13427 	 * never succeed.
13428 	 */
13429 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0)
13430 		ire_walk_ill(0, 0, ill_downi, ill, ill);
13431 
13432 	/*
13433 	 * Walk all CONNs that can have a reference on an ire for this
13434 	 * ipif (we actually walk all that now have stale references).
13435 	 */
13436 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
13437 
13438 	/*
13439 	 * If mp is NULL the caller will wait for the appropriate refcnt.
13440 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
13441 	 * and ill_delete -> ipif_free -> ipif_down
13442 	 */
13443 	if (mp == NULL) {
13444 		ASSERT(q == NULL);
13445 		return (0);
13446 	}
13447 
13448 	if (CONN_Q(q)) {
13449 		connp = Q_TO_CONN(q);
13450 		mutex_enter(&connp->conn_lock);
13451 	} else {
13452 		connp = NULL;
13453 	}
13454 	mutex_enter(&ill->ill_lock);
13455 	/*
13456 	 * Are there any ire's pointing to this ipif that are still active ?
13457 	 * If this is the last ipif going down, are there any ire's pointing
13458 	 * to this ill that are still active ?
13459 	 */
13460 	if (ipif_is_quiescent(ipif)) {
13461 		mutex_exit(&ill->ill_lock);
13462 		if (connp != NULL)
13463 			mutex_exit(&connp->conn_lock);
13464 		return (0);
13465 	}
13466 
13467 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
13468 	    ill->ill_name, (void *)ill));
13469 	/*
13470 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
13471 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
13472 	 * which in turn is called by the last refrele on the ipif/ill/ire.
13473 	 */
13474 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
13475 	if (!success) {
13476 		/* The conn is closing. So just return */
13477 		ASSERT(connp != NULL);
13478 		mutex_exit(&ill->ill_lock);
13479 		mutex_exit(&connp->conn_lock);
13480 		return (EINTR);
13481 	}
13482 
13483 	mutex_exit(&ill->ill_lock);
13484 	if (connp != NULL)
13485 		mutex_exit(&connp->conn_lock);
13486 	return (EINPROGRESS);
13487 }
13488 
13489 int
13490 ipif_down_tail(ipif_t *ipif)
13491 {
13492 	ill_t	*ill = ipif->ipif_ill;
13493 	int	err = 0;
13494 
13495 	DTRACE_PROBE3(ipif__downup, char *, "ipif_down_tail",
13496 	    ill_t *, ill, ipif_t *, ipif);
13497 
13498 	/*
13499 	 * Skip any loopback interface (null wq).
13500 	 * If this is the last logical interface on the ill
13501 	 * have ill_dl_down tell the driver we are gone (unbind)
13502 	 * Note that lun 0 can ipif_down even though
13503 	 * there are other logical units that are up.
13504 	 * This occurs e.g. when we change a "significant" IFF_ flag.
13505 	 */
13506 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13507 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13508 	    ill->ill_dl_up) {
13509 		ill_dl_down(ill);
13510 	}
13511 	if (!ipif->ipif_isv6)
13512 		err = ipif_arp_down(ipif);
13513 
13514 	ill->ill_logical_down = 0;
13515 
13516 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
13517 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif, RTSQ_DEFAULT);
13518 	return (err);
13519 }
13520 
13521 /*
13522  * Bring interface logically down without bringing the physical interface
13523  * down e.g. when the netmask is changed. This avoids long lasting link
13524  * negotiations between an ethernet interface and a certain switches.
13525  */
13526 static int
13527 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13528 {
13529 	DTRACE_PROBE3(ipif__downup, char *, "ipif_logical_down",
13530 	    ill_t *, ipif->ipif_ill, ipif_t *, ipif);
13531 
13532 	/*
13533 	 * The ill_logical_down flag is a transient flag. It is set here
13534 	 * and is cleared once the down has completed in ipif_down_tail.
13535 	 * This flag does not indicate whether the ill stream is in the
13536 	 * DL_BOUND state with the driver. Instead this flag is used by
13537 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
13538 	 * the driver. The state of the ill stream i.e. whether it is
13539 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
13540 	 */
13541 	ipif->ipif_ill->ill_logical_down = 1;
13542 	return (ipif_down(ipif, q, mp));
13543 }
13544 
13545 /*
13546  * Initiate deallocate of an IPIF. Always called as writer. Called by
13547  * ill_delete or ip_sioctl_removeif.
13548  */
13549 static void
13550 ipif_free(ipif_t *ipif)
13551 {
13552 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13553 
13554 	ASSERT(IAM_WRITER_IPIF(ipif));
13555 
13556 	if (ipif->ipif_recovery_id != 0)
13557 		(void) untimeout(ipif->ipif_recovery_id);
13558 	ipif->ipif_recovery_id = 0;
13559 
13560 	/*
13561 	 * Take down the interface. We can be called either from ill_delete
13562 	 * or from ip_sioctl_removeif.
13563 	 */
13564 	(void) ipif_down(ipif, NULL, NULL);
13565 
13566 	/*
13567 	 * Now that the interface is down, there's no chance it can still
13568 	 * become a duplicate.  Cancel any timer that may have been set while
13569 	 * tearing down.
13570 	 */
13571 	if (ipif->ipif_recovery_id != 0)
13572 		(void) untimeout(ipif->ipif_recovery_id);
13573 	ipif->ipif_recovery_id = 0;
13574 
13575 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13576 	/* Remove pointers to this ill in the multicast routing tables */
13577 	reset_mrt_vif_ipif(ipif);
13578 	/* If necessary, clear the cached source ipif rotor. */
13579 	if (ipif->ipif_ill->ill_src_ipif == ipif)
13580 		ipif->ipif_ill->ill_src_ipif = NULL;
13581 	rw_exit(&ipst->ips_ill_g_lock);
13582 }
13583 
13584 static void
13585 ipif_free_tail(ipif_t *ipif)
13586 {
13587 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
13588 
13589 	/*
13590 	 * Need to hold both ill_g_lock and ill_lock while
13591 	 * inserting or removing an ipif from the linked list
13592 	 * of ipifs hanging off the ill.
13593 	 */
13594 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13595 
13596 #ifdef DEBUG
13597 	ipif_trace_cleanup(ipif);
13598 #endif
13599 
13600 	/* Ask SCTP to take it out of it list */
13601 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
13602 	ip_rts_newaddrmsg(RTM_FREEADDR, 0, ipif, RTSQ_DEFAULT);
13603 
13604 	/* Get it out of the ILL interface list. */
13605 	ipif_remove(ipif);
13606 	rw_exit(&ipst->ips_ill_g_lock);
13607 
13608 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
13609 	ASSERT(ipif->ipif_recovery_id == 0);
13610 	ASSERT(ipif->ipif_ire_local == NULL);
13611 	ASSERT(ipif->ipif_ire_if == NULL);
13612 
13613 	/* Free the memory. */
13614 	mi_free(ipif);
13615 }
13616 
13617 /*
13618  * Sets `buf' to an ipif name of the form "ill_name:id", or "ill_name" if "id"
13619  * is zero.
13620  */
13621 void
13622 ipif_get_name(const ipif_t *ipif, char *buf, int len)
13623 {
13624 	char	lbuf[LIFNAMSIZ];
13625 	char	*name;
13626 	size_t	name_len;
13627 
13628 	buf[0] = '\0';
13629 	name = ipif->ipif_ill->ill_name;
13630 	name_len = ipif->ipif_ill->ill_name_length;
13631 	if (ipif->ipif_id != 0) {
13632 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
13633 		    ipif->ipif_id);
13634 		name = lbuf;
13635 		name_len = mi_strlen(name) + 1;
13636 	}
13637 	len -= 1;
13638 	buf[len] = '\0';
13639 	len = MIN(len, name_len);
13640 	bcopy(name, buf, len);
13641 }
13642 
13643 /*
13644  * Sets `buf' to an ill name.
13645  */
13646 void
13647 ill_get_name(const ill_t *ill, char *buf, int len)
13648 {
13649 	char	*name;
13650 	size_t	name_len;
13651 
13652 	name = ill->ill_name;
13653 	name_len = ill->ill_name_length;
13654 	len -= 1;
13655 	buf[len] = '\0';
13656 	len = MIN(len, name_len);
13657 	bcopy(name, buf, len);
13658 }
13659 
13660 /*
13661  * Find an IPIF based on the name passed in.  Names can be of the form <phys>
13662  * (e.g., le0) or <phys>:<#> (e.g., le0:1).  When there is no colon, the
13663  * implied unit id is zero. <phys> must correspond to the name of an ILL.
13664  * (May be called as writer.)
13665  */
13666 static ipif_t *
13667 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
13668     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, ip_stack_t *ipst)
13669 {
13670 	char	*cp;
13671 	char	*endp;
13672 	long	id;
13673 	ill_t	*ill;
13674 	ipif_t	*ipif;
13675 	uint_t	ire_type;
13676 	boolean_t did_alloc = B_FALSE;
13677 	char	last;
13678 
13679 	/*
13680 	 * If the caller wants to us to create the ipif, make sure we have a
13681 	 * valid zoneid
13682 	 */
13683 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
13684 
13685 	if (namelen == 0) {
13686 		return (NULL);
13687 	}
13688 
13689 	*exists = B_FALSE;
13690 	/* Look for a colon in the name. */
13691 	endp = &name[namelen];
13692 	for (cp = endp; --cp > name; ) {
13693 		if (*cp == IPIF_SEPARATOR_CHAR)
13694 			break;
13695 	}
13696 
13697 	if (*cp == IPIF_SEPARATOR_CHAR) {
13698 		/*
13699 		 * Reject any non-decimal aliases for logical
13700 		 * interfaces. Aliases with leading zeroes
13701 		 * are also rejected as they introduce ambiguity
13702 		 * in the naming of the interfaces.
13703 		 * In order to confirm with existing semantics,
13704 		 * and to not break any programs/script relying
13705 		 * on that behaviour, if<0>:0 is considered to be
13706 		 * a valid interface.
13707 		 *
13708 		 * If alias has two or more digits and the first
13709 		 * is zero, fail.
13710 		 */
13711 		if (&cp[2] < endp && cp[1] == '0') {
13712 			return (NULL);
13713 		}
13714 	}
13715 
13716 	if (cp <= name) {
13717 		cp = endp;
13718 	}
13719 	last = *cp;
13720 	*cp = '\0';
13721 
13722 	/*
13723 	 * Look up the ILL, based on the portion of the name
13724 	 * before the slash. ill_lookup_on_name returns a held ill.
13725 	 * Temporary to check whether ill exists already. If so
13726 	 * ill_lookup_on_name will clear it.
13727 	 */
13728 	ill = ill_lookup_on_name(name, do_alloc, isv6,
13729 	    &did_alloc, ipst);
13730 	*cp = last;
13731 	if (ill == NULL)
13732 		return (NULL);
13733 
13734 	/* Establish the unit number in the name. */
13735 	id = 0;
13736 	if (cp < endp && *endp == '\0') {
13737 		/* If there was a colon, the unit number follows. */
13738 		cp++;
13739 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13740 			ill_refrele(ill);
13741 			return (NULL);
13742 		}
13743 	}
13744 
13745 	mutex_enter(&ill->ill_lock);
13746 	/* Now see if there is an IPIF with this unit number. */
13747 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13748 		if (ipif->ipif_id == id) {
13749 			if (zoneid != ALL_ZONES &&
13750 			    zoneid != ipif->ipif_zoneid &&
13751 			    ipif->ipif_zoneid != ALL_ZONES) {
13752 				mutex_exit(&ill->ill_lock);
13753 				ill_refrele(ill);
13754 				return (NULL);
13755 			}
13756 			if (IPIF_CAN_LOOKUP(ipif)) {
13757 				ipif_refhold_locked(ipif);
13758 				mutex_exit(&ill->ill_lock);
13759 				if (!did_alloc)
13760 					*exists = B_TRUE;
13761 				/*
13762 				 * Drop locks before calling ill_refrele
13763 				 * since it can potentially call into
13764 				 * ipif_ill_refrele_tail which can end up
13765 				 * in trying to acquire any lock.
13766 				 */
13767 				ill_refrele(ill);
13768 				return (ipif);
13769 			}
13770 		}
13771 	}
13772 
13773 	if (!do_alloc) {
13774 		mutex_exit(&ill->ill_lock);
13775 		ill_refrele(ill);
13776 		return (NULL);
13777 	}
13778 
13779 	/*
13780 	 * If none found, atomically allocate and return a new one.
13781 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
13782 	 * to support "receive only" use of lo0:1 etc. as is still done
13783 	 * below as an initial guess.
13784 	 * However, this is now likely to be overriden later in ipif_up_done()
13785 	 * when we know for sure what address has been configured on the
13786 	 * interface, since we might have more than one loopback interface
13787 	 * with a loopback address, e.g. in the case of zones, and all the
13788 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
13789 	 */
13790 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
13791 		ire_type = IRE_LOOPBACK;
13792 	else
13793 		ire_type = IRE_LOCAL;
13794 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE, B_TRUE, NULL);
13795 	if (ipif != NULL)
13796 		ipif_refhold_locked(ipif);
13797 	mutex_exit(&ill->ill_lock);
13798 	ill_refrele(ill);
13799 	return (ipif);
13800 }
13801 
13802 /*
13803  * Variant of the above that queues the request on the ipsq when
13804  * IPIF_CHANGING is set.
13805  */
13806 static ipif_t *
13807 ipif_lookup_on_name_async(char *name, size_t namelen, boolean_t isv6,
13808     zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func, int *error,
13809     ip_stack_t *ipst)
13810 {
13811 	char	*cp;
13812 	char	*endp;
13813 	long	id;
13814 	ill_t	*ill;
13815 	ipif_t	*ipif;
13816 	boolean_t did_alloc = B_FALSE;
13817 	ipsq_t	*ipsq;
13818 
13819 	if (error != NULL)
13820 		*error = 0;
13821 
13822 	if (namelen == 0) {
13823 		if (error != NULL)
13824 			*error = ENXIO;
13825 		return (NULL);
13826 	}
13827 
13828 	/* Look for a colon in the name. */
13829 	endp = &name[namelen];
13830 	for (cp = endp; --cp > name; ) {
13831 		if (*cp == IPIF_SEPARATOR_CHAR)
13832 			break;
13833 	}
13834 
13835 	if (*cp == IPIF_SEPARATOR_CHAR) {
13836 		/*
13837 		 * Reject any non-decimal aliases for logical
13838 		 * interfaces. Aliases with leading zeroes
13839 		 * are also rejected as they introduce ambiguity
13840 		 * in the naming of the interfaces.
13841 		 * In order to confirm with existing semantics,
13842 		 * and to not break any programs/script relying
13843 		 * on that behaviour, if<0>:0 is considered to be
13844 		 * a valid interface.
13845 		 *
13846 		 * If alias has two or more digits and the first
13847 		 * is zero, fail.
13848 		 */
13849 		if (&cp[2] < endp && cp[1] == '0') {
13850 			if (error != NULL)
13851 				*error = EINVAL;
13852 			return (NULL);
13853 		}
13854 	}
13855 
13856 	if (cp <= name) {
13857 		cp = endp;
13858 	} else {
13859 		*cp = '\0';
13860 	}
13861 
13862 	/*
13863 	 * Look up the ILL, based on the portion of the name
13864 	 * before the slash. ill_lookup_on_name returns a held ill.
13865 	 * Temporary to check whether ill exists already. If so
13866 	 * ill_lookup_on_name will clear it.
13867 	 */
13868 	ill = ill_lookup_on_name(name, B_FALSE, isv6, &did_alloc, ipst);
13869 	if (cp != endp)
13870 		*cp = IPIF_SEPARATOR_CHAR;
13871 	if (ill == NULL)
13872 		return (NULL);
13873 
13874 	/* Establish the unit number in the name. */
13875 	id = 0;
13876 	if (cp < endp && *endp == '\0') {
13877 		/* If there was a colon, the unit number follows. */
13878 		cp++;
13879 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13880 			ill_refrele(ill);
13881 			if (error != NULL)
13882 				*error = ENXIO;
13883 			return (NULL);
13884 		}
13885 	}
13886 
13887 	GRAB_CONN_LOCK(q);
13888 	mutex_enter(&ill->ill_lock);
13889 	/* Now see if there is an IPIF with this unit number. */
13890 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13891 		if (ipif->ipif_id == id) {
13892 			if (zoneid != ALL_ZONES &&
13893 			    zoneid != ipif->ipif_zoneid &&
13894 			    ipif->ipif_zoneid != ALL_ZONES) {
13895 				mutex_exit(&ill->ill_lock);
13896 				RELEASE_CONN_LOCK(q);
13897 				ill_refrele(ill);
13898 				if (error != NULL)
13899 					*error = ENXIO;
13900 				return (NULL);
13901 			}
13902 
13903 			if (!(IPIF_IS_CHANGING(ipif) ||
13904 			    IPIF_IS_CONDEMNED(ipif)) ||
13905 			    IAM_WRITER_IPIF(ipif)) {
13906 				ipif_refhold_locked(ipif);
13907 				mutex_exit(&ill->ill_lock);
13908 				/*
13909 				 * Drop locks before calling ill_refrele
13910 				 * since it can potentially call into
13911 				 * ipif_ill_refrele_tail which can end up
13912 				 * in trying to acquire any lock.
13913 				 */
13914 				RELEASE_CONN_LOCK(q);
13915 				ill_refrele(ill);
13916 				return (ipif);
13917 			} else if (q != NULL && !IPIF_IS_CONDEMNED(ipif)) {
13918 				ipsq = ill->ill_phyint->phyint_ipsq;
13919 				mutex_enter(&ipsq->ipsq_lock);
13920 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
13921 				mutex_exit(&ill->ill_lock);
13922 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
13923 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
13924 				mutex_exit(&ipsq->ipsq_lock);
13925 				RELEASE_CONN_LOCK(q);
13926 				ill_refrele(ill);
13927 				if (error != NULL)
13928 					*error = EINPROGRESS;
13929 				return (NULL);
13930 			}
13931 		}
13932 	}
13933 	RELEASE_CONN_LOCK(q);
13934 	mutex_exit(&ill->ill_lock);
13935 	ill_refrele(ill);
13936 	if (error != NULL)
13937 		*error = ENXIO;
13938 	return (NULL);
13939 }
13940 
13941 /*
13942  * This routine is called whenever a new address comes up on an ipif.  If
13943  * we are configured to respond to address mask requests, then we are supposed
13944  * to broadcast an address mask reply at this time.  This routine is also
13945  * called if we are already up, but a netmask change is made.  This is legal
13946  * but might not make the system manager very popular.	(May be called
13947  * as writer.)
13948  */
13949 void
13950 ipif_mask_reply(ipif_t *ipif)
13951 {
13952 	icmph_t	*icmph;
13953 	ipha_t	*ipha;
13954 	mblk_t	*mp;
13955 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13956 	ip_xmit_attr_t ixas;
13957 
13958 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
13959 
13960 	if (!ipst->ips_ip_respond_to_address_mask_broadcast)
13961 		return;
13962 
13963 	/* ICMP mask reply is IPv4 only */
13964 	ASSERT(!ipif->ipif_isv6);
13965 	/* ICMP mask reply is not for a loopback interface */
13966 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
13967 
13968 	if (ipif->ipif_lcl_addr == INADDR_ANY)
13969 		return;
13970 
13971 	mp = allocb(REPLY_LEN, BPRI_HI);
13972 	if (mp == NULL)
13973 		return;
13974 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
13975 
13976 	ipha = (ipha_t *)mp->b_rptr;
13977 	bzero(ipha, REPLY_LEN);
13978 	*ipha = icmp_ipha;
13979 	ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
13980 	ipha->ipha_src = ipif->ipif_lcl_addr;
13981 	ipha->ipha_dst = ipif->ipif_brd_addr;
13982 	ipha->ipha_length = htons(REPLY_LEN);
13983 	ipha->ipha_ident = 0;
13984 
13985 	icmph = (icmph_t *)&ipha[1];
13986 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
13987 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
13988 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
13989 
13990 	bzero(&ixas, sizeof (ixas));
13991 	ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13992 	ixas.ixa_zoneid = ALL_ZONES;
13993 	ixas.ixa_ifindex = 0;
13994 	ixas.ixa_ipst = ipst;
13995 	ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
13996 	(void) ip_output_simple(mp, &ixas);
13997 	ixa_cleanup(&ixas);
13998 #undef	REPLY_LEN
13999 }
14000 
14001 /*
14002  * Join the ipif specific multicast groups.
14003  * Must be called after a mapping has been set up in the resolver.  (Always
14004  * called as writer.)
14005  */
14006 void
14007 ipif_multicast_up(ipif_t *ipif)
14008 {
14009 	int err;
14010 	ill_t *ill;
14011 	ilm_t *ilm;
14012 
14013 	ASSERT(IAM_WRITER_IPIF(ipif));
14014 
14015 	ill = ipif->ipif_ill;
14016 
14017 	ip1dbg(("ipif_multicast_up\n"));
14018 	if (!(ill->ill_flags & ILLF_MULTICAST) ||
14019 	    ipif->ipif_allhosts_ilm != NULL)
14020 		return;
14021 
14022 	if (ipif->ipif_isv6) {
14023 		in6_addr_t v6allmc = ipv6_all_hosts_mcast;
14024 		in6_addr_t v6solmc = ipv6_solicited_node_mcast;
14025 
14026 		v6solmc.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
14027 
14028 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
14029 			return;
14030 
14031 		ip1dbg(("ipif_multicast_up - addmulti\n"));
14032 
14033 		/*
14034 		 * Join the all hosts multicast address.  We skip this for
14035 		 * underlying IPMP interfaces since they should be invisible.
14036 		 */
14037 		if (!IS_UNDER_IPMP(ill)) {
14038 			ilm = ip_addmulti(&v6allmc, ill, ipif->ipif_zoneid,
14039 			    &err);
14040 			if (ilm == NULL) {
14041 				ASSERT(err != 0);
14042 				ip0dbg(("ipif_multicast_up: "
14043 				    "all_hosts_mcast failed %d\n", err));
14044 				return;
14045 			}
14046 			ipif->ipif_allhosts_ilm = ilm;
14047 		}
14048 
14049 		/*
14050 		 * Enable multicast for the solicited node multicast address.
14051 		 * If IPMP we need to put the membership on the upper ill.
14052 		 */
14053 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
14054 			ill_t *mcast_ill = NULL;
14055 			boolean_t need_refrele;
14056 
14057 			if (IS_UNDER_IPMP(ill) &&
14058 			    (mcast_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL) {
14059 				need_refrele = B_TRUE;
14060 			} else {
14061 				mcast_ill = ill;
14062 				need_refrele = B_FALSE;
14063 			}
14064 
14065 			ilm = ip_addmulti(&v6solmc, mcast_ill,
14066 			    ipif->ipif_zoneid, &err);
14067 			if (need_refrele)
14068 				ill_refrele(mcast_ill);
14069 
14070 			if (ilm == NULL) {
14071 				ASSERT(err != 0);
14072 				ip0dbg(("ipif_multicast_up: solicited MC"
14073 				    " failed %d\n", err));
14074 				if ((ilm = ipif->ipif_allhosts_ilm) != NULL) {
14075 					ipif->ipif_allhosts_ilm = NULL;
14076 					(void) ip_delmulti(ilm);
14077 				}
14078 				return;
14079 			}
14080 			ipif->ipif_solmulti_ilm = ilm;
14081 		}
14082 	} else {
14083 		in6_addr_t v6group;
14084 
14085 		if (ipif->ipif_lcl_addr == INADDR_ANY || IS_UNDER_IPMP(ill))
14086 			return;
14087 
14088 		/* Join the all hosts multicast address */
14089 		ip1dbg(("ipif_multicast_up - addmulti\n"));
14090 		IN6_IPADDR_TO_V4MAPPED(htonl(INADDR_ALLHOSTS_GROUP), &v6group);
14091 
14092 		ilm = ip_addmulti(&v6group, ill, ipif->ipif_zoneid, &err);
14093 		if (ilm == NULL) {
14094 			ASSERT(err != 0);
14095 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
14096 			return;
14097 		}
14098 		ipif->ipif_allhosts_ilm = ilm;
14099 	}
14100 }
14101 
14102 /*
14103  * Blow away any multicast groups that we joined in ipif_multicast_up().
14104  * (ilms from explicit memberships are handled in conn_update_ill.)
14105  */
14106 void
14107 ipif_multicast_down(ipif_t *ipif)
14108 {
14109 	ASSERT(IAM_WRITER_IPIF(ipif));
14110 
14111 	ip1dbg(("ipif_multicast_down\n"));
14112 
14113 	if (ipif->ipif_allhosts_ilm != NULL) {
14114 		(void) ip_delmulti(ipif->ipif_allhosts_ilm);
14115 		ipif->ipif_allhosts_ilm = NULL;
14116 	}
14117 	if (ipif->ipif_solmulti_ilm != NULL) {
14118 		(void) ip_delmulti(ipif->ipif_solmulti_ilm);
14119 		ipif->ipif_solmulti_ilm = NULL;
14120 	}
14121 }
14122 
14123 /*
14124  * Used when an interface comes up to recreate any extra routes on this
14125  * interface.
14126  */
14127 int
14128 ill_recover_saved_ire(ill_t *ill)
14129 {
14130 	mblk_t		*mp;
14131 	ip_stack_t	*ipst = ill->ill_ipst;
14132 
14133 	ip1dbg(("ill_recover_saved_ire(%s)", ill->ill_name));
14134 
14135 	mutex_enter(&ill->ill_saved_ire_lock);
14136 	for (mp = ill->ill_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
14137 		ire_t		*ire, *nire;
14138 		ifrt_t		*ifrt;
14139 
14140 		ifrt = (ifrt_t *)mp->b_rptr;
14141 		/*
14142 		 * Create a copy of the IRE with the saved address and netmask.
14143 		 */
14144 		if (ill->ill_isv6) {
14145 			ire = ire_create_v6(
14146 			    &ifrt->ifrt_v6addr,
14147 			    &ifrt->ifrt_v6mask,
14148 			    &ifrt->ifrt_v6gateway_addr,
14149 			    ifrt->ifrt_type,
14150 			    ill,
14151 			    ifrt->ifrt_zoneid,
14152 			    ifrt->ifrt_flags,
14153 			    NULL,
14154 			    ipst);
14155 		} else {
14156 			ire = ire_create(
14157 			    (uint8_t *)&ifrt->ifrt_addr,
14158 			    (uint8_t *)&ifrt->ifrt_mask,
14159 			    (uint8_t *)&ifrt->ifrt_gateway_addr,
14160 			    ifrt->ifrt_type,
14161 			    ill,
14162 			    ifrt->ifrt_zoneid,
14163 			    ifrt->ifrt_flags,
14164 			    NULL,
14165 			    ipst);
14166 		}
14167 		if (ire == NULL) {
14168 			mutex_exit(&ill->ill_saved_ire_lock);
14169 			return (ENOMEM);
14170 		}
14171 
14172 		if (ifrt->ifrt_flags & RTF_SETSRC) {
14173 			if (ill->ill_isv6) {
14174 				ire->ire_setsrc_addr_v6 =
14175 				    ifrt->ifrt_v6setsrc_addr;
14176 			} else {
14177 				ire->ire_setsrc_addr = ifrt->ifrt_setsrc_addr;
14178 			}
14179 		}
14180 
14181 		/*
14182 		 * Some software (for example, GateD and Sun Cluster) attempts
14183 		 * to create (what amount to) IRE_PREFIX routes with the
14184 		 * loopback address as the gateway.  This is primarily done to
14185 		 * set up prefixes with the RTF_REJECT flag set (for example,
14186 		 * when generating aggregate routes.)
14187 		 *
14188 		 * If the IRE type (as defined by ill->ill_net_type) is
14189 		 * IRE_LOOPBACK, then we map the request into a
14190 		 * IRE_IF_NORESOLVER.
14191 		 */
14192 		if (ill->ill_net_type == IRE_LOOPBACK)
14193 			ire->ire_type = IRE_IF_NORESOLVER;
14194 
14195 		/*
14196 		 * ire held by ire_add, will be refreled' towards the
14197 		 * the end of ipif_up_done
14198 		 */
14199 		nire = ire_add(ire);
14200 		/*
14201 		 * Check if it was a duplicate entry. This handles
14202 		 * the case of two racing route adds for the same route
14203 		 */
14204 		if (nire == NULL) {
14205 			ip1dbg(("ill_recover_saved_ire: FAILED\n"));
14206 		} else if (nire != ire) {
14207 			ip1dbg(("ill_recover_saved_ire: duplicate ire %p\n",
14208 			    (void *)nire));
14209 			ire_delete(nire);
14210 		} else {
14211 			ip1dbg(("ill_recover_saved_ire: added ire %p\n",
14212 			    (void *)nire));
14213 		}
14214 		if (nire != NULL)
14215 			ire_refrele(nire);
14216 	}
14217 	mutex_exit(&ill->ill_saved_ire_lock);
14218 	return (0);
14219 }
14220 
14221 /*
14222  * Used to set the netmask and broadcast address to default values when the
14223  * interface is brought up.  (Always called as writer.)
14224  */
14225 static void
14226 ipif_set_default(ipif_t *ipif)
14227 {
14228 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14229 
14230 	if (!ipif->ipif_isv6) {
14231 		/*
14232 		 * Interface holds an IPv4 address. Default
14233 		 * mask is the natural netmask.
14234 		 */
14235 		if (!ipif->ipif_net_mask) {
14236 			ipaddr_t	v4mask;
14237 
14238 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
14239 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
14240 		}
14241 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14242 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14243 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14244 		} else {
14245 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14246 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14247 		}
14248 		/*
14249 		 * NOTE: SunOS 4.X does this even if the broadcast address
14250 		 * has been already set thus we do the same here.
14251 		 */
14252 		if (ipif->ipif_flags & IPIF_BROADCAST) {
14253 			ipaddr_t	v4addr;
14254 
14255 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
14256 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
14257 		}
14258 	} else {
14259 		/*
14260 		 * Interface holds an IPv6-only address.  Default
14261 		 * mask is all-ones.
14262 		 */
14263 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
14264 			ipif->ipif_v6net_mask = ipv6_all_ones;
14265 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14266 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14267 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14268 		} else {
14269 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14270 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14271 		}
14272 	}
14273 }
14274 
14275 /*
14276  * Return 0 if this address can be used as local address without causing
14277  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
14278  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
14279  * Note that the same IPv6 link-local address is allowed as long as the ills
14280  * are not on the same link.
14281  */
14282 int
14283 ip_addr_availability_check(ipif_t *new_ipif)
14284 {
14285 	in6_addr_t our_v6addr;
14286 	ill_t *ill;
14287 	ipif_t *ipif;
14288 	ill_walk_context_t ctx;
14289 	ip_stack_t	*ipst = new_ipif->ipif_ill->ill_ipst;
14290 
14291 	ASSERT(IAM_WRITER_IPIF(new_ipif));
14292 	ASSERT(MUTEX_HELD(&ipst->ips_ip_addr_avail_lock));
14293 	ASSERT(RW_READ_HELD(&ipst->ips_ill_g_lock));
14294 
14295 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
14296 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
14297 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
14298 		return (0);
14299 
14300 	our_v6addr = new_ipif->ipif_v6lcl_addr;
14301 
14302 	if (new_ipif->ipif_isv6)
14303 		ill = ILL_START_WALK_V6(&ctx, ipst);
14304 	else
14305 		ill = ILL_START_WALK_V4(&ctx, ipst);
14306 
14307 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
14308 		for (ipif = ill->ill_ipif; ipif != NULL;
14309 		    ipif = ipif->ipif_next) {
14310 			if ((ipif == new_ipif) ||
14311 			    !(ipif->ipif_flags & IPIF_UP) ||
14312 			    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
14313 			    !IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
14314 			    &our_v6addr))
14315 				continue;
14316 
14317 			if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
14318 				new_ipif->ipif_flags |= IPIF_UNNUMBERED;
14319 			else if (ipif->ipif_flags & IPIF_POINTOPOINT)
14320 				ipif->ipif_flags |= IPIF_UNNUMBERED;
14321 			else if ((IN6_IS_ADDR_LINKLOCAL(&our_v6addr) ||
14322 			    IN6_IS_ADDR_SITELOCAL(&our_v6addr)) &&
14323 			    !IS_ON_SAME_LAN(ill, new_ipif->ipif_ill))
14324 				continue;
14325 			else if (new_ipif->ipif_zoneid != ipif->ipif_zoneid &&
14326 			    ipif->ipif_zoneid != ALL_ZONES && IS_LOOPBACK(ill))
14327 				continue;
14328 			else if (new_ipif->ipif_ill == ill)
14329 				return (EADDRINUSE);
14330 			else
14331 				return (EADDRNOTAVAIL);
14332 		}
14333 	}
14334 
14335 	return (0);
14336 }
14337 
14338 /*
14339  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
14340  * IREs for the ipif.
14341  * When the routine returns EINPROGRESS then mp has been consumed and
14342  * the ioctl will be acked from ip_rput_dlpi.
14343  */
14344 int
14345 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
14346 {
14347 	ill_t		*ill = ipif->ipif_ill;
14348 	boolean_t 	isv6 = ipif->ipif_isv6;
14349 	int		err = 0;
14350 	boolean_t	success;
14351 	uint_t		ipif_orig_id;
14352 	ip_stack_t	*ipst = ill->ill_ipst;
14353 
14354 	ASSERT(IAM_WRITER_IPIF(ipif));
14355 
14356 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
14357 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up",
14358 	    ill_t *, ill, ipif_t *, ipif);
14359 
14360 	/* Shouldn't get here if it is already up. */
14361 	if (ipif->ipif_flags & IPIF_UP)
14362 		return (EALREADY);
14363 
14364 	/*
14365 	 * If this is a request to bring up a data address on an interface
14366 	 * under IPMP, then move the address to its IPMP meta-interface and
14367 	 * try to bring it up.  One complication is that the zeroth ipif for
14368 	 * an ill is special, in that every ill always has one, and that code
14369 	 * throughout IP deferences ill->ill_ipif without holding any locks.
14370 	 */
14371 	if (IS_UNDER_IPMP(ill) && ipmp_ipif_is_dataaddr(ipif) &&
14372 	    (!ipif->ipif_isv6 || !V6_IPIF_LINKLOCAL(ipif))) {
14373 		ipif_t	*stubipif = NULL, *moveipif = NULL;
14374 		ill_t	*ipmp_ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
14375 
14376 		/*
14377 		 * The ipif being brought up should be quiesced.  If it's not,
14378 		 * something has gone amiss and we need to bail out.  (If it's
14379 		 * quiesced, we know it will remain so via IPIF_CONDEMNED.)
14380 		 */
14381 		mutex_enter(&ill->ill_lock);
14382 		if (!ipif_is_quiescent(ipif)) {
14383 			mutex_exit(&ill->ill_lock);
14384 			return (EINVAL);
14385 		}
14386 		mutex_exit(&ill->ill_lock);
14387 
14388 		/*
14389 		 * If we're going to need to allocate ipifs, do it prior
14390 		 * to starting the move (and grabbing locks).
14391 		 */
14392 		if (ipif->ipif_id == 0) {
14393 			if ((moveipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14394 			    B_FALSE, &err)) == NULL) {
14395 				return (err);
14396 			}
14397 			if ((stubipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14398 			    B_FALSE, &err)) == NULL) {
14399 				mi_free(moveipif);
14400 				return (err);
14401 			}
14402 		}
14403 
14404 		/*
14405 		 * Grab or transfer the ipif to move.  During the move, keep
14406 		 * ill_g_lock held to prevent any ill walker threads from
14407 		 * seeing things in an inconsistent state.
14408 		 */
14409 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
14410 		if (ipif->ipif_id != 0) {
14411 			ipif_remove(ipif);
14412 		} else {
14413 			ipif_transfer(ipif, moveipif, stubipif);
14414 			ipif = moveipif;
14415 		}
14416 
14417 		/*
14418 		 * Place the ipif on the IPMP ill.  If the zeroth ipif on
14419 		 * the IPMP ill is a stub (0.0.0.0 down address) then we
14420 		 * replace that one.  Otherwise, pick the next available slot.
14421 		 */
14422 		ipif->ipif_ill = ipmp_ill;
14423 		ipif_orig_id = ipif->ipif_id;
14424 
14425 		if (ipmp_ipif_is_stubaddr(ipmp_ill->ill_ipif)) {
14426 			ipif_transfer(ipif, ipmp_ill->ill_ipif, NULL);
14427 			ipif = ipmp_ill->ill_ipif;
14428 		} else {
14429 			ipif->ipif_id = -1;
14430 			if ((err = ipif_insert(ipif, B_FALSE)) != 0) {
14431 				/*
14432 				 * No more available ipif_id's -- put it back
14433 				 * on the original ill and fail the operation.
14434 				 * Since we're writer on the ill, we can be
14435 				 * sure our old slot is still available.
14436 				 */
14437 				ipif->ipif_id = ipif_orig_id;
14438 				ipif->ipif_ill = ill;
14439 				if (ipif_orig_id == 0) {
14440 					ipif_transfer(ipif, ill->ill_ipif,
14441 					    NULL);
14442 				} else {
14443 					VERIFY(ipif_insert(ipif, B_FALSE) == 0);
14444 				}
14445 				rw_exit(&ipst->ips_ill_g_lock);
14446 				return (err);
14447 			}
14448 		}
14449 		rw_exit(&ipst->ips_ill_g_lock);
14450 
14451 		/*
14452 		 * Tell SCTP that the ipif has moved.  Note that even if we
14453 		 * had to allocate a new ipif, the original sequence id was
14454 		 * preserved and therefore SCTP won't know.
14455 		 */
14456 		sctp_move_ipif(ipif, ill, ipmp_ill);
14457 
14458 		/*
14459 		 * If the ipif being brought up was on slot zero, then we
14460 		 * first need to bring up the placeholder we stuck there.  In
14461 		 * ip_rput_dlpi_writer(), arp_bringup_done(), or the recursive
14462 		 * call to ipif_up() itself, if we successfully bring up the
14463 		 * placeholder, we'll check ill_move_ipif and bring it up too.
14464 		 */
14465 		if (ipif_orig_id == 0) {
14466 			ASSERT(ill->ill_move_ipif == NULL);
14467 			ill->ill_move_ipif = ipif;
14468 			if ((err = ipif_up(ill->ill_ipif, q, mp)) == 0)
14469 				ASSERT(ill->ill_move_ipif == NULL);
14470 			if (err != EINPROGRESS)
14471 				ill->ill_move_ipif = NULL;
14472 			return (err);
14473 		}
14474 
14475 		/*
14476 		 * Bring it up on the IPMP ill.
14477 		 */
14478 		return (ipif_up(ipif, q, mp));
14479 	}
14480 
14481 	/* Skip arp/ndp for any loopback interface. */
14482 	if (ill->ill_wq != NULL) {
14483 		conn_t *connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14484 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
14485 
14486 		if (!ill->ill_dl_up) {
14487 			/*
14488 			 * ill_dl_up is not yet set. i.e. we are yet to
14489 			 * DL_BIND with the driver and this is the first
14490 			 * logical interface on the ill to become "up".
14491 			 * Tell the driver to get going (via DL_BIND_REQ).
14492 			 * Note that changing "significant" IFF_ flags
14493 			 * address/netmask etc cause a down/up dance, but
14494 			 * does not cause an unbind (DL_UNBIND) with the driver
14495 			 */
14496 			return (ill_dl_up(ill, ipif, mp, q));
14497 		}
14498 
14499 		/*
14500 		 * ipif_resolver_up may end up needeing to bind/attach
14501 		 * the ARP stream, which in turn necessitates a
14502 		 * DLPI message exchange with the driver. ioctls are
14503 		 * serialized and so we cannot send more than one
14504 		 * interface up message at a time. If ipif_resolver_up
14505 		 * does need to wait for the DLPI handshake for the ARP stream,
14506 		 * we get EINPROGRESS and we will complete in arp_bringup_done.
14507 		 */
14508 
14509 		ASSERT(connp != NULL || !CONN_Q(q));
14510 		if (connp != NULL)
14511 			mutex_enter(&connp->conn_lock);
14512 		mutex_enter(&ill->ill_lock);
14513 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14514 		mutex_exit(&ill->ill_lock);
14515 		if (connp != NULL)
14516 			mutex_exit(&connp->conn_lock);
14517 		if (!success)
14518 			return (EINTR);
14519 
14520 		/*
14521 		 * Crank up IPv6 neighbor discovery. Unlike ARP, this should
14522 		 * complete when ipif_ndp_up returns.
14523 		 */
14524 		err = ipif_resolver_up(ipif, Res_act_initial);
14525 		if (err == EINPROGRESS) {
14526 			/* We will complete it in arp_bringup_done() */
14527 			return (err);
14528 		}
14529 
14530 		if (isv6 && err == 0)
14531 			err = ipif_ndp_up(ipif, B_TRUE);
14532 
14533 		ASSERT(err != EINPROGRESS);
14534 		mp = ipsq_pending_mp_get(ipsq, &connp);
14535 		ASSERT(mp != NULL);
14536 		if (err != 0)
14537 			return (err);
14538 	} else {
14539 		/*
14540 		 * Interfaces without underlying hardware don't do duplicate
14541 		 * address detection.
14542 		 */
14543 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
14544 		ipif->ipif_addr_ready = 1;
14545 		err = ill_add_ires(ill);
14546 		/* allocation failure? */
14547 		if (err != 0)
14548 			return (err);
14549 	}
14550 
14551 	err = (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
14552 	if (err == 0 && ill->ill_move_ipif != NULL) {
14553 		ipif = ill->ill_move_ipif;
14554 		ill->ill_move_ipif = NULL;
14555 		return (ipif_up(ipif, q, mp));
14556 	}
14557 	return (err);
14558 }
14559 
14560 /*
14561  * Add any IREs tied to the ill. For now this is just an IRE_MULTICAST.
14562  * The identical set of IREs need to be removed in ill_delete_ires().
14563  */
14564 int
14565 ill_add_ires(ill_t *ill)
14566 {
14567 	ire_t	*ire;
14568 	in6_addr_t dummy6 = {(uint32_t)V6_MCAST, 0, 0, 1};
14569 	in_addr_t dummy4 = htonl(INADDR_ALLHOSTS_GROUP);
14570 
14571 	if (ill->ill_ire_multicast != NULL)
14572 		return (0);
14573 
14574 	/*
14575 	 * provide some dummy ire_addr for creating the ire.
14576 	 */
14577 	if (ill->ill_isv6) {
14578 		ire = ire_create_v6(&dummy6, 0, 0, IRE_MULTICAST, ill,
14579 		    ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14580 	} else {
14581 		ire = ire_create((uchar_t *)&dummy4, 0, 0, IRE_MULTICAST, ill,
14582 		    ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14583 	}
14584 	if (ire == NULL)
14585 		return (ENOMEM);
14586 
14587 	ill->ill_ire_multicast = ire;
14588 	return (0);
14589 }
14590 
14591 void
14592 ill_delete_ires(ill_t *ill)
14593 {
14594 	if (ill->ill_ire_multicast != NULL) {
14595 		/*
14596 		 * BIND/ATTACH completed; Release the ref for ill_ire_multicast
14597 		 * which was taken without any th_tracing enabled.
14598 		 * We also mark it as condemned (note that it was never added)
14599 		 * so that caching conn's can move off of it.
14600 		 */
14601 		ire_make_condemned(ill->ill_ire_multicast);
14602 		ire_refrele_notr(ill->ill_ire_multicast);
14603 		ill->ill_ire_multicast = NULL;
14604 	}
14605 }
14606 
14607 /*
14608  * Perform a bind for the physical device.
14609  * When the routine returns EINPROGRESS then mp has been consumed and
14610  * the ioctl will be acked from ip_rput_dlpi.
14611  * Allocate an unbind message and save it until ipif_down.
14612  */
14613 static int
14614 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
14615 {
14616 	mblk_t	*bind_mp = NULL;
14617 	mblk_t	*unbind_mp = NULL;
14618 	conn_t	*connp;
14619 	boolean_t success;
14620 	int	err;
14621 
14622 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_up", ill_t *, ill);
14623 
14624 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
14625 	ASSERT(IAM_WRITER_ILL(ill));
14626 	ASSERT(mp != NULL);
14627 
14628 	/*
14629 	 * Make sure we have an IRE_MULTICAST in case we immediately
14630 	 * start receiving packets.
14631 	 */
14632 	err = ill_add_ires(ill);
14633 	if (err != 0)
14634 		goto bad;
14635 
14636 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
14637 	    DL_BIND_REQ);
14638 	if (bind_mp == NULL)
14639 		goto bad;
14640 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
14641 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
14642 
14643 	/*
14644 	 * ill_unbind_mp would be non-null if the following sequence had
14645 	 * happened:
14646 	 * - send DL_BIND_REQ to driver, wait for response
14647 	 * - multiple ioctls that need to bring the ipif up are encountered,
14648 	 *   but they cannot enter the ipsq due to the outstanding DL_BIND_REQ.
14649 	 *   These ioctls will then be enqueued on the ipsq
14650 	 * - a DL_ERROR_ACK is returned for the DL_BIND_REQ
14651 	 * At this point, the pending ioctls in the ipsq will be drained, and
14652 	 * since ill->ill_dl_up was not set, ill_dl_up would be invoked with
14653 	 * a non-null ill->ill_unbind_mp
14654 	 */
14655 	if (ill->ill_unbind_mp == NULL) {
14656 		unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t),
14657 		    DL_UNBIND_REQ);
14658 		if (unbind_mp == NULL)
14659 			goto bad;
14660 	}
14661 	/*
14662 	 * Record state needed to complete this operation when the
14663 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
14664 	 */
14665 	connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14666 	ASSERT(connp != NULL || !CONN_Q(q));
14667 	GRAB_CONN_LOCK(q);
14668 	mutex_enter(&ipif->ipif_ill->ill_lock);
14669 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14670 	mutex_exit(&ipif->ipif_ill->ill_lock);
14671 	RELEASE_CONN_LOCK(q);
14672 	if (!success)
14673 		goto bad;
14674 
14675 	/*
14676 	 * Save the unbind message for ill_dl_down(); it will be consumed when
14677 	 * the interface goes down.
14678 	 */
14679 	if (ill->ill_unbind_mp == NULL)
14680 		ill->ill_unbind_mp = unbind_mp;
14681 
14682 	ill_dlpi_send(ill, bind_mp);
14683 	/* Send down link-layer capabilities probe if not already done. */
14684 	ill_capability_probe(ill);
14685 
14686 	/*
14687 	 * Sysid used to rely on the fact that netboots set domainname
14688 	 * and the like. Now that miniroot boots aren't strictly netboots
14689 	 * and miniroot network configuration is driven from userland
14690 	 * these things still need to be set. This situation can be detected
14691 	 * by comparing the interface being configured here to the one
14692 	 * dhcifname was set to reference by the boot loader. Once sysid is
14693 	 * converted to use dhcp_ipc_getinfo() this call can go away.
14694 	 */
14695 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) &&
14696 	    (strcmp(ill->ill_name, dhcifname) == 0) &&
14697 	    (strlen(srpc_domain) == 0)) {
14698 		if (dhcpinit() != 0)
14699 			cmn_err(CE_WARN, "no cached dhcp response");
14700 	}
14701 
14702 	/*
14703 	 * This operation will complete in ip_rput_dlpi with either
14704 	 * a DL_BIND_ACK or DL_ERROR_ACK.
14705 	 */
14706 	return (EINPROGRESS);
14707 bad:
14708 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
14709 
14710 	freemsg(bind_mp);
14711 	freemsg(unbind_mp);
14712 	return (ENOMEM);
14713 }
14714 
14715 /* Add room for tcp+ip headers */
14716 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
14717 
14718 /*
14719  * DLPI and ARP is up.
14720  * Create all the IREs associated with an interface. Bring up multicast.
14721  * Set the interface flag and finish other initialization
14722  * that potentially had to be deferred to after DL_BIND_ACK.
14723  */
14724 int
14725 ipif_up_done(ipif_t *ipif)
14726 {
14727 	ill_t		*ill = ipif->ipif_ill;
14728 	int		err = 0;
14729 	boolean_t	loopback = B_FALSE;
14730 	boolean_t	update_src_selection = B_TRUE;
14731 	ipif_t		*tmp_ipif;
14732 
14733 	ip1dbg(("ipif_up_done(%s:%u)\n",
14734 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
14735 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done",
14736 	    ill_t *, ill, ipif_t *, ipif);
14737 
14738 	/* Check if this is a loopback interface */
14739 	if (ipif->ipif_ill->ill_wq == NULL)
14740 		loopback = B_TRUE;
14741 
14742 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14743 
14744 	/*
14745 	 * If all other interfaces for this ill are down or DEPRECATED,
14746 	 * or otherwise unsuitable for source address selection,
14747 	 * reset the src generation numbers to make sure source
14748 	 * address selection gets to take this new ipif into account.
14749 	 * No need to hold ill_lock while traversing the ipif list since
14750 	 * we are writer
14751 	 */
14752 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
14753 	    tmp_ipif = tmp_ipif->ipif_next) {
14754 		if (((tmp_ipif->ipif_flags &
14755 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
14756 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
14757 		    (tmp_ipif == ipif))
14758 			continue;
14759 		/* first useable pre-existing interface */
14760 		update_src_selection = B_FALSE;
14761 		break;
14762 	}
14763 	if (update_src_selection)
14764 		ip_update_source_selection(ill->ill_ipst);
14765 
14766 	if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) {
14767 		nce_t *loop_nce = NULL;
14768 		uint16_t flags = (NCE_F_MYADDR | NCE_F_AUTHORITY | NCE_F_NONUD);
14769 
14770 		/*
14771 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
14772 		 * ipif_lookup_on_name(), but in the case of zones we can have
14773 		 * several loopback addresses on lo0. So all the interfaces with
14774 		 * loopback addresses need to be marked IRE_LOOPBACK.
14775 		 */
14776 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
14777 		    htonl(INADDR_LOOPBACK))
14778 			ipif->ipif_ire_type = IRE_LOOPBACK;
14779 		else
14780 			ipif->ipif_ire_type = IRE_LOCAL;
14781 		if (ill->ill_net_type != IRE_LOOPBACK)
14782 			flags |= NCE_F_PUBLISH;
14783 
14784 		/* add unicast nce for the local addr */
14785 		err = nce_lookup_then_add_v4(ill, NULL,
14786 		    ill->ill_phys_addr_length, &ipif->ipif_lcl_addr, flags,
14787 		    ND_REACHABLE, &loop_nce);
14788 		/* A shared-IP zone sees EEXIST for lo0:N */
14789 		if (err == 0 || err == EEXIST) {
14790 			ipif->ipif_added_nce = 1;
14791 			loop_nce->nce_ipif_cnt++;
14792 			nce_refrele(loop_nce);
14793 			err = 0;
14794 		} else {
14795 			ASSERT(loop_nce == NULL);
14796 			return (err);
14797 		}
14798 	}
14799 
14800 	/* Create all the IREs associated with this interface */
14801 	err = ipif_add_ires_v4(ipif, loopback);
14802 	if (err != 0) {
14803 		/*
14804 		 * see comments about return value from
14805 		 * ip_addr_availability_check() in ipif_add_ires_v4().
14806 		 */
14807 		if (err != EADDRINUSE) {
14808 			(void) ipif_arp_down(ipif);
14809 		} else {
14810 			/*
14811 			 * Make IPMP aware of the deleted ipif so that
14812 			 * the needed ipmp cleanup (e.g., of ipif_bound_ill)
14813 			 * can be completed. Note that we do not want to
14814 			 * destroy the nce that was created on the ipmp_ill
14815 			 * for the active copy of the duplicate address in
14816 			 * use.
14817 			 */
14818 			if (IS_IPMP(ill))
14819 				ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
14820 			err = EADDRNOTAVAIL;
14821 		}
14822 		return (err);
14823 	}
14824 
14825 	if (ill->ill_ipif_up_count == 1 && !loopback) {
14826 		/* Recover any additional IREs entries for this ill */
14827 		(void) ill_recover_saved_ire(ill);
14828 	}
14829 
14830 	if (ill->ill_need_recover_multicast) {
14831 		/*
14832 		 * Need to recover all multicast memberships in the driver.
14833 		 * This had to be deferred until we had attached.  The same
14834 		 * code exists in ipif_up_done_v6() to recover IPv6
14835 		 * memberships.
14836 		 *
14837 		 * Note that it would be preferable to unconditionally do the
14838 		 * ill_recover_multicast() in ill_dl_up(), but we cannot do
14839 		 * that since ill_join_allmulti() depends on ill_dl_up being
14840 		 * set, and it is not set until we receive a DL_BIND_ACK after
14841 		 * having called ill_dl_up().
14842 		 */
14843 		ill_recover_multicast(ill);
14844 	}
14845 
14846 	if (ill->ill_ipif_up_count == 1) {
14847 		/*
14848 		 * Since the interface is now up, it may now be active.
14849 		 */
14850 		if (IS_UNDER_IPMP(ill))
14851 			ipmp_ill_refresh_active(ill);
14852 
14853 		/*
14854 		 * If this is an IPMP interface, we may now be able to
14855 		 * establish ARP entries.
14856 		 */
14857 		if (IS_IPMP(ill))
14858 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
14859 	}
14860 
14861 	/* Join the allhosts multicast address */
14862 	ipif_multicast_up(ipif);
14863 
14864 	if (!loopback && !update_src_selection &&
14865 	    !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)))
14866 		ip_update_source_selection(ill->ill_ipst);
14867 
14868 	if (!loopback && ipif->ipif_addr_ready) {
14869 		/* Broadcast an address mask reply. */
14870 		ipif_mask_reply(ipif);
14871 	}
14872 	/* Perhaps ilgs should use this ill */
14873 	update_conn_ill(NULL, ill->ill_ipst);
14874 
14875 	/*
14876 	 * This had to be deferred until we had bound.  Tell routing sockets and
14877 	 * others that this interface is up if it looks like the address has
14878 	 * been validated.  Otherwise, if it isn't ready yet, wait for
14879 	 * duplicate address detection to do its thing.
14880 	 */
14881 	if (ipif->ipif_addr_ready)
14882 		ipif_up_notify(ipif);
14883 	return (0);
14884 }
14885 
14886 /*
14887  * Add the IREs associated with the ipif.
14888  * Those MUST be explicitly removed in ipif_delete_ires_v4.
14889  */
14890 static int
14891 ipif_add_ires_v4(ipif_t *ipif, boolean_t loopback)
14892 {
14893 	ill_t		*ill = ipif->ipif_ill;
14894 	ip_stack_t	*ipst = ill->ill_ipst;
14895 	ire_t		*ire_array[20];
14896 	ire_t		**irep = ire_array;
14897 	ire_t		**irep1;
14898 	ipaddr_t	net_mask = 0;
14899 	ipaddr_t	subnet_mask, route_mask;
14900 	int		err;
14901 	ire_t		*ire_local = NULL;	/* LOCAL or LOOPBACK */
14902 	ire_t		*ire_if = NULL;
14903 	uchar_t		*gw;
14904 
14905 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14906 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14907 		/*
14908 		 * If we're on a labeled system then make sure that zone-
14909 		 * private addresses have proper remote host database entries.
14910 		 */
14911 		if (is_system_labeled() &&
14912 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
14913 		    !tsol_check_interface_address(ipif))
14914 			return (EINVAL);
14915 
14916 		/* Register the source address for __sin6_src_id */
14917 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
14918 		    ipif->ipif_zoneid, ipst);
14919 		if (err != 0) {
14920 			ip0dbg(("ipif_add_ires: srcid_insert %d\n", err));
14921 			return (err);
14922 		}
14923 
14924 		if (loopback)
14925 			gw = (uchar_t *)&ipif->ipif_lcl_addr;
14926 		else
14927 			gw = NULL;
14928 
14929 		/* If the interface address is set, create the local IRE. */
14930 		ire_local = ire_create(
14931 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
14932 		    (uchar_t *)&ip_g_all_ones,		/* mask */
14933 		    gw,					/* gateway */
14934 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
14935 		    ipif->ipif_ill,
14936 		    ipif->ipif_zoneid,
14937 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
14938 		    RTF_PRIVATE : 0) | RTF_KERNEL,
14939 		    NULL,
14940 		    ipst);
14941 		ip1dbg(("ipif_add_ires: 0x%p creating IRE %p type 0x%x"
14942 		    " for 0x%x\n", (void *)ipif, (void *)ire_local,
14943 		    ipif->ipif_ire_type,
14944 		    ntohl(ipif->ipif_lcl_addr)));
14945 		if (ire_local == NULL) {
14946 			ip1dbg(("ipif_up_done: NULL ire_local\n"));
14947 			err = ENOMEM;
14948 			goto bad;
14949 		}
14950 	} else {
14951 		ip1dbg((
14952 		    "ipif_add_ires: not creating IRE %d for 0x%x: flags 0x%x\n",
14953 		    ipif->ipif_ire_type,
14954 		    ntohl(ipif->ipif_lcl_addr),
14955 		    (uint_t)ipif->ipif_flags));
14956 	}
14957 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14958 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14959 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14960 	} else {
14961 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
14962 	}
14963 
14964 	subnet_mask = ipif->ipif_net_mask;
14965 
14966 	/*
14967 	 * If mask was not specified, use natural netmask of
14968 	 * interface address. Also, store this mask back into the
14969 	 * ipif struct.
14970 	 */
14971 	if (subnet_mask == 0) {
14972 		subnet_mask = net_mask;
14973 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
14974 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
14975 		    ipif->ipif_v6subnet);
14976 	}
14977 
14978 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
14979 	if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
14980 	    ipif->ipif_subnet != INADDR_ANY) {
14981 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14982 
14983 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14984 			route_mask = IP_HOST_MASK;
14985 		} else {
14986 			route_mask = subnet_mask;
14987 		}
14988 
14989 		ip1dbg(("ipif_add_ires: ipif 0x%p ill 0x%p "
14990 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
14991 		    (void *)ipif, (void *)ill, ill->ill_net_type,
14992 		    ntohl(ipif->ipif_subnet)));
14993 		ire_if = ire_create(
14994 		    (uchar_t *)&ipif->ipif_subnet,
14995 		    (uchar_t *)&route_mask,
14996 		    (uchar_t *)&ipif->ipif_lcl_addr,
14997 		    ill->ill_net_type,
14998 		    ill,
14999 		    ipif->ipif_zoneid,
15000 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
15001 		    RTF_PRIVATE: 0) | RTF_KERNEL,
15002 		    NULL,
15003 		    ipst);
15004 		if (ire_if == NULL) {
15005 			ip1dbg(("ipif_up_done: NULL ire_if\n"));
15006 			err = ENOMEM;
15007 			goto bad;
15008 		}
15009 	}
15010 
15011 	/*
15012 	 * Create any necessary broadcast IREs.
15013 	 */
15014 	if ((ipif->ipif_flags & IPIF_BROADCAST) &&
15015 	    !(ipif->ipif_flags & IPIF_NOXMIT))
15016 		irep = ipif_create_bcast_ires(ipif, irep);
15017 
15018 	/* If an earlier ire_create failed, get out now */
15019 	for (irep1 = irep; irep1 > ire_array; ) {
15020 		irep1--;
15021 		if (*irep1 == NULL) {
15022 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
15023 			err = ENOMEM;
15024 			goto bad;
15025 		}
15026 	}
15027 
15028 	/*
15029 	 * Need to atomically check for IP address availability under
15030 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
15031 	 * ills or new ipifs can be added while we are checking availability.
15032 	 */
15033 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15034 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
15035 	/* Mark it up, and increment counters. */
15036 	ipif->ipif_flags |= IPIF_UP;
15037 	ill->ill_ipif_up_count++;
15038 	err = ip_addr_availability_check(ipif);
15039 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
15040 	rw_exit(&ipst->ips_ill_g_lock);
15041 
15042 	if (err != 0) {
15043 		/*
15044 		 * Our address may already be up on the same ill. In this case,
15045 		 * the ARP entry for our ipif replaced the one for the other
15046 		 * ipif. So we don't want to delete it (otherwise the other ipif
15047 		 * would be unable to send packets).
15048 		 * ip_addr_availability_check() identifies this case for us and
15049 		 * returns EADDRINUSE; Caller should turn it into EADDRNOTAVAIL
15050 		 * which is the expected error code.
15051 		 */
15052 		ill->ill_ipif_up_count--;
15053 		ipif->ipif_flags &= ~IPIF_UP;
15054 		goto bad;
15055 	}
15056 
15057 	/*
15058 	 * Add in all newly created IREs.  ire_create_bcast() has
15059 	 * already checked for duplicates of the IRE_BROADCAST type.
15060 	 * We add the IRE_INTERFACE before the IRE_LOCAL to ensure
15061 	 * that lookups find the IRE_LOCAL even if the IRE_INTERFACE is
15062 	 * a /32 route.
15063 	 */
15064 	if (ire_if != NULL) {
15065 		ire_if = ire_add(ire_if);
15066 		if (ire_if == NULL) {
15067 			err = ENOMEM;
15068 			goto bad2;
15069 		}
15070 #ifdef DEBUG
15071 		ire_refhold_notr(ire_if);
15072 		ire_refrele(ire_if);
15073 #endif
15074 	}
15075 	if (ire_local != NULL) {
15076 		ire_local = ire_add(ire_local);
15077 		if (ire_local == NULL) {
15078 			err = ENOMEM;
15079 			goto bad2;
15080 		}
15081 #ifdef DEBUG
15082 		ire_refhold_notr(ire_local);
15083 		ire_refrele(ire_local);
15084 #endif
15085 	}
15086 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15087 	if (ire_local != NULL)
15088 		ipif->ipif_ire_local = ire_local;
15089 	if (ire_if != NULL)
15090 		ipif->ipif_ire_if = ire_if;
15091 	rw_exit(&ipst->ips_ill_g_lock);
15092 	ire_local = NULL;
15093 	ire_if = NULL;
15094 
15095 	/*
15096 	 * We first add all of them, and if that succeeds we refrele the
15097 	 * bunch. That enables us to delete all of them should any of the
15098 	 * ire_adds fail.
15099 	 */
15100 	for (irep1 = irep; irep1 > ire_array; ) {
15101 		irep1--;
15102 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ill->ill_lock)));
15103 		*irep1 = ire_add(*irep1);
15104 		if (*irep1 == NULL) {
15105 			err = ENOMEM;
15106 			goto bad2;
15107 		}
15108 	}
15109 
15110 	for (irep1 = irep; irep1 > ire_array; ) {
15111 		irep1--;
15112 		/* refheld by ire_add. */
15113 		if (*irep1 != NULL) {
15114 			ire_refrele(*irep1);
15115 			*irep1 = NULL;
15116 		}
15117 	}
15118 
15119 	if (!loopback) {
15120 		/*
15121 		 * If the broadcast address has been set, make sure it makes
15122 		 * sense based on the interface address.
15123 		 * Only match on ill since we are sharing broadcast addresses.
15124 		 */
15125 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
15126 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
15127 			ire_t	*ire;
15128 
15129 			ire = ire_ftable_lookup_v4(ipif->ipif_brd_addr, 0, 0,
15130 			    IRE_BROADCAST, ipif->ipif_ill, ALL_ZONES, NULL,
15131 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL), 0, ipst, NULL);
15132 
15133 			if (ire == NULL) {
15134 				/*
15135 				 * If there isn't a matching broadcast IRE,
15136 				 * revert to the default for this netmask.
15137 				 */
15138 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
15139 				mutex_enter(&ipif->ipif_ill->ill_lock);
15140 				ipif_set_default(ipif);
15141 				mutex_exit(&ipif->ipif_ill->ill_lock);
15142 			} else {
15143 				ire_refrele(ire);
15144 			}
15145 		}
15146 
15147 	}
15148 	return (0);
15149 
15150 bad2:
15151 	ill->ill_ipif_up_count--;
15152 	ipif->ipif_flags &= ~IPIF_UP;
15153 
15154 bad:
15155 	ip1dbg(("ipif_add_ires: FAILED \n"));
15156 	if (ire_local != NULL)
15157 		ire_delete(ire_local);
15158 	if (ire_if != NULL)
15159 		ire_delete(ire_if);
15160 
15161 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15162 	ire_local = ipif->ipif_ire_local;
15163 	ipif->ipif_ire_local = NULL;
15164 	ire_if = ipif->ipif_ire_if;
15165 	ipif->ipif_ire_if = NULL;
15166 	rw_exit(&ipst->ips_ill_g_lock);
15167 	if (ire_local != NULL) {
15168 		ire_delete(ire_local);
15169 		ire_refrele_notr(ire_local);
15170 	}
15171 	if (ire_if != NULL) {
15172 		ire_delete(ire_if);
15173 		ire_refrele_notr(ire_if);
15174 	}
15175 
15176 	while (irep > ire_array) {
15177 		irep--;
15178 		if (*irep != NULL) {
15179 			ire_delete(*irep);
15180 		}
15181 	}
15182 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
15183 
15184 	return (err);
15185 }
15186 
15187 /* Remove all the IREs created by ipif_add_ires_v4 */
15188 void
15189 ipif_delete_ires_v4(ipif_t *ipif)
15190 {
15191 	ill_t		*ill = ipif->ipif_ill;
15192 	ip_stack_t	*ipst = ill->ill_ipst;
15193 	ire_t		*ire;
15194 
15195 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15196 	ire = ipif->ipif_ire_local;
15197 	ipif->ipif_ire_local = NULL;
15198 	rw_exit(&ipst->ips_ill_g_lock);
15199 	if (ire != NULL) {
15200 		/*
15201 		 * Move count to ipif so we don't loose the count due to
15202 		 * a down/up dance.
15203 		 */
15204 		atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count);
15205 
15206 		ire_delete(ire);
15207 		ire_refrele_notr(ire);
15208 	}
15209 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15210 	ire = ipif->ipif_ire_if;
15211 	ipif->ipif_ire_if = NULL;
15212 	rw_exit(&ipst->ips_ill_g_lock);
15213 	if (ire != NULL) {
15214 		ire_delete(ire);
15215 		ire_refrele_notr(ire);
15216 	}
15217 
15218 	/*
15219 	 * Delete the broadcast IREs.
15220 	 */
15221 	if ((ipif->ipif_flags & IPIF_BROADCAST) &&
15222 	    !(ipif->ipif_flags & IPIF_NOXMIT))
15223 		ipif_delete_bcast_ires(ipif);
15224 }
15225 
15226 /*
15227  * Checks for availbility of a usable source address (if there is one) when the
15228  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
15229  * this selection is done regardless of the destination.
15230  */
15231 boolean_t
15232 ipif_zone_avail(uint_t ifindex, boolean_t isv6, zoneid_t zoneid,
15233     ip_stack_t *ipst)
15234 {
15235 	ipif_t		*ipif = NULL;
15236 	ill_t		*uill;
15237 
15238 	ASSERT(ifindex != 0);
15239 
15240 	uill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
15241 	if (uill == NULL)
15242 		return (B_FALSE);
15243 
15244 	mutex_enter(&uill->ill_lock);
15245 	for (ipif = uill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15246 		if (IPIF_IS_CONDEMNED(ipif))
15247 			continue;
15248 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15249 			continue;
15250 		if (!(ipif->ipif_flags & IPIF_UP))
15251 			continue;
15252 		if (ipif->ipif_zoneid != zoneid)
15253 			continue;
15254 		if (isv6 ? IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15255 		    ipif->ipif_lcl_addr == INADDR_ANY)
15256 			continue;
15257 		mutex_exit(&uill->ill_lock);
15258 		ill_refrele(uill);
15259 		return (B_TRUE);
15260 	}
15261 	mutex_exit(&uill->ill_lock);
15262 	ill_refrele(uill);
15263 	return (B_FALSE);
15264 }
15265 
15266 /*
15267  * Find an ipif with a good local address on the ill+zoneid.
15268  */
15269 ipif_t *
15270 ipif_good_addr(ill_t *ill, zoneid_t zoneid)
15271 {
15272 	ipif_t		*ipif;
15273 
15274 	mutex_enter(&ill->ill_lock);
15275 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15276 		if (IPIF_IS_CONDEMNED(ipif))
15277 			continue;
15278 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15279 			continue;
15280 		if (!(ipif->ipif_flags & IPIF_UP))
15281 			continue;
15282 		if (ipif->ipif_zoneid != zoneid &&
15283 		    ipif->ipif_zoneid != ALL_ZONES && zoneid != ALL_ZONES)
15284 			continue;
15285 		if (ill->ill_isv6 ?
15286 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15287 		    ipif->ipif_lcl_addr == INADDR_ANY)
15288 			continue;
15289 		ipif_refhold_locked(ipif);
15290 		mutex_exit(&ill->ill_lock);
15291 		return (ipif);
15292 	}
15293 	mutex_exit(&ill->ill_lock);
15294 	return (NULL);
15295 }
15296 
15297 /*
15298  * IP source address type, sorted from worst to best.  For a given type,
15299  * always prefer IP addresses on the same subnet.  All-zones addresses are
15300  * suboptimal because they pose problems with unlabeled destinations.
15301  */
15302 typedef enum {
15303 	IPIF_NONE,
15304 	IPIF_DIFFNET_DEPRECATED, 	/* deprecated and different subnet */
15305 	IPIF_SAMENET_DEPRECATED, 	/* deprecated and same subnet */
15306 	IPIF_DIFFNET_ALLZONES,		/* allzones and different subnet */
15307 	IPIF_SAMENET_ALLZONES,		/* allzones and same subnet */
15308 	IPIF_DIFFNET,			/* normal and different subnet */
15309 	IPIF_SAMENET,			/* normal and same subnet */
15310 	IPIF_LOCALADDR			/* local loopback */
15311 } ipif_type_t;
15312 
15313 /*
15314  * Pick the optimal ipif on `ill' for sending to destination `dst' from zone
15315  * `zoneid'.  We rate usable ipifs from low -> high as per the ipif_type_t
15316  * enumeration, and return the highest-rated ipif.  If there's a tie, we pick
15317  * the first one, unless IPMP is used in which case we round-robin among them;
15318  * see below for more.
15319  *
15320  * Returns NULL if there is no suitable source address for the ill.
15321  * This only occurs when there is no valid source address for the ill.
15322  */
15323 ipif_t *
15324 ipif_select_source_v4(ill_t *ill, ipaddr_t dst, zoneid_t zoneid,
15325     boolean_t allow_usesrc, boolean_t *notreadyp)
15326 {
15327 	ill_t	*usill = NULL;
15328 	ill_t	*ipmp_ill = NULL;
15329 	ipif_t	*start_ipif, *next_ipif, *ipif, *best_ipif;
15330 	ipif_type_t type, best_type;
15331 	tsol_tpc_t *src_rhtp, *dst_rhtp;
15332 	ip_stack_t *ipst = ill->ill_ipst;
15333 	boolean_t samenet;
15334 
15335 	if (ill->ill_usesrc_ifindex != 0 && allow_usesrc) {
15336 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex,
15337 		    B_FALSE, ipst);
15338 		if (usill != NULL)
15339 			ill = usill;	/* Select source from usesrc ILL */
15340 		else
15341 			return (NULL);
15342 	}
15343 
15344 	/*
15345 	 * Test addresses should never be used for source address selection,
15346 	 * so if we were passed one, switch to the IPMP meta-interface.
15347 	 */
15348 	if (IS_UNDER_IPMP(ill)) {
15349 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL)
15350 			ill = ipmp_ill;	/* Select source from IPMP ill */
15351 		else
15352 			return (NULL);
15353 	}
15354 
15355 	/*
15356 	 * If we're dealing with an unlabeled destination on a labeled system,
15357 	 * make sure that we ignore source addresses that are incompatible with
15358 	 * the destination's default label.  That destination's default label
15359 	 * must dominate the minimum label on the source address.
15360 	 */
15361 	dst_rhtp = NULL;
15362 	if (is_system_labeled()) {
15363 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
15364 		if (dst_rhtp == NULL)
15365 			return (NULL);
15366 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
15367 			TPC_RELE(dst_rhtp);
15368 			dst_rhtp = NULL;
15369 		}
15370 	}
15371 
15372 	/*
15373 	 * Hold the ill_g_lock as reader. This makes sure that no ipif/ill
15374 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
15375 	 * After selecting the right ipif, under ill_lock make sure ipif is
15376 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
15377 	 * we retry. Inside the loop we still need to check for CONDEMNED,
15378 	 * but not under a lock.
15379 	 */
15380 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15381 retry:
15382 	/*
15383 	 * For source address selection, we treat the ipif list as circular
15384 	 * and continue until we get back to where we started.  This allows
15385 	 * IPMP to vary source address selection (which improves inbound load
15386 	 * spreading) by caching its last ending point and starting from
15387 	 * there.  NOTE: we don't have to worry about ill_src_ipif changing
15388 	 * ills since that can't happen on the IPMP ill.
15389 	 */
15390 	start_ipif = ill->ill_ipif;
15391 	if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
15392 		start_ipif = ill->ill_src_ipif;
15393 
15394 	ipif = start_ipif;
15395 	best_ipif = NULL;
15396 	best_type = IPIF_NONE;
15397 	do {
15398 		if ((next_ipif = ipif->ipif_next) == NULL)
15399 			next_ipif = ill->ill_ipif;
15400 
15401 		if (IPIF_IS_CONDEMNED(ipif))
15402 			continue;
15403 		/* Always skip NOLOCAL and ANYCAST interfaces */
15404 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15405 			continue;
15406 		/* Always skip NOACCEPT interfaces */
15407 		if (ipif->ipif_ill->ill_flags & ILLF_NOACCEPT)
15408 			continue;
15409 		if (!(ipif->ipif_flags & IPIF_UP))
15410 			continue;
15411 
15412 		if (!ipif->ipif_addr_ready) {
15413 			if (notreadyp != NULL)
15414 				*notreadyp = B_TRUE;
15415 			continue;
15416 		}
15417 
15418 		if (zoneid != ALL_ZONES &&
15419 		    ipif->ipif_zoneid != zoneid &&
15420 		    ipif->ipif_zoneid != ALL_ZONES)
15421 			continue;
15422 
15423 		/*
15424 		 * Interfaces with 0.0.0.0 address are allowed to be UP, but
15425 		 * are not valid as source addresses.
15426 		 */
15427 		if (ipif->ipif_lcl_addr == INADDR_ANY)
15428 			continue;
15429 
15430 		/*
15431 		 * Check compatibility of local address for destination's
15432 		 * default label if we're on a labeled system.	Incompatible
15433 		 * addresses can't be used at all.
15434 		 */
15435 		if (dst_rhtp != NULL) {
15436 			boolean_t incompat;
15437 
15438 			src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
15439 			    IPV4_VERSION, B_FALSE);
15440 			if (src_rhtp == NULL)
15441 				continue;
15442 			incompat = src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
15443 			    src_rhtp->tpc_tp.tp_doi !=
15444 			    dst_rhtp->tpc_tp.tp_doi ||
15445 			    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
15446 			    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
15447 			    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
15448 			    src_rhtp->tpc_tp.tp_sl_set_cipso));
15449 			TPC_RELE(src_rhtp);
15450 			if (incompat)
15451 				continue;
15452 		}
15453 
15454 		samenet = ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet);
15455 
15456 		if (ipif->ipif_lcl_addr == dst) {
15457 			type = IPIF_LOCALADDR;
15458 		} else if (ipif->ipif_flags & IPIF_DEPRECATED) {
15459 			type = samenet ? IPIF_SAMENET_DEPRECATED :
15460 			    IPIF_DIFFNET_DEPRECATED;
15461 		} else if (ipif->ipif_zoneid == ALL_ZONES) {
15462 			type = samenet ? IPIF_SAMENET_ALLZONES :
15463 			    IPIF_DIFFNET_ALLZONES;
15464 		} else {
15465 			type = samenet ? IPIF_SAMENET : IPIF_DIFFNET;
15466 		}
15467 
15468 		if (type > best_type) {
15469 			best_type = type;
15470 			best_ipif = ipif;
15471 			if (best_type == IPIF_LOCALADDR)
15472 				break; /* can't get better */
15473 		}
15474 	} while ((ipif = next_ipif) != start_ipif);
15475 
15476 	if ((ipif = best_ipif) != NULL) {
15477 		mutex_enter(&ipif->ipif_ill->ill_lock);
15478 		if (IPIF_IS_CONDEMNED(ipif)) {
15479 			mutex_exit(&ipif->ipif_ill->ill_lock);
15480 			goto retry;
15481 		}
15482 		ipif_refhold_locked(ipif);
15483 
15484 		/*
15485 		 * For IPMP, update the source ipif rotor to the next ipif,
15486 		 * provided we can look it up.  (We must not use it if it's
15487 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
15488 		 * ipif_free() checked ill_src_ipif.)
15489 		 */
15490 		if (IS_IPMP(ill) && ipif != NULL) {
15491 			next_ipif = ipif->ipif_next;
15492 			if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif))
15493 				ill->ill_src_ipif = next_ipif;
15494 			else
15495 				ill->ill_src_ipif = NULL;
15496 		}
15497 		mutex_exit(&ipif->ipif_ill->ill_lock);
15498 	}
15499 
15500 	rw_exit(&ipst->ips_ill_g_lock);
15501 	if (usill != NULL)
15502 		ill_refrele(usill);
15503 	if (ipmp_ill != NULL)
15504 		ill_refrele(ipmp_ill);
15505 	if (dst_rhtp != NULL)
15506 		TPC_RELE(dst_rhtp);
15507 
15508 #ifdef DEBUG
15509 	if (ipif == NULL) {
15510 		char buf1[INET6_ADDRSTRLEN];
15511 
15512 		ip1dbg(("ipif_select_source_v4(%s, %s) -> NULL\n",
15513 		    ill->ill_name,
15514 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
15515 	} else {
15516 		char buf1[INET6_ADDRSTRLEN];
15517 		char buf2[INET6_ADDRSTRLEN];
15518 
15519 		ip1dbg(("ipif_select_source_v4(%s, %s) -> %s\n",
15520 		    ipif->ipif_ill->ill_name,
15521 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
15522 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
15523 		    buf2, sizeof (buf2))));
15524 	}
15525 #endif /* DEBUG */
15526 	return (ipif);
15527 }
15528 
15529 /*
15530  * Pick a source address based on the destination ill and an optional setsrc
15531  * address.
15532  * The result is stored in srcp. If generation is set, then put the source
15533  * generation number there before we look for the source address (to avoid
15534  * missing changes in the set of source addresses.
15535  * If flagsp is set, then us it to pass back ipif_flags.
15536  *
15537  * If the caller wants to cache the returned source address and detect when
15538  * that might be stale, the caller should pass in a generation argument,
15539  * which the caller can later compare against ips_src_generation
15540  *
15541  * The precedence order for selecting an IPv4 source address is:
15542  *  - RTF_SETSRC on the offlink ire always wins.
15543  *  - If usrsrc is set, swap the ill to be the usesrc one.
15544  *  - If IPMP is used on the ill, select a random address from the most
15545  *    preferred ones below:
15546  * 1. If onlink destination, same subnet and not deprecated, not ALL_ZONES
15547  * 2. Not deprecated, not ALL_ZONES
15548  * 3. If onlink destination, same subnet and not deprecated, ALL_ZONES
15549  * 4. Not deprecated, ALL_ZONES
15550  * 5. If onlink destination, same subnet and deprecated
15551  * 6. Deprecated.
15552  *
15553  * We have lower preference for ALL_ZONES IP addresses,
15554  * as they pose problems with unlabeled destinations.
15555  *
15556  * Note that when multiple IP addresses match e.g., #1 we pick
15557  * the first one if IPMP is not in use. With IPMP we randomize.
15558  */
15559 int
15560 ip_select_source_v4(ill_t *ill, ipaddr_t setsrc, ipaddr_t dst,
15561     ipaddr_t multicast_ifaddr,
15562     zoneid_t zoneid, ip_stack_t *ipst, ipaddr_t *srcp,
15563     uint32_t *generation, uint64_t *flagsp)
15564 {
15565 	ipif_t *ipif;
15566 	boolean_t notready = B_FALSE;	/* Set if !ipif_addr_ready found */
15567 
15568 	if (flagsp != NULL)
15569 		*flagsp = 0;
15570 
15571 	/*
15572 	 * Need to grab the generation number before we check to
15573 	 * avoid a race with a change to the set of local addresses.
15574 	 * No lock needed since the thread which updates the set of local
15575 	 * addresses use ipif/ill locks and exit those (hence a store memory
15576 	 * barrier) before doing the atomic increase of ips_src_generation.
15577 	 */
15578 	if (generation != NULL) {
15579 		*generation = ipst->ips_src_generation;
15580 	}
15581 
15582 	if (CLASSD(dst) && multicast_ifaddr != INADDR_ANY) {
15583 		*srcp = multicast_ifaddr;
15584 		return (0);
15585 	}
15586 
15587 	/* Was RTF_SETSRC set on the first IRE in the recursive lookup? */
15588 	if (setsrc != INADDR_ANY) {
15589 		*srcp = setsrc;
15590 		return (0);
15591 	}
15592 	ipif = ipif_select_source_v4(ill, dst, zoneid, B_TRUE, &notready);
15593 	if (ipif == NULL) {
15594 		if (notready)
15595 			return (ENETDOWN);
15596 		else
15597 			return (EADDRNOTAVAIL);
15598 	}
15599 	*srcp = ipif->ipif_lcl_addr;
15600 	if (flagsp != NULL)
15601 		*flagsp = ipif->ipif_flags;
15602 	ipif_refrele(ipif);
15603 	return (0);
15604 }
15605 
15606 /* ARGSUSED */
15607 int
15608 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15609 	ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15610 {
15611 	/*
15612 	 * ill_phyint_reinit merged the v4 and v6 into a single
15613 	 * ipsq.  We might not have been able to complete the
15614 	 * operation in ipif_set_values, if we could not become
15615 	 * exclusive.  If so restart it here.
15616 	 */
15617 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15618 }
15619 
15620 /*
15621  * Can operate on either a module or a driver queue.
15622  * Returns an error if not a module queue.
15623  */
15624 /* ARGSUSED */
15625 int
15626 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15627     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15628 {
15629 	queue_t		*q1 = q;
15630 	char 		*cp;
15631 	char		interf_name[LIFNAMSIZ];
15632 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
15633 
15634 	if (q->q_next == NULL) {
15635 		ip1dbg((
15636 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
15637 		return (EINVAL);
15638 	}
15639 
15640 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
15641 		return (EALREADY);
15642 
15643 	do {
15644 		q1 = q1->q_next;
15645 	} while (q1->q_next);
15646 	cp = q1->q_qinfo->qi_minfo->mi_idname;
15647 	(void) sprintf(interf_name, "%s%d", cp, ppa);
15648 
15649 	/*
15650 	 * Here we are not going to delay the ioack until after
15651 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
15652 	 * original ioctl message before sending the requests.
15653 	 */
15654 	return (ipif_set_values(q, mp, interf_name, &ppa));
15655 }
15656 
15657 /* ARGSUSED */
15658 int
15659 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15660     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15661 {
15662 	return (ENXIO);
15663 }
15664 
15665 /*
15666  * Create any IRE_BROADCAST entries for `ipif', and store those entries in
15667  * `irep'.  Returns a pointer to the next free `irep' entry
15668  * A mirror exists in ipif_delete_bcast_ires().
15669  *
15670  * The management of any "extra" or seemingly duplicate IRE_BROADCASTs is
15671  * done in ire_add.
15672  */
15673 static ire_t **
15674 ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep)
15675 {
15676 	ipaddr_t addr;
15677 	ipaddr_t netmask = ip_net_mask(ipif->ipif_lcl_addr);
15678 	ipaddr_t subnetmask = ipif->ipif_net_mask;
15679 	ill_t *ill = ipif->ipif_ill;
15680 	zoneid_t zoneid = ipif->ipif_zoneid;
15681 
15682 	ip1dbg(("ipif_create_bcast_ires: creating broadcast IREs\n"));
15683 
15684 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15685 	ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15686 
15687 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
15688 	    (ipif->ipif_flags & IPIF_NOLOCAL))
15689 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
15690 
15691 	irep = ire_create_bcast(ill, 0, zoneid, irep);
15692 	irep = ire_create_bcast(ill, INADDR_BROADCAST, zoneid, irep);
15693 
15694 	/*
15695 	 * For backward compatibility, we create net broadcast IREs based on
15696 	 * the old "IP address class system", since some old machines only
15697 	 * respond to these class derived net broadcast.  However, we must not
15698 	 * create these net broadcast IREs if the subnetmask is shorter than
15699 	 * the IP address class based derived netmask.  Otherwise, we may
15700 	 * create a net broadcast address which is the same as an IP address
15701 	 * on the subnet -- and then TCP will refuse to talk to that address.
15702 	 */
15703 	if (netmask < subnetmask) {
15704 		addr = netmask & ipif->ipif_subnet;
15705 		irep = ire_create_bcast(ill, addr, zoneid, irep);
15706 		irep = ire_create_bcast(ill, ~netmask | addr, zoneid, irep);
15707 	}
15708 
15709 	/*
15710 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15711 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15712 	 * created.  Creating these broadcast IREs will only create confusion
15713 	 * as `addr' will be the same as the IP address.
15714 	 */
15715 	if (subnetmask != 0xFFFFFFFF) {
15716 		addr = ipif->ipif_subnet;
15717 		irep = ire_create_bcast(ill, addr, zoneid, irep);
15718 		irep = ire_create_bcast(ill, ~subnetmask | addr, zoneid, irep);
15719 	}
15720 
15721 	return (irep);
15722 }
15723 
15724 /*
15725  * Mirror of ipif_create_bcast_ires()
15726  */
15727 static void
15728 ipif_delete_bcast_ires(ipif_t *ipif)
15729 {
15730 	ipaddr_t	addr;
15731 	ipaddr_t	netmask = ip_net_mask(ipif->ipif_lcl_addr);
15732 	ipaddr_t	subnetmask = ipif->ipif_net_mask;
15733 	ill_t		*ill = ipif->ipif_ill;
15734 	zoneid_t	zoneid = ipif->ipif_zoneid;
15735 	ire_t		*ire;
15736 
15737 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15738 	ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15739 
15740 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
15741 	    (ipif->ipif_flags & IPIF_NOLOCAL))
15742 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
15743 
15744 	ire = ire_lookup_bcast(ill, 0, zoneid);
15745 	ASSERT(ire != NULL);
15746 	ire_delete(ire); ire_refrele(ire);
15747 	ire = ire_lookup_bcast(ill, INADDR_BROADCAST, zoneid);
15748 	ASSERT(ire != NULL);
15749 	ire_delete(ire); ire_refrele(ire);
15750 
15751 	/*
15752 	 * For backward compatibility, we create net broadcast IREs based on
15753 	 * the old "IP address class system", since some old machines only
15754 	 * respond to these class derived net broadcast.  However, we must not
15755 	 * create these net broadcast IREs if the subnetmask is shorter than
15756 	 * the IP address class based derived netmask.  Otherwise, we may
15757 	 * create a net broadcast address which is the same as an IP address
15758 	 * on the subnet -- and then TCP will refuse to talk to that address.
15759 	 */
15760 	if (netmask < subnetmask) {
15761 		addr = netmask & ipif->ipif_subnet;
15762 		ire = ire_lookup_bcast(ill, addr, zoneid);
15763 		ASSERT(ire != NULL);
15764 		ire_delete(ire); ire_refrele(ire);
15765 		ire = ire_lookup_bcast(ill, ~netmask | addr, zoneid);
15766 		ASSERT(ire != NULL);
15767 		ire_delete(ire); ire_refrele(ire);
15768 	}
15769 
15770 	/*
15771 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15772 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15773 	 * created.  Creating these broadcast IREs will only create confusion
15774 	 * as `addr' will be the same as the IP address.
15775 	 */
15776 	if (subnetmask != 0xFFFFFFFF) {
15777 		addr = ipif->ipif_subnet;
15778 		ire = ire_lookup_bcast(ill, addr, zoneid);
15779 		ASSERT(ire != NULL);
15780 		ire_delete(ire); ire_refrele(ire);
15781 		ire = ire_lookup_bcast(ill, ~subnetmask | addr, zoneid);
15782 		ASSERT(ire != NULL);
15783 		ire_delete(ire); ire_refrele(ire);
15784 	}
15785 }
15786 
15787 /*
15788  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
15789  * from lifr_flags and the name from lifr_name.
15790  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
15791  * since ipif_lookup_on_name uses the _isv6 flags when matching.
15792  * Returns EINPROGRESS when mp has been consumed by queueing it on
15793  * ipx_pending_mp and the ioctl will complete in ip_rput.
15794  *
15795  * Can operate on either a module or a driver queue.
15796  * Returns an error if not a module queue.
15797  */
15798 /* ARGSUSED */
15799 int
15800 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15801     ip_ioctl_cmd_t *ipip, void *if_req)
15802 {
15803 	ill_t	*ill = q->q_ptr;
15804 	phyint_t *phyi;
15805 	ip_stack_t *ipst;
15806 	struct lifreq *lifr = if_req;
15807 	uint64_t new_flags;
15808 
15809 	ASSERT(ipif != NULL);
15810 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
15811 
15812 	if (q->q_next == NULL) {
15813 		ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: no q_next\n"));
15814 		return (EINVAL);
15815 	}
15816 
15817 	/*
15818 	 * If we are not writer on 'q' then this interface exists already
15819 	 * and previous lookups (ip_extract_lifreq()) found this ipif --
15820 	 * so return EALREADY.
15821 	 */
15822 	if (ill != ipif->ipif_ill)
15823 		return (EALREADY);
15824 
15825 	if (ill->ill_name[0] != '\0')
15826 		return (EALREADY);
15827 
15828 	/*
15829 	 * If there's another ill already with the requested name, ensure
15830 	 * that it's of the same type.  Otherwise, ill_phyint_reinit() will
15831 	 * fuse together two unrelated ills, which will cause chaos.
15832 	 */
15833 	ipst = ill->ill_ipst;
15834 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
15835 	    lifr->lifr_name, NULL);
15836 	if (phyi != NULL) {
15837 		ill_t *ill_mate = phyi->phyint_illv4;
15838 
15839 		if (ill_mate == NULL)
15840 			ill_mate = phyi->phyint_illv6;
15841 		ASSERT(ill_mate != NULL);
15842 
15843 		if (ill_mate->ill_media->ip_m_mac_type !=
15844 		    ill->ill_media->ip_m_mac_type) {
15845 			ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: attempt to "
15846 			    "use the same ill name on differing media\n"));
15847 			return (EINVAL);
15848 		}
15849 	}
15850 
15851 	/*
15852 	 * We start off as IFF_IPV4 in ipif_allocate and become
15853 	 * IFF_IPV4 or IFF_IPV6 here depending  on lifr_flags value.
15854 	 * The only flags that we read from user space are IFF_IPV4,
15855 	 * IFF_IPV6, and IFF_BROADCAST.
15856 	 *
15857 	 * This ill has not been inserted into the global list.
15858 	 * So we are still single threaded and don't need any lock
15859 	 *
15860 	 * Saniy check the flags.
15861 	 */
15862 
15863 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
15864 	    ((lifr->lifr_flags & IFF_IPV6) ||
15865 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
15866 		ip1dbg(("ip_sioctl_slifname: link not broadcast capable "
15867 		    "or IPv6 i.e., no broadcast \n"));
15868 		return (EINVAL);
15869 	}
15870 
15871 	new_flags =
15872 	    lifr->lifr_flags & (IFF_IPV6|IFF_IPV4|IFF_BROADCAST);
15873 
15874 	if ((new_flags ^ (IFF_IPV6|IFF_IPV4)) == 0) {
15875 		ip1dbg(("ip_sioctl_slifname: flags must be exactly one of "
15876 		    "IFF_IPV4 or IFF_IPV6\n"));
15877 		return (EINVAL);
15878 	}
15879 
15880 	/*
15881 	 * We always start off as IPv4, so only need to check for IPv6.
15882 	 */
15883 	if ((new_flags & IFF_IPV6) != 0) {
15884 		ill->ill_flags |= ILLF_IPV6;
15885 		ill->ill_flags &= ~ILLF_IPV4;
15886 
15887 		if (lifr->lifr_flags & IFF_NOLINKLOCAL)
15888 			ill->ill_flags |= ILLF_NOLINKLOCAL;
15889 	}
15890 
15891 	if ((new_flags & IFF_BROADCAST) != 0)
15892 		ipif->ipif_flags |= IPIF_BROADCAST;
15893 	else
15894 		ipif->ipif_flags &= ~IPIF_BROADCAST;
15895 
15896 	/* We started off as V4. */
15897 	if (ill->ill_flags & ILLF_IPV6) {
15898 		ill->ill_phyint->phyint_illv6 = ill;
15899 		ill->ill_phyint->phyint_illv4 = NULL;
15900 	}
15901 
15902 	return (ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa));
15903 }
15904 
15905 /* ARGSUSED */
15906 int
15907 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15908     ip_ioctl_cmd_t *ipip, void *if_req)
15909 {
15910 	/*
15911 	 * ill_phyint_reinit merged the v4 and v6 into a single
15912 	 * ipsq.  We might not have been able to complete the
15913 	 * slifname in ipif_set_values, if we could not become
15914 	 * exclusive.  If so restart it here
15915 	 */
15916 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15917 }
15918 
15919 /*
15920  * Return a pointer to the ipif which matches the index, IP version type and
15921  * zoneid.
15922  */
15923 ipif_t *
15924 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
15925     ip_stack_t *ipst)
15926 {
15927 	ill_t	*ill;
15928 	ipif_t	*ipif = NULL;
15929 
15930 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
15931 	if (ill != NULL) {
15932 		mutex_enter(&ill->ill_lock);
15933 		for (ipif = ill->ill_ipif; ipif != NULL;
15934 		    ipif = ipif->ipif_next) {
15935 			if (!IPIF_IS_CONDEMNED(ipif) && (zoneid == ALL_ZONES ||
15936 			    zoneid == ipif->ipif_zoneid ||
15937 			    ipif->ipif_zoneid == ALL_ZONES)) {
15938 				ipif_refhold_locked(ipif);
15939 				break;
15940 			}
15941 		}
15942 		mutex_exit(&ill->ill_lock);
15943 		ill_refrele(ill);
15944 	}
15945 	return (ipif);
15946 }
15947 
15948 /*
15949  * Change an existing physical interface's index. If the new index
15950  * is acceptable we update the index and the phyint_list_avl_by_index tree.
15951  * Finally, we update other systems which may have a dependence on the
15952  * index value.
15953  */
15954 /* ARGSUSED */
15955 int
15956 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15957     ip_ioctl_cmd_t *ipip, void *ifreq)
15958 {
15959 	ill_t		*ill;
15960 	phyint_t	*phyi;
15961 	struct ifreq	*ifr = (struct ifreq *)ifreq;
15962 	struct lifreq	*lifr = (struct lifreq *)ifreq;
15963 	uint_t	old_index, index;
15964 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15965 	avl_index_t	where;
15966 
15967 	if (ipip->ipi_cmd_type == IF_CMD)
15968 		index = ifr->ifr_index;
15969 	else
15970 		index = lifr->lifr_index;
15971 
15972 	/*
15973 	 * Only allow on physical interface. Also, index zero is illegal.
15974 	 */
15975 	ill = ipif->ipif_ill;
15976 	phyi = ill->ill_phyint;
15977 	if (ipif->ipif_id != 0 || index == 0 || index > IF_INDEX_MAX) {
15978 		return (EINVAL);
15979 	}
15980 
15981 	/* If the index is not changing, no work to do */
15982 	if (phyi->phyint_ifindex == index)
15983 		return (0);
15984 
15985 	/*
15986 	 * Use phyint_exists() to determine if the new interface index
15987 	 * is already in use. If the index is unused then we need to
15988 	 * change the phyint's position in the phyint_list_avl_by_index
15989 	 * tree. If we do not do this, subsequent lookups (using the new
15990 	 * index value) will not find the phyint.
15991 	 */
15992 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15993 	if (phyint_exists(index, ipst)) {
15994 		rw_exit(&ipst->ips_ill_g_lock);
15995 		return (EEXIST);
15996 	}
15997 
15998 	/*
15999 	 * The new index is unused. Set it in the phyint. However we must not
16000 	 * forget to trigger NE_IFINDEX_CHANGE event before the ifindex
16001 	 * changes. The event must be bound to old ifindex value.
16002 	 */
16003 	ill_nic_event_dispatch(ill, 0, NE_IFINDEX_CHANGE,
16004 	    &index, sizeof (index));
16005 
16006 	old_index = phyi->phyint_ifindex;
16007 	phyi->phyint_ifindex = index;
16008 
16009 	avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index, phyi);
16010 	(void) avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16011 	    &index, &where);
16012 	avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16013 	    phyi, where);
16014 	rw_exit(&ipst->ips_ill_g_lock);
16015 
16016 	/* Update SCTP's ILL list */
16017 	sctp_ill_reindex(ill, old_index);
16018 
16019 	/* Send the routing sockets message */
16020 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
16021 	if (ILL_OTHER(ill))
16022 		ip_rts_ifmsg(ILL_OTHER(ill)->ill_ipif, RTSQ_DEFAULT);
16023 
16024 	/* Perhaps ilgs should use this ill */
16025 	update_conn_ill(NULL, ill->ill_ipst);
16026 	return (0);
16027 }
16028 
16029 /* ARGSUSED */
16030 int
16031 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16032     ip_ioctl_cmd_t *ipip, void *ifreq)
16033 {
16034 	struct ifreq	*ifr = (struct ifreq *)ifreq;
16035 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16036 
16037 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
16038 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16039 	/* Get the interface index */
16040 	if (ipip->ipi_cmd_type == IF_CMD) {
16041 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16042 	} else {
16043 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16044 	}
16045 	return (0);
16046 }
16047 
16048 /* ARGSUSED */
16049 int
16050 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16051     ip_ioctl_cmd_t *ipip, void *ifreq)
16052 {
16053 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16054 
16055 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
16056 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16057 	/* Get the interface zone */
16058 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16059 	lifr->lifr_zoneid = ipif->ipif_zoneid;
16060 	return (0);
16061 }
16062 
16063 /*
16064  * Set the zoneid of an interface.
16065  */
16066 /* ARGSUSED */
16067 int
16068 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16069     ip_ioctl_cmd_t *ipip, void *ifreq)
16070 {
16071 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16072 	int err = 0;
16073 	boolean_t need_up = B_FALSE;
16074 	zone_t *zptr;
16075 	zone_status_t status;
16076 	zoneid_t zoneid;
16077 
16078 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16079 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
16080 		if (!is_system_labeled())
16081 			return (ENOTSUP);
16082 		zoneid = GLOBAL_ZONEID;
16083 	}
16084 
16085 	/* cannot assign instance zero to a non-global zone */
16086 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
16087 		return (ENOTSUP);
16088 
16089 	/*
16090 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
16091 	 * the event of a race with the zone shutdown processing, since IP
16092 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
16093 	 * interface will be cleaned up even if the zone is shut down
16094 	 * immediately after the status check. If the interface can't be brought
16095 	 * down right away, and the zone is shut down before the restart
16096 	 * function is called, we resolve the possible races by rechecking the
16097 	 * zone status in the restart function.
16098 	 */
16099 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
16100 		return (EINVAL);
16101 	status = zone_status_get(zptr);
16102 	zone_rele(zptr);
16103 
16104 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
16105 		return (EINVAL);
16106 
16107 	if (ipif->ipif_flags & IPIF_UP) {
16108 		/*
16109 		 * If the interface is already marked up,
16110 		 * we call ipif_down which will take care
16111 		 * of ditching any IREs that have been set
16112 		 * up based on the old interface address.
16113 		 */
16114 		err = ipif_logical_down(ipif, q, mp);
16115 		if (err == EINPROGRESS)
16116 			return (err);
16117 		(void) ipif_down_tail(ipif);
16118 		need_up = B_TRUE;
16119 	}
16120 
16121 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
16122 	return (err);
16123 }
16124 
16125 static int
16126 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
16127     queue_t *q, mblk_t *mp, boolean_t need_up)
16128 {
16129 	int	err = 0;
16130 	ip_stack_t	*ipst;
16131 
16132 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
16133 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16134 
16135 	if (CONN_Q(q))
16136 		ipst = CONNQ_TO_IPST(q);
16137 	else
16138 		ipst = ILLQ_TO_IPST(q);
16139 
16140 	/*
16141 	 * For exclusive stacks we don't allow a different zoneid than
16142 	 * global.
16143 	 */
16144 	if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID &&
16145 	    zoneid != GLOBAL_ZONEID)
16146 		return (EINVAL);
16147 
16148 	/* Set the new zone id. */
16149 	ipif->ipif_zoneid = zoneid;
16150 
16151 	/* Update sctp list */
16152 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
16153 
16154 	/* The default multicast interface might have changed */
16155 	ire_increment_multicast_generation(ipst, ipif->ipif_ill->ill_isv6);
16156 
16157 	if (need_up) {
16158 		/*
16159 		 * Now bring the interface back up.  If this
16160 		 * is the only IPIF for the ILL, ipif_up
16161 		 * will have to re-bind to the device, so
16162 		 * we may get back EINPROGRESS, in which
16163 		 * case, this IOCTL will get completed in
16164 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
16165 		 */
16166 		err = ipif_up(ipif, q, mp);
16167 	}
16168 	return (err);
16169 }
16170 
16171 /* ARGSUSED */
16172 int
16173 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16174     ip_ioctl_cmd_t *ipip, void *if_req)
16175 {
16176 	struct lifreq *lifr = (struct lifreq *)if_req;
16177 	zoneid_t zoneid;
16178 	zone_t *zptr;
16179 	zone_status_t status;
16180 
16181 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16182 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
16183 		zoneid = GLOBAL_ZONEID;
16184 
16185 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
16186 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16187 
16188 	/*
16189 	 * We recheck the zone status to resolve the following race condition:
16190 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
16191 	 * 2) hme0:1 is up and can't be brought down right away;
16192 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
16193 	 * 3) zone "myzone" is halted; the zone status switches to
16194 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
16195 	 * the interfaces to remove - hme0:1 is not returned because it's not
16196 	 * yet in "myzone", so it won't be removed;
16197 	 * 4) the restart function for SIOCSLIFZONE is called; without the
16198 	 * status check here, we would have hme0:1 in "myzone" after it's been
16199 	 * destroyed.
16200 	 * Note that if the status check fails, we need to bring the interface
16201 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
16202 	 * ipif_up_done[_v6]().
16203 	 */
16204 	status = ZONE_IS_UNINITIALIZED;
16205 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
16206 		status = zone_status_get(zptr);
16207 		zone_rele(zptr);
16208 	}
16209 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
16210 		if (ipif->ipif_isv6) {
16211 			(void) ipif_up_done_v6(ipif);
16212 		} else {
16213 			(void) ipif_up_done(ipif);
16214 		}
16215 		return (EINVAL);
16216 	}
16217 
16218 	(void) ipif_down_tail(ipif);
16219 
16220 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
16221 	    B_TRUE));
16222 }
16223 
16224 /*
16225  * Return the number of addresses on `ill' with one or more of the values
16226  * in `set' set and all of the values in `clear' clear.
16227  */
16228 static uint_t
16229 ill_flagaddr_cnt(const ill_t *ill, uint64_t set, uint64_t clear)
16230 {
16231 	ipif_t	*ipif;
16232 	uint_t	cnt = 0;
16233 
16234 	ASSERT(IAM_WRITER_ILL(ill));
16235 
16236 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
16237 		if ((ipif->ipif_flags & set) && !(ipif->ipif_flags & clear))
16238 			cnt++;
16239 
16240 	return (cnt);
16241 }
16242 
16243 /*
16244  * Return the number of migratable addresses on `ill' that are under
16245  * application control.
16246  */
16247 uint_t
16248 ill_appaddr_cnt(const ill_t *ill)
16249 {
16250 	return (ill_flagaddr_cnt(ill, IPIF_DHCPRUNNING | IPIF_ADDRCONF,
16251 	    IPIF_NOFAILOVER));
16252 }
16253 
16254 /*
16255  * Return the number of point-to-point addresses on `ill'.
16256  */
16257 uint_t
16258 ill_ptpaddr_cnt(const ill_t *ill)
16259 {
16260 	return (ill_flagaddr_cnt(ill, IPIF_POINTOPOINT, 0));
16261 }
16262 
16263 /* ARGSUSED */
16264 int
16265 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16266 	ip_ioctl_cmd_t *ipip, void *ifreq)
16267 {
16268 	struct lifreq	*lifr = ifreq;
16269 
16270 	ASSERT(q->q_next == NULL);
16271 	ASSERT(CONN_Q(q));
16272 
16273 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
16274 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16275 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
16276 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
16277 
16278 	return (0);
16279 }
16280 
16281 /* Find the previous ILL in this usesrc group */
16282 static ill_t *
16283 ill_prev_usesrc(ill_t *uill)
16284 {
16285 	ill_t *ill;
16286 
16287 	for (ill = uill->ill_usesrc_grp_next;
16288 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
16289 	    ill = ill->ill_usesrc_grp_next)
16290 		/* do nothing */;
16291 	return (ill);
16292 }
16293 
16294 /*
16295  * Release all members of the usesrc group. This routine is called
16296  * from ill_delete when the interface being unplumbed is the
16297  * group head.
16298  *
16299  * This silently clears the usesrc that ifconfig setup.
16300  * An alternative would be to keep that ifindex, and drop packets on the floor
16301  * since no source address can be selected.
16302  * Even if we keep the current semantics, don't need a lock and a linked list.
16303  * Can walk all the ills checking if they have a ill_usesrc_ifindex matching
16304  * the one that is being removed. Issue is how we return the usesrc users
16305  * (SIOCGLIFSRCOF). We want to be able to find the ills which have an
16306  * ill_usesrc_ifindex matching a target ill. We could also do that with an
16307  * ill walk, but the walker would need to insert in the ioctl response.
16308  */
16309 static void
16310 ill_disband_usesrc_group(ill_t *uill)
16311 {
16312 	ill_t *next_ill, *tmp_ill;
16313 	ip_stack_t	*ipst = uill->ill_ipst;
16314 
16315 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16316 	next_ill = uill->ill_usesrc_grp_next;
16317 
16318 	do {
16319 		ASSERT(next_ill != NULL);
16320 		tmp_ill = next_ill->ill_usesrc_grp_next;
16321 		ASSERT(tmp_ill != NULL);
16322 		next_ill->ill_usesrc_grp_next = NULL;
16323 		next_ill->ill_usesrc_ifindex = 0;
16324 		next_ill = tmp_ill;
16325 	} while (next_ill->ill_usesrc_ifindex != 0);
16326 	uill->ill_usesrc_grp_next = NULL;
16327 }
16328 
16329 /*
16330  * Remove the client usesrc ILL from the list and relink to a new list
16331  */
16332 int
16333 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
16334 {
16335 	ill_t *ill, *tmp_ill;
16336 	ip_stack_t	*ipst = ucill->ill_ipst;
16337 
16338 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
16339 	    (uill != NULL) && RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16340 
16341 	/*
16342 	 * Check if the usesrc client ILL passed in is not already
16343 	 * in use as a usesrc ILL i.e one whose source address is
16344 	 * in use OR a usesrc ILL is not already in use as a usesrc
16345 	 * client ILL
16346 	 */
16347 	if ((ucill->ill_usesrc_ifindex == 0) ||
16348 	    (uill->ill_usesrc_ifindex != 0)) {
16349 		return (-1);
16350 	}
16351 
16352 	ill = ill_prev_usesrc(ucill);
16353 	ASSERT(ill->ill_usesrc_grp_next != NULL);
16354 
16355 	/* Remove from the current list */
16356 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
16357 		/* Only two elements in the list */
16358 		ASSERT(ill->ill_usesrc_ifindex == 0);
16359 		ill->ill_usesrc_grp_next = NULL;
16360 	} else {
16361 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
16362 	}
16363 
16364 	if (ifindex == 0) {
16365 		ucill->ill_usesrc_ifindex = 0;
16366 		ucill->ill_usesrc_grp_next = NULL;
16367 		return (0);
16368 	}
16369 
16370 	ucill->ill_usesrc_ifindex = ifindex;
16371 	tmp_ill = uill->ill_usesrc_grp_next;
16372 	uill->ill_usesrc_grp_next = ucill;
16373 	ucill->ill_usesrc_grp_next =
16374 	    (tmp_ill != NULL) ? tmp_ill : uill;
16375 	return (0);
16376 }
16377 
16378 /*
16379  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
16380  * ip.c for locking details.
16381  */
16382 /* ARGSUSED */
16383 int
16384 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16385     ip_ioctl_cmd_t *ipip, void *ifreq)
16386 {
16387 	struct lifreq *lifr = (struct lifreq *)ifreq;
16388 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE;
16389 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
16390 	int err = 0, ret;
16391 	uint_t ifindex;
16392 	ipsq_t *ipsq = NULL;
16393 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
16394 
16395 	ASSERT(IAM_WRITER_IPIF(ipif));
16396 	ASSERT(q->q_next == NULL);
16397 	ASSERT(CONN_Q(q));
16398 
16399 	isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
16400 
16401 	ifindex = lifr->lifr_index;
16402 	if (ifindex == 0) {
16403 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
16404 			/* non usesrc group interface, nothing to reset */
16405 			return (0);
16406 		}
16407 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
16408 		/* valid reset request */
16409 		reset_flg = B_TRUE;
16410 	}
16411 
16412 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
16413 	if (usesrc_ill == NULL)
16414 		return (ENXIO);
16415 	if (usesrc_ill == ipif->ipif_ill) {
16416 		ill_refrele(usesrc_ill);
16417 		return (EINVAL);
16418 	}
16419 
16420 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
16421 	    NEW_OP, B_TRUE);
16422 	if (ipsq == NULL) {
16423 		err = EINPROGRESS;
16424 		/* Operation enqueued on the ipsq of the usesrc ILL */
16425 		goto done;
16426 	}
16427 
16428 	/* USESRC isn't currently supported with IPMP */
16429 	if (IS_IPMP(usesrc_ill) || IS_UNDER_IPMP(usesrc_ill)) {
16430 		err = ENOTSUP;
16431 		goto done;
16432 	}
16433 
16434 	/*
16435 	 * USESRC isn't compatible with the STANDBY flag.  (STANDBY is only
16436 	 * used by IPMP underlying interfaces, but someone might think it's
16437 	 * more general and try to use it independently with VNI.)
16438 	 */
16439 	if (usesrc_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
16440 		err = ENOTSUP;
16441 		goto done;
16442 	}
16443 
16444 	/*
16445 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
16446 	 * already a client then return EINVAL
16447 	 */
16448 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
16449 		err = EINVAL;
16450 		goto done;
16451 	}
16452 
16453 	/*
16454 	 * If the ill_usesrc_ifindex field is already set to what it needs to
16455 	 * be then this is a duplicate operation.
16456 	 */
16457 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
16458 		err = 0;
16459 		goto done;
16460 	}
16461 
16462 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
16463 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
16464 	    usesrc_ill->ill_isv6));
16465 
16466 	/*
16467 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
16468 	 * and the ill_usesrc_ifindex fields
16469 	 */
16470 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
16471 
16472 	if (reset_flg) {
16473 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
16474 		if (ret != 0) {
16475 			err = EINVAL;
16476 		}
16477 		rw_exit(&ipst->ips_ill_g_usesrc_lock);
16478 		goto done;
16479 	}
16480 
16481 	/*
16482 	 * Four possibilities to consider:
16483 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
16484 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
16485 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
16486 	 * 4. Both are part of their respective usesrc groups
16487 	 */
16488 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
16489 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16490 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
16491 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16492 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16493 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
16494 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
16495 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16496 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16497 		/* Insert at head of list */
16498 		usesrc_cli_ill->ill_usesrc_grp_next =
16499 		    usesrc_ill->ill_usesrc_grp_next;
16500 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16501 	} else {
16502 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
16503 		    ifindex);
16504 		if (ret != 0)
16505 			err = EINVAL;
16506 	}
16507 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
16508 
16509 done:
16510 	if (ipsq != NULL)
16511 		ipsq_exit(ipsq);
16512 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
16513 	ill_refrele(usesrc_ill);
16514 
16515 	/* Let conn_ixa caching know that source address selection changed */
16516 	ip_update_source_selection(ipst);
16517 
16518 	return (err);
16519 }
16520 
16521 /* ARGSUSED */
16522 int
16523 ip_sioctl_get_dadstate(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16524     ip_ioctl_cmd_t *ipip, void *if_req)
16525 {
16526 	struct lifreq	*lifr = (struct lifreq *)if_req;
16527 	ill_t		*ill = ipif->ipif_ill;
16528 
16529 	/*
16530 	 * Need a lock since IFF_UP can be set even when there are
16531 	 * references to the ipif.
16532 	 */
16533 	mutex_enter(&ill->ill_lock);
16534 	if ((ipif->ipif_flags & IPIF_UP) && ipif->ipif_addr_ready == 0)
16535 		lifr->lifr_dadstate = DAD_IN_PROGRESS;
16536 	else
16537 		lifr->lifr_dadstate = DAD_DONE;
16538 	mutex_exit(&ill->ill_lock);
16539 	return (0);
16540 }
16541 
16542 /*
16543  * comparison function used by avl.
16544  */
16545 static int
16546 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
16547 {
16548 
16549 	uint_t index;
16550 
16551 	ASSERT(phyip != NULL && index_ptr != NULL);
16552 
16553 	index = *((uint_t *)index_ptr);
16554 	/*
16555 	 * let the phyint with the lowest index be on top.
16556 	 */
16557 	if (((phyint_t *)phyip)->phyint_ifindex < index)
16558 		return (1);
16559 	if (((phyint_t *)phyip)->phyint_ifindex > index)
16560 		return (-1);
16561 	return (0);
16562 }
16563 
16564 /*
16565  * comparison function used by avl.
16566  */
16567 static int
16568 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
16569 {
16570 	ill_t *ill;
16571 	int res = 0;
16572 
16573 	ASSERT(phyip != NULL && name_ptr != NULL);
16574 
16575 	if (((phyint_t *)phyip)->phyint_illv4)
16576 		ill = ((phyint_t *)phyip)->phyint_illv4;
16577 	else
16578 		ill = ((phyint_t *)phyip)->phyint_illv6;
16579 	ASSERT(ill != NULL);
16580 
16581 	res = strcmp(ill->ill_name, (char *)name_ptr);
16582 	if (res > 0)
16583 		return (1);
16584 	else if (res < 0)
16585 		return (-1);
16586 	return (0);
16587 }
16588 
16589 /*
16590  * This function is called on the unplumb path via ill_glist_delete() when
16591  * there are no ills left on the phyint and thus the phyint can be freed.
16592  */
16593 static void
16594 phyint_free(phyint_t *phyi)
16595 {
16596 	ip_stack_t *ipst = PHYINT_TO_IPST(phyi);
16597 
16598 	ASSERT(phyi->phyint_illv4 == NULL && phyi->phyint_illv6 == NULL);
16599 
16600 	/*
16601 	 * If this phyint was an IPMP meta-interface, blow away the group.
16602 	 * This is safe to do because all of the illgrps have already been
16603 	 * removed by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find us.
16604 	 * If we're cleaning up as a result of failed initialization,
16605 	 * phyint_grp may be NULL.
16606 	 */
16607 	if ((phyi->phyint_flags & PHYI_IPMP) && (phyi->phyint_grp != NULL)) {
16608 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16609 		ipmp_grp_destroy(phyi->phyint_grp);
16610 		phyi->phyint_grp = NULL;
16611 		rw_exit(&ipst->ips_ipmp_lock);
16612 	}
16613 
16614 	/*
16615 	 * If this interface was under IPMP, take it out of the group.
16616 	 */
16617 	if (phyi->phyint_grp != NULL)
16618 		ipmp_phyint_leave_grp(phyi);
16619 
16620 	/*
16621 	 * Delete the phyint and disassociate its ipsq.  The ipsq itself
16622 	 * will be freed in ipsq_exit().
16623 	 */
16624 	phyi->phyint_ipsq->ipsq_phyint = NULL;
16625 	phyi->phyint_name[0] = '\0';
16626 
16627 	mi_free(phyi);
16628 }
16629 
16630 /*
16631  * Attach the ill to the phyint structure which can be shared by both
16632  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
16633  * function is called from ipif_set_values and ill_lookup_on_name (for
16634  * loopback) where we know the name of the ill. We lookup the ill and if
16635  * there is one present already with the name use that phyint. Otherwise
16636  * reuse the one allocated by ill_init.
16637  */
16638 static void
16639 ill_phyint_reinit(ill_t *ill)
16640 {
16641 	boolean_t isv6 = ill->ill_isv6;
16642 	phyint_t *phyi_old;
16643 	phyint_t *phyi;
16644 	avl_index_t where = 0;
16645 	ill_t	*ill_other = NULL;
16646 	ip_stack_t	*ipst = ill->ill_ipst;
16647 
16648 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
16649 
16650 	phyi_old = ill->ill_phyint;
16651 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
16652 	    phyi_old->phyint_illv6 == NULL));
16653 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
16654 	    phyi_old->phyint_illv4 == NULL));
16655 	ASSERT(phyi_old->phyint_ifindex == 0);
16656 
16657 	/*
16658 	 * Now that our ill has a name, set it in the phyint.
16659 	 */
16660 	(void) strlcpy(ill->ill_phyint->phyint_name, ill->ill_name, LIFNAMSIZ);
16661 
16662 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16663 	    ill->ill_name, &where);
16664 
16665 	/*
16666 	 * 1. We grabbed the ill_g_lock before inserting this ill into
16667 	 *    the global list of ills. So no other thread could have located
16668 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
16669 	 * 2. Now locate the other protocol instance of this ill.
16670 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
16671 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
16672 	 *    of neither ill can change.
16673 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
16674 	 *    other ill.
16675 	 * 5. Release all locks.
16676 	 */
16677 
16678 	/*
16679 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
16680 	 * we are initializing IPv4.
16681 	 */
16682 	if (phyi != NULL) {
16683 		ill_other = (isv6) ? phyi->phyint_illv4 : phyi->phyint_illv6;
16684 		ASSERT(ill_other->ill_phyint != NULL);
16685 		ASSERT((isv6 && !ill_other->ill_isv6) ||
16686 		    (!isv6 && ill_other->ill_isv6));
16687 		GRAB_ILL_LOCKS(ill, ill_other);
16688 		/*
16689 		 * We are potentially throwing away phyint_flags which
16690 		 * could be different from the one that we obtain from
16691 		 * ill_other->ill_phyint. But it is okay as we are assuming
16692 		 * that the state maintained within IP is correct.
16693 		 */
16694 		mutex_enter(&phyi->phyint_lock);
16695 		if (isv6) {
16696 			ASSERT(phyi->phyint_illv6 == NULL);
16697 			phyi->phyint_illv6 = ill;
16698 		} else {
16699 			ASSERT(phyi->phyint_illv4 == NULL);
16700 			phyi->phyint_illv4 = ill;
16701 		}
16702 
16703 		/*
16704 		 * Delete the old phyint and make its ipsq eligible
16705 		 * to be freed in ipsq_exit().
16706 		 */
16707 		phyi_old->phyint_illv4 = NULL;
16708 		phyi_old->phyint_illv6 = NULL;
16709 		phyi_old->phyint_ipsq->ipsq_phyint = NULL;
16710 		phyi_old->phyint_name[0] = '\0';
16711 		mi_free(phyi_old);
16712 	} else {
16713 		mutex_enter(&ill->ill_lock);
16714 		/*
16715 		 * We don't need to acquire any lock, since
16716 		 * the ill is not yet visible globally  and we
16717 		 * have not yet released the ill_g_lock.
16718 		 */
16719 		phyi = phyi_old;
16720 		mutex_enter(&phyi->phyint_lock);
16721 		/* XXX We need a recovery strategy here. */
16722 		if (!phyint_assign_ifindex(phyi, ipst))
16723 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
16724 
16725 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16726 		    (void *)phyi, where);
16727 
16728 		(void) avl_find(&ipst->ips_phyint_g_list->
16729 		    phyint_list_avl_by_index,
16730 		    &phyi->phyint_ifindex, &where);
16731 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16732 		    (void *)phyi, where);
16733 	}
16734 
16735 	/*
16736 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
16737 	 * pending mp is not affected because that is per ill basis.
16738 	 */
16739 	ill->ill_phyint = phyi;
16740 
16741 	/*
16742 	 * Now that the phyint's ifindex has been assigned, complete the
16743 	 * remaining
16744 	 */
16745 	ill->ill_ip_mib->ipIfStatsIfIndex = ill->ill_phyint->phyint_ifindex;
16746 	if (ill->ill_isv6) {
16747 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
16748 		    ill->ill_phyint->phyint_ifindex;
16749 		ill->ill_mcast_type = ipst->ips_mld_max_version;
16750 	} else {
16751 		ill->ill_mcast_type = ipst->ips_igmp_max_version;
16752 	}
16753 
16754 	/*
16755 	 * Generate an event within the hooks framework to indicate that
16756 	 * a new interface has just been added to IP.  For this event to
16757 	 * be generated, the network interface must, at least, have an
16758 	 * ifindex assigned to it.  (We don't generate the event for
16759 	 * loopback since ill_lookup_on_name() has its own NE_PLUMB event.)
16760 	 *
16761 	 * This needs to be run inside the ill_g_lock perimeter to ensure
16762 	 * that the ordering of delivered events to listeners matches the
16763 	 * order of them in the kernel.
16764 	 */
16765 	if (!IS_LOOPBACK(ill)) {
16766 		ill_nic_event_dispatch(ill, 0, NE_PLUMB, ill->ill_name,
16767 		    ill->ill_name_length);
16768 	}
16769 	RELEASE_ILL_LOCKS(ill, ill_other);
16770 	mutex_exit(&phyi->phyint_lock);
16771 }
16772 
16773 /*
16774  * Notify any downstream modules of the name of this interface.
16775  * An M_IOCTL is used even though we don't expect a successful reply.
16776  * Any reply message from the driver (presumably an M_IOCNAK) will
16777  * eventually get discarded somewhere upstream.  The message format is
16778  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
16779  * to IP.
16780  */
16781 static void
16782 ip_ifname_notify(ill_t *ill, queue_t *q)
16783 {
16784 	mblk_t *mp1, *mp2;
16785 	struct iocblk *iocp;
16786 	struct lifreq *lifr;
16787 
16788 	mp1 = mkiocb(SIOCSLIFNAME);
16789 	if (mp1 == NULL)
16790 		return;
16791 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
16792 	if (mp2 == NULL) {
16793 		freeb(mp1);
16794 		return;
16795 	}
16796 
16797 	mp1->b_cont = mp2;
16798 	iocp = (struct iocblk *)mp1->b_rptr;
16799 	iocp->ioc_count = sizeof (struct lifreq);
16800 
16801 	lifr = (struct lifreq *)mp2->b_rptr;
16802 	mp2->b_wptr += sizeof (struct lifreq);
16803 	bzero(lifr, sizeof (struct lifreq));
16804 
16805 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
16806 	lifr->lifr_ppa = ill->ill_ppa;
16807 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
16808 
16809 	DTRACE_PROBE3(ill__dlpi, char *, "ip_ifname_notify",
16810 	    char *, "SIOCSLIFNAME", ill_t *, ill);
16811 	putnext(q, mp1);
16812 }
16813 
16814 static int
16815 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
16816 {
16817 	int		err;
16818 	ip_stack_t	*ipst = ill->ill_ipst;
16819 	phyint_t	*phyi = ill->ill_phyint;
16820 
16821 	/*
16822 	 * Now that ill_name is set, the configuration for the IPMP
16823 	 * meta-interface can be performed.
16824 	 */
16825 	if (IS_IPMP(ill)) {
16826 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16827 		/*
16828 		 * If phyi->phyint_grp is NULL, then this is the first IPMP
16829 		 * meta-interface and we need to create the IPMP group.
16830 		 */
16831 		if (phyi->phyint_grp == NULL) {
16832 			/*
16833 			 * If someone has renamed another IPMP group to have
16834 			 * the same name as our interface, bail.
16835 			 */
16836 			if (ipmp_grp_lookup(ill->ill_name, ipst) != NULL) {
16837 				rw_exit(&ipst->ips_ipmp_lock);
16838 				return (EEXIST);
16839 			}
16840 			phyi->phyint_grp = ipmp_grp_create(ill->ill_name, phyi);
16841 			if (phyi->phyint_grp == NULL) {
16842 				rw_exit(&ipst->ips_ipmp_lock);
16843 				return (ENOMEM);
16844 			}
16845 		}
16846 		rw_exit(&ipst->ips_ipmp_lock);
16847 	}
16848 
16849 	/* Tell downstream modules where they are. */
16850 	ip_ifname_notify(ill, q);
16851 
16852 	/*
16853 	 * ill_dl_phys returns EINPROGRESS in the usual case.
16854 	 * Error cases are ENOMEM ...
16855 	 */
16856 	err = ill_dl_phys(ill, ipif, mp, q);
16857 
16858 	if (ill->ill_isv6) {
16859 		mutex_enter(&ipst->ips_mld_slowtimeout_lock);
16860 		if (ipst->ips_mld_slowtimeout_id == 0) {
16861 			ipst->ips_mld_slowtimeout_id = timeout(mld_slowtimo,
16862 			    (void *)ipst,
16863 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16864 		}
16865 		mutex_exit(&ipst->ips_mld_slowtimeout_lock);
16866 	} else {
16867 		mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
16868 		if (ipst->ips_igmp_slowtimeout_id == 0) {
16869 			ipst->ips_igmp_slowtimeout_id = timeout(igmp_slowtimo,
16870 			    (void *)ipst,
16871 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16872 		}
16873 		mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
16874 	}
16875 
16876 	return (err);
16877 }
16878 
16879 /*
16880  * Common routine for ppa and ifname setting. Should be called exclusive.
16881  *
16882  * Returns EINPROGRESS when mp has been consumed by queueing it on
16883  * ipx_pending_mp and the ioctl will complete in ip_rput.
16884  *
16885  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
16886  * the new name and new ppa in lifr_name and lifr_ppa respectively.
16887  * For SLIFNAME, we pass these values back to the userland.
16888  */
16889 static int
16890 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
16891 {
16892 	ill_t	*ill;
16893 	ipif_t	*ipif;
16894 	ipsq_t	*ipsq;
16895 	char	*ppa_ptr;
16896 	char	*old_ptr;
16897 	char	old_char;
16898 	int	error;
16899 	ip_stack_t	*ipst;
16900 
16901 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
16902 	ASSERT(q->q_next != NULL);
16903 	ASSERT(interf_name != NULL);
16904 
16905 	ill = (ill_t *)q->q_ptr;
16906 	ipst = ill->ill_ipst;
16907 
16908 	ASSERT(ill->ill_ipst != NULL);
16909 	ASSERT(ill->ill_name[0] == '\0');
16910 	ASSERT(IAM_WRITER_ILL(ill));
16911 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
16912 	ASSERT(ill->ill_ppa == UINT_MAX);
16913 
16914 	ill->ill_defend_start = ill->ill_defend_count = 0;
16915 	/* The ppa is sent down by ifconfig or is chosen */
16916 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
16917 		return (EINVAL);
16918 	}
16919 
16920 	/*
16921 	 * make sure ppa passed in is same as ppa in the name.
16922 	 * This check is not made when ppa == UINT_MAX in that case ppa
16923 	 * in the name could be anything. System will choose a ppa and
16924 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
16925 	 */
16926 	if (*new_ppa_ptr != UINT_MAX) {
16927 		/* stoi changes the pointer */
16928 		old_ptr = ppa_ptr;
16929 		/*
16930 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
16931 		 * (they don't have an externally visible ppa).  We assign one
16932 		 * here so that we can manage the interface.  Note that in
16933 		 * the past this value was always 0 for DLPI 1 drivers.
16934 		 */
16935 		if (*new_ppa_ptr == 0)
16936 			*new_ppa_ptr = stoi(&old_ptr);
16937 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
16938 			return (EINVAL);
16939 	}
16940 	/*
16941 	 * terminate string before ppa
16942 	 * save char at that location.
16943 	 */
16944 	old_char = ppa_ptr[0];
16945 	ppa_ptr[0] = '\0';
16946 
16947 	ill->ill_ppa = *new_ppa_ptr;
16948 	/*
16949 	 * Finish as much work now as possible before calling ill_glist_insert
16950 	 * which makes the ill globally visible and also merges it with the
16951 	 * other protocol instance of this phyint. The remaining work is
16952 	 * done after entering the ipsq which may happen sometime later.
16953 	 */
16954 	ipif = ill->ill_ipif;
16955 
16956 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
16957 	ipif_assign_seqid(ipif);
16958 
16959 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
16960 		ill->ill_flags |= ILLF_IPV4;
16961 
16962 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
16963 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
16964 
16965 	if (ill->ill_flags & ILLF_IPV6) {
16966 
16967 		ill->ill_isv6 = B_TRUE;
16968 		ill_set_inputfn(ill);
16969 		if (ill->ill_rq != NULL) {
16970 			ill->ill_rq->q_qinfo = &iprinitv6;
16971 		}
16972 
16973 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
16974 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
16975 		ipif->ipif_v6subnet = ipv6_all_zeros;
16976 		ipif->ipif_v6net_mask = ipv6_all_zeros;
16977 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
16978 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
16979 		ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
16980 		/*
16981 		 * point-to-point or Non-mulicast capable
16982 		 * interfaces won't do NUD unless explicitly
16983 		 * configured to do so.
16984 		 */
16985 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
16986 		    !(ill->ill_flags & ILLF_MULTICAST)) {
16987 			ill->ill_flags |= ILLF_NONUD;
16988 		}
16989 		/* Make sure IPv4 specific flag is not set on IPv6 if */
16990 		if (ill->ill_flags & ILLF_NOARP) {
16991 			/*
16992 			 * Note: xresolv interfaces will eventually need
16993 			 * NOARP set here as well, but that will require
16994 			 * those external resolvers to have some
16995 			 * knowledge of that flag and act appropriately.
16996 			 * Not to be changed at present.
16997 			 */
16998 			ill->ill_flags &= ~ILLF_NOARP;
16999 		}
17000 		/*
17001 		 * Set the ILLF_ROUTER flag according to the global
17002 		 * IPv6 forwarding policy.
17003 		 */
17004 		if (ipst->ips_ipv6_forwarding != 0)
17005 			ill->ill_flags |= ILLF_ROUTER;
17006 	} else if (ill->ill_flags & ILLF_IPV4) {
17007 		ill->ill_isv6 = B_FALSE;
17008 		ill_set_inputfn(ill);
17009 		ill->ill_reachable_retrans_time = ARP_RETRANS_TIMER;
17010 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
17011 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
17012 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
17013 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
17014 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
17015 		/*
17016 		 * Set the ILLF_ROUTER flag according to the global
17017 		 * IPv4 forwarding policy.
17018 		 */
17019 		if (ipst->ips_ip_forwarding != 0)
17020 			ill->ill_flags |= ILLF_ROUTER;
17021 	}
17022 
17023 	ASSERT(ill->ill_phyint != NULL);
17024 
17025 	/*
17026 	 * The ipIfStatsIfindex and ipv6IfIcmpIfIndex assignments will
17027 	 * be completed in ill_glist_insert -> ill_phyint_reinit
17028 	 */
17029 	if (!ill_allocate_mibs(ill))
17030 		return (ENOMEM);
17031 
17032 	/*
17033 	 * Pick a default sap until we get the DL_INFO_ACK back from
17034 	 * the driver.
17035 	 */
17036 	ill->ill_sap = (ill->ill_isv6) ? ill->ill_media->ip_m_ipv6sap :
17037 	    ill->ill_media->ip_m_ipv4sap;
17038 
17039 	ill->ill_ifname_pending = 1;
17040 	ill->ill_ifname_pending_err = 0;
17041 
17042 	/*
17043 	 * When the first ipif comes up in ipif_up_done(), multicast groups
17044 	 * that were joined while this ill was not bound to the DLPI link need
17045 	 * to be recovered by ill_recover_multicast().
17046 	 */
17047 	ill->ill_need_recover_multicast = 1;
17048 
17049 	ill_refhold(ill);
17050 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
17051 	if ((error = ill_glist_insert(ill, interf_name,
17052 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
17053 		ill->ill_ppa = UINT_MAX;
17054 		ill->ill_name[0] = '\0';
17055 		/*
17056 		 * undo null termination done above.
17057 		 */
17058 		ppa_ptr[0] = old_char;
17059 		rw_exit(&ipst->ips_ill_g_lock);
17060 		ill_refrele(ill);
17061 		return (error);
17062 	}
17063 
17064 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
17065 
17066 	/*
17067 	 * When we return the buffer pointed to by interf_name should contain
17068 	 * the same name as in ill_name.
17069 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
17070 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
17071 	 * so copy full name and update the ppa ptr.
17072 	 * When ppa passed in != UINT_MAX all values are correct just undo
17073 	 * null termination, this saves a bcopy.
17074 	 */
17075 	if (*new_ppa_ptr == UINT_MAX) {
17076 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
17077 		*new_ppa_ptr = ill->ill_ppa;
17078 	} else {
17079 		/*
17080 		 * undo null termination done above.
17081 		 */
17082 		ppa_ptr[0] = old_char;
17083 	}
17084 
17085 	/* Let SCTP know about this ILL */
17086 	sctp_update_ill(ill, SCTP_ILL_INSERT);
17087 
17088 	/*
17089 	 * ill_glist_insert has made the ill visible globally, and
17090 	 * ill_phyint_reinit could have changed the ipsq. At this point,
17091 	 * we need to hold the ips_ill_g_lock across the call to enter the
17092 	 * ipsq to enforce atomicity and prevent reordering. In the event
17093 	 * the ipsq has changed, and if the new ipsq is currently busy,
17094 	 * we need to make sure that this half-completed ioctl is ahead of
17095 	 * any subsequent ioctl. We achieve this by not dropping the
17096 	 * ips_ill_g_lock which prevents any ill lookup itself thereby
17097 	 * ensuring that new ioctls can't start.
17098 	 */
17099 	ipsq = ipsq_try_enter_internal(ill, q, mp, ip_reprocess_ioctl, NEW_OP,
17100 	    B_TRUE);
17101 
17102 	rw_exit(&ipst->ips_ill_g_lock);
17103 	ill_refrele(ill);
17104 	if (ipsq == NULL)
17105 		return (EINPROGRESS);
17106 
17107 	/*
17108 	 * If ill_phyint_reinit() changed our ipsq, then start on the new ipsq.
17109 	 */
17110 	if (ipsq->ipsq_xop->ipx_current_ipif == NULL)
17111 		ipsq_current_start(ipsq, ipif, SIOCSLIFNAME);
17112 	else
17113 		ASSERT(ipsq->ipsq_xop->ipx_current_ipif == ipif);
17114 
17115 	error = ipif_set_values_tail(ill, ipif, mp, q);
17116 	ipsq_exit(ipsq);
17117 	if (error != 0 && error != EINPROGRESS) {
17118 		/*
17119 		 * restore previous values
17120 		 */
17121 		ill->ill_isv6 = B_FALSE;
17122 		ill_set_inputfn(ill);
17123 	}
17124 	return (error);
17125 }
17126 
17127 void
17128 ipif_init(ip_stack_t *ipst)
17129 {
17130 	int i;
17131 
17132 	for (i = 0; i < MAX_G_HEADS; i++) {
17133 		ipst->ips_ill_g_heads[i].ill_g_list_head =
17134 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
17135 		ipst->ips_ill_g_heads[i].ill_g_list_tail =
17136 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
17137 	}
17138 
17139 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17140 	    ill_phyint_compare_index,
17141 	    sizeof (phyint_t),
17142 	    offsetof(struct phyint, phyint_avl_by_index));
17143 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
17144 	    ill_phyint_compare_name,
17145 	    sizeof (phyint_t),
17146 	    offsetof(struct phyint, phyint_avl_by_name));
17147 }
17148 
17149 /*
17150  * Save enough information so that we can recreate the IRE if
17151  * the interface goes down and then up.
17152  */
17153 void
17154 ill_save_ire(ill_t *ill, ire_t *ire)
17155 {
17156 	mblk_t	*save_mp;
17157 
17158 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
17159 	if (save_mp != NULL) {
17160 		ifrt_t	*ifrt;
17161 
17162 		save_mp->b_wptr += sizeof (ifrt_t);
17163 		ifrt = (ifrt_t *)save_mp->b_rptr;
17164 		bzero(ifrt, sizeof (ifrt_t));
17165 		ifrt->ifrt_type = ire->ire_type;
17166 		if (ire->ire_ipversion == IPV4_VERSION) {
17167 			ASSERT(!ill->ill_isv6);
17168 			ifrt->ifrt_addr = ire->ire_addr;
17169 			ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
17170 			ifrt->ifrt_setsrc_addr = ire->ire_setsrc_addr;
17171 			ifrt->ifrt_mask = ire->ire_mask;
17172 		} else {
17173 			ASSERT(ill->ill_isv6);
17174 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
17175 			/* ire_gateway_addr_v6 can change due to RTM_CHANGE */
17176 			mutex_enter(&ire->ire_lock);
17177 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
17178 			mutex_exit(&ire->ire_lock);
17179 			ifrt->ifrt_v6setsrc_addr = ire->ire_setsrc_addr_v6;
17180 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
17181 		}
17182 		ifrt->ifrt_flags = ire->ire_flags;
17183 		ifrt->ifrt_zoneid = ire->ire_zoneid;
17184 		mutex_enter(&ill->ill_saved_ire_lock);
17185 		save_mp->b_cont = ill->ill_saved_ire_mp;
17186 		ill->ill_saved_ire_mp = save_mp;
17187 		ill->ill_saved_ire_cnt++;
17188 		mutex_exit(&ill->ill_saved_ire_lock);
17189 	}
17190 }
17191 
17192 /*
17193  * Remove one entry from ill_saved_ire_mp.
17194  */
17195 void
17196 ill_remove_saved_ire(ill_t *ill, ire_t *ire)
17197 {
17198 	mblk_t	**mpp;
17199 	mblk_t	*mp;
17200 	ifrt_t	*ifrt;
17201 
17202 	/* Remove from ill_saved_ire_mp list if it is there */
17203 	mutex_enter(&ill->ill_saved_ire_lock);
17204 	for (mpp = &ill->ill_saved_ire_mp; *mpp != NULL;
17205 	    mpp = &(*mpp)->b_cont) {
17206 		in6_addr_t	gw_addr_v6;
17207 
17208 		/*
17209 		 * On a given ill, the tuple of address, gateway, mask,
17210 		 * ire_type, and zoneid is unique for each saved IRE.
17211 		 */
17212 		mp = *mpp;
17213 		ifrt = (ifrt_t *)mp->b_rptr;
17214 		/* ire_gateway_addr_v6 can change - need lock */
17215 		mutex_enter(&ire->ire_lock);
17216 		gw_addr_v6 = ire->ire_gateway_addr_v6;
17217 		mutex_exit(&ire->ire_lock);
17218 
17219 		if (ifrt->ifrt_zoneid != ire->ire_zoneid ||
17220 		    ifrt->ifrt_type != ire->ire_type)
17221 			continue;
17222 
17223 		if (ill->ill_isv6 ?
17224 		    (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
17225 		    &ire->ire_addr_v6) &&
17226 		    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
17227 		    &gw_addr_v6) &&
17228 		    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
17229 		    &ire->ire_mask_v6)) :
17230 		    (ifrt->ifrt_addr == ire->ire_addr &&
17231 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
17232 		    ifrt->ifrt_mask == ire->ire_mask)) {
17233 			*mpp = mp->b_cont;
17234 			ill->ill_saved_ire_cnt--;
17235 			freeb(mp);
17236 			break;
17237 		}
17238 	}
17239 	mutex_exit(&ill->ill_saved_ire_lock);
17240 }
17241 
17242 /*
17243  * IP multirouting broadcast routes handling
17244  * Append CGTP broadcast IREs to regular ones created
17245  * at ifconfig time.
17246  * The usage is a route add <cgtp_bc> <nic_bc> -multirt i.e., both
17247  * the destination and the gateway are broadcast addresses.
17248  * The caller has verified that the destination is an IRE_BROADCAST and that
17249  * RTF_MULTIRT was set. Here if the gateway is a broadcast address, then
17250  * we create a MULTIRT IRE_BROADCAST.
17251  * Note that the IRE_HOST created by ire_rt_add doesn't get found by anything
17252  * since the IRE_BROADCAST takes precedence; ire_add_v4 does head insertion.
17253  */
17254 static void
17255 ip_cgtp_bcast_add(ire_t *ire, ip_stack_t *ipst)
17256 {
17257 	ire_t *ire_prim;
17258 
17259 	ASSERT(ire != NULL);
17260 
17261 	ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17262 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
17263 	    NULL);
17264 	if (ire_prim != NULL) {
17265 		/*
17266 		 * We are in the special case of broadcasts for
17267 		 * CGTP. We add an IRE_BROADCAST that holds
17268 		 * the RTF_MULTIRT flag, the destination
17269 		 * address and the low level
17270 		 * info of ire_prim. In other words, CGTP
17271 		 * broadcast is added to the redundant ipif.
17272 		 */
17273 		ill_t *ill_prim;
17274 		ire_t  *bcast_ire;
17275 
17276 		ill_prim = ire_prim->ire_ill;
17277 
17278 		ip2dbg(("ip_cgtp_filter_bcast_add: ire_prim %p, ill_prim %p\n",
17279 		    (void *)ire_prim, (void *)ill_prim));
17280 
17281 		bcast_ire = ire_create(
17282 		    (uchar_t *)&ire->ire_addr,
17283 		    (uchar_t *)&ip_g_all_ones,
17284 		    (uchar_t *)&ire->ire_gateway_addr,
17285 		    IRE_BROADCAST,
17286 		    ill_prim,
17287 		    GLOBAL_ZONEID,	/* CGTP is only for the global zone */
17288 		    ire->ire_flags | RTF_KERNEL,
17289 		    NULL,
17290 		    ipst);
17291 
17292 		/*
17293 		 * Here we assume that ire_add does head insertion so that
17294 		 * the added IRE_BROADCAST comes before the existing IRE_HOST.
17295 		 */
17296 		if (bcast_ire != NULL) {
17297 			if (ire->ire_flags & RTF_SETSRC) {
17298 				bcast_ire->ire_setsrc_addr =
17299 				    ire->ire_setsrc_addr;
17300 			}
17301 			bcast_ire = ire_add(bcast_ire);
17302 			if (bcast_ire != NULL) {
17303 				ip2dbg(("ip_cgtp_filter_bcast_add: "
17304 				    "added bcast_ire %p\n",
17305 				    (void *)bcast_ire));
17306 
17307 				ill_save_ire(ill_prim, bcast_ire);
17308 				ire_refrele(bcast_ire);
17309 			}
17310 		}
17311 		ire_refrele(ire_prim);
17312 	}
17313 }
17314 
17315 /*
17316  * IP multirouting broadcast routes handling
17317  * Remove the broadcast ire.
17318  * The usage is a route delete <cgtp_bc> <nic_bc> -multirt i.e., both
17319  * the destination and the gateway are broadcast addresses.
17320  * The caller has only verified that RTF_MULTIRT was set. We check
17321  * that the destination is broadcast and that the gateway is a broadcast
17322  * address, and if so delete the IRE added by ip_cgtp_bcast_add().
17323  */
17324 static void
17325 ip_cgtp_bcast_delete(ire_t *ire, ip_stack_t *ipst)
17326 {
17327 	ASSERT(ire != NULL);
17328 
17329 	if (ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST) {
17330 		ire_t *ire_prim;
17331 
17332 		ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17333 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0,
17334 		    ipst, NULL);
17335 		if (ire_prim != NULL) {
17336 			ill_t *ill_prim;
17337 			ire_t  *bcast_ire;
17338 
17339 			ill_prim = ire_prim->ire_ill;
17340 
17341 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
17342 			    "ire_prim %p, ill_prim %p\n",
17343 			    (void *)ire_prim, (void *)ill_prim));
17344 
17345 			bcast_ire = ire_ftable_lookup_v4(ire->ire_addr, 0,
17346 			    ire->ire_gateway_addr, IRE_BROADCAST,
17347 			    ill_prim, ALL_ZONES, NULL,
17348 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_ILL |
17349 			    MATCH_IRE_MASK, 0, ipst, NULL);
17350 
17351 			if (bcast_ire != NULL) {
17352 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
17353 				    "looked up bcast_ire %p\n",
17354 				    (void *)bcast_ire));
17355 				ill_remove_saved_ire(bcast_ire->ire_ill,
17356 				    bcast_ire);
17357 				ire_delete(bcast_ire);
17358 				ire_refrele(bcast_ire);
17359 			}
17360 			ire_refrele(ire_prim);
17361 		}
17362 	}
17363 }
17364 
17365 /*
17366  * Derive an interface id from the link layer address.
17367  * Knows about IEEE 802 and IEEE EUI-64 mappings.
17368  */
17369 static void
17370 ip_ether_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17371 {
17372 	char		*addr;
17373 
17374 	/*
17375 	 * Note that some IPv6 interfaces get plumbed over links that claim to
17376 	 * be DL_ETHER, but don't actually have Ethernet MAC addresses (e.g.
17377 	 * PPP links).  The ETHERADDRL check here ensures that we only set the
17378 	 * interface ID on IPv6 interfaces above links that actually have real
17379 	 * Ethernet addresses.
17380 	 */
17381 	if (ill->ill_phys_addr_length == ETHERADDRL) {
17382 		/* Form EUI-64 like address */
17383 		addr = (char *)&v6addr->s6_addr32[2];
17384 		bcopy(ill->ill_phys_addr, addr, 3);
17385 		addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
17386 		addr[3] = (char)0xff;
17387 		addr[4] = (char)0xfe;
17388 		bcopy(ill->ill_phys_addr + 3, addr + 5, 3);
17389 	}
17390 }
17391 
17392 /* ARGSUSED */
17393 static void
17394 ip_nodef_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17395 {
17396 }
17397 
17398 typedef struct ipmp_ifcookie {
17399 	uint32_t	ic_hostid;
17400 	char		ic_ifname[LIFNAMSIZ];
17401 	char		ic_zonename[ZONENAME_MAX];
17402 } ipmp_ifcookie_t;
17403 
17404 /*
17405  * Construct a pseudo-random interface ID for the IPMP interface that's both
17406  * predictable and (almost) guaranteed to be unique.
17407  */
17408 static void
17409 ip_ipmp_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17410 {
17411 	zone_t		*zp;
17412 	uint8_t		*addr;
17413 	uchar_t		hash[16];
17414 	ulong_t 	hostid;
17415 	MD5_CTX		ctx;
17416 	ipmp_ifcookie_t	ic = { 0 };
17417 
17418 	ASSERT(IS_IPMP(ill));
17419 
17420 	(void) ddi_strtoul(hw_serial, NULL, 10, &hostid);
17421 	ic.ic_hostid = htonl((uint32_t)hostid);
17422 
17423 	(void) strlcpy(ic.ic_ifname, ill->ill_name, LIFNAMSIZ);
17424 
17425 	if ((zp = zone_find_by_id(ill->ill_zoneid)) != NULL) {
17426 		(void) strlcpy(ic.ic_zonename, zp->zone_name, ZONENAME_MAX);
17427 		zone_rele(zp);
17428 	}
17429 
17430 	MD5Init(&ctx);
17431 	MD5Update(&ctx, &ic, sizeof (ic));
17432 	MD5Final(hash, &ctx);
17433 
17434 	/*
17435 	 * Map the hash to an interface ID per the basic approach in RFC3041.
17436 	 */
17437 	addr = &v6addr->s6_addr8[8];
17438 	bcopy(hash + 8, addr, sizeof (uint64_t));
17439 	addr[0] &= ~0x2;				/* set local bit */
17440 }
17441 
17442 /*
17443  * Map the multicast in6_addr_t in m_ip6addr to the physaddr for ethernet.
17444  */
17445 static void
17446 ip_ether_v6_mapping(ill_t *ill, uchar_t *m_ip6addr, uchar_t *m_physaddr)
17447 {
17448 	phyint_t *phyi = ill->ill_phyint;
17449 
17450 	/*
17451 	 * Check PHYI_MULTI_BCAST and length of physical
17452 	 * address to determine if we use the mapping or the
17453 	 * broadcast address.
17454 	 */
17455 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17456 	    ill->ill_phys_addr_length != ETHERADDRL) {
17457 		ip_mbcast_mapping(ill, m_ip6addr, m_physaddr);
17458 		return;
17459 	}
17460 	m_physaddr[0] = 0x33;
17461 	m_physaddr[1] = 0x33;
17462 	m_physaddr[2] = m_ip6addr[12];
17463 	m_physaddr[3] = m_ip6addr[13];
17464 	m_physaddr[4] = m_ip6addr[14];
17465 	m_physaddr[5] = m_ip6addr[15];
17466 }
17467 
17468 /*
17469  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for ethernet.
17470  */
17471 static void
17472 ip_ether_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17473 {
17474 	phyint_t *phyi = ill->ill_phyint;
17475 
17476 	/*
17477 	 * Check PHYI_MULTI_BCAST and length of physical
17478 	 * address to determine if we use the mapping or the
17479 	 * broadcast address.
17480 	 */
17481 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17482 	    ill->ill_phys_addr_length != ETHERADDRL) {
17483 		ip_mbcast_mapping(ill, m_ipaddr, m_physaddr);
17484 		return;
17485 	}
17486 	m_physaddr[0] = 0x01;
17487 	m_physaddr[1] = 0x00;
17488 	m_physaddr[2] = 0x5e;
17489 	m_physaddr[3] = m_ipaddr[1] & 0x7f;
17490 	m_physaddr[4] = m_ipaddr[2];
17491 	m_physaddr[5] = m_ipaddr[3];
17492 }
17493 
17494 /* ARGSUSED */
17495 static void
17496 ip_mbcast_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17497 {
17498 	/*
17499 	 * for the MULTI_BCAST case and other cases when we want to
17500 	 * use the link-layer broadcast address for multicast.
17501 	 */
17502 	uint8_t	*bphys_addr;
17503 	dl_unitdata_req_t *dlur;
17504 
17505 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17506 	if (ill->ill_sap_length < 0) {
17507 		bphys_addr = (uchar_t *)dlur +
17508 		    dlur->dl_dest_addr_offset;
17509 	} else  {
17510 		bphys_addr = (uchar_t *)dlur +
17511 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
17512 	}
17513 
17514 	bcopy(bphys_addr, m_physaddr, ill->ill_phys_addr_length);
17515 }
17516 
17517 /*
17518  * Derive IPoIB interface id from the link layer address.
17519  */
17520 static void
17521 ip_ib_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17522 {
17523 	char		*addr;
17524 
17525 	ASSERT(ill->ill_phys_addr_length == 20);
17526 	addr = (char *)&v6addr->s6_addr32[2];
17527 	bcopy(ill->ill_phys_addr + 12, addr, 8);
17528 	/*
17529 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
17530 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
17531 	 * rules. In these cases, the IBA considers these GUIDs to be in
17532 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
17533 	 * required; vendors are required not to assign global EUI-64's
17534 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
17535 	 * of the interface identifier. Whether the GUID is in modified
17536 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
17537 	 * bit set to 1.
17538 	 */
17539 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
17540 }
17541 
17542 /*
17543  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for InfiniBand.
17544  * Note on mapping from multicast IP addresses to IPoIB multicast link
17545  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
17546  * The format of an IPoIB multicast address is:
17547  *
17548  *  4 byte QPN      Scope Sign.  Pkey
17549  * +--------------------------------------------+
17550  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
17551  * +--------------------------------------------+
17552  *
17553  * The Scope and Pkey components are properties of the IBA port and
17554  * network interface. They can be ascertained from the broadcast address.
17555  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
17556  */
17557 static void
17558 ip_ib_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17559 {
17560 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17561 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
17562 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17563 	uint8_t	*bphys_addr;
17564 	dl_unitdata_req_t *dlur;
17565 
17566 	bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17567 
17568 	/*
17569 	 * RFC 4391: IPv4 MGID is 28-bit long.
17570 	 */
17571 	m_physaddr[16] = m_ipaddr[0] & 0x0f;
17572 	m_physaddr[17] = m_ipaddr[1];
17573 	m_physaddr[18] = m_ipaddr[2];
17574 	m_physaddr[19] = m_ipaddr[3];
17575 
17576 
17577 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17578 	if (ill->ill_sap_length < 0) {
17579 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17580 	} else  {
17581 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17582 		    ill->ill_sap_length;
17583 	}
17584 	/*
17585 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
17586 	 */
17587 	m_physaddr[5] = bphys_addr[5];
17588 	m_physaddr[8] = bphys_addr[8];
17589 	m_physaddr[9] = bphys_addr[9];
17590 }
17591 
17592 static void
17593 ip_ib_v6_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17594 {
17595 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17596 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
17597 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17598 	uint8_t	*bphys_addr;
17599 	dl_unitdata_req_t *dlur;
17600 
17601 	bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17602 
17603 	/*
17604 	 * RFC 4391: IPv4 MGID is 80-bit long.
17605 	 */
17606 	bcopy(&m_ipaddr[6], &m_physaddr[10], 10);
17607 
17608 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17609 	if (ill->ill_sap_length < 0) {
17610 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17611 	} else  {
17612 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17613 		    ill->ill_sap_length;
17614 	}
17615 	/*
17616 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
17617 	 */
17618 	m_physaddr[5] = bphys_addr[5];
17619 	m_physaddr[8] = bphys_addr[8];
17620 	m_physaddr[9] = bphys_addr[9];
17621 }
17622 
17623 /*
17624  * Derive IPv6 interface id from an IPv4 link-layer address (e.g. from an IPv4
17625  * tunnel).  The IPv4 address simply get placed in the lower 4 bytes of the
17626  * IPv6 interface id.  This is a suggested mechanism described in section 3.7
17627  * of RFC4213.
17628  */
17629 static void
17630 ip_ipv4_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17631 {
17632 	ASSERT(ill->ill_phys_addr_length == sizeof (ipaddr_t));
17633 	v6addr->s6_addr32[2] = 0;
17634 	bcopy(physaddr, &v6addr->s6_addr32[3], sizeof (ipaddr_t));
17635 }
17636 
17637 /*
17638  * Derive IPv6 interface id from an IPv6 link-layer address (e.g. from an IPv6
17639  * tunnel).  The lower 8 bytes of the IPv6 address simply become the interface
17640  * id.
17641  */
17642 static void
17643 ip_ipv6_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17644 {
17645 	in6_addr_t *v6lladdr = (in6_addr_t *)physaddr;
17646 
17647 	ASSERT(ill->ill_phys_addr_length == sizeof (in6_addr_t));
17648 	bcopy(&v6lladdr->s6_addr32[2], &v6addr->s6_addr32[2], 8);
17649 }
17650 
17651 static void
17652 ip_ipv6_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17653 {
17654 	ip_ipv6_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17655 }
17656 
17657 static void
17658 ip_ipv6_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17659 {
17660 	ip_ipv6_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17661 }
17662 
17663 static void
17664 ip_ipv4_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17665 {
17666 	ip_ipv4_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17667 }
17668 
17669 static void
17670 ip_ipv4_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17671 {
17672 	ip_ipv4_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17673 }
17674 
17675 /*
17676  * Lookup an ill and verify that the zoneid has an ipif on that ill.
17677  * Returns an held ill, or NULL.
17678  */
17679 ill_t *
17680 ill_lookup_on_ifindex_zoneid(uint_t index, zoneid_t zoneid, boolean_t isv6,
17681     ip_stack_t *ipst)
17682 {
17683 	ill_t	*ill;
17684 	ipif_t	*ipif;
17685 
17686 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
17687 	if (ill == NULL)
17688 		return (NULL);
17689 
17690 	mutex_enter(&ill->ill_lock);
17691 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17692 		if (IPIF_IS_CONDEMNED(ipif))
17693 			continue;
17694 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
17695 		    ipif->ipif_zoneid != ALL_ZONES)
17696 			continue;
17697 
17698 		mutex_exit(&ill->ill_lock);
17699 		return (ill);
17700 	}
17701 	mutex_exit(&ill->ill_lock);
17702 	ill_refrele(ill);
17703 	return (NULL);
17704 }
17705 
17706 /*
17707  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
17708  * If a pointer to an ipif_t is returned then the caller will need to do
17709  * an ill_refrele().
17710  */
17711 ipif_t *
17712 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6,
17713     ip_stack_t *ipst)
17714 {
17715 	ipif_t *ipif;
17716 	ill_t *ill;
17717 
17718 	ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
17719 	if (ill == NULL)
17720 		return (NULL);
17721 
17722 	mutex_enter(&ill->ill_lock);
17723 	if (ill->ill_state_flags & ILL_CONDEMNED) {
17724 		mutex_exit(&ill->ill_lock);
17725 		ill_refrele(ill);
17726 		return (NULL);
17727 	}
17728 
17729 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17730 		if (!IPIF_CAN_LOOKUP(ipif))
17731 			continue;
17732 		if (lifidx == ipif->ipif_id) {
17733 			ipif_refhold_locked(ipif);
17734 			break;
17735 		}
17736 	}
17737 
17738 	mutex_exit(&ill->ill_lock);
17739 	ill_refrele(ill);
17740 	return (ipif);
17741 }
17742 
17743 /*
17744  * Set ill_inputfn based on the current know state.
17745  * This needs to be called when any of the factors taken into
17746  * account changes.
17747  */
17748 void
17749 ill_set_inputfn(ill_t *ill)
17750 {
17751 	ip_stack_t	*ipst = ill->ill_ipst;
17752 
17753 	if (ill->ill_isv6) {
17754 		if (is_system_labeled())
17755 			ill->ill_inputfn = ill_input_full_v6;
17756 		else
17757 			ill->ill_inputfn = ill_input_short_v6;
17758 	} else {
17759 		if (is_system_labeled())
17760 			ill->ill_inputfn = ill_input_full_v4;
17761 		else if (ill->ill_dhcpinit != 0)
17762 			ill->ill_inputfn = ill_input_full_v4;
17763 		else if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head
17764 		    != NULL)
17765 			ill->ill_inputfn = ill_input_full_v4;
17766 		else if (ipst->ips_ip_cgtp_filter &&
17767 		    ipst->ips_ip_cgtp_filter_ops != NULL)
17768 			ill->ill_inputfn = ill_input_full_v4;
17769 		else
17770 			ill->ill_inputfn = ill_input_short_v4;
17771 	}
17772 }
17773 
17774 /*
17775  * Re-evaluate ill_inputfn for all the IPv4 ills.
17776  * Used when RSVP and CGTP comes and goes.
17777  */
17778 void
17779 ill_set_inputfn_all(ip_stack_t *ipst)
17780 {
17781 	ill_walk_context_t	ctx;
17782 	ill_t			*ill;
17783 
17784 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
17785 	ill = ILL_START_WALK_V4(&ctx, ipst);
17786 	for (; ill != NULL; ill = ill_next(&ctx, ill))
17787 		ill_set_inputfn(ill);
17788 
17789 	rw_exit(&ipst->ips_ill_g_lock);
17790 }
17791 
17792 /*
17793  * Set the physical address information for `ill' to the contents of the
17794  * dl_notify_ind_t pointed to by `mp'.  Must be called as writer, and will be
17795  * asynchronous if `ill' cannot immediately be quiesced -- in which case
17796  * EINPROGRESS will be returned.
17797  */
17798 int
17799 ill_set_phys_addr(ill_t *ill, mblk_t *mp)
17800 {
17801 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17802 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)mp->b_rptr;
17803 
17804 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17805 
17806 	if (dlindp->dl_data != DL_IPV6_LINK_LAYER_ADDR &&
17807 	    dlindp->dl_data != DL_CURR_DEST_ADDR &&
17808 	    dlindp->dl_data != DL_CURR_PHYS_ADDR) {
17809 		/* Changing DL_IPV6_TOKEN is not yet supported */
17810 		return (0);
17811 	}
17812 
17813 	/*
17814 	 * We need to store up to two copies of `mp' in `ill'.  Due to the
17815 	 * design of ipsq_pending_mp_add(), we can't pass them as separate
17816 	 * arguments to ill_set_phys_addr_tail().  Instead, chain them
17817 	 * together here, then pull 'em apart in ill_set_phys_addr_tail().
17818 	 */
17819 	if ((mp = copyb(mp)) == NULL || (mp->b_cont = copyb(mp)) == NULL) {
17820 		freemsg(mp);
17821 		return (ENOMEM);
17822 	}
17823 
17824 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
17825 
17826 	/*
17827 	 * Since we'll only do a logical down, we can't rely on ipif_down
17828 	 * to turn on ILL_DOWN_IN_PROGRESS, or for the DL_BIND_ACK to reset
17829 	 * ILL_DOWN_IN_PROGRESS. We instead manage this separately for this
17830 	 * case, to quiesce ire's and nce's for ill_is_quiescent.
17831 	 */
17832 	mutex_enter(&ill->ill_lock);
17833 	ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
17834 	/* no more ire/nce addition allowed */
17835 	mutex_exit(&ill->ill_lock);
17836 
17837 	/*
17838 	 * If we can quiesce the ill, then set the address.  If not, then
17839 	 * ill_set_phys_addr_tail() will be called from ipif_ill_refrele_tail().
17840 	 */
17841 	ill_down_ipifs(ill, B_TRUE);
17842 	mutex_enter(&ill->ill_lock);
17843 	if (!ill_is_quiescent(ill)) {
17844 		/* call cannot fail since `conn_t *' argument is NULL */
17845 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
17846 		    mp, ILL_DOWN);
17847 		mutex_exit(&ill->ill_lock);
17848 		return (EINPROGRESS);
17849 	}
17850 	mutex_exit(&ill->ill_lock);
17851 
17852 	ill_set_phys_addr_tail(ipsq, ill->ill_rq, mp, NULL);
17853 	return (0);
17854 }
17855 
17856 /*
17857  * When the allowed-ips link property is set on the datalink, IP receives a
17858  * DL_NOTE_ALLOWED_IPS notification that is processed in ill_set_allowed_ips()
17859  * to initialize the ill_allowed_ips[] array in the ill_t. This array is then
17860  * used to vet addresses passed to ip_sioctl_addr() and to ensure that the
17861  * only IP addresses configured on the ill_t are those in the ill_allowed_ips[]
17862  * array.
17863  */
17864 void
17865 ill_set_allowed_ips(ill_t *ill, mblk_t *mp)
17866 {
17867 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17868 	dl_notify_ind_t	*dlip = (dl_notify_ind_t *)mp->b_rptr;
17869 	mac_protect_t *mrp;
17870 	int i;
17871 
17872 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17873 	mrp = (mac_protect_t *)&dlip[1];
17874 
17875 	if (mrp->mp_ipaddrcnt == 0) { /* reset allowed-ips */
17876 		kmem_free(ill->ill_allowed_ips,
17877 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17878 		ill->ill_allowed_ips_cnt = 0;
17879 		ill->ill_allowed_ips = NULL;
17880 		mutex_enter(&ill->ill_phyint->phyint_lock);
17881 		ill->ill_phyint->phyint_flags &= ~PHYI_L3PROTECT;
17882 		mutex_exit(&ill->ill_phyint->phyint_lock);
17883 		return;
17884 	}
17885 
17886 	if (ill->ill_allowed_ips != NULL) {
17887 		kmem_free(ill->ill_allowed_ips,
17888 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17889 	}
17890 	ill->ill_allowed_ips_cnt = mrp->mp_ipaddrcnt;
17891 	ill->ill_allowed_ips = kmem_alloc(
17892 	    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t), KM_SLEEP);
17893 	for (i = 0; i < mrp->mp_ipaddrcnt;  i++)
17894 		ill->ill_allowed_ips[i] = mrp->mp_ipaddrs[i].ip_addr;
17895 
17896 	mutex_enter(&ill->ill_phyint->phyint_lock);
17897 	ill->ill_phyint->phyint_flags |= PHYI_L3PROTECT;
17898 	mutex_exit(&ill->ill_phyint->phyint_lock);
17899 }
17900 
17901 /*
17902  * Once the ill associated with `q' has quiesced, set its physical address
17903  * information to the values in `addrmp'.  Note that two copies of `addrmp'
17904  * are passed (linked by b_cont), since we sometimes need to save two distinct
17905  * copies in the ill_t, and our context doesn't permit sleeping or allocation
17906  * failure (we'll free the other copy if it's not needed).  Since the ill_t
17907  * is quiesced, we know any stale nce's with the old address information have
17908  * already been removed, so we don't need to call nce_flush().
17909  */
17910 /* ARGSUSED */
17911 static void
17912 ill_set_phys_addr_tail(ipsq_t *ipsq, queue_t *q, mblk_t *addrmp, void *dummy)
17913 {
17914 	ill_t		*ill = q->q_ptr;
17915 	mblk_t		*addrmp2 = unlinkb(addrmp);
17916 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)addrmp->b_rptr;
17917 	uint_t		addrlen, addroff;
17918 	int		status;
17919 
17920 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17921 
17922 	addroff	= dlindp->dl_addr_offset;
17923 	addrlen = dlindp->dl_addr_length - ABS(ill->ill_sap_length);
17924 
17925 	switch (dlindp->dl_data) {
17926 	case DL_IPV6_LINK_LAYER_ADDR:
17927 		ill_set_ndmp(ill, addrmp, addroff, addrlen);
17928 		freemsg(addrmp2);
17929 		break;
17930 
17931 	case DL_CURR_DEST_ADDR:
17932 		freemsg(ill->ill_dest_addr_mp);
17933 		ill->ill_dest_addr = addrmp->b_rptr + addroff;
17934 		ill->ill_dest_addr_mp = addrmp;
17935 		if (ill->ill_isv6) {
17936 			ill_setdesttoken(ill);
17937 			ipif_setdestlinklocal(ill->ill_ipif);
17938 		}
17939 		freemsg(addrmp2);
17940 		break;
17941 
17942 	case DL_CURR_PHYS_ADDR:
17943 		freemsg(ill->ill_phys_addr_mp);
17944 		ill->ill_phys_addr = addrmp->b_rptr + addroff;
17945 		ill->ill_phys_addr_mp = addrmp;
17946 		ill->ill_phys_addr_length = addrlen;
17947 		if (ill->ill_isv6)
17948 			ill_set_ndmp(ill, addrmp2, addroff, addrlen);
17949 		else
17950 			freemsg(addrmp2);
17951 		if (ill->ill_isv6) {
17952 			ill_setdefaulttoken(ill);
17953 			ipif_setlinklocal(ill->ill_ipif);
17954 		}
17955 		break;
17956 	default:
17957 		ASSERT(0);
17958 	}
17959 
17960 	/*
17961 	 * reset ILL_DOWN_IN_PROGRESS so that we can successfully add ires
17962 	 * as we bring the ipifs up again.
17963 	 */
17964 	mutex_enter(&ill->ill_lock);
17965 	ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
17966 	mutex_exit(&ill->ill_lock);
17967 	/*
17968 	 * If there are ipifs to bring up, ill_up_ipifs() will return
17969 	 * EINPROGRESS, and ipsq_current_finish() will be called by
17970 	 * ip_rput_dlpi_writer() or arp_bringup_done() when the last ipif is
17971 	 * brought up.
17972 	 */
17973 	status = ill_up_ipifs(ill, q, addrmp);
17974 	if (status != EINPROGRESS)
17975 		ipsq_current_finish(ipsq);
17976 }
17977 
17978 /*
17979  * Helper routine for setting the ill_nd_lla fields.
17980  */
17981 void
17982 ill_set_ndmp(ill_t *ill, mblk_t *ndmp, uint_t addroff, uint_t addrlen)
17983 {
17984 	freemsg(ill->ill_nd_lla_mp);
17985 	ill->ill_nd_lla = ndmp->b_rptr + addroff;
17986 	ill->ill_nd_lla_mp = ndmp;
17987 	ill->ill_nd_lla_len = addrlen;
17988 }
17989 
17990 /*
17991  * Replumb the ill.
17992  */
17993 int
17994 ill_replumb(ill_t *ill, mblk_t *mp)
17995 {
17996 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17997 
17998 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17999 
18000 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
18001 
18002 	/*
18003 	 * If we can quiesce the ill, then continue.  If not, then
18004 	 * ill_replumb_tail() will be called from ipif_ill_refrele_tail().
18005 	 */
18006 	ill_down_ipifs(ill, B_FALSE);
18007 
18008 	mutex_enter(&ill->ill_lock);
18009 	if (!ill_is_quiescent(ill)) {
18010 		/* call cannot fail since `conn_t *' argument is NULL */
18011 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
18012 		    mp, ILL_DOWN);
18013 		mutex_exit(&ill->ill_lock);
18014 		return (EINPROGRESS);
18015 	}
18016 	mutex_exit(&ill->ill_lock);
18017 
18018 	ill_replumb_tail(ipsq, ill->ill_rq, mp, NULL);
18019 	return (0);
18020 }
18021 
18022 /* ARGSUSED */
18023 static void
18024 ill_replumb_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
18025 {
18026 	ill_t *ill = q->q_ptr;
18027 	int err;
18028 	conn_t *connp = NULL;
18029 
18030 	ASSERT(IAM_WRITER_IPSQ(ipsq));
18031 	freemsg(ill->ill_replumb_mp);
18032 	ill->ill_replumb_mp = copyb(mp);
18033 
18034 	if (ill->ill_replumb_mp == NULL) {
18035 		/* out of memory */
18036 		ipsq_current_finish(ipsq);
18037 		return;
18038 	}
18039 
18040 	mutex_enter(&ill->ill_lock);
18041 	ill->ill_up_ipifs = ipsq_pending_mp_add(NULL, ill->ill_ipif,
18042 	    ill->ill_rq, ill->ill_replumb_mp, 0);
18043 	mutex_exit(&ill->ill_lock);
18044 
18045 	if (!ill->ill_up_ipifs) {
18046 		/* already closing */
18047 		ipsq_current_finish(ipsq);
18048 		return;
18049 	}
18050 	ill->ill_replumbing = 1;
18051 	err = ill_down_ipifs_tail(ill);
18052 
18053 	/*
18054 	 * Successfully quiesced and brought down the interface, now we send
18055 	 * the DL_NOTE_REPLUMB_DONE message down to the driver. Reuse the
18056 	 * DL_NOTE_REPLUMB message.
18057 	 */
18058 	mp = mexchange(NULL, mp, sizeof (dl_notify_conf_t), M_PROTO,
18059 	    DL_NOTIFY_CONF);
18060 	ASSERT(mp != NULL);
18061 	((dl_notify_conf_t *)mp->b_rptr)->dl_notification =
18062 	    DL_NOTE_REPLUMB_DONE;
18063 	ill_dlpi_send(ill, mp);
18064 
18065 	/*
18066 	 * For IPv4, we would usually get EINPROGRESS because the ETHERTYPE_ARP
18067 	 * streams have to be unbound. When all the DLPI exchanges are done,
18068 	 * ipsq_current_finish() will be called by arp_bringup_done(). The
18069 	 * remainder of ipif bringup via ill_up_ipifs() will also be done in
18070 	 * arp_bringup_done().
18071 	 */
18072 	ASSERT(ill->ill_replumb_mp != NULL);
18073 	if (err == EINPROGRESS)
18074 		return;
18075 	else
18076 		ill->ill_replumb_mp = ipsq_pending_mp_get(ipsq, &connp);
18077 	ASSERT(connp == NULL);
18078 	if (err == 0 && ill->ill_replumb_mp != NULL &&
18079 	    ill_up_ipifs(ill, q, ill->ill_replumb_mp) == EINPROGRESS) {
18080 		return;
18081 	}
18082 	ipsq_current_finish(ipsq);
18083 }
18084 
18085 /*
18086  * Issue ioctl `cmd' on `lh'; caller provides the initial payload in `buf'
18087  * which is `bufsize' bytes.  On success, zero is returned and `buf' updated
18088  * as per the ioctl.  On failure, an errno is returned.
18089  */
18090 static int
18091 ip_ioctl(ldi_handle_t lh, int cmd, void *buf, uint_t bufsize, cred_t *cr)
18092 {
18093 	int rval;
18094 	struct strioctl iocb;
18095 
18096 	iocb.ic_cmd = cmd;
18097 	iocb.ic_timout = 15;
18098 	iocb.ic_len = bufsize;
18099 	iocb.ic_dp = buf;
18100 
18101 	return (ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval));
18102 }
18103 
18104 /*
18105  * Issue an SIOCGLIFCONF for address family `af' and store the result into a
18106  * dynamically-allocated `lifcp' that will be `bufsizep' bytes on success.
18107  */
18108 static int
18109 ip_lifconf_ioctl(ldi_handle_t lh, int af, struct lifconf *lifcp,
18110     uint_t *bufsizep, cred_t *cr)
18111 {
18112 	int err;
18113 	struct lifnum lifn;
18114 
18115 	bzero(&lifn, sizeof (lifn));
18116 	lifn.lifn_family = af;
18117 	lifn.lifn_flags = LIFC_UNDER_IPMP;
18118 
18119 	if ((err = ip_ioctl(lh, SIOCGLIFNUM, &lifn, sizeof (lifn), cr)) != 0)
18120 		return (err);
18121 
18122 	/*
18123 	 * Pad the interface count to account for additional interfaces that
18124 	 * may have been configured between the SIOCGLIFNUM and SIOCGLIFCONF.
18125 	 */
18126 	lifn.lifn_count += 4;
18127 	bzero(lifcp, sizeof (*lifcp));
18128 	lifcp->lifc_flags = LIFC_UNDER_IPMP;
18129 	lifcp->lifc_family = af;
18130 	lifcp->lifc_len = *bufsizep = lifn.lifn_count * sizeof (struct lifreq);
18131 	lifcp->lifc_buf = kmem_zalloc(*bufsizep, KM_SLEEP);
18132 
18133 	err = ip_ioctl(lh, SIOCGLIFCONF, lifcp, sizeof (*lifcp), cr);
18134 	if (err != 0) {
18135 		kmem_free(lifcp->lifc_buf, *bufsizep);
18136 		return (err);
18137 	}
18138 
18139 	return (0);
18140 }
18141 
18142 /*
18143  * Helper for ip_interface_cleanup() that removes the loopback interface.
18144  */
18145 static void
18146 ip_loopback_removeif(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18147 {
18148 	int err;
18149 	struct lifreq lifr;
18150 
18151 	bzero(&lifr, sizeof (lifr));
18152 	(void) strcpy(lifr.lifr_name, ipif_loopback_name);
18153 
18154 	/*
18155 	 * Attempt to remove the interface.  It may legitimately not exist
18156 	 * (e.g. the zone administrator unplumbed it), so ignore ENXIO.
18157 	 */
18158 	err = ip_ioctl(lh, SIOCLIFREMOVEIF, &lifr, sizeof (lifr), cr);
18159 	if (err != 0 && err != ENXIO) {
18160 		ip0dbg(("ip_loopback_removeif: IP%s SIOCLIFREMOVEIF failed: "
18161 		    "error %d\n", isv6 ? "v6" : "v4", err));
18162 	}
18163 }
18164 
18165 /*
18166  * Helper for ip_interface_cleanup() that ensures no IP interfaces are in IPMP
18167  * groups and that IPMP data addresses are down.  These conditions must be met
18168  * so that IPMP interfaces can be I_PUNLINK'd, as per ip_sioctl_plink_ipmp().
18169  */
18170 static void
18171 ip_ipmp_cleanup(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18172 {
18173 	int af = isv6 ? AF_INET6 : AF_INET;
18174 	int i, nifs;
18175 	int err;
18176 	uint_t bufsize;
18177 	uint_t lifrsize = sizeof (struct lifreq);
18178 	struct lifconf lifc;
18179 	struct lifreq *lifrp;
18180 
18181 	if ((err = ip_lifconf_ioctl(lh, af, &lifc, &bufsize, cr)) != 0) {
18182 		cmn_err(CE_WARN, "ip_ipmp_cleanup: cannot get interface list "
18183 		    "(error %d); any IPMP interfaces cannot be shutdown", err);
18184 		return;
18185 	}
18186 
18187 	nifs = lifc.lifc_len / lifrsize;
18188 	for (lifrp = lifc.lifc_req, i = 0; i < nifs; i++, lifrp++) {
18189 		err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18190 		if (err != 0) {
18191 			cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot get "
18192 			    "flags: error %d", lifrp->lifr_name, err);
18193 			continue;
18194 		}
18195 
18196 		if (lifrp->lifr_flags & IFF_IPMP) {
18197 			if ((lifrp->lifr_flags & (IFF_UP|IFF_DUPLICATE)) == 0)
18198 				continue;
18199 
18200 			lifrp->lifr_flags &= ~IFF_UP;
18201 			err = ip_ioctl(lh, SIOCSLIFFLAGS, lifrp, lifrsize, cr);
18202 			if (err != 0) {
18203 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18204 				    "bring down (error %d); IPMP interface may "
18205 				    "not be shutdown", lifrp->lifr_name, err);
18206 			}
18207 
18208 			/*
18209 			 * Check if IFF_DUPLICATE is still set -- and if so,
18210 			 * reset the address to clear it.
18211 			 */
18212 			err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18213 			if (err != 0 || !(lifrp->lifr_flags & IFF_DUPLICATE))
18214 				continue;
18215 
18216 			err = ip_ioctl(lh, SIOCGLIFADDR, lifrp, lifrsize, cr);
18217 			if (err != 0 || (err = ip_ioctl(lh, SIOCGLIFADDR,
18218 			    lifrp, lifrsize, cr)) != 0) {
18219 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18220 				    "reset DAD (error %d); IPMP interface may "
18221 				    "not be shutdown", lifrp->lifr_name, err);
18222 			}
18223 			continue;
18224 		}
18225 
18226 		if (strchr(lifrp->lifr_name, IPIF_SEPARATOR_CHAR) == 0) {
18227 			lifrp->lifr_groupname[0] = '\0';
18228 			if ((err = ip_ioctl(lh, SIOCSLIFGROUPNAME, lifrp,
18229 			    lifrsize, cr)) != 0) {
18230 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18231 				    "leave IPMP group (error %d); associated "
18232 				    "IPMP interface may not be shutdown",
18233 				    lifrp->lifr_name, err);
18234 				continue;
18235 			}
18236 		}
18237 	}
18238 
18239 	kmem_free(lifc.lifc_buf, bufsize);
18240 }
18241 
18242 #define	UDPDEV		"/devices/pseudo/udp@0:udp"
18243 #define	UDP6DEV		"/devices/pseudo/udp6@0:udp6"
18244 
18245 /*
18246  * Remove the loopback interfaces and prep the IPMP interfaces to be torn down.
18247  * Non-loopback interfaces are either I_LINK'd or I_PLINK'd; the former go away
18248  * when the user-level processes in the zone are killed and the latter are
18249  * cleaned up by str_stack_shutdown().
18250  */
18251 void
18252 ip_interface_cleanup(ip_stack_t *ipst)
18253 {
18254 	ldi_handle_t	lh;
18255 	ldi_ident_t	li;
18256 	cred_t		*cr;
18257 	int		err;
18258 	int		i;
18259 	char		*devs[] = { UDP6DEV, UDPDEV };
18260 	netstackid_t	stackid = ipst->ips_netstack->netstack_stackid;
18261 
18262 	if ((err = ldi_ident_from_major(ddi_name_to_major("ip"), &li)) != 0) {
18263 		cmn_err(CE_WARN, "ip_interface_cleanup: cannot get ldi ident:"
18264 		    " error %d", err);
18265 		return;
18266 	}
18267 
18268 	cr = zone_get_kcred(netstackid_to_zoneid(stackid));
18269 	ASSERT(cr != NULL);
18270 
18271 	/*
18272 	 * NOTE: loop executes exactly twice and is hardcoded to know that the
18273 	 * first iteration is IPv6.  (Unrolling yields repetitious code, hence
18274 	 * the loop.)
18275 	 */
18276 	for (i = 0; i < 2; i++) {
18277 		err = ldi_open_by_name(devs[i], FREAD|FWRITE, cr, &lh, li);
18278 		if (err != 0) {
18279 			cmn_err(CE_WARN, "ip_interface_cleanup: cannot open %s:"
18280 			    " error %d", devs[i], err);
18281 			continue;
18282 		}
18283 
18284 		ip_loopback_removeif(lh, i == 0, cr);
18285 		ip_ipmp_cleanup(lh, i == 0, cr);
18286 
18287 		(void) ldi_close(lh, FREAD|FWRITE, cr);
18288 	}
18289 
18290 	ldi_ident_release(li);
18291 	crfree(cr);
18292 }
18293 
18294 /*
18295  * This needs to be in-sync with nic_event_t definition
18296  */
18297 static const char *
18298 ill_hook_event2str(nic_event_t event)
18299 {
18300 	switch (event) {
18301 	case NE_PLUMB:
18302 		return ("PLUMB");
18303 	case NE_UNPLUMB:
18304 		return ("UNPLUMB");
18305 	case NE_UP:
18306 		return ("UP");
18307 	case NE_DOWN:
18308 		return ("DOWN");
18309 	case NE_ADDRESS_CHANGE:
18310 		return ("ADDRESS_CHANGE");
18311 	case NE_LIF_UP:
18312 		return ("LIF_UP");
18313 	case NE_LIF_DOWN:
18314 		return ("LIF_DOWN");
18315 	case NE_IFINDEX_CHANGE:
18316 		return ("IFINDEX_CHANGE");
18317 	default:
18318 		return ("UNKNOWN");
18319 	}
18320 }
18321 
18322 void
18323 ill_nic_event_dispatch(ill_t *ill, lif_if_t lif, nic_event_t event,
18324     nic_event_data_t data, size_t datalen)
18325 {
18326 	ip_stack_t		*ipst = ill->ill_ipst;
18327 	hook_nic_event_int_t	*info;
18328 	const char		*str = NULL;
18329 
18330 	/* create a new nic event info */
18331 	if ((info = kmem_alloc(sizeof (*info), KM_NOSLEEP)) == NULL)
18332 		goto fail;
18333 
18334 	info->hnei_event.hne_nic = ill->ill_phyint->phyint_ifindex;
18335 	info->hnei_event.hne_lif = lif;
18336 	info->hnei_event.hne_event = event;
18337 	info->hnei_event.hne_protocol = ill->ill_isv6 ?
18338 	    ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data;
18339 	info->hnei_event.hne_data = NULL;
18340 	info->hnei_event.hne_datalen = 0;
18341 	info->hnei_stackid = ipst->ips_netstack->netstack_stackid;
18342 
18343 	if (data != NULL && datalen != 0) {
18344 		info->hnei_event.hne_data = kmem_alloc(datalen, KM_NOSLEEP);
18345 		if (info->hnei_event.hne_data == NULL)
18346 			goto fail;
18347 		bcopy(data, info->hnei_event.hne_data, datalen);
18348 		info->hnei_event.hne_datalen = datalen;
18349 	}
18350 
18351 	if (ddi_taskq_dispatch(eventq_queue_nic, ip_ne_queue_func, info,
18352 	    DDI_NOSLEEP) == DDI_SUCCESS)
18353 		return;
18354 
18355 fail:
18356 	if (info != NULL) {
18357 		if (info->hnei_event.hne_data != NULL) {
18358 			kmem_free(info->hnei_event.hne_data,
18359 			    info->hnei_event.hne_datalen);
18360 		}
18361 		kmem_free(info, sizeof (hook_nic_event_t));
18362 	}
18363 	str = ill_hook_event2str(event);
18364 	ip2dbg(("ill_nic_event_dispatch: could not dispatch %s nic event "
18365 	    "information for %s (ENOMEM)\n", str, ill->ill_name));
18366 }
18367 
18368 static int
18369 ipif_arp_up_done_tail(ipif_t *ipif, enum ip_resolver_action res_act)
18370 {
18371 	int		err = 0;
18372 	const in_addr_t	*addr = NULL;
18373 	nce_t		*nce = NULL;
18374 	ill_t		*ill = ipif->ipif_ill;
18375 	ill_t		*bound_ill;
18376 	boolean_t	added_ipif = B_FALSE;
18377 	uint16_t	state;
18378 	uint16_t	flags;
18379 
18380 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up_done_tail",
18381 	    ill_t *, ill, ipif_t *, ipif);
18382 	if (ipif->ipif_lcl_addr != INADDR_ANY) {
18383 		addr = &ipif->ipif_lcl_addr;
18384 	}
18385 
18386 	if ((ipif->ipif_flags & IPIF_UNNUMBERED) || addr == NULL) {
18387 		if (res_act != Res_act_initial)
18388 			return (EINVAL);
18389 	}
18390 
18391 	if (addr != NULL) {
18392 		ipmp_illgrp_t	*illg = ill->ill_grp;
18393 
18394 		/* add unicast nce for the local addr */
18395 
18396 		if (IS_IPMP(ill)) {
18397 			/*
18398 			 * If we're here via ipif_up(), then the ipif
18399 			 * won't be bound yet -- add it to the group,
18400 			 * which will bind it if possible. (We would
18401 			 * add it in ipif_up(), but deleting on failure
18402 			 * there is gruesome.)  If we're here via
18403 			 * ipmp_ill_bind_ipif(), then the ipif has
18404 			 * already been added to the group and we
18405 			 * just need to use the binding.
18406 			 */
18407 			if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
18408 				bound_ill  = ipmp_illgrp_add_ipif(illg, ipif);
18409 				if (bound_ill == NULL) {
18410 					/*
18411 					 * We couldn't bind the ipif to an ill
18412 					 * yet, so we have nothing to publish.
18413 					 * Mark the address as ready and return.
18414 					 */
18415 					ipif->ipif_addr_ready = 1;
18416 					return (0);
18417 				}
18418 				added_ipif = B_TRUE;
18419 			}
18420 		} else {
18421 			bound_ill = ill;
18422 		}
18423 
18424 		flags = (NCE_F_MYADDR | NCE_F_PUBLISH | NCE_F_AUTHORITY |
18425 		    NCE_F_NONUD);
18426 		/*
18427 		 * If this is an initial bring-up (or the ipif was never
18428 		 * completely brought up), do DAD.  Otherwise, we're here
18429 		 * because IPMP has rebound an address to this ill: send
18430 		 * unsolicited advertisements (ARP announcements) to
18431 		 * inform others.
18432 		 */
18433 		if (res_act == Res_act_initial || !ipif->ipif_addr_ready) {
18434 			state = ND_UNCHANGED; /* compute in nce_add_common() */
18435 		} else {
18436 			state = ND_REACHABLE;
18437 			flags |= NCE_F_UNSOL_ADV;
18438 		}
18439 
18440 retry:
18441 		err = nce_lookup_then_add_v4(ill,
18442 		    bound_ill->ill_phys_addr, bound_ill->ill_phys_addr_length,
18443 		    addr, flags, state, &nce);
18444 
18445 		/*
18446 		 * note that we may encounter EEXIST if we are moving
18447 		 * the nce as a result of a rebind operation.
18448 		 */
18449 		switch (err) {
18450 		case 0:
18451 			ipif->ipif_added_nce = 1;
18452 			nce->nce_ipif_cnt++;
18453 			break;
18454 		case EEXIST:
18455 			ip1dbg(("ipif_arp_up: NCE already exists for %s\n",
18456 			    ill->ill_name));
18457 			if (!NCE_MYADDR(nce->nce_common)) {
18458 				/*
18459 				 * A leftover nce from before this address
18460 				 * existed
18461 				 */
18462 				ncec_delete(nce->nce_common);
18463 				nce_refrele(nce);
18464 				nce = NULL;
18465 				goto retry;
18466 			}
18467 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
18468 				nce_refrele(nce);
18469 				nce = NULL;
18470 				ip1dbg(("ipif_arp_up: NCE already exists "
18471 				    "for %s:%u\n", ill->ill_name,
18472 				    ipif->ipif_id));
18473 				goto arp_up_done;
18474 			}
18475 			/*
18476 			 * Duplicate local addresses are permissible for
18477 			 * IPIF_POINTOPOINT interfaces which will get marked
18478 			 * IPIF_UNNUMBERED later in
18479 			 * ip_addr_availability_check().
18480 			 *
18481 			 * The nce_ipif_cnt field tracks the number of
18482 			 * ipifs that have nce_addr as their local address.
18483 			 */
18484 			ipif->ipif_addr_ready = 1;
18485 			ipif->ipif_added_nce = 1;
18486 			nce->nce_ipif_cnt++;
18487 			err = 0;
18488 			break;
18489 		default:
18490 			ASSERT(nce == NULL);
18491 			goto arp_up_done;
18492 		}
18493 		if (arp_no_defense) {
18494 			if ((ipif->ipif_flags & IPIF_UP) &&
18495 			    !ipif->ipif_addr_ready)
18496 				ipif_up_notify(ipif);
18497 			ipif->ipif_addr_ready = 1;
18498 		}
18499 	} else {
18500 		/* zero address. nothing to publish */
18501 		ipif->ipif_addr_ready = 1;
18502 	}
18503 	if (nce != NULL)
18504 		nce_refrele(nce);
18505 arp_up_done:
18506 	if (added_ipif && err != 0)
18507 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18508 	return (err);
18509 }
18510 
18511 int
18512 ipif_arp_up(ipif_t *ipif, enum ip_resolver_action res_act, boolean_t was_dup)
18513 {
18514 	int 		err = 0;
18515 	ill_t 		*ill = ipif->ipif_ill;
18516 	boolean_t	first_interface, wait_for_dlpi = B_FALSE;
18517 
18518 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up",
18519 	    ill_t *, ill, ipif_t *, ipif);
18520 
18521 	/*
18522 	 * need to bring up ARP or setup mcast mapping only
18523 	 * when the first interface is coming UP.
18524 	 */
18525 	first_interface = (ill->ill_ipif_up_count == 0 &&
18526 	    ill->ill_ipif_dup_count == 0 && !was_dup);
18527 
18528 	if (res_act == Res_act_initial && first_interface) {
18529 		/*
18530 		 * Send ATTACH + BIND
18531 		 */
18532 		err = arp_ll_up(ill);
18533 		if (err != EINPROGRESS && err != 0)
18534 			return (err);
18535 
18536 		/*
18537 		 * Add NCE for local address. Start DAD.
18538 		 * we'll wait to hear that DAD has finished
18539 		 * before using the interface.
18540 		 */
18541 		if (err == EINPROGRESS)
18542 			wait_for_dlpi = B_TRUE;
18543 	}
18544 
18545 	if (!wait_for_dlpi)
18546 		(void) ipif_arp_up_done_tail(ipif, res_act);
18547 
18548 	return (!wait_for_dlpi ? 0 : EINPROGRESS);
18549 }
18550 
18551 /*
18552  * Finish processing of "arp_up" after all the DLPI message
18553  * exchanges have completed between arp and the driver.
18554  */
18555 void
18556 arp_bringup_done(ill_t *ill, int err)
18557 {
18558 	mblk_t	*mp1;
18559 	ipif_t  *ipif;
18560 	conn_t *connp = NULL;
18561 	ipsq_t	*ipsq;
18562 	queue_t *q;
18563 
18564 	ip1dbg(("arp_bringup_done(%s)\n", ill->ill_name));
18565 
18566 	ASSERT(IAM_WRITER_ILL(ill));
18567 
18568 	ipsq = ill->ill_phyint->phyint_ipsq;
18569 	ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18570 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
18571 	ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18572 	if (mp1 == NULL) /* bringup was aborted by the user */
18573 		return;
18574 
18575 	/*
18576 	 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18577 	 * must have an associated conn_t.  Otherwise, we're bringing this
18578 	 * interface back up as part of handling an asynchronous event (e.g.,
18579 	 * physical address change).
18580 	 */
18581 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18582 		ASSERT(connp != NULL);
18583 		q = CONNP_TO_WQ(connp);
18584 	} else {
18585 		ASSERT(connp == NULL);
18586 		q = ill->ill_rq;
18587 	}
18588 	if (err == 0) {
18589 		if (ipif->ipif_isv6) {
18590 			if ((err = ipif_up_done_v6(ipif)) != 0)
18591 				ip0dbg(("arp_bringup_done: init failed\n"));
18592 		} else {
18593 			err = ipif_arp_up_done_tail(ipif, Res_act_initial);
18594 			if (err != 0 ||
18595 			    (err = ipif_up_done(ipif)) != 0) {
18596 				ip0dbg(("arp_bringup_done: "
18597 				    "init failed err %x\n", err));
18598 				(void) ipif_arp_down(ipif);
18599 			}
18600 
18601 		}
18602 	} else {
18603 		ip0dbg(("arp_bringup_done: DL_BIND_REQ failed\n"));
18604 	}
18605 
18606 	if ((err == 0) && (ill->ill_up_ipifs)) {
18607 		err = ill_up_ipifs(ill, q, mp1);
18608 		if (err == EINPROGRESS)
18609 			return;
18610 	}
18611 
18612 	/*
18613 	 * If we have a moved ipif to bring up, and everything has succeeded
18614 	 * to this point, bring it up on the IPMP ill.  Otherwise, leave it
18615 	 * down -- the admin can try to bring it up by hand if need be.
18616 	 */
18617 	if (ill->ill_move_ipif != NULL) {
18618 		ipif = ill->ill_move_ipif;
18619 		ip1dbg(("bringing up ipif %p on ill %s\n", (void *)ipif,
18620 		    ipif->ipif_ill->ill_name));
18621 		ill->ill_move_ipif = NULL;
18622 		if (err == 0) {
18623 			err = ipif_up(ipif, q, mp1);
18624 			if (err == EINPROGRESS)
18625 				return;
18626 		}
18627 	}
18628 
18629 	/*
18630 	 * The operation must complete without EINPROGRESS since
18631 	 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18632 	 * Otherwise, the operation will be stuck forever in the ipsq.
18633 	 */
18634 	ASSERT(err != EINPROGRESS);
18635 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18636 		DTRACE_PROBE4(ipif__ioctl, char *, "arp_bringup_done finish",
18637 		    int, ipsq->ipsq_xop->ipx_current_ioctl,
18638 		    ill_t *, ill, ipif_t *, ipif);
18639 		ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18640 	} else {
18641 		ipsq_current_finish(ipsq);
18642 	}
18643 }
18644 
18645 /*
18646  * Finish processing of arp replumb after all the DLPI message
18647  * exchanges have completed between arp and the driver.
18648  */
18649 void
18650 arp_replumb_done(ill_t *ill, int err)
18651 {
18652 	mblk_t	*mp1;
18653 	ipif_t  *ipif;
18654 	conn_t *connp = NULL;
18655 	ipsq_t	*ipsq;
18656 	queue_t *q;
18657 
18658 	ASSERT(IAM_WRITER_ILL(ill));
18659 
18660 	ipsq = ill->ill_phyint->phyint_ipsq;
18661 	ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18662 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
18663 	ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18664 	if (mp1 == NULL) {
18665 		ip0dbg(("arp_replumb_done: bringup aborted ioctl %x\n",
18666 		    ipsq->ipsq_xop->ipx_current_ioctl));
18667 		/* bringup was aborted by the user */
18668 		return;
18669 	}
18670 	/*
18671 	 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18672 	 * must have an associated conn_t.  Otherwise, we're bringing this
18673 	 * interface back up as part of handling an asynchronous event (e.g.,
18674 	 * physical address change).
18675 	 */
18676 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18677 		ASSERT(connp != NULL);
18678 		q = CONNP_TO_WQ(connp);
18679 	} else {
18680 		ASSERT(connp == NULL);
18681 		q = ill->ill_rq;
18682 	}
18683 	if ((err == 0) && (ill->ill_up_ipifs)) {
18684 		err = ill_up_ipifs(ill, q, mp1);
18685 		if (err == EINPROGRESS)
18686 			return;
18687 	}
18688 	/*
18689 	 * The operation must complete without EINPROGRESS since
18690 	 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18691 	 * Otherwise, the operation will be stuck forever in the ipsq.
18692 	 */
18693 	ASSERT(err != EINPROGRESS);
18694 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18695 		DTRACE_PROBE4(ipif__ioctl, char *,
18696 		    "arp_replumb_done finish",
18697 		    int, ipsq->ipsq_xop->ipx_current_ioctl,
18698 		    ill_t *, ill, ipif_t *, ipif);
18699 		ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18700 	} else {
18701 		ipsq_current_finish(ipsq);
18702 	}
18703 }
18704 
18705 void
18706 ipif_up_notify(ipif_t *ipif)
18707 {
18708 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
18709 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif, RTSQ_DEFAULT);
18710 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
18711 	ill_nic_event_dispatch(ipif->ipif_ill, MAP_IPIF_ID(ipif->ipif_id),
18712 	    NE_LIF_UP, NULL, 0);
18713 }
18714 
18715 /*
18716  * ILB ioctl uses cv_wait (such as deleting a rule or adding a server) and
18717  * this assumes the context is cv_wait'able.  Hence it shouldnt' be used on
18718  * TPI end points with STREAMS modules pushed above.  This is assured by not
18719  * having the IPI_MODOK flag for the ioctl.  And IP ensures the ILB ioctl
18720  * never ends up on an ipsq, otherwise we may end up processing the ioctl
18721  * while unwinding from the ispq and that could be a thread from the bottom.
18722  */
18723 /* ARGSUSED */
18724 int
18725 ip_sioctl_ilb_cmd(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18726     ip_ioctl_cmd_t *ipip, void *arg)
18727 {
18728 	mblk_t *cmd_mp = mp->b_cont->b_cont;
18729 	ilb_cmd_t command = *((ilb_cmd_t *)cmd_mp->b_rptr);
18730 	int ret = 0;
18731 	int i;
18732 	size_t size;
18733 	ip_stack_t *ipst;
18734 	zoneid_t zoneid;
18735 	ilb_stack_t *ilbs;
18736 
18737 	ipst = CONNQ_TO_IPST(q);
18738 	ilbs = ipst->ips_netstack->netstack_ilb;
18739 	zoneid = Q_TO_CONN(q)->conn_zoneid;
18740 
18741 	switch (command) {
18742 	case ILB_CREATE_RULE: {
18743 		ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18744 
18745 		if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18746 			ret = EINVAL;
18747 			break;
18748 		}
18749 
18750 		ret = ilb_rule_add(ilbs, zoneid, cmd);
18751 		break;
18752 	}
18753 	case ILB_DESTROY_RULE:
18754 	case ILB_ENABLE_RULE:
18755 	case ILB_DISABLE_RULE: {
18756 		ilb_name_cmd_t *cmd = (ilb_name_cmd_t *)cmd_mp->b_rptr;
18757 
18758 		if (MBLKL(cmd_mp) != sizeof (ilb_name_cmd_t)) {
18759 			ret = EINVAL;
18760 			break;
18761 		}
18762 
18763 		if (cmd->flags & ILB_RULE_ALLRULES) {
18764 			if (command == ILB_DESTROY_RULE) {
18765 				ilb_rule_del_all(ilbs, zoneid);
18766 				break;
18767 			} else if (command == ILB_ENABLE_RULE) {
18768 				ilb_rule_enable_all(ilbs, zoneid);
18769 				break;
18770 			} else if (command == ILB_DISABLE_RULE) {
18771 				ilb_rule_disable_all(ilbs, zoneid);
18772 				break;
18773 			}
18774 		} else {
18775 			if (command == ILB_DESTROY_RULE) {
18776 				ret = ilb_rule_del(ilbs, zoneid, cmd->name);
18777 			} else if (command == ILB_ENABLE_RULE) {
18778 				ret = ilb_rule_enable(ilbs, zoneid, cmd->name,
18779 				    NULL);
18780 			} else if (command == ILB_DISABLE_RULE) {
18781 				ret = ilb_rule_disable(ilbs, zoneid, cmd->name,
18782 				    NULL);
18783 			}
18784 		}
18785 		break;
18786 	}
18787 	case ILB_NUM_RULES: {
18788 		ilb_num_rules_cmd_t *cmd;
18789 
18790 		if (MBLKL(cmd_mp) != sizeof (ilb_num_rules_cmd_t)) {
18791 			ret = EINVAL;
18792 			break;
18793 		}
18794 		cmd = (ilb_num_rules_cmd_t *)cmd_mp->b_rptr;
18795 		ilb_get_num_rules(ilbs, zoneid, &(cmd->num));
18796 		break;
18797 	}
18798 	case ILB_RULE_NAMES: {
18799 		ilb_rule_names_cmd_t *cmd;
18800 
18801 		cmd = (ilb_rule_names_cmd_t *)cmd_mp->b_rptr;
18802 		if (MBLKL(cmd_mp) < sizeof (ilb_rule_names_cmd_t) ||
18803 		    cmd->num_names == 0) {
18804 			ret = EINVAL;
18805 			break;
18806 		}
18807 		size = cmd->num_names * ILB_RULE_NAMESZ;
18808 		if (cmd_mp->b_rptr + offsetof(ilb_rule_names_cmd_t, buf) +
18809 		    size != cmd_mp->b_wptr) {
18810 			ret = EINVAL;
18811 			break;
18812 		}
18813 		ilb_get_rulenames(ilbs, zoneid, &cmd->num_names, cmd->buf);
18814 		break;
18815 	}
18816 	case ILB_NUM_SERVERS: {
18817 		ilb_num_servers_cmd_t *cmd;
18818 
18819 		if (MBLKL(cmd_mp) != sizeof (ilb_num_servers_cmd_t)) {
18820 			ret = EINVAL;
18821 			break;
18822 		}
18823 		cmd = (ilb_num_servers_cmd_t *)cmd_mp->b_rptr;
18824 		ret = ilb_get_num_servers(ilbs, zoneid, cmd->name,
18825 		    &(cmd->num));
18826 		break;
18827 	}
18828 	case ILB_LIST_RULE: {
18829 		ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18830 
18831 		if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18832 			ret = EINVAL;
18833 			break;
18834 		}
18835 		ret = ilb_rule_list(ilbs, zoneid, cmd);
18836 		break;
18837 	}
18838 	case ILB_LIST_SERVERS: {
18839 		ilb_servers_info_cmd_t *cmd;
18840 
18841 		cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18842 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t) ||
18843 		    cmd->num_servers == 0) {
18844 			ret = EINVAL;
18845 			break;
18846 		}
18847 		size = cmd->num_servers * sizeof (ilb_server_info_t);
18848 		if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18849 		    size != cmd_mp->b_wptr) {
18850 			ret = EINVAL;
18851 			break;
18852 		}
18853 
18854 		ret = ilb_get_servers(ilbs, zoneid, cmd->name, cmd->servers,
18855 		    &cmd->num_servers);
18856 		break;
18857 	}
18858 	case ILB_ADD_SERVERS: {
18859 		ilb_servers_info_cmd_t *cmd;
18860 		ilb_rule_t *rule;
18861 
18862 		cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18863 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t)) {
18864 			ret = EINVAL;
18865 			break;
18866 		}
18867 		size = cmd->num_servers * sizeof (ilb_server_info_t);
18868 		if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18869 		    size != cmd_mp->b_wptr) {
18870 			ret = EINVAL;
18871 			break;
18872 		}
18873 		rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18874 		if (rule == NULL) {
18875 			ASSERT(ret != 0);
18876 			break;
18877 		}
18878 		for (i = 0; i < cmd->num_servers; i++) {
18879 			ilb_server_info_t *s;
18880 
18881 			s = &cmd->servers[i];
18882 			s->err = ilb_server_add(ilbs, rule, s);
18883 		}
18884 		ILB_RULE_REFRELE(rule);
18885 		break;
18886 	}
18887 	case ILB_DEL_SERVERS:
18888 	case ILB_ENABLE_SERVERS:
18889 	case ILB_DISABLE_SERVERS: {
18890 		ilb_servers_cmd_t *cmd;
18891 		ilb_rule_t *rule;
18892 		int (*f)();
18893 
18894 		cmd = (ilb_servers_cmd_t *)cmd_mp->b_rptr;
18895 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_cmd_t)) {
18896 			ret = EINVAL;
18897 			break;
18898 		}
18899 		size = cmd->num_servers * sizeof (ilb_server_arg_t);
18900 		if (cmd_mp->b_rptr + offsetof(ilb_servers_cmd_t, servers) +
18901 		    size != cmd_mp->b_wptr) {
18902 			ret = EINVAL;
18903 			break;
18904 		}
18905 
18906 		if (command == ILB_DEL_SERVERS)
18907 			f = ilb_server_del;
18908 		else if (command == ILB_ENABLE_SERVERS)
18909 			f = ilb_server_enable;
18910 		else if (command == ILB_DISABLE_SERVERS)
18911 			f = ilb_server_disable;
18912 
18913 		rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18914 		if (rule == NULL) {
18915 			ASSERT(ret != 0);
18916 			break;
18917 		}
18918 
18919 		for (i = 0; i < cmd->num_servers; i++) {
18920 			ilb_server_arg_t *s;
18921 
18922 			s = &cmd->servers[i];
18923 			s->err = f(ilbs, zoneid, NULL, rule, &s->addr);
18924 		}
18925 		ILB_RULE_REFRELE(rule);
18926 		break;
18927 	}
18928 	case ILB_LIST_NAT_TABLE: {
18929 		ilb_list_nat_cmd_t *cmd;
18930 
18931 		cmd = (ilb_list_nat_cmd_t *)cmd_mp->b_rptr;
18932 		if (MBLKL(cmd_mp) < sizeof (ilb_list_nat_cmd_t)) {
18933 			ret = EINVAL;
18934 			break;
18935 		}
18936 		size = cmd->num_nat * sizeof (ilb_nat_entry_t);
18937 		if (cmd_mp->b_rptr + offsetof(ilb_list_nat_cmd_t, entries) +
18938 		    size != cmd_mp->b_wptr) {
18939 			ret = EINVAL;
18940 			break;
18941 		}
18942 
18943 		ret = ilb_list_nat(ilbs, zoneid, cmd->entries, &cmd->num_nat,
18944 		    &cmd->flags);
18945 		break;
18946 	}
18947 	case ILB_LIST_STICKY_TABLE: {
18948 		ilb_list_sticky_cmd_t *cmd;
18949 
18950 		cmd = (ilb_list_sticky_cmd_t *)cmd_mp->b_rptr;
18951 		if (MBLKL(cmd_mp) < sizeof (ilb_list_sticky_cmd_t)) {
18952 			ret = EINVAL;
18953 			break;
18954 		}
18955 		size = cmd->num_sticky * sizeof (ilb_sticky_entry_t);
18956 		if (cmd_mp->b_rptr + offsetof(ilb_list_sticky_cmd_t, entries) +
18957 		    size != cmd_mp->b_wptr) {
18958 			ret = EINVAL;
18959 			break;
18960 		}
18961 
18962 		ret = ilb_list_sticky(ilbs, zoneid, cmd->entries,
18963 		    &cmd->num_sticky, &cmd->flags);
18964 		break;
18965 	}
18966 	default:
18967 		ret = EINVAL;
18968 		break;
18969 	}
18970 done:
18971 	return (ret);
18972 }
18973 
18974 /* Remove all cache entries for this logical interface */
18975 void
18976 ipif_nce_down(ipif_t *ipif)
18977 {
18978 	ill_t *ill = ipif->ipif_ill;
18979 	nce_t *nce;
18980 
18981 	DTRACE_PROBE3(ipif__downup, char *, "ipif_nce_down",
18982 	    ill_t *, ill, ipif_t *, ipif);
18983 	if (ipif->ipif_added_nce) {
18984 		if (ipif->ipif_isv6)
18985 			nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
18986 		else
18987 			nce = nce_lookup_v4(ill, &ipif->ipif_lcl_addr);
18988 		if (nce != NULL) {
18989 			if (--nce->nce_ipif_cnt == 0)
18990 				ncec_delete(nce->nce_common);
18991 			ipif->ipif_added_nce = 0;
18992 			nce_refrele(nce);
18993 		} else {
18994 			/*
18995 			 * nce may already be NULL because it was already
18996 			 * flushed, e.g., due to a call to nce_flush
18997 			 */
18998 			ipif->ipif_added_nce = 0;
18999 		}
19000 	}
19001 	/*
19002 	 * Make IPMP aware of the deleted data address.
19003 	 */
19004 	if (IS_IPMP(ill))
19005 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
19006 
19007 	/*
19008 	 * Remove all other nces dependent on this ill when the last ipif
19009 	 * is going away.
19010 	 */
19011 	if (ill->ill_ipif_up_count == 0) {
19012 		ncec_walk(ill, (pfi_t)ncec_delete_per_ill,
19013 		    (uchar_t *)ill, ill->ill_ipst);
19014 		if (IS_UNDER_IPMP(ill))
19015 			nce_flush(ill, B_TRUE);
19016 	}
19017 }
19018 
19019 /*
19020  * find the first interface that uses usill for its source address.
19021  */
19022 ill_t *
19023 ill_lookup_usesrc(ill_t *usill)
19024 {
19025 	ip_stack_t *ipst = usill->ill_ipst;
19026 	ill_t *ill;
19027 
19028 	ASSERT(usill != NULL);
19029 
19030 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
19031 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
19032 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
19033 	for (ill = usill->ill_usesrc_grp_next; ill != NULL && ill != usill;
19034 	    ill = ill->ill_usesrc_grp_next) {
19035 		if (!IS_UNDER_IPMP(ill) && (ill->ill_flags & ILLF_MULTICAST) &&
19036 		    !ILL_IS_CONDEMNED(ill)) {
19037 			ill_refhold(ill);
19038 			break;
19039 		}
19040 	}
19041 	rw_exit(&ipst->ips_ill_g_lock);
19042 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
19043 	return (ill);
19044 }
19045 
19046 /*
19047  * This comment applies to both ip_sioctl_get_ifhwaddr and
19048  * ip_sioctl_get_lifhwaddr as the basic function of these two functions
19049  * is the same.
19050  *
19051  * The goal here is to find an IP interface that corresponds to the name
19052  * provided by the caller in the ifreq/lifreq structure held in the mblk_t
19053  * chain and to fill out a sockaddr/sockaddr_storage structure with the
19054  * mac address.
19055  *
19056  * The SIOCGIFHWADDR/SIOCGLIFHWADDR ioctl may return an error for a number
19057  * of different reasons:
19058  * ENXIO - the device name is not known to IP.
19059  * EADDRNOTAVAIL - the device has no hardware address. This is indicated
19060  * by ill_phys_addr not pointing to an actual address.
19061  * EPFNOSUPPORT - this will indicate that a request is being made for a
19062  * mac address that will not fit in the data structure supplier (struct
19063  * sockaddr).
19064  *
19065  */
19066 /* ARGSUSED */
19067 int
19068 ip_sioctl_get_ifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19069     ip_ioctl_cmd_t *ipip, void *if_req)
19070 {
19071 	struct sockaddr *sock;
19072 	struct ifreq *ifr;
19073 	mblk_t *mp1;
19074 	ill_t *ill;
19075 
19076 	ASSERT(ipif != NULL);
19077 	ill = ipif->ipif_ill;
19078 
19079 	if (ill->ill_phys_addr == NULL) {
19080 		return (EADDRNOTAVAIL);
19081 	}
19082 	if (ill->ill_phys_addr_length > sizeof (sock->sa_data)) {
19083 		return (EPFNOSUPPORT);
19084 	}
19085 
19086 	ip1dbg(("ip_sioctl_get_hwaddr(%s)\n", ill->ill_name));
19087 
19088 	/* Existence of mp1 has been checked in ip_wput_nondata */
19089 	mp1 = mp->b_cont->b_cont;
19090 	ifr = (struct ifreq *)mp1->b_rptr;
19091 
19092 	sock = &ifr->ifr_addr;
19093 	/*
19094 	 * The "family" field in the returned structure is set to a value
19095 	 * that represents the type of device to which the address belongs.
19096 	 * The value returned may differ to that on Linux but it will still
19097 	 * represent the correct symbol on Solaris.
19098 	 */
19099 	sock->sa_family = arp_hw_type(ill->ill_mactype);
19100 	bcopy(ill->ill_phys_addr, &sock->sa_data, ill->ill_phys_addr_length);
19101 
19102 	return (0);
19103 }
19104 
19105 /*
19106  * The expection of applications using SIOCGIFHWADDR is that data will
19107  * be returned in the sa_data field of the sockaddr structure. With
19108  * SIOCGLIFHWADDR, we're breaking new ground as there is no Linux
19109  * equivalent. In light of this, struct sockaddr_dl is used as it
19110  * offers more space for address storage in sll_data.
19111  */
19112 /* ARGSUSED */
19113 int
19114 ip_sioctl_get_lifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19115     ip_ioctl_cmd_t *ipip, void *if_req)
19116 {
19117 	struct sockaddr_dl *sock;
19118 	struct lifreq *lifr;
19119 	mblk_t *mp1;
19120 	ill_t *ill;
19121 
19122 	ASSERT(ipif != NULL);
19123 	ill = ipif->ipif_ill;
19124 
19125 	if (ill->ill_phys_addr == NULL) {
19126 		return (EADDRNOTAVAIL);
19127 	}
19128 	if (ill->ill_phys_addr_length > sizeof (sock->sdl_data)) {
19129 		return (EPFNOSUPPORT);
19130 	}
19131 
19132 	ip1dbg(("ip_sioctl_get_lifhwaddr(%s)\n", ill->ill_name));
19133 
19134 	/* Existence of mp1 has been checked in ip_wput_nondata */
19135 	mp1 = mp->b_cont->b_cont;
19136 	lifr = (struct lifreq *)mp1->b_rptr;
19137 
19138 	/*
19139 	 * sockaddr_ll is used here because it is also the structure used in
19140 	 * responding to the same ioctl in sockpfp. The only other choice is
19141 	 * sockaddr_dl which contains fields that are not required here
19142 	 * because its purpose is different.
19143 	 */
19144 	lifr->lifr_type = ill->ill_type;
19145 	sock = (struct sockaddr_dl *)&lifr->lifr_addr;
19146 	sock->sdl_family = AF_LINK;
19147 	sock->sdl_index = ill->ill_phyint->phyint_ifindex;
19148 	sock->sdl_type = ill->ill_mactype;
19149 	sock->sdl_nlen = 0;
19150 	sock->sdl_slen = 0;
19151 	sock->sdl_alen = ill->ill_phys_addr_length;
19152 	bcopy(ill->ill_phys_addr, sock->sdl_data, ill->ill_phys_addr_length);
19153 
19154 	return (0);
19155 }
19156