xref: /illumos-gate/usr/src/uts/common/inet/ip/ip_if.c (revision bbf21555)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 1990 Mentat Inc.
24  * Copyright (c) 2013 by Delphix. All rights reserved.
25  * Copyright (c) 2016, Joyent, Inc. All rights reserved.
26  * Copyright (c) 2014, OmniTI Computer Consulting, Inc. All rights reserved.
27  */
28 
29 /*
30  * This file contains the interface control functions for IP.
31  */
32 
33 #include <sys/types.h>
34 #include <sys/stream.h>
35 #include <sys/dlpi.h>
36 #include <sys/stropts.h>
37 #include <sys/strsun.h>
38 #include <sys/sysmacros.h>
39 #include <sys/strsubr.h>
40 #include <sys/strlog.h>
41 #include <sys/ddi.h>
42 #include <sys/sunddi.h>
43 #include <sys/cmn_err.h>
44 #include <sys/kstat.h>
45 #include <sys/debug.h>
46 #include <sys/zone.h>
47 #include <sys/sunldi.h>
48 #include <sys/file.h>
49 #include <sys/bitmap.h>
50 #include <sys/cpuvar.h>
51 #include <sys/time.h>
52 #include <sys/ctype.h>
53 #include <sys/kmem.h>
54 #include <sys/systm.h>
55 #include <sys/param.h>
56 #include <sys/socket.h>
57 #include <sys/isa_defs.h>
58 #include <net/if.h>
59 #include <net/if_arp.h>
60 #include <net/if_types.h>
61 #include <net/if_dl.h>
62 #include <net/route.h>
63 #include <sys/sockio.h>
64 #include <netinet/in.h>
65 #include <netinet/ip6.h>
66 #include <netinet/icmp6.h>
67 #include <netinet/igmp_var.h>
68 #include <sys/policy.h>
69 #include <sys/ethernet.h>
70 #include <sys/callb.h>
71 #include <sys/md5.h>
72 
73 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
74 #include <inet/mi.h>
75 #include <inet/nd.h>
76 #include <inet/tunables.h>
77 #include <inet/arp.h>
78 #include <inet/ip_arp.h>
79 #include <inet/mib2.h>
80 #include <inet/ip.h>
81 #include <inet/ip6.h>
82 #include <inet/ip6_asp.h>
83 #include <inet/tcp.h>
84 #include <inet/ip_multi.h>
85 #include <inet/ip_ire.h>
86 #include <inet/ip_ftable.h>
87 #include <inet/ip_rts.h>
88 #include <inet/ip_ndp.h>
89 #include <inet/ip_if.h>
90 #include <inet/ip_impl.h>
91 #include <inet/sctp_ip.h>
92 #include <inet/ip_netinfo.h>
93 #include <inet/ilb_ip.h>
94 
95 #include <netinet/igmp.h>
96 #include <inet/ip_listutils.h>
97 #include <inet/ipclassifier.h>
98 #include <sys/mac_client.h>
99 #include <sys/dld.h>
100 #include <sys/mac_flow.h>
101 
102 #include <sys/systeminfo.h>
103 #include <sys/bootconf.h>
104 
105 #include <sys/tsol/tndb.h>
106 #include <sys/tsol/tnet.h>
107 
108 #include <inet/rawip_impl.h> /* needed for icmp_stack_t */
109 #include <inet/udp_impl.h> /* needed for udp_stack_t */
110 
111 /* The character which tells where the ill_name ends */
112 #define	IPIF_SEPARATOR_CHAR	':'
113 
114 /* IP ioctl function table entry */
115 typedef struct ipft_s {
116 	int	ipft_cmd;
117 	pfi_t	ipft_pfi;
118 	int	ipft_min_size;
119 	int	ipft_flags;
120 } ipft_t;
121 #define	IPFT_F_NO_REPLY		0x1	/* IP ioctl does not expect any reply */
122 #define	IPFT_F_SELF_REPLY	0x2	/* ioctl callee does the ioctl reply */
123 
124 static int	nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
125 static int	nd_ill_forward_set(queue_t *q, mblk_t *mp,
126 		    char *value, caddr_t cp, cred_t *ioc_cr);
127 
128 static boolean_t ill_is_quiescent(ill_t *);
129 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
130 static ip_m_t	*ip_m_lookup(t_uscalar_t mac_type);
131 static int	ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
132     mblk_t *mp, boolean_t need_up);
133 static int	ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
134     mblk_t *mp, boolean_t need_up);
135 static int	ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
136     queue_t *q, mblk_t *mp, boolean_t need_up);
137 static int	ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
138     mblk_t *mp);
139 static int	ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
140     mblk_t *mp);
141 static int	ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
142     queue_t *q, mblk_t *mp, boolean_t need_up);
143 static int	ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
144     int ioccmd, struct linkblk *li);
145 static ipaddr_t	ip_subnet_mask(ipaddr_t addr, ipif_t **, ip_stack_t *);
146 static void	ip_wput_ioctl(queue_t *q, mblk_t *mp);
147 static void	ipsq_flush(ill_t *ill);
148 
149 static	int	ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
150     queue_t *q, mblk_t *mp, boolean_t need_up);
151 static void	ipsq_delete(ipsq_t *);
152 
153 static ipif_t	*ipif_allocate(ill_t *ill, int id, uint_t ire_type,
154     boolean_t initialize, boolean_t insert, int *errorp);
155 static ire_t	**ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep);
156 static void	ipif_delete_bcast_ires(ipif_t *ipif);
157 static int	ipif_add_ires_v4(ipif_t *, boolean_t);
158 static boolean_t ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif,
159 		    boolean_t isv6);
160 static int	ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
161 static void	ipif_free(ipif_t *ipif);
162 static void	ipif_free_tail(ipif_t *ipif);
163 static void	ipif_set_default(ipif_t *ipif);
164 static int	ipif_set_values(queue_t *q, mblk_t *mp,
165     char *interf_name, uint_t *ppa);
166 static int	ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
167     queue_t *q);
168 static ipif_t	*ipif_lookup_on_name(char *name, size_t namelen,
169     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
170     ip_stack_t *);
171 static ipif_t	*ipif_lookup_on_name_async(char *name, size_t namelen,
172     boolean_t isv6, zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func,
173     int *error, ip_stack_t *);
174 
175 static int	ill_alloc_ppa(ill_if_t *, ill_t *);
176 static void	ill_delete_interface_type(ill_if_t *);
177 static int	ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
178 static void	ill_dl_down(ill_t *ill);
179 static void	ill_down(ill_t *ill);
180 static void	ill_down_ipifs(ill_t *, boolean_t);
181 static void	ill_free_mib(ill_t *ill);
182 static void	ill_glist_delete(ill_t *);
183 static void	ill_phyint_reinit(ill_t *ill);
184 static void	ill_set_nce_router_flags(ill_t *, boolean_t);
185 static void	ill_set_phys_addr_tail(ipsq_t *, queue_t *, mblk_t *, void *);
186 static void	ill_replumb_tail(ipsq_t *, queue_t *, mblk_t *, void *);
187 
188 static ip_v6intfid_func_t ip_ether_v6intfid, ip_ib_v6intfid;
189 static ip_v6intfid_func_t ip_ipv4_v6intfid, ip_ipv6_v6intfid;
190 static ip_v6intfid_func_t ip_ipmp_v6intfid, ip_nodef_v6intfid;
191 static ip_v6intfid_func_t ip_ipv4_v6destintfid, ip_ipv6_v6destintfid;
192 static ip_v4mapinfo_func_t ip_ether_v4_mapping;
193 static ip_v6mapinfo_func_t ip_ether_v6_mapping;
194 static ip_v4mapinfo_func_t ip_ib_v4_mapping;
195 static ip_v6mapinfo_func_t ip_ib_v6_mapping;
196 static ip_v4mapinfo_func_t ip_mbcast_mapping;
197 static void	ip_cgtp_bcast_add(ire_t *, ip_stack_t *);
198 static void	ip_cgtp_bcast_delete(ire_t *, ip_stack_t *);
199 static void	phyint_free(phyint_t *);
200 
201 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *);
202 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
203 static void ill_capability_vrrp_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
204 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
205 static void ill_capability_hcksum_reset_fill(ill_t *, mblk_t *);
206 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
207     dl_capability_sub_t *);
208 static void ill_capability_zerocopy_reset_fill(ill_t *, mblk_t *);
209 static void	ill_capability_dld_reset_fill(ill_t *, mblk_t *);
210 static void	ill_capability_dld_ack(ill_t *, mblk_t *,
211 		    dl_capability_sub_t *);
212 static void	ill_capability_dld_enable(ill_t *);
213 static void	ill_capability_ack_thr(void *);
214 static void	ill_capability_lso_enable(ill_t *);
215 
216 static ill_t	*ill_prev_usesrc(ill_t *);
217 static int	ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
218 static void	ill_disband_usesrc_group(ill_t *);
219 static void	ip_sioctl_garp_reply(mblk_t *, ill_t *, void *, int);
220 
221 #ifdef DEBUG
222 static	void	ill_trace_cleanup(const ill_t *);
223 static	void	ipif_trace_cleanup(const ipif_t *);
224 #endif
225 
226 static	void	ill_dlpi_clear_deferred(ill_t *ill);
227 
228 static	void	phyint_flags_init(phyint_t *, t_uscalar_t);
229 
230 /*
231  * if we go over the memory footprint limit more than once in this msec
232  * interval, we'll start pruning aggressively.
233  */
234 int ip_min_frag_prune_time = 0;
235 
236 static ipft_t	ip_ioctl_ftbl[] = {
237 	{ IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
238 	{ IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
239 		IPFT_F_NO_REPLY },
240 	{ IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
241 	{ 0 }
242 };
243 
244 /* Simple ICMP IP Header Template */
245 static ipha_t icmp_ipha = {
246 	IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
247 };
248 
249 static uchar_t	ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
250 
251 static ip_m_t   ip_m_tbl[] = {
252 	{ DL_ETHER, IFT_ETHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
253 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
254 	    ip_nodef_v6intfid },
255 	{ DL_CSMACD, IFT_ISO88023, ETHERTYPE_IP, ETHERTYPE_IPV6,
256 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
257 	    ip_nodef_v6intfid },
258 	{ DL_TPB, IFT_ISO88024, ETHERTYPE_IP, ETHERTYPE_IPV6,
259 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
260 	    ip_nodef_v6intfid },
261 	{ DL_TPR, IFT_ISO88025, ETHERTYPE_IP, ETHERTYPE_IPV6,
262 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
263 	    ip_nodef_v6intfid },
264 	{ DL_FDDI, IFT_FDDI, ETHERTYPE_IP, ETHERTYPE_IPV6,
265 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
266 	    ip_nodef_v6intfid },
267 	{ DL_IB, IFT_IB, ETHERTYPE_IP, ETHERTYPE_IPV6,
268 	    ip_ib_v4_mapping, ip_ib_v6_mapping, ip_ib_v6intfid,
269 	    ip_nodef_v6intfid },
270 	{ DL_IPV4, IFT_IPV4, IPPROTO_ENCAP, IPPROTO_IPV6,
271 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
272 	    ip_ipv4_v6destintfid },
273 	{ DL_IPV6, IFT_IPV6, IPPROTO_ENCAP, IPPROTO_IPV6,
274 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv6_v6intfid,
275 	    ip_ipv6_v6destintfid },
276 	{ DL_6TO4, IFT_6TO4, IPPROTO_ENCAP, IPPROTO_IPV6,
277 	    ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
278 	    ip_nodef_v6intfid },
279 	{ SUNW_DL_VNI, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
280 	    NULL, NULL, ip_nodef_v6intfid, ip_nodef_v6intfid },
281 	{ SUNW_DL_IPMP, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
282 	    NULL, NULL, ip_ipmp_v6intfid, ip_nodef_v6intfid },
283 	{ DL_OTHER, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
284 	    ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
285 	    ip_nodef_v6intfid }
286 };
287 
288 char	ipif_loopback_name[] = "lo0";
289 
290 /* These are used by all IP network modules. */
291 sin6_t	sin6_null;	/* Zero address for quick clears */
292 sin_t	sin_null;	/* Zero address for quick clears */
293 
294 /* When set search for unused ipif_seqid */
295 static ipif_t	ipif_zero;
296 
297 /*
298  * ppa arena is created after these many
299  * interfaces have been plumbed.
300  */
301 uint_t	ill_no_arena = 12;	/* Setable in /etc/system */
302 
303 /*
304  * Allocate per-interface mibs.
305  * Returns true if ok. False otherwise.
306  *  ipsq  may not yet be allocated (loopback case ).
307  */
308 static boolean_t
309 ill_allocate_mibs(ill_t *ill)
310 {
311 	/* Already allocated? */
312 	if (ill->ill_ip_mib != NULL) {
313 		if (ill->ill_isv6)
314 			ASSERT(ill->ill_icmp6_mib != NULL);
315 		return (B_TRUE);
316 	}
317 
318 	ill->ill_ip_mib = kmem_zalloc(sizeof (*ill->ill_ip_mib),
319 	    KM_NOSLEEP);
320 	if (ill->ill_ip_mib == NULL) {
321 		return (B_FALSE);
322 	}
323 
324 	/* Setup static information */
325 	SET_MIB(ill->ill_ip_mib->ipIfStatsEntrySize,
326 	    sizeof (mib2_ipIfStatsEntry_t));
327 	if (ill->ill_isv6) {
328 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
329 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
330 		    sizeof (mib2_ipv6AddrEntry_t));
331 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
332 		    sizeof (mib2_ipv6RouteEntry_t));
333 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
334 		    sizeof (mib2_ipv6NetToMediaEntry_t));
335 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
336 		    sizeof (ipv6_member_t));
337 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
338 		    sizeof (ipv6_grpsrc_t));
339 	} else {
340 		ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
341 		SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
342 		    sizeof (mib2_ipAddrEntry_t));
343 		SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
344 		    sizeof (mib2_ipRouteEntry_t));
345 		SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
346 		    sizeof (mib2_ipNetToMediaEntry_t));
347 		SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
348 		    sizeof (ip_member_t));
349 		SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
350 		    sizeof (ip_grpsrc_t));
351 
352 		/*
353 		 * For a v4 ill, we are done at this point, because per ill
354 		 * icmp mibs are only used for v6.
355 		 */
356 		return (B_TRUE);
357 	}
358 
359 	ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
360 	    KM_NOSLEEP);
361 	if (ill->ill_icmp6_mib == NULL) {
362 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
363 		ill->ill_ip_mib = NULL;
364 		return (B_FALSE);
365 	}
366 	/* static icmp info */
367 	ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
368 	    sizeof (mib2_ipv6IfIcmpEntry_t);
369 	/*
370 	 * The ipIfStatsIfindex and ipv6IfIcmpIndex will be assigned later
371 	 * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
372 	 * -> ill_phyint_reinit
373 	 */
374 	return (B_TRUE);
375 }
376 
377 /*
378  * Completely vaporize a lower level tap and all associated interfaces.
379  * ill_delete is called only out of ip_close when the device control
380  * stream is being closed.
381  */
382 void
383 ill_delete(ill_t *ill)
384 {
385 	ipif_t	*ipif;
386 	ill_t	*prev_ill;
387 	ip_stack_t	*ipst = ill->ill_ipst;
388 
389 	/*
390 	 * ill_delete may be forcibly entering the ipsq. The previous
391 	 * ioctl may not have completed and may need to be aborted.
392 	 * ipsq_flush takes care of it. If we don't need to enter the
393 	 * the ipsq forcibly, the 2nd invocation of ipsq_flush in
394 	 * ill_delete_tail is sufficient.
395 	 */
396 	ipsq_flush(ill);
397 
398 	/*
399 	 * Nuke all interfaces.  ipif_free will take down the interface,
400 	 * remove it from the list, and free the data structure.
401 	 * Walk down the ipif list and remove the logical interfaces
402 	 * first before removing the main ipif. We can't unplumb
403 	 * zeroth interface first in the case of IPv6 as update_conn_ill
404 	 * -> ip_ll_multireq de-references ill_ipif for checking
405 	 * POINTOPOINT.
406 	 *
407 	 * If ill_ipif was not properly initialized (i.e low on memory),
408 	 * then no interfaces to clean up. In this case just clean up the
409 	 * ill.
410 	 */
411 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
412 		ipif_free(ipif);
413 
414 	/*
415 	 * clean out all the nce_t entries that depend on this
416 	 * ill for the ill_phys_addr.
417 	 */
418 	nce_flush(ill, B_TRUE);
419 
420 	/* Clean up msgs on pending upcalls for mrouted */
421 	reset_mrt_ill(ill);
422 
423 	update_conn_ill(ill, ipst);
424 
425 	/*
426 	 * Remove multicast references added as a result of calls to
427 	 * ip_join_allmulti().
428 	 */
429 	ip_purge_allmulti(ill);
430 
431 	/*
432 	 * If the ill being deleted is under IPMP, boot it out of the illgrp.
433 	 */
434 	if (IS_UNDER_IPMP(ill))
435 		ipmp_ill_leave_illgrp(ill);
436 
437 	/*
438 	 * ill_down will arrange to blow off any IRE's dependent on this
439 	 * ILL, and shut down fragmentation reassembly.
440 	 */
441 	ill_down(ill);
442 
443 	/* Let SCTP know, so that it can remove this from its list. */
444 	sctp_update_ill(ill, SCTP_ILL_REMOVE);
445 
446 	/*
447 	 * Walk all CONNs that can have a reference on an ire or nce for this
448 	 * ill (we actually walk all that now have stale references).
449 	 */
450 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
451 
452 	/* With IPv6 we have dce_ifindex. Cleanup for neatness */
453 	if (ill->ill_isv6)
454 		dce_cleanup(ill->ill_phyint->phyint_ifindex, ipst);
455 
456 	/*
457 	 * If an address on this ILL is being used as a source address then
458 	 * clear out the pointers in other ILLs that point to this ILL.
459 	 */
460 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
461 	if (ill->ill_usesrc_grp_next != NULL) {
462 		if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
463 			ill_disband_usesrc_group(ill);
464 		} else {	/* consumer of the usesrc ILL */
465 			prev_ill = ill_prev_usesrc(ill);
466 			prev_ill->ill_usesrc_grp_next =
467 			    ill->ill_usesrc_grp_next;
468 		}
469 	}
470 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
471 }
472 
473 static void
474 ipif_non_duplicate(ipif_t *ipif)
475 {
476 	ill_t *ill = ipif->ipif_ill;
477 	mutex_enter(&ill->ill_lock);
478 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
479 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
480 		ASSERT(ill->ill_ipif_dup_count > 0);
481 		ill->ill_ipif_dup_count--;
482 	}
483 	mutex_exit(&ill->ill_lock);
484 }
485 
486 /*
487  * ill_delete_tail is called from ip_modclose after all references
488  * to the closing ill are gone. The wait is done in ip_modclose
489  */
490 void
491 ill_delete_tail(ill_t *ill)
492 {
493 	mblk_t	**mpp;
494 	ipif_t	*ipif;
495 	ip_stack_t *ipst = ill->ill_ipst;
496 
497 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
498 		ipif_non_duplicate(ipif);
499 		(void) ipif_down_tail(ipif);
500 	}
501 
502 	ASSERT(ill->ill_ipif_dup_count == 0);
503 
504 	/*
505 	 * If polling capability is enabled (which signifies direct
506 	 * upcall into IP and driver has ill saved as a handle),
507 	 * we need to make sure that unbind has completed before we
508 	 * let the ill disappear and driver no longer has any reference
509 	 * to this ill.
510 	 */
511 	mutex_enter(&ill->ill_lock);
512 	while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
513 		cv_wait(&ill->ill_cv, &ill->ill_lock);
514 	mutex_exit(&ill->ill_lock);
515 	ASSERT(!(ill->ill_capabilities &
516 	    (ILL_CAPAB_DLD | ILL_CAPAB_DLD_POLL | ILL_CAPAB_DLD_DIRECT)));
517 
518 	if (ill->ill_net_type != IRE_LOOPBACK)
519 		qprocsoff(ill->ill_rq);
520 
521 	/*
522 	 * We do an ipsq_flush once again now. New messages could have
523 	 * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
524 	 * could also have landed up if an ioctl thread had looked up
525 	 * the ill before we set the ILL_CONDEMNED flag, but not yet
526 	 * enqueued the ioctl when we did the ipsq_flush last time.
527 	 */
528 	ipsq_flush(ill);
529 
530 	/*
531 	 * Free capabilities.
532 	 */
533 	if (ill->ill_hcksum_capab != NULL) {
534 		kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
535 		ill->ill_hcksum_capab = NULL;
536 	}
537 
538 	if (ill->ill_zerocopy_capab != NULL) {
539 		kmem_free(ill->ill_zerocopy_capab,
540 		    sizeof (ill_zerocopy_capab_t));
541 		ill->ill_zerocopy_capab = NULL;
542 	}
543 
544 	if (ill->ill_lso_capab != NULL) {
545 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
546 		ill->ill_lso_capab = NULL;
547 	}
548 
549 	if (ill->ill_dld_capab != NULL) {
550 		kmem_free(ill->ill_dld_capab, sizeof (ill_dld_capab_t));
551 		ill->ill_dld_capab = NULL;
552 	}
553 
554 	/* Clean up ill_allowed_ips* related state */
555 	if (ill->ill_allowed_ips != NULL) {
556 		ASSERT(ill->ill_allowed_ips_cnt > 0);
557 		kmem_free(ill->ill_allowed_ips,
558 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
559 		ill->ill_allowed_ips = NULL;
560 		ill->ill_allowed_ips_cnt = 0;
561 	}
562 
563 	while (ill->ill_ipif != NULL)
564 		ipif_free_tail(ill->ill_ipif);
565 
566 	/*
567 	 * We have removed all references to ilm from conn and the ones joined
568 	 * within the kernel.
569 	 *
570 	 * We don't walk conns, mrts and ires because
571 	 *
572 	 * 1) update_conn_ill and reset_mrt_ill cleans up conns and mrts.
573 	 * 2) ill_down ->ill_downi walks all the ires and cleans up
574 	 *    ill references.
575 	 */
576 
577 	/*
578 	 * If this ill is an IPMP meta-interface, blow away the illgrp.  This
579 	 * is safe to do because the illgrp has already been unlinked from the
580 	 * group by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find it.
581 	 */
582 	if (IS_IPMP(ill)) {
583 		ipmp_illgrp_destroy(ill->ill_grp);
584 		ill->ill_grp = NULL;
585 	}
586 
587 	if (ill->ill_mphysaddr_list != NULL) {
588 		multiphysaddr_t *mpa, *tmpa;
589 
590 		mpa = ill->ill_mphysaddr_list;
591 		ill->ill_mphysaddr_list = NULL;
592 		while (mpa) {
593 			tmpa = mpa->mpa_next;
594 			kmem_free(mpa, sizeof (*mpa));
595 			mpa = tmpa;
596 		}
597 	}
598 	/*
599 	 * Take us out of the list of ILLs. ill_glist_delete -> phyint_free
600 	 * could free the phyint. No more reference to the phyint after this
601 	 * point.
602 	 */
603 	(void) ill_glist_delete(ill);
604 
605 	if (ill->ill_frag_ptr != NULL) {
606 		uint_t count;
607 
608 		for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
609 			mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
610 		}
611 		mi_free(ill->ill_frag_ptr);
612 		ill->ill_frag_ptr = NULL;
613 		ill->ill_frag_hash_tbl = NULL;
614 	}
615 
616 	freemsg(ill->ill_nd_lla_mp);
617 	/* Free all retained control messages. */
618 	mpp = &ill->ill_first_mp_to_free;
619 	do {
620 		while (mpp[0]) {
621 			mblk_t  *mp;
622 			mblk_t  *mp1;
623 
624 			mp = mpp[0];
625 			mpp[0] = mp->b_next;
626 			for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
627 				mp1->b_next = NULL;
628 				mp1->b_prev = NULL;
629 			}
630 			freemsg(mp);
631 		}
632 	} while (mpp++ != &ill->ill_last_mp_to_free);
633 
634 	ill_free_mib(ill);
635 
636 #ifdef DEBUG
637 	ill_trace_cleanup(ill);
638 #endif
639 
640 	/* The default multicast interface might have changed */
641 	ire_increment_multicast_generation(ipst, ill->ill_isv6);
642 
643 	/* Drop refcnt here */
644 	netstack_rele(ill->ill_ipst->ips_netstack);
645 	ill->ill_ipst = NULL;
646 }
647 
648 static void
649 ill_free_mib(ill_t *ill)
650 {
651 	ip_stack_t *ipst = ill->ill_ipst;
652 
653 	/*
654 	 * MIB statistics must not be lost, so when an interface
655 	 * goes away the counter values will be added to the global
656 	 * MIBs.
657 	 */
658 	if (ill->ill_ip_mib != NULL) {
659 		if (ill->ill_isv6) {
660 			ip_mib2_add_ip_stats(&ipst->ips_ip6_mib,
661 			    ill->ill_ip_mib);
662 		} else {
663 			ip_mib2_add_ip_stats(&ipst->ips_ip_mib,
664 			    ill->ill_ip_mib);
665 		}
666 
667 		kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
668 		ill->ill_ip_mib = NULL;
669 	}
670 	if (ill->ill_icmp6_mib != NULL) {
671 		ip_mib2_add_icmp6_stats(&ipst->ips_icmp6_mib,
672 		    ill->ill_icmp6_mib);
673 		kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
674 		ill->ill_icmp6_mib = NULL;
675 	}
676 }
677 
678 /*
679  * Concatenate together a physical address and a sap.
680  *
681  * Sap_lengths are interpreted as follows:
682  *   sap_length == 0	==>	no sap
683  *   sap_length > 0	==>	sap is at the head of the dlpi address
684  *   sap_length < 0	==>	sap is at the tail of the dlpi address
685  */
686 static void
687 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
688     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
689 {
690 	uint16_t sap_addr = (uint16_t)sap_src;
691 
692 	if (sap_length == 0) {
693 		if (phys_src == NULL)
694 			bzero(dst, phys_length);
695 		else
696 			bcopy(phys_src, dst, phys_length);
697 	} else if (sap_length < 0) {
698 		if (phys_src == NULL)
699 			bzero(dst, phys_length);
700 		else
701 			bcopy(phys_src, dst, phys_length);
702 		bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
703 	} else {
704 		bcopy(&sap_addr, dst, sizeof (sap_addr));
705 		if (phys_src == NULL)
706 			bzero((char *)dst + sap_length, phys_length);
707 		else
708 			bcopy(phys_src, (char *)dst + sap_length, phys_length);
709 	}
710 }
711 
712 /*
713  * Generate a dl_unitdata_req mblk for the device and address given.
714  * addr_length is the length of the physical portion of the address.
715  * If addr is NULL include an all zero address of the specified length.
716  * TRUE? In any case, addr_length is taken to be the entire length of the
717  * dlpi address, including the absolute value of sap_length.
718  */
719 mblk_t *
720 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
721     t_scalar_t sap_length)
722 {
723 	dl_unitdata_req_t *dlur;
724 	mblk_t	*mp;
725 	t_scalar_t	abs_sap_length;		/* absolute value */
726 
727 	abs_sap_length = ABS(sap_length);
728 	mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
729 	    DL_UNITDATA_REQ);
730 	if (mp == NULL)
731 		return (NULL);
732 	dlur = (dl_unitdata_req_t *)mp->b_rptr;
733 	/* HACK: accomodate incompatible DLPI drivers */
734 	if (addr_length == 8)
735 		addr_length = 6;
736 	dlur->dl_dest_addr_length = addr_length + abs_sap_length;
737 	dlur->dl_dest_addr_offset = sizeof (*dlur);
738 	dlur->dl_priority.dl_min = 0;
739 	dlur->dl_priority.dl_max = 0;
740 	ill_dlur_copy_address(addr, addr_length, sap, sap_length,
741 	    (uchar_t *)&dlur[1]);
742 	return (mp);
743 }
744 
745 /*
746  * Add the pending mp to the list. There can be only 1 pending mp
747  * in the list. Any exclusive ioctl that needs to wait for a response
748  * from another module or driver needs to use this function to set
749  * the ipx_pending_mp to the ioctl mblk and wait for the response from
750  * the other module/driver. This is also used while waiting for the
751  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
752  */
753 boolean_t
754 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
755     int waitfor)
756 {
757 	ipxop_t	*ipx = ipif->ipif_ill->ill_phyint->phyint_ipsq->ipsq_xop;
758 
759 	ASSERT(IAM_WRITER_IPIF(ipif));
760 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
761 	ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
762 	ASSERT(ipx->ipx_pending_mp == NULL);
763 	/*
764 	 * The caller may be using a different ipif than the one passed into
765 	 * ipsq_current_start() (e.g., suppose an ioctl that came in on the V4
766 	 * ill needs to wait for the V6 ill to quiesce).  So we can't ASSERT
767 	 * that `ipx_current_ipif == ipif'.
768 	 */
769 	ASSERT(ipx->ipx_current_ipif != NULL);
770 
771 	/*
772 	 * M_IOCDATA from ioctls, M_ERROR/M_HANGUP/M_PROTO/M_PCPROTO from the
773 	 * driver.
774 	 */
775 	ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_ERROR) ||
776 	    (DB_TYPE(add_mp) == M_HANGUP) || (DB_TYPE(add_mp) == M_PROTO) ||
777 	    (DB_TYPE(add_mp) == M_PCPROTO));
778 
779 	if (connp != NULL) {
780 		ASSERT(MUTEX_HELD(&connp->conn_lock));
781 		/*
782 		 * Return error if the conn has started closing. The conn
783 		 * could have finished cleaning up the pending mp list,
784 		 * If so we should not add another mp to the list negating
785 		 * the cleanup.
786 		 */
787 		if (connp->conn_state_flags & CONN_CLOSING)
788 			return (B_FALSE);
789 	}
790 	mutex_enter(&ipx->ipx_lock);
791 	ipx->ipx_pending_ipif = ipif;
792 	/*
793 	 * Note down the queue in b_queue. This will be returned by
794 	 * ipsq_pending_mp_get. Caller will then use these values to restart
795 	 * the processing
796 	 */
797 	add_mp->b_next = NULL;
798 	add_mp->b_queue = q;
799 	ipx->ipx_pending_mp = add_mp;
800 	ipx->ipx_waitfor = waitfor;
801 	mutex_exit(&ipx->ipx_lock);
802 
803 	if (connp != NULL)
804 		connp->conn_oper_pending_ill = ipif->ipif_ill;
805 
806 	return (B_TRUE);
807 }
808 
809 /*
810  * Retrieve the ipx_pending_mp and return it. There can be only 1 mp
811  * queued in the list.
812  */
813 mblk_t *
814 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
815 {
816 	mblk_t	*curr = NULL;
817 	ipxop_t	*ipx = ipsq->ipsq_xop;
818 
819 	*connpp = NULL;
820 	mutex_enter(&ipx->ipx_lock);
821 	if (ipx->ipx_pending_mp == NULL) {
822 		mutex_exit(&ipx->ipx_lock);
823 		return (NULL);
824 	}
825 
826 	/* There can be only 1 such excl message */
827 	curr = ipx->ipx_pending_mp;
828 	ASSERT(curr->b_next == NULL);
829 	ipx->ipx_pending_ipif = NULL;
830 	ipx->ipx_pending_mp = NULL;
831 	ipx->ipx_waitfor = 0;
832 	mutex_exit(&ipx->ipx_lock);
833 
834 	if (CONN_Q(curr->b_queue)) {
835 		/*
836 		 * This mp did a refhold on the conn, at the start of the ioctl.
837 		 * So we can safely return a pointer to the conn to the caller.
838 		 */
839 		*connpp = Q_TO_CONN(curr->b_queue);
840 	} else {
841 		*connpp = NULL;
842 	}
843 	curr->b_next = NULL;
844 	curr->b_prev = NULL;
845 	return (curr);
846 }
847 
848 /*
849  * Cleanup the ioctl mp queued in ipx_pending_mp
850  * - Called in the ill_delete path
851  * - Called in the M_ERROR or M_HANGUP path on the ill.
852  * - Called in the conn close path.
853  *
854  * Returns success on finding the pending mblk associated with the ioctl or
855  * exclusive operation in progress, failure otherwise.
856  */
857 boolean_t
858 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
859 {
860 	mblk_t	*mp;
861 	ipxop_t	*ipx;
862 	queue_t	*q;
863 	ipif_t	*ipif;
864 	int	cmd;
865 
866 	ASSERT(IAM_WRITER_ILL(ill));
867 	ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
868 
869 	mutex_enter(&ipx->ipx_lock);
870 	mp = ipx->ipx_pending_mp;
871 	if (connp != NULL) {
872 		if (mp == NULL || mp->b_queue != CONNP_TO_WQ(connp)) {
873 			/*
874 			 * Nothing to clean since the conn that is closing
875 			 * does not have a matching pending mblk in
876 			 * ipx_pending_mp.
877 			 */
878 			mutex_exit(&ipx->ipx_lock);
879 			return (B_FALSE);
880 		}
881 	} else {
882 		/*
883 		 * A non-zero ill_error signifies we are called in the
884 		 * M_ERROR or M_HANGUP path and we need to unconditionally
885 		 * abort any current ioctl and do the corresponding cleanup.
886 		 * A zero ill_error means we are in the ill_delete path and
887 		 * we do the cleanup only if there is a pending mp.
888 		 */
889 		if (mp == NULL && ill->ill_error == 0) {
890 			mutex_exit(&ipx->ipx_lock);
891 			return (B_FALSE);
892 		}
893 	}
894 
895 	/* Now remove from the ipx_pending_mp */
896 	ipx->ipx_pending_mp = NULL;
897 	ipif = ipx->ipx_pending_ipif;
898 	ipx->ipx_pending_ipif = NULL;
899 	ipx->ipx_waitfor = 0;
900 	ipx->ipx_current_ipif = NULL;
901 	cmd = ipx->ipx_current_ioctl;
902 	ipx->ipx_current_ioctl = 0;
903 	ipx->ipx_current_done = B_TRUE;
904 	mutex_exit(&ipx->ipx_lock);
905 
906 	if (mp == NULL)
907 		return (B_FALSE);
908 
909 	q = mp->b_queue;
910 	mp->b_next = NULL;
911 	mp->b_prev = NULL;
912 	mp->b_queue = NULL;
913 
914 	if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
915 		DTRACE_PROBE4(ipif__ioctl,
916 		    char *, "ipsq_pending_mp_cleanup",
917 		    int, cmd, ill_t *, ipif == NULL ? NULL : ipif->ipif_ill,
918 		    ipif_t *, ipif);
919 		if (connp == NULL) {
920 			ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
921 		} else {
922 			ip_ioctl_finish(q, mp, ENXIO, CONN_CLOSE, NULL);
923 			mutex_enter(&ipif->ipif_ill->ill_lock);
924 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
925 			mutex_exit(&ipif->ipif_ill->ill_lock);
926 		}
927 	} else {
928 		inet_freemsg(mp);
929 	}
930 	return (B_TRUE);
931 }
932 
933 /*
934  * Called in the conn close path and ill delete path
935  */
936 static void
937 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
938 {
939 	ipsq_t	*ipsq;
940 	mblk_t	*prev;
941 	mblk_t	*curr;
942 	mblk_t	*next;
943 	queue_t	*wq, *rq = NULL;
944 	mblk_t	*tmp_list = NULL;
945 
946 	ASSERT(IAM_WRITER_ILL(ill));
947 	if (connp != NULL)
948 		wq = CONNP_TO_WQ(connp);
949 	else
950 		wq = ill->ill_wq;
951 
952 	/*
953 	 * In the case of lo0 being unplumbed, ill_wq will be NULL. Guard
954 	 * against this here.
955 	 */
956 	if (wq != NULL)
957 		rq = RD(wq);
958 
959 	ipsq = ill->ill_phyint->phyint_ipsq;
960 	/*
961 	 * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
962 	 * In the case of ioctl from a conn, there can be only 1 mp
963 	 * queued on the ipsq. If an ill is being unplumbed flush all
964 	 * the messages.
965 	 */
966 	mutex_enter(&ipsq->ipsq_lock);
967 	for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
968 	    curr = next) {
969 		next = curr->b_next;
970 		if (connp == NULL ||
971 		    (curr->b_queue == wq || curr->b_queue == rq)) {
972 			/* Unlink the mblk from the pending mp list */
973 			if (prev != NULL) {
974 				prev->b_next = curr->b_next;
975 			} else {
976 				ASSERT(ipsq->ipsq_xopq_mphead == curr);
977 				ipsq->ipsq_xopq_mphead = curr->b_next;
978 			}
979 			if (ipsq->ipsq_xopq_mptail == curr)
980 				ipsq->ipsq_xopq_mptail = prev;
981 			/*
982 			 * Create a temporary list and release the ipsq lock
983 			 * New elements are added to the head of the tmp_list
984 			 */
985 			curr->b_next = tmp_list;
986 			tmp_list = curr;
987 		} else {
988 			prev = curr;
989 		}
990 	}
991 	mutex_exit(&ipsq->ipsq_lock);
992 
993 	while (tmp_list != NULL) {
994 		curr = tmp_list;
995 		tmp_list = curr->b_next;
996 		curr->b_next = NULL;
997 		curr->b_prev = NULL;
998 		wq = curr->b_queue;
999 		curr->b_queue = NULL;
1000 		if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1001 			DTRACE_PROBE4(ipif__ioctl,
1002 			    char *, "ipsq_xopq_mp_cleanup",
1003 			    int, 0, ill_t *, NULL, ipif_t *, NULL);
1004 			ip_ioctl_finish(wq, curr, ENXIO, connp != NULL ?
1005 			    CONN_CLOSE : NO_COPYOUT, NULL);
1006 		} else {
1007 			/*
1008 			 * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1009 			 * this can't be just inet_freemsg. we have to
1010 			 * restart it otherwise the thread will be stuck.
1011 			 */
1012 			inet_freemsg(curr);
1013 		}
1014 	}
1015 }
1016 
1017 /*
1018  * This conn has started closing. Cleanup any pending ioctl from this conn.
1019  * STREAMS ensures that there can be at most 1 active ioctl on a stream.
1020  */
1021 void
1022 conn_ioctl_cleanup(conn_t *connp)
1023 {
1024 	ipsq_t	*ipsq;
1025 	ill_t	*ill;
1026 	boolean_t refheld;
1027 
1028 	/*
1029 	 * Check for a queued ioctl. If the ioctl has not yet started, the mp
1030 	 * is pending in the list headed by ipsq_xopq_head. If the ioctl has
1031 	 * started the mp could be present in ipx_pending_mp. Note that if
1032 	 * conn_oper_pending_ill is NULL, the ioctl may still be in flight and
1033 	 * not yet queued anywhere. In this case, the conn close code will wait
1034 	 * until the conn_ref is dropped. If the stream was a tcp stream, then
1035 	 * tcp_close will wait first until all ioctls have completed for this
1036 	 * conn.
1037 	 */
1038 	mutex_enter(&connp->conn_lock);
1039 	ill = connp->conn_oper_pending_ill;
1040 	if (ill == NULL) {
1041 		mutex_exit(&connp->conn_lock);
1042 		return;
1043 	}
1044 
1045 	/*
1046 	 * We may not be able to refhold the ill if the ill/ipif
1047 	 * is changing. But we need to make sure that the ill will
1048 	 * not vanish. So we just bump up the ill_waiter count.
1049 	 */
1050 	refheld = ill_waiter_inc(ill);
1051 	mutex_exit(&connp->conn_lock);
1052 	if (refheld) {
1053 		if (ipsq_enter(ill, B_TRUE, NEW_OP)) {
1054 			ill_waiter_dcr(ill);
1055 			/*
1056 			 * Check whether this ioctl has started and is
1057 			 * pending. If it is not found there then check
1058 			 * whether this ioctl has not even started and is in
1059 			 * the ipsq_xopq list.
1060 			 */
1061 			if (!ipsq_pending_mp_cleanup(ill, connp))
1062 				ipsq_xopq_mp_cleanup(ill, connp);
1063 			ipsq = ill->ill_phyint->phyint_ipsq;
1064 			ipsq_exit(ipsq);
1065 			return;
1066 		}
1067 	}
1068 
1069 	/*
1070 	 * The ill is also closing and we could not bump up the
1071 	 * ill_waiter_count or we could not enter the ipsq. Leave
1072 	 * the cleanup to ill_delete
1073 	 */
1074 	mutex_enter(&connp->conn_lock);
1075 	while (connp->conn_oper_pending_ill != NULL)
1076 		cv_wait(&connp->conn_refcv, &connp->conn_lock);
1077 	mutex_exit(&connp->conn_lock);
1078 	if (refheld)
1079 		ill_waiter_dcr(ill);
1080 }
1081 
1082 /*
1083  * ipcl_walk function for cleaning up conn_*_ill fields.
1084  * Note that we leave ixa_multicast_ifindex, conn_incoming_ifindex, and
1085  * conn_bound_if in place. We prefer dropping
1086  * packets instead of sending them out the wrong interface, or accepting
1087  * packets from the wrong ifindex.
1088  */
1089 static void
1090 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1091 {
1092 	ill_t	*ill = (ill_t *)arg;
1093 
1094 	mutex_enter(&connp->conn_lock);
1095 	if (connp->conn_dhcpinit_ill == ill) {
1096 		connp->conn_dhcpinit_ill = NULL;
1097 		ASSERT(ill->ill_dhcpinit != 0);
1098 		atomic_dec_32(&ill->ill_dhcpinit);
1099 		ill_set_inputfn(ill);
1100 	}
1101 	mutex_exit(&connp->conn_lock);
1102 }
1103 
1104 static int
1105 ill_down_ipifs_tail(ill_t *ill)
1106 {
1107 	ipif_t	*ipif;
1108 	int err;
1109 
1110 	ASSERT(IAM_WRITER_ILL(ill));
1111 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1112 		ipif_non_duplicate(ipif);
1113 		/*
1114 		 * ipif_down_tail will call arp_ll_down on the last ipif
1115 		 * and typically return EINPROGRESS when the DL_UNBIND is sent.
1116 		 */
1117 		if ((err = ipif_down_tail(ipif)) != 0)
1118 			return (err);
1119 	}
1120 	return (0);
1121 }
1122 
1123 /* ARGSUSED */
1124 void
1125 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1126 {
1127 	ASSERT(IAM_WRITER_IPSQ(ipsq));
1128 	(void) ill_down_ipifs_tail(q->q_ptr);
1129 	freemsg(mp);
1130 	ipsq_current_finish(ipsq);
1131 }
1132 
1133 /*
1134  * ill_down_start is called when we want to down this ill and bring it up again
1135  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1136  * all interfaces, but don't tear down any plumbing.
1137  */
1138 boolean_t
1139 ill_down_start(queue_t *q, mblk_t *mp)
1140 {
1141 	ill_t	*ill = q->q_ptr;
1142 	ipif_t	*ipif;
1143 
1144 	ASSERT(IAM_WRITER_ILL(ill));
1145 	/*
1146 	 * It is possible that some ioctl is already in progress while we
1147 	 * received the M_ERROR / M_HANGUP in which case, we need to abort
1148 	 * the ioctl. ill_down_start() is being processed as CUR_OP rather
1149 	 * than as NEW_OP since the cause of the M_ERROR / M_HANGUP may prevent
1150 	 * the in progress ioctl from ever completing.
1151 	 *
1152 	 * The thread that started the ioctl (if any) must have returned,
1153 	 * since we are now executing as writer. After the 2 calls below,
1154 	 * the state of the ipsq and the ill would reflect no trace of any
1155 	 * pending operation. Subsequently if there is any response to the
1156 	 * original ioctl from the driver, it would be discarded as an
1157 	 * unsolicited message from the driver.
1158 	 */
1159 	(void) ipsq_pending_mp_cleanup(ill, NULL);
1160 	ill_dlpi_clear_deferred(ill);
1161 
1162 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1163 		(void) ipif_down(ipif, NULL, NULL);
1164 
1165 	ill_down(ill);
1166 
1167 	/*
1168 	 * Walk all CONNs that can have a reference on an ire or nce for this
1169 	 * ill (we actually walk all that now have stale references).
1170 	 */
1171 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ill->ill_ipst);
1172 
1173 	/* With IPv6 we have dce_ifindex. Cleanup for neatness */
1174 	if (ill->ill_isv6)
1175 		dce_cleanup(ill->ill_phyint->phyint_ifindex, ill->ill_ipst);
1176 
1177 	ipsq_current_start(ill->ill_phyint->phyint_ipsq, ill->ill_ipif, 0);
1178 
1179 	/*
1180 	 * Atomically test and add the pending mp if references are active.
1181 	 */
1182 	mutex_enter(&ill->ill_lock);
1183 	if (!ill_is_quiescent(ill)) {
1184 		/* call cannot fail since `conn_t *' argument is NULL */
1185 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1186 		    mp, ILL_DOWN);
1187 		mutex_exit(&ill->ill_lock);
1188 		return (B_FALSE);
1189 	}
1190 	mutex_exit(&ill->ill_lock);
1191 	return (B_TRUE);
1192 }
1193 
1194 static void
1195 ill_down(ill_t *ill)
1196 {
1197 	mblk_t	*mp;
1198 	ip_stack_t	*ipst = ill->ill_ipst;
1199 
1200 	/*
1201 	 * Blow off any IREs dependent on this ILL.
1202 	 * The caller needs to handle conn_ixa_cleanup
1203 	 */
1204 	ill_delete_ires(ill);
1205 
1206 	ire_walk_ill(0, 0, ill_downi, ill, ill);
1207 
1208 	/* Remove any conn_*_ill depending on this ill */
1209 	ipcl_walk(conn_cleanup_ill, (caddr_t)ill, ipst);
1210 
1211 	/*
1212 	 * Free state for additional IREs.
1213 	 */
1214 	mutex_enter(&ill->ill_saved_ire_lock);
1215 	mp = ill->ill_saved_ire_mp;
1216 	ill->ill_saved_ire_mp = NULL;
1217 	ill->ill_saved_ire_cnt = 0;
1218 	mutex_exit(&ill->ill_saved_ire_lock);
1219 	freemsg(mp);
1220 }
1221 
1222 /*
1223  * ire_walk routine used to delete every IRE that depends on
1224  * 'ill'.  (Always called as writer, and may only be called from ire_walk.)
1225  *
1226  * Note: since the routes added by the kernel are deleted separately,
1227  * this will only be 1) IRE_IF_CLONE and 2) manually added IRE_INTERFACE.
1228  *
1229  * We also remove references on ire_nce_cache entries that refer to the ill.
1230  */
1231 void
1232 ill_downi(ire_t *ire, char *ill_arg)
1233 {
1234 	ill_t	*ill = (ill_t *)ill_arg;
1235 	nce_t	*nce;
1236 
1237 	mutex_enter(&ire->ire_lock);
1238 	nce = ire->ire_nce_cache;
1239 	if (nce != NULL && nce->nce_ill == ill)
1240 		ire->ire_nce_cache = NULL;
1241 	else
1242 		nce = NULL;
1243 	mutex_exit(&ire->ire_lock);
1244 	if (nce != NULL)
1245 		nce_refrele(nce);
1246 	if (ire->ire_ill == ill) {
1247 		/*
1248 		 * The existing interface binding for ire must be
1249 		 * deleted before trying to bind the route to another
1250 		 * interface. However, since we are using the contents of the
1251 		 * ire after ire_delete, the caller has to ensure that
1252 		 * CONDEMNED (deleted) ire's are not removed from the list
1253 		 * when ire_delete() returns. Currently ill_downi() is
1254 		 * only called as part of ire_walk*() routines, so that
1255 		 * the irb_refhold() done by ire_walk*() will ensure that
1256 		 * ire_delete() does not lead to ire_inactive().
1257 		 */
1258 		ASSERT(ire->ire_bucket->irb_refcnt > 0);
1259 		ire_delete(ire);
1260 		if (ire->ire_unbound)
1261 			ire_rebind(ire);
1262 	}
1263 }
1264 
1265 /* Remove IRE_IF_CLONE on this ill */
1266 void
1267 ill_downi_if_clone(ire_t *ire, char *ill_arg)
1268 {
1269 	ill_t	*ill = (ill_t *)ill_arg;
1270 
1271 	ASSERT(ire->ire_type & IRE_IF_CLONE);
1272 	if (ire->ire_ill == ill)
1273 		ire_delete(ire);
1274 }
1275 
1276 /* Consume an M_IOCACK of the fastpath probe. */
1277 void
1278 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1279 {
1280 	mblk_t	*mp1 = mp;
1281 
1282 	/*
1283 	 * If this was the first attempt turn on the fastpath probing.
1284 	 */
1285 	mutex_enter(&ill->ill_lock);
1286 	if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1287 		ill->ill_dlpi_fastpath_state = IDS_OK;
1288 	mutex_exit(&ill->ill_lock);
1289 
1290 	/* Free the M_IOCACK mblk, hold on to the data */
1291 	mp = mp->b_cont;
1292 	freeb(mp1);
1293 	if (mp == NULL)
1294 		return;
1295 	if (mp->b_cont != NULL)
1296 		nce_fastpath_update(ill, mp);
1297 	else
1298 		ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1299 	freemsg(mp);
1300 }
1301 
1302 /*
1303  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1304  * The data portion of the request is a dl_unitdata_req_t template for
1305  * what we would send downstream in the absence of a fastpath confirmation.
1306  */
1307 int
1308 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1309 {
1310 	struct iocblk	*ioc;
1311 	mblk_t	*mp;
1312 
1313 	if (dlur_mp == NULL)
1314 		return (EINVAL);
1315 
1316 	mutex_enter(&ill->ill_lock);
1317 	switch (ill->ill_dlpi_fastpath_state) {
1318 	case IDS_FAILED:
1319 		/*
1320 		 * Driver NAKed the first fastpath ioctl - assume it doesn't
1321 		 * support it.
1322 		 */
1323 		mutex_exit(&ill->ill_lock);
1324 		return (ENOTSUP);
1325 	case IDS_UNKNOWN:
1326 		/* This is the first probe */
1327 		ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1328 		break;
1329 	default:
1330 		break;
1331 	}
1332 	mutex_exit(&ill->ill_lock);
1333 
1334 	if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1335 		return (EAGAIN);
1336 
1337 	mp->b_cont = copyb(dlur_mp);
1338 	if (mp->b_cont == NULL) {
1339 		freeb(mp);
1340 		return (EAGAIN);
1341 	}
1342 
1343 	ioc = (struct iocblk *)mp->b_rptr;
1344 	ioc->ioc_count = msgdsize(mp->b_cont);
1345 
1346 	DTRACE_PROBE3(ill__dlpi, char *, "ill_fastpath_probe",
1347 	    char *, "DL_IOC_HDR_INFO", ill_t *, ill);
1348 	putnext(ill->ill_wq, mp);
1349 	return (0);
1350 }
1351 
1352 void
1353 ill_capability_probe(ill_t *ill)
1354 {
1355 	mblk_t	*mp;
1356 
1357 	ASSERT(IAM_WRITER_ILL(ill));
1358 
1359 	if (ill->ill_dlpi_capab_state != IDCS_UNKNOWN &&
1360 	    ill->ill_dlpi_capab_state != IDCS_FAILED)
1361 		return;
1362 
1363 	/*
1364 	 * We are starting a new cycle of capability negotiation.
1365 	 * Free up the capab reset messages of any previous incarnation.
1366 	 * We will do a fresh allocation when we get the response to our probe
1367 	 */
1368 	if (ill->ill_capab_reset_mp != NULL) {
1369 		freemsg(ill->ill_capab_reset_mp);
1370 		ill->ill_capab_reset_mp = NULL;
1371 	}
1372 
1373 	ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1374 
1375 	mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
1376 	if (mp == NULL)
1377 		return;
1378 
1379 	ill_capability_send(ill, mp);
1380 	ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
1381 }
1382 
1383 void
1384 ill_capability_reset(ill_t *ill, boolean_t reneg)
1385 {
1386 	ASSERT(IAM_WRITER_ILL(ill));
1387 
1388 	if (ill->ill_dlpi_capab_state != IDCS_OK)
1389 		return;
1390 
1391 	ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
1392 
1393 	ill_capability_send(ill, ill->ill_capab_reset_mp);
1394 	ill->ill_capab_reset_mp = NULL;
1395 	/*
1396 	 * We turn off all capabilities except those pertaining to
1397 	 * direct function call capabilities viz. ILL_CAPAB_DLD*
1398 	 * which will be turned off by the corresponding reset functions.
1399 	 */
1400 	ill->ill_capabilities &= ~(ILL_CAPAB_HCKSUM  | ILL_CAPAB_ZEROCOPY);
1401 }
1402 
1403 static void
1404 ill_capability_reset_alloc(ill_t *ill)
1405 {
1406 	mblk_t *mp;
1407 	size_t	size = 0;
1408 	int	err;
1409 	dl_capability_req_t	*capb;
1410 
1411 	ASSERT(IAM_WRITER_ILL(ill));
1412 	ASSERT(ill->ill_capab_reset_mp == NULL);
1413 
1414 	if (ILL_HCKSUM_CAPABLE(ill)) {
1415 		size += sizeof (dl_capability_sub_t) +
1416 		    sizeof (dl_capab_hcksum_t);
1417 	}
1418 
1419 	if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) {
1420 		size += sizeof (dl_capability_sub_t) +
1421 		    sizeof (dl_capab_zerocopy_t);
1422 	}
1423 
1424 	if (ill->ill_capabilities & ILL_CAPAB_DLD) {
1425 		size += sizeof (dl_capability_sub_t) +
1426 		    sizeof (dl_capab_dld_t);
1427 	}
1428 
1429 	mp = allocb_wait(size + sizeof (dl_capability_req_t), BPRI_MED,
1430 	    STR_NOSIG, &err);
1431 
1432 	mp->b_datap->db_type = M_PROTO;
1433 	bzero(mp->b_rptr, size + sizeof (dl_capability_req_t));
1434 
1435 	capb = (dl_capability_req_t *)mp->b_rptr;
1436 	capb->dl_primitive = DL_CAPABILITY_REQ;
1437 	capb->dl_sub_offset = sizeof (dl_capability_req_t);
1438 	capb->dl_sub_length = size;
1439 
1440 	mp->b_wptr += sizeof (dl_capability_req_t);
1441 
1442 	/*
1443 	 * Each handler fills in the corresponding dl_capability_sub_t
1444 	 * inside the mblk,
1445 	 */
1446 	ill_capability_hcksum_reset_fill(ill, mp);
1447 	ill_capability_zerocopy_reset_fill(ill, mp);
1448 	ill_capability_dld_reset_fill(ill, mp);
1449 
1450 	ill->ill_capab_reset_mp = mp;
1451 }
1452 
1453 static void
1454 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1455 {
1456 	dl_capab_id_t *id_ic;
1457 	uint_t sub_dl_cap = outers->dl_cap;
1458 	dl_capability_sub_t *inners;
1459 	uint8_t *capend;
1460 
1461 	ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1462 
1463 	/*
1464 	 * Note: range checks here are not absolutely sufficient to
1465 	 * make us robust against malformed messages sent by drivers;
1466 	 * this is in keeping with the rest of IP's dlpi handling.
1467 	 * (Remember, it's coming from something else in the kernel
1468 	 * address space)
1469 	 */
1470 
1471 	capend = (uint8_t *)(outers + 1) + outers->dl_length;
1472 	if (capend > mp->b_wptr) {
1473 		cmn_err(CE_WARN, "ill_capability_id_ack: "
1474 		    "malformed sub-capability too long for mblk");
1475 		return;
1476 	}
1477 
1478 	id_ic = (dl_capab_id_t *)(outers + 1);
1479 
1480 	inners = &id_ic->id_subcap;
1481 	if (outers->dl_length < sizeof (*id_ic) ||
1482 	    inners->dl_length > (outers->dl_length - sizeof (*inners))) {
1483 		cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1484 		    "encapsulated capab type %d too long for mblk",
1485 		    inners->dl_cap);
1486 		return;
1487 	}
1488 
1489 	if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1490 		ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1491 		    "isn't as expected; pass-thru module(s) detected, "
1492 		    "discarding capability\n", inners->dl_cap));
1493 		return;
1494 	}
1495 
1496 	/* Process the encapsulated sub-capability */
1497 	ill_capability_dispatch(ill, mp, inners);
1498 }
1499 
1500 static void
1501 ill_capability_dld_reset_fill(ill_t *ill, mblk_t *mp)
1502 {
1503 	dl_capability_sub_t *dl_subcap;
1504 
1505 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
1506 		return;
1507 
1508 	/*
1509 	 * The dl_capab_dld_t that follows the dl_capability_sub_t is not
1510 	 * initialized below since it is not used by DLD.
1511 	 */
1512 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1513 	dl_subcap->dl_cap = DL_CAPAB_DLD;
1514 	dl_subcap->dl_length = sizeof (dl_capab_dld_t);
1515 
1516 	mp->b_wptr += sizeof (dl_capability_sub_t) + sizeof (dl_capab_dld_t);
1517 }
1518 
1519 static void
1520 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp)
1521 {
1522 	/*
1523 	 * If no ipif was brought up over this ill, this DL_CAPABILITY_REQ/ACK
1524 	 * is only to get the VRRP capability.
1525 	 *
1526 	 * Note that we cannot check ill_ipif_up_count here since
1527 	 * ill_ipif_up_count is only incremented when the resolver is setup.
1528 	 * That is done asynchronously, and can race with this function.
1529 	 */
1530 	if (!ill->ill_dl_up) {
1531 		if (subp->dl_cap == DL_CAPAB_VRRP)
1532 			ill_capability_vrrp_ack(ill, mp, subp);
1533 		return;
1534 	}
1535 
1536 	switch (subp->dl_cap) {
1537 	case DL_CAPAB_HCKSUM:
1538 		ill_capability_hcksum_ack(ill, mp, subp);
1539 		break;
1540 	case DL_CAPAB_ZEROCOPY:
1541 		ill_capability_zerocopy_ack(ill, mp, subp);
1542 		break;
1543 	case DL_CAPAB_DLD:
1544 		ill_capability_dld_ack(ill, mp, subp);
1545 		break;
1546 	case DL_CAPAB_VRRP:
1547 		break;
1548 	default:
1549 		ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
1550 		    subp->dl_cap));
1551 	}
1552 }
1553 
1554 /*
1555  * Process the vrrp capability received from a DLS Provider. isub must point
1556  * to the sub-capability (DL_CAPAB_VRRP) of a DL_CAPABILITY_ACK message.
1557  */
1558 static void
1559 ill_capability_vrrp_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1560 {
1561 	dl_capab_vrrp_t	*vrrp;
1562 	uint_t		sub_dl_cap = isub->dl_cap;
1563 	uint8_t		*capend;
1564 
1565 	ASSERT(IAM_WRITER_ILL(ill));
1566 	ASSERT(sub_dl_cap == DL_CAPAB_VRRP);
1567 
1568 	/*
1569 	 * Note: range checks here are not absolutely sufficient to
1570 	 * make us robust against malformed messages sent by drivers;
1571 	 * this is in keeping with the rest of IP's dlpi handling.
1572 	 * (Remember, it's coming from something else in the kernel
1573 	 * address space)
1574 	 */
1575 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1576 	if (capend > mp->b_wptr) {
1577 		cmn_err(CE_WARN, "ill_capability_vrrp_ack: "
1578 		    "malformed sub-capability too long for mblk");
1579 		return;
1580 	}
1581 	vrrp = (dl_capab_vrrp_t *)(isub + 1);
1582 
1583 	/*
1584 	 * Compare the IP address family and set ILLF_VRRP for the right ill.
1585 	 */
1586 	if ((vrrp->vrrp_af == AF_INET6 && ill->ill_isv6) ||
1587 	    (vrrp->vrrp_af == AF_INET && !ill->ill_isv6)) {
1588 		ill->ill_flags |= ILLF_VRRP;
1589 	}
1590 }
1591 
1592 /*
1593  * Process a hardware checksum offload capability negotiation ack received
1594  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
1595  * of a DL_CAPABILITY_ACK message.
1596  */
1597 static void
1598 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1599 {
1600 	dl_capability_req_t	*ocap;
1601 	dl_capab_hcksum_t	*ihck, *ohck;
1602 	ill_hcksum_capab_t	**ill_hcksum;
1603 	mblk_t			*nmp = NULL;
1604 	uint_t			sub_dl_cap = isub->dl_cap;
1605 	uint8_t			*capend;
1606 
1607 	ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
1608 
1609 	ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
1610 
1611 	/*
1612 	 * Note: range checks here are not absolutely sufficient to
1613 	 * make us robust against malformed messages sent by drivers;
1614 	 * this is in keeping with the rest of IP's dlpi handling.
1615 	 * (Remember, it's coming from something else in the kernel
1616 	 * address space)
1617 	 */
1618 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1619 	if (capend > mp->b_wptr) {
1620 		cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1621 		    "malformed sub-capability too long for mblk");
1622 		return;
1623 	}
1624 
1625 	/*
1626 	 * There are two types of acks we process here:
1627 	 * 1. acks in reply to a (first form) generic capability req
1628 	 *    (no ENABLE flag set)
1629 	 * 2. acks in reply to a ENABLE capability req.
1630 	 *    (ENABLE flag set)
1631 	 */
1632 	ihck = (dl_capab_hcksum_t *)(isub + 1);
1633 
1634 	if (ihck->hcksum_version != HCKSUM_VERSION_1) {
1635 		cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
1636 		    "unsupported hardware checksum "
1637 		    "sub-capability (version %d, expected %d)",
1638 		    ihck->hcksum_version, HCKSUM_VERSION_1);
1639 		return;
1640 	}
1641 
1642 	if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
1643 		ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
1644 		    "checksum capability isn't as expected; pass-thru "
1645 		    "module(s) detected, discarding capability\n"));
1646 		return;
1647 	}
1648 
1649 #define	CURR_HCKSUM_CAPAB				\
1650 	(HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |	\
1651 	HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
1652 
1653 	if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
1654 	    (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
1655 		/* do ENABLE processing */
1656 		if (*ill_hcksum == NULL) {
1657 			*ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
1658 			    KM_NOSLEEP);
1659 
1660 			if (*ill_hcksum == NULL) {
1661 				cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1662 				    "could not enable hcksum version %d "
1663 				    "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
1664 				    ill->ill_name);
1665 				return;
1666 			}
1667 		}
1668 
1669 		(*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
1670 		(*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
1671 		ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
1672 		ip1dbg(("ill_capability_hcksum_ack: interface %s "
1673 		    "has enabled hardware checksumming\n ",
1674 		    ill->ill_name));
1675 	} else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
1676 		/*
1677 		 * Enabling hardware checksum offload
1678 		 * Currently IP supports {TCP,UDP}/IPv4
1679 		 * partial and full cksum offload and
1680 		 * IPv4 header checksum offload.
1681 		 * Allocate new mblk which will
1682 		 * contain a new capability request
1683 		 * to enable hardware checksum offload.
1684 		 */
1685 		uint_t	size;
1686 		uchar_t	*rptr;
1687 
1688 		size = sizeof (dl_capability_req_t) +
1689 		    sizeof (dl_capability_sub_t) + isub->dl_length;
1690 
1691 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1692 			cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1693 			    "could not enable hardware cksum for %s (ENOMEM)\n",
1694 			    ill->ill_name);
1695 			return;
1696 		}
1697 
1698 		rptr = nmp->b_rptr;
1699 		/* initialize dl_capability_req_t */
1700 		ocap = (dl_capability_req_t *)nmp->b_rptr;
1701 		ocap->dl_sub_offset =
1702 		    sizeof (dl_capability_req_t);
1703 		ocap->dl_sub_length =
1704 		    sizeof (dl_capability_sub_t) +
1705 		    isub->dl_length;
1706 		nmp->b_rptr += sizeof (dl_capability_req_t);
1707 
1708 		/* initialize dl_capability_sub_t */
1709 		bcopy(isub, nmp->b_rptr, sizeof (*isub));
1710 		nmp->b_rptr += sizeof (*isub);
1711 
1712 		/* initialize dl_capab_hcksum_t */
1713 		ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
1714 		bcopy(ihck, ohck, sizeof (*ihck));
1715 
1716 		nmp->b_rptr = rptr;
1717 		ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
1718 
1719 		/* Set ENABLE flag */
1720 		ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
1721 		ohck->hcksum_txflags |= HCKSUM_ENABLE;
1722 
1723 		/*
1724 		 * nmp points to a DL_CAPABILITY_REQ message to enable
1725 		 * hardware checksum acceleration.
1726 		 */
1727 		ill_capability_send(ill, nmp);
1728 	} else {
1729 		ip1dbg(("ill_capability_hcksum_ack: interface %s has "
1730 		    "advertised %x hardware checksum capability flags\n",
1731 		    ill->ill_name, ihck->hcksum_txflags));
1732 	}
1733 }
1734 
1735 static void
1736 ill_capability_hcksum_reset_fill(ill_t *ill, mblk_t *mp)
1737 {
1738 	dl_capab_hcksum_t *hck_subcap;
1739 	dl_capability_sub_t *dl_subcap;
1740 
1741 	if (!ILL_HCKSUM_CAPABLE(ill))
1742 		return;
1743 
1744 	ASSERT(ill->ill_hcksum_capab != NULL);
1745 
1746 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1747 	dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
1748 	dl_subcap->dl_length = sizeof (*hck_subcap);
1749 
1750 	hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
1751 	hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
1752 	hck_subcap->hcksum_txflags = 0;
1753 
1754 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*hck_subcap);
1755 }
1756 
1757 static void
1758 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1759 {
1760 	mblk_t *nmp = NULL;
1761 	dl_capability_req_t *oc;
1762 	dl_capab_zerocopy_t *zc_ic, *zc_oc;
1763 	ill_zerocopy_capab_t **ill_zerocopy_capab;
1764 	uint_t sub_dl_cap = isub->dl_cap;
1765 	uint8_t *capend;
1766 
1767 	ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
1768 
1769 	ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
1770 
1771 	/*
1772 	 * Note: range checks here are not absolutely sufficient to
1773 	 * make us robust against malformed messages sent by drivers;
1774 	 * this is in keeping with the rest of IP's dlpi handling.
1775 	 * (Remember, it's coming from something else in the kernel
1776 	 * address space)
1777 	 */
1778 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1779 	if (capend > mp->b_wptr) {
1780 		cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1781 		    "malformed sub-capability too long for mblk");
1782 		return;
1783 	}
1784 
1785 	zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
1786 	if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
1787 		cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
1788 		    "unsupported ZEROCOPY sub-capability (version %d, "
1789 		    "expected %d)", zc_ic->zerocopy_version,
1790 		    ZEROCOPY_VERSION_1);
1791 		return;
1792 	}
1793 
1794 	if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
1795 		ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
1796 		    "capability isn't as expected; pass-thru module(s) "
1797 		    "detected, discarding capability\n"));
1798 		return;
1799 	}
1800 
1801 	if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
1802 		if (*ill_zerocopy_capab == NULL) {
1803 			*ill_zerocopy_capab =
1804 			    kmem_zalloc(sizeof (ill_zerocopy_capab_t),
1805 			    KM_NOSLEEP);
1806 
1807 			if (*ill_zerocopy_capab == NULL) {
1808 				cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1809 				    "could not enable Zero-copy version %d "
1810 				    "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
1811 				    ill->ill_name);
1812 				return;
1813 			}
1814 		}
1815 
1816 		ip1dbg(("ill_capability_zerocopy_ack: interface %s "
1817 		    "supports Zero-copy version %d\n", ill->ill_name,
1818 		    ZEROCOPY_VERSION_1));
1819 
1820 		(*ill_zerocopy_capab)->ill_zerocopy_version =
1821 		    zc_ic->zerocopy_version;
1822 		(*ill_zerocopy_capab)->ill_zerocopy_flags =
1823 		    zc_ic->zerocopy_flags;
1824 
1825 		ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
1826 	} else {
1827 		uint_t size;
1828 		uchar_t *rptr;
1829 
1830 		size = sizeof (dl_capability_req_t) +
1831 		    sizeof (dl_capability_sub_t) +
1832 		    sizeof (dl_capab_zerocopy_t);
1833 
1834 		if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1835 			cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1836 			    "could not enable zerocopy for %s (ENOMEM)\n",
1837 			    ill->ill_name);
1838 			return;
1839 		}
1840 
1841 		rptr = nmp->b_rptr;
1842 		/* initialize dl_capability_req_t */
1843 		oc = (dl_capability_req_t *)rptr;
1844 		oc->dl_sub_offset = sizeof (dl_capability_req_t);
1845 		oc->dl_sub_length = sizeof (dl_capability_sub_t) +
1846 		    sizeof (dl_capab_zerocopy_t);
1847 		rptr += sizeof (dl_capability_req_t);
1848 
1849 		/* initialize dl_capability_sub_t */
1850 		bcopy(isub, rptr, sizeof (*isub));
1851 		rptr += sizeof (*isub);
1852 
1853 		/* initialize dl_capab_zerocopy_t */
1854 		zc_oc = (dl_capab_zerocopy_t *)rptr;
1855 		*zc_oc = *zc_ic;
1856 
1857 		ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
1858 		    "to enable zero-copy version %d\n", ill->ill_name,
1859 		    ZEROCOPY_VERSION_1));
1860 
1861 		/* set VMSAFE_MEM flag */
1862 		zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
1863 
1864 		/* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
1865 		ill_capability_send(ill, nmp);
1866 	}
1867 }
1868 
1869 static void
1870 ill_capability_zerocopy_reset_fill(ill_t *ill, mblk_t *mp)
1871 {
1872 	dl_capab_zerocopy_t *zerocopy_subcap;
1873 	dl_capability_sub_t *dl_subcap;
1874 
1875 	if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
1876 		return;
1877 
1878 	ASSERT(ill->ill_zerocopy_capab != NULL);
1879 
1880 	dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1881 	dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
1882 	dl_subcap->dl_length = sizeof (*zerocopy_subcap);
1883 
1884 	zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
1885 	zerocopy_subcap->zerocopy_version =
1886 	    ill->ill_zerocopy_capab->ill_zerocopy_version;
1887 	zerocopy_subcap->zerocopy_flags = 0;
1888 
1889 	mp->b_wptr += sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
1890 }
1891 
1892 /*
1893  * DLD capability
1894  * Refer to dld.h for more information regarding the purpose and usage
1895  * of this capability.
1896  */
1897 static void
1898 ill_capability_dld_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1899 {
1900 	dl_capab_dld_t		*dld_ic, dld;
1901 	uint_t			sub_dl_cap = isub->dl_cap;
1902 	uint8_t			*capend;
1903 	ill_dld_capab_t		*idc;
1904 
1905 	ASSERT(IAM_WRITER_ILL(ill));
1906 	ASSERT(sub_dl_cap == DL_CAPAB_DLD);
1907 
1908 	/*
1909 	 * Note: range checks here are not absolutely sufficient to
1910 	 * make us robust against malformed messages sent by drivers;
1911 	 * this is in keeping with the rest of IP's dlpi handling.
1912 	 * (Remember, it's coming from something else in the kernel
1913 	 * address space)
1914 	 */
1915 	capend = (uint8_t *)(isub + 1) + isub->dl_length;
1916 	if (capend > mp->b_wptr) {
1917 		cmn_err(CE_WARN, "ill_capability_dld_ack: "
1918 		    "malformed sub-capability too long for mblk");
1919 		return;
1920 	}
1921 	dld_ic = (dl_capab_dld_t *)(isub + 1);
1922 	if (dld_ic->dld_version != DLD_CURRENT_VERSION) {
1923 		cmn_err(CE_CONT, "ill_capability_dld_ack: "
1924 		    "unsupported DLD sub-capability (version %d, "
1925 		    "expected %d)", dld_ic->dld_version,
1926 		    DLD_CURRENT_VERSION);
1927 		return;
1928 	}
1929 	if (!dlcapabcheckqid(&dld_ic->dld_mid, ill->ill_lmod_rq)) {
1930 		ip1dbg(("ill_capability_dld_ack: mid token for dld "
1931 		    "capability isn't as expected; pass-thru module(s) "
1932 		    "detected, discarding capability\n"));
1933 		return;
1934 	}
1935 
1936 	/*
1937 	 * Copy locally to ensure alignment.
1938 	 */
1939 	bcopy(dld_ic, &dld, sizeof (dl_capab_dld_t));
1940 
1941 	if ((idc = ill->ill_dld_capab) == NULL) {
1942 		idc = kmem_zalloc(sizeof (ill_dld_capab_t), KM_NOSLEEP);
1943 		if (idc == NULL) {
1944 			cmn_err(CE_WARN, "ill_capability_dld_ack: "
1945 			    "could not enable DLD version %d "
1946 			    "for %s (ENOMEM)\n", DLD_CURRENT_VERSION,
1947 			    ill->ill_name);
1948 			return;
1949 		}
1950 		ill->ill_dld_capab = idc;
1951 	}
1952 	idc->idc_capab_df = (ip_capab_func_t)dld.dld_capab;
1953 	idc->idc_capab_dh = (void *)dld.dld_capab_handle;
1954 	ip1dbg(("ill_capability_dld_ack: interface %s "
1955 	    "supports DLD version %d\n", ill->ill_name, DLD_CURRENT_VERSION));
1956 
1957 	ill_capability_dld_enable(ill);
1958 }
1959 
1960 /*
1961  * Typically capability negotiation between IP and the driver happens via
1962  * DLPI message exchange. However GLD also offers a direct function call
1963  * mechanism to exchange the DLD_DIRECT_CAPAB and DLD_POLL_CAPAB capabilities,
1964  * But arbitrary function calls into IP or GLD are not permitted, since both
1965  * of them are protected by their own perimeter mechanism. The perimeter can
1966  * be viewed as a coarse lock or serialization mechanism. The hierarchy of
1967  * these perimeters is IP -> MAC. Thus for example to enable the squeue
1968  * polling, IP needs to enter its perimeter, then call ill_mac_perim_enter
1969  * to enter the mac perimeter and then do the direct function calls into
1970  * GLD to enable squeue polling. The ring related callbacks from the mac into
1971  * the stack to add, bind, quiesce, restart or cleanup a ring are all
1972  * protected by the mac perimeter.
1973  */
1974 static void
1975 ill_mac_perim_enter(ill_t *ill, mac_perim_handle_t *mphp)
1976 {
1977 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1978 	int			err;
1979 
1980 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mphp,
1981 	    DLD_ENABLE);
1982 	ASSERT(err == 0);
1983 }
1984 
1985 static void
1986 ill_mac_perim_exit(ill_t *ill, mac_perim_handle_t mph)
1987 {
1988 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
1989 	int			err;
1990 
1991 	err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mph,
1992 	    DLD_DISABLE);
1993 	ASSERT(err == 0);
1994 }
1995 
1996 boolean_t
1997 ill_mac_perim_held(ill_t *ill)
1998 {
1999 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2000 
2001 	return (idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, NULL,
2002 	    DLD_QUERY));
2003 }
2004 
2005 static void
2006 ill_capability_direct_enable(ill_t *ill)
2007 {
2008 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2009 	ill_dld_direct_t	*idd = &idc->idc_direct;
2010 	dld_capab_direct_t	direct;
2011 	int			rc;
2012 
2013 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2014 
2015 	bzero(&direct, sizeof (direct));
2016 	direct.di_rx_cf = (uintptr_t)ip_input;
2017 	direct.di_rx_ch = ill;
2018 
2019 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT, &direct,
2020 	    DLD_ENABLE);
2021 	if (rc == 0) {
2022 		idd->idd_tx_df = (ip_dld_tx_t)direct.di_tx_df;
2023 		idd->idd_tx_dh = direct.di_tx_dh;
2024 		idd->idd_tx_cb_df = (ip_dld_callb_t)direct.di_tx_cb_df;
2025 		idd->idd_tx_cb_dh = direct.di_tx_cb_dh;
2026 		idd->idd_tx_fctl_df = (ip_dld_fctl_t)direct.di_tx_fctl_df;
2027 		idd->idd_tx_fctl_dh = direct.di_tx_fctl_dh;
2028 		ASSERT(idd->idd_tx_cb_df != NULL);
2029 		ASSERT(idd->idd_tx_fctl_df != NULL);
2030 		ASSERT(idd->idd_tx_df != NULL);
2031 		/*
2032 		 * One time registration of flow enable callback function
2033 		 */
2034 		ill->ill_flownotify_mh = idd->idd_tx_cb_df(idd->idd_tx_cb_dh,
2035 		    ill_flow_enable, ill);
2036 		ill->ill_capabilities |= ILL_CAPAB_DLD_DIRECT;
2037 		DTRACE_PROBE1(direct_on, (ill_t *), ill);
2038 	} else {
2039 		cmn_err(CE_WARN, "warning: could not enable DIRECT "
2040 		    "capability, rc = %d\n", rc);
2041 		DTRACE_PROBE2(direct_off, (ill_t *), ill, (int), rc);
2042 	}
2043 }
2044 
2045 static void
2046 ill_capability_poll_enable(ill_t *ill)
2047 {
2048 	ill_dld_capab_t		*idc = ill->ill_dld_capab;
2049 	dld_capab_poll_t	poll;
2050 	int			rc;
2051 
2052 	ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2053 
2054 	bzero(&poll, sizeof (poll));
2055 	poll.poll_ring_add_cf = (uintptr_t)ip_squeue_add_ring;
2056 	poll.poll_ring_remove_cf = (uintptr_t)ip_squeue_clean_ring;
2057 	poll.poll_ring_quiesce_cf = (uintptr_t)ip_squeue_quiesce_ring;
2058 	poll.poll_ring_restart_cf = (uintptr_t)ip_squeue_restart_ring;
2059 	poll.poll_ring_bind_cf = (uintptr_t)ip_squeue_bind_ring;
2060 	poll.poll_ring_ch = ill;
2061 	rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL, &poll,
2062 	    DLD_ENABLE);
2063 	if (rc == 0) {
2064 		ill->ill_capabilities |= ILL_CAPAB_DLD_POLL;
2065 		DTRACE_PROBE1(poll_on, (ill_t *), ill);
2066 	} else {
2067 		ip1dbg(("warning: could not enable POLL "
2068 		    "capability, rc = %d\n", rc));
2069 		DTRACE_PROBE2(poll_off, (ill_t *), ill, (int), rc);
2070 	}
2071 }
2072 
2073 /*
2074  * Enable the LSO capability.
2075  */
2076 static void
2077 ill_capability_lso_enable(ill_t *ill)
2078 {
2079 	ill_dld_capab_t	*idc = ill->ill_dld_capab;
2080 	dld_capab_lso_t	lso;
2081 	int rc;
2082 
2083 	ASSERT(IAM_WRITER_ILL(ill));
2084 
2085 	if (ill->ill_lso_capab == NULL) {
2086 		ill->ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
2087 		    KM_NOSLEEP);
2088 		if (ill->ill_lso_capab == NULL) {
2089 			cmn_err(CE_WARN, "ill_capability_lso_enable: "
2090 			    "could not enable LSO for %s (ENOMEM)\n",
2091 			    ill->ill_name);
2092 			return;
2093 		}
2094 	}
2095 
2096 	bzero(&lso, sizeof (lso));
2097 	if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO, &lso,
2098 	    DLD_ENABLE)) == 0) {
2099 		ill->ill_lso_capab->ill_lso_flags = lso.lso_flags;
2100 		ill->ill_lso_capab->ill_lso_max_tcpv4 = lso.lso_max_tcpv4;
2101 		ill->ill_lso_capab->ill_lso_max_tcpv6 = lso.lso_max_tcpv6;
2102 		ill->ill_capabilities |= ILL_CAPAB_LSO;
2103 		ip1dbg(("ill_capability_lso_enable: interface %s "
2104 		    "has enabled LSO\n ", ill->ill_name));
2105 	} else {
2106 		kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
2107 		ill->ill_lso_capab = NULL;
2108 		DTRACE_PROBE2(lso_off, (ill_t *), ill, (int), rc);
2109 	}
2110 }
2111 
2112 static void
2113 ill_capability_dld_enable(ill_t *ill)
2114 {
2115 	mac_perim_handle_t mph;
2116 
2117 	ASSERT(IAM_WRITER_ILL(ill));
2118 
2119 	ill_mac_perim_enter(ill, &mph);
2120 	if (!ill->ill_isv6) {
2121 		ill_capability_direct_enable(ill);
2122 		ill_capability_poll_enable(ill);
2123 	}
2124 	ill_capability_lso_enable(ill);
2125 	ill->ill_capabilities |= ILL_CAPAB_DLD;
2126 	ill_mac_perim_exit(ill, mph);
2127 }
2128 
2129 static void
2130 ill_capability_dld_disable(ill_t *ill)
2131 {
2132 	ill_dld_capab_t	*idc;
2133 	ill_dld_direct_t *idd;
2134 	mac_perim_handle_t	mph;
2135 
2136 	ASSERT(IAM_WRITER_ILL(ill));
2137 
2138 	if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
2139 		return;
2140 
2141 	ill_mac_perim_enter(ill, &mph);
2142 
2143 	idc = ill->ill_dld_capab;
2144 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT) != 0) {
2145 		/*
2146 		 * For performance we avoid locks in the transmit data path
2147 		 * and don't maintain a count of the number of threads using
2148 		 * direct calls. Thus some threads could be using direct
2149 		 * transmit calls to GLD, even after the capability mechanism
2150 		 * turns it off. This is still safe since the handles used in
2151 		 * the direct calls continue to be valid until the unplumb is
2152 		 * completed. Remove the callback that was added (1-time) at
2153 		 * capab enable time.
2154 		 */
2155 		mutex_enter(&ill->ill_lock);
2156 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_DIRECT;
2157 		mutex_exit(&ill->ill_lock);
2158 		if (ill->ill_flownotify_mh != NULL) {
2159 			idd = &idc->idc_direct;
2160 			idd->idd_tx_cb_df(idd->idd_tx_cb_dh, NULL,
2161 			    ill->ill_flownotify_mh);
2162 			ill->ill_flownotify_mh = NULL;
2163 		}
2164 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT,
2165 		    NULL, DLD_DISABLE);
2166 	}
2167 
2168 	if ((ill->ill_capabilities & ILL_CAPAB_DLD_POLL) != 0) {
2169 		ill->ill_capabilities &= ~ILL_CAPAB_DLD_POLL;
2170 		ip_squeue_clean_all(ill);
2171 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL,
2172 		    NULL, DLD_DISABLE);
2173 	}
2174 
2175 	if ((ill->ill_capabilities & ILL_CAPAB_LSO) != 0) {
2176 		ASSERT(ill->ill_lso_capab != NULL);
2177 		/*
2178 		 * Clear the capability flag for LSO but retain the
2179 		 * ill_lso_capab structure since it's possible that another
2180 		 * thread is still referring to it.  The structure only gets
2181 		 * deallocated when we destroy the ill.
2182 		 */
2183 
2184 		ill->ill_capabilities &= ~ILL_CAPAB_LSO;
2185 		(void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO,
2186 		    NULL, DLD_DISABLE);
2187 	}
2188 
2189 	ill->ill_capabilities &= ~ILL_CAPAB_DLD;
2190 	ill_mac_perim_exit(ill, mph);
2191 }
2192 
2193 /*
2194  * Capability Negotiation protocol
2195  *
2196  * We don't wait for DLPI capability operations to finish during interface
2197  * bringup or teardown. Doing so would introduce more asynchrony and the
2198  * interface up/down operations will need multiple return and restarts.
2199  * Instead the 'ipsq_current_ipif' of the ipsq is not cleared as long as
2200  * the 'ill_dlpi_deferred' chain is non-empty. This ensures that the next
2201  * exclusive operation won't start until the DLPI operations of the previous
2202  * exclusive operation complete.
2203  *
2204  * The capability state machine is shown below.
2205  *
2206  * state		next state		event, action
2207  *
2208  * IDCS_UNKNOWN		IDCS_PROBE_SENT		ill_capability_probe
2209  * IDCS_PROBE_SENT	IDCS_OK			ill_capability_ack
2210  * IDCS_PROBE_SENT	IDCS_FAILED		ip_rput_dlpi_writer (nack)
2211  * IDCS_OK		IDCS_RENEG		Receipt of DL_NOTE_CAPAB_RENEG
2212  * IDCS_OK		IDCS_RESET_SENT		ill_capability_reset
2213  * IDCS_RESET_SENT	IDCS_UNKNOWN		ill_capability_ack_thr
2214  * IDCS_RENEG		IDCS_PROBE_SENT		ill_capability_ack_thr ->
2215  *						    ill_capability_probe.
2216  */
2217 
2218 /*
2219  * Dedicated thread started from ip_stack_init that handles capability
2220  * disable. This thread ensures the taskq dispatch does not fail by waiting
2221  * for resources using TQ_SLEEP. The taskq mechanism is used to ensure
2222  * that direct calls to DLD are done in a cv_waitable context.
2223  */
2224 void
2225 ill_taskq_dispatch(ip_stack_t *ipst)
2226 {
2227 	callb_cpr_t cprinfo;
2228 	char	name[64];
2229 	mblk_t	*mp;
2230 
2231 	(void) snprintf(name, sizeof (name), "ill_taskq_dispatch_%d",
2232 	    ipst->ips_netstack->netstack_stackid);
2233 	CALLB_CPR_INIT(&cprinfo, &ipst->ips_capab_taskq_lock, callb_generic_cpr,
2234 	    name);
2235 	mutex_enter(&ipst->ips_capab_taskq_lock);
2236 
2237 	for (;;) {
2238 		mp = ipst->ips_capab_taskq_head;
2239 		while (mp != NULL) {
2240 			ipst->ips_capab_taskq_head = mp->b_next;
2241 			if (ipst->ips_capab_taskq_head == NULL)
2242 				ipst->ips_capab_taskq_tail = NULL;
2243 			mutex_exit(&ipst->ips_capab_taskq_lock);
2244 			mp->b_next = NULL;
2245 
2246 			VERIFY(taskq_dispatch(system_taskq,
2247 			    ill_capability_ack_thr, mp, TQ_SLEEP) !=
2248 			    TASKQID_INVALID);
2249 			mutex_enter(&ipst->ips_capab_taskq_lock);
2250 			mp = ipst->ips_capab_taskq_head;
2251 		}
2252 
2253 		if (ipst->ips_capab_taskq_quit)
2254 			break;
2255 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
2256 		cv_wait(&ipst->ips_capab_taskq_cv, &ipst->ips_capab_taskq_lock);
2257 		CALLB_CPR_SAFE_END(&cprinfo, &ipst->ips_capab_taskq_lock);
2258 	}
2259 	VERIFY(ipst->ips_capab_taskq_head == NULL);
2260 	VERIFY(ipst->ips_capab_taskq_tail == NULL);
2261 	CALLB_CPR_EXIT(&cprinfo);
2262 	thread_exit();
2263 }
2264 
2265 /*
2266  * Consume a new-style hardware capabilities negotiation ack.
2267  * Called via taskq on receipt of DL_CAPABILITY_ACK.
2268  */
2269 static void
2270 ill_capability_ack_thr(void *arg)
2271 {
2272 	mblk_t	*mp = arg;
2273 	dl_capability_ack_t *capp;
2274 	dl_capability_sub_t *subp, *endp;
2275 	ill_t	*ill;
2276 	boolean_t reneg;
2277 
2278 	ill = (ill_t *)mp->b_prev;
2279 	mp->b_prev = NULL;
2280 
2281 	VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
2282 
2283 	if (ill->ill_dlpi_capab_state == IDCS_RESET_SENT ||
2284 	    ill->ill_dlpi_capab_state == IDCS_RENEG) {
2285 		/*
2286 		 * We have received the ack for our DL_CAPAB reset request.
2287 		 * There isnt' anything in the message that needs processing.
2288 		 * All message based capabilities have been disabled, now
2289 		 * do the function call based capability disable.
2290 		 */
2291 		reneg = ill->ill_dlpi_capab_state == IDCS_RENEG;
2292 		ill_capability_dld_disable(ill);
2293 		ill->ill_dlpi_capab_state = IDCS_UNKNOWN;
2294 		if (reneg)
2295 			ill_capability_probe(ill);
2296 		goto done;
2297 	}
2298 
2299 	if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
2300 		ill->ill_dlpi_capab_state = IDCS_OK;
2301 
2302 	capp = (dl_capability_ack_t *)mp->b_rptr;
2303 
2304 	if (capp->dl_sub_length == 0) {
2305 		/* no new-style capabilities */
2306 		goto done;
2307 	}
2308 
2309 	/* make sure the driver supplied correct dl_sub_length */
2310 	if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
2311 		ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
2312 		    "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
2313 		goto done;
2314 	}
2315 
2316 #define	SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
2317 	/*
2318 	 * There are sub-capabilities. Process the ones we know about.
2319 	 * Loop until we don't have room for another sub-cap header..
2320 	 */
2321 	for (subp = SC(capp, capp->dl_sub_offset),
2322 	    endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
2323 	    subp <= endp;
2324 	    subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
2325 
2326 		switch (subp->dl_cap) {
2327 		case DL_CAPAB_ID_WRAPPER:
2328 			ill_capability_id_ack(ill, mp, subp);
2329 			break;
2330 		default:
2331 			ill_capability_dispatch(ill, mp, subp);
2332 			break;
2333 		}
2334 	}
2335 #undef SC
2336 done:
2337 	inet_freemsg(mp);
2338 	ill_capability_done(ill);
2339 	ipsq_exit(ill->ill_phyint->phyint_ipsq);
2340 }
2341 
2342 /*
2343  * This needs to be started in a taskq thread to provide a cv_waitable
2344  * context.
2345  */
2346 void
2347 ill_capability_ack(ill_t *ill, mblk_t *mp)
2348 {
2349 	ip_stack_t	*ipst = ill->ill_ipst;
2350 
2351 	mp->b_prev = (mblk_t *)ill;
2352 	ASSERT(mp->b_next == NULL);
2353 
2354 	if (taskq_dispatch(system_taskq, ill_capability_ack_thr, mp,
2355 	    TQ_NOSLEEP) != TASKQID_INVALID)
2356 		return;
2357 
2358 	/*
2359 	 * The taskq dispatch failed. Signal the ill_taskq_dispatch thread
2360 	 * which will do the dispatch using TQ_SLEEP to guarantee success.
2361 	 */
2362 	mutex_enter(&ipst->ips_capab_taskq_lock);
2363 	if (ipst->ips_capab_taskq_head == NULL) {
2364 		ASSERT(ipst->ips_capab_taskq_tail == NULL);
2365 		ipst->ips_capab_taskq_head = mp;
2366 	} else {
2367 		ipst->ips_capab_taskq_tail->b_next = mp;
2368 	}
2369 	ipst->ips_capab_taskq_tail = mp;
2370 
2371 	cv_signal(&ipst->ips_capab_taskq_cv);
2372 	mutex_exit(&ipst->ips_capab_taskq_lock);
2373 }
2374 
2375 /*
2376  * This routine is called to scan the fragmentation reassembly table for
2377  * the specified ILL for any packets that are starting to smell.
2378  * dead_interval is the maximum time in seconds that will be tolerated.  It
2379  * will either be the value specified in ip_g_frag_timeout, or zero if the
2380  * ILL is shutting down and it is time to blow everything off.
2381  *
2382  * It returns the number of seconds (as a time_t) that the next frag timer
2383  * should be scheduled for, 0 meaning that the timer doesn't need to be
2384  * re-started.  Note that the method of calculating next_timeout isn't
2385  * entirely accurate since time will flow between the time we grab
2386  * current_time and the time we schedule the next timeout.  This isn't a
2387  * big problem since this is the timer for sending an ICMP reassembly time
2388  * exceeded messages, and it doesn't have to be exactly accurate.
2389  *
2390  * This function is
2391  * sometimes called as writer, although this is not required.
2392  */
2393 time_t
2394 ill_frag_timeout(ill_t *ill, time_t dead_interval)
2395 {
2396 	ipfb_t	*ipfb;
2397 	ipfb_t	*endp;
2398 	ipf_t	*ipf;
2399 	ipf_t	*ipfnext;
2400 	mblk_t	*mp;
2401 	time_t	current_time = gethrestime_sec();
2402 	time_t	next_timeout = 0;
2403 	uint32_t	hdr_length;
2404 	mblk_t	*send_icmp_head;
2405 	mblk_t	*send_icmp_head_v6;
2406 	ip_stack_t *ipst = ill->ill_ipst;
2407 	ip_recv_attr_t iras;
2408 
2409 	bzero(&iras, sizeof (iras));
2410 	iras.ira_flags = 0;
2411 	iras.ira_ill = iras.ira_rill = ill;
2412 	iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
2413 	iras.ira_rifindex = iras.ira_ruifindex;
2414 
2415 	ipfb = ill->ill_frag_hash_tbl;
2416 	if (ipfb == NULL)
2417 		return (B_FALSE);
2418 	endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
2419 	/* Walk the frag hash table. */
2420 	for (; ipfb < endp; ipfb++) {
2421 		send_icmp_head = NULL;
2422 		send_icmp_head_v6 = NULL;
2423 		mutex_enter(&ipfb->ipfb_lock);
2424 		while ((ipf = ipfb->ipfb_ipf) != 0) {
2425 			time_t frag_time = current_time - ipf->ipf_timestamp;
2426 			time_t frag_timeout;
2427 
2428 			if (frag_time < dead_interval) {
2429 				/*
2430 				 * There are some outstanding fragments
2431 				 * that will timeout later.  Make note of
2432 				 * the time so that we can reschedule the
2433 				 * next timeout appropriately.
2434 				 */
2435 				frag_timeout = dead_interval - frag_time;
2436 				if (next_timeout == 0 ||
2437 				    frag_timeout < next_timeout) {
2438 					next_timeout = frag_timeout;
2439 				}
2440 				break;
2441 			}
2442 			/* Time's up.  Get it out of here. */
2443 			hdr_length = ipf->ipf_nf_hdr_len;
2444 			ipfnext = ipf->ipf_hash_next;
2445 			if (ipfnext)
2446 				ipfnext->ipf_ptphn = ipf->ipf_ptphn;
2447 			*ipf->ipf_ptphn = ipfnext;
2448 			mp = ipf->ipf_mp->b_cont;
2449 			for (; mp; mp = mp->b_cont) {
2450 				/* Extra points for neatness. */
2451 				IP_REASS_SET_START(mp, 0);
2452 				IP_REASS_SET_END(mp, 0);
2453 			}
2454 			mp = ipf->ipf_mp->b_cont;
2455 			atomic_add_32(&ill->ill_frag_count, -ipf->ipf_count);
2456 			ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
2457 			ipfb->ipfb_count -= ipf->ipf_count;
2458 			ASSERT(ipfb->ipfb_frag_pkts > 0);
2459 			ipfb->ipfb_frag_pkts--;
2460 			/*
2461 			 * We do not send any icmp message from here because
2462 			 * we currently are holding the ipfb_lock for this
2463 			 * hash chain. If we try and send any icmp messages
2464 			 * from here we may end up via a put back into ip
2465 			 * trying to get the same lock, causing a recursive
2466 			 * mutex panic. Instead we build a list and send all
2467 			 * the icmp messages after we have dropped the lock.
2468 			 */
2469 			if (ill->ill_isv6) {
2470 				if (hdr_length != 0) {
2471 					mp->b_next = send_icmp_head_v6;
2472 					send_icmp_head_v6 = mp;
2473 				} else {
2474 					freemsg(mp);
2475 				}
2476 			} else {
2477 				if (hdr_length != 0) {
2478 					mp->b_next = send_icmp_head;
2479 					send_icmp_head = mp;
2480 				} else {
2481 					freemsg(mp);
2482 				}
2483 			}
2484 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2485 			ip_drop_input("ipIfStatsReasmFails", ipf->ipf_mp, ill);
2486 			freeb(ipf->ipf_mp);
2487 		}
2488 		mutex_exit(&ipfb->ipfb_lock);
2489 		/*
2490 		 * Now need to send any icmp messages that we delayed from
2491 		 * above.
2492 		 */
2493 		while (send_icmp_head_v6 != NULL) {
2494 			ip6_t *ip6h;
2495 
2496 			mp = send_icmp_head_v6;
2497 			send_icmp_head_v6 = send_icmp_head_v6->b_next;
2498 			mp->b_next = NULL;
2499 			ip6h = (ip6_t *)mp->b_rptr;
2500 			iras.ira_flags = 0;
2501 			/*
2502 			 * This will result in an incorrect ALL_ZONES zoneid
2503 			 * for multicast packets, but we
2504 			 * don't send ICMP errors for those in any case.
2505 			 */
2506 			iras.ira_zoneid =
2507 			    ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
2508 			    ill, ipst);
2509 			ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2510 			icmp_time_exceeded_v6(mp,
2511 			    ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
2512 			    &iras);
2513 			ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2514 		}
2515 		while (send_icmp_head != NULL) {
2516 			ipaddr_t dst;
2517 
2518 			mp = send_icmp_head;
2519 			send_icmp_head = send_icmp_head->b_next;
2520 			mp->b_next = NULL;
2521 
2522 			dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
2523 
2524 			iras.ira_flags = IRAF_IS_IPV4;
2525 			/*
2526 			 * This will result in an incorrect ALL_ZONES zoneid
2527 			 * for broadcast and multicast packets, but we
2528 			 * don't send ICMP errors for those in any case.
2529 			 */
2530 			iras.ira_zoneid = ipif_lookup_addr_zoneid(dst,
2531 			    ill, ipst);
2532 			ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2533 			icmp_time_exceeded(mp,
2534 			    ICMP_REASSEMBLY_TIME_EXCEEDED, &iras);
2535 			ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2536 		}
2537 	}
2538 	/*
2539 	 * A non-dying ILL will use the return value to decide whether to
2540 	 * restart the frag timer, and for how long.
2541 	 */
2542 	return (next_timeout);
2543 }
2544 
2545 /*
2546  * This routine is called when the approximate count of mblk memory used
2547  * for the specified ILL has exceeded max_count.
2548  */
2549 void
2550 ill_frag_prune(ill_t *ill, uint_t max_count)
2551 {
2552 	ipfb_t	*ipfb;
2553 	ipf_t	*ipf;
2554 	size_t	count;
2555 	clock_t now;
2556 
2557 	/*
2558 	 * If we are here within ip_min_frag_prune_time msecs remove
2559 	 * ill_frag_free_num_pkts oldest packets from each bucket and increment
2560 	 * ill_frag_free_num_pkts.
2561 	 */
2562 	mutex_enter(&ill->ill_lock);
2563 	now = ddi_get_lbolt();
2564 	if (TICK_TO_MSEC(now - ill->ill_last_frag_clean_time) <=
2565 	    (ip_min_frag_prune_time != 0 ?
2566 	    ip_min_frag_prune_time : msec_per_tick)) {
2567 
2568 		ill->ill_frag_free_num_pkts++;
2569 
2570 	} else {
2571 		ill->ill_frag_free_num_pkts = 0;
2572 	}
2573 	ill->ill_last_frag_clean_time = now;
2574 	mutex_exit(&ill->ill_lock);
2575 
2576 	/*
2577 	 * free ill_frag_free_num_pkts oldest packets from each bucket.
2578 	 */
2579 	if (ill->ill_frag_free_num_pkts != 0) {
2580 		int ix;
2581 
2582 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2583 			ipfb = &ill->ill_frag_hash_tbl[ix];
2584 			mutex_enter(&ipfb->ipfb_lock);
2585 			if (ipfb->ipfb_ipf != NULL) {
2586 				ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
2587 				    ill->ill_frag_free_num_pkts);
2588 			}
2589 			mutex_exit(&ipfb->ipfb_lock);
2590 		}
2591 	}
2592 	/*
2593 	 * While the reassembly list for this ILL is too big, prune a fragment
2594 	 * queue by age, oldest first.
2595 	 */
2596 	while (ill->ill_frag_count > max_count) {
2597 		int	ix;
2598 		ipfb_t	*oipfb = NULL;
2599 		uint_t	oldest = UINT_MAX;
2600 
2601 		count = 0;
2602 		for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2603 			ipfb = &ill->ill_frag_hash_tbl[ix];
2604 			mutex_enter(&ipfb->ipfb_lock);
2605 			ipf = ipfb->ipfb_ipf;
2606 			if (ipf != NULL && ipf->ipf_gen < oldest) {
2607 				oldest = ipf->ipf_gen;
2608 				oipfb = ipfb;
2609 			}
2610 			count += ipfb->ipfb_count;
2611 			mutex_exit(&ipfb->ipfb_lock);
2612 		}
2613 		if (oipfb == NULL)
2614 			break;
2615 
2616 		if (count <= max_count)
2617 			return;	/* Somebody beat us to it, nothing to do */
2618 		mutex_enter(&oipfb->ipfb_lock);
2619 		ipf = oipfb->ipfb_ipf;
2620 		if (ipf != NULL) {
2621 			ill_frag_free_pkts(ill, oipfb, ipf, 1);
2622 		}
2623 		mutex_exit(&oipfb->ipfb_lock);
2624 	}
2625 }
2626 
2627 /*
2628  * free 'free_cnt' fragmented packets starting at ipf.
2629  */
2630 void
2631 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
2632 {
2633 	size_t	count;
2634 	mblk_t	*mp;
2635 	mblk_t	*tmp;
2636 	ipf_t **ipfp = ipf->ipf_ptphn;
2637 
2638 	ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
2639 	ASSERT(ipfp != NULL);
2640 	ASSERT(ipf != NULL);
2641 
2642 	while (ipf != NULL && free_cnt-- > 0) {
2643 		count = ipf->ipf_count;
2644 		mp = ipf->ipf_mp;
2645 		ipf = ipf->ipf_hash_next;
2646 		for (tmp = mp; tmp; tmp = tmp->b_cont) {
2647 			IP_REASS_SET_START(tmp, 0);
2648 			IP_REASS_SET_END(tmp, 0);
2649 		}
2650 		atomic_add_32(&ill->ill_frag_count, -count);
2651 		ASSERT(ipfb->ipfb_count >= count);
2652 		ipfb->ipfb_count -= count;
2653 		ASSERT(ipfb->ipfb_frag_pkts > 0);
2654 		ipfb->ipfb_frag_pkts--;
2655 		BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2656 		ip_drop_input("ipIfStatsReasmFails", mp, ill);
2657 		freemsg(mp);
2658 	}
2659 
2660 	if (ipf)
2661 		ipf->ipf_ptphn = ipfp;
2662 	ipfp[0] = ipf;
2663 }
2664 
2665 /*
2666  * Helper function for ill_forward_set().
2667  */
2668 static void
2669 ill_forward_set_on_ill(ill_t *ill, boolean_t enable)
2670 {
2671 	ip_stack_t	*ipst = ill->ill_ipst;
2672 
2673 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2674 
2675 	ip1dbg(("ill_forward_set: %s %s forwarding on %s",
2676 	    (enable ? "Enabling" : "Disabling"),
2677 	    (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
2678 	mutex_enter(&ill->ill_lock);
2679 	if (enable)
2680 		ill->ill_flags |= ILLF_ROUTER;
2681 	else
2682 		ill->ill_flags &= ~ILLF_ROUTER;
2683 	mutex_exit(&ill->ill_lock);
2684 	if (ill->ill_isv6)
2685 		ill_set_nce_router_flags(ill, enable);
2686 	/* Notify routing socket listeners of this change. */
2687 	if (ill->ill_ipif != NULL)
2688 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
2689 }
2690 
2691 /*
2692  * Set an ill's ILLF_ROUTER flag appropriately.  Send up RTS_IFINFO routing
2693  * socket messages for each interface whose flags we change.
2694  */
2695 int
2696 ill_forward_set(ill_t *ill, boolean_t enable)
2697 {
2698 	ipmp_illgrp_t *illg;
2699 	ip_stack_t *ipst = ill->ill_ipst;
2700 
2701 	ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2702 
2703 	if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
2704 	    (!enable && !(ill->ill_flags & ILLF_ROUTER)))
2705 		return (0);
2706 
2707 	if (IS_LOOPBACK(ill))
2708 		return (EINVAL);
2709 
2710 	if (enable && ill->ill_allowed_ips_cnt > 0)
2711 		return (EPERM);
2712 
2713 	if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
2714 		/*
2715 		 * Update all of the interfaces in the group.
2716 		 */
2717 		illg = ill->ill_grp;
2718 		ill = list_head(&illg->ig_if);
2719 		for (; ill != NULL; ill = list_next(&illg->ig_if, ill))
2720 			ill_forward_set_on_ill(ill, enable);
2721 
2722 		/*
2723 		 * Update the IPMP meta-interface.
2724 		 */
2725 		ill_forward_set_on_ill(ipmp_illgrp_ipmp_ill(illg), enable);
2726 		return (0);
2727 	}
2728 
2729 	ill_forward_set_on_ill(ill, enable);
2730 	return (0);
2731 }
2732 
2733 /*
2734  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
2735  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
2736  * set or clear.
2737  */
2738 static void
2739 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
2740 {
2741 	ipif_t *ipif;
2742 	ncec_t *ncec;
2743 	nce_t *nce;
2744 
2745 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
2746 		/*
2747 		 * NOTE: we match across the illgrp because nce's for
2748 		 * addresses on IPMP interfaces have an nce_ill that points to
2749 		 * the bound underlying ill.
2750 		 */
2751 		nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
2752 		if (nce != NULL) {
2753 			ncec = nce->nce_common;
2754 			mutex_enter(&ncec->ncec_lock);
2755 			if (enable)
2756 				ncec->ncec_flags |= NCE_F_ISROUTER;
2757 			else
2758 				ncec->ncec_flags &= ~NCE_F_ISROUTER;
2759 			mutex_exit(&ncec->ncec_lock);
2760 			nce_refrele(nce);
2761 		}
2762 	}
2763 }
2764 
2765 /*
2766  * Intializes the context structure and returns the first ill in the list
2767  * cuurently start_list and end_list can have values:
2768  * MAX_G_HEADS		Traverse both IPV4 and IPV6 lists.
2769  * IP_V4_G_HEAD		Traverse IPV4 list only.
2770  * IP_V6_G_HEAD		Traverse IPV6 list only.
2771  */
2772 
2773 /*
2774  * We don't check for CONDEMNED ills here. Caller must do that if
2775  * necessary under the ill lock.
2776  */
2777 ill_t *
2778 ill_first(int start_list, int end_list, ill_walk_context_t *ctx,
2779     ip_stack_t *ipst)
2780 {
2781 	ill_if_t *ifp;
2782 	ill_t *ill;
2783 	avl_tree_t *avl_tree;
2784 
2785 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
2786 	ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
2787 
2788 	/*
2789 	 * setup the lists to search
2790 	 */
2791 	if (end_list != MAX_G_HEADS) {
2792 		ctx->ctx_current_list = start_list;
2793 		ctx->ctx_last_list = end_list;
2794 	} else {
2795 		ctx->ctx_last_list = MAX_G_HEADS - 1;
2796 		ctx->ctx_current_list = 0;
2797 	}
2798 
2799 	while (ctx->ctx_current_list <= ctx->ctx_last_list) {
2800 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2801 		if (ifp != (ill_if_t *)
2802 		    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2803 			avl_tree = &ifp->illif_avl_by_ppa;
2804 			ill = avl_first(avl_tree);
2805 			/*
2806 			 * ill is guaranteed to be non NULL or ifp should have
2807 			 * not existed.
2808 			 */
2809 			ASSERT(ill != NULL);
2810 			return (ill);
2811 		}
2812 		ctx->ctx_current_list++;
2813 	}
2814 
2815 	return (NULL);
2816 }
2817 
2818 /*
2819  * returns the next ill in the list. ill_first() must have been called
2820  * before calling ill_next() or bad things will happen.
2821  */
2822 
2823 /*
2824  * We don't check for CONDEMNED ills here. Caller must do that if
2825  * necessary under the ill lock.
2826  */
2827 ill_t *
2828 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
2829 {
2830 	ill_if_t *ifp;
2831 	ill_t *ill;
2832 	ip_stack_t	*ipst = lastill->ill_ipst;
2833 
2834 	ASSERT(lastill->ill_ifptr != (ill_if_t *)
2835 	    &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst));
2836 	if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
2837 	    AVL_AFTER)) != NULL) {
2838 		return (ill);
2839 	}
2840 
2841 	/* goto next ill_ifp in the list. */
2842 	ifp = lastill->ill_ifptr->illif_next;
2843 
2844 	/* make sure not at end of circular list */
2845 	while (ifp ==
2846 	    (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2847 		if (++ctx->ctx_current_list > ctx->ctx_last_list)
2848 			return (NULL);
2849 		ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2850 	}
2851 
2852 	return (avl_first(&ifp->illif_avl_by_ppa));
2853 }
2854 
2855 /*
2856  * Check interface name for correct format: [a-zA-Z]+[a-zA-Z0-9._]*[0-9]+
2857  * The final number (PPA) must not have any leading zeros.  Upon success, a
2858  * pointer to the start of the PPA is returned; otherwise NULL is returned.
2859  */
2860 static char *
2861 ill_get_ppa_ptr(char *name)
2862 {
2863 	int namelen = strlen(name);
2864 	int end_ndx = namelen - 1;
2865 	int ppa_ndx, i;
2866 
2867 	/*
2868 	 * Check that the first character is [a-zA-Z], and that the last
2869 	 * character is [0-9].
2870 	 */
2871 	if (namelen == 0 || !isalpha(name[0]) || !isdigit(name[end_ndx]))
2872 		return (NULL);
2873 
2874 	/*
2875 	 * Set `ppa_ndx' to the PPA start, and check for leading zeroes.
2876 	 */
2877 	for (ppa_ndx = end_ndx; ppa_ndx > 0; ppa_ndx--)
2878 		if (!isdigit(name[ppa_ndx - 1]))
2879 			break;
2880 
2881 	if (name[ppa_ndx] == '0' && ppa_ndx < end_ndx)
2882 		return (NULL);
2883 
2884 	/*
2885 	 * Check that the intermediate characters are [a-z0-9.]
2886 	 */
2887 	for (i = 1; i < ppa_ndx; i++) {
2888 		if (!isalpha(name[i]) && !isdigit(name[i]) &&
2889 		    name[i] != '.' && name[i] != '_') {
2890 			return (NULL);
2891 		}
2892 	}
2893 
2894 	return (name + ppa_ndx);
2895 }
2896 
2897 /*
2898  * use avl tree to locate the ill.
2899  */
2900 static ill_t *
2901 ill_find_by_name(char *name, boolean_t isv6, ip_stack_t *ipst)
2902 {
2903 	char *ppa_ptr = NULL;
2904 	int len;
2905 	uint_t ppa;
2906 	ill_t *ill = NULL;
2907 	ill_if_t *ifp;
2908 	int list;
2909 
2910 	/*
2911 	 * get ppa ptr
2912 	 */
2913 	if (isv6)
2914 		list = IP_V6_G_HEAD;
2915 	else
2916 		list = IP_V4_G_HEAD;
2917 
2918 	if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
2919 		return (NULL);
2920 	}
2921 
2922 	len = ppa_ptr - name + 1;
2923 
2924 	ppa = stoi(&ppa_ptr);
2925 
2926 	ifp = IP_VX_ILL_G_LIST(list, ipst);
2927 
2928 	while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2929 		/*
2930 		 * match is done on len - 1 as the name is not null
2931 		 * terminated it contains ppa in addition to the interface
2932 		 * name.
2933 		 */
2934 		if ((ifp->illif_name_len == len) &&
2935 		    bcmp(ifp->illif_name, name, len - 1) == 0) {
2936 			break;
2937 		} else {
2938 			ifp = ifp->illif_next;
2939 		}
2940 	}
2941 
2942 	if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2943 		/*
2944 		 * Even the interface type does not exist.
2945 		 */
2946 		return (NULL);
2947 	}
2948 
2949 	ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
2950 	if (ill != NULL) {
2951 		mutex_enter(&ill->ill_lock);
2952 		if (ILL_CAN_LOOKUP(ill)) {
2953 			ill_refhold_locked(ill);
2954 			mutex_exit(&ill->ill_lock);
2955 			return (ill);
2956 		}
2957 		mutex_exit(&ill->ill_lock);
2958 	}
2959 	return (NULL);
2960 }
2961 
2962 /*
2963  * comparison function for use with avl.
2964  */
2965 static int
2966 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
2967 {
2968 	uint_t ppa;
2969 	uint_t ill_ppa;
2970 
2971 	ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
2972 
2973 	ppa = *((uint_t *)ppa_ptr);
2974 	ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
2975 	/*
2976 	 * We want the ill with the lowest ppa to be on the
2977 	 * top.
2978 	 */
2979 	if (ill_ppa < ppa)
2980 		return (1);
2981 	if (ill_ppa > ppa)
2982 		return (-1);
2983 	return (0);
2984 }
2985 
2986 /*
2987  * remove an interface type from the global list.
2988  */
2989 static void
2990 ill_delete_interface_type(ill_if_t *interface)
2991 {
2992 	ASSERT(interface != NULL);
2993 	ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
2994 
2995 	avl_destroy(&interface->illif_avl_by_ppa);
2996 	if (interface->illif_ppa_arena != NULL)
2997 		vmem_destroy(interface->illif_ppa_arena);
2998 
2999 	remque(interface);
3000 
3001 	mi_free(interface);
3002 }
3003 
3004 /*
3005  * remove ill from the global list.
3006  */
3007 static void
3008 ill_glist_delete(ill_t *ill)
3009 {
3010 	ip_stack_t	*ipst;
3011 	phyint_t	*phyi;
3012 
3013 	if (ill == NULL)
3014 		return;
3015 	ipst = ill->ill_ipst;
3016 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3017 
3018 	/*
3019 	 * If the ill was never inserted into the AVL tree
3020 	 * we skip the if branch.
3021 	 */
3022 	if (ill->ill_ifptr != NULL) {
3023 		/*
3024 		 * remove from AVL tree and free ppa number
3025 		 */
3026 		avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
3027 
3028 		if (ill->ill_ifptr->illif_ppa_arena != NULL) {
3029 			vmem_free(ill->ill_ifptr->illif_ppa_arena,
3030 			    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3031 		}
3032 		if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
3033 			ill_delete_interface_type(ill->ill_ifptr);
3034 		}
3035 
3036 		/*
3037 		 * Indicate ill is no longer in the list.
3038 		 */
3039 		ill->ill_ifptr = NULL;
3040 		ill->ill_name_length = 0;
3041 		ill->ill_name[0] = '\0';
3042 		ill->ill_ppa = UINT_MAX;
3043 	}
3044 
3045 	/* Generate one last event for this ill. */
3046 	ill_nic_event_dispatch(ill, 0, NE_UNPLUMB, ill->ill_name,
3047 	    ill->ill_name_length);
3048 
3049 	ASSERT(ill->ill_phyint != NULL);
3050 	phyi = ill->ill_phyint;
3051 	ill->ill_phyint = NULL;
3052 
3053 	/*
3054 	 * ill_init allocates a phyint always to store the copy
3055 	 * of flags relevant to phyint. At that point in time, we could
3056 	 * not assign the name and hence phyint_illv4/v6 could not be
3057 	 * initialized. Later in ipif_set_values, we assign the name to
3058 	 * the ill, at which point in time we assign phyint_illv4/v6.
3059 	 * Thus we don't rely on phyint_illv6 to be initialized always.
3060 	 */
3061 	if (ill->ill_flags & ILLF_IPV6)
3062 		phyi->phyint_illv6 = NULL;
3063 	else
3064 		phyi->phyint_illv4 = NULL;
3065 
3066 	if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL) {
3067 		rw_exit(&ipst->ips_ill_g_lock);
3068 		return;
3069 	}
3070 
3071 	/*
3072 	 * There are no ills left on this phyint; pull it out of the phyint
3073 	 * avl trees, and free it.
3074 	 */
3075 	if (phyi->phyint_ifindex > 0) {
3076 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3077 		    phyi);
3078 		avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
3079 		    phyi);
3080 	}
3081 	rw_exit(&ipst->ips_ill_g_lock);
3082 
3083 	phyint_free(phyi);
3084 }
3085 
3086 /*
3087  * allocate a ppa, if the number of plumbed interfaces of this type are
3088  * less than ill_no_arena do a linear search to find a unused ppa.
3089  * When the number goes beyond ill_no_arena switch to using an arena.
3090  * Note: ppa value of zero cannot be allocated from vmem_arena as it
3091  * is the return value for an error condition, so allocation starts at one
3092  * and is decremented by one.
3093  */
3094 static int
3095 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
3096 {
3097 	ill_t *tmp_ill;
3098 	uint_t start, end;
3099 	int ppa;
3100 
3101 	if (ifp->illif_ppa_arena == NULL &&
3102 	    (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
3103 		/*
3104 		 * Create an arena.
3105 		 */
3106 		ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
3107 		    (void *)1, UINT_MAX - 1, 1, NULL, NULL,
3108 		    NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
3109 			/* allocate what has already been assigned */
3110 		for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
3111 		    tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
3112 		    tmp_ill, AVL_AFTER)) {
3113 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3114 			    1,		/* size */
3115 			    1,		/* align/quantum */
3116 			    0,		/* phase */
3117 			    0,		/* nocross */
3118 			    /* minaddr */
3119 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 1),
3120 			    /* maxaddr */
3121 			    (void *)((uintptr_t)tmp_ill->ill_ppa + 2),
3122 			    VM_NOSLEEP|VM_FIRSTFIT);
3123 			if (ppa == 0) {
3124 				ip1dbg(("ill_alloc_ppa: ppa allocation"
3125 				    " failed while switching"));
3126 				vmem_destroy(ifp->illif_ppa_arena);
3127 				ifp->illif_ppa_arena = NULL;
3128 				break;
3129 			}
3130 		}
3131 	}
3132 
3133 	if (ifp->illif_ppa_arena != NULL) {
3134 		if (ill->ill_ppa == UINT_MAX) {
3135 			ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
3136 			    1, VM_NOSLEEP|VM_FIRSTFIT);
3137 			if (ppa == 0)
3138 				return (EAGAIN);
3139 			ill->ill_ppa = --ppa;
3140 		} else {
3141 			ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3142 			    1,		/* size */
3143 			    1,		/* align/quantum */
3144 			    0,		/* phase */
3145 			    0,		/* nocross */
3146 			    (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
3147 			    (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
3148 			    VM_NOSLEEP|VM_FIRSTFIT);
3149 			/*
3150 			 * Most likely the allocation failed because
3151 			 * the requested ppa was in use.
3152 			 */
3153 			if (ppa == 0)
3154 				return (EEXIST);
3155 		}
3156 		return (0);
3157 	}
3158 
3159 	/*
3160 	 * No arena is in use and not enough (>ill_no_arena) interfaces have
3161 	 * been plumbed to create one. Do a linear search to get a unused ppa.
3162 	 */
3163 	if (ill->ill_ppa == UINT_MAX) {
3164 		end = UINT_MAX - 1;
3165 		start = 0;
3166 	} else {
3167 		end = start = ill->ill_ppa;
3168 	}
3169 
3170 	tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
3171 	while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
3172 		if (start++ >= end) {
3173 			if (ill->ill_ppa == UINT_MAX)
3174 				return (EAGAIN);
3175 			else
3176 				return (EEXIST);
3177 		}
3178 		tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
3179 	}
3180 	ill->ill_ppa = start;
3181 	return (0);
3182 }
3183 
3184 /*
3185  * Insert ill into the list of configured ill's. Once this function completes,
3186  * the ill is globally visible and is available through lookups. More precisely
3187  * this happens after the caller drops the ill_g_lock.
3188  */
3189 static int
3190 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
3191 {
3192 	ill_if_t *ill_interface;
3193 	avl_index_t where = 0;
3194 	int error;
3195 	int name_length;
3196 	int index;
3197 	boolean_t check_length = B_FALSE;
3198 	ip_stack_t	*ipst = ill->ill_ipst;
3199 
3200 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
3201 
3202 	name_length = mi_strlen(name) + 1;
3203 
3204 	if (isv6)
3205 		index = IP_V6_G_HEAD;
3206 	else
3207 		index = IP_V4_G_HEAD;
3208 
3209 	ill_interface = IP_VX_ILL_G_LIST(index, ipst);
3210 	/*
3211 	 * Search for interface type based on name
3212 	 */
3213 	while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3214 		if ((ill_interface->illif_name_len == name_length) &&
3215 		    (strcmp(ill_interface->illif_name, name) == 0)) {
3216 			break;
3217 		}
3218 		ill_interface = ill_interface->illif_next;
3219 	}
3220 
3221 	/*
3222 	 * Interface type not found, create one.
3223 	 */
3224 	if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3225 		ill_g_head_t ghead;
3226 
3227 		/*
3228 		 * allocate ill_if_t structure
3229 		 */
3230 		ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
3231 		if (ill_interface == NULL) {
3232 			return (ENOMEM);
3233 		}
3234 
3235 		(void) strcpy(ill_interface->illif_name, name);
3236 		ill_interface->illif_name_len = name_length;
3237 
3238 		avl_create(&ill_interface->illif_avl_by_ppa,
3239 		    ill_compare_ppa, sizeof (ill_t),
3240 		    offsetof(struct ill_s, ill_avl_byppa));
3241 
3242 		/*
3243 		 * link the structure in the back to maintain order
3244 		 * of configuration for ifconfig output.
3245 		 */
3246 		ghead = ipst->ips_ill_g_heads[index];
3247 		insque(ill_interface, ghead.ill_g_list_tail);
3248 	}
3249 
3250 	if (ill->ill_ppa == UINT_MAX)
3251 		check_length = B_TRUE;
3252 
3253 	error = ill_alloc_ppa(ill_interface, ill);
3254 	if (error != 0) {
3255 		if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3256 			ill_delete_interface_type(ill->ill_ifptr);
3257 		return (error);
3258 	}
3259 
3260 	/*
3261 	 * When the ppa is choosen by the system, check that there is
3262 	 * enough space to insert ppa. if a specific ppa was passed in this
3263 	 * check is not required as the interface name passed in will have
3264 	 * the right ppa in it.
3265 	 */
3266 	if (check_length) {
3267 		/*
3268 		 * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
3269 		 */
3270 		char buf[sizeof (uint_t) * 3];
3271 
3272 		/*
3273 		 * convert ppa to string to calculate the amount of space
3274 		 * required for it in the name.
3275 		 */
3276 		numtos(ill->ill_ppa, buf);
3277 
3278 		/* Do we have enough space to insert ppa ? */
3279 
3280 		if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
3281 			/* Free ppa and interface type struct */
3282 			if (ill_interface->illif_ppa_arena != NULL) {
3283 				vmem_free(ill_interface->illif_ppa_arena,
3284 				    (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3285 			}
3286 			if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3287 				ill_delete_interface_type(ill->ill_ifptr);
3288 
3289 			return (EINVAL);
3290 		}
3291 	}
3292 
3293 	(void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
3294 	ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
3295 
3296 	(void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
3297 	    &where);
3298 	ill->ill_ifptr = ill_interface;
3299 	avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
3300 
3301 	ill_phyint_reinit(ill);
3302 	return (0);
3303 }
3304 
3305 /* Initialize the per phyint ipsq used for serialization */
3306 static boolean_t
3307 ipsq_init(ill_t *ill, boolean_t enter)
3308 {
3309 	ipsq_t  *ipsq;
3310 	ipxop_t	*ipx;
3311 
3312 	if ((ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP)) == NULL)
3313 		return (B_FALSE);
3314 
3315 	ill->ill_phyint->phyint_ipsq = ipsq;
3316 	ipx = ipsq->ipsq_xop = &ipsq->ipsq_ownxop;
3317 	ipx->ipx_ipsq = ipsq;
3318 	ipsq->ipsq_next = ipsq;
3319 	ipsq->ipsq_phyint = ill->ill_phyint;
3320 	mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
3321 	mutex_init(&ipx->ipx_lock, NULL, MUTEX_DEFAULT, 0);
3322 	ipsq->ipsq_ipst = ill->ill_ipst;	/* No netstack_hold */
3323 	if (enter) {
3324 		ipx->ipx_writer = curthread;
3325 		ipx->ipx_forced = B_FALSE;
3326 		ipx->ipx_reentry_cnt = 1;
3327 #ifdef DEBUG
3328 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
3329 #endif
3330 	}
3331 	return (B_TRUE);
3332 }
3333 
3334 /*
3335  * Here we perform initialisation of the ill_t common to both regular
3336  * interface ILLs and the special loopback ILL created by ill_lookup_on_name.
3337  */
3338 static int
3339 ill_init_common(ill_t *ill, queue_t *q, boolean_t isv6, boolean_t is_loopback,
3340     boolean_t ipsq_enter)
3341 {
3342 	int count;
3343 	uchar_t *frag_ptr;
3344 
3345 	mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
3346 	mutex_init(&ill->ill_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
3347 	ill->ill_saved_ire_cnt = 0;
3348 
3349 	if (is_loopback) {
3350 		ill->ill_max_frag = isv6 ? ip_loopback_mtu_v6plus :
3351 		    ip_loopback_mtuplus;
3352 		/*
3353 		 * No resolver here.
3354 		 */
3355 		ill->ill_net_type = IRE_LOOPBACK;
3356 	} else {
3357 		ill->ill_rq = q;
3358 		ill->ill_wq = WR(q);
3359 		ill->ill_ppa = UINT_MAX;
3360 	}
3361 
3362 	ill->ill_isv6 = isv6;
3363 
3364 	/*
3365 	 * Allocate sufficient space to contain our fragment hash table and
3366 	 * the device name.
3367 	 */
3368 	frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE + 2 * LIFNAMSIZ);
3369 	if (frag_ptr == NULL)
3370 		return (ENOMEM);
3371 	ill->ill_frag_ptr = frag_ptr;
3372 	ill->ill_frag_free_num_pkts = 0;
3373 	ill->ill_last_frag_clean_time = 0;
3374 	ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
3375 	ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
3376 	for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
3377 		mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
3378 		    NULL, MUTEX_DEFAULT, NULL);
3379 	}
3380 
3381 	ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
3382 	if (ill->ill_phyint == NULL) {
3383 		mi_free(frag_ptr);
3384 		return (ENOMEM);
3385 	}
3386 
3387 	mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
3388 	if (isv6) {
3389 		ill->ill_phyint->phyint_illv6 = ill;
3390 	} else {
3391 		ill->ill_phyint->phyint_illv4 = ill;
3392 	}
3393 	if (is_loopback) {
3394 		phyint_flags_init(ill->ill_phyint, DL_LOOP);
3395 	}
3396 
3397 	list_create(&ill->ill_nce, sizeof (nce_t), offsetof(nce_t, nce_node));
3398 
3399 	ill_set_inputfn(ill);
3400 
3401 	if (!ipsq_init(ill, ipsq_enter)) {
3402 		mi_free(frag_ptr);
3403 		mi_free(ill->ill_phyint);
3404 		return (ENOMEM);
3405 	}
3406 
3407 	/* Frag queue limit stuff */
3408 	ill->ill_frag_count = 0;
3409 	ill->ill_ipf_gen = 0;
3410 
3411 	rw_init(&ill->ill_mcast_lock, NULL, RW_DEFAULT, NULL);
3412 	mutex_init(&ill->ill_mcast_serializer, NULL, MUTEX_DEFAULT, NULL);
3413 	ill->ill_global_timer = INFINITY;
3414 	ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
3415 	ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
3416 	ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
3417 	ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
3418 
3419 	/*
3420 	 * Initialize IPv6 configuration variables.  The IP module is always
3421 	 * opened as an IPv4 module.  Instead tracking down the cases where
3422 	 * it switches to do ipv6, we'll just initialize the IPv6 configuration
3423 	 * here for convenience, this has no effect until the ill is set to do
3424 	 * IPv6.
3425 	 */
3426 	ill->ill_reachable_time = ND_REACHABLE_TIME;
3427 	ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
3428 	ill->ill_max_buf = ND_MAX_Q;
3429 	ill->ill_refcnt = 0;
3430 
3431 	return (0);
3432 }
3433 
3434 /*
3435  * ill_init is called by ip_open when a device control stream is opened.
3436  * It does a few initializations, and shoots a DL_INFO_REQ message down
3437  * to the driver.  The response is later picked up in ip_rput_dlpi and
3438  * used to set up default mechanisms for talking to the driver.  (Always
3439  * called as writer.)
3440  *
3441  * If this function returns error, ip_open will call ip_close which in
3442  * turn will call ill_delete to clean up any memory allocated here that
3443  * is not yet freed.
3444  *
3445  * Note: ill_ipst and ill_zoneid must be set before calling ill_init.
3446  */
3447 int
3448 ill_init(queue_t *q, ill_t *ill)
3449 {
3450 	int ret;
3451 	dl_info_req_t	*dlir;
3452 	mblk_t	*info_mp;
3453 
3454 	info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
3455 	    BPRI_HI);
3456 	if (info_mp == NULL)
3457 		return (ENOMEM);
3458 
3459 	/*
3460 	 * For now pretend this is a v4 ill. We need to set phyint_ill*
3461 	 * at this point because of the following reason. If we can't
3462 	 * enter the ipsq at some point and cv_wait, the writer that
3463 	 * wakes us up tries to locate us using the list of all phyints
3464 	 * in an ipsq and the ills from the phyint thru the phyint_ill*.
3465 	 * If we don't set it now, we risk a missed wakeup.
3466 	 */
3467 	if ((ret = ill_init_common(ill, q, B_FALSE, B_FALSE, B_TRUE)) != 0) {
3468 		freemsg(info_mp);
3469 		return (ret);
3470 	}
3471 
3472 	ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
3473 
3474 	/* Send down the Info Request to the driver. */
3475 	info_mp->b_datap->db_type = M_PCPROTO;
3476 	dlir = (dl_info_req_t *)info_mp->b_rptr;
3477 	info_mp->b_wptr = (uchar_t *)&dlir[1];
3478 	dlir->dl_primitive = DL_INFO_REQ;
3479 
3480 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
3481 
3482 	qprocson(q);
3483 	ill_dlpi_send(ill, info_mp);
3484 
3485 	return (0);
3486 }
3487 
3488 /*
3489  * ill_dls_info
3490  * creates datalink socket info from the device.
3491  */
3492 int
3493 ill_dls_info(struct sockaddr_dl *sdl, const ill_t *ill)
3494 {
3495 	size_t	len;
3496 
3497 	sdl->sdl_family = AF_LINK;
3498 	sdl->sdl_index = ill_get_upper_ifindex(ill);
3499 	sdl->sdl_type = ill->ill_type;
3500 	ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3501 	len = strlen(sdl->sdl_data);
3502 	ASSERT(len < 256);
3503 	sdl->sdl_nlen = (uchar_t)len;
3504 	sdl->sdl_alen = ill->ill_phys_addr_length;
3505 	sdl->sdl_slen = 0;
3506 	if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL)
3507 		bcopy(ill->ill_phys_addr, &sdl->sdl_data[len], sdl->sdl_alen);
3508 
3509 	return (sizeof (struct sockaddr_dl));
3510 }
3511 
3512 /*
3513  * ill_xarp_info
3514  * creates xarp info from the device.
3515  */
3516 static int
3517 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
3518 {
3519 	sdl->sdl_family = AF_LINK;
3520 	sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
3521 	sdl->sdl_type = ill->ill_type;
3522 	ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3523 	sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
3524 	sdl->sdl_alen = ill->ill_phys_addr_length;
3525 	sdl->sdl_slen = 0;
3526 	return (sdl->sdl_nlen);
3527 }
3528 
3529 static int
3530 loopback_kstat_update(kstat_t *ksp, int rw)
3531 {
3532 	kstat_named_t *kn;
3533 	netstackid_t	stackid;
3534 	netstack_t	*ns;
3535 	ip_stack_t	*ipst;
3536 
3537 	if (ksp == NULL || ksp->ks_data == NULL)
3538 		return (EIO);
3539 
3540 	if (rw == KSTAT_WRITE)
3541 		return (EACCES);
3542 
3543 	kn = KSTAT_NAMED_PTR(ksp);
3544 	stackid = (zoneid_t)(uintptr_t)ksp->ks_private;
3545 
3546 	ns = netstack_find_by_stackid(stackid);
3547 	if (ns == NULL)
3548 		return (-1);
3549 
3550 	ipst = ns->netstack_ip;
3551 	if (ipst == NULL) {
3552 		netstack_rele(ns);
3553 		return (-1);
3554 	}
3555 	kn[0].value.ui32 = ipst->ips_loopback_packets;
3556 	kn[1].value.ui32 = ipst->ips_loopback_packets;
3557 	netstack_rele(ns);
3558 	return (0);
3559 }
3560 
3561 /*
3562  * Has ifindex been plumbed already?
3563  */
3564 static boolean_t
3565 phyint_exists(uint_t index, ip_stack_t *ipst)
3566 {
3567 	ASSERT(index != 0);
3568 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
3569 
3570 	return (avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3571 	    &index, NULL) != NULL);
3572 }
3573 
3574 /*
3575  * Pick a unique ifindex.
3576  * When the index counter passes IF_INDEX_MAX for the first time, the wrap
3577  * flag is set so that next time time ip_assign_ifindex() is called, it
3578  * falls through and resets the index counter back to 1, the minimum value
3579  * for the interface index. The logic below assumes that ips_ill_index
3580  * can hold a value of IF_INDEX_MAX+1 without there being any loss
3581  * (i.e. reset back to 0.)
3582  */
3583 boolean_t
3584 ip_assign_ifindex(uint_t *indexp, ip_stack_t *ipst)
3585 {
3586 	uint_t loops;
3587 
3588 	if (!ipst->ips_ill_index_wrap) {
3589 		*indexp = ipst->ips_ill_index++;
3590 		if (ipst->ips_ill_index > IF_INDEX_MAX) {
3591 			/*
3592 			 * Reached the maximum ifindex value, set the wrap
3593 			 * flag to indicate that it is no longer possible
3594 			 * to assume that a given index is unallocated.
3595 			 */
3596 			ipst->ips_ill_index_wrap = B_TRUE;
3597 		}
3598 		return (B_TRUE);
3599 	}
3600 
3601 	if (ipst->ips_ill_index > IF_INDEX_MAX)
3602 		ipst->ips_ill_index = 1;
3603 
3604 	/*
3605 	 * Start reusing unused indexes. Note that we hold the ill_g_lock
3606 	 * at this point and don't want to call any function that attempts
3607 	 * to get the lock again.
3608 	 */
3609 	for (loops = IF_INDEX_MAX; loops > 0; loops--) {
3610 		if (!phyint_exists(ipst->ips_ill_index, ipst)) {
3611 			/* found unused index - use it */
3612 			*indexp = ipst->ips_ill_index;
3613 			return (B_TRUE);
3614 		}
3615 
3616 		ipst->ips_ill_index++;
3617 		if (ipst->ips_ill_index > IF_INDEX_MAX)
3618 			ipst->ips_ill_index = 1;
3619 	}
3620 
3621 	/*
3622 	 * all interface indicies are inuse.
3623 	 */
3624 	return (B_FALSE);
3625 }
3626 
3627 /*
3628  * Assign a unique interface index for the phyint.
3629  */
3630 static boolean_t
3631 phyint_assign_ifindex(phyint_t *phyi, ip_stack_t *ipst)
3632 {
3633 	ASSERT(phyi->phyint_ifindex == 0);
3634 	return (ip_assign_ifindex(&phyi->phyint_ifindex, ipst));
3635 }
3636 
3637 /*
3638  * Initialize the flags on `phyi' as per the provided mactype.
3639  */
3640 static void
3641 phyint_flags_init(phyint_t *phyi, t_uscalar_t mactype)
3642 {
3643 	uint64_t flags = 0;
3644 
3645 	/*
3646 	 * Initialize PHYI_RUNNING and PHYI_FAILED.  For non-IPMP interfaces,
3647 	 * we always presume the underlying hardware is working and set
3648 	 * PHYI_RUNNING (if it's not, the driver will subsequently send a
3649 	 * DL_NOTE_LINK_DOWN message).  For IPMP interfaces, at initialization
3650 	 * there are no active interfaces in the group so we set PHYI_FAILED.
3651 	 */
3652 	if (mactype == SUNW_DL_IPMP)
3653 		flags |= PHYI_FAILED;
3654 	else
3655 		flags |= PHYI_RUNNING;
3656 
3657 	switch (mactype) {
3658 	case SUNW_DL_VNI:
3659 		flags |= PHYI_VIRTUAL;
3660 		break;
3661 	case SUNW_DL_IPMP:
3662 		flags |= PHYI_IPMP;
3663 		break;
3664 	case DL_LOOP:
3665 		flags |= (PHYI_LOOPBACK | PHYI_VIRTUAL);
3666 		break;
3667 	}
3668 
3669 	mutex_enter(&phyi->phyint_lock);
3670 	phyi->phyint_flags |= flags;
3671 	mutex_exit(&phyi->phyint_lock);
3672 }
3673 
3674 /*
3675  * Return a pointer to the ill which matches the supplied name.  Note that
3676  * the ill name length includes the null termination character.  (May be
3677  * called as writer.)
3678  * If do_alloc and the interface is "lo0" it will be automatically created.
3679  * Cannot bump up reference on condemned ills. So dup detect can't be done
3680  * using this func.
3681  */
3682 ill_t *
3683 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
3684     boolean_t *did_alloc, ip_stack_t *ipst)
3685 {
3686 	ill_t	*ill;
3687 	ipif_t	*ipif;
3688 	ipsq_t	*ipsq;
3689 	kstat_named_t	*kn;
3690 	boolean_t isloopback;
3691 	in6_addr_t ov6addr;
3692 
3693 	isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
3694 
3695 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3696 	ill = ill_find_by_name(name, isv6, ipst);
3697 	rw_exit(&ipst->ips_ill_g_lock);
3698 	if (ill != NULL)
3699 		return (ill);
3700 
3701 	/*
3702 	 * Couldn't find it.  Does this happen to be a lookup for the
3703 	 * loopback device and are we allowed to allocate it?
3704 	 */
3705 	if (!isloopback || !do_alloc)
3706 		return (NULL);
3707 
3708 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3709 	ill = ill_find_by_name(name, isv6, ipst);
3710 	if (ill != NULL) {
3711 		rw_exit(&ipst->ips_ill_g_lock);
3712 		return (ill);
3713 	}
3714 
3715 	/* Create the loopback device on demand */
3716 	ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
3717 	    sizeof (ipif_loopback_name), BPRI_MED));
3718 	if (ill == NULL)
3719 		goto done;
3720 
3721 	bzero(ill, sizeof (*ill));
3722 	ill->ill_ipst = ipst;
3723 	netstack_hold(ipst->ips_netstack);
3724 	/*
3725 	 * For exclusive stacks we set the zoneid to zero
3726 	 * to make IP operate as if in the global zone.
3727 	 */
3728 	ill->ill_zoneid = GLOBAL_ZONEID;
3729 
3730 	if (ill_init_common(ill, NULL, isv6, B_TRUE, B_FALSE) != 0)
3731 		goto done;
3732 
3733 	if (!ill_allocate_mibs(ill))
3734 		goto done;
3735 
3736 	ill->ill_current_frag = ill->ill_max_frag;
3737 	ill->ill_mtu = ill->ill_max_frag;	/* Initial value */
3738 	ill->ill_mc_mtu = ill->ill_mtu;
3739 	/*
3740 	 * ipif_loopback_name can't be pointed at directly because its used
3741 	 * by both the ipv4 and ipv6 interfaces.  When the ill is removed
3742 	 * from the glist, ill_glist_delete() sets the first character of
3743 	 * ill_name to '\0'.
3744 	 */
3745 	ill->ill_name = (char *)ill + sizeof (*ill);
3746 	(void) strcpy(ill->ill_name, ipif_loopback_name);
3747 	ill->ill_name_length = sizeof (ipif_loopback_name);
3748 	/* Set ill_dlpi_pending for ipsq_current_finish() to work properly */
3749 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
3750 
3751 	ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE, B_TRUE, NULL);
3752 	if (ipif == NULL)
3753 		goto done;
3754 
3755 	ill->ill_flags = ILLF_MULTICAST;
3756 
3757 	ov6addr = ipif->ipif_v6lcl_addr;
3758 	/* Set up default loopback address and mask. */
3759 	if (!isv6) {
3760 		ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
3761 
3762 		IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
3763 		V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
3764 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3765 		    ipif->ipif_v6subnet);
3766 		ill->ill_flags |= ILLF_IPV4;
3767 	} else {
3768 		ipif->ipif_v6lcl_addr = ipv6_loopback;
3769 		ipif->ipif_v6net_mask = ipv6_all_ones;
3770 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3771 		    ipif->ipif_v6subnet);
3772 		ill->ill_flags |= ILLF_IPV6;
3773 	}
3774 
3775 	/*
3776 	 * Chain us in at the end of the ill list. hold the ill
3777 	 * before we make it globally visible. 1 for the lookup.
3778 	 */
3779 	ill_refhold(ill);
3780 
3781 	ipsq = ill->ill_phyint->phyint_ipsq;
3782 
3783 	if (ill_glist_insert(ill, "lo", isv6) != 0)
3784 		cmn_err(CE_PANIC, "cannot insert loopback interface");
3785 
3786 	/* Let SCTP know so that it can add this to its list */
3787 	sctp_update_ill(ill, SCTP_ILL_INSERT);
3788 
3789 	/*
3790 	 * We have already assigned ipif_v6lcl_addr above, but we need to
3791 	 * call sctp_update_ipif_addr() after SCTP_ILL_INSERT, which
3792 	 * requires to be after ill_glist_insert() since we need the
3793 	 * ill_index set. Pass on ipv6_loopback as the old address.
3794 	 */
3795 	sctp_update_ipif_addr(ipif, ov6addr);
3796 
3797 	ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
3798 
3799 	/*
3800 	 * ill_glist_insert() -> ill_phyint_reinit() may have merged IPSQs.
3801 	 * If so, free our original one.
3802 	 */
3803 	if (ipsq != ill->ill_phyint->phyint_ipsq)
3804 		ipsq_delete(ipsq);
3805 
3806 	if (ipst->ips_loopback_ksp == NULL) {
3807 		/* Export loopback interface statistics */
3808 		ipst->ips_loopback_ksp = kstat_create_netstack("lo", 0,
3809 		    ipif_loopback_name, "net",
3810 		    KSTAT_TYPE_NAMED, 2, 0,
3811 		    ipst->ips_netstack->netstack_stackid);
3812 		if (ipst->ips_loopback_ksp != NULL) {
3813 			ipst->ips_loopback_ksp->ks_update =
3814 			    loopback_kstat_update;
3815 			kn = KSTAT_NAMED_PTR(ipst->ips_loopback_ksp);
3816 			kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
3817 			kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
3818 			ipst->ips_loopback_ksp->ks_private =
3819 			    (void *)(uintptr_t)ipst->ips_netstack->
3820 			    netstack_stackid;
3821 			kstat_install(ipst->ips_loopback_ksp);
3822 		}
3823 	}
3824 
3825 	*did_alloc = B_TRUE;
3826 	rw_exit(&ipst->ips_ill_g_lock);
3827 	ill_nic_event_dispatch(ill, MAP_IPIF_ID(ill->ill_ipif->ipif_id),
3828 	    NE_PLUMB, ill->ill_name, ill->ill_name_length);
3829 	return (ill);
3830 done:
3831 	if (ill != NULL) {
3832 		if (ill->ill_phyint != NULL) {
3833 			ipsq = ill->ill_phyint->phyint_ipsq;
3834 			if (ipsq != NULL) {
3835 				ipsq->ipsq_phyint = NULL;
3836 				ipsq_delete(ipsq);
3837 			}
3838 			mi_free(ill->ill_phyint);
3839 		}
3840 		ill_free_mib(ill);
3841 		if (ill->ill_ipst != NULL)
3842 			netstack_rele(ill->ill_ipst->ips_netstack);
3843 		mi_free(ill);
3844 	}
3845 	rw_exit(&ipst->ips_ill_g_lock);
3846 	return (NULL);
3847 }
3848 
3849 /*
3850  * For IPP calls - use the ip_stack_t for global stack.
3851  */
3852 ill_t *
3853 ill_lookup_on_ifindex_global_instance(uint_t index, boolean_t isv6)
3854 {
3855 	ip_stack_t	*ipst;
3856 	ill_t		*ill;
3857 	netstack_t	*ns;
3858 
3859 	ns = netstack_find_by_stackid(GLOBAL_NETSTACKID);
3860 
3861 	if ((ipst = ns->netstack_ip) == NULL) {
3862 		cmn_err(CE_WARN, "No ip_stack_t for zoneid zero!\n");
3863 		netstack_rele(ns);
3864 		return (NULL);
3865 	}
3866 
3867 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
3868 	netstack_rele(ns);
3869 	return (ill);
3870 }
3871 
3872 /*
3873  * Return a pointer to the ill which matches the index and IP version type.
3874  */
3875 ill_t *
3876 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3877 {
3878 	ill_t	*ill;
3879 	phyint_t *phyi;
3880 
3881 	/*
3882 	 * Indexes are stored in the phyint - a common structure
3883 	 * to both IPv4 and IPv6.
3884 	 */
3885 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3886 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3887 	    (void *) &index, NULL);
3888 	if (phyi != NULL) {
3889 		ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
3890 		if (ill != NULL) {
3891 			mutex_enter(&ill->ill_lock);
3892 			if (!ILL_IS_CONDEMNED(ill)) {
3893 				ill_refhold_locked(ill);
3894 				mutex_exit(&ill->ill_lock);
3895 				rw_exit(&ipst->ips_ill_g_lock);
3896 				return (ill);
3897 			}
3898 			mutex_exit(&ill->ill_lock);
3899 		}
3900 	}
3901 	rw_exit(&ipst->ips_ill_g_lock);
3902 	return (NULL);
3903 }
3904 
3905 /*
3906  * Verify whether or not an interface index is valid for the specified zoneid
3907  * to transmit packets.
3908  * It can be zero (meaning "reset") or an interface index assigned
3909  * to a non-VNI interface. (We don't use VNI interface to send packets.)
3910  */
3911 boolean_t
3912 ip_xmit_ifindex_valid(uint_t ifindex, zoneid_t zoneid, boolean_t isv6,
3913     ip_stack_t *ipst)
3914 {
3915 	ill_t		*ill;
3916 
3917 	if (ifindex == 0)
3918 		return (B_TRUE);
3919 
3920 	ill = ill_lookup_on_ifindex_zoneid(ifindex, zoneid, isv6, ipst);
3921 	if (ill == NULL)
3922 		return (B_FALSE);
3923 	if (IS_VNI(ill)) {
3924 		ill_refrele(ill);
3925 		return (B_FALSE);
3926 	}
3927 	ill_refrele(ill);
3928 	return (B_TRUE);
3929 }
3930 
3931 /*
3932  * Return the ifindex next in sequence after the passed in ifindex.
3933  * If there is no next ifindex for the given protocol, return 0.
3934  */
3935 uint_t
3936 ill_get_next_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3937 {
3938 	phyint_t *phyi;
3939 	phyint_t *phyi_initial;
3940 	uint_t   ifindex;
3941 
3942 	phyi_initial = NULL;
3943 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3944 
3945 	if (index == 0) {
3946 		phyi = avl_first(
3947 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index);
3948 	} else {
3949 		phyi = phyi_initial = avl_find(
3950 		    &ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3951 		    (void *) &index, NULL);
3952 	}
3953 
3954 	for (; phyi != NULL;
3955 	    phyi = avl_walk(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3956 	    phyi, AVL_AFTER)) {
3957 		/*
3958 		 * If we're not returning the first interface in the tree
3959 		 * and we still haven't moved past the phyint_t that
3960 		 * corresponds to index, avl_walk needs to be called again
3961 		 */
3962 		if (!((index != 0) && (phyi == phyi_initial))) {
3963 			if (isv6) {
3964 				if ((phyi->phyint_illv6) &&
3965 				    ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
3966 				    (phyi->phyint_illv6->ill_isv6 == 1))
3967 					break;
3968 			} else {
3969 				if ((phyi->phyint_illv4) &&
3970 				    ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
3971 				    (phyi->phyint_illv4->ill_isv6 == 0))
3972 					break;
3973 			}
3974 		}
3975 	}
3976 
3977 	rw_exit(&ipst->ips_ill_g_lock);
3978 
3979 	if (phyi != NULL)
3980 		ifindex = phyi->phyint_ifindex;
3981 	else
3982 		ifindex = 0;
3983 
3984 	return (ifindex);
3985 }
3986 
3987 /*
3988  * Return the ifindex for the named interface.
3989  * If there is no next ifindex for the interface, return 0.
3990  */
3991 uint_t
3992 ill_get_ifindex_by_name(char *name, ip_stack_t *ipst)
3993 {
3994 	phyint_t	*phyi;
3995 	avl_index_t	where = 0;
3996 	uint_t		ifindex;
3997 
3998 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3999 
4000 	if ((phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
4001 	    name, &where)) == NULL) {
4002 		rw_exit(&ipst->ips_ill_g_lock);
4003 		return (0);
4004 	}
4005 
4006 	ifindex = phyi->phyint_ifindex;
4007 
4008 	rw_exit(&ipst->ips_ill_g_lock);
4009 
4010 	return (ifindex);
4011 }
4012 
4013 /*
4014  * Return the ifindex to be used by upper layer protocols for instance
4015  * for IPV6_RECVPKTINFO. If IPMP this is the one for the upper ill.
4016  */
4017 uint_t
4018 ill_get_upper_ifindex(const ill_t *ill)
4019 {
4020 	if (IS_UNDER_IPMP(ill))
4021 		return (ipmp_ill_get_ipmp_ifindex(ill));
4022 	else
4023 		return (ill->ill_phyint->phyint_ifindex);
4024 }
4025 
4026 
4027 /*
4028  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
4029  * that gives a running thread a reference to the ill. This reference must be
4030  * released by the thread when it is done accessing the ill and related
4031  * objects. ill_refcnt can not be used to account for static references
4032  * such as other structures pointing to an ill. Callers must generally
4033  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
4034  * or be sure that the ill is not being deleted or changing state before
4035  * calling the refhold functions. A non-zero ill_refcnt ensures that the
4036  * ill won't change any of its critical state such as address, netmask etc.
4037  */
4038 void
4039 ill_refhold(ill_t *ill)
4040 {
4041 	mutex_enter(&ill->ill_lock);
4042 	ill->ill_refcnt++;
4043 	ILL_TRACE_REF(ill);
4044 	mutex_exit(&ill->ill_lock);
4045 }
4046 
4047 void
4048 ill_refhold_locked(ill_t *ill)
4049 {
4050 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4051 	ill->ill_refcnt++;
4052 	ILL_TRACE_REF(ill);
4053 }
4054 
4055 /* Returns true if we managed to get a refhold */
4056 boolean_t
4057 ill_check_and_refhold(ill_t *ill)
4058 {
4059 	mutex_enter(&ill->ill_lock);
4060 	if (!ILL_IS_CONDEMNED(ill)) {
4061 		ill_refhold_locked(ill);
4062 		mutex_exit(&ill->ill_lock);
4063 		return (B_TRUE);
4064 	}
4065 	mutex_exit(&ill->ill_lock);
4066 	return (B_FALSE);
4067 }
4068 
4069 /*
4070  * Must not be called while holding any locks. Otherwise if this is
4071  * the last reference to be released, there is a chance of recursive mutex
4072  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
4073  * to restart an ioctl.
4074  */
4075 void
4076 ill_refrele(ill_t *ill)
4077 {
4078 	mutex_enter(&ill->ill_lock);
4079 	ASSERT(ill->ill_refcnt != 0);
4080 	ill->ill_refcnt--;
4081 	ILL_UNTRACE_REF(ill);
4082 	if (ill->ill_refcnt != 0) {
4083 		/* Every ire pointing to the ill adds 1 to ill_refcnt */
4084 		mutex_exit(&ill->ill_lock);
4085 		return;
4086 	}
4087 
4088 	/* Drops the ill_lock */
4089 	ipif_ill_refrele_tail(ill);
4090 }
4091 
4092 /*
4093  * Obtain a weak reference count on the ill. This reference ensures the
4094  * ill won't be freed, but the ill may change any of its critical state
4095  * such as netmask, address etc. Returns an error if the ill has started
4096  * closing.
4097  */
4098 boolean_t
4099 ill_waiter_inc(ill_t *ill)
4100 {
4101 	mutex_enter(&ill->ill_lock);
4102 	if (ill->ill_state_flags & ILL_CONDEMNED) {
4103 		mutex_exit(&ill->ill_lock);
4104 		return (B_FALSE);
4105 	}
4106 	ill->ill_waiters++;
4107 	mutex_exit(&ill->ill_lock);
4108 	return (B_TRUE);
4109 }
4110 
4111 void
4112 ill_waiter_dcr(ill_t *ill)
4113 {
4114 	mutex_enter(&ill->ill_lock);
4115 	ill->ill_waiters--;
4116 	if (ill->ill_waiters == 0)
4117 		cv_broadcast(&ill->ill_cv);
4118 	mutex_exit(&ill->ill_lock);
4119 }
4120 
4121 /*
4122  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
4123  * driver.  We construct best guess defaults for lower level information that
4124  * we need.  If an interface is brought up without injection of any overriding
4125  * information from outside, we have to be ready to go with these defaults.
4126  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
4127  * we primarely want the dl_provider_style.
4128  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
4129  * at which point we assume the other part of the information is valid.
4130  */
4131 void
4132 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
4133 {
4134 	uchar_t		*brdcst_addr;
4135 	uint_t		brdcst_addr_length, phys_addr_length;
4136 	t_scalar_t	sap_length;
4137 	dl_info_ack_t	*dlia;
4138 	ip_m_t		*ipm;
4139 	dl_qos_cl_sel1_t *sel1;
4140 	int		min_mtu;
4141 
4142 	ASSERT(IAM_WRITER_ILL(ill));
4143 
4144 	/*
4145 	 * Till the ill is fully up  the ill is not globally visible.
4146 	 * So no need for a lock.
4147 	 */
4148 	dlia = (dl_info_ack_t *)mp->b_rptr;
4149 	ill->ill_mactype = dlia->dl_mac_type;
4150 
4151 	ipm = ip_m_lookup(dlia->dl_mac_type);
4152 	if (ipm == NULL) {
4153 		ipm = ip_m_lookup(DL_OTHER);
4154 		ASSERT(ipm != NULL);
4155 	}
4156 	ill->ill_media = ipm;
4157 
4158 	/*
4159 	 * When the new DLPI stuff is ready we'll pull lengths
4160 	 * from dlia.
4161 	 */
4162 	if (dlia->dl_version == DL_VERSION_2) {
4163 		brdcst_addr_length = dlia->dl_brdcst_addr_length;
4164 		brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
4165 		    brdcst_addr_length);
4166 		if (brdcst_addr == NULL) {
4167 			brdcst_addr_length = 0;
4168 		}
4169 		sap_length = dlia->dl_sap_length;
4170 		phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
4171 		ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
4172 		    brdcst_addr_length, sap_length, phys_addr_length));
4173 	} else {
4174 		brdcst_addr_length = 6;
4175 		brdcst_addr = ip_six_byte_all_ones;
4176 		sap_length = -2;
4177 		phys_addr_length = brdcst_addr_length;
4178 	}
4179 
4180 	ill->ill_bcast_addr_length = brdcst_addr_length;
4181 	ill->ill_phys_addr_length = phys_addr_length;
4182 	ill->ill_sap_length = sap_length;
4183 
4184 	/*
4185 	 * Synthetic DLPI types such as SUNW_DL_IPMP specify a zero SDU,
4186 	 * but we must ensure a minimum IP MTU is used since other bits of
4187 	 * IP will fly apart otherwise.
4188 	 */
4189 	min_mtu = ill->ill_isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
4190 	ill->ill_max_frag = MAX(min_mtu, dlia->dl_max_sdu);
4191 	ill->ill_current_frag = ill->ill_max_frag;
4192 	ill->ill_mtu = ill->ill_max_frag;
4193 	ill->ill_mc_mtu = ill->ill_mtu;	/* Overridden by DL_NOTE_SDU_SIZE2 */
4194 
4195 	ill->ill_type = ipm->ip_m_type;
4196 
4197 	if (!ill->ill_dlpi_style_set) {
4198 		if (dlia->dl_provider_style == DL_STYLE2)
4199 			ill->ill_needs_attach = 1;
4200 
4201 		phyint_flags_init(ill->ill_phyint, ill->ill_mactype);
4202 
4203 		/*
4204 		 * Allocate the first ipif on this ill.  We don't delay it
4205 		 * further as ioctl handling assumes at least one ipif exists.
4206 		 *
4207 		 * At this point we don't know whether the ill is v4 or v6.
4208 		 * We will know this whan the SIOCSLIFNAME happens and
4209 		 * the correct value for ill_isv6 will be assigned in
4210 		 * ipif_set_values(). We need to hold the ill lock and
4211 		 * clear the ILL_LL_SUBNET_PENDING flag and atomically do
4212 		 * the wakeup.
4213 		 */
4214 		(void) ipif_allocate(ill, 0, IRE_LOCAL,
4215 		    dlia->dl_provider_style != DL_STYLE2, B_TRUE, NULL);
4216 		mutex_enter(&ill->ill_lock);
4217 		ASSERT(ill->ill_dlpi_style_set == 0);
4218 		ill->ill_dlpi_style_set = 1;
4219 		ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
4220 		cv_broadcast(&ill->ill_cv);
4221 		mutex_exit(&ill->ill_lock);
4222 		freemsg(mp);
4223 		return;
4224 	}
4225 	ASSERT(ill->ill_ipif != NULL);
4226 	/*
4227 	 * We know whether it is IPv4 or IPv6 now, as this is the
4228 	 * second DL_INFO_ACK we are recieving in response to the
4229 	 * DL_INFO_REQ sent in ipif_set_values.
4230 	 */
4231 	ill->ill_sap = (ill->ill_isv6) ? ipm->ip_m_ipv6sap : ipm->ip_m_ipv4sap;
4232 	/*
4233 	 * Clear all the flags that were set based on ill_bcast_addr_length
4234 	 * and ill_phys_addr_length (in ipif_set_values) as these could have
4235 	 * changed now and we need to re-evaluate.
4236 	 */
4237 	ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
4238 	ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
4239 
4240 	/*
4241 	 * Free ill_bcast_mp as things could have changed now.
4242 	 *
4243 	 * NOTE: The IPMP meta-interface is special-cased because it starts
4244 	 * with no underlying interfaces (and thus an unknown broadcast
4245 	 * address length), but we enforce that an interface is broadcast-
4246 	 * capable as part of allowing it to join a group.
4247 	 */
4248 	if (ill->ill_bcast_addr_length == 0 && !IS_IPMP(ill)) {
4249 		if (ill->ill_bcast_mp != NULL)
4250 			freemsg(ill->ill_bcast_mp);
4251 		ill->ill_net_type = IRE_IF_NORESOLVER;
4252 
4253 		ill->ill_bcast_mp = ill_dlur_gen(NULL,
4254 		    ill->ill_phys_addr_length,
4255 		    ill->ill_sap,
4256 		    ill->ill_sap_length);
4257 
4258 		if (ill->ill_isv6)
4259 			/*
4260 			 * Note: xresolv interfaces will eventually need NOARP
4261 			 * set here as well, but that will require those
4262 			 * external resolvers to have some knowledge of
4263 			 * that flag and act appropriately. Not to be changed
4264 			 * at present.
4265 			 */
4266 			ill->ill_flags |= ILLF_NONUD;
4267 		else
4268 			ill->ill_flags |= ILLF_NOARP;
4269 
4270 		if (ill->ill_mactype == SUNW_DL_VNI) {
4271 			ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
4272 		} else if (ill->ill_phys_addr_length == 0 ||
4273 		    ill->ill_mactype == DL_IPV4 ||
4274 		    ill->ill_mactype == DL_IPV6) {
4275 			/*
4276 			 * The underying link is point-to-point, so mark the
4277 			 * interface as such.  We can do IP multicast over
4278 			 * such a link since it transmits all network-layer
4279 			 * packets to the remote side the same way.
4280 			 */
4281 			ill->ill_flags |= ILLF_MULTICAST;
4282 			ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
4283 		}
4284 	} else {
4285 		ill->ill_net_type = IRE_IF_RESOLVER;
4286 		if (ill->ill_bcast_mp != NULL)
4287 			freemsg(ill->ill_bcast_mp);
4288 		ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
4289 		    ill->ill_bcast_addr_length, ill->ill_sap,
4290 		    ill->ill_sap_length);
4291 		/*
4292 		 * Later detect lack of DLPI driver multicast
4293 		 * capability by catching DL_ENABMULTI errors in
4294 		 * ip_rput_dlpi.
4295 		 */
4296 		ill->ill_flags |= ILLF_MULTICAST;
4297 		if (!ill->ill_isv6)
4298 			ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
4299 	}
4300 
4301 	/* For IPMP, PHYI_IPMP should already be set by phyint_flags_init() */
4302 	if (ill->ill_mactype == SUNW_DL_IPMP)
4303 		ASSERT(ill->ill_phyint->phyint_flags & PHYI_IPMP);
4304 
4305 	/* By default an interface does not support any CoS marking */
4306 	ill->ill_flags &= ~ILLF_COS_ENABLED;
4307 
4308 	/*
4309 	 * If we get QoS information in DL_INFO_ACK, the device supports
4310 	 * some form of CoS marking, set ILLF_COS_ENABLED.
4311 	 */
4312 	sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
4313 	    dlia->dl_qos_length);
4314 	if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
4315 		ill->ill_flags |= ILLF_COS_ENABLED;
4316 	}
4317 
4318 	/* Clear any previous error indication. */
4319 	ill->ill_error = 0;
4320 	freemsg(mp);
4321 }
4322 
4323 /*
4324  * Perform various checks to verify that an address would make sense as a
4325  * local, remote, or subnet interface address.
4326  */
4327 static boolean_t
4328 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
4329 {
4330 	ipaddr_t	net_mask;
4331 
4332 	/*
4333 	 * Don't allow all zeroes, or all ones, but allow
4334 	 * all ones netmask.
4335 	 */
4336 	if ((net_mask = ip_net_mask(addr)) == 0)
4337 		return (B_FALSE);
4338 	/* A given netmask overrides the "guess" netmask */
4339 	if (subnet_mask != 0)
4340 		net_mask = subnet_mask;
4341 	if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
4342 	    (addr == (addr | ~net_mask)))) {
4343 		return (B_FALSE);
4344 	}
4345 
4346 	/*
4347 	 * Even if the netmask is all ones, we do not allow address to be
4348 	 * 255.255.255.255
4349 	 */
4350 	if (addr == INADDR_BROADCAST)
4351 		return (B_FALSE);
4352 
4353 	if (CLASSD(addr))
4354 		return (B_FALSE);
4355 
4356 	return (B_TRUE);
4357 }
4358 
4359 #define	V6_IPIF_LINKLOCAL(p)	\
4360 	IN6_IS_ADDR_LINKLOCAL(&(p)->ipif_v6lcl_addr)
4361 
4362 /*
4363  * Compare two given ipifs and check if the second one is better than
4364  * the first one using the order of preference (not taking deprecated
4365  * into acount) specified in ipif_lookup_multicast().
4366  */
4367 static boolean_t
4368 ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif, boolean_t isv6)
4369 {
4370 	/* Check the least preferred first. */
4371 	if (IS_LOOPBACK(old_ipif->ipif_ill)) {
4372 		/* If both ipifs are the same, use the first one. */
4373 		if (IS_LOOPBACK(new_ipif->ipif_ill))
4374 			return (B_FALSE);
4375 		else
4376 			return (B_TRUE);
4377 	}
4378 
4379 	/* For IPv6, check for link local address. */
4380 	if (isv6 && V6_IPIF_LINKLOCAL(old_ipif)) {
4381 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4382 		    V6_IPIF_LINKLOCAL(new_ipif)) {
4383 			/* The second one is equal or less preferred. */
4384 			return (B_FALSE);
4385 		} else {
4386 			return (B_TRUE);
4387 		}
4388 	}
4389 
4390 	/* Then check for point to point interface. */
4391 	if (old_ipif->ipif_flags & IPIF_POINTOPOINT) {
4392 		if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4393 		    (isv6 && V6_IPIF_LINKLOCAL(new_ipif)) ||
4394 		    (new_ipif->ipif_flags & IPIF_POINTOPOINT)) {
4395 			return (B_FALSE);
4396 		} else {
4397 			return (B_TRUE);
4398 		}
4399 	}
4400 
4401 	/* old_ipif is a normal interface, so no need to use the new one. */
4402 	return (B_FALSE);
4403 }
4404 
4405 /*
4406  * Find a mulitcast-capable ipif given an IP instance and zoneid.
4407  * The ipif must be up, and its ill must multicast-capable, not
4408  * condemned, not an underlying interface in an IPMP group, and
4409  * not a VNI interface.  Order of preference:
4410  *
4411  *	1a. normal
4412  *	1b. normal, but deprecated
4413  *	2a. point to point
4414  *	2b. point to point, but deprecated
4415  *	3a. link local
4416  *	3b. link local, but deprecated
4417  *	4. loopback.
4418  */
4419 static ipif_t *
4420 ipif_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4421 {
4422 	ill_t			*ill;
4423 	ill_walk_context_t	ctx;
4424 	ipif_t			*ipif;
4425 	ipif_t			*saved_ipif = NULL;
4426 	ipif_t			*dep_ipif = NULL;
4427 
4428 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4429 	if (isv6)
4430 		ill = ILL_START_WALK_V6(&ctx, ipst);
4431 	else
4432 		ill = ILL_START_WALK_V4(&ctx, ipst);
4433 
4434 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4435 		mutex_enter(&ill->ill_lock);
4436 		if (IS_VNI(ill) || IS_UNDER_IPMP(ill) ||
4437 		    ILL_IS_CONDEMNED(ill) ||
4438 		    !(ill->ill_flags & ILLF_MULTICAST)) {
4439 			mutex_exit(&ill->ill_lock);
4440 			continue;
4441 		}
4442 		for (ipif = ill->ill_ipif; ipif != NULL;
4443 		    ipif = ipif->ipif_next) {
4444 			if (zoneid != ipif->ipif_zoneid &&
4445 			    zoneid != ALL_ZONES &&
4446 			    ipif->ipif_zoneid != ALL_ZONES) {
4447 				continue;
4448 			}
4449 			if (!(ipif->ipif_flags & IPIF_UP) ||
4450 			    IPIF_IS_CONDEMNED(ipif)) {
4451 				continue;
4452 			}
4453 
4454 			/*
4455 			 * Found one candidate.  If it is deprecated,
4456 			 * remember it in dep_ipif.  If it is not deprecated,
4457 			 * remember it in saved_ipif.
4458 			 */
4459 			if (ipif->ipif_flags & IPIF_DEPRECATED) {
4460 				if (dep_ipif == NULL) {
4461 					dep_ipif = ipif;
4462 				} else if (ipif_comp_multi(dep_ipif, ipif,
4463 				    isv6)) {
4464 					/*
4465 					 * If the previous dep_ipif does not
4466 					 * belong to the same ill, we've done
4467 					 * a ipif_refhold() on it.  So we need
4468 					 * to release it.
4469 					 */
4470 					if (dep_ipif->ipif_ill != ill)
4471 						ipif_refrele(dep_ipif);
4472 					dep_ipif = ipif;
4473 				}
4474 				continue;
4475 			}
4476 			if (saved_ipif == NULL) {
4477 				saved_ipif = ipif;
4478 			} else {
4479 				if (ipif_comp_multi(saved_ipif, ipif, isv6)) {
4480 					if (saved_ipif->ipif_ill != ill)
4481 						ipif_refrele(saved_ipif);
4482 					saved_ipif = ipif;
4483 				}
4484 			}
4485 		}
4486 		/*
4487 		 * Before going to the next ill, do a ipif_refhold() on the
4488 		 * saved ones.
4489 		 */
4490 		if (saved_ipif != NULL && saved_ipif->ipif_ill == ill)
4491 			ipif_refhold_locked(saved_ipif);
4492 		if (dep_ipif != NULL && dep_ipif->ipif_ill == ill)
4493 			ipif_refhold_locked(dep_ipif);
4494 		mutex_exit(&ill->ill_lock);
4495 	}
4496 	rw_exit(&ipst->ips_ill_g_lock);
4497 
4498 	/*
4499 	 * If we have only the saved_ipif, return it.  But if we have both
4500 	 * saved_ipif and dep_ipif, check to see which one is better.
4501 	 */
4502 	if (saved_ipif != NULL) {
4503 		if (dep_ipif != NULL) {
4504 			if (ipif_comp_multi(saved_ipif, dep_ipif, isv6)) {
4505 				ipif_refrele(saved_ipif);
4506 				return (dep_ipif);
4507 			} else {
4508 				ipif_refrele(dep_ipif);
4509 				return (saved_ipif);
4510 			}
4511 		}
4512 		return (saved_ipif);
4513 	} else {
4514 		return (dep_ipif);
4515 	}
4516 }
4517 
4518 ill_t *
4519 ill_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4520 {
4521 	ipif_t *ipif;
4522 	ill_t *ill;
4523 
4524 	ipif = ipif_lookup_multicast(ipst, zoneid, isv6);
4525 	if (ipif == NULL)
4526 		return (NULL);
4527 
4528 	ill = ipif->ipif_ill;
4529 	ill_refhold(ill);
4530 	ipif_refrele(ipif);
4531 	return (ill);
4532 }
4533 
4534 /*
4535  * This function is called when an application does not specify an interface
4536  * to be used for multicast traffic (joining a group/sending data).  It
4537  * calls ire_lookup_multi() to look for an interface route for the
4538  * specified multicast group.  Doing this allows the administrator to add
4539  * prefix routes for multicast to indicate which interface to be used for
4540  * multicast traffic in the above scenario.  The route could be for all
4541  * multicast (224.0/4), for a single multicast group (a /32 route) or
4542  * anything in between.  If there is no such multicast route, we just find
4543  * any multicast capable interface and return it.  The returned ipif
4544  * is refhold'ed.
4545  *
4546  * We support MULTIRT and RTF_SETSRC on the multicast routes added to the
4547  * unicast table. This is used by CGTP.
4548  */
4549 ill_t *
4550 ill_lookup_group_v4(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst,
4551     boolean_t *multirtp, ipaddr_t *setsrcp)
4552 {
4553 	ill_t			*ill;
4554 
4555 	ill = ire_lookup_multi_ill_v4(group, zoneid, ipst, multirtp, setsrcp);
4556 	if (ill != NULL)
4557 		return (ill);
4558 
4559 	return (ill_lookup_multicast(ipst, zoneid, B_FALSE));
4560 }
4561 
4562 /*
4563  * Look for an ipif with the specified interface address and destination.
4564  * The destination address is used only for matching point-to-point interfaces.
4565  */
4566 ipif_t *
4567 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, ip_stack_t *ipst)
4568 {
4569 	ipif_t	*ipif;
4570 	ill_t	*ill;
4571 	ill_walk_context_t ctx;
4572 
4573 	/*
4574 	 * First match all the point-to-point interfaces
4575 	 * before looking at non-point-to-point interfaces.
4576 	 * This is done to avoid returning non-point-to-point
4577 	 * ipif instead of unnumbered point-to-point ipif.
4578 	 */
4579 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4580 	ill = ILL_START_WALK_V4(&ctx, ipst);
4581 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4582 		mutex_enter(&ill->ill_lock);
4583 		for (ipif = ill->ill_ipif; ipif != NULL;
4584 		    ipif = ipif->ipif_next) {
4585 			/* Allow the ipif to be down */
4586 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
4587 			    (ipif->ipif_lcl_addr == if_addr) &&
4588 			    (ipif->ipif_pp_dst_addr == dst)) {
4589 				if (!IPIF_IS_CONDEMNED(ipif)) {
4590 					ipif_refhold_locked(ipif);
4591 					mutex_exit(&ill->ill_lock);
4592 					rw_exit(&ipst->ips_ill_g_lock);
4593 					return (ipif);
4594 				}
4595 			}
4596 		}
4597 		mutex_exit(&ill->ill_lock);
4598 	}
4599 	rw_exit(&ipst->ips_ill_g_lock);
4600 
4601 	/* lookup the ipif based on interface address */
4602 	ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, ipst);
4603 	ASSERT(ipif == NULL || !ipif->ipif_isv6);
4604 	return (ipif);
4605 }
4606 
4607 /*
4608  * Common function for ipif_lookup_addr() and ipif_lookup_addr_exact().
4609  */
4610 static ipif_t *
4611 ipif_lookup_addr_common(ipaddr_t addr, ill_t *match_ill, uint32_t match_flags,
4612     zoneid_t zoneid, ip_stack_t *ipst)
4613 {
4614 	ipif_t  *ipif;
4615 	ill_t   *ill;
4616 	boolean_t ptp = B_FALSE;
4617 	ill_walk_context_t	ctx;
4618 	boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP);
4619 	boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP);
4620 
4621 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4622 	/*
4623 	 * Repeat twice, first based on local addresses and
4624 	 * next time for pointopoint.
4625 	 */
4626 repeat:
4627 	ill = ILL_START_WALK_V4(&ctx, ipst);
4628 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4629 		if (match_ill != NULL && ill != match_ill &&
4630 		    (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
4631 			continue;
4632 		}
4633 		mutex_enter(&ill->ill_lock);
4634 		for (ipif = ill->ill_ipif; ipif != NULL;
4635 		    ipif = ipif->ipif_next) {
4636 			if (zoneid != ALL_ZONES &&
4637 			    zoneid != ipif->ipif_zoneid &&
4638 			    ipif->ipif_zoneid != ALL_ZONES)
4639 				continue;
4640 
4641 			if (no_duplicate && !(ipif->ipif_flags & IPIF_UP))
4642 				continue;
4643 
4644 			/* Allow the ipif to be down */
4645 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4646 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4647 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4648 			    (ipif->ipif_pp_dst_addr == addr))) {
4649 				if (!IPIF_IS_CONDEMNED(ipif)) {
4650 					ipif_refhold_locked(ipif);
4651 					mutex_exit(&ill->ill_lock);
4652 					rw_exit(&ipst->ips_ill_g_lock);
4653 					return (ipif);
4654 				}
4655 			}
4656 		}
4657 		mutex_exit(&ill->ill_lock);
4658 	}
4659 
4660 	/* If we already did the ptp case, then we are done */
4661 	if (ptp) {
4662 		rw_exit(&ipst->ips_ill_g_lock);
4663 		return (NULL);
4664 	}
4665 	ptp = B_TRUE;
4666 	goto repeat;
4667 }
4668 
4669 /*
4670  * Lookup an ipif with the specified address.  For point-to-point links we
4671  * look for matches on either the destination address or the local address,
4672  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
4673  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
4674  * (or illgrp if `match_ill' is in an IPMP group).
4675  */
4676 ipif_t *
4677 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4678     ip_stack_t *ipst)
4679 {
4680 	return (ipif_lookup_addr_common(addr, match_ill, IPIF_MATCH_ILLGRP,
4681 	    zoneid, ipst));
4682 }
4683 
4684 /*
4685  * Lookup an ipif with the specified address. Similar to ipif_lookup_addr,
4686  * except that we will only return an address if it is not marked as
4687  * IPIF_DUPLICATE
4688  */
4689 ipif_t *
4690 ipif_lookup_addr_nondup(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4691     ip_stack_t *ipst)
4692 {
4693 	return (ipif_lookup_addr_common(addr, match_ill,
4694 	    (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP),
4695 	    zoneid, ipst));
4696 }
4697 
4698 /*
4699  * Special abbreviated version of ipif_lookup_addr() that doesn't match
4700  * `match_ill' across the IPMP group.  This function is only needed in some
4701  * corner-cases; almost everything should use ipif_lookup_addr().
4702  */
4703 ipif_t *
4704 ipif_lookup_addr_exact(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4705 {
4706 	ASSERT(match_ill != NULL);
4707 	return (ipif_lookup_addr_common(addr, match_ill, 0, ALL_ZONES,
4708 	    ipst));
4709 }
4710 
4711 /*
4712  * Look for an ipif with the specified address. For point-point links
4713  * we look for matches on either the destination address and the local
4714  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
4715  * is set.
4716  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
4717  * ill (or illgrp if `match_ill' is in an IPMP group).
4718  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
4719  */
4720 zoneid_t
4721 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4722 {
4723 	zoneid_t zoneid;
4724 	ipif_t  *ipif;
4725 	ill_t   *ill;
4726 	boolean_t ptp = B_FALSE;
4727 	ill_walk_context_t	ctx;
4728 
4729 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4730 	/*
4731 	 * Repeat twice, first based on local addresses and
4732 	 * next time for pointopoint.
4733 	 */
4734 repeat:
4735 	ill = ILL_START_WALK_V4(&ctx, ipst);
4736 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4737 		if (match_ill != NULL && ill != match_ill &&
4738 		    !IS_IN_SAME_ILLGRP(ill, match_ill)) {
4739 			continue;
4740 		}
4741 		mutex_enter(&ill->ill_lock);
4742 		for (ipif = ill->ill_ipif; ipif != NULL;
4743 		    ipif = ipif->ipif_next) {
4744 			/* Allow the ipif to be down */
4745 			if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4746 			    ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4747 			    (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4748 			    (ipif->ipif_pp_dst_addr == addr)) &&
4749 			    !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
4750 				zoneid = ipif->ipif_zoneid;
4751 				mutex_exit(&ill->ill_lock);
4752 				rw_exit(&ipst->ips_ill_g_lock);
4753 				/*
4754 				 * If ipif_zoneid was ALL_ZONES then we have
4755 				 * a trusted extensions shared IP address.
4756 				 * In that case GLOBAL_ZONEID works to send.
4757 				 */
4758 				if (zoneid == ALL_ZONES)
4759 					zoneid = GLOBAL_ZONEID;
4760 				return (zoneid);
4761 			}
4762 		}
4763 		mutex_exit(&ill->ill_lock);
4764 	}
4765 
4766 	/* If we already did the ptp case, then we are done */
4767 	if (ptp) {
4768 		rw_exit(&ipst->ips_ill_g_lock);
4769 		return (ALL_ZONES);
4770 	}
4771 	ptp = B_TRUE;
4772 	goto repeat;
4773 }
4774 
4775 /*
4776  * Look for an ipif that matches the specified remote address i.e. the
4777  * ipif that would receive the specified packet.
4778  * First look for directly connected interfaces and then do a recursive
4779  * IRE lookup and pick the first ipif corresponding to the source address in the
4780  * ire.
4781  * Returns: held ipif
4782  *
4783  * This is only used for ICMP_ADDRESS_MASK_REQUESTs
4784  */
4785 ipif_t *
4786 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
4787 {
4788 	ipif_t	*ipif;
4789 
4790 	ASSERT(!ill->ill_isv6);
4791 
4792 	/*
4793 	 * Someone could be changing this ipif currently or change it
4794 	 * after we return this. Thus  a few packets could use the old
4795 	 * old values. However structure updates/creates (ire, ilg, ilm etc)
4796 	 * will atomically be updated or cleaned up with the new value
4797 	 * Thus we don't need a lock to check the flags or other attrs below.
4798 	 */
4799 	mutex_enter(&ill->ill_lock);
4800 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4801 		if (IPIF_IS_CONDEMNED(ipif))
4802 			continue;
4803 		if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
4804 		    ipif->ipif_zoneid != ALL_ZONES)
4805 			continue;
4806 		/* Allow the ipif to be down */
4807 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
4808 			if ((ipif->ipif_pp_dst_addr == addr) ||
4809 			    (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
4810 			    ipif->ipif_lcl_addr == addr)) {
4811 				ipif_refhold_locked(ipif);
4812 				mutex_exit(&ill->ill_lock);
4813 				return (ipif);
4814 			}
4815 		} else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
4816 			ipif_refhold_locked(ipif);
4817 			mutex_exit(&ill->ill_lock);
4818 			return (ipif);
4819 		}
4820 	}
4821 	mutex_exit(&ill->ill_lock);
4822 	/*
4823 	 * For a remote destination it isn't possible to nail down a particular
4824 	 * ipif.
4825 	 */
4826 
4827 	/* Pick the first interface */
4828 	ipif = ipif_get_next_ipif(NULL, ill);
4829 	return (ipif);
4830 }
4831 
4832 /*
4833  * This func does not prevent refcnt from increasing. But if
4834  * the caller has taken steps to that effect, then this func
4835  * can be used to determine whether the ill has become quiescent
4836  */
4837 static boolean_t
4838 ill_is_quiescent(ill_t *ill)
4839 {
4840 	ipif_t	*ipif;
4841 
4842 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4843 
4844 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4845 		if (ipif->ipif_refcnt != 0)
4846 			return (B_FALSE);
4847 	}
4848 	if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
4849 		return (B_FALSE);
4850 	}
4851 	return (B_TRUE);
4852 }
4853 
4854 boolean_t
4855 ill_is_freeable(ill_t *ill)
4856 {
4857 	ipif_t	*ipif;
4858 
4859 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4860 
4861 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4862 		if (ipif->ipif_refcnt != 0) {
4863 			return (B_FALSE);
4864 		}
4865 	}
4866 	if (!ILL_FREE_OK(ill) || ill->ill_refcnt != 0) {
4867 		return (B_FALSE);
4868 	}
4869 	return (B_TRUE);
4870 }
4871 
4872 /*
4873  * This func does not prevent refcnt from increasing. But if
4874  * the caller has taken steps to that effect, then this func
4875  * can be used to determine whether the ipif has become quiescent
4876  */
4877 static boolean_t
4878 ipif_is_quiescent(ipif_t *ipif)
4879 {
4880 	ill_t *ill;
4881 
4882 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4883 
4884 	if (ipif->ipif_refcnt != 0)
4885 		return (B_FALSE);
4886 
4887 	ill = ipif->ipif_ill;
4888 	if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
4889 	    ill->ill_logical_down) {
4890 		return (B_TRUE);
4891 	}
4892 
4893 	/* This is the last ipif going down or being deleted on this ill */
4894 	if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0) {
4895 		return (B_FALSE);
4896 	}
4897 
4898 	return (B_TRUE);
4899 }
4900 
4901 /*
4902  * return true if the ipif can be destroyed: the ipif has to be quiescent
4903  * with zero references from ire/ilm to it.
4904  */
4905 static boolean_t
4906 ipif_is_freeable(ipif_t *ipif)
4907 {
4908 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4909 	ASSERT(ipif->ipif_id != 0);
4910 	return (ipif->ipif_refcnt == 0);
4911 }
4912 
4913 /*
4914  * The ipif/ill/ire has been refreled. Do the tail processing.
4915  * Determine if the ipif or ill in question has become quiescent and if so
4916  * wakeup close and/or restart any queued pending ioctl that is waiting
4917  * for the ipif_down (or ill_down)
4918  */
4919 void
4920 ipif_ill_refrele_tail(ill_t *ill)
4921 {
4922 	mblk_t	*mp;
4923 	conn_t	*connp;
4924 	ipsq_t	*ipsq;
4925 	ipxop_t	*ipx;
4926 	ipif_t	*ipif;
4927 	dl_notify_ind_t *dlindp;
4928 
4929 	ASSERT(MUTEX_HELD(&ill->ill_lock));
4930 
4931 	if ((ill->ill_state_flags & ILL_CONDEMNED) && ill_is_freeable(ill)) {
4932 		/* ip_modclose() may be waiting */
4933 		cv_broadcast(&ill->ill_cv);
4934 	}
4935 
4936 	ipsq = ill->ill_phyint->phyint_ipsq;
4937 	mutex_enter(&ipsq->ipsq_lock);
4938 	ipx = ipsq->ipsq_xop;
4939 	mutex_enter(&ipx->ipx_lock);
4940 	if (ipx->ipx_waitfor == 0)	/* no one's waiting; bail */
4941 		goto unlock;
4942 
4943 	ASSERT(ipx->ipx_pending_mp != NULL && ipx->ipx_pending_ipif != NULL);
4944 
4945 	ipif = ipx->ipx_pending_ipif;
4946 	if (ipif->ipif_ill != ill)	/* wait is for another ill; bail */
4947 		goto unlock;
4948 
4949 	switch (ipx->ipx_waitfor) {
4950 	case IPIF_DOWN:
4951 		if (!ipif_is_quiescent(ipif))
4952 			goto unlock;
4953 		break;
4954 	case IPIF_FREE:
4955 		if (!ipif_is_freeable(ipif))
4956 			goto unlock;
4957 		break;
4958 	case ILL_DOWN:
4959 		if (!ill_is_quiescent(ill))
4960 			goto unlock;
4961 		break;
4962 	case ILL_FREE:
4963 		/*
4964 		 * ILL_FREE is only for loopback; normal ill teardown waits
4965 		 * synchronously in ip_modclose() without using ipx_waitfor,
4966 		 * handled by the cv_broadcast() at the top of this function.
4967 		 */
4968 		if (!ill_is_freeable(ill))
4969 			goto unlock;
4970 		break;
4971 	default:
4972 		cmn_err(CE_PANIC, "ipsq: %p unknown ipx_waitfor %d\n",
4973 		    (void *)ipsq, ipx->ipx_waitfor);
4974 	}
4975 
4976 	ill_refhold_locked(ill);	/* for qwriter_ip() call below */
4977 	mutex_exit(&ipx->ipx_lock);
4978 	mp = ipsq_pending_mp_get(ipsq, &connp);
4979 	mutex_exit(&ipsq->ipsq_lock);
4980 	mutex_exit(&ill->ill_lock);
4981 
4982 	ASSERT(mp != NULL);
4983 	/*
4984 	 * NOTE: all of the qwriter_ip() calls below use CUR_OP since
4985 	 * we can only get here when the current operation decides it
4986 	 * it needs to quiesce via ipsq_pending_mp_add().
4987 	 */
4988 	switch (mp->b_datap->db_type) {
4989 	case M_PCPROTO:
4990 	case M_PROTO:
4991 		/*
4992 		 * For now, only DL_NOTIFY_IND messages can use this facility.
4993 		 */
4994 		dlindp = (dl_notify_ind_t *)mp->b_rptr;
4995 		ASSERT(dlindp->dl_primitive == DL_NOTIFY_IND);
4996 
4997 		switch (dlindp->dl_notification) {
4998 		case DL_NOTE_PHYS_ADDR:
4999 			qwriter_ip(ill, ill->ill_rq, mp,
5000 			    ill_set_phys_addr_tail, CUR_OP, B_TRUE);
5001 			return;
5002 		case DL_NOTE_REPLUMB:
5003 			qwriter_ip(ill, ill->ill_rq, mp,
5004 			    ill_replumb_tail, CUR_OP, B_TRUE);
5005 			return;
5006 		default:
5007 			ASSERT(0);
5008 			ill_refrele(ill);
5009 		}
5010 		break;
5011 
5012 	case M_ERROR:
5013 	case M_HANGUP:
5014 		qwriter_ip(ill, ill->ill_rq, mp, ipif_all_down_tail, CUR_OP,
5015 		    B_TRUE);
5016 		return;
5017 
5018 	case M_IOCTL:
5019 	case M_IOCDATA:
5020 		qwriter_ip(ill, (connp != NULL ? CONNP_TO_WQ(connp) :
5021 		    ill->ill_wq), mp, ip_reprocess_ioctl, CUR_OP, B_TRUE);
5022 		return;
5023 
5024 	default:
5025 		cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
5026 		    "db_type %d\n", (void *)mp, mp->b_datap->db_type);
5027 	}
5028 	return;
5029 unlock:
5030 	mutex_exit(&ipsq->ipsq_lock);
5031 	mutex_exit(&ipx->ipx_lock);
5032 	mutex_exit(&ill->ill_lock);
5033 }
5034 
5035 #ifdef DEBUG
5036 /* Reuse trace buffer from beginning (if reached the end) and record trace */
5037 static void
5038 th_trace_rrecord(th_trace_t *th_trace)
5039 {
5040 	tr_buf_t *tr_buf;
5041 	uint_t lastref;
5042 
5043 	lastref = th_trace->th_trace_lastref;
5044 	lastref++;
5045 	if (lastref == TR_BUF_MAX)
5046 		lastref = 0;
5047 	th_trace->th_trace_lastref = lastref;
5048 	tr_buf = &th_trace->th_trbuf[lastref];
5049 	tr_buf->tr_time = ddi_get_lbolt();
5050 	tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, TR_STACK_DEPTH);
5051 }
5052 
5053 static void
5054 th_trace_free(void *value)
5055 {
5056 	th_trace_t *th_trace = value;
5057 
5058 	ASSERT(th_trace->th_refcnt == 0);
5059 	kmem_free(th_trace, sizeof (*th_trace));
5060 }
5061 
5062 /*
5063  * Find or create the per-thread hash table used to track object references.
5064  * The ipst argument is NULL if we shouldn't allocate.
5065  *
5066  * Accesses per-thread data, so there's no need to lock here.
5067  */
5068 static mod_hash_t *
5069 th_trace_gethash(ip_stack_t *ipst)
5070 {
5071 	th_hash_t *thh;
5072 
5073 	if ((thh = tsd_get(ip_thread_data)) == NULL && ipst != NULL) {
5074 		mod_hash_t *mh;
5075 		char name[256];
5076 		size_t objsize, rshift;
5077 		int retv;
5078 
5079 		if ((thh = kmem_alloc(sizeof (*thh), KM_NOSLEEP)) == NULL)
5080 			return (NULL);
5081 		(void) snprintf(name, sizeof (name), "th_trace_%p",
5082 		    (void *)curthread);
5083 
5084 		/*
5085 		 * We use mod_hash_create_extended here rather than the more
5086 		 * obvious mod_hash_create_ptrhash because the latter has a
5087 		 * hard-coded KM_SLEEP, and we'd prefer to fail rather than
5088 		 * block.
5089 		 */
5090 		objsize = MAX(MAX(sizeof (ill_t), sizeof (ipif_t)),
5091 		    MAX(sizeof (ire_t), sizeof (ncec_t)));
5092 		rshift = highbit(objsize);
5093 		mh = mod_hash_create_extended(name, 64, mod_hash_null_keydtor,
5094 		    th_trace_free, mod_hash_byptr, (void *)rshift,
5095 		    mod_hash_ptrkey_cmp, KM_NOSLEEP);
5096 		if (mh == NULL) {
5097 			kmem_free(thh, sizeof (*thh));
5098 			return (NULL);
5099 		}
5100 		thh->thh_hash = mh;
5101 		thh->thh_ipst = ipst;
5102 		/*
5103 		 * We trace ills, ipifs, ires, and nces.  All of these are
5104 		 * per-IP-stack, so the lock on the thread list is as well.
5105 		 */
5106 		rw_enter(&ip_thread_rwlock, RW_WRITER);
5107 		list_insert_tail(&ip_thread_list, thh);
5108 		rw_exit(&ip_thread_rwlock);
5109 		retv = tsd_set(ip_thread_data, thh);
5110 		ASSERT(retv == 0);
5111 	}
5112 	return (thh != NULL ? thh->thh_hash : NULL);
5113 }
5114 
5115 boolean_t
5116 th_trace_ref(const void *obj, ip_stack_t *ipst)
5117 {
5118 	th_trace_t *th_trace;
5119 	mod_hash_t *mh;
5120 	mod_hash_val_t val;
5121 
5122 	if ((mh = th_trace_gethash(ipst)) == NULL)
5123 		return (B_FALSE);
5124 
5125 	/*
5126 	 * Attempt to locate the trace buffer for this obj and thread.
5127 	 * If it does not exist, then allocate a new trace buffer and
5128 	 * insert into the hash.
5129 	 */
5130 	if (mod_hash_find(mh, (mod_hash_key_t)obj, &val) == MH_ERR_NOTFOUND) {
5131 		th_trace = kmem_zalloc(sizeof (th_trace_t), KM_NOSLEEP);
5132 		if (th_trace == NULL)
5133 			return (B_FALSE);
5134 
5135 		th_trace->th_id = curthread;
5136 		if (mod_hash_insert(mh, (mod_hash_key_t)obj,
5137 		    (mod_hash_val_t)th_trace) != 0) {
5138 			kmem_free(th_trace, sizeof (th_trace_t));
5139 			return (B_FALSE);
5140 		}
5141 	} else {
5142 		th_trace = (th_trace_t *)val;
5143 	}
5144 
5145 	ASSERT(th_trace->th_refcnt >= 0 &&
5146 	    th_trace->th_refcnt < TR_BUF_MAX - 1);
5147 
5148 	th_trace->th_refcnt++;
5149 	th_trace_rrecord(th_trace);
5150 	return (B_TRUE);
5151 }
5152 
5153 /*
5154  * For the purpose of tracing a reference release, we assume that global
5155  * tracing is always on and that the same thread initiated the reference hold
5156  * is releasing.
5157  */
5158 void
5159 th_trace_unref(const void *obj)
5160 {
5161 	int retv;
5162 	mod_hash_t *mh;
5163 	th_trace_t *th_trace;
5164 	mod_hash_val_t val;
5165 
5166 	mh = th_trace_gethash(NULL);
5167 	retv = mod_hash_find(mh, (mod_hash_key_t)obj, &val);
5168 	ASSERT(retv == 0);
5169 	th_trace = (th_trace_t *)val;
5170 
5171 	ASSERT(th_trace->th_refcnt > 0);
5172 	th_trace->th_refcnt--;
5173 	th_trace_rrecord(th_trace);
5174 }
5175 
5176 /*
5177  * If tracing has been disabled, then we assume that the reference counts are
5178  * now useless, and we clear them out before destroying the entries.
5179  */
5180 void
5181 th_trace_cleanup(const void *obj, boolean_t trace_disable)
5182 {
5183 	th_hash_t	*thh;
5184 	mod_hash_t	*mh;
5185 	mod_hash_val_t	val;
5186 	th_trace_t	*th_trace;
5187 	int		retv;
5188 
5189 	rw_enter(&ip_thread_rwlock, RW_READER);
5190 	for (thh = list_head(&ip_thread_list); thh != NULL;
5191 	    thh = list_next(&ip_thread_list, thh)) {
5192 		if (mod_hash_find(mh = thh->thh_hash, (mod_hash_key_t)obj,
5193 		    &val) == 0) {
5194 			th_trace = (th_trace_t *)val;
5195 			if (trace_disable)
5196 				th_trace->th_refcnt = 0;
5197 			retv = mod_hash_destroy(mh, (mod_hash_key_t)obj);
5198 			ASSERT(retv == 0);
5199 		}
5200 	}
5201 	rw_exit(&ip_thread_rwlock);
5202 }
5203 
5204 void
5205 ipif_trace_ref(ipif_t *ipif)
5206 {
5207 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5208 
5209 	if (ipif->ipif_trace_disable)
5210 		return;
5211 
5212 	if (!th_trace_ref(ipif, ipif->ipif_ill->ill_ipst)) {
5213 		ipif->ipif_trace_disable = B_TRUE;
5214 		ipif_trace_cleanup(ipif);
5215 	}
5216 }
5217 
5218 void
5219 ipif_untrace_ref(ipif_t *ipif)
5220 {
5221 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5222 
5223 	if (!ipif->ipif_trace_disable)
5224 		th_trace_unref(ipif);
5225 }
5226 
5227 void
5228 ill_trace_ref(ill_t *ill)
5229 {
5230 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5231 
5232 	if (ill->ill_trace_disable)
5233 		return;
5234 
5235 	if (!th_trace_ref(ill, ill->ill_ipst)) {
5236 		ill->ill_trace_disable = B_TRUE;
5237 		ill_trace_cleanup(ill);
5238 	}
5239 }
5240 
5241 void
5242 ill_untrace_ref(ill_t *ill)
5243 {
5244 	ASSERT(MUTEX_HELD(&ill->ill_lock));
5245 
5246 	if (!ill->ill_trace_disable)
5247 		th_trace_unref(ill);
5248 }
5249 
5250 /*
5251  * Called when ipif is unplumbed or when memory alloc fails.  Note that on
5252  * failure, ipif_trace_disable is set.
5253  */
5254 static void
5255 ipif_trace_cleanup(const ipif_t *ipif)
5256 {
5257 	th_trace_cleanup(ipif, ipif->ipif_trace_disable);
5258 }
5259 
5260 /*
5261  * Called when ill is unplumbed or when memory alloc fails.  Note that on
5262  * failure, ill_trace_disable is set.
5263  */
5264 static void
5265 ill_trace_cleanup(const ill_t *ill)
5266 {
5267 	th_trace_cleanup(ill, ill->ill_trace_disable);
5268 }
5269 #endif /* DEBUG */
5270 
5271 void
5272 ipif_refhold_locked(ipif_t *ipif)
5273 {
5274 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5275 	ipif->ipif_refcnt++;
5276 	IPIF_TRACE_REF(ipif);
5277 }
5278 
5279 void
5280 ipif_refhold(ipif_t *ipif)
5281 {
5282 	ill_t	*ill;
5283 
5284 	ill = ipif->ipif_ill;
5285 	mutex_enter(&ill->ill_lock);
5286 	ipif->ipif_refcnt++;
5287 	IPIF_TRACE_REF(ipif);
5288 	mutex_exit(&ill->ill_lock);
5289 }
5290 
5291 /*
5292  * Must not be called while holding any locks. Otherwise if this is
5293  * the last reference to be released there is a chance of recursive mutex
5294  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5295  * to restart an ioctl.
5296  */
5297 void
5298 ipif_refrele(ipif_t *ipif)
5299 {
5300 	ill_t	*ill;
5301 
5302 	ill = ipif->ipif_ill;
5303 
5304 	mutex_enter(&ill->ill_lock);
5305 	ASSERT(ipif->ipif_refcnt != 0);
5306 	ipif->ipif_refcnt--;
5307 	IPIF_UNTRACE_REF(ipif);
5308 	if (ipif->ipif_refcnt != 0) {
5309 		mutex_exit(&ill->ill_lock);
5310 		return;
5311 	}
5312 
5313 	/* Drops the ill_lock */
5314 	ipif_ill_refrele_tail(ill);
5315 }
5316 
5317 ipif_t *
5318 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
5319 {
5320 	ipif_t	*ipif;
5321 
5322 	mutex_enter(&ill->ill_lock);
5323 	for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
5324 	    ipif != NULL; ipif = ipif->ipif_next) {
5325 		if (IPIF_IS_CONDEMNED(ipif))
5326 			continue;
5327 		ipif_refhold_locked(ipif);
5328 		mutex_exit(&ill->ill_lock);
5329 		return (ipif);
5330 	}
5331 	mutex_exit(&ill->ill_lock);
5332 	return (NULL);
5333 }
5334 
5335 /*
5336  * TODO: make this table extendible at run time
5337  * Return a pointer to the mac type info for 'mac_type'
5338  */
5339 static ip_m_t *
5340 ip_m_lookup(t_uscalar_t mac_type)
5341 {
5342 	ip_m_t	*ipm;
5343 
5344 	for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
5345 		if (ipm->ip_m_mac_type == mac_type)
5346 			return (ipm);
5347 	return (NULL);
5348 }
5349 
5350 /*
5351  * Make a link layer address from the multicast IP address *addr.
5352  * To form the link layer address, invoke the ip_m_v*mapping function
5353  * associated with the link-layer type.
5354  */
5355 void
5356 ip_mcast_mapping(ill_t *ill, uchar_t *addr, uchar_t *hwaddr)
5357 {
5358 	ip_m_t *ipm;
5359 
5360 	if (ill->ill_net_type == IRE_IF_NORESOLVER)
5361 		return;
5362 
5363 	ASSERT(addr != NULL);
5364 
5365 	ipm = ip_m_lookup(ill->ill_mactype);
5366 	if (ipm == NULL ||
5367 	    (ill->ill_isv6 && ipm->ip_m_v6mapping == NULL) ||
5368 	    (!ill->ill_isv6 && ipm->ip_m_v4mapping == NULL)) {
5369 		ip0dbg(("no mapping for ill %s mactype 0x%x\n",
5370 		    ill->ill_name, ill->ill_mactype));
5371 		return;
5372 	}
5373 	if (ill->ill_isv6)
5374 		(*ipm->ip_m_v6mapping)(ill, addr, hwaddr);
5375 	else
5376 		(*ipm->ip_m_v4mapping)(ill, addr, hwaddr);
5377 }
5378 
5379 /*
5380  * Returns B_FALSE if the IPv4 netmask pointed by `mask' is non-contiguous.
5381  * Otherwise returns B_TRUE.
5382  *
5383  * The netmask can be verified to be contiguous with 32 shifts and or
5384  * operations. Take the contiguous mask (in host byte order) and compute
5385  *	mask | mask << 1 | mask << 2 | ... | mask << 31
5386  * the result will be the same as the 'mask' for contiguous mask.
5387  */
5388 static boolean_t
5389 ip_contiguous_mask(uint32_t mask)
5390 {
5391 	uint32_t	m = mask;
5392 	int		i;
5393 
5394 	for (i = 1; i < 32; i++)
5395 		m |= (mask << i);
5396 
5397 	return (m == mask);
5398 }
5399 
5400 /*
5401  * ip_rt_add is called to add an IPv4 route to the forwarding table.
5402  * ill is passed in to associate it with the correct interface.
5403  * If ire_arg is set, then we return the held IRE in that location.
5404  */
5405 int
5406 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5407     ipaddr_t src_addr, int flags, ill_t *ill, ire_t **ire_arg,
5408     boolean_t ioctl_msg, struct rtsa_s *sp, ip_stack_t *ipst, zoneid_t zoneid)
5409 {
5410 	ire_t	*ire, *nire;
5411 	ire_t	*gw_ire = NULL;
5412 	ipif_t	*ipif = NULL;
5413 	uint_t	type;
5414 	int	match_flags = MATCH_IRE_TYPE;
5415 	tsol_gc_t *gc = NULL;
5416 	tsol_gcgrp_t *gcgrp = NULL;
5417 	boolean_t gcgrp_xtraref = B_FALSE;
5418 	boolean_t cgtp_broadcast;
5419 	boolean_t unbound = B_FALSE;
5420 
5421 	ip1dbg(("ip_rt_add:"));
5422 
5423 	if (ire_arg != NULL)
5424 		*ire_arg = NULL;
5425 
5426 	/* disallow non-contiguous netmasks */
5427 	if (!ip_contiguous_mask(ntohl(mask)))
5428 		return (ENOTSUP);
5429 
5430 	/*
5431 	 * If this is the case of RTF_HOST being set, then we set the netmask
5432 	 * to all ones (regardless if one was supplied).
5433 	 */
5434 	if (flags & RTF_HOST)
5435 		mask = IP_HOST_MASK;
5436 
5437 	/*
5438 	 * Prevent routes with a zero gateway from being created (since
5439 	 * interfaces can currently be plumbed and brought up no assigned
5440 	 * address).
5441 	 */
5442 	if (gw_addr == 0)
5443 		return (ENETUNREACH);
5444 	/*
5445 	 * Get the ipif, if any, corresponding to the gw_addr
5446 	 * If -ifp was specified we restrict ourselves to the ill, otherwise
5447 	 * we match on the gatway and destination to handle unnumbered pt-pt
5448 	 * interfaces.
5449 	 */
5450 	if (ill != NULL)
5451 		ipif = ipif_lookup_addr(gw_addr, ill, ALL_ZONES, ipst);
5452 	else
5453 		ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
5454 	if (ipif != NULL) {
5455 		if (IS_VNI(ipif->ipif_ill)) {
5456 			ipif_refrele(ipif);
5457 			return (EINVAL);
5458 		}
5459 	}
5460 
5461 	/*
5462 	 * GateD will attempt to create routes with a loopback interface
5463 	 * address as the gateway and with RTF_GATEWAY set.  We allow
5464 	 * these routes to be added, but create them as interface routes
5465 	 * since the gateway is an interface address.
5466 	 */
5467 	if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
5468 		flags &= ~RTF_GATEWAY;
5469 		if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
5470 		    mask == IP_HOST_MASK) {
5471 			ire = ire_ftable_lookup_v4(dst_addr, 0, 0, IRE_LOOPBACK,
5472 			    NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
5473 			    NULL);
5474 			if (ire != NULL) {
5475 				ire_refrele(ire);
5476 				ipif_refrele(ipif);
5477 				return (EEXIST);
5478 			}
5479 			ip1dbg(("ip_rt_add: 0x%p creating IRE 0x%x"
5480 			    "for 0x%x\n", (void *)ipif,
5481 			    ipif->ipif_ire_type,
5482 			    ntohl(ipif->ipif_lcl_addr)));
5483 			ire = ire_create(
5484 			    (uchar_t *)&dst_addr,	/* dest address */
5485 			    (uchar_t *)&mask,		/* mask */
5486 			    NULL,			/* no gateway */
5487 			    ipif->ipif_ire_type,	/* LOOPBACK */
5488 			    ipif->ipif_ill,
5489 			    zoneid,
5490 			    (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
5491 			    NULL,
5492 			    ipst);
5493 
5494 			if (ire == NULL) {
5495 				ipif_refrele(ipif);
5496 				return (ENOMEM);
5497 			}
5498 			/* src address assigned by the caller? */
5499 			if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5500 				ire->ire_setsrc_addr = src_addr;
5501 
5502 			nire = ire_add(ire);
5503 			if (nire == NULL) {
5504 				/*
5505 				 * In the result of failure, ire_add() will have
5506 				 * already deleted the ire in question, so there
5507 				 * is no need to do that here.
5508 				 */
5509 				ipif_refrele(ipif);
5510 				return (ENOMEM);
5511 			}
5512 			/*
5513 			 * Check if it was a duplicate entry. This handles
5514 			 * the case of two racing route adds for the same route
5515 			 */
5516 			if (nire != ire) {
5517 				ASSERT(nire->ire_identical_ref > 1);
5518 				ire_delete(nire);
5519 				ire_refrele(nire);
5520 				ipif_refrele(ipif);
5521 				return (EEXIST);
5522 			}
5523 			ire = nire;
5524 			goto save_ire;
5525 		}
5526 	}
5527 
5528 	/*
5529 	 * The routes for multicast with CGTP are quite special in that
5530 	 * the gateway is the local interface address, yet RTF_GATEWAY
5531 	 * is set. We turn off RTF_GATEWAY to provide compatibility with
5532 	 * this undocumented and unusual use of multicast routes.
5533 	 */
5534 	if ((flags & RTF_MULTIRT) && ipif != NULL)
5535 		flags &= ~RTF_GATEWAY;
5536 
5537 	/*
5538 	 * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
5539 	 * and the gateway address provided is one of the system's interface
5540 	 * addresses.  By using the routing socket interface and supplying an
5541 	 * RTA_IFP sockaddr with an interface index, an alternate method of
5542 	 * specifying an interface route to be created is available which uses
5543 	 * the interface index that specifies the outgoing interface rather than
5544 	 * the address of an outgoing interface (which may not be able to
5545 	 * uniquely identify an interface).  When coupled with the RTF_GATEWAY
5546 	 * flag, routes can be specified which not only specify the next-hop to
5547 	 * be used when routing to a certain prefix, but also which outgoing
5548 	 * interface should be used.
5549 	 *
5550 	 * Previously, interfaces would have unique addresses assigned to them
5551 	 * and so the address assigned to a particular interface could be used
5552 	 * to identify a particular interface.  One exception to this was the
5553 	 * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
5554 	 *
5555 	 * With the advent of IPv6 and its link-local addresses, this
5556 	 * restriction was relaxed and interfaces could share addresses between
5557 	 * themselves.  In fact, typically all of the link-local interfaces on
5558 	 * an IPv6 node or router will have the same link-local address.  In
5559 	 * order to differentiate between these interfaces, the use of an
5560 	 * interface index is necessary and this index can be carried inside a
5561 	 * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
5562 	 * of using the interface index, however, is that all of the ipif's that
5563 	 * are part of an ill have the same index and so the RTA_IFP sockaddr
5564 	 * cannot be used to differentiate between ipif's (or logical
5565 	 * interfaces) that belong to the same ill (physical interface).
5566 	 *
5567 	 * For example, in the following case involving IPv4 interfaces and
5568 	 * logical interfaces
5569 	 *
5570 	 *	192.0.2.32	255.255.255.224	192.0.2.33	U	if0
5571 	 *	192.0.2.32	255.255.255.224	192.0.2.34	U	if0
5572 	 *	192.0.2.32	255.255.255.224	192.0.2.35	U	if0
5573 	 *
5574 	 * the ipif's corresponding to each of these interface routes can be
5575 	 * uniquely identified by the "gateway" (actually interface address).
5576 	 *
5577 	 * In this case involving multiple IPv6 default routes to a particular
5578 	 * link-local gateway, the use of RTA_IFP is necessary to specify which
5579 	 * default route is of interest:
5580 	 *
5581 	 *	default		fe80::123:4567:89ab:cdef	U	if0
5582 	 *	default		fe80::123:4567:89ab:cdef	U	if1
5583 	 */
5584 
5585 	/* RTF_GATEWAY not set */
5586 	if (!(flags & RTF_GATEWAY)) {
5587 		if (sp != NULL) {
5588 			ip2dbg(("ip_rt_add: gateway security attributes "
5589 			    "cannot be set with interface route\n"));
5590 			if (ipif != NULL)
5591 				ipif_refrele(ipif);
5592 			return (EINVAL);
5593 		}
5594 
5595 		/*
5596 		 * Whether or not ill (RTA_IFP) is set, we require that
5597 		 * the gateway is one of our local addresses.
5598 		 */
5599 		if (ipif == NULL)
5600 			return (ENETUNREACH);
5601 
5602 		/*
5603 		 * We use MATCH_IRE_ILL here. If the caller specified an
5604 		 * interface (from the RTA_IFP sockaddr) we use it, otherwise
5605 		 * we use the ill derived from the gateway address.
5606 		 * We can always match the gateway address since we record it
5607 		 * in ire_gateway_addr.
5608 		 * We don't allow RTA_IFP to specify a different ill than the
5609 		 * one matching the ipif to make sure we can delete the route.
5610 		 */
5611 		match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL;
5612 		if (ill == NULL) {
5613 			ill = ipif->ipif_ill;
5614 		} else if (ill != ipif->ipif_ill) {
5615 			ipif_refrele(ipif);
5616 			return (EINVAL);
5617 		}
5618 
5619 		/*
5620 		 * We check for an existing entry at this point.
5621 		 *
5622 		 * Since a netmask isn't passed in via the ioctl interface
5623 		 * (SIOCADDRT), we don't check for a matching netmask in that
5624 		 * case.
5625 		 */
5626 		if (!ioctl_msg)
5627 			match_flags |= MATCH_IRE_MASK;
5628 		ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
5629 		    IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst,
5630 		    NULL);
5631 		if (ire != NULL) {
5632 			ire_refrele(ire);
5633 			ipif_refrele(ipif);
5634 			return (EEXIST);
5635 		}
5636 
5637 		/*
5638 		 * Some software (for example, GateD and Sun Cluster) attempts
5639 		 * to create (what amount to) IRE_PREFIX routes with the
5640 		 * loopback address as the gateway.  This is primarily done to
5641 		 * set up prefixes with the RTF_REJECT flag set (for example,
5642 		 * when generating aggregate routes.)
5643 		 *
5644 		 * If the IRE type (as defined by ill->ill_net_type) would be
5645 		 * IRE_LOOPBACK, then we map the request into a
5646 		 * IRE_IF_NORESOLVER. We also OR in the RTF_BLACKHOLE flag as
5647 		 * these interface routes, by definition, can only be that.
5648 		 *
5649 		 * Needless to say, the real IRE_LOOPBACK is NOT created by this
5650 		 * routine, but rather using ire_create() directly.
5651 		 *
5652 		 */
5653 		type = ill->ill_net_type;
5654 		if (type == IRE_LOOPBACK) {
5655 			type = IRE_IF_NORESOLVER;
5656 			flags |= RTF_BLACKHOLE;
5657 		}
5658 
5659 		/*
5660 		 * Create a copy of the IRE_IF_NORESOLVER or
5661 		 * IRE_IF_RESOLVER with the modified address, netmask, and
5662 		 * gateway.
5663 		 */
5664 		ire = ire_create(
5665 		    (uchar_t *)&dst_addr,
5666 		    (uint8_t *)&mask,
5667 		    (uint8_t *)&gw_addr,
5668 		    type,
5669 		    ill,
5670 		    zoneid,
5671 		    flags,
5672 		    NULL,
5673 		    ipst);
5674 		if (ire == NULL) {
5675 			ipif_refrele(ipif);
5676 			return (ENOMEM);
5677 		}
5678 
5679 		/* src address assigned by the caller? */
5680 		if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5681 			ire->ire_setsrc_addr = src_addr;
5682 
5683 		nire = ire_add(ire);
5684 		if (nire == NULL) {
5685 			/*
5686 			 * In the result of failure, ire_add() will have
5687 			 * already deleted the ire in question, so there
5688 			 * is no need to do that here.
5689 			 */
5690 			ipif_refrele(ipif);
5691 			return (ENOMEM);
5692 		}
5693 		/*
5694 		 * Check if it was a duplicate entry. This handles
5695 		 * the case of two racing route adds for the same route
5696 		 */
5697 		if (nire != ire) {
5698 			ire_delete(nire);
5699 			ire_refrele(nire);
5700 			ipif_refrele(ipif);
5701 			return (EEXIST);
5702 		}
5703 		ire = nire;
5704 		goto save_ire;
5705 	}
5706 
5707 	/*
5708 	 * Get an interface IRE for the specified gateway.
5709 	 * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
5710 	 * gateway, it is currently unreachable and we fail the request
5711 	 * accordingly. We reject any RTF_GATEWAY routes where the gateway
5712 	 * is an IRE_LOCAL or IRE_LOOPBACK.
5713 	 * If RTA_IFP was specified we look on that particular ill.
5714 	 */
5715 	if (ill != NULL)
5716 		match_flags |= MATCH_IRE_ILL;
5717 
5718 	/* Check whether the gateway is reachable. */
5719 again:
5720 	type = IRE_INTERFACE | IRE_LOCAL | IRE_LOOPBACK;
5721 	if (flags & RTF_INDIRECT)
5722 		type |= IRE_OFFLINK;
5723 
5724 	gw_ire = ire_ftable_lookup_v4(gw_addr, 0, 0, type, ill,
5725 	    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
5726 	if (gw_ire == NULL) {
5727 		/*
5728 		 * With IPMP, we allow host routes to influence in.mpathd's
5729 		 * target selection.  However, if the test addresses are on
5730 		 * their own network, the above lookup will fail since the
5731 		 * underlying IRE_INTERFACEs are marked hidden.  So allow
5732 		 * hidden test IREs to be found and try again.
5733 		 */
5734 		if (!(match_flags & MATCH_IRE_TESTHIDDEN))  {
5735 			match_flags |= MATCH_IRE_TESTHIDDEN;
5736 			goto again;
5737 		}
5738 		if (ipif != NULL)
5739 			ipif_refrele(ipif);
5740 		return (ENETUNREACH);
5741 	}
5742 	if (gw_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
5743 		ire_refrele(gw_ire);
5744 		if (ipif != NULL)
5745 			ipif_refrele(ipif);
5746 		return (ENETUNREACH);
5747 	}
5748 
5749 	if (ill == NULL && !(flags & RTF_INDIRECT)) {
5750 		unbound = B_TRUE;
5751 		if (ipst->ips_ip_strict_src_multihoming > 0)
5752 			ill = gw_ire->ire_ill;
5753 	}
5754 
5755 	/*
5756 	 * We create one of three types of IREs as a result of this request
5757 	 * based on the netmask.  A netmask of all ones (which is automatically
5758 	 * assumed when RTF_HOST is set) results in an IRE_HOST being created.
5759 	 * An all zeroes netmask implies a default route so an IRE_DEFAULT is
5760 	 * created.  Otherwise, an IRE_PREFIX route is created for the
5761 	 * destination prefix.
5762 	 */
5763 	if (mask == IP_HOST_MASK)
5764 		type = IRE_HOST;
5765 	else if (mask == 0)
5766 		type = IRE_DEFAULT;
5767 	else
5768 		type = IRE_PREFIX;
5769 
5770 	/* check for a duplicate entry */
5771 	ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
5772 	    ALL_ZONES, NULL, match_flags | MATCH_IRE_MASK | MATCH_IRE_GW,
5773 	    0, ipst, NULL);
5774 	if (ire != NULL) {
5775 		if (ipif != NULL)
5776 			ipif_refrele(ipif);
5777 		ire_refrele(gw_ire);
5778 		ire_refrele(ire);
5779 		return (EEXIST);
5780 	}
5781 
5782 	/* Security attribute exists */
5783 	if (sp != NULL) {
5784 		tsol_gcgrp_addr_t ga;
5785 
5786 		/* find or create the gateway credentials group */
5787 		ga.ga_af = AF_INET;
5788 		IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
5789 
5790 		/* we hold reference to it upon success */
5791 		gcgrp = gcgrp_lookup(&ga, B_TRUE);
5792 		if (gcgrp == NULL) {
5793 			if (ipif != NULL)
5794 				ipif_refrele(ipif);
5795 			ire_refrele(gw_ire);
5796 			return (ENOMEM);
5797 		}
5798 
5799 		/*
5800 		 * Create and add the security attribute to the group; a
5801 		 * reference to the group is made upon allocating a new
5802 		 * entry successfully.  If it finds an already-existing
5803 		 * entry for the security attribute in the group, it simply
5804 		 * returns it and no new reference is made to the group.
5805 		 */
5806 		gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
5807 		if (gc == NULL) {
5808 			if (ipif != NULL)
5809 				ipif_refrele(ipif);
5810 			/* release reference held by gcgrp_lookup */
5811 			GCGRP_REFRELE(gcgrp);
5812 			ire_refrele(gw_ire);
5813 			return (ENOMEM);
5814 		}
5815 	}
5816 
5817 	/* Create the IRE. */
5818 	ire = ire_create(
5819 	    (uchar_t *)&dst_addr,		/* dest address */
5820 	    (uchar_t *)&mask,			/* mask */
5821 	    (uchar_t *)&gw_addr,		/* gateway address */
5822 	    (ushort_t)type,			/* IRE type */
5823 	    ill,
5824 	    zoneid,
5825 	    flags,
5826 	    gc,					/* security attribute */
5827 	    ipst);
5828 
5829 	/*
5830 	 * The ire holds a reference to the 'gc' and the 'gc' holds a
5831 	 * reference to the 'gcgrp'. We can now release the extra reference
5832 	 * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
5833 	 */
5834 	if (gcgrp_xtraref)
5835 		GCGRP_REFRELE(gcgrp);
5836 	if (ire == NULL) {
5837 		if (gc != NULL)
5838 			GC_REFRELE(gc);
5839 		if (ipif != NULL)
5840 			ipif_refrele(ipif);
5841 		ire_refrele(gw_ire);
5842 		return (ENOMEM);
5843 	}
5844 
5845 	/* Before we add, check if an extra CGTP broadcast is needed */
5846 	cgtp_broadcast = ((flags & RTF_MULTIRT) &&
5847 	    ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST);
5848 
5849 	/* src address assigned by the caller? */
5850 	if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5851 		ire->ire_setsrc_addr = src_addr;
5852 
5853 	ire->ire_unbound = unbound;
5854 
5855 	/*
5856 	 * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
5857 	 * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
5858 	 */
5859 
5860 	/* Add the new IRE. */
5861 	nire = ire_add(ire);
5862 	if (nire == NULL) {
5863 		/*
5864 		 * In the result of failure, ire_add() will have
5865 		 * already deleted the ire in question, so there
5866 		 * is no need to do that here.
5867 		 */
5868 		if (ipif != NULL)
5869 			ipif_refrele(ipif);
5870 		ire_refrele(gw_ire);
5871 		return (ENOMEM);
5872 	}
5873 	/*
5874 	 * Check if it was a duplicate entry. This handles
5875 	 * the case of two racing route adds for the same route
5876 	 */
5877 	if (nire != ire) {
5878 		ire_delete(nire);
5879 		ire_refrele(nire);
5880 		if (ipif != NULL)
5881 			ipif_refrele(ipif);
5882 		ire_refrele(gw_ire);
5883 		return (EEXIST);
5884 	}
5885 	ire = nire;
5886 
5887 	if (flags & RTF_MULTIRT) {
5888 		/*
5889 		 * Invoke the CGTP (multirouting) filtering module
5890 		 * to add the dst address in the filtering database.
5891 		 * Replicated inbound packets coming from that address
5892 		 * will be filtered to discard the duplicates.
5893 		 * It is not necessary to call the CGTP filter hook
5894 		 * when the dst address is a broadcast or multicast,
5895 		 * because an IP source address cannot be a broadcast
5896 		 * or a multicast.
5897 		 */
5898 		if (cgtp_broadcast) {
5899 			ip_cgtp_bcast_add(ire, ipst);
5900 			goto save_ire;
5901 		}
5902 		if (ipst->ips_ip_cgtp_filter_ops != NULL &&
5903 		    !CLASSD(ire->ire_addr)) {
5904 			int res;
5905 			ipif_t *src_ipif;
5906 
5907 			/* Find the source address corresponding to gw_ire */
5908 			src_ipif = ipif_lookup_addr(gw_ire->ire_gateway_addr,
5909 			    NULL, zoneid, ipst);
5910 			if (src_ipif != NULL) {
5911 				res = ipst->ips_ip_cgtp_filter_ops->
5912 				    cfo_add_dest_v4(
5913 				    ipst->ips_netstack->netstack_stackid,
5914 				    ire->ire_addr,
5915 				    ire->ire_gateway_addr,
5916 				    ire->ire_setsrc_addr,
5917 				    src_ipif->ipif_lcl_addr);
5918 				ipif_refrele(src_ipif);
5919 			} else {
5920 				res = EADDRNOTAVAIL;
5921 			}
5922 			if (res != 0) {
5923 				if (ipif != NULL)
5924 					ipif_refrele(ipif);
5925 				ire_refrele(gw_ire);
5926 				ire_delete(ire);
5927 				ire_refrele(ire);	/* Held in ire_add */
5928 				return (res);
5929 			}
5930 		}
5931 	}
5932 
5933 save_ire:
5934 	if (gw_ire != NULL) {
5935 		ire_refrele(gw_ire);
5936 		gw_ire = NULL;
5937 	}
5938 	if (ill != NULL) {
5939 		/*
5940 		 * Save enough information so that we can recreate the IRE if
5941 		 * the interface goes down and then up.  The metrics associated
5942 		 * with the route will be saved as well when rts_setmetrics() is
5943 		 * called after the IRE has been created.  In the case where
5944 		 * memory cannot be allocated, none of this information will be
5945 		 * saved.
5946 		 */
5947 		ill_save_ire(ill, ire);
5948 	}
5949 	if (ioctl_msg)
5950 		ip_rts_rtmsg(RTM_OLDADD, ire, 0, ipst);
5951 	if (ire_arg != NULL) {
5952 		/*
5953 		 * Store the ire that was successfully added into where ire_arg
5954 		 * points to so that callers don't have to look it up
5955 		 * themselves (but they are responsible for ire_refrele()ing
5956 		 * the ire when they are finished with it).
5957 		 */
5958 		*ire_arg = ire;
5959 	} else {
5960 		ire_refrele(ire);		/* Held in ire_add */
5961 	}
5962 	if (ipif != NULL)
5963 		ipif_refrele(ipif);
5964 	return (0);
5965 }
5966 
5967 /*
5968  * ip_rt_delete is called to delete an IPv4 route.
5969  * ill is passed in to associate it with the correct interface.
5970  */
5971 /* ARGSUSED4 */
5972 int
5973 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5974     uint_t rtm_addrs, int flags, ill_t *ill, boolean_t ioctl_msg,
5975     ip_stack_t *ipst, zoneid_t zoneid)
5976 {
5977 	ire_t	*ire = NULL;
5978 	ipif_t	*ipif;
5979 	uint_t	type;
5980 	uint_t	match_flags = MATCH_IRE_TYPE;
5981 	int	err = 0;
5982 
5983 	ip1dbg(("ip_rt_delete:"));
5984 	/*
5985 	 * If this is the case of RTF_HOST being set, then we set the netmask
5986 	 * to all ones.  Otherwise, we use the netmask if one was supplied.
5987 	 */
5988 	if (flags & RTF_HOST) {
5989 		mask = IP_HOST_MASK;
5990 		match_flags |= MATCH_IRE_MASK;
5991 	} else if (rtm_addrs & RTA_NETMASK) {
5992 		match_flags |= MATCH_IRE_MASK;
5993 	}
5994 
5995 	/*
5996 	 * Note that RTF_GATEWAY is never set on a delete, therefore
5997 	 * we check if the gateway address is one of our interfaces first,
5998 	 * and fall back on RTF_GATEWAY routes.
5999 	 *
6000 	 * This makes it possible to delete an original
6001 	 * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
6002 	 * However, we have RTF_KERNEL set on the ones created by ipif_up
6003 	 * and those can not be deleted here.
6004 	 *
6005 	 * We use MATCH_IRE_ILL if we know the interface. If the caller
6006 	 * specified an interface (from the RTA_IFP sockaddr) we use it,
6007 	 * otherwise we use the ill derived from the gateway address.
6008 	 * We can always match the gateway address since we record it
6009 	 * in ire_gateway_addr.
6010 	 *
6011 	 * For more detail on specifying routes by gateway address and by
6012 	 * interface index, see the comments in ip_rt_add().
6013 	 */
6014 	ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
6015 	if (ipif != NULL) {
6016 		ill_t	*ill_match;
6017 
6018 		if (ill != NULL)
6019 			ill_match = ill;
6020 		else
6021 			ill_match = ipif->ipif_ill;
6022 
6023 		match_flags |= MATCH_IRE_ILL;
6024 		if (ipif->ipif_ire_type == IRE_LOOPBACK) {
6025 			ire = ire_ftable_lookup_v4(dst_addr, mask, 0,
6026 			    IRE_LOOPBACK, ill_match, ALL_ZONES, NULL,
6027 			    match_flags, 0, ipst, NULL);
6028 		}
6029 		if (ire == NULL) {
6030 			match_flags |= MATCH_IRE_GW;
6031 			ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
6032 			    IRE_INTERFACE, ill_match, ALL_ZONES, NULL,
6033 			    match_flags, 0, ipst, NULL);
6034 		}
6035 		/* Avoid deleting routes created by kernel from an ipif */
6036 		if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) {
6037 			ire_refrele(ire);
6038 			ire = NULL;
6039 		}
6040 
6041 		/* Restore in case we didn't find a match */
6042 		match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL);
6043 	}
6044 
6045 	if (ire == NULL) {
6046 		/*
6047 		 * At this point, the gateway address is not one of our own
6048 		 * addresses or a matching interface route was not found.  We
6049 		 * set the IRE type to lookup based on whether
6050 		 * this is a host route, a default route or just a prefix.
6051 		 *
6052 		 * If an ill was passed in, then the lookup is based on an
6053 		 * interface index so MATCH_IRE_ILL is added to match_flags.
6054 		 */
6055 		match_flags |= MATCH_IRE_GW;
6056 		if (ill != NULL)
6057 			match_flags |= MATCH_IRE_ILL;
6058 		if (mask == IP_HOST_MASK)
6059 			type = IRE_HOST;
6060 		else if (mask == 0)
6061 			type = IRE_DEFAULT;
6062 		else
6063 			type = IRE_PREFIX;
6064 		ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
6065 		    ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
6066 	}
6067 
6068 	if (ipif != NULL) {
6069 		ipif_refrele(ipif);
6070 		ipif = NULL;
6071 	}
6072 
6073 	if (ire == NULL)
6074 		return (ESRCH);
6075 
6076 	if (ire->ire_flags & RTF_MULTIRT) {
6077 		/*
6078 		 * Invoke the CGTP (multirouting) filtering module
6079 		 * to remove the dst address from the filtering database.
6080 		 * Packets coming from that address will no longer be
6081 		 * filtered to remove duplicates.
6082 		 */
6083 		if (ipst->ips_ip_cgtp_filter_ops != NULL) {
6084 			err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v4(
6085 			    ipst->ips_netstack->netstack_stackid,
6086 			    ire->ire_addr, ire->ire_gateway_addr);
6087 		}
6088 		ip_cgtp_bcast_delete(ire, ipst);
6089 	}
6090 
6091 	ill = ire->ire_ill;
6092 	if (ill != NULL)
6093 		ill_remove_saved_ire(ill, ire);
6094 	if (ioctl_msg)
6095 		ip_rts_rtmsg(RTM_OLDDEL, ire, 0, ipst);
6096 	ire_delete(ire);
6097 	ire_refrele(ire);
6098 	return (err);
6099 }
6100 
6101 /*
6102  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
6103  */
6104 /* ARGSUSED */
6105 int
6106 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6107     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6108 {
6109 	ipaddr_t dst_addr;
6110 	ipaddr_t gw_addr;
6111 	ipaddr_t mask;
6112 	int error = 0;
6113 	mblk_t *mp1;
6114 	struct rtentry *rt;
6115 	ipif_t *ipif = NULL;
6116 	ip_stack_t	*ipst;
6117 
6118 	ASSERT(q->q_next == NULL);
6119 	ipst = CONNQ_TO_IPST(q);
6120 
6121 	ip1dbg(("ip_siocaddrt:"));
6122 	/* Existence of mp1 verified in ip_wput_nondata */
6123 	mp1 = mp->b_cont->b_cont;
6124 	rt = (struct rtentry *)mp1->b_rptr;
6125 
6126 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6127 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6128 
6129 	/*
6130 	 * If the RTF_HOST flag is on, this is a request to assign a gateway
6131 	 * to a particular host address.  In this case, we set the netmask to
6132 	 * all ones for the particular destination address.  Otherwise,
6133 	 * determine the netmask to be used based on dst_addr and the interfaces
6134 	 * in use.
6135 	 */
6136 	if (rt->rt_flags & RTF_HOST) {
6137 		mask = IP_HOST_MASK;
6138 	} else {
6139 		/*
6140 		 * Note that ip_subnet_mask returns a zero mask in the case of
6141 		 * default (an all-zeroes address).
6142 		 */
6143 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6144 	}
6145 
6146 	error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
6147 	    B_TRUE, NULL, ipst, ALL_ZONES);
6148 	if (ipif != NULL)
6149 		ipif_refrele(ipif);
6150 	return (error);
6151 }
6152 
6153 /*
6154  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
6155  */
6156 /* ARGSUSED */
6157 int
6158 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6159     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6160 {
6161 	ipaddr_t dst_addr;
6162 	ipaddr_t gw_addr;
6163 	ipaddr_t mask;
6164 	int error;
6165 	mblk_t *mp1;
6166 	struct rtentry *rt;
6167 	ipif_t *ipif = NULL;
6168 	ip_stack_t	*ipst;
6169 
6170 	ASSERT(q->q_next == NULL);
6171 	ipst = CONNQ_TO_IPST(q);
6172 
6173 	ip1dbg(("ip_siocdelrt:"));
6174 	/* Existence of mp1 verified in ip_wput_nondata */
6175 	mp1 = mp->b_cont->b_cont;
6176 	rt = (struct rtentry *)mp1->b_rptr;
6177 
6178 	dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6179 	gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6180 
6181 	/*
6182 	 * If the RTF_HOST flag is on, this is a request to delete a gateway
6183 	 * to a particular host address.  In this case, we set the netmask to
6184 	 * all ones for the particular destination address.  Otherwise,
6185 	 * determine the netmask to be used based on dst_addr and the interfaces
6186 	 * in use.
6187 	 */
6188 	if (rt->rt_flags & RTF_HOST) {
6189 		mask = IP_HOST_MASK;
6190 	} else {
6191 		/*
6192 		 * Note that ip_subnet_mask returns a zero mask in the case of
6193 		 * default (an all-zeroes address).
6194 		 */
6195 		mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6196 	}
6197 
6198 	error = ip_rt_delete(dst_addr, mask, gw_addr,
6199 	    RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, B_TRUE,
6200 	    ipst, ALL_ZONES);
6201 	if (ipif != NULL)
6202 		ipif_refrele(ipif);
6203 	return (error);
6204 }
6205 
6206 /*
6207  * Enqueue the mp onto the ipsq, chained by b_next.
6208  * b_prev stores the function to be executed later, and b_queue the queue
6209  * where this mp originated.
6210  */
6211 void
6212 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6213     ill_t *pending_ill)
6214 {
6215 	conn_t	*connp;
6216 	ipxop_t *ipx = ipsq->ipsq_xop;
6217 
6218 	ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6219 	ASSERT(MUTEX_HELD(&ipx->ipx_lock));
6220 	ASSERT(func != NULL);
6221 
6222 	mp->b_queue = q;
6223 	mp->b_prev = (void *)func;
6224 	mp->b_next = NULL;
6225 
6226 	switch (type) {
6227 	case CUR_OP:
6228 		if (ipx->ipx_mptail != NULL) {
6229 			ASSERT(ipx->ipx_mphead != NULL);
6230 			ipx->ipx_mptail->b_next = mp;
6231 		} else {
6232 			ASSERT(ipx->ipx_mphead == NULL);
6233 			ipx->ipx_mphead = mp;
6234 		}
6235 		ipx->ipx_mptail = mp;
6236 		break;
6237 
6238 	case NEW_OP:
6239 		if (ipsq->ipsq_xopq_mptail != NULL) {
6240 			ASSERT(ipsq->ipsq_xopq_mphead != NULL);
6241 			ipsq->ipsq_xopq_mptail->b_next = mp;
6242 		} else {
6243 			ASSERT(ipsq->ipsq_xopq_mphead == NULL);
6244 			ipsq->ipsq_xopq_mphead = mp;
6245 		}
6246 		ipsq->ipsq_xopq_mptail = mp;
6247 		ipx->ipx_ipsq_queued = B_TRUE;
6248 		break;
6249 
6250 	case SWITCH_OP:
6251 		ASSERT(ipsq->ipsq_swxop != NULL);
6252 		/* only one switch operation is currently allowed */
6253 		ASSERT(ipsq->ipsq_switch_mp == NULL);
6254 		ipsq->ipsq_switch_mp = mp;
6255 		ipx->ipx_ipsq_queued = B_TRUE;
6256 		break;
6257 	default:
6258 		cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
6259 	}
6260 
6261 	if (CONN_Q(q) && pending_ill != NULL) {
6262 		connp = Q_TO_CONN(q);
6263 		ASSERT(MUTEX_HELD(&connp->conn_lock));
6264 		connp->conn_oper_pending_ill = pending_ill;
6265 	}
6266 }
6267 
6268 /*
6269  * Dequeue the next message that requested exclusive access to this IPSQ's
6270  * xop.  Specifically:
6271  *
6272  *  1. If we're still processing the current operation on `ipsq', then
6273  *     dequeue the next message for the operation (from ipx_mphead), or
6274  *     return NULL if there are no queued messages for the operation.
6275  *     These messages are queued via CUR_OP to qwriter_ip() and friends.
6276  *
6277  *  2. If the current operation on `ipsq' has completed (ipx_current_ipif is
6278  *     not set) see if the ipsq has requested an xop switch.  If so, switch
6279  *     `ipsq' to a different xop.  Xop switches only happen when joining or
6280  *     leaving IPMP groups and require a careful dance -- see the comments
6281  *     in-line below for details.  If we're leaving a group xop or if we're
6282  *     joining a group xop and become writer on it, then we proceed to (3).
6283  *     Otherwise, we return NULL and exit the xop.
6284  *
6285  *  3. For each IPSQ in the xop, return any switch operation stored on
6286  *     ipsq_switch_mp (set via SWITCH_OP); these must be processed before
6287  *     any other messages queued on the IPSQ.  Otherwise, dequeue the next
6288  *     exclusive operation (queued via NEW_OP) stored on ipsq_xopq_mphead.
6289  *     Note that if the phyint tied to `ipsq' is not using IPMP there will
6290  *     only be one IPSQ in the xop.  Otherwise, there will be one IPSQ for
6291  *     each phyint in the group, including the IPMP meta-interface phyint.
6292  */
6293 static mblk_t *
6294 ipsq_dq(ipsq_t *ipsq)
6295 {
6296 	ill_t	*illv4, *illv6;
6297 	mblk_t	*mp;
6298 	ipsq_t	*xopipsq;
6299 	ipsq_t	*leftipsq = NULL;
6300 	ipxop_t *ipx;
6301 	phyint_t *phyi = ipsq->ipsq_phyint;
6302 	ip_stack_t *ipst = ipsq->ipsq_ipst;
6303 	boolean_t emptied = B_FALSE;
6304 
6305 	/*
6306 	 * Grab all the locks we need in the defined order (ill_g_lock ->
6307 	 * ipsq_lock -> ipx_lock); ill_g_lock is needed to use ipsq_next.
6308 	 */
6309 	rw_enter(&ipst->ips_ill_g_lock,
6310 	    ipsq->ipsq_swxop != NULL ? RW_WRITER : RW_READER);
6311 	mutex_enter(&ipsq->ipsq_lock);
6312 	ipx = ipsq->ipsq_xop;
6313 	mutex_enter(&ipx->ipx_lock);
6314 
6315 	/*
6316 	 * Dequeue the next message associated with the current exclusive
6317 	 * operation, if any.
6318 	 */
6319 	if ((mp = ipx->ipx_mphead) != NULL) {
6320 		ipx->ipx_mphead = mp->b_next;
6321 		if (ipx->ipx_mphead == NULL)
6322 			ipx->ipx_mptail = NULL;
6323 		mp->b_next = (void *)ipsq;
6324 		goto out;
6325 	}
6326 
6327 	if (ipx->ipx_current_ipif != NULL)
6328 		goto empty;
6329 
6330 	if (ipsq->ipsq_swxop != NULL) {
6331 		/*
6332 		 * The exclusive operation that is now being completed has
6333 		 * requested a switch to a different xop.  This happens
6334 		 * when an interface joins or leaves an IPMP group.  Joins
6335 		 * happen through SIOCSLIFGROUPNAME (ip_sioctl_groupname()).
6336 		 * Leaves happen via SIOCSLIFGROUPNAME, interface unplumb
6337 		 * (phyint_free()), or interface plumb for an ill type
6338 		 * not in the IPMP group (ip_rput_dlpi_writer()).
6339 		 *
6340 		 * Xop switches are not allowed on the IPMP meta-interface.
6341 		 */
6342 		ASSERT(phyi == NULL || !(phyi->phyint_flags & PHYI_IPMP));
6343 		ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
6344 		DTRACE_PROBE1(ipsq__switch, (ipsq_t *), ipsq);
6345 
6346 		if (ipsq->ipsq_swxop == &ipsq->ipsq_ownxop) {
6347 			/*
6348 			 * We're switching back to our own xop, so we have two
6349 			 * xop's to drain/exit: our own, and the group xop
6350 			 * that we are leaving.
6351 			 *
6352 			 * First, pull ourselves out of the group ipsq list.
6353 			 * This is safe since we're writer on ill_g_lock.
6354 			 */
6355 			ASSERT(ipsq->ipsq_xop != &ipsq->ipsq_ownxop);
6356 
6357 			xopipsq = ipx->ipx_ipsq;
6358 			while (xopipsq->ipsq_next != ipsq)
6359 				xopipsq = xopipsq->ipsq_next;
6360 
6361 			xopipsq->ipsq_next = ipsq->ipsq_next;
6362 			ipsq->ipsq_next = ipsq;
6363 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
6364 			ipsq->ipsq_swxop = NULL;
6365 
6366 			/*
6367 			 * Second, prepare to exit the group xop.  The actual
6368 			 * ipsq_exit() is done at the end of this function
6369 			 * since we cannot hold any locks across ipsq_exit().
6370 			 * Note that although we drop the group's ipx_lock, no
6371 			 * threads can proceed since we're still ipx_writer.
6372 			 */
6373 			leftipsq = xopipsq;
6374 			mutex_exit(&ipx->ipx_lock);
6375 
6376 			/*
6377 			 * Third, set ipx to point to our own xop (which was
6378 			 * inactive and therefore can be entered).
6379 			 */
6380 			ipx = ipsq->ipsq_xop;
6381 			mutex_enter(&ipx->ipx_lock);
6382 			ASSERT(ipx->ipx_writer == NULL);
6383 			ASSERT(ipx->ipx_current_ipif == NULL);
6384 		} else {
6385 			/*
6386 			 * We're switching from our own xop to a group xop.
6387 			 * The requestor of the switch must ensure that the
6388 			 * group xop cannot go away (e.g. by ensuring the
6389 			 * phyint associated with the xop cannot go away).
6390 			 *
6391 			 * If we can become writer on our new xop, then we'll
6392 			 * do the drain.  Otherwise, the current writer of our
6393 			 * new xop will do the drain when it exits.
6394 			 *
6395 			 * First, splice ourselves into the group IPSQ list.
6396 			 * This is safe since we're writer on ill_g_lock.
6397 			 */
6398 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6399 
6400 			xopipsq = ipsq->ipsq_swxop->ipx_ipsq;
6401 			while (xopipsq->ipsq_next != ipsq->ipsq_swxop->ipx_ipsq)
6402 				xopipsq = xopipsq->ipsq_next;
6403 
6404 			xopipsq->ipsq_next = ipsq;
6405 			ipsq->ipsq_next = ipsq->ipsq_swxop->ipx_ipsq;
6406 			ipsq->ipsq_xop = ipsq->ipsq_swxop;
6407 			ipsq->ipsq_swxop = NULL;
6408 
6409 			/*
6410 			 * Second, exit our own xop, since it's now unused.
6411 			 * This is safe since we've got the only reference.
6412 			 */
6413 			ASSERT(ipx->ipx_writer == curthread);
6414 			ipx->ipx_writer = NULL;
6415 			VERIFY(--ipx->ipx_reentry_cnt == 0);
6416 			ipx->ipx_ipsq_queued = B_FALSE;
6417 			mutex_exit(&ipx->ipx_lock);
6418 
6419 			/*
6420 			 * Third, set ipx to point to our new xop, and check
6421 			 * if we can become writer on it.  If we cannot, then
6422 			 * the current writer will drain the IPSQ group when
6423 			 * it exits.  Our ipsq_xop is guaranteed to be stable
6424 			 * because we're still holding ipsq_lock.
6425 			 */
6426 			ipx = ipsq->ipsq_xop;
6427 			mutex_enter(&ipx->ipx_lock);
6428 			if (ipx->ipx_writer != NULL ||
6429 			    ipx->ipx_current_ipif != NULL) {
6430 				goto out;
6431 			}
6432 		}
6433 
6434 		/*
6435 		 * Fourth, become writer on our new ipx before we continue
6436 		 * with the drain.  Note that we never dropped ipsq_lock
6437 		 * above, so no other thread could've raced with us to
6438 		 * become writer first.  Also, we're holding ipx_lock, so
6439 		 * no other thread can examine the ipx right now.
6440 		 */
6441 		ASSERT(ipx->ipx_current_ipif == NULL);
6442 		ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6443 		VERIFY(ipx->ipx_reentry_cnt++ == 0);
6444 		ipx->ipx_writer = curthread;
6445 		ipx->ipx_forced = B_FALSE;
6446 #ifdef DEBUG
6447 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6448 #endif
6449 	}
6450 
6451 	xopipsq = ipsq;
6452 	do {
6453 		/*
6454 		 * So that other operations operate on a consistent and
6455 		 * complete phyint, a switch message on an IPSQ must be
6456 		 * handled prior to any other operations on that IPSQ.
6457 		 */
6458 		if ((mp = xopipsq->ipsq_switch_mp) != NULL) {
6459 			xopipsq->ipsq_switch_mp = NULL;
6460 			ASSERT(mp->b_next == NULL);
6461 			mp->b_next = (void *)xopipsq;
6462 			goto out;
6463 		}
6464 
6465 		if ((mp = xopipsq->ipsq_xopq_mphead) != NULL) {
6466 			xopipsq->ipsq_xopq_mphead = mp->b_next;
6467 			if (xopipsq->ipsq_xopq_mphead == NULL)
6468 				xopipsq->ipsq_xopq_mptail = NULL;
6469 			mp->b_next = (void *)xopipsq;
6470 			goto out;
6471 		}
6472 	} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6473 empty:
6474 	/*
6475 	 * There are no messages.  Further, we are holding ipx_lock, hence no
6476 	 * new messages can end up on any IPSQ in the xop.
6477 	 */
6478 	ipx->ipx_writer = NULL;
6479 	ipx->ipx_forced = B_FALSE;
6480 	VERIFY(--ipx->ipx_reentry_cnt == 0);
6481 	ipx->ipx_ipsq_queued = B_FALSE;
6482 	emptied = B_TRUE;
6483 #ifdef	DEBUG
6484 	ipx->ipx_depth = 0;
6485 #endif
6486 out:
6487 	mutex_exit(&ipx->ipx_lock);
6488 	mutex_exit(&ipsq->ipsq_lock);
6489 
6490 	/*
6491 	 * If we completely emptied the xop, then wake up any threads waiting
6492 	 * to enter any of the IPSQ's associated with it.
6493 	 */
6494 	if (emptied) {
6495 		xopipsq = ipsq;
6496 		do {
6497 			if ((phyi = xopipsq->ipsq_phyint) == NULL)
6498 				continue;
6499 
6500 			illv4 = phyi->phyint_illv4;
6501 			illv6 = phyi->phyint_illv6;
6502 
6503 			GRAB_ILL_LOCKS(illv4, illv6);
6504 			if (illv4 != NULL)
6505 				cv_broadcast(&illv4->ill_cv);
6506 			if (illv6 != NULL)
6507 				cv_broadcast(&illv6->ill_cv);
6508 			RELEASE_ILL_LOCKS(illv4, illv6);
6509 		} while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6510 	}
6511 	rw_exit(&ipst->ips_ill_g_lock);
6512 
6513 	/*
6514 	 * Now that all locks are dropped, exit the IPSQ we left.
6515 	 */
6516 	if (leftipsq != NULL)
6517 		ipsq_exit(leftipsq);
6518 
6519 	return (mp);
6520 }
6521 
6522 /*
6523  * Return completion status of previously initiated DLPI operations on
6524  * ills in the purview of an ipsq.
6525  */
6526 static boolean_t
6527 ipsq_dlpi_done(ipsq_t *ipsq)
6528 {
6529 	ipsq_t		*ipsq_start;
6530 	phyint_t	*phyi;
6531 	ill_t		*ill;
6532 
6533 	ASSERT(RW_LOCK_HELD(&ipsq->ipsq_ipst->ips_ill_g_lock));
6534 	ipsq_start = ipsq;
6535 
6536 	do {
6537 		/*
6538 		 * The only current users of this function are ipsq_try_enter
6539 		 * and ipsq_enter which have made sure that ipsq_writer is
6540 		 * NULL before we reach here. ill_dlpi_pending is modified
6541 		 * only by an ipsq writer
6542 		 */
6543 		ASSERT(ipsq->ipsq_xop->ipx_writer == NULL);
6544 		phyi = ipsq->ipsq_phyint;
6545 		/*
6546 		 * phyi could be NULL if a phyint that is part of an
6547 		 * IPMP group is being unplumbed. A more detailed
6548 		 * comment is in ipmp_grp_update_kstats()
6549 		 */
6550 		if (phyi != NULL) {
6551 			ill = phyi->phyint_illv4;
6552 			if (ill != NULL &&
6553 			    (ill->ill_dlpi_pending != DL_PRIM_INVAL ||
6554 			    ill->ill_arl_dlpi_pending))
6555 				return (B_FALSE);
6556 
6557 			ill = phyi->phyint_illv6;
6558 			if (ill != NULL &&
6559 			    ill->ill_dlpi_pending != DL_PRIM_INVAL)
6560 				return (B_FALSE);
6561 		}
6562 
6563 	} while ((ipsq = ipsq->ipsq_next) != ipsq_start);
6564 
6565 	return (B_TRUE);
6566 }
6567 
6568 /*
6569  * Enter the ipsq corresponding to ill, by waiting synchronously till
6570  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
6571  * will have to drain completely before ipsq_enter returns success.
6572  * ipx_current_ipif will be set if some exclusive op is in progress,
6573  * and the ipsq_exit logic will start the next enqueued op after
6574  * completion of the current op. If 'force' is used, we don't wait
6575  * for the enqueued ops. This is needed when a conn_close wants to
6576  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
6577  * of an ill can also use this option. But we dont' use it currently.
6578  */
6579 #define	ENTER_SQ_WAIT_TICKS 100
6580 boolean_t
6581 ipsq_enter(ill_t *ill, boolean_t force, int type)
6582 {
6583 	ipsq_t	*ipsq;
6584 	ipxop_t *ipx;
6585 	boolean_t waited_enough = B_FALSE;
6586 	ip_stack_t *ipst = ill->ill_ipst;
6587 
6588 	/*
6589 	 * Note that the relationship between ill and ipsq is fixed as long as
6590 	 * the ill is not ILL_CONDEMNED.  Holding ipsq_lock ensures the
6591 	 * relationship between the IPSQ and xop cannot change.  However,
6592 	 * since we cannot hold ipsq_lock across the cv_wait(), it may change
6593 	 * while we're waiting.  We wait on ill_cv and rely on ipsq_exit()
6594 	 * waking up all ills in the xop when it becomes available.
6595 	 */
6596 	for (;;) {
6597 		rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6598 		mutex_enter(&ill->ill_lock);
6599 		if (ill->ill_state_flags & ILL_CONDEMNED) {
6600 			mutex_exit(&ill->ill_lock);
6601 			rw_exit(&ipst->ips_ill_g_lock);
6602 			return (B_FALSE);
6603 		}
6604 
6605 		ipsq = ill->ill_phyint->phyint_ipsq;
6606 		mutex_enter(&ipsq->ipsq_lock);
6607 		ipx = ipsq->ipsq_xop;
6608 		mutex_enter(&ipx->ipx_lock);
6609 
6610 		if (ipx->ipx_writer == NULL && (type == CUR_OP ||
6611 		    (ipx->ipx_current_ipif == NULL && ipsq_dlpi_done(ipsq)) ||
6612 		    waited_enough))
6613 			break;
6614 
6615 		rw_exit(&ipst->ips_ill_g_lock);
6616 
6617 		if (!force || ipx->ipx_writer != NULL) {
6618 			mutex_exit(&ipx->ipx_lock);
6619 			mutex_exit(&ipsq->ipsq_lock);
6620 			cv_wait(&ill->ill_cv, &ill->ill_lock);
6621 		} else {
6622 			mutex_exit(&ipx->ipx_lock);
6623 			mutex_exit(&ipsq->ipsq_lock);
6624 			(void) cv_reltimedwait(&ill->ill_cv,
6625 			    &ill->ill_lock, ENTER_SQ_WAIT_TICKS, TR_CLOCK_TICK);
6626 			waited_enough = B_TRUE;
6627 		}
6628 		mutex_exit(&ill->ill_lock);
6629 	}
6630 
6631 	ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6632 	ASSERT(ipx->ipx_reentry_cnt == 0);
6633 	ipx->ipx_writer = curthread;
6634 	ipx->ipx_forced = (ipx->ipx_current_ipif != NULL);
6635 	ipx->ipx_reentry_cnt++;
6636 #ifdef DEBUG
6637 	ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6638 #endif
6639 	mutex_exit(&ipx->ipx_lock);
6640 	mutex_exit(&ipsq->ipsq_lock);
6641 	mutex_exit(&ill->ill_lock);
6642 	rw_exit(&ipst->ips_ill_g_lock);
6643 
6644 	return (B_TRUE);
6645 }
6646 
6647 /*
6648  * ipif_set_values() has a constraint that it cannot drop the ips_ill_g_lock
6649  * across the call to the core interface ipsq_try_enter() and hence calls this
6650  * function directly. This is explained more fully in ipif_set_values().
6651  * In order to support the above constraint, ipsq_try_enter is implemented as
6652  * a wrapper that grabs the ips_ill_g_lock and calls this function subsequently
6653  */
6654 static ipsq_t *
6655 ipsq_try_enter_internal(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func,
6656     int type, boolean_t reentry_ok)
6657 {
6658 	ipsq_t	*ipsq;
6659 	ipxop_t	*ipx;
6660 	ip_stack_t *ipst = ill->ill_ipst;
6661 
6662 	/*
6663 	 * lock ordering:
6664 	 * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock.
6665 	 *
6666 	 * ipx of an ipsq can't change when ipsq_lock is held.
6667 	 */
6668 	ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
6669 	GRAB_CONN_LOCK(q);
6670 	mutex_enter(&ill->ill_lock);
6671 	ipsq = ill->ill_phyint->phyint_ipsq;
6672 	mutex_enter(&ipsq->ipsq_lock);
6673 	ipx = ipsq->ipsq_xop;
6674 	mutex_enter(&ipx->ipx_lock);
6675 
6676 	/*
6677 	 * 1. Enter the ipsq if we are already writer and reentry is ok.
6678 	 *    (Note: If the caller does not specify reentry_ok then neither
6679 	 *    'func' nor any of its callees must ever attempt to enter the ipsq
6680 	 *    again. Otherwise it can lead to an infinite loop
6681 	 * 2. Enter the ipsq if there is no current writer and this attempted
6682 	 *    entry is part of the current operation
6683 	 * 3. Enter the ipsq if there is no current writer and this is a new
6684 	 *    operation and the operation queue is empty and there is no
6685 	 *    operation currently in progress and if all previously initiated
6686 	 *    DLPI operations have completed.
6687 	 */
6688 	if ((ipx->ipx_writer == curthread && reentry_ok) ||
6689 	    (ipx->ipx_writer == NULL && (type == CUR_OP || (type == NEW_OP &&
6690 	    !ipx->ipx_ipsq_queued && ipx->ipx_current_ipif == NULL &&
6691 	    ipsq_dlpi_done(ipsq))))) {
6692 		/* Success. */
6693 		ipx->ipx_reentry_cnt++;
6694 		ipx->ipx_writer = curthread;
6695 		ipx->ipx_forced = B_FALSE;
6696 		mutex_exit(&ipx->ipx_lock);
6697 		mutex_exit(&ipsq->ipsq_lock);
6698 		mutex_exit(&ill->ill_lock);
6699 		RELEASE_CONN_LOCK(q);
6700 #ifdef DEBUG
6701 		ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6702 #endif
6703 		return (ipsq);
6704 	}
6705 
6706 	if (func != NULL)
6707 		ipsq_enq(ipsq, q, mp, func, type, ill);
6708 
6709 	mutex_exit(&ipx->ipx_lock);
6710 	mutex_exit(&ipsq->ipsq_lock);
6711 	mutex_exit(&ill->ill_lock);
6712 	RELEASE_CONN_LOCK(q);
6713 	return (NULL);
6714 }
6715 
6716 /*
6717  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
6718  * certain critical operations like plumbing (i.e. most set ioctls), etc.
6719  * There is one ipsq per phyint. The ipsq
6720  * serializes exclusive ioctls issued by applications on a per ipsq basis in
6721  * ipsq_xopq_mphead. It also protects against multiple threads executing in
6722  * the ipsq. Responses from the driver pertain to the current ioctl (say a
6723  * DL_BIND_ACK in response to a DL_BIND_REQ initiated as part of bringing
6724  * up the interface) and are enqueued in ipx_mphead.
6725  *
6726  * If a thread does not want to reenter the ipsq when it is already writer,
6727  * it must make sure that the specified reentry point to be called later
6728  * when the ipsq is empty, nor any code path starting from the specified reentry
6729  * point must never ever try to enter the ipsq again. Otherwise it can lead
6730  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
6731  * When the thread that is currently exclusive finishes, it (ipsq_exit)
6732  * dequeues the requests waiting to become exclusive in ipx_mphead and calls
6733  * the reentry point. When the list at ipx_mphead becomes empty ipsq_exit
6734  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
6735  * ioctl if the current ioctl has completed. If the current ioctl is still
6736  * in progress it simply returns. The current ioctl could be waiting for
6737  * a response from another module (the driver or could be waiting for
6738  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipx_pending_mp
6739  * and ipx_pending_ipif are set. ipx_current_ipif is set throughout the
6740  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
6741  * ipx_current_ipif is NULL which happens only once the ioctl is complete and
6742  * all associated DLPI operations have completed.
6743  */
6744 
6745 /*
6746  * Try to enter the IPSQ corresponding to `ipif' or `ill' exclusively (`ipif'
6747  * and `ill' cannot both be specified).  Returns a pointer to the entered IPSQ
6748  * on success, or NULL on failure.  The caller ensures ipif/ill is valid by
6749  * refholding it as necessary.  If the IPSQ cannot be entered and `func' is
6750  * non-NULL, then `func' will be called back with `q' and `mp' once the IPSQ
6751  * can be entered.  If `func' is NULL, then `q' and `mp' are ignored.
6752  */
6753 ipsq_t *
6754 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
6755     ipsq_func_t func, int type, boolean_t reentry_ok)
6756 {
6757 	ip_stack_t	*ipst;
6758 	ipsq_t		*ipsq;
6759 
6760 	/* Only 1 of ipif or ill can be specified */
6761 	ASSERT((ipif != NULL) ^ (ill != NULL));
6762 
6763 	if (ipif != NULL)
6764 		ill = ipif->ipif_ill;
6765 	ipst = ill->ill_ipst;
6766 
6767 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6768 	ipsq = ipsq_try_enter_internal(ill, q, mp, func, type, reentry_ok);
6769 	rw_exit(&ipst->ips_ill_g_lock);
6770 
6771 	return (ipsq);
6772 }
6773 
6774 /*
6775  * Try to enter the IPSQ corresponding to `ill' as writer.  The caller ensures
6776  * ill is valid by refholding it if necessary; we will refrele.  If the IPSQ
6777  * cannot be entered, the mp is queued for completion.
6778  */
6779 void
6780 qwriter_ip(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6781     boolean_t reentry_ok)
6782 {
6783 	ipsq_t	*ipsq;
6784 
6785 	ipsq = ipsq_try_enter(NULL, ill, q, mp, func, type, reentry_ok);
6786 
6787 	/*
6788 	 * Drop the caller's refhold on the ill.  This is safe since we either
6789 	 * entered the IPSQ (and thus are exclusive), or failed to enter the
6790 	 * IPSQ, in which case we return without accessing ill anymore.  This
6791 	 * is needed because func needs to see the correct refcount.
6792 	 * e.g. removeif can work only then.
6793 	 */
6794 	ill_refrele(ill);
6795 	if (ipsq != NULL) {
6796 		(*func)(ipsq, q, mp, NULL);
6797 		ipsq_exit(ipsq);
6798 	}
6799 }
6800 
6801 /*
6802  * Exit the specified IPSQ.  If this is the final exit on it then drain it
6803  * prior to exiting.  Caller must be writer on the specified IPSQ.
6804  */
6805 void
6806 ipsq_exit(ipsq_t *ipsq)
6807 {
6808 	mblk_t *mp;
6809 	ipsq_t *mp_ipsq;
6810 	queue_t	*q;
6811 	phyint_t *phyi;
6812 	ipsq_func_t func;
6813 
6814 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6815 
6816 	ASSERT(ipsq->ipsq_xop->ipx_reentry_cnt >= 1);
6817 	if (ipsq->ipsq_xop->ipx_reentry_cnt != 1) {
6818 		ipsq->ipsq_xop->ipx_reentry_cnt--;
6819 		return;
6820 	}
6821 
6822 	for (;;) {
6823 		phyi = ipsq->ipsq_phyint;
6824 		mp = ipsq_dq(ipsq);
6825 		mp_ipsq = (mp == NULL) ? NULL : (ipsq_t *)mp->b_next;
6826 
6827 		/*
6828 		 * If we've changed to a new IPSQ, and the phyint associated
6829 		 * with the old one has gone away, free the old IPSQ.  Note
6830 		 * that this cannot happen while the IPSQ is in a group.
6831 		 */
6832 		if (mp_ipsq != ipsq && phyi == NULL) {
6833 			ASSERT(ipsq->ipsq_next == ipsq);
6834 			ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6835 			ipsq_delete(ipsq);
6836 		}
6837 
6838 		if (mp == NULL)
6839 			break;
6840 
6841 		q = mp->b_queue;
6842 		func = (ipsq_func_t)mp->b_prev;
6843 		ipsq = mp_ipsq;
6844 		mp->b_next = mp->b_prev = NULL;
6845 		mp->b_queue = NULL;
6846 
6847 		/*
6848 		 * If 'q' is an conn queue, it is valid, since we did a
6849 		 * a refhold on the conn at the start of the ioctl.
6850 		 * If 'q' is an ill queue, it is valid, since close of an
6851 		 * ill will clean up its IPSQ.
6852 		 */
6853 		(*func)(ipsq, q, mp, NULL);
6854 	}
6855 }
6856 
6857 /*
6858  * Used to start any igmp or mld timers that could not be started
6859  * while holding ill_mcast_lock. The timers can't be started while holding
6860  * the lock, since mld/igmp_start_timers may need to call untimeout()
6861  * which can't be done while holding the lock which the timeout handler
6862  * acquires. Otherwise
6863  * there could be a deadlock since the timeout handlers
6864  * mld_timeout_handler_per_ill/igmp_timeout_handler_per_ill also acquire
6865  * ill_mcast_lock.
6866  */
6867 void
6868 ill_mcast_timer_start(ip_stack_t *ipst)
6869 {
6870 	int		next;
6871 
6872 	mutex_enter(&ipst->ips_igmp_timer_lock);
6873 	next = ipst->ips_igmp_deferred_next;
6874 	ipst->ips_igmp_deferred_next = INFINITY;
6875 	mutex_exit(&ipst->ips_igmp_timer_lock);
6876 
6877 	if (next != INFINITY)
6878 		igmp_start_timers(next, ipst);
6879 
6880 	mutex_enter(&ipst->ips_mld_timer_lock);
6881 	next = ipst->ips_mld_deferred_next;
6882 	ipst->ips_mld_deferred_next = INFINITY;
6883 	mutex_exit(&ipst->ips_mld_timer_lock);
6884 
6885 	if (next != INFINITY)
6886 		mld_start_timers(next, ipst);
6887 }
6888 
6889 /*
6890  * Start the current exclusive operation on `ipsq'; associate it with `ipif'
6891  * and `ioccmd'.
6892  */
6893 void
6894 ipsq_current_start(ipsq_t *ipsq, ipif_t *ipif, int ioccmd)
6895 {
6896 	ill_t *ill = ipif->ipif_ill;
6897 	ipxop_t *ipx = ipsq->ipsq_xop;
6898 
6899 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6900 	ASSERT(ipx->ipx_current_ipif == NULL);
6901 	ASSERT(ipx->ipx_current_ioctl == 0);
6902 
6903 	ipx->ipx_current_done = B_FALSE;
6904 	ipx->ipx_current_ioctl = ioccmd;
6905 	mutex_enter(&ipx->ipx_lock);
6906 	ipx->ipx_current_ipif = ipif;
6907 	mutex_exit(&ipx->ipx_lock);
6908 
6909 	/*
6910 	 * Set IPIF_CHANGING on one or more ipifs associated with the
6911 	 * current exclusive operation.  IPIF_CHANGING prevents any new
6912 	 * references to the ipif (so that the references will eventually
6913 	 * drop to zero) and also prevents any "get" operations (e.g.,
6914 	 * SIOCGLIFFLAGS) from being able to access the ipif until the
6915 	 * operation has completed and the ipif is again in a stable state.
6916 	 *
6917 	 * For ioctls, IPIF_CHANGING is set on the ipif associated with the
6918 	 * ioctl.  For internal operations (where ioccmd is zero), all ipifs
6919 	 * on the ill are marked with IPIF_CHANGING since it's unclear which
6920 	 * ipifs will be affected.
6921 	 *
6922 	 * Note that SIOCLIFREMOVEIF is a special case as it sets
6923 	 * IPIF_CONDEMNED internally after identifying the right ipif to
6924 	 * operate on.
6925 	 */
6926 	switch (ioccmd) {
6927 	case SIOCLIFREMOVEIF:
6928 		break;
6929 	case 0:
6930 		mutex_enter(&ill->ill_lock);
6931 		ipif = ipif->ipif_ill->ill_ipif;
6932 		for (; ipif != NULL; ipif = ipif->ipif_next)
6933 			ipif->ipif_state_flags |= IPIF_CHANGING;
6934 		mutex_exit(&ill->ill_lock);
6935 		break;
6936 	default:
6937 		mutex_enter(&ill->ill_lock);
6938 		ipif->ipif_state_flags |= IPIF_CHANGING;
6939 		mutex_exit(&ill->ill_lock);
6940 	}
6941 }
6942 
6943 /*
6944  * Finish the current exclusive operation on `ipsq'.  Usually, this will allow
6945  * the next exclusive operation to begin once we ipsq_exit().  However, if
6946  * pending DLPI operations remain, then we will wait for the queue to drain
6947  * before allowing the next exclusive operation to begin.  This ensures that
6948  * DLPI operations from one exclusive operation are never improperly processed
6949  * as part of a subsequent exclusive operation.
6950  */
6951 void
6952 ipsq_current_finish(ipsq_t *ipsq)
6953 {
6954 	ipxop_t	*ipx = ipsq->ipsq_xop;
6955 	t_uscalar_t dlpi_pending = DL_PRIM_INVAL;
6956 	ipif_t	*ipif = ipx->ipx_current_ipif;
6957 
6958 	ASSERT(IAM_WRITER_IPSQ(ipsq));
6959 
6960 	/*
6961 	 * For SIOCLIFREMOVEIF, the ipif has been already been blown away
6962 	 * (but in that case, IPIF_CHANGING will already be clear and no
6963 	 * pending DLPI messages can remain).
6964 	 */
6965 	if (ipx->ipx_current_ioctl != SIOCLIFREMOVEIF) {
6966 		ill_t *ill = ipif->ipif_ill;
6967 
6968 		mutex_enter(&ill->ill_lock);
6969 		dlpi_pending = ill->ill_dlpi_pending;
6970 		if (ipx->ipx_current_ioctl == 0) {
6971 			ipif = ill->ill_ipif;
6972 			for (; ipif != NULL; ipif = ipif->ipif_next)
6973 				ipif->ipif_state_flags &= ~IPIF_CHANGING;
6974 		} else {
6975 			ipif->ipif_state_flags &= ~IPIF_CHANGING;
6976 		}
6977 		mutex_exit(&ill->ill_lock);
6978 	}
6979 
6980 	ASSERT(!ipx->ipx_current_done);
6981 	ipx->ipx_current_done = B_TRUE;
6982 	ipx->ipx_current_ioctl = 0;
6983 	if (dlpi_pending == DL_PRIM_INVAL) {
6984 		mutex_enter(&ipx->ipx_lock);
6985 		ipx->ipx_current_ipif = NULL;
6986 		mutex_exit(&ipx->ipx_lock);
6987 	}
6988 }
6989 
6990 /*
6991  * The ill is closing. Flush all messages on the ipsq that originated
6992  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
6993  * for this ill since ipsq_enter could not have entered until then.
6994  * New messages can't be queued since the CONDEMNED flag is set.
6995  */
6996 static void
6997 ipsq_flush(ill_t *ill)
6998 {
6999 	queue_t	*q;
7000 	mblk_t	*prev;
7001 	mblk_t	*mp;
7002 	mblk_t	*mp_next;
7003 	ipxop_t	*ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
7004 
7005 	ASSERT(IAM_WRITER_ILL(ill));
7006 
7007 	/*
7008 	 * Flush any messages sent up by the driver.
7009 	 */
7010 	mutex_enter(&ipx->ipx_lock);
7011 	for (prev = NULL, mp = ipx->ipx_mphead; mp != NULL; mp = mp_next) {
7012 		mp_next = mp->b_next;
7013 		q = mp->b_queue;
7014 		if (q == ill->ill_rq || q == ill->ill_wq) {
7015 			/* dequeue mp */
7016 			if (prev == NULL)
7017 				ipx->ipx_mphead = mp->b_next;
7018 			else
7019 				prev->b_next = mp->b_next;
7020 			if (ipx->ipx_mptail == mp) {
7021 				ASSERT(mp_next == NULL);
7022 				ipx->ipx_mptail = prev;
7023 			}
7024 			inet_freemsg(mp);
7025 		} else {
7026 			prev = mp;
7027 		}
7028 	}
7029 	mutex_exit(&ipx->ipx_lock);
7030 	(void) ipsq_pending_mp_cleanup(ill, NULL);
7031 	ipsq_xopq_mp_cleanup(ill, NULL);
7032 }
7033 
7034 /*
7035  * Parse an ifreq or lifreq struct coming down ioctls and refhold
7036  * and return the associated ipif.
7037  * Return value:
7038  *	Non zero: An error has occurred. ci may not be filled out.
7039  *	zero : ci is filled out with the ioctl cmd in ci.ci_name, and
7040  *	a held ipif in ci.ci_ipif.
7041  */
7042 int
7043 ip_extract_lifreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
7044     cmd_info_t *ci)
7045 {
7046 	char		*name;
7047 	struct ifreq    *ifr;
7048 	struct lifreq    *lifr;
7049 	ipif_t		*ipif = NULL;
7050 	ill_t		*ill;
7051 	conn_t		*connp;
7052 	boolean_t	isv6;
7053 	int		err;
7054 	mblk_t		*mp1;
7055 	zoneid_t	zoneid;
7056 	ip_stack_t	*ipst;
7057 
7058 	if (q->q_next != NULL) {
7059 		ill = (ill_t *)q->q_ptr;
7060 		isv6 = ill->ill_isv6;
7061 		connp = NULL;
7062 		zoneid = ALL_ZONES;
7063 		ipst = ill->ill_ipst;
7064 	} else {
7065 		ill = NULL;
7066 		connp = Q_TO_CONN(q);
7067 		isv6 = (connp->conn_family == AF_INET6);
7068 		zoneid = connp->conn_zoneid;
7069 		if (zoneid == GLOBAL_ZONEID) {
7070 			/* global zone can access ipifs in all zones */
7071 			zoneid = ALL_ZONES;
7072 		}
7073 		ipst = connp->conn_netstack->netstack_ip;
7074 	}
7075 
7076 	/* Has been checked in ip_wput_nondata */
7077 	mp1 = mp->b_cont->b_cont;
7078 
7079 	if (ipip->ipi_cmd_type == IF_CMD) {
7080 		/* This a old style SIOC[GS]IF* command */
7081 		ifr = (struct ifreq *)mp1->b_rptr;
7082 		/*
7083 		 * Null terminate the string to protect against buffer
7084 		 * overrun. String was generated by user code and may not
7085 		 * be trusted.
7086 		 */
7087 		ifr->ifr_name[IFNAMSIZ - 1] = '\0';
7088 		name = ifr->ifr_name;
7089 		ci->ci_sin = (sin_t *)&ifr->ifr_addr;
7090 		ci->ci_sin6 = NULL;
7091 		ci->ci_lifr = (struct lifreq *)ifr;
7092 	} else {
7093 		/* This a new style SIOC[GS]LIF* command */
7094 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
7095 		lifr = (struct lifreq *)mp1->b_rptr;
7096 		/*
7097 		 * Null terminate the string to protect against buffer
7098 		 * overrun. String was generated by user code and may not
7099 		 * be trusted.
7100 		 */
7101 		lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
7102 		name = lifr->lifr_name;
7103 		ci->ci_sin = (sin_t *)&lifr->lifr_addr;
7104 		ci->ci_sin6 = (sin6_t *)&lifr->lifr_addr;
7105 		ci->ci_lifr = lifr;
7106 	}
7107 
7108 	if (ipip->ipi_cmd == SIOCSLIFNAME) {
7109 		/*
7110 		 * The ioctl will be failed if the ioctl comes down
7111 		 * an conn stream
7112 		 */
7113 		if (ill == NULL) {
7114 			/*
7115 			 * Not an ill queue, return EINVAL same as the
7116 			 * old error code.
7117 			 */
7118 			return (ENXIO);
7119 		}
7120 		ipif = ill->ill_ipif;
7121 		ipif_refhold(ipif);
7122 	} else {
7123 		/*
7124 		 * Ensure that ioctls don't see any internal state changes
7125 		 * caused by set ioctls by deferring them if IPIF_CHANGING is
7126 		 * set.
7127 		 */
7128 		ipif = ipif_lookup_on_name_async(name, mi_strlen(name),
7129 		    isv6, zoneid, q, mp, ip_process_ioctl, &err, ipst);
7130 		if (ipif == NULL) {
7131 			if (err == EINPROGRESS)
7132 				return (err);
7133 			err = 0;	/* Ensure we don't use it below */
7134 		}
7135 	}
7136 
7137 	/*
7138 	 * Old style [GS]IFCMD does not admit IPv6 ipif
7139 	 */
7140 	if (ipif != NULL && ipif->ipif_isv6 && ipip->ipi_cmd_type == IF_CMD) {
7141 		ipif_refrele(ipif);
7142 		return (ENXIO);
7143 	}
7144 
7145 	if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
7146 	    name[0] == '\0') {
7147 		/*
7148 		 * Handle a or a SIOC?IF* with a null name
7149 		 * during plumb (on the ill queue before the I_PLINK).
7150 		 */
7151 		ipif = ill->ill_ipif;
7152 		ipif_refhold(ipif);
7153 	}
7154 
7155 	if (ipif == NULL)
7156 		return (ENXIO);
7157 
7158 	DTRACE_PROBE4(ipif__ioctl, char *, "ip_extract_lifreq",
7159 	    int, ipip->ipi_cmd, ill_t *, ipif->ipif_ill, ipif_t *, ipif);
7160 
7161 	ci->ci_ipif = ipif;
7162 	return (0);
7163 }
7164 
7165 /*
7166  * Return the total number of ipifs.
7167  */
7168 static uint_t
7169 ip_get_numifs(zoneid_t zoneid, ip_stack_t *ipst)
7170 {
7171 	uint_t numifs = 0;
7172 	ill_t	*ill;
7173 	ill_walk_context_t	ctx;
7174 	ipif_t	*ipif;
7175 
7176 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7177 	ill = ILL_START_WALK_V4(&ctx, ipst);
7178 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7179 		if (IS_UNDER_IPMP(ill))
7180 			continue;
7181 		for (ipif = ill->ill_ipif; ipif != NULL;
7182 		    ipif = ipif->ipif_next) {
7183 			if (ipif->ipif_zoneid == zoneid ||
7184 			    ipif->ipif_zoneid == ALL_ZONES)
7185 				numifs++;
7186 		}
7187 	}
7188 	rw_exit(&ipst->ips_ill_g_lock);
7189 	return (numifs);
7190 }
7191 
7192 /*
7193  * Return the total number of ipifs.
7194  */
7195 static uint_t
7196 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid, ip_stack_t *ipst)
7197 {
7198 	uint_t numifs = 0;
7199 	ill_t	*ill;
7200 	ipif_t	*ipif;
7201 	ill_walk_context_t	ctx;
7202 
7203 	ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
7204 
7205 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7206 	if (family == AF_INET)
7207 		ill = ILL_START_WALK_V4(&ctx, ipst);
7208 	else if (family == AF_INET6)
7209 		ill = ILL_START_WALK_V6(&ctx, ipst);
7210 	else
7211 		ill = ILL_START_WALK_ALL(&ctx, ipst);
7212 
7213 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7214 		if (IS_UNDER_IPMP(ill) && !(lifn_flags & LIFC_UNDER_IPMP))
7215 			continue;
7216 
7217 		for (ipif = ill->ill_ipif; ipif != NULL;
7218 		    ipif = ipif->ipif_next) {
7219 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7220 			    !(lifn_flags & LIFC_NOXMIT))
7221 				continue;
7222 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7223 			    !(lifn_flags & LIFC_TEMPORARY))
7224 				continue;
7225 			if (((ipif->ipif_flags &
7226 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7227 			    IPIF_DEPRECATED)) ||
7228 			    IS_LOOPBACK(ill) ||
7229 			    !(ipif->ipif_flags & IPIF_UP)) &&
7230 			    (lifn_flags & LIFC_EXTERNAL_SOURCE))
7231 				continue;
7232 
7233 			if (zoneid != ipif->ipif_zoneid &&
7234 			    ipif->ipif_zoneid != ALL_ZONES &&
7235 			    (zoneid != GLOBAL_ZONEID ||
7236 			    !(lifn_flags & LIFC_ALLZONES)))
7237 				continue;
7238 
7239 			numifs++;
7240 		}
7241 	}
7242 	rw_exit(&ipst->ips_ill_g_lock);
7243 	return (numifs);
7244 }
7245 
7246 uint_t
7247 ip_get_lifsrcofnum(ill_t *ill)
7248 {
7249 	uint_t numifs = 0;
7250 	ill_t	*ill_head = ill;
7251 	ip_stack_t	*ipst = ill->ill_ipst;
7252 
7253 	/*
7254 	 * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
7255 	 * other thread may be trying to relink the ILLs in this usesrc group
7256 	 * and adjusting the ill_usesrc_grp_next pointers
7257 	 */
7258 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7259 	if ((ill->ill_usesrc_ifindex == 0) &&
7260 	    (ill->ill_usesrc_grp_next != NULL)) {
7261 		for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
7262 		    ill = ill->ill_usesrc_grp_next)
7263 			numifs++;
7264 	}
7265 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
7266 
7267 	return (numifs);
7268 }
7269 
7270 /* Null values are passed in for ipif, sin, and ifreq */
7271 /* ARGSUSED */
7272 int
7273 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7274     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7275 {
7276 	int *nump;
7277 	conn_t *connp = Q_TO_CONN(q);
7278 
7279 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7280 
7281 	/* Existence of b_cont->b_cont checked in ip_wput_nondata */
7282 	nump = (int *)mp->b_cont->b_cont->b_rptr;
7283 
7284 	*nump = ip_get_numifs(connp->conn_zoneid,
7285 	    connp->conn_netstack->netstack_ip);
7286 	ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
7287 	return (0);
7288 }
7289 
7290 /* Null values are passed in for ipif, sin, and ifreq */
7291 /* ARGSUSED */
7292 int
7293 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
7294     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7295 {
7296 	struct lifnum *lifn;
7297 	mblk_t	*mp1;
7298 	conn_t *connp = Q_TO_CONN(q);
7299 
7300 	ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7301 
7302 	/* Existence checked in ip_wput_nondata */
7303 	mp1 = mp->b_cont->b_cont;
7304 
7305 	lifn = (struct lifnum *)mp1->b_rptr;
7306 	switch (lifn->lifn_family) {
7307 	case AF_UNSPEC:
7308 	case AF_INET:
7309 	case AF_INET6:
7310 		break;
7311 	default:
7312 		return (EAFNOSUPPORT);
7313 	}
7314 
7315 	lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
7316 	    connp->conn_zoneid, connp->conn_netstack->netstack_ip);
7317 	ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
7318 	return (0);
7319 }
7320 
7321 /* ARGSUSED */
7322 int
7323 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7324     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7325 {
7326 	STRUCT_HANDLE(ifconf, ifc);
7327 	mblk_t *mp1;
7328 	struct iocblk *iocp;
7329 	struct ifreq *ifr;
7330 	ill_walk_context_t	ctx;
7331 	ill_t	*ill;
7332 	ipif_t	*ipif;
7333 	struct sockaddr_in *sin;
7334 	int32_t	ifclen;
7335 	zoneid_t zoneid;
7336 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
7337 
7338 	ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
7339 
7340 	ip1dbg(("ip_sioctl_get_ifconf"));
7341 	/* Existence verified in ip_wput_nondata */
7342 	mp1 = mp->b_cont->b_cont;
7343 	iocp = (struct iocblk *)mp->b_rptr;
7344 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7345 
7346 	/*
7347 	 * The original SIOCGIFCONF passed in a struct ifconf which specified
7348 	 * the user buffer address and length into which the list of struct
7349 	 * ifreqs was to be copied.  Since AT&T Streams does not seem to
7350 	 * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
7351 	 * the SIOCGIFCONF operation was redefined to simply provide
7352 	 * a large output buffer into which we are supposed to jam the ifreq
7353 	 * array.  The same ioctl command code was used, despite the fact that
7354 	 * both the applications and the kernel code had to change, thus making
7355 	 * it impossible to support both interfaces.
7356 	 *
7357 	 * For reasons not good enough to try to explain, the following
7358 	 * algorithm is used for deciding what to do with one of these:
7359 	 * If the IOCTL comes in as an I_STR, it is assumed to be of the new
7360 	 * form with the output buffer coming down as the continuation message.
7361 	 * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
7362 	 * and we have to copy in the ifconf structure to find out how big the
7363 	 * output buffer is and where to copy out to.  Sure no problem...
7364 	 *
7365 	 */
7366 	STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
7367 	if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
7368 		int numifs = 0;
7369 		size_t ifc_bufsize;
7370 
7371 		/*
7372 		 * Must be (better be!) continuation of a TRANSPARENT
7373 		 * IOCTL.  We just copied in the ifconf structure.
7374 		 */
7375 		STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
7376 		    (struct ifconf *)mp1->b_rptr);
7377 
7378 		/*
7379 		 * Allocate a buffer to hold requested information.
7380 		 *
7381 		 * If ifc_len is larger than what is needed, we only
7382 		 * allocate what we will use.
7383 		 *
7384 		 * If ifc_len is smaller than what is needed, return
7385 		 * EINVAL.
7386 		 *
7387 		 * XXX: the ill_t structure can hava 2 counters, for
7388 		 * v4 and v6 (not just ill_ipif_up_count) to store the
7389 		 * number of interfaces for a device, so we don't need
7390 		 * to count them here...
7391 		 */
7392 		numifs = ip_get_numifs(zoneid, ipst);
7393 
7394 		ifclen = STRUCT_FGET(ifc, ifc_len);
7395 		ifc_bufsize = numifs * sizeof (struct ifreq);
7396 		if (ifc_bufsize > ifclen) {
7397 			if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7398 				/* old behaviour */
7399 				return (EINVAL);
7400 			} else {
7401 				ifc_bufsize = ifclen;
7402 			}
7403 		}
7404 
7405 		mp1 = mi_copyout_alloc(q, mp,
7406 		    STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
7407 		if (mp1 == NULL)
7408 			return (ENOMEM);
7409 
7410 		mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
7411 	}
7412 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7413 	/*
7414 	 * the SIOCGIFCONF ioctl only knows about
7415 	 * IPv4 addresses, so don't try to tell
7416 	 * it about interfaces with IPv6-only
7417 	 * addresses. (Last parm 'isv6' is B_FALSE)
7418 	 */
7419 
7420 	ifr = (struct ifreq *)mp1->b_rptr;
7421 
7422 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7423 	ill = ILL_START_WALK_V4(&ctx, ipst);
7424 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7425 		if (IS_UNDER_IPMP(ill))
7426 			continue;
7427 		for (ipif = ill->ill_ipif; ipif != NULL;
7428 		    ipif = ipif->ipif_next) {
7429 			if (zoneid != ipif->ipif_zoneid &&
7430 			    ipif->ipif_zoneid != ALL_ZONES)
7431 				continue;
7432 			if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
7433 				if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7434 					/* old behaviour */
7435 					rw_exit(&ipst->ips_ill_g_lock);
7436 					return (EINVAL);
7437 				} else {
7438 					goto if_copydone;
7439 				}
7440 			}
7441 			ipif_get_name(ipif, ifr->ifr_name,
7442 			    sizeof (ifr->ifr_name));
7443 			sin = (sin_t *)&ifr->ifr_addr;
7444 			*sin = sin_null;
7445 			sin->sin_family = AF_INET;
7446 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7447 			ifr++;
7448 		}
7449 	}
7450 if_copydone:
7451 	rw_exit(&ipst->ips_ill_g_lock);
7452 	mp1->b_wptr = (uchar_t *)ifr;
7453 
7454 	if (STRUCT_BUF(ifc) != NULL) {
7455 		STRUCT_FSET(ifc, ifc_len,
7456 		    (int)((uchar_t *)ifr - mp1->b_rptr));
7457 	}
7458 	return (0);
7459 }
7460 
7461 /*
7462  * Get the interfaces using the address hosted on the interface passed in,
7463  * as a source adddress
7464  */
7465 /* ARGSUSED */
7466 int
7467 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7468     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7469 {
7470 	mblk_t *mp1;
7471 	ill_t	*ill, *ill_head;
7472 	ipif_t	*ipif, *orig_ipif;
7473 	int	numlifs = 0;
7474 	size_t	lifs_bufsize, lifsmaxlen;
7475 	struct	lifreq *lifr;
7476 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7477 	uint_t	ifindex;
7478 	zoneid_t zoneid;
7479 	boolean_t isv6 = B_FALSE;
7480 	struct	sockaddr_in	*sin;
7481 	struct	sockaddr_in6	*sin6;
7482 	STRUCT_HANDLE(lifsrcof, lifs);
7483 	ip_stack_t		*ipst;
7484 
7485 	ipst = CONNQ_TO_IPST(q);
7486 
7487 	ASSERT(q->q_next == NULL);
7488 
7489 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7490 
7491 	/* Existence verified in ip_wput_nondata */
7492 	mp1 = mp->b_cont->b_cont;
7493 
7494 	/*
7495 	 * Must be (better be!) continuation of a TRANSPARENT
7496 	 * IOCTL.  We just copied in the lifsrcof structure.
7497 	 */
7498 	STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
7499 	    (struct lifsrcof *)mp1->b_rptr);
7500 
7501 	if (MBLKL(mp1) != STRUCT_SIZE(lifs))
7502 		return (EINVAL);
7503 
7504 	ifindex = STRUCT_FGET(lifs, lifs_ifindex);
7505 	isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
7506 	ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, ipst);
7507 	if (ipif == NULL) {
7508 		ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
7509 		    ifindex));
7510 		return (ENXIO);
7511 	}
7512 
7513 	/* Allocate a buffer to hold requested information */
7514 	numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
7515 	lifs_bufsize = numlifs * sizeof (struct lifreq);
7516 	lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
7517 	/* The actual size needed is always returned in lifs_len */
7518 	STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
7519 
7520 	/* If the amount we need is more than what is passed in, abort */
7521 	if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
7522 		ipif_refrele(ipif);
7523 		return (0);
7524 	}
7525 
7526 	mp1 = mi_copyout_alloc(q, mp,
7527 	    STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
7528 	if (mp1 == NULL) {
7529 		ipif_refrele(ipif);
7530 		return (ENOMEM);
7531 	}
7532 
7533 	mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
7534 	bzero(mp1->b_rptr, lifs_bufsize);
7535 
7536 	lifr = (struct lifreq *)mp1->b_rptr;
7537 
7538 	ill = ill_head = ipif->ipif_ill;
7539 	orig_ipif = ipif;
7540 
7541 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
7542 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7543 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7544 
7545 	ill = ill->ill_usesrc_grp_next; /* start from next ill */
7546 	for (; (ill != NULL) && (ill != ill_head);
7547 	    ill = ill->ill_usesrc_grp_next) {
7548 
7549 		if ((uchar_t *)&lifr[1] > mp1->b_wptr)
7550 			break;
7551 
7552 		ipif = ill->ill_ipif;
7553 		ipif_get_name(ipif, lifr->lifr_name, sizeof (lifr->lifr_name));
7554 		if (ipif->ipif_isv6) {
7555 			sin6 = (sin6_t *)&lifr->lifr_addr;
7556 			*sin6 = sin6_null;
7557 			sin6->sin6_family = AF_INET6;
7558 			sin6->sin6_addr = ipif->ipif_v6lcl_addr;
7559 			lifr->lifr_addrlen = ip_mask_to_plen_v6(
7560 			    &ipif->ipif_v6net_mask);
7561 		} else {
7562 			sin = (sin_t *)&lifr->lifr_addr;
7563 			*sin = sin_null;
7564 			sin->sin_family = AF_INET;
7565 			sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7566 			lifr->lifr_addrlen = ip_mask_to_plen(
7567 			    ipif->ipif_net_mask);
7568 		}
7569 		lifr++;
7570 	}
7571 	rw_exit(&ipst->ips_ill_g_lock);
7572 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
7573 	ipif_refrele(orig_ipif);
7574 	mp1->b_wptr = (uchar_t *)lifr;
7575 	STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
7576 
7577 	return (0);
7578 }
7579 
7580 /* ARGSUSED */
7581 int
7582 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7583     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7584 {
7585 	mblk_t *mp1;
7586 	int	list;
7587 	ill_t	*ill;
7588 	ipif_t	*ipif;
7589 	int	flags;
7590 	int	numlifs = 0;
7591 	size_t	lifc_bufsize;
7592 	struct	lifreq *lifr;
7593 	sa_family_t	family;
7594 	struct	sockaddr_in	*sin;
7595 	struct	sockaddr_in6	*sin6;
7596 	ill_walk_context_t	ctx;
7597 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7598 	int32_t	lifclen;
7599 	zoneid_t zoneid;
7600 	STRUCT_HANDLE(lifconf, lifc);
7601 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
7602 
7603 	ip1dbg(("ip_sioctl_get_lifconf"));
7604 
7605 	ASSERT(q->q_next == NULL);
7606 
7607 	zoneid = Q_TO_CONN(q)->conn_zoneid;
7608 
7609 	/* Existence verified in ip_wput_nondata */
7610 	mp1 = mp->b_cont->b_cont;
7611 
7612 	/*
7613 	 * An extended version of SIOCGIFCONF that takes an
7614 	 * additional address family and flags field.
7615 	 * AF_UNSPEC retrieve both IPv4 and IPv6.
7616 	 * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
7617 	 * interfaces are omitted.
7618 	 * Similarly, IPIF_TEMPORARY interfaces are omitted
7619 	 * unless LIFC_TEMPORARY is specified.
7620 	 * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
7621 	 * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
7622 	 * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
7623 	 * has priority over LIFC_NOXMIT.
7624 	 */
7625 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
7626 
7627 	if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
7628 		return (EINVAL);
7629 
7630 	/*
7631 	 * Must be (better be!) continuation of a TRANSPARENT
7632 	 * IOCTL.  We just copied in the lifconf structure.
7633 	 */
7634 	STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
7635 
7636 	family = STRUCT_FGET(lifc, lifc_family);
7637 	flags = STRUCT_FGET(lifc, lifc_flags);
7638 
7639 	switch (family) {
7640 	case AF_UNSPEC:
7641 		/*
7642 		 * walk all ILL's.
7643 		 */
7644 		list = MAX_G_HEADS;
7645 		break;
7646 	case AF_INET:
7647 		/*
7648 		 * walk only IPV4 ILL's.
7649 		 */
7650 		list = IP_V4_G_HEAD;
7651 		break;
7652 	case AF_INET6:
7653 		/*
7654 		 * walk only IPV6 ILL's.
7655 		 */
7656 		list = IP_V6_G_HEAD;
7657 		break;
7658 	default:
7659 		return (EAFNOSUPPORT);
7660 	}
7661 
7662 	/*
7663 	 * Allocate a buffer to hold requested information.
7664 	 *
7665 	 * If lifc_len is larger than what is needed, we only
7666 	 * allocate what we will use.
7667 	 *
7668 	 * If lifc_len is smaller than what is needed, return
7669 	 * EINVAL.
7670 	 */
7671 	numlifs = ip_get_numlifs(family, flags, zoneid, ipst);
7672 	lifc_bufsize = numlifs * sizeof (struct lifreq);
7673 	lifclen = STRUCT_FGET(lifc, lifc_len);
7674 	if (lifc_bufsize > lifclen) {
7675 		if (iocp->ioc_cmd == O_SIOCGLIFCONF)
7676 			return (EINVAL);
7677 		else
7678 			lifc_bufsize = lifclen;
7679 	}
7680 
7681 	mp1 = mi_copyout_alloc(q, mp,
7682 	    STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
7683 	if (mp1 == NULL)
7684 		return (ENOMEM);
7685 
7686 	mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
7687 	bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7688 
7689 	lifr = (struct lifreq *)mp1->b_rptr;
7690 
7691 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7692 	ill = ill_first(list, list, &ctx, ipst);
7693 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7694 		if (IS_UNDER_IPMP(ill) && !(flags & LIFC_UNDER_IPMP))
7695 			continue;
7696 
7697 		for (ipif = ill->ill_ipif; ipif != NULL;
7698 		    ipif = ipif->ipif_next) {
7699 			if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7700 			    !(flags & LIFC_NOXMIT))
7701 				continue;
7702 
7703 			if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7704 			    !(flags & LIFC_TEMPORARY))
7705 				continue;
7706 
7707 			if (((ipif->ipif_flags &
7708 			    (IPIF_NOXMIT|IPIF_NOLOCAL|
7709 			    IPIF_DEPRECATED)) ||
7710 			    IS_LOOPBACK(ill) ||
7711 			    !(ipif->ipif_flags & IPIF_UP)) &&
7712 			    (flags & LIFC_EXTERNAL_SOURCE))
7713 				continue;
7714 
7715 			if (zoneid != ipif->ipif_zoneid &&
7716 			    ipif->ipif_zoneid != ALL_ZONES &&
7717 			    (zoneid != GLOBAL_ZONEID ||
7718 			    !(flags & LIFC_ALLZONES)))
7719 				continue;
7720 
7721 			if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
7722 				if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
7723 					rw_exit(&ipst->ips_ill_g_lock);
7724 					return (EINVAL);
7725 				} else {
7726 					goto lif_copydone;
7727 				}
7728 			}
7729 
7730 			ipif_get_name(ipif, lifr->lifr_name,
7731 			    sizeof (lifr->lifr_name));
7732 			lifr->lifr_type = ill->ill_type;
7733 			if (ipif->ipif_isv6) {
7734 				sin6 = (sin6_t *)&lifr->lifr_addr;
7735 				*sin6 = sin6_null;
7736 				sin6->sin6_family = AF_INET6;
7737 				sin6->sin6_addr =
7738 				    ipif->ipif_v6lcl_addr;
7739 				lifr->lifr_addrlen =
7740 				    ip_mask_to_plen_v6(
7741 				    &ipif->ipif_v6net_mask);
7742 			} else {
7743 				sin = (sin_t *)&lifr->lifr_addr;
7744 				*sin = sin_null;
7745 				sin->sin_family = AF_INET;
7746 				sin->sin_addr.s_addr =
7747 				    ipif->ipif_lcl_addr;
7748 				lifr->lifr_addrlen =
7749 				    ip_mask_to_plen(
7750 				    ipif->ipif_net_mask);
7751 			}
7752 			lifr++;
7753 		}
7754 	}
7755 lif_copydone:
7756 	rw_exit(&ipst->ips_ill_g_lock);
7757 
7758 	mp1->b_wptr = (uchar_t *)lifr;
7759 	if (STRUCT_BUF(lifc) != NULL) {
7760 		STRUCT_FSET(lifc, lifc_len,
7761 		    (int)((uchar_t *)lifr - mp1->b_rptr));
7762 	}
7763 	return (0);
7764 }
7765 
7766 static void
7767 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
7768 {
7769 	ip6_asp_t *table;
7770 	size_t table_size;
7771 	mblk_t *data_mp;
7772 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7773 	ip_stack_t	*ipst;
7774 
7775 	if (q->q_next == NULL)
7776 		ipst = CONNQ_TO_IPST(q);
7777 	else
7778 		ipst = ILLQ_TO_IPST(q);
7779 
7780 	/* These two ioctls are I_STR only */
7781 	if (iocp->ioc_count == TRANSPARENT) {
7782 		miocnak(q, mp, 0, EINVAL);
7783 		return;
7784 	}
7785 
7786 	data_mp = mp->b_cont;
7787 	if (data_mp == NULL) {
7788 		/* The user passed us a NULL argument */
7789 		table = NULL;
7790 		table_size = iocp->ioc_count;
7791 	} else {
7792 		/*
7793 		 * The user provided a table.  The stream head
7794 		 * may have copied in the user data in chunks,
7795 		 * so make sure everything is pulled up
7796 		 * properly.
7797 		 */
7798 		if (MBLKL(data_mp) < iocp->ioc_count) {
7799 			mblk_t *new_data_mp;
7800 			if ((new_data_mp = msgpullup(data_mp, -1)) ==
7801 			    NULL) {
7802 				miocnak(q, mp, 0, ENOMEM);
7803 				return;
7804 			}
7805 			freemsg(data_mp);
7806 			data_mp = new_data_mp;
7807 			mp->b_cont = data_mp;
7808 		}
7809 		table = (ip6_asp_t *)data_mp->b_rptr;
7810 		table_size = iocp->ioc_count;
7811 	}
7812 
7813 	switch (iocp->ioc_cmd) {
7814 	case SIOCGIP6ADDRPOLICY:
7815 		iocp->ioc_rval = ip6_asp_get(table, table_size, ipst);
7816 		if (iocp->ioc_rval == -1)
7817 			iocp->ioc_error = EINVAL;
7818 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7819 		else if (table != NULL &&
7820 		    (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
7821 			ip6_asp_t *src = table;
7822 			ip6_asp32_t *dst = (void *)table;
7823 			int count = table_size / sizeof (ip6_asp_t);
7824 			int i;
7825 
7826 			/*
7827 			 * We need to do an in-place shrink of the array
7828 			 * to match the alignment attributes of the
7829 			 * 32-bit ABI looking at it.
7830 			 */
7831 			/* LINTED: logical expression always true: op "||" */
7832 			ASSERT(sizeof (*src) > sizeof (*dst));
7833 			for (i = 1; i < count; i++)
7834 				bcopy(src + i, dst + i, sizeof (*dst));
7835 		}
7836 #endif
7837 		break;
7838 
7839 	case SIOCSIP6ADDRPOLICY:
7840 		ASSERT(mp->b_prev == NULL);
7841 		mp->b_prev = (void *)q;
7842 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7843 		/*
7844 		 * We pass in the datamodel here so that the ip6_asp_replace()
7845 		 * routine can handle converting from 32-bit to native formats
7846 		 * where necessary.
7847 		 *
7848 		 * A better way to handle this might be to convert the inbound
7849 		 * data structure here, and hang it off a new 'mp'; thus the
7850 		 * ip6_asp_replace() logic would always be dealing with native
7851 		 * format data structures..
7852 		 *
7853 		 * (An even simpler way to handle these ioctls is to just
7854 		 * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
7855 		 * and just recompile everything that depends on it.)
7856 		 */
7857 #endif
7858 		ip6_asp_replace(mp, table, table_size, B_FALSE, ipst,
7859 		    iocp->ioc_flag & IOC_MODELS);
7860 		return;
7861 	}
7862 
7863 	DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
7864 	qreply(q, mp);
7865 }
7866 
7867 static void
7868 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
7869 {
7870 	mblk_t		*data_mp;
7871 	struct dstinforeq	*dir;
7872 	uint8_t		*end, *cur;
7873 	in6_addr_t	*daddr, *saddr;
7874 	ipaddr_t	v4daddr;
7875 	ire_t		*ire;
7876 	ipaddr_t	v4setsrc;
7877 	in6_addr_t	v6setsrc;
7878 	char		*slabel, *dlabel;
7879 	boolean_t	isipv4;
7880 	int		match_ire;
7881 	ill_t		*dst_ill;
7882 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7883 	conn_t		*connp = Q_TO_CONN(q);
7884 	zoneid_t	zoneid = IPCL_ZONEID(connp);
7885 	ip_stack_t	*ipst = connp->conn_netstack->netstack_ip;
7886 	uint64_t	ipif_flags;
7887 
7888 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
7889 
7890 	/*
7891 	 * This ioctl is I_STR only, and must have a
7892 	 * data mblk following the M_IOCTL mblk.
7893 	 */
7894 	data_mp = mp->b_cont;
7895 	if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
7896 		miocnak(q, mp, 0, EINVAL);
7897 		return;
7898 	}
7899 
7900 	if (MBLKL(data_mp) < iocp->ioc_count) {
7901 		mblk_t *new_data_mp;
7902 
7903 		if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
7904 			miocnak(q, mp, 0, ENOMEM);
7905 			return;
7906 		}
7907 		freemsg(data_mp);
7908 		data_mp = new_data_mp;
7909 		mp->b_cont = data_mp;
7910 	}
7911 	match_ire = MATCH_IRE_DSTONLY;
7912 
7913 	for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
7914 	    end - cur >= sizeof (struct dstinforeq);
7915 	    cur += sizeof (struct dstinforeq)) {
7916 		dir = (struct dstinforeq *)cur;
7917 		daddr = &dir->dir_daddr;
7918 		saddr = &dir->dir_saddr;
7919 
7920 		/*
7921 		 * ip_addr_scope_v6() and ip6_asp_lookup() handle
7922 		 * v4 mapped addresses; ire_ftable_lookup_v6()
7923 		 * and ip_select_source_v6() do not.
7924 		 */
7925 		dir->dir_dscope = ip_addr_scope_v6(daddr);
7926 		dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence, ipst);
7927 
7928 		isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
7929 		if (isipv4) {
7930 			IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
7931 			v4setsrc = INADDR_ANY;
7932 			ire = ire_route_recursive_v4(v4daddr, 0, NULL, zoneid,
7933 			    NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v4setsrc,
7934 			    NULL, NULL);
7935 		} else {
7936 			v6setsrc = ipv6_all_zeros;
7937 			ire = ire_route_recursive_v6(daddr, 0, NULL, zoneid,
7938 			    NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v6setsrc,
7939 			    NULL, NULL);
7940 		}
7941 		ASSERT(ire != NULL);
7942 		if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
7943 			ire_refrele(ire);
7944 			dir->dir_dreachable = 0;
7945 
7946 			/* move on to next dst addr */
7947 			continue;
7948 		}
7949 		dir->dir_dreachable = 1;
7950 
7951 		dst_ill = ire_nexthop_ill(ire);
7952 		if (dst_ill == NULL) {
7953 			ire_refrele(ire);
7954 			continue;
7955 		}
7956 
7957 		/* With ipmp we most likely look at the ipmp ill here */
7958 		dir->dir_dmactype = dst_ill->ill_mactype;
7959 
7960 		if (isipv4) {
7961 			ipaddr_t v4saddr;
7962 
7963 			if (ip_select_source_v4(dst_ill, v4setsrc, v4daddr,
7964 			    connp->conn_ixa->ixa_multicast_ifaddr, zoneid, ipst,
7965 			    &v4saddr, NULL, &ipif_flags) != 0) {
7966 				v4saddr = INADDR_ANY;
7967 				ipif_flags = 0;
7968 			}
7969 			IN6_IPADDR_TO_V4MAPPED(v4saddr, saddr);
7970 		} else {
7971 			if (ip_select_source_v6(dst_ill, &v6setsrc, daddr,
7972 			    zoneid, ipst, B_FALSE, IPV6_PREFER_SRC_DEFAULT,
7973 			    saddr, NULL, &ipif_flags) != 0) {
7974 				*saddr = ipv6_all_zeros;
7975 				ipif_flags = 0;
7976 			}
7977 		}
7978 
7979 		dir->dir_sscope = ip_addr_scope_v6(saddr);
7980 		slabel = ip6_asp_lookup(saddr, NULL, ipst);
7981 		dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
7982 		dir->dir_sdeprecated = (ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
7983 		ire_refrele(ire);
7984 		ill_refrele(dst_ill);
7985 	}
7986 	miocack(q, mp, iocp->ioc_count, 0);
7987 }
7988 
7989 /*
7990  * Check if this is an address assigned to this machine.
7991  * Skips interfaces that are down by using ire checks.
7992  * Translates mapped addresses to v4 addresses and then
7993  * treats them as such, returning true if the v4 address
7994  * associated with this mapped address is configured.
7995  * Note: Applications will have to be careful what they do
7996  * with the response; use of mapped addresses limits
7997  * what can be done with the socket, especially with
7998  * respect to socket options and ioctls - neither IPv4
7999  * options nor IPv6 sticky options/ancillary data options
8000  * may be used.
8001  */
8002 /* ARGSUSED */
8003 int
8004 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8005     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8006 {
8007 	struct sioc_addrreq *sia;
8008 	sin_t *sin;
8009 	ire_t *ire;
8010 	mblk_t *mp1;
8011 	zoneid_t zoneid;
8012 	ip_stack_t	*ipst;
8013 
8014 	ip1dbg(("ip_sioctl_tmyaddr"));
8015 
8016 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8017 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8018 	ipst = CONNQ_TO_IPST(q);
8019 
8020 	/* Existence verified in ip_wput_nondata */
8021 	mp1 = mp->b_cont->b_cont;
8022 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8023 	sin = (sin_t *)&sia->sa_addr;
8024 	switch (sin->sin_family) {
8025 	case AF_INET6: {
8026 		sin6_t *sin6 = (sin6_t *)sin;
8027 
8028 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8029 			ipaddr_t v4_addr;
8030 
8031 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8032 			    v4_addr);
8033 			ire = ire_ftable_lookup_v4(v4_addr, 0, 0,
8034 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8035 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8036 		} else {
8037 			in6_addr_t v6addr;
8038 
8039 			v6addr = sin6->sin6_addr;
8040 			ire = ire_ftable_lookup_v6(&v6addr, 0, 0,
8041 			    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8042 			    MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8043 		}
8044 		break;
8045 	}
8046 	case AF_INET: {
8047 		ipaddr_t v4addr;
8048 
8049 		v4addr = sin->sin_addr.s_addr;
8050 		ire = ire_ftable_lookup_v4(v4addr, 0, 0,
8051 		    IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8052 		    NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8053 		break;
8054 	}
8055 	default:
8056 		return (EAFNOSUPPORT);
8057 	}
8058 	if (ire != NULL) {
8059 		sia->sa_res = 1;
8060 		ire_refrele(ire);
8061 	} else {
8062 		sia->sa_res = 0;
8063 	}
8064 	return (0);
8065 }
8066 
8067 /*
8068  * Check if this is an address assigned on-link i.e. neighbor,
8069  * and makes sure it's reachable from the current zone.
8070  * Returns true for my addresses as well.
8071  * Translates mapped addresses to v4 addresses and then
8072  * treats them as such, returning true if the v4 address
8073  * associated with this mapped address is configured.
8074  * Note: Applications will have to be careful what they do
8075  * with the response; use of mapped addresses limits
8076  * what can be done with the socket, especially with
8077  * respect to socket options and ioctls - neither IPv4
8078  * options nor IPv6 sticky options/ancillary data options
8079  * may be used.
8080  */
8081 /* ARGSUSED */
8082 int
8083 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8084     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
8085 {
8086 	struct sioc_addrreq *sia;
8087 	sin_t *sin;
8088 	mblk_t	*mp1;
8089 	ire_t *ire = NULL;
8090 	zoneid_t zoneid;
8091 	ip_stack_t	*ipst;
8092 
8093 	ip1dbg(("ip_sioctl_tonlink"));
8094 
8095 	ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8096 	zoneid = Q_TO_CONN(q)->conn_zoneid;
8097 	ipst = CONNQ_TO_IPST(q);
8098 
8099 	/* Existence verified in ip_wput_nondata */
8100 	mp1 = mp->b_cont->b_cont;
8101 	sia = (struct sioc_addrreq *)mp1->b_rptr;
8102 	sin = (sin_t *)&sia->sa_addr;
8103 
8104 	/*
8105 	 * We check for IRE_ONLINK and exclude IRE_BROADCAST|IRE_MULTICAST
8106 	 * to make sure we only look at on-link unicast address.
8107 	 */
8108 	switch (sin->sin_family) {
8109 	case AF_INET6: {
8110 		sin6_t *sin6 = (sin6_t *)sin;
8111 
8112 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8113 			ipaddr_t v4_addr;
8114 
8115 			IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8116 			    v4_addr);
8117 			if (!CLASSD(v4_addr)) {
8118 				ire = ire_ftable_lookup_v4(v4_addr, 0, 0, 0,
8119 				    NULL, zoneid, NULL, MATCH_IRE_DSTONLY,
8120 				    0, ipst, NULL);
8121 			}
8122 		} else {
8123 			in6_addr_t v6addr;
8124 
8125 			v6addr = sin6->sin6_addr;
8126 			if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
8127 				ire = ire_ftable_lookup_v6(&v6addr, 0, 0, 0,
8128 				    NULL, zoneid, NULL, MATCH_IRE_DSTONLY, 0,
8129 				    ipst, NULL);
8130 			}
8131 		}
8132 		break;
8133 	}
8134 	case AF_INET: {
8135 		ipaddr_t v4addr;
8136 
8137 		v4addr = sin->sin_addr.s_addr;
8138 		if (!CLASSD(v4addr)) {
8139 			ire = ire_ftable_lookup_v4(v4addr, 0, 0, 0, NULL,
8140 			    zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
8141 		}
8142 		break;
8143 	}
8144 	default:
8145 		return (EAFNOSUPPORT);
8146 	}
8147 	sia->sa_res = 0;
8148 	if (ire != NULL) {
8149 		ASSERT(!(ire->ire_type & IRE_MULTICAST));
8150 
8151 		if ((ire->ire_type & IRE_ONLINK) &&
8152 		    !(ire->ire_type & IRE_BROADCAST))
8153 			sia->sa_res = 1;
8154 		ire_refrele(ire);
8155 	}
8156 	return (0);
8157 }
8158 
8159 /*
8160  * TBD: implement when kernel maintaines a list of site prefixes.
8161  */
8162 /* ARGSUSED */
8163 int
8164 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8165     ip_ioctl_cmd_t *ipip, void *ifreq)
8166 {
8167 	return (ENXIO);
8168 }
8169 
8170 /* ARP IOCTLs. */
8171 /* ARGSUSED */
8172 int
8173 ip_sioctl_arp(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8174     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8175 {
8176 	int		err;
8177 	ipaddr_t	ipaddr;
8178 	struct iocblk	*iocp;
8179 	conn_t		*connp;
8180 	struct arpreq	*ar;
8181 	struct xarpreq	*xar;
8182 	int		arp_flags, flags, alength;
8183 	uchar_t		*lladdr;
8184 	ip_stack_t	*ipst;
8185 	ill_t		*ill = ipif->ipif_ill;
8186 	ill_t		*proxy_ill = NULL;
8187 	ipmp_arpent_t	*entp = NULL;
8188 	boolean_t	proxyarp = B_FALSE;
8189 	boolean_t	if_arp_ioctl = B_FALSE;
8190 	ncec_t		*ncec = NULL;
8191 	nce_t		*nce;
8192 
8193 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8194 	connp = Q_TO_CONN(q);
8195 	ipst = connp->conn_netstack->netstack_ip;
8196 	iocp = (struct iocblk *)mp->b_rptr;
8197 
8198 	if (ipip->ipi_cmd_type == XARP_CMD) {
8199 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
8200 		xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
8201 		ar = NULL;
8202 
8203 		arp_flags = xar->xarp_flags;
8204 		lladdr = (uchar_t *)LLADDR(&xar->xarp_ha);
8205 		if_arp_ioctl = (xar->xarp_ha.sdl_nlen != 0);
8206 		/*
8207 		 * Validate against user's link layer address length
8208 		 * input and name and addr length limits.
8209 		 */
8210 		alength = ill->ill_phys_addr_length;
8211 		if (ipip->ipi_cmd == SIOCSXARP) {
8212 			if (alength != xar->xarp_ha.sdl_alen ||
8213 			    (alength + xar->xarp_ha.sdl_nlen >
8214 			    sizeof (xar->xarp_ha.sdl_data)))
8215 				return (EINVAL);
8216 		}
8217 	} else {
8218 		/* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
8219 		ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
8220 		xar = NULL;
8221 
8222 		arp_flags = ar->arp_flags;
8223 		lladdr = (uchar_t *)ar->arp_ha.sa_data;
8224 		/*
8225 		 * Theoretically, the sa_family could tell us what link
8226 		 * layer type this operation is trying to deal with. By
8227 		 * common usage AF_UNSPEC means ethernet. We'll assume
8228 		 * any attempt to use the SIOC?ARP ioctls is for ethernet,
8229 		 * for now. Our new SIOC*XARP ioctls can be used more
8230 		 * generally.
8231 		 *
8232 		 * If the underlying media happens to have a non 6 byte
8233 		 * address, arp module will fail set/get, but the del
8234 		 * operation will succeed.
8235 		 */
8236 		alength = 6;
8237 		if ((ipip->ipi_cmd != SIOCDARP) &&
8238 		    (alength != ill->ill_phys_addr_length)) {
8239 			return (EINVAL);
8240 		}
8241 	}
8242 
8243 	/* Translate ATF* flags to NCE* flags */
8244 	flags = 0;
8245 	if (arp_flags & ATF_AUTHORITY)
8246 		flags |= NCE_F_AUTHORITY;
8247 	if (arp_flags & ATF_PERM)
8248 		flags |= NCE_F_NONUD; /* not subject to aging */
8249 	if (arp_flags & ATF_PUBL)
8250 		flags |= NCE_F_PUBLISH;
8251 
8252 	/*
8253 	 * IPMP ARP special handling:
8254 	 *
8255 	 * 1. Since ARP mappings must appear consistent across the group,
8256 	 *    prohibit changing ARP mappings on the underlying interfaces.
8257 	 *
8258 	 * 2. Since ARP mappings for IPMP data addresses are maintained by
8259 	 *    IP itself, prohibit changing them.
8260 	 *
8261 	 * 3. For proxy ARP, use a functioning hardware address in the group,
8262 	 *    provided one exists.  If one doesn't, just add the entry as-is;
8263 	 *    ipmp_illgrp_refresh_arpent() will refresh it if things change.
8264 	 */
8265 	if (IS_UNDER_IPMP(ill)) {
8266 		if (ipip->ipi_cmd != SIOCGARP && ipip->ipi_cmd != SIOCGXARP)
8267 			return (EPERM);
8268 	}
8269 	if (IS_IPMP(ill)) {
8270 		ipmp_illgrp_t *illg = ill->ill_grp;
8271 
8272 		switch (ipip->ipi_cmd) {
8273 		case SIOCSARP:
8274 		case SIOCSXARP:
8275 			proxy_ill = ipmp_illgrp_find_ill(illg, lladdr, alength);
8276 			if (proxy_ill != NULL) {
8277 				proxyarp = B_TRUE;
8278 				if (!ipmp_ill_is_active(proxy_ill))
8279 					proxy_ill = ipmp_illgrp_next_ill(illg);
8280 				if (proxy_ill != NULL)
8281 					lladdr = proxy_ill->ill_phys_addr;
8282 			}
8283 			/* FALLTHRU */
8284 		}
8285 	}
8286 
8287 	ipaddr = sin->sin_addr.s_addr;
8288 	/*
8289 	 * don't match across illgrp per case (1) and (2).
8290 	 * XXX use IS_IPMP(ill) like ndp_sioc_update?
8291 	 */
8292 	nce = nce_lookup_v4(ill, &ipaddr);
8293 	if (nce != NULL)
8294 		ncec = nce->nce_common;
8295 
8296 	switch (iocp->ioc_cmd) {
8297 	case SIOCDARP:
8298 	case SIOCDXARP: {
8299 		/*
8300 		 * Delete the NCE if any.
8301 		 */
8302 		if (ncec == NULL) {
8303 			iocp->ioc_error = ENXIO;
8304 			break;
8305 		}
8306 		/* Don't allow changes to arp mappings of local addresses. */
8307 		if (NCE_MYADDR(ncec)) {
8308 			nce_refrele(nce);
8309 			return (ENOTSUP);
8310 		}
8311 		iocp->ioc_error = 0;
8312 
8313 		/*
8314 		 * Delete the nce_common which has ncec_ill set to ipmp_ill.
8315 		 * This will delete all the nce entries on the under_ills.
8316 		 */
8317 		ncec_delete(ncec);
8318 		/*
8319 		 * Once the NCE has been deleted, then the ire_dep* consistency
8320 		 * mechanism will find any IRE which depended on the now
8321 		 * condemned NCE (as part of sending packets).
8322 		 * That mechanism handles redirects by deleting redirects
8323 		 * that refer to UNREACHABLE nces.
8324 		 */
8325 		break;
8326 	}
8327 	case SIOCGARP:
8328 	case SIOCGXARP:
8329 		if (ncec != NULL) {
8330 			lladdr = ncec->ncec_lladdr;
8331 			flags = ncec->ncec_flags;
8332 			iocp->ioc_error = 0;
8333 			ip_sioctl_garp_reply(mp, ncec->ncec_ill, lladdr, flags);
8334 		} else {
8335 			iocp->ioc_error = ENXIO;
8336 		}
8337 		break;
8338 	case SIOCSARP:
8339 	case SIOCSXARP:
8340 		/* Don't allow changes to arp mappings of local addresses. */
8341 		if (ncec != NULL && NCE_MYADDR(ncec)) {
8342 			nce_refrele(nce);
8343 			return (ENOTSUP);
8344 		}
8345 
8346 		/* static arp entries will undergo NUD if ATF_PERM is not set */
8347 		flags |= NCE_F_STATIC;
8348 		if (!if_arp_ioctl) {
8349 			ip_nce_lookup_and_update(&ipaddr, NULL, ipst,
8350 			    lladdr, alength, flags);
8351 		} else {
8352 			ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
8353 			if (ipif != NULL) {
8354 				ip_nce_lookup_and_update(&ipaddr, ipif, ipst,
8355 				    lladdr, alength, flags);
8356 				ipif_refrele(ipif);
8357 			}
8358 		}
8359 		if (nce != NULL) {
8360 			nce_refrele(nce);
8361 			nce = NULL;
8362 		}
8363 		/*
8364 		 * NCE_F_STATIC entries will be added in state ND_REACHABLE
8365 		 * by nce_add_common()
8366 		 */
8367 		err = nce_lookup_then_add_v4(ill, lladdr,
8368 		    ill->ill_phys_addr_length, &ipaddr, flags, ND_UNCHANGED,
8369 		    &nce);
8370 		if (err == EEXIST) {
8371 			ncec = nce->nce_common;
8372 			mutex_enter(&ncec->ncec_lock);
8373 			ncec->ncec_state = ND_REACHABLE;
8374 			ncec->ncec_flags = flags;
8375 			nce_update(ncec, ND_UNCHANGED, lladdr);
8376 			mutex_exit(&ncec->ncec_lock);
8377 			err = 0;
8378 		}
8379 		if (nce != NULL) {
8380 			nce_refrele(nce);
8381 			nce = NULL;
8382 		}
8383 		if (IS_IPMP(ill) && err == 0) {
8384 			entp = ipmp_illgrp_create_arpent(ill->ill_grp,
8385 			    proxyarp, ipaddr, lladdr, ill->ill_phys_addr_length,
8386 			    flags);
8387 			if (entp == NULL || (proxyarp && proxy_ill == NULL)) {
8388 				iocp->ioc_error = (entp == NULL ? ENOMEM : 0);
8389 				break;
8390 			}
8391 		}
8392 		iocp->ioc_error = err;
8393 	}
8394 
8395 	if (nce != NULL) {
8396 		nce_refrele(nce);
8397 	}
8398 
8399 	/*
8400 	 * If we created an IPMP ARP entry, mark that we've notified ARP.
8401 	 */
8402 	if (entp != NULL)
8403 		ipmp_illgrp_mark_arpent(ill->ill_grp, entp);
8404 
8405 	return (iocp->ioc_error);
8406 }
8407 
8408 /*
8409  * Parse an [x]arpreq structure coming down SIOC[GSD][X]ARP ioctls, identify
8410  * the associated sin and refhold and return the associated ipif via `ci'.
8411  */
8412 int
8413 ip_extract_arpreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8414     cmd_info_t *ci)
8415 {
8416 	mblk_t	*mp1;
8417 	sin_t	*sin;
8418 	conn_t	*connp;
8419 	ipif_t	*ipif;
8420 	ire_t	*ire = NULL;
8421 	ill_t	*ill = NULL;
8422 	boolean_t exists;
8423 	ip_stack_t *ipst;
8424 	struct arpreq *ar;
8425 	struct xarpreq *xar;
8426 	struct sockaddr_dl *sdl;
8427 
8428 	/* ioctl comes down on a conn */
8429 	ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8430 	connp = Q_TO_CONN(q);
8431 	if (connp->conn_family == AF_INET6)
8432 		return (ENXIO);
8433 
8434 	ipst = connp->conn_netstack->netstack_ip;
8435 
8436 	/* Verified in ip_wput_nondata */
8437 	mp1 = mp->b_cont->b_cont;
8438 
8439 	if (ipip->ipi_cmd_type == XARP_CMD) {
8440 		ASSERT(MBLKL(mp1) >= sizeof (struct xarpreq));
8441 		xar = (struct xarpreq *)mp1->b_rptr;
8442 		sin = (sin_t *)&xar->xarp_pa;
8443 		sdl = &xar->xarp_ha;
8444 
8445 		if (sdl->sdl_family != AF_LINK || sin->sin_family != AF_INET)
8446 			return (ENXIO);
8447 		if (sdl->sdl_nlen >= LIFNAMSIZ)
8448 			return (EINVAL);
8449 	} else {
8450 		ASSERT(ipip->ipi_cmd_type == ARP_CMD);
8451 		ASSERT(MBLKL(mp1) >= sizeof (struct arpreq));
8452 		ar = (struct arpreq *)mp1->b_rptr;
8453 		sin = (sin_t *)&ar->arp_pa;
8454 	}
8455 
8456 	if (ipip->ipi_cmd_type == XARP_CMD && sdl->sdl_nlen != 0) {
8457 		ipif = ipif_lookup_on_name(sdl->sdl_data, sdl->sdl_nlen,
8458 		    B_FALSE, &exists, B_FALSE, ALL_ZONES, ipst);
8459 		if (ipif == NULL)
8460 			return (ENXIO);
8461 		if (ipif->ipif_id != 0) {
8462 			ipif_refrele(ipif);
8463 			return (ENXIO);
8464 		}
8465 	} else {
8466 		/*
8467 		 * Either an SIOC[DGS]ARP or an SIOC[DGS]XARP with an sdl_nlen
8468 		 * of 0: use the IP address to find the ipif.  If the IP
8469 		 * address is an IPMP test address, ire_ftable_lookup() will
8470 		 * find the wrong ill, so we first do an ipif_lookup_addr().
8471 		 */
8472 		ipif = ipif_lookup_addr(sin->sin_addr.s_addr, NULL, ALL_ZONES,
8473 		    ipst);
8474 		if (ipif == NULL) {
8475 			ire = ire_ftable_lookup_v4(sin->sin_addr.s_addr,
8476 			    0, 0, IRE_IF_RESOLVER, NULL, ALL_ZONES,
8477 			    NULL, MATCH_IRE_TYPE, 0, ipst, NULL);
8478 			if (ire == NULL || ((ill = ire->ire_ill) == NULL)) {
8479 				if (ire != NULL)
8480 					ire_refrele(ire);
8481 				return (ENXIO);
8482 			}
8483 			ASSERT(ire != NULL && ill != NULL);
8484 			ipif = ill->ill_ipif;
8485 			ipif_refhold(ipif);
8486 			ire_refrele(ire);
8487 		}
8488 	}
8489 
8490 	if (ipif->ipif_ill->ill_net_type != IRE_IF_RESOLVER) {
8491 		ipif_refrele(ipif);
8492 		return (ENXIO);
8493 	}
8494 
8495 	ci->ci_sin = sin;
8496 	ci->ci_ipif = ipif;
8497 	return (0);
8498 }
8499 
8500 /*
8501  * Link or unlink the illgrp on IPMP meta-interface `ill' depending on the
8502  * value of `ioccmd'.  While an illgrp is linked to an ipmp_grp_t, it is
8503  * accessible from that ipmp_grp_t, which means SIOCSLIFGROUPNAME can look it
8504  * up and thus an ill can join that illgrp.
8505  *
8506  * We use I_PLINK/I_PUNLINK to do the link/unlink operations rather than
8507  * open()/close() primarily because close() is not allowed to fail or block
8508  * forever.  On the other hand, I_PUNLINK *can* fail, and there's no reason
8509  * why anyone should ever need to I_PUNLINK an in-use IPMP stream.  To ensure
8510  * symmetric behavior (e.g., doing an I_PLINK after and I_PUNLINK undoes the
8511  * I_PUNLINK) we defer linking to I_PLINK.  Separately, we also fail attempts
8512  * to I_LINK since I_UNLINK is optional and we'd end up in an inconsistent
8513  * state if I_UNLINK didn't occur.
8514  *
8515  * Note that for each plumb/unplumb operation, we may end up here more than
8516  * once because of the way ifconfig works.  However, it's OK to link the same
8517  * illgrp more than once, or unlink an illgrp that's already unlinked.
8518  */
8519 static int
8520 ip_sioctl_plink_ipmp(ill_t *ill, int ioccmd)
8521 {
8522 	int err;
8523 	ip_stack_t *ipst = ill->ill_ipst;
8524 
8525 	ASSERT(IS_IPMP(ill));
8526 	ASSERT(IAM_WRITER_ILL(ill));
8527 
8528 	switch (ioccmd) {
8529 	case I_LINK:
8530 		return (ENOTSUP);
8531 
8532 	case I_PLINK:
8533 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8534 		ipmp_illgrp_link_grp(ill->ill_grp, ill->ill_phyint->phyint_grp);
8535 		rw_exit(&ipst->ips_ipmp_lock);
8536 		break;
8537 
8538 	case I_PUNLINK:
8539 		/*
8540 		 * Require all UP ipifs be brought down prior to unlinking the
8541 		 * illgrp so any associated IREs (and other state) is torched.
8542 		 */
8543 		if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0)
8544 			return (EBUSY);
8545 
8546 		/*
8547 		 * NOTE: We hold ipmp_lock across the unlink to prevent a race
8548 		 * with an SIOCSLIFGROUPNAME request from an ill trying to
8549 		 * join this group.  Specifically: ills trying to join grab
8550 		 * ipmp_lock and bump a "pending join" counter checked by
8551 		 * ipmp_illgrp_unlink_grp().  During the unlink no new pending
8552 		 * joins can occur (since we have ipmp_lock).  Once we drop
8553 		 * ipmp_lock, subsequent SIOCSLIFGROUPNAME requests will not
8554 		 * find the illgrp (since we unlinked it) and will return
8555 		 * EAFNOSUPPORT.  This will then take them back through the
8556 		 * IPMP meta-interface plumbing logic in ifconfig, and thus
8557 		 * back through I_PLINK above.
8558 		 */
8559 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8560 		err = ipmp_illgrp_unlink_grp(ill->ill_grp);
8561 		rw_exit(&ipst->ips_ipmp_lock);
8562 		return (err);
8563 	default:
8564 		break;
8565 	}
8566 	return (0);
8567 }
8568 
8569 /*
8570  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
8571  * atomically set/clear the muxids. Also complete the ioctl by acking or
8572  * naking it.  Note that the code is structured such that the link type,
8573  * whether it's persistent or not, is treated equally.  ifconfig(8) and
8574  * its clones use the persistent link, while pppd(8) and perhaps many
8575  * other daemons may use non-persistent link.  When combined with some
8576  * ill_t states, linking and unlinking lower streams may be used as
8577  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
8578  */
8579 /* ARGSUSED */
8580 void
8581 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8582 {
8583 	mblk_t		*mp1;
8584 	struct linkblk	*li;
8585 	int		ioccmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
8586 	int		err = 0;
8587 
8588 	ASSERT(ioccmd == I_PLINK || ioccmd == I_PUNLINK ||
8589 	    ioccmd == I_LINK || ioccmd == I_UNLINK);
8590 
8591 	mp1 = mp->b_cont;	/* This is the linkblk info */
8592 	li = (struct linkblk *)mp1->b_rptr;
8593 
8594 	err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li);
8595 	if (err == EINPROGRESS)
8596 		return;
8597 	if (err == 0)
8598 		miocack(q, mp, 0, 0);
8599 	else
8600 		miocnak(q, mp, 0, err);
8601 
8602 	/* Conn was refheld in ip_sioctl_copyin_setup */
8603 	if (CONN_Q(q)) {
8604 		CONN_DEC_IOCTLREF(Q_TO_CONN(q));
8605 		CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
8606 	}
8607 }
8608 
8609 /*
8610  * Process I_{P}LINK and I_{P}UNLINK requests named by `ioccmd' and pointed to
8611  * by `mp' and `li' for the IP module stream (if li->q_bot is in fact an IP
8612  * module stream).
8613  * Returns zero on success, EINPROGRESS if the operation is still pending, or
8614  * an error code on failure.
8615  */
8616 static int
8617 ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp, int ioccmd,
8618     struct linkblk *li)
8619 {
8620 	int		err = 0;
8621 	ill_t		*ill;
8622 	queue_t		*ipwq, *dwq;
8623 	const char	*name;
8624 	struct qinit	*qinfo;
8625 	boolean_t	islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
8626 	boolean_t	entered_ipsq = B_FALSE;
8627 	boolean_t	is_ip = B_FALSE;
8628 	arl_t		*arl;
8629 
8630 	/*
8631 	 * Walk the lower stream to verify it's the IP module stream.
8632 	 * The IP module is identified by its name, wput function,
8633 	 * and non-NULL q_next.  STREAMS ensures that the lower stream
8634 	 * (li->l_qbot) will not vanish until this ioctl completes.
8635 	 */
8636 	for (ipwq = li->l_qbot; ipwq != NULL; ipwq = ipwq->q_next) {
8637 		qinfo = ipwq->q_qinfo;
8638 		name = qinfo->qi_minfo->mi_idname;
8639 		if (name != NULL && strcmp(name, ip_mod_info.mi_idname) == 0 &&
8640 		    qinfo->qi_putp != ip_lwput && ipwq->q_next != NULL) {
8641 			is_ip = B_TRUE;
8642 			break;
8643 		}
8644 		if (name != NULL && strcmp(name, arp_mod_info.mi_idname) == 0 &&
8645 		    qinfo->qi_putp != ip_lwput && ipwq->q_next != NULL) {
8646 			break;
8647 		}
8648 	}
8649 
8650 	/*
8651 	 * If this isn't an IP module stream, bail.
8652 	 */
8653 	if (ipwq == NULL)
8654 		return (0);
8655 
8656 	if (!is_ip) {
8657 		arl = (arl_t *)ipwq->q_ptr;
8658 		ill = arl_to_ill(arl);
8659 		if (ill == NULL)
8660 			return (0);
8661 	} else {
8662 		ill = ipwq->q_ptr;
8663 	}
8664 	ASSERT(ill != NULL);
8665 
8666 	if (ipsq == NULL) {
8667 		ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
8668 		    NEW_OP, B_FALSE);
8669 		if (ipsq == NULL) {
8670 			if (!is_ip)
8671 				ill_refrele(ill);
8672 			return (EINPROGRESS);
8673 		}
8674 		entered_ipsq = B_TRUE;
8675 	}
8676 	ASSERT(IAM_WRITER_ILL(ill));
8677 	mutex_enter(&ill->ill_lock);
8678 	if (!is_ip) {
8679 		if (islink && ill->ill_muxid == 0) {
8680 			/*
8681 			 * Plumbing has to be done with IP plumbed first, arp
8682 			 * second, but here we have arp being plumbed first.
8683 			 */
8684 			mutex_exit(&ill->ill_lock);
8685 			if (entered_ipsq)
8686 				ipsq_exit(ipsq);
8687 			ill_refrele(ill);
8688 			return (EINVAL);
8689 		}
8690 	}
8691 	mutex_exit(&ill->ill_lock);
8692 	if (!is_ip) {
8693 		arl->arl_muxid = islink ? li->l_index : 0;
8694 		ill_refrele(ill);
8695 		goto done;
8696 	}
8697 
8698 	if (IS_IPMP(ill) && (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
8699 		goto done;
8700 
8701 	/*
8702 	 * As part of I_{P}LINKing, stash the number of downstream modules and
8703 	 * the read queue of the module immediately below IP in the ill.
8704 	 * These are used during the capability negotiation below.
8705 	 */
8706 	ill->ill_lmod_rq = NULL;
8707 	ill->ill_lmod_cnt = 0;
8708 	if (islink && ((dwq = ipwq->q_next) != NULL)) {
8709 		ill->ill_lmod_rq = RD(dwq);
8710 		for (; dwq != NULL; dwq = dwq->q_next)
8711 			ill->ill_lmod_cnt++;
8712 	}
8713 
8714 	ill->ill_muxid = islink ? li->l_index : 0;
8715 
8716 	/*
8717 	 * Mark the ipsq busy until the capability operations initiated below
8718 	 * complete. The PLINK/UNLINK ioctl itself completes when our caller
8719 	 * returns, but the capability operation may complete asynchronously
8720 	 * much later.
8721 	 */
8722 	ipsq_current_start(ipsq, ill->ill_ipif, ioccmd);
8723 	/*
8724 	 * If there's at least one up ipif on this ill, then we're bound to
8725 	 * the underlying driver via DLPI.  In that case, renegotiate
8726 	 * capabilities to account for any possible change in modules
8727 	 * interposed between IP and the driver.
8728 	 */
8729 	if (ill->ill_ipif_up_count > 0) {
8730 		if (islink)
8731 			ill_capability_probe(ill);
8732 		else
8733 			ill_capability_reset(ill, B_FALSE);
8734 	}
8735 	ipsq_current_finish(ipsq);
8736 done:
8737 	if (entered_ipsq)
8738 		ipsq_exit(ipsq);
8739 
8740 	return (err);
8741 }
8742 
8743 /*
8744  * Search the ioctl command in the ioctl tables and return a pointer
8745  * to the ioctl command information. The ioctl command tables are
8746  * static and fully populated at compile time.
8747  */
8748 ip_ioctl_cmd_t *
8749 ip_sioctl_lookup(int ioc_cmd)
8750 {
8751 	int index;
8752 	ip_ioctl_cmd_t *ipip;
8753 	ip_ioctl_cmd_t *ipip_end;
8754 
8755 	if (ioc_cmd == IPI_DONTCARE)
8756 		return (NULL);
8757 
8758 	/*
8759 	 * Do a 2 step search. First search the indexed table
8760 	 * based on the least significant byte of the ioctl cmd.
8761 	 * If we don't find a match, then search the misc table
8762 	 * serially.
8763 	 */
8764 	index = ioc_cmd & 0xFF;
8765 	if (index < ip_ndx_ioctl_count) {
8766 		ipip = &ip_ndx_ioctl_table[index];
8767 		if (ipip->ipi_cmd == ioc_cmd) {
8768 			/* Found a match in the ndx table */
8769 			return (ipip);
8770 		}
8771 	}
8772 
8773 	/* Search the misc table */
8774 	ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
8775 	for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
8776 		if (ipip->ipi_cmd == ioc_cmd)
8777 			/* Found a match in the misc table */
8778 			return (ipip);
8779 	}
8780 
8781 	return (NULL);
8782 }
8783 
8784 /*
8785  * helper function for ip_sioctl_getsetprop(), which does some sanity checks
8786  */
8787 static boolean_t
8788 getset_ioctl_checks(mblk_t *mp)
8789 {
8790 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8791 	mblk_t		*mp1 = mp->b_cont;
8792 	mod_ioc_prop_t	*pioc;
8793 	uint_t		flags;
8794 	uint_t		pioc_size;
8795 
8796 	/* do sanity checks on various arguments */
8797 	if (mp1 == NULL || iocp->ioc_count == 0 ||
8798 	    iocp->ioc_count == TRANSPARENT) {
8799 		return (B_FALSE);
8800 	}
8801 	if (msgdsize(mp1) < iocp->ioc_count) {
8802 		if (!pullupmsg(mp1, iocp->ioc_count))
8803 			return (B_FALSE);
8804 	}
8805 
8806 	pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8807 
8808 	/* sanity checks on mpr_valsize */
8809 	pioc_size = sizeof (mod_ioc_prop_t);
8810 	if (pioc->mpr_valsize != 0)
8811 		pioc_size += pioc->mpr_valsize - 1;
8812 
8813 	if (iocp->ioc_count != pioc_size)
8814 		return (B_FALSE);
8815 
8816 	flags = pioc->mpr_flags;
8817 	if (iocp->ioc_cmd == SIOCSETPROP) {
8818 		/*
8819 		 * One can either reset the value to it's default value or
8820 		 * change the current value or append/remove the value from
8821 		 * a multi-valued properties.
8822 		 */
8823 		if ((flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8824 		    flags != MOD_PROP_ACTIVE &&
8825 		    flags != (MOD_PROP_ACTIVE|MOD_PROP_APPEND) &&
8826 		    flags != (MOD_PROP_ACTIVE|MOD_PROP_REMOVE))
8827 			return (B_FALSE);
8828 	} else {
8829 		ASSERT(iocp->ioc_cmd == SIOCGETPROP);
8830 
8831 		/*
8832 		 * One can retrieve only one kind of property information
8833 		 * at a time.
8834 		 */
8835 		if ((flags & MOD_PROP_ACTIVE) != MOD_PROP_ACTIVE &&
8836 		    (flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8837 		    (flags & MOD_PROP_POSSIBLE) != MOD_PROP_POSSIBLE &&
8838 		    (flags & MOD_PROP_PERM) != MOD_PROP_PERM)
8839 			return (B_FALSE);
8840 	}
8841 
8842 	return (B_TRUE);
8843 }
8844 
8845 /*
8846  * process the SIOC{SET|GET}PROP ioctl's
8847  */
8848 /* ARGSUSED */
8849 static void
8850 ip_sioctl_getsetprop(queue_t *q, mblk_t *mp)
8851 {
8852 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8853 	mblk_t		*mp1 = mp->b_cont;
8854 	mod_ioc_prop_t	*pioc;
8855 	mod_prop_info_t *ptbl = NULL, *pinfo = NULL;
8856 	ip_stack_t	*ipst;
8857 	netstack_t	*stack;
8858 	cred_t		*cr;
8859 	boolean_t	set;
8860 	int		err;
8861 
8862 	ASSERT(q->q_next == NULL);
8863 	ASSERT(CONN_Q(q));
8864 
8865 	if (!getset_ioctl_checks(mp)) {
8866 		miocnak(q, mp, 0, EINVAL);
8867 		return;
8868 	}
8869 	ipst = CONNQ_TO_IPST(q);
8870 	stack = ipst->ips_netstack;
8871 	pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8872 
8873 	switch (pioc->mpr_proto) {
8874 	case MOD_PROTO_IP:
8875 	case MOD_PROTO_IPV4:
8876 	case MOD_PROTO_IPV6:
8877 		ptbl = ipst->ips_propinfo_tbl;
8878 		break;
8879 	case MOD_PROTO_RAWIP:
8880 		ptbl = stack->netstack_icmp->is_propinfo_tbl;
8881 		break;
8882 	case MOD_PROTO_TCP:
8883 		ptbl = stack->netstack_tcp->tcps_propinfo_tbl;
8884 		break;
8885 	case MOD_PROTO_UDP:
8886 		ptbl = stack->netstack_udp->us_propinfo_tbl;
8887 		break;
8888 	case MOD_PROTO_SCTP:
8889 		ptbl = stack->netstack_sctp->sctps_propinfo_tbl;
8890 		break;
8891 	default:
8892 		miocnak(q, mp, 0, EINVAL);
8893 		return;
8894 	}
8895 
8896 	pinfo = mod_prop_lookup(ptbl, pioc->mpr_name, pioc->mpr_proto);
8897 	if (pinfo == NULL) {
8898 		miocnak(q, mp, 0, ENOENT);
8899 		return;
8900 	}
8901 
8902 	set = (iocp->ioc_cmd == SIOCSETPROP) ? B_TRUE : B_FALSE;
8903 	if (set && pinfo->mpi_setf != NULL) {
8904 		cr = msg_getcred(mp, NULL);
8905 		if (cr == NULL)
8906 			cr = iocp->ioc_cr;
8907 		err = pinfo->mpi_setf(stack, cr, pinfo, pioc->mpr_ifname,
8908 		    pioc->mpr_val, pioc->mpr_flags);
8909 	} else if (!set && pinfo->mpi_getf != NULL) {
8910 		err = pinfo->mpi_getf(stack, pinfo, pioc->mpr_ifname,
8911 		    pioc->mpr_val, pioc->mpr_valsize, pioc->mpr_flags);
8912 	} else {
8913 		err = EPERM;
8914 	}
8915 
8916 	if (err != 0) {
8917 		miocnak(q, mp, 0, err);
8918 	} else {
8919 		if (set)
8920 			miocack(q, mp, 0, 0);
8921 		else    /* For get, we need to return back the data */
8922 			miocack(q, mp, iocp->ioc_count, 0);
8923 	}
8924 }
8925 
8926 /*
8927  * process the legacy ND_GET, ND_SET ioctl just for {ip|ip6}_forwarding
8928  * as several routing daemons have unfortunately used this 'unpublished'
8929  * but well-known ioctls.
8930  */
8931 /* ARGSUSED */
8932 static void
8933 ip_process_legacy_nddprop(queue_t *q, mblk_t *mp)
8934 {
8935 	struct iocblk	*iocp = (struct iocblk *)mp->b_rptr;
8936 	mblk_t		*mp1 = mp->b_cont;
8937 	char		*pname, *pval, *buf;
8938 	uint_t		bufsize, proto;
8939 	mod_prop_info_t *pinfo = NULL;
8940 	ip_stack_t	*ipst;
8941 	int		err = 0;
8942 
8943 	ASSERT(CONN_Q(q));
8944 	ipst = CONNQ_TO_IPST(q);
8945 
8946 	if (iocp->ioc_count == 0 || mp1 == NULL) {
8947 		miocnak(q, mp, 0, EINVAL);
8948 		return;
8949 	}
8950 
8951 	mp1->b_datap->db_lim[-1] = '\0';	/* Force null termination */
8952 	pval = buf = pname = (char *)mp1->b_rptr;
8953 	bufsize = MBLKL(mp1);
8954 
8955 	if (strcmp(pname, "ip_forwarding") == 0) {
8956 		pname = "forwarding";
8957 		proto = MOD_PROTO_IPV4;
8958 	} else if (strcmp(pname, "ip6_forwarding") == 0) {
8959 		pname = "forwarding";
8960 		proto = MOD_PROTO_IPV6;
8961 	} else {
8962 		miocnak(q, mp, 0, EINVAL);
8963 		return;
8964 	}
8965 
8966 	pinfo = mod_prop_lookup(ipst->ips_propinfo_tbl, pname, proto);
8967 
8968 	switch (iocp->ioc_cmd) {
8969 	case ND_GET:
8970 		if ((err = pinfo->mpi_getf(ipst->ips_netstack, pinfo, NULL, buf,
8971 		    bufsize, 0)) == 0) {
8972 			miocack(q, mp, iocp->ioc_count, 0);
8973 			return;
8974 		}
8975 		break;
8976 	case ND_SET:
8977 		/*
8978 		 * buffer will have property name and value in the following
8979 		 * format,
8980 		 * <property name>'\0'<property value>'\0', extract them;
8981 		 */
8982 		while (*pval++)
8983 			noop;
8984 
8985 		if (!*pval || pval >= (char *)mp1->b_wptr) {
8986 			err = EINVAL;
8987 		} else if ((err = pinfo->mpi_setf(ipst->ips_netstack, NULL,
8988 		    pinfo, NULL, pval, 0)) == 0) {
8989 			miocack(q, mp, 0, 0);
8990 			return;
8991 		}
8992 		break;
8993 	default:
8994 		err = EINVAL;
8995 		break;
8996 	}
8997 	miocnak(q, mp, 0, err);
8998 }
8999 
9000 /*
9001  * Wrapper function for resuming deferred ioctl processing
9002  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9003  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9004  */
9005 /* ARGSUSED */
9006 void
9007 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9008     void *dummy_arg)
9009 {
9010 	ip_sioctl_copyin_setup(q, mp);
9011 }
9012 
9013 /*
9014  * ip_sioctl_copyin_setup is called by ip_wput_nondata with any M_IOCTL message
9015  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9016  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9017  * We establish here the size of the block to be copied in.  mi_copyin
9018  * arranges for this to happen, an processing continues in ip_wput_nondata with
9019  * an M_IOCDATA message.
9020  */
9021 void
9022 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9023 {
9024 	int	copyin_size;
9025 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9026 	ip_ioctl_cmd_t *ipip;
9027 	cred_t *cr;
9028 	ip_stack_t	*ipst;
9029 
9030 	if (CONN_Q(q))
9031 		ipst = CONNQ_TO_IPST(q);
9032 	else
9033 		ipst = ILLQ_TO_IPST(q);
9034 
9035 	ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9036 	if (ipip == NULL) {
9037 		/*
9038 		 * The ioctl is not one we understand or own.
9039 		 * Pass it along to be processed down stream,
9040 		 * if this is a module instance of IP, else nak
9041 		 * the ioctl.
9042 		 */
9043 		if (q->q_next == NULL) {
9044 			goto nak;
9045 		} else {
9046 			putnext(q, mp);
9047 			return;
9048 		}
9049 	}
9050 
9051 	/*
9052 	 * If this is deferred, then we will do all the checks when we
9053 	 * come back.
9054 	 */
9055 	if ((iocp->ioc_cmd == SIOCGDSTINFO ||
9056 	    iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup(ipst)) {
9057 		ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
9058 		return;
9059 	}
9060 
9061 	/*
9062 	 * Only allow a very small subset of IP ioctls on this stream if
9063 	 * IP is a module and not a driver. Allowing ioctls to be processed
9064 	 * in this case may cause assert failures or data corruption.
9065 	 * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
9066 	 * ioctls allowed on an IP module stream, after which this stream
9067 	 * normally becomes a multiplexor (at which time the stream head
9068 	 * will fail all ioctls).
9069 	 */
9070 	if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
9071 		goto nak;
9072 	}
9073 
9074 	/* Make sure we have ioctl data to process. */
9075 	if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
9076 		goto nak;
9077 
9078 	/*
9079 	 * Prefer dblk credential over ioctl credential; some synthesized
9080 	 * ioctls have kcred set because there's no way to crhold()
9081 	 * a credential in some contexts.  (ioc_cr is not crfree() by
9082 	 * the framework; the caller of ioctl needs to hold the reference
9083 	 * for the duration of the call).
9084 	 */
9085 	cr = msg_getcred(mp, NULL);
9086 	if (cr == NULL)
9087 		cr = iocp->ioc_cr;
9088 
9089 	/* Make sure normal users don't send down privileged ioctls */
9090 	if ((ipip->ipi_flags & IPI_PRIV) &&
9091 	    (cr != NULL) && secpolicy_ip_config(cr, B_TRUE) != 0) {
9092 		/* We checked the privilege earlier but log it here */
9093 		miocnak(q, mp, 0, secpolicy_ip_config(cr, B_FALSE));
9094 		return;
9095 	}
9096 
9097 	/*
9098 	 * The ioctl command tables can only encode fixed length
9099 	 * ioctl data. If the length is variable, the table will
9100 	 * encode the length as zero. Such special cases are handled
9101 	 * below in the switch.
9102 	 */
9103 	if (ipip->ipi_copyin_size != 0) {
9104 		mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
9105 		return;
9106 	}
9107 
9108 	switch (iocp->ioc_cmd) {
9109 	case O_SIOCGIFCONF:
9110 	case SIOCGIFCONF:
9111 		/*
9112 		 * This IOCTL is hilarious.  See comments in
9113 		 * ip_sioctl_get_ifconf for the story.
9114 		 */
9115 		if (iocp->ioc_count == TRANSPARENT)
9116 			copyin_size = SIZEOF_STRUCT(ifconf,
9117 			    iocp->ioc_flag);
9118 		else
9119 			copyin_size = iocp->ioc_count;
9120 		mi_copyin(q, mp, NULL, copyin_size);
9121 		return;
9122 
9123 	case O_SIOCGLIFCONF:
9124 	case SIOCGLIFCONF:
9125 		copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
9126 		mi_copyin(q, mp, NULL, copyin_size);
9127 		return;
9128 
9129 	case SIOCGLIFSRCOF:
9130 		copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
9131 		mi_copyin(q, mp, NULL, copyin_size);
9132 		return;
9133 
9134 	case SIOCGIP6ADDRPOLICY:
9135 		ip_sioctl_ip6addrpolicy(q, mp);
9136 		ip6_asp_table_refrele(ipst);
9137 		return;
9138 
9139 	case SIOCSIP6ADDRPOLICY:
9140 		ip_sioctl_ip6addrpolicy(q, mp);
9141 		return;
9142 
9143 	case SIOCGDSTINFO:
9144 		ip_sioctl_dstinfo(q, mp);
9145 		ip6_asp_table_refrele(ipst);
9146 		return;
9147 
9148 	case ND_SET:
9149 	case ND_GET:
9150 		ip_process_legacy_nddprop(q, mp);
9151 		return;
9152 
9153 	case SIOCSETPROP:
9154 	case SIOCGETPROP:
9155 		ip_sioctl_getsetprop(q, mp);
9156 		return;
9157 
9158 	case I_PLINK:
9159 	case I_PUNLINK:
9160 	case I_LINK:
9161 	case I_UNLINK:
9162 		/*
9163 		 * We treat non-persistent link similarly as the persistent
9164 		 * link case, in terms of plumbing/unplumbing, as well as
9165 		 * dynamic re-plumbing events indicator.  See comments
9166 		 * in ip_sioctl_plink() for more.
9167 		 *
9168 		 * Request can be enqueued in the 'ipsq' while waiting
9169 		 * to become exclusive. So bump up the conn ref.
9170 		 */
9171 		if (CONN_Q(q)) {
9172 			CONN_INC_REF(Q_TO_CONN(q));
9173 			CONN_INC_IOCTLREF(Q_TO_CONN(q))
9174 		}
9175 		ip_sioctl_plink(NULL, q, mp, NULL);
9176 		return;
9177 
9178 	case IP_IOCTL:
9179 		ip_wput_ioctl(q, mp);
9180 		return;
9181 
9182 	case SIOCILB:
9183 		/* The ioctl length varies depending on the ILB command. */
9184 		copyin_size = iocp->ioc_count;
9185 		if (copyin_size < sizeof (ilb_cmd_t))
9186 			goto nak;
9187 		mi_copyin(q, mp, NULL, copyin_size);
9188 		return;
9189 
9190 	default:
9191 		cmn_err(CE_WARN, "Unknown ioctl %d/0x%x slipped through.",
9192 		    iocp->ioc_cmd, iocp->ioc_cmd);
9193 		/* FALLTHRU */
9194 	}
9195 nak:
9196 	if (mp->b_cont != NULL) {
9197 		freemsg(mp->b_cont);
9198 		mp->b_cont = NULL;
9199 	}
9200 	iocp->ioc_error = EINVAL;
9201 	mp->b_datap->db_type = M_IOCNAK;
9202 	iocp->ioc_count = 0;
9203 	qreply(q, mp);
9204 }
9205 
9206 static void
9207 ip_sioctl_garp_reply(mblk_t *mp, ill_t *ill, void *hwaddr, int flags)
9208 {
9209 	struct arpreq *ar;
9210 	struct xarpreq *xar;
9211 	mblk_t	*tmp;
9212 	struct iocblk *iocp;
9213 	int x_arp_ioctl = B_FALSE;
9214 	int *flagsp;
9215 	char *storage = NULL;
9216 
9217 	ASSERT(ill != NULL);
9218 
9219 	iocp = (struct iocblk *)mp->b_rptr;
9220 	ASSERT(iocp->ioc_cmd == SIOCGXARP || iocp->ioc_cmd == SIOCGARP);
9221 
9222 	tmp = (mp->b_cont)->b_cont; /* xarpreq/arpreq */
9223 	if ((iocp->ioc_cmd == SIOCGXARP) ||
9224 	    (iocp->ioc_cmd == SIOCSXARP)) {
9225 		x_arp_ioctl = B_TRUE;
9226 		xar = (struct xarpreq *)tmp->b_rptr;
9227 		flagsp = &xar->xarp_flags;
9228 		storage = xar->xarp_ha.sdl_data;
9229 	} else {
9230 		ar = (struct arpreq *)tmp->b_rptr;
9231 		flagsp = &ar->arp_flags;
9232 		storage = ar->arp_ha.sa_data;
9233 	}
9234 
9235 	/*
9236 	 * We're done if this is not an SIOCG{X}ARP
9237 	 */
9238 	if (x_arp_ioctl) {
9239 		storage += ill_xarp_info(&xar->xarp_ha, ill);
9240 		if ((ill->ill_phys_addr_length + ill->ill_name_length) >
9241 		    sizeof (xar->xarp_ha.sdl_data)) {
9242 			iocp->ioc_error = EINVAL;
9243 			return;
9244 		}
9245 	}
9246 	*flagsp = ATF_INUSE;
9247 	/*
9248 	 * If /sbin/arp told us we are the authority using the "permanent"
9249 	 * flag, or if this is one of my addresses print "permanent"
9250 	 * in the /sbin/arp output.
9251 	 */
9252 	if ((flags & NCE_F_MYADDR) || (flags & NCE_F_AUTHORITY))
9253 		*flagsp |= ATF_AUTHORITY;
9254 	if (flags & NCE_F_NONUD)
9255 		*flagsp |= ATF_PERM; /* not subject to aging */
9256 	if (flags & NCE_F_PUBLISH)
9257 		*flagsp |= ATF_PUBL;
9258 	if (hwaddr != NULL) {
9259 		*flagsp |= ATF_COM;
9260 		bcopy((char *)hwaddr, storage, ill->ill_phys_addr_length);
9261 	}
9262 }
9263 
9264 /*
9265  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
9266  * interface) create the next available logical interface for this
9267  * physical interface.
9268  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
9269  * ipif with the specified name.
9270  *
9271  * If the address family is not AF_UNSPEC then set the address as well.
9272  *
9273  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
9274  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
9275  *
9276  * Executed as a writer on the ill.
9277  * So no lock is needed to traverse the ipif chain, or examine the
9278  * phyint flags.
9279  */
9280 /* ARGSUSED */
9281 int
9282 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9283     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9284 {
9285 	mblk_t	*mp1;
9286 	struct lifreq *lifr;
9287 	boolean_t	isv6;
9288 	boolean_t	exists;
9289 	char	*name;
9290 	char	*endp;
9291 	char	*cp;
9292 	int	namelen;
9293 	ipif_t	*ipif;
9294 	long	id;
9295 	ipsq_t	*ipsq;
9296 	ill_t	*ill;
9297 	sin_t	*sin;
9298 	int	err = 0;
9299 	boolean_t found_sep = B_FALSE;
9300 	conn_t	*connp;
9301 	zoneid_t zoneid;
9302 	ip_stack_t *ipst = CONNQ_TO_IPST(q);
9303 
9304 	ASSERT(q->q_next == NULL);
9305 	ip1dbg(("ip_sioctl_addif\n"));
9306 	/* Existence of mp1 has been checked in ip_wput_nondata */
9307 	mp1 = mp->b_cont->b_cont;
9308 	/*
9309 	 * Null terminate the string to protect against buffer
9310 	 * overrun. String was generated by user code and may not
9311 	 * be trusted.
9312 	 */
9313 	lifr = (struct lifreq *)mp1->b_rptr;
9314 	lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
9315 	name = lifr->lifr_name;
9316 	ASSERT(CONN_Q(q));
9317 	connp = Q_TO_CONN(q);
9318 	isv6 = (connp->conn_family == AF_INET6);
9319 	zoneid = connp->conn_zoneid;
9320 	namelen = mi_strlen(name);
9321 	if (namelen == 0)
9322 		return (EINVAL);
9323 
9324 	exists = B_FALSE;
9325 	if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
9326 	    (mi_strcmp(name, ipif_loopback_name) == 0)) {
9327 		/*
9328 		 * Allow creating lo0 using SIOCLIFADDIF.
9329 		 * can't be any other writer thread. So can pass null below
9330 		 * for the last 4 args to ipif_lookup_name.
9331 		 */
9332 		ipif = ipif_lookup_on_name(lifr->lifr_name, namelen, B_TRUE,
9333 		    &exists, isv6, zoneid, ipst);
9334 		/* Prevent any further action */
9335 		if (ipif == NULL) {
9336 			return (ENOBUFS);
9337 		} else if (!exists) {
9338 			/* We created the ipif now and as writer */
9339 			ipif_refrele(ipif);
9340 			return (0);
9341 		} else {
9342 			ill = ipif->ipif_ill;
9343 			ill_refhold(ill);
9344 			ipif_refrele(ipif);
9345 		}
9346 	} else {
9347 		/* Look for a colon in the name. */
9348 		endp = &name[namelen];
9349 		for (cp = endp; --cp > name; ) {
9350 			if (*cp == IPIF_SEPARATOR_CHAR) {
9351 				found_sep = B_TRUE;
9352 				/*
9353 				 * Reject any non-decimal aliases for plumbing
9354 				 * of logical interfaces. Aliases with leading
9355 				 * zeroes are also rejected as they introduce
9356 				 * ambiguity in the naming of the interfaces.
9357 				 * Comparing with "0" takes care of all such
9358 				 * cases.
9359 				 */
9360 				if ((strncmp("0", cp+1, 1)) == 0)
9361 					return (EINVAL);
9362 
9363 				if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
9364 				    id <= 0 || *endp != '\0') {
9365 					return (EINVAL);
9366 				}
9367 				*cp = '\0';
9368 				break;
9369 			}
9370 		}
9371 		ill = ill_lookup_on_name(name, B_FALSE, isv6, NULL, ipst);
9372 		if (found_sep)
9373 			*cp = IPIF_SEPARATOR_CHAR;
9374 		if (ill == NULL)
9375 			return (ENXIO);
9376 	}
9377 
9378 	ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
9379 	    B_TRUE);
9380 
9381 	/*
9382 	 * Release the refhold due to the lookup, now that we are excl
9383 	 * or we are just returning
9384 	 */
9385 	ill_refrele(ill);
9386 
9387 	if (ipsq == NULL)
9388 		return (EINPROGRESS);
9389 
9390 	/* We are now exclusive on the IPSQ */
9391 	ASSERT(IAM_WRITER_ILL(ill));
9392 
9393 	if (found_sep) {
9394 		/* Now see if there is an IPIF with this unit number. */
9395 		for (ipif = ill->ill_ipif; ipif != NULL;
9396 		    ipif = ipif->ipif_next) {
9397 			if (ipif->ipif_id == id) {
9398 				err = EEXIST;
9399 				goto done;
9400 			}
9401 		}
9402 	}
9403 
9404 	/*
9405 	 * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
9406 	 * of lo0.  Plumbing for lo0:0 happens in ipif_lookup_on_name()
9407 	 * instead.
9408 	 */
9409 	if ((ipif = ipif_allocate(ill, found_sep ? id : -1, IRE_LOCAL,
9410 	    B_TRUE, B_TRUE, &err)) == NULL) {
9411 		goto done;
9412 	}
9413 
9414 	/* Return created name with ioctl */
9415 	(void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
9416 	    IPIF_SEPARATOR_CHAR, ipif->ipif_id);
9417 	ip1dbg(("created %s\n", lifr->lifr_name));
9418 
9419 	/* Set address */
9420 	sin = (sin_t *)&lifr->lifr_addr;
9421 	if (sin->sin_family != AF_UNSPEC) {
9422 		err = ip_sioctl_addr(ipif, sin, q, mp,
9423 		    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
9424 	}
9425 
9426 done:
9427 	ipsq_exit(ipsq);
9428 	return (err);
9429 }
9430 
9431 /*
9432  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
9433  * interface) delete it based on the IP address (on this physical interface).
9434  * Otherwise delete it based on the ipif_id.
9435  * Also, special handling to allow a removeif of lo0.
9436  */
9437 /* ARGSUSED */
9438 int
9439 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9440     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9441 {
9442 	conn_t		*connp;
9443 	ill_t		*ill = ipif->ipif_ill;
9444 	boolean_t	 success;
9445 	ip_stack_t	*ipst;
9446 
9447 	ipst = CONNQ_TO_IPST(q);
9448 
9449 	ASSERT(q->q_next == NULL);
9450 	ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
9451 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9452 	ASSERT(IAM_WRITER_IPIF(ipif));
9453 
9454 	connp = Q_TO_CONN(q);
9455 	/*
9456 	 * Special case for unplumbing lo0 (the loopback physical interface).
9457 	 * If unplumbing lo0, the incoming address structure has been
9458 	 * initialized to all zeros. When unplumbing lo0, all its logical
9459 	 * interfaces must be removed too.
9460 	 *
9461 	 * Note that this interface may be called to remove a specific
9462 	 * loopback logical interface (eg, lo0:1). But in that case
9463 	 * ipif->ipif_id != 0 so that the code path for that case is the
9464 	 * same as any other interface (meaning it skips the code directly
9465 	 * below).
9466 	 */
9467 	if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9468 		if (sin->sin_family == AF_UNSPEC &&
9469 		    (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
9470 			/*
9471 			 * Mark it condemned. No new ref. will be made to ill.
9472 			 */
9473 			mutex_enter(&ill->ill_lock);
9474 			ill->ill_state_flags |= ILL_CONDEMNED;
9475 			for (ipif = ill->ill_ipif; ipif != NULL;
9476 			    ipif = ipif->ipif_next) {
9477 				ipif->ipif_state_flags |= IPIF_CONDEMNED;
9478 			}
9479 			mutex_exit(&ill->ill_lock);
9480 
9481 			ipif = ill->ill_ipif;
9482 			/* unplumb the loopback interface */
9483 			ill_delete(ill);
9484 			mutex_enter(&connp->conn_lock);
9485 			mutex_enter(&ill->ill_lock);
9486 
9487 			/* Are any references to this ill active */
9488 			if (ill_is_freeable(ill)) {
9489 				mutex_exit(&ill->ill_lock);
9490 				mutex_exit(&connp->conn_lock);
9491 				ill_delete_tail(ill);
9492 				mi_free(ill);
9493 				return (0);
9494 			}
9495 			success = ipsq_pending_mp_add(connp, ipif,
9496 			    CONNP_TO_WQ(connp), mp, ILL_FREE);
9497 			mutex_exit(&connp->conn_lock);
9498 			mutex_exit(&ill->ill_lock);
9499 			if (success)
9500 				return (EINPROGRESS);
9501 			else
9502 				return (EINTR);
9503 		}
9504 	}
9505 
9506 	if (ipif->ipif_id == 0) {
9507 		ipsq_t *ipsq;
9508 
9509 		/* Find based on address */
9510 		if (ipif->ipif_isv6) {
9511 			sin6_t *sin6;
9512 
9513 			if (sin->sin_family != AF_INET6)
9514 				return (EAFNOSUPPORT);
9515 
9516 			sin6 = (sin6_t *)sin;
9517 			/* We are a writer, so we should be able to lookup */
9518 			ipif = ipif_lookup_addr_exact_v6(&sin6->sin6_addr, ill,
9519 			    ipst);
9520 		} else {
9521 			if (sin->sin_family != AF_INET)
9522 				return (EAFNOSUPPORT);
9523 
9524 			/* We are a writer, so we should be able to lookup */
9525 			ipif = ipif_lookup_addr_exact(sin->sin_addr.s_addr, ill,
9526 			    ipst);
9527 		}
9528 		if (ipif == NULL) {
9529 			return (EADDRNOTAVAIL);
9530 		}
9531 
9532 		/*
9533 		 * It is possible for a user to send an SIOCLIFREMOVEIF with
9534 		 * lifr_name of the physical interface but with an ip address
9535 		 * lifr_addr of a logical interface plumbed over it.
9536 		 * So update ipx_current_ipif now that ipif points to the
9537 		 * correct one.
9538 		 */
9539 		ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
9540 		ipsq->ipsq_xop->ipx_current_ipif = ipif;
9541 
9542 		/* This is a writer */
9543 		ipif_refrele(ipif);
9544 	}
9545 
9546 	/*
9547 	 * Can not delete instance zero since it is tied to the ill.
9548 	 */
9549 	if (ipif->ipif_id == 0)
9550 		return (EBUSY);
9551 
9552 	mutex_enter(&ill->ill_lock);
9553 	ipif->ipif_state_flags |= IPIF_CONDEMNED;
9554 	mutex_exit(&ill->ill_lock);
9555 
9556 	ipif_free(ipif);
9557 
9558 	mutex_enter(&connp->conn_lock);
9559 	mutex_enter(&ill->ill_lock);
9560 
9561 	/* Are any references to this ipif active */
9562 	if (ipif_is_freeable(ipif)) {
9563 		mutex_exit(&ill->ill_lock);
9564 		mutex_exit(&connp->conn_lock);
9565 		ipif_non_duplicate(ipif);
9566 		(void) ipif_down_tail(ipif);
9567 		ipif_free_tail(ipif); /* frees ipif */
9568 		return (0);
9569 	}
9570 	success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
9571 	    IPIF_FREE);
9572 	mutex_exit(&ill->ill_lock);
9573 	mutex_exit(&connp->conn_lock);
9574 	if (success)
9575 		return (EINPROGRESS);
9576 	else
9577 		return (EINTR);
9578 }
9579 
9580 /*
9581  * Restart the removeif ioctl. The refcnt has gone down to 0.
9582  * The ipif is already condemned. So can't find it thru lookups.
9583  */
9584 /* ARGSUSED */
9585 int
9586 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
9587     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9588 {
9589 	ill_t *ill = ipif->ipif_ill;
9590 
9591 	ASSERT(IAM_WRITER_IPIF(ipif));
9592 	ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
9593 
9594 	ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
9595 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9596 
9597 	if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9598 		ASSERT(ill->ill_state_flags & ILL_CONDEMNED);
9599 		ill_delete_tail(ill);
9600 		mi_free(ill);
9601 		return (0);
9602 	}
9603 
9604 	ipif_non_duplicate(ipif);
9605 	(void) ipif_down_tail(ipif);
9606 	ipif_free_tail(ipif);
9607 
9608 	return (0);
9609 }
9610 
9611 /*
9612  * Set the local interface address using the given prefix and ill_token.
9613  */
9614 /* ARGSUSED */
9615 int
9616 ip_sioctl_prefix(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9617     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9618 {
9619 	int err;
9620 	in6_addr_t v6addr;
9621 	sin6_t *sin6;
9622 	ill_t *ill;
9623 	int i;
9624 
9625 	ip1dbg(("ip_sioctl_prefix(%s:%u %p)\n",
9626 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9627 
9628 	ASSERT(IAM_WRITER_IPIF(ipif));
9629 
9630 	if (!ipif->ipif_isv6)
9631 		return (EINVAL);
9632 
9633 	if (sin->sin_family != AF_INET6)
9634 		return (EAFNOSUPPORT);
9635 
9636 	sin6 = (sin6_t *)sin;
9637 	v6addr = sin6->sin6_addr;
9638 	ill = ipif->ipif_ill;
9639 
9640 	if (IN6_IS_ADDR_UNSPECIFIED(&v6addr) ||
9641 	    IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token))
9642 		return (EADDRNOTAVAIL);
9643 
9644 	for (i = 0; i < 4; i++)
9645 		sin6->sin6_addr.s6_addr32[i] |= ill->ill_token.s6_addr32[i];
9646 
9647 	err = ip_sioctl_addr(ipif, sin, q, mp,
9648 	    &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], dummy_ifreq);
9649 	return (err);
9650 }
9651 
9652 /*
9653  * Restart entry point to restart the address set operation after the
9654  * refcounts have dropped to zero.
9655  */
9656 /* ARGSUSED */
9657 int
9658 ip_sioctl_prefix_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9659     ip_ioctl_cmd_t *ipip, void *ifreq)
9660 {
9661 	ip1dbg(("ip_sioctl_prefix_restart(%s:%u %p)\n",
9662 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9663 	return (ip_sioctl_addr_restart(ipif, sin, q, mp, ipip, ifreq));
9664 }
9665 
9666 /*
9667  * Set the local interface address.
9668  * Allow an address of all zero when the interface is down.
9669  */
9670 /* ARGSUSED */
9671 int
9672 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9673     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9674 {
9675 	int err = 0;
9676 	in6_addr_t v6addr;
9677 	boolean_t need_up = B_FALSE;
9678 	ill_t *ill;
9679 	int i;
9680 
9681 	ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
9682 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9683 
9684 	ASSERT(IAM_WRITER_IPIF(ipif));
9685 
9686 	ill = ipif->ipif_ill;
9687 	if (ipif->ipif_isv6) {
9688 		sin6_t *sin6;
9689 		phyint_t *phyi;
9690 
9691 		if (sin->sin_family != AF_INET6)
9692 			return (EAFNOSUPPORT);
9693 
9694 		sin6 = (sin6_t *)sin;
9695 		v6addr = sin6->sin6_addr;
9696 		phyi = ill->ill_phyint;
9697 
9698 		/*
9699 		 * Enforce that true multicast interfaces have a link-local
9700 		 * address for logical unit 0.
9701 		 *
9702 		 * However for those ipif's for which link-local address was
9703 		 * not created by default, also allow setting :: as the address.
9704 		 * This scenario would arise, when we delete an address on ipif
9705 		 * with logical unit 0, we would want to set :: as the address.
9706 		 */
9707 		if (ipif->ipif_id == 0 &&
9708 		    (ill->ill_flags & ILLF_MULTICAST) &&
9709 		    !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
9710 		    !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
9711 		    !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
9712 
9713 			/*
9714 			 * if default link-local was not created by kernel for
9715 			 * this ill, allow setting :: as the address on ipif:0.
9716 			 */
9717 			if (ill->ill_flags & ILLF_NOLINKLOCAL) {
9718 				if (!IN6_IS_ADDR_UNSPECIFIED(&v6addr))
9719 					return (EADDRNOTAVAIL);
9720 			} else {
9721 				return (EADDRNOTAVAIL);
9722 			}
9723 		}
9724 
9725 		/*
9726 		 * up interfaces shouldn't have the unspecified address
9727 		 * unless they also have the IPIF_NOLOCAL flags set and
9728 		 * have a subnet assigned.
9729 		 */
9730 		if ((ipif->ipif_flags & IPIF_UP) &&
9731 		    IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
9732 		    (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
9733 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
9734 			return (EADDRNOTAVAIL);
9735 		}
9736 
9737 		if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
9738 			return (EADDRNOTAVAIL);
9739 	} else {
9740 		ipaddr_t addr;
9741 
9742 		if (sin->sin_family != AF_INET)
9743 			return (EAFNOSUPPORT);
9744 
9745 		addr = sin->sin_addr.s_addr;
9746 
9747 		/* Allow INADDR_ANY as the local address. */
9748 		if (addr != INADDR_ANY &&
9749 		    !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
9750 			return (EADDRNOTAVAIL);
9751 
9752 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9753 	}
9754 	/*
9755 	 * verify that the address being configured is permitted by the
9756 	 * ill_allowed_ips[] for the interface.
9757 	 */
9758 	if (ill->ill_allowed_ips_cnt > 0) {
9759 		for (i = 0; i < ill->ill_allowed_ips_cnt; i++) {
9760 			if (IN6_ARE_ADDR_EQUAL(&ill->ill_allowed_ips[i],
9761 			    &v6addr))
9762 				break;
9763 		}
9764 		if (i == ill->ill_allowed_ips_cnt) {
9765 			pr_addr_dbg("!allowed addr %s\n", AF_INET6, &v6addr);
9766 			return (EPERM);
9767 		}
9768 	}
9769 	/*
9770 	 * Even if there is no change we redo things just to rerun
9771 	 * ipif_set_default.
9772 	 */
9773 	if (ipif->ipif_flags & IPIF_UP) {
9774 		/*
9775 		 * Setting a new local address, make sure
9776 		 * we have net and subnet bcast ire's for
9777 		 * the old address if we need them.
9778 		 */
9779 		/*
9780 		 * If the interface is already marked up,
9781 		 * we call ipif_down which will take care
9782 		 * of ditching any IREs that have been set
9783 		 * up based on the old interface address.
9784 		 */
9785 		err = ipif_logical_down(ipif, q, mp);
9786 		if (err == EINPROGRESS)
9787 			return (err);
9788 		(void) ipif_down_tail(ipif);
9789 		need_up = 1;
9790 	}
9791 
9792 	err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
9793 	return (err);
9794 }
9795 
9796 int
9797 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9798     boolean_t need_up)
9799 {
9800 	in6_addr_t v6addr;
9801 	in6_addr_t ov6addr;
9802 	ipaddr_t addr;
9803 	sin6_t	*sin6;
9804 	int	sinlen;
9805 	int	err = 0;
9806 	ill_t	*ill = ipif->ipif_ill;
9807 	boolean_t need_dl_down;
9808 	boolean_t need_arp_down;
9809 	struct iocblk *iocp;
9810 
9811 	iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
9812 
9813 	ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
9814 	    ill->ill_name, ipif->ipif_id, (void *)ipif));
9815 	ASSERT(IAM_WRITER_IPIF(ipif));
9816 
9817 	/* Must cancel any pending timer before taking the ill_lock */
9818 	if (ipif->ipif_recovery_id != 0)
9819 		(void) untimeout(ipif->ipif_recovery_id);
9820 	ipif->ipif_recovery_id = 0;
9821 
9822 	if (ipif->ipif_isv6) {
9823 		sin6 = (sin6_t *)sin;
9824 		v6addr = sin6->sin6_addr;
9825 		sinlen = sizeof (struct sockaddr_in6);
9826 	} else {
9827 		addr = sin->sin_addr.s_addr;
9828 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9829 		sinlen = sizeof (struct sockaddr_in);
9830 	}
9831 	mutex_enter(&ill->ill_lock);
9832 	ov6addr = ipif->ipif_v6lcl_addr;
9833 	ipif->ipif_v6lcl_addr = v6addr;
9834 	sctp_update_ipif_addr(ipif, ov6addr);
9835 	ipif->ipif_addr_ready = 0;
9836 
9837 	ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
9838 
9839 	/*
9840 	 * If the interface was previously marked as a duplicate, then since
9841 	 * we've now got a "new" address, it should no longer be considered a
9842 	 * duplicate -- even if the "new" address is the same as the old one.
9843 	 * Note that if all ipifs are down, we may have a pending ARP down
9844 	 * event to handle.  This is because we want to recover from duplicates
9845 	 * and thus delay tearing down ARP until the duplicates have been
9846 	 * removed or disabled.
9847 	 */
9848 	need_dl_down = need_arp_down = B_FALSE;
9849 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
9850 		need_arp_down = !need_up;
9851 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
9852 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
9853 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
9854 			need_dl_down = B_TRUE;
9855 		}
9856 	}
9857 
9858 	ipif_set_default(ipif);
9859 
9860 	/*
9861 	 * If we've just manually set the IPv6 link-local address (0th ipif),
9862 	 * tag the ill so that future updates to the interface ID don't result
9863 	 * in this address getting automatically reconfigured from under the
9864 	 * administrator.
9865 	 */
9866 	if (ipif->ipif_isv6 && ipif->ipif_id == 0) {
9867 		if (iocp == NULL || (iocp->ioc_cmd == SIOCSLIFADDR &&
9868 		    !IN6_IS_ADDR_UNSPECIFIED(&v6addr)))
9869 			ill->ill_manual_linklocal = 1;
9870 	}
9871 
9872 	/*
9873 	 * When publishing an interface address change event, we only notify
9874 	 * the event listeners of the new address.  It is assumed that if they
9875 	 * actively care about the addresses assigned that they will have
9876 	 * already discovered the previous address assigned (if there was one.)
9877 	 *
9878 	 * Don't attach nic event message for SIOCLIFADDIF ioctl.
9879 	 */
9880 	if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
9881 		ill_nic_event_dispatch(ill, MAP_IPIF_ID(ipif->ipif_id),
9882 		    NE_ADDRESS_CHANGE, sin, sinlen);
9883 	}
9884 
9885 	mutex_exit(&ill->ill_lock);
9886 
9887 	if (need_up) {
9888 		/*
9889 		 * Now bring the interface back up.  If this
9890 		 * is the only IPIF for the ILL, ipif_up
9891 		 * will have to re-bind to the device, so
9892 		 * we may get back EINPROGRESS, in which
9893 		 * case, this IOCTL will get completed in
9894 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
9895 		 */
9896 		err = ipif_up(ipif, q, mp);
9897 	} else {
9898 		/* Perhaps ilgs should use this ill */
9899 		update_conn_ill(NULL, ill->ill_ipst);
9900 	}
9901 
9902 	if (need_dl_down)
9903 		ill_dl_down(ill);
9904 
9905 	if (need_arp_down && !ill->ill_isv6)
9906 		(void) ipif_arp_down(ipif);
9907 
9908 	/*
9909 	 * The default multicast interface might have changed (for
9910 	 * instance if the IPv6 scope of the address changed)
9911 	 */
9912 	ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
9913 
9914 	return (err);
9915 }
9916 
9917 /*
9918  * Restart entry point to restart the address set operation after the
9919  * refcounts have dropped to zero.
9920  */
9921 /* ARGSUSED */
9922 int
9923 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9924     ip_ioctl_cmd_t *ipip, void *ifreq)
9925 {
9926 	ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
9927 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9928 	ASSERT(IAM_WRITER_IPIF(ipif));
9929 	(void) ipif_down_tail(ipif);
9930 	return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
9931 }
9932 
9933 /* ARGSUSED */
9934 int
9935 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9936     ip_ioctl_cmd_t *ipip, void *if_req)
9937 {
9938 	sin6_t *sin6 = (struct sockaddr_in6 *)sin;
9939 	struct lifreq *lifr = (struct lifreq *)if_req;
9940 
9941 	ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
9942 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9943 	/*
9944 	 * The net mask and address can't change since we have a
9945 	 * reference to the ipif. So no lock is necessary.
9946 	 */
9947 	if (ipif->ipif_isv6) {
9948 		*sin6 = sin6_null;
9949 		sin6->sin6_family = AF_INET6;
9950 		sin6->sin6_addr = ipif->ipif_v6lcl_addr;
9951 		if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
9952 			sin6->sin6_scope_id =
9953 			    ipif->ipif_ill->ill_phyint->phyint_ifindex;
9954 		}
9955 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
9956 		lifr->lifr_addrlen =
9957 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
9958 	} else {
9959 		*sin = sin_null;
9960 		sin->sin_family = AF_INET;
9961 		sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
9962 		if (ipip->ipi_cmd_type == LIF_CMD) {
9963 			lifr->lifr_addrlen =
9964 			    ip_mask_to_plen(ipif->ipif_net_mask);
9965 		}
9966 	}
9967 	return (0);
9968 }
9969 
9970 /*
9971  * Set the destination address for a pt-pt interface.
9972  */
9973 /* ARGSUSED */
9974 int
9975 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9976     ip_ioctl_cmd_t *ipip, void *if_req)
9977 {
9978 	int err = 0;
9979 	in6_addr_t v6addr;
9980 	boolean_t need_up = B_FALSE;
9981 
9982 	ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
9983 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9984 	ASSERT(IAM_WRITER_IPIF(ipif));
9985 
9986 	if (ipif->ipif_isv6) {
9987 		sin6_t *sin6;
9988 
9989 		if (sin->sin_family != AF_INET6)
9990 			return (EAFNOSUPPORT);
9991 
9992 		sin6 = (sin6_t *)sin;
9993 		v6addr = sin6->sin6_addr;
9994 
9995 		if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
9996 			return (EADDRNOTAVAIL);
9997 	} else {
9998 		ipaddr_t addr;
9999 
10000 		if (sin->sin_family != AF_INET)
10001 			return (EAFNOSUPPORT);
10002 
10003 		addr = sin->sin_addr.s_addr;
10004 		if (addr != INADDR_ANY &&
10005 		    !ip_addr_ok_v4(addr, ipif->ipif_net_mask)) {
10006 			return (EADDRNOTAVAIL);
10007 		}
10008 
10009 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10010 	}
10011 
10012 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
10013 		return (0);	/* No change */
10014 
10015 	if (ipif->ipif_flags & IPIF_UP) {
10016 		/*
10017 		 * If the interface is already marked up,
10018 		 * we call ipif_down which will take care
10019 		 * of ditching any IREs that have been set
10020 		 * up based on the old pp dst address.
10021 		 */
10022 		err = ipif_logical_down(ipif, q, mp);
10023 		if (err == EINPROGRESS)
10024 			return (err);
10025 		(void) ipif_down_tail(ipif);
10026 		need_up = B_TRUE;
10027 	}
10028 	/*
10029 	 * could return EINPROGRESS. If so ioctl will complete in
10030 	 * ip_rput_dlpi_writer
10031 	 */
10032 	err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
10033 	return (err);
10034 }
10035 
10036 static int
10037 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10038     boolean_t need_up)
10039 {
10040 	in6_addr_t v6addr;
10041 	ill_t	*ill = ipif->ipif_ill;
10042 	int	err = 0;
10043 	boolean_t need_dl_down;
10044 	boolean_t need_arp_down;
10045 
10046 	ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
10047 	    ipif->ipif_id, (void *)ipif));
10048 
10049 	/* Must cancel any pending timer before taking the ill_lock */
10050 	if (ipif->ipif_recovery_id != 0)
10051 		(void) untimeout(ipif->ipif_recovery_id);
10052 	ipif->ipif_recovery_id = 0;
10053 
10054 	if (ipif->ipif_isv6) {
10055 		sin6_t *sin6;
10056 
10057 		sin6 = (sin6_t *)sin;
10058 		v6addr = sin6->sin6_addr;
10059 	} else {
10060 		ipaddr_t addr;
10061 
10062 		addr = sin->sin_addr.s_addr;
10063 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10064 	}
10065 	mutex_enter(&ill->ill_lock);
10066 	/* Set point to point destination address. */
10067 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10068 		/*
10069 		 * Allow this as a means of creating logical
10070 		 * pt-pt interfaces on top of e.g. an Ethernet.
10071 		 * XXX Undocumented HACK for testing.
10072 		 * pt-pt interfaces are created with NUD disabled.
10073 		 */
10074 		ipif->ipif_flags |= IPIF_POINTOPOINT;
10075 		ipif->ipif_flags &= ~IPIF_BROADCAST;
10076 		if (ipif->ipif_isv6)
10077 			ill->ill_flags |= ILLF_NONUD;
10078 	}
10079 
10080 	/*
10081 	 * If the interface was previously marked as a duplicate, then since
10082 	 * we've now got a "new" address, it should no longer be considered a
10083 	 * duplicate -- even if the "new" address is the same as the old one.
10084 	 * Note that if all ipifs are down, we may have a pending ARP down
10085 	 * event to handle.
10086 	 */
10087 	need_dl_down = need_arp_down = B_FALSE;
10088 	if (ipif->ipif_flags & IPIF_DUPLICATE) {
10089 		need_arp_down = !need_up;
10090 		ipif->ipif_flags &= ~IPIF_DUPLICATE;
10091 		if (--ill->ill_ipif_dup_count == 0 && !need_up &&
10092 		    ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
10093 			need_dl_down = B_TRUE;
10094 		}
10095 	}
10096 
10097 	/*
10098 	 * If we've just manually set the IPv6 destination link-local address
10099 	 * (0th ipif), tag the ill so that future updates to the destination
10100 	 * interface ID (as can happen with interfaces over IP tunnels) don't
10101 	 * result in this address getting automatically reconfigured from
10102 	 * under the administrator.
10103 	 */
10104 	if (ipif->ipif_isv6 && ipif->ipif_id == 0)
10105 		ill->ill_manual_dst_linklocal = 1;
10106 
10107 	/* Set the new address. */
10108 	ipif->ipif_v6pp_dst_addr = v6addr;
10109 	/* Make sure subnet tracks pp_dst */
10110 	ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
10111 	mutex_exit(&ill->ill_lock);
10112 
10113 	if (need_up) {
10114 		/*
10115 		 * Now bring the interface back up.  If this
10116 		 * is the only IPIF for the ILL, ipif_up
10117 		 * will have to re-bind to the device, so
10118 		 * we may get back EINPROGRESS, in which
10119 		 * case, this IOCTL will get completed in
10120 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
10121 		 */
10122 		err = ipif_up(ipif, q, mp);
10123 	}
10124 
10125 	if (need_dl_down)
10126 		ill_dl_down(ill);
10127 	if (need_arp_down && !ipif->ipif_isv6)
10128 		(void) ipif_arp_down(ipif);
10129 
10130 	return (err);
10131 }
10132 
10133 /*
10134  * Restart entry point to restart the dstaddress set operation after the
10135  * refcounts have dropped to zero.
10136  */
10137 /* ARGSUSED */
10138 int
10139 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10140     ip_ioctl_cmd_t *ipip, void *ifreq)
10141 {
10142 	ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
10143 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10144 	(void) ipif_down_tail(ipif);
10145 	return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
10146 }
10147 
10148 /* ARGSUSED */
10149 int
10150 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10151     ip_ioctl_cmd_t *ipip, void *if_req)
10152 {
10153 	sin6_t	*sin6 = (struct sockaddr_in6 *)sin;
10154 
10155 	ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
10156 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10157 	/*
10158 	 * Get point to point destination address. The addresses can't
10159 	 * change since we hold a reference to the ipif.
10160 	 */
10161 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
10162 		return (EADDRNOTAVAIL);
10163 
10164 	if (ipif->ipif_isv6) {
10165 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10166 		*sin6 = sin6_null;
10167 		sin6->sin6_family = AF_INET6;
10168 		sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
10169 	} else {
10170 		*sin = sin_null;
10171 		sin->sin_family = AF_INET;
10172 		sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
10173 	}
10174 	return (0);
10175 }
10176 
10177 /*
10178  * Check which flags will change by the given flags being set
10179  * silently ignore flags which userland is not allowed to control.
10180  * (Because these flags may change between SIOCGLIFFLAGS and
10181  * SIOCSLIFFLAGS, and that's outside of userland's control,
10182  * we need to silently ignore them rather than fail.)
10183  */
10184 static void
10185 ip_sioctl_flags_onoff(ipif_t *ipif, uint64_t flags, uint64_t *onp,
10186     uint64_t *offp)
10187 {
10188 	ill_t		*ill = ipif->ipif_ill;
10189 	phyint_t	*phyi = ill->ill_phyint;
10190 	uint64_t	cantchange_flags, intf_flags;
10191 	uint64_t	turn_on, turn_off;
10192 
10193 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10194 	cantchange_flags = IFF_CANTCHANGE;
10195 	if (IS_IPMP(ill))
10196 		cantchange_flags |= IFF_IPMP_CANTCHANGE;
10197 	turn_on = (flags ^ intf_flags) & ~cantchange_flags;
10198 	turn_off = intf_flags & turn_on;
10199 	turn_on ^= turn_off;
10200 	*onp = turn_on;
10201 	*offp = turn_off;
10202 }
10203 
10204 /*
10205  * Set interface flags.  Many flags require special handling (e.g.,
10206  * bringing the interface down); see below for details.
10207  *
10208  * NOTE : We really don't enforce that ipif_id zero should be used
10209  *	  for setting any flags other than IFF_LOGINT_FLAGS. This
10210  *	  is because applications generally does SICGLIFFLAGS and
10211  *	  ORs in the new flags (that affects the logical) and does a
10212  *	  SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
10213  *	  than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
10214  *	  flags that will be turned on is correct with respect to
10215  *	  ipif_id 0. For backward compatibility reasons, it is not done.
10216  */
10217 /* ARGSUSED */
10218 int
10219 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10220     ip_ioctl_cmd_t *ipip, void *if_req)
10221 {
10222 	uint64_t turn_on;
10223 	uint64_t turn_off;
10224 	int	err = 0;
10225 	phyint_t *phyi;
10226 	ill_t *ill;
10227 	conn_t *connp;
10228 	uint64_t intf_flags;
10229 	boolean_t phyint_flags_modified = B_FALSE;
10230 	uint64_t flags;
10231 	struct ifreq *ifr;
10232 	struct lifreq *lifr;
10233 	boolean_t set_linklocal = B_FALSE;
10234 
10235 	ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
10236 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10237 
10238 	ASSERT(IAM_WRITER_IPIF(ipif));
10239 
10240 	ill = ipif->ipif_ill;
10241 	phyi = ill->ill_phyint;
10242 
10243 	if (ipip->ipi_cmd_type == IF_CMD) {
10244 		ifr = (struct ifreq *)if_req;
10245 		flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
10246 	} else {
10247 		lifr = (struct lifreq *)if_req;
10248 		flags = lifr->lifr_flags;
10249 	}
10250 
10251 	intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10252 
10253 	/*
10254 	 * Have the flags been set correctly until now?
10255 	 */
10256 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10257 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10258 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10259 	/*
10260 	 * Compare the new flags to the old, and partition
10261 	 * into those coming on and those going off.
10262 	 * For the 16 bit command keep the bits above bit 16 unchanged.
10263 	 */
10264 	if (ipip->ipi_cmd == SIOCSIFFLAGS)
10265 		flags |= intf_flags & ~0xFFFF;
10266 
10267 	/*
10268 	 * Explicitly fail attempts to change flags that are always invalid on
10269 	 * an IPMP meta-interface.
10270 	 */
10271 	if (IS_IPMP(ill) && ((flags ^ intf_flags) & IFF_IPMP_INVALID))
10272 		return (EINVAL);
10273 
10274 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10275 	if ((turn_on|turn_off) == 0)
10276 		return (0);	/* No change */
10277 
10278 	/*
10279 	 * All test addresses must be IFF_DEPRECATED (to ensure source address
10280 	 * selection avoids them) -- so force IFF_DEPRECATED on, and do not
10281 	 * allow it to be turned off.
10282 	 */
10283 	if ((turn_off & (IFF_DEPRECATED|IFF_NOFAILOVER)) == IFF_DEPRECATED &&
10284 	    (turn_on|intf_flags) & IFF_NOFAILOVER)
10285 		return (EINVAL);
10286 
10287 	if ((connp = Q_TO_CONN(q)) == NULL)
10288 		return (EINVAL);
10289 
10290 	/*
10291 	 * Only vrrp control socket is allowed to change IFF_UP and
10292 	 * IFF_NOACCEPT flags when IFF_VRRP is set.
10293 	 */
10294 	if ((intf_flags & IFF_VRRP) && ((turn_off | turn_on) & IFF_UP)) {
10295 		if (!connp->conn_isvrrp)
10296 			return (EINVAL);
10297 	}
10298 
10299 	/*
10300 	 * The IFF_NOACCEPT flag can only be set on an IFF_VRRP IP address by
10301 	 * VRRP control socket.
10302 	 */
10303 	if ((turn_off | turn_on) & IFF_NOACCEPT) {
10304 		if (!connp->conn_isvrrp || !(intf_flags & IFF_VRRP))
10305 			return (EINVAL);
10306 	}
10307 
10308 	if (turn_on & IFF_NOFAILOVER) {
10309 		turn_on |= IFF_DEPRECATED;
10310 		flags |= IFF_DEPRECATED;
10311 	}
10312 
10313 	/*
10314 	 * On underlying interfaces, only allow applications to manage test
10315 	 * addresses -- otherwise, they may get confused when the address
10316 	 * moves as part of being brought up.  Likewise, prevent an
10317 	 * application-managed test address from being converted to a data
10318 	 * address.  To prevent migration of administratively up addresses in
10319 	 * the kernel, we don't allow them to be converted either.
10320 	 */
10321 	if (IS_UNDER_IPMP(ill)) {
10322 		const uint64_t appflags = IFF_DHCPRUNNING | IFF_ADDRCONF;
10323 
10324 		if ((turn_on & appflags) && !(flags & IFF_NOFAILOVER))
10325 			return (EINVAL);
10326 
10327 		if ((turn_off & IFF_NOFAILOVER) &&
10328 		    (flags & (appflags | IFF_UP | IFF_DUPLICATE)))
10329 			return (EINVAL);
10330 	}
10331 
10332 	/*
10333 	 * Only allow IFF_TEMPORARY flag to be set on
10334 	 * IPv6 interfaces.
10335 	 */
10336 	if ((turn_on & IFF_TEMPORARY) && !(ipif->ipif_isv6))
10337 		return (EINVAL);
10338 
10339 	/*
10340 	 * cannot turn off IFF_NOXMIT on  VNI interfaces.
10341 	 */
10342 	if ((turn_off & IFF_NOXMIT) && IS_VNI(ipif->ipif_ill))
10343 		return (EINVAL);
10344 
10345 	/*
10346 	 * Don't allow the IFF_ROUTER flag to be turned on on loopback
10347 	 * interfaces.  It makes no sense in that context.
10348 	 */
10349 	if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
10350 		return (EINVAL);
10351 
10352 	/*
10353 	 * For IPv6 ipif_id 0, don't allow the interface to be up without
10354 	 * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
10355 	 * If the link local address isn't set, and can be set, it will get
10356 	 * set later on in this function.
10357 	 */
10358 	if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
10359 	    (flags & IFF_UP) && !(flags & (IFF_NOLOCAL|IFF_ANYCAST)) &&
10360 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
10361 		if (ipif_cant_setlinklocal(ipif))
10362 			return (EINVAL);
10363 		set_linklocal = B_TRUE;
10364 	}
10365 
10366 	/*
10367 	 * If we modify physical interface flags, we'll potentially need to
10368 	 * send up two routing socket messages for the changes (one for the
10369 	 * IPv4 ill, and another for the IPv6 ill).  Note that here.
10370 	 */
10371 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10372 		phyint_flags_modified = B_TRUE;
10373 
10374 	/*
10375 	 * All functioning PHYI_STANDBY interfaces start life PHYI_INACTIVE
10376 	 * (otherwise, we'd immediately use them, defeating standby).  Also,
10377 	 * since PHYI_INACTIVE has a separate meaning when PHYI_STANDBY is not
10378 	 * set, don't allow PHYI_STANDBY to be set if PHYI_INACTIVE is already
10379 	 * set, and clear PHYI_INACTIVE if PHYI_STANDBY is being cleared.  We
10380 	 * also don't allow PHYI_STANDBY if VNI is enabled since its semantics
10381 	 * will not be honored.
10382 	 */
10383 	if (turn_on & PHYI_STANDBY) {
10384 		/*
10385 		 * No need to grab ill_g_usesrc_lock here; see the
10386 		 * synchronization notes in ip.c.
10387 		 */
10388 		if (ill->ill_usesrc_grp_next != NULL ||
10389 		    intf_flags & PHYI_INACTIVE)
10390 			return (EINVAL);
10391 		if (!(flags & PHYI_FAILED)) {
10392 			flags |= PHYI_INACTIVE;
10393 			turn_on |= PHYI_INACTIVE;
10394 		}
10395 	}
10396 
10397 	if (turn_off & PHYI_STANDBY) {
10398 		flags &= ~PHYI_INACTIVE;
10399 		turn_off |= PHYI_INACTIVE;
10400 	}
10401 
10402 	/*
10403 	 * PHYI_FAILED and PHYI_INACTIVE are mutually exclusive; fail if both
10404 	 * would end up on.
10405 	 */
10406 	if ((flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
10407 	    (PHYI_FAILED | PHYI_INACTIVE))
10408 		return (EINVAL);
10409 
10410 	/*
10411 	 * If ILLF_ROUTER changes, we need to change the ip forwarding
10412 	 * status of the interface.
10413 	 */
10414 	if ((turn_on | turn_off) & ILLF_ROUTER) {
10415 		err = ill_forward_set(ill, ((turn_on & ILLF_ROUTER) != 0));
10416 		if (err != 0)
10417 			return (err);
10418 	}
10419 
10420 	/*
10421 	 * If the interface is not UP and we are not going to
10422 	 * bring it UP, record the flags and return. When the
10423 	 * interface comes UP later, the right actions will be
10424 	 * taken.
10425 	 */
10426 	if (!(ipif->ipif_flags & IPIF_UP) &&
10427 	    !(turn_on & IPIF_UP)) {
10428 		/* Record new flags in their respective places. */
10429 		mutex_enter(&ill->ill_lock);
10430 		mutex_enter(&ill->ill_phyint->phyint_lock);
10431 		ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10432 		ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10433 		ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10434 		ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10435 		phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10436 		phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10437 		mutex_exit(&ill->ill_lock);
10438 		mutex_exit(&ill->ill_phyint->phyint_lock);
10439 
10440 		/*
10441 		 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the
10442 		 * same to the kernel: if any of them has been set by
10443 		 * userland, the interface cannot be used for data traffic.
10444 		 */
10445 		if ((turn_on|turn_off) &
10446 		    (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10447 			ASSERT(!IS_IPMP(ill));
10448 			/*
10449 			 * It's possible the ill is part of an "anonymous"
10450 			 * IPMP group rather than a real group.  In that case,
10451 			 * there are no other interfaces in the group and thus
10452 			 * no need to call ipmp_phyint_refresh_active().
10453 			 */
10454 			if (IS_UNDER_IPMP(ill))
10455 				ipmp_phyint_refresh_active(phyi);
10456 		}
10457 
10458 		if (phyint_flags_modified) {
10459 			if (phyi->phyint_illv4 != NULL) {
10460 				ip_rts_ifmsg(phyi->phyint_illv4->
10461 				    ill_ipif, RTSQ_DEFAULT);
10462 			}
10463 			if (phyi->phyint_illv6 != NULL) {
10464 				ip_rts_ifmsg(phyi->phyint_illv6->
10465 				    ill_ipif, RTSQ_DEFAULT);
10466 			}
10467 		}
10468 		/* The default multicast interface might have changed */
10469 		ire_increment_multicast_generation(ill->ill_ipst,
10470 		    ill->ill_isv6);
10471 
10472 		return (0);
10473 	} else if (set_linklocal) {
10474 		mutex_enter(&ill->ill_lock);
10475 		if (set_linklocal)
10476 			ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
10477 		mutex_exit(&ill->ill_lock);
10478 	}
10479 
10480 	/*
10481 	 * Disallow IPv6 interfaces coming up that have the unspecified address,
10482 	 * or point-to-point interfaces with an unspecified destination. We do
10483 	 * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
10484 	 * have a subnet assigned, which is how in.ndpd currently manages its
10485 	 * onlink prefix list when no addresses are configured with those
10486 	 * prefixes.
10487 	 */
10488 	if (ipif->ipif_isv6 &&
10489 	    ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
10490 	    (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
10491 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
10492 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10493 	    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
10494 		return (EINVAL);
10495 	}
10496 
10497 	/*
10498 	 * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
10499 	 * from being brought up.
10500 	 */
10501 	if (!ipif->ipif_isv6 &&
10502 	    ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10503 	    ipif->ipif_pp_dst_addr == INADDR_ANY)) {
10504 		return (EINVAL);
10505 	}
10506 
10507 	/*
10508 	 * If we are going to change one or more of the flags that are
10509 	 * IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL, ILLF_NOARP,
10510 	 * ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, IPIF_PREFERRED, and
10511 	 * IPIF_NOFAILOVER, we will take special action.  This is
10512 	 * done by bring the ipif down, changing the flags and bringing
10513 	 * it back up again.  For IPIF_NOFAILOVER, the act of bringing it
10514 	 * back up will trigger the address to be moved.
10515 	 *
10516 	 * If we are going to change IFF_NOACCEPT, we need to bring
10517 	 * all the ipifs down then bring them up again.	 The act of
10518 	 * bringing all the ipifs back up will trigger the local
10519 	 * ires being recreated with "no_accept" set/cleared.
10520 	 *
10521 	 * Note that ILLF_NOACCEPT is always set separately from the
10522 	 * other flags.
10523 	 */
10524 	if ((turn_on|turn_off) &
10525 	    (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
10526 	    ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED|
10527 	    IPIF_NOFAILOVER)) {
10528 		/*
10529 		 * ipif_down() will ire_delete bcast ire's for the subnet,
10530 		 * while the ire_identical_ref tracks the case of IRE_BROADCAST
10531 		 * entries shared between multiple ipifs on the same subnet.
10532 		 */
10533 		if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
10534 		    !(turn_off & IPIF_UP)) {
10535 			if (ipif->ipif_flags & IPIF_UP)
10536 				ill->ill_logical_down = 1;
10537 			turn_on &= ~IPIF_UP;
10538 		}
10539 		err = ipif_down(ipif, q, mp);
10540 		ip1dbg(("ipif_down returns %d err ", err));
10541 		if (err == EINPROGRESS)
10542 			return (err);
10543 		(void) ipif_down_tail(ipif);
10544 	} else if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10545 		/*
10546 		 * If we can quiesce the ill, then continue.  If not, then
10547 		 * ip_sioctl_flags_tail() will be called from
10548 		 * ipif_ill_refrele_tail().
10549 		 */
10550 		ill_down_ipifs(ill, B_TRUE);
10551 
10552 		mutex_enter(&connp->conn_lock);
10553 		mutex_enter(&ill->ill_lock);
10554 		if (!ill_is_quiescent(ill)) {
10555 			boolean_t success;
10556 
10557 			success = ipsq_pending_mp_add(connp, ill->ill_ipif,
10558 			    q, mp, ILL_DOWN);
10559 			mutex_exit(&ill->ill_lock);
10560 			mutex_exit(&connp->conn_lock);
10561 			return (success ? EINPROGRESS : EINTR);
10562 		}
10563 		mutex_exit(&ill->ill_lock);
10564 		mutex_exit(&connp->conn_lock);
10565 	}
10566 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10567 }
10568 
10569 static int
10570 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp)
10571 {
10572 	ill_t	*ill;
10573 	phyint_t *phyi;
10574 	uint64_t turn_on, turn_off;
10575 	boolean_t phyint_flags_modified = B_FALSE;
10576 	int	err = 0;
10577 	boolean_t set_linklocal = B_FALSE;
10578 
10579 	ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
10580 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
10581 
10582 	ASSERT(IAM_WRITER_IPIF(ipif));
10583 
10584 	ill = ipif->ipif_ill;
10585 	phyi = ill->ill_phyint;
10586 
10587 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10588 
10589 	/*
10590 	 * IFF_UP is handled separately.
10591 	 */
10592 	turn_on &= ~IFF_UP;
10593 	turn_off &= ~IFF_UP;
10594 
10595 	if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10596 		phyint_flags_modified = B_TRUE;
10597 
10598 	/*
10599 	 * Now we change the flags. Track current value of
10600 	 * other flags in their respective places.
10601 	 */
10602 	mutex_enter(&ill->ill_lock);
10603 	mutex_enter(&phyi->phyint_lock);
10604 	ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10605 	ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10606 	ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10607 	ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10608 	phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10609 	phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10610 	if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
10611 		set_linklocal = B_TRUE;
10612 		ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
10613 	}
10614 
10615 	mutex_exit(&ill->ill_lock);
10616 	mutex_exit(&phyi->phyint_lock);
10617 
10618 	if (set_linklocal)
10619 		(void) ipif_setlinklocal(ipif);
10620 
10621 	/*
10622 	 * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the same to
10623 	 * the kernel: if any of them has been set by userland, the interface
10624 	 * cannot be used for data traffic.
10625 	 */
10626 	if ((turn_on|turn_off) & (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10627 		ASSERT(!IS_IPMP(ill));
10628 		/*
10629 		 * It's possible the ill is part of an "anonymous" IPMP group
10630 		 * rather than a real group.  In that case, there are no other
10631 		 * interfaces in the group and thus no need for us to call
10632 		 * ipmp_phyint_refresh_active().
10633 		 */
10634 		if (IS_UNDER_IPMP(ill))
10635 			ipmp_phyint_refresh_active(phyi);
10636 	}
10637 
10638 	if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10639 		/*
10640 		 * If the ILLF_NOACCEPT flag is changed, bring up all the
10641 		 * ipifs that were brought down.
10642 		 *
10643 		 * The routing sockets messages are sent as the result
10644 		 * of ill_up_ipifs(), further, SCTP's IPIF list was updated
10645 		 * as well.
10646 		 */
10647 		err = ill_up_ipifs(ill, q, mp);
10648 	} else if ((flags & IFF_UP) && !(ipif->ipif_flags & IPIF_UP)) {
10649 		/*
10650 		 * XXX ipif_up really does not know whether a phyint flags
10651 		 * was modified or not. So, it sends up information on
10652 		 * only one routing sockets message. As we don't bring up
10653 		 * the interface and also set PHYI_ flags simultaneously
10654 		 * it should be okay.
10655 		 */
10656 		err = ipif_up(ipif, q, mp);
10657 	} else {
10658 		/*
10659 		 * Make sure routing socket sees all changes to the flags.
10660 		 * ipif_up_done* handles this when we use ipif_up.
10661 		 */
10662 		if (phyint_flags_modified) {
10663 			if (phyi->phyint_illv4 != NULL) {
10664 				ip_rts_ifmsg(phyi->phyint_illv4->
10665 				    ill_ipif, RTSQ_DEFAULT);
10666 			}
10667 			if (phyi->phyint_illv6 != NULL) {
10668 				ip_rts_ifmsg(phyi->phyint_illv6->
10669 				    ill_ipif, RTSQ_DEFAULT);
10670 			}
10671 		} else {
10672 			ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
10673 		}
10674 		/*
10675 		 * Update the flags in SCTP's IPIF list, ipif_up() will do
10676 		 * this in need_up case.
10677 		 */
10678 		sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10679 	}
10680 
10681 	/* The default multicast interface might have changed */
10682 	ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
10683 	return (err);
10684 }
10685 
10686 /*
10687  * Restart the flags operation now that the refcounts have dropped to zero.
10688  */
10689 /* ARGSUSED */
10690 int
10691 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10692     ip_ioctl_cmd_t *ipip, void *if_req)
10693 {
10694 	uint64_t flags;
10695 	struct ifreq *ifr = if_req;
10696 	struct lifreq *lifr = if_req;
10697 	uint64_t turn_on, turn_off;
10698 
10699 	ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
10700 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10701 
10702 	if (ipip->ipi_cmd_type == IF_CMD) {
10703 		/* cast to uint16_t prevents unwanted sign extension */
10704 		flags = (uint16_t)ifr->ifr_flags;
10705 	} else {
10706 		flags = lifr->lifr_flags;
10707 	}
10708 
10709 	/*
10710 	 * If this function call is a result of the ILLF_NOACCEPT flag
10711 	 * change, do not call ipif_down_tail(). See ip_sioctl_flags().
10712 	 */
10713 	ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10714 	if (!((turn_on|turn_off) & ILLF_NOACCEPT))
10715 		(void) ipif_down_tail(ipif);
10716 
10717 	return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10718 }
10719 
10720 /*
10721  * Can operate on either a module or a driver queue.
10722  */
10723 /* ARGSUSED */
10724 int
10725 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10726     ip_ioctl_cmd_t *ipip, void *if_req)
10727 {
10728 	/*
10729 	 * Has the flags been set correctly till now ?
10730 	 */
10731 	ill_t *ill = ipif->ipif_ill;
10732 	phyint_t *phyi = ill->ill_phyint;
10733 
10734 	ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
10735 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10736 	ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10737 	ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10738 	ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10739 
10740 	/*
10741 	 * Need a lock since some flags can be set even when there are
10742 	 * references to the ipif.
10743 	 */
10744 	mutex_enter(&ill->ill_lock);
10745 	if (ipip->ipi_cmd_type == IF_CMD) {
10746 		struct ifreq *ifr = (struct ifreq *)if_req;
10747 
10748 		/* Get interface flags (low 16 only). */
10749 		ifr->ifr_flags = ((ipif->ipif_flags |
10750 		    ill->ill_flags | phyi->phyint_flags) & 0xffff);
10751 	} else {
10752 		struct lifreq *lifr = (struct lifreq *)if_req;
10753 
10754 		/* Get interface flags. */
10755 		lifr->lifr_flags = ipif->ipif_flags |
10756 		    ill->ill_flags | phyi->phyint_flags;
10757 	}
10758 	mutex_exit(&ill->ill_lock);
10759 	return (0);
10760 }
10761 
10762 /*
10763  * We allow the MTU to be set on an ILL, but not have it be different
10764  * for different IPIFs since we don't actually send packets on IPIFs.
10765  */
10766 /* ARGSUSED */
10767 int
10768 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10769     ip_ioctl_cmd_t *ipip, void *if_req)
10770 {
10771 	int mtu;
10772 	int ip_min_mtu;
10773 	struct ifreq	*ifr;
10774 	struct lifreq *lifr;
10775 	ill_t	*ill;
10776 
10777 	ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
10778 	    ipif->ipif_id, (void *)ipif));
10779 	if (ipip->ipi_cmd_type == IF_CMD) {
10780 		ifr = (struct ifreq *)if_req;
10781 		mtu = ifr->ifr_metric;
10782 	} else {
10783 		lifr = (struct lifreq *)if_req;
10784 		mtu = lifr->lifr_mtu;
10785 	}
10786 	/* Only allow for logical unit zero i.e. not on "bge0:17" */
10787 	if (ipif->ipif_id != 0)
10788 		return (EINVAL);
10789 
10790 	ill = ipif->ipif_ill;
10791 	if (ipif->ipif_isv6)
10792 		ip_min_mtu = IPV6_MIN_MTU;
10793 	else
10794 		ip_min_mtu = IP_MIN_MTU;
10795 
10796 	mutex_enter(&ill->ill_lock);
10797 	if (mtu > ill->ill_max_frag || mtu < ip_min_mtu) {
10798 		mutex_exit(&ill->ill_lock);
10799 		return (EINVAL);
10800 	}
10801 	/* Avoid increasing ill_mc_mtu */
10802 	if (ill->ill_mc_mtu > mtu)
10803 		ill->ill_mc_mtu = mtu;
10804 
10805 	/*
10806 	 * The dce and fragmentation code can handle changes to ill_mtu
10807 	 * concurrent with sending/fragmenting packets.
10808 	 */
10809 	ill->ill_mtu = mtu;
10810 	ill->ill_flags |= ILLF_FIXEDMTU;
10811 	mutex_exit(&ill->ill_lock);
10812 
10813 	/*
10814 	 * Make sure all dce_generation checks find out
10815 	 * that ill_mtu/ill_mc_mtu has changed.
10816 	 */
10817 	dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
10818 
10819 	/*
10820 	 * Refresh IPMP meta-interface MTU if necessary.
10821 	 */
10822 	if (IS_UNDER_IPMP(ill))
10823 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
10824 
10825 	/* Update the MTU in SCTP's list */
10826 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10827 	return (0);
10828 }
10829 
10830 /* Get interface MTU. */
10831 /* ARGSUSED */
10832 int
10833 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10834     ip_ioctl_cmd_t *ipip, void *if_req)
10835 {
10836 	struct ifreq	*ifr;
10837 	struct lifreq	*lifr;
10838 
10839 	ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
10840 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10841 
10842 	/*
10843 	 * We allow a get on any logical interface even though the set
10844 	 * can only be done on logical unit 0.
10845 	 */
10846 	if (ipip->ipi_cmd_type == IF_CMD) {
10847 		ifr = (struct ifreq *)if_req;
10848 		ifr->ifr_metric = ipif->ipif_ill->ill_mtu;
10849 	} else {
10850 		lifr = (struct lifreq *)if_req;
10851 		lifr->lifr_mtu = ipif->ipif_ill->ill_mtu;
10852 	}
10853 	return (0);
10854 }
10855 
10856 /* Set interface broadcast address. */
10857 /* ARGSUSED2 */
10858 int
10859 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10860     ip_ioctl_cmd_t *ipip, void *if_req)
10861 {
10862 	ipaddr_t addr;
10863 	ire_t	*ire;
10864 	ill_t		*ill = ipif->ipif_ill;
10865 	ip_stack_t	*ipst = ill->ill_ipst;
10866 
10867 	ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ill->ill_name,
10868 	    ipif->ipif_id));
10869 
10870 	ASSERT(IAM_WRITER_IPIF(ipif));
10871 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
10872 		return (EADDRNOTAVAIL);
10873 
10874 	ASSERT(!(ipif->ipif_isv6));	/* No IPv6 broadcast */
10875 
10876 	if (sin->sin_family != AF_INET)
10877 		return (EAFNOSUPPORT);
10878 
10879 	addr = sin->sin_addr.s_addr;
10880 
10881 	if (ipif->ipif_flags & IPIF_UP) {
10882 		/*
10883 		 * If we are already up, make sure the new
10884 		 * broadcast address makes sense.  If it does,
10885 		 * there should be an IRE for it already.
10886 		 */
10887 		ire = ire_ftable_lookup_v4(addr, 0, 0, IRE_BROADCAST,
10888 		    ill, ipif->ipif_zoneid, NULL,
10889 		    (MATCH_IRE_ILL | MATCH_IRE_TYPE), 0, ipst, NULL);
10890 		if (ire == NULL) {
10891 			return (EINVAL);
10892 		} else {
10893 			ire_refrele(ire);
10894 		}
10895 	}
10896 	/*
10897 	 * Changing the broadcast addr for this ipif. Since the IRE_BROADCAST
10898 	 * needs to already exist we never need to change the set of
10899 	 * IRE_BROADCASTs when we are UP.
10900 	 */
10901 	if (addr != ipif->ipif_brd_addr)
10902 		IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
10903 
10904 	return (0);
10905 }
10906 
10907 /* Get interface broadcast address. */
10908 /* ARGSUSED */
10909 int
10910 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10911     ip_ioctl_cmd_t *ipip, void *if_req)
10912 {
10913 	ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
10914 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10915 	if (!(ipif->ipif_flags & IPIF_BROADCAST))
10916 		return (EADDRNOTAVAIL);
10917 
10918 	/* IPIF_BROADCAST not possible with IPv6 */
10919 	ASSERT(!ipif->ipif_isv6);
10920 	*sin = sin_null;
10921 	sin->sin_family = AF_INET;
10922 	sin->sin_addr.s_addr = ipif->ipif_brd_addr;
10923 	return (0);
10924 }
10925 
10926 /*
10927  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
10928  */
10929 /* ARGSUSED */
10930 int
10931 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10932     ip_ioctl_cmd_t *ipip, void *if_req)
10933 {
10934 	int err = 0;
10935 	in6_addr_t v6mask;
10936 
10937 	ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
10938 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10939 
10940 	ASSERT(IAM_WRITER_IPIF(ipif));
10941 
10942 	if (ipif->ipif_isv6) {
10943 		sin6_t *sin6;
10944 
10945 		if (sin->sin_family != AF_INET6)
10946 			return (EAFNOSUPPORT);
10947 
10948 		sin6 = (sin6_t *)sin;
10949 		v6mask = sin6->sin6_addr;
10950 	} else {
10951 		ipaddr_t mask;
10952 
10953 		if (sin->sin_family != AF_INET)
10954 			return (EAFNOSUPPORT);
10955 
10956 		mask = sin->sin_addr.s_addr;
10957 		if (!ip_contiguous_mask(ntohl(mask)))
10958 			return (ENOTSUP);
10959 		V4MASK_TO_V6(mask, v6mask);
10960 	}
10961 
10962 	/*
10963 	 * No big deal if the interface isn't already up, or the mask
10964 	 * isn't really changing, or this is pt-pt.
10965 	 */
10966 	if (!(ipif->ipif_flags & IPIF_UP) ||
10967 	    IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
10968 	    (ipif->ipif_flags & IPIF_POINTOPOINT)) {
10969 		ipif->ipif_v6net_mask = v6mask;
10970 		if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10971 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
10972 			    ipif->ipif_v6net_mask,
10973 			    ipif->ipif_v6subnet);
10974 		}
10975 		return (0);
10976 	}
10977 	/*
10978 	 * Make sure we have valid net and subnet broadcast ire's
10979 	 * for the old netmask, if needed by other logical interfaces.
10980 	 */
10981 	err = ipif_logical_down(ipif, q, mp);
10982 	if (err == EINPROGRESS)
10983 		return (err);
10984 	(void) ipif_down_tail(ipif);
10985 	err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
10986 	return (err);
10987 }
10988 
10989 static int
10990 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
10991 {
10992 	in6_addr_t v6mask;
10993 	int err = 0;
10994 
10995 	ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
10996 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10997 
10998 	if (ipif->ipif_isv6) {
10999 		sin6_t *sin6;
11000 
11001 		sin6 = (sin6_t *)sin;
11002 		v6mask = sin6->sin6_addr;
11003 	} else {
11004 		ipaddr_t mask;
11005 
11006 		mask = sin->sin_addr.s_addr;
11007 		V4MASK_TO_V6(mask, v6mask);
11008 	}
11009 
11010 	ipif->ipif_v6net_mask = v6mask;
11011 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11012 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
11013 		    ipif->ipif_v6subnet);
11014 	}
11015 	err = ipif_up(ipif, q, mp);
11016 
11017 	if (err == 0 || err == EINPROGRESS) {
11018 		/*
11019 		 * The interface must be DL_BOUND if this packet has to
11020 		 * go out on the wire. Since we only go through a logical
11021 		 * down and are bound with the driver during an internal
11022 		 * down/up that is satisfied.
11023 		 */
11024 		if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
11025 			/* Potentially broadcast an address mask reply. */
11026 			ipif_mask_reply(ipif);
11027 		}
11028 	}
11029 	return (err);
11030 }
11031 
11032 /* ARGSUSED */
11033 int
11034 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11035     ip_ioctl_cmd_t *ipip, void *if_req)
11036 {
11037 	ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
11038 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11039 	(void) ipif_down_tail(ipif);
11040 	return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
11041 }
11042 
11043 /* Get interface net mask. */
11044 /* ARGSUSED */
11045 int
11046 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11047     ip_ioctl_cmd_t *ipip, void *if_req)
11048 {
11049 	struct lifreq *lifr = (struct lifreq *)if_req;
11050 	struct sockaddr_in6 *sin6 = (sin6_t *)sin;
11051 
11052 	ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
11053 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11054 
11055 	/*
11056 	 * net mask can't change since we have a reference to the ipif.
11057 	 */
11058 	if (ipif->ipif_isv6) {
11059 		ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11060 		*sin6 = sin6_null;
11061 		sin6->sin6_family = AF_INET6;
11062 		sin6->sin6_addr = ipif->ipif_v6net_mask;
11063 		lifr->lifr_addrlen =
11064 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11065 	} else {
11066 		*sin = sin_null;
11067 		sin->sin_family = AF_INET;
11068 		sin->sin_addr.s_addr = ipif->ipif_net_mask;
11069 		if (ipip->ipi_cmd_type == LIF_CMD) {
11070 			lifr->lifr_addrlen =
11071 			    ip_mask_to_plen(ipif->ipif_net_mask);
11072 		}
11073 	}
11074 	return (0);
11075 }
11076 
11077 /* ARGSUSED */
11078 int
11079 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11080     ip_ioctl_cmd_t *ipip, void *if_req)
11081 {
11082 	ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
11083 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11084 
11085 	/*
11086 	 * Since no applications should ever be setting metrics on underlying
11087 	 * interfaces, we explicitly fail to smoke 'em out.
11088 	 */
11089 	if (IS_UNDER_IPMP(ipif->ipif_ill))
11090 		return (EINVAL);
11091 
11092 	/*
11093 	 * Set interface metric.  We don't use this for
11094 	 * anything but we keep track of it in case it is
11095 	 * important to routing applications or such.
11096 	 */
11097 	if (ipip->ipi_cmd_type == IF_CMD) {
11098 		struct ifreq    *ifr;
11099 
11100 		ifr = (struct ifreq *)if_req;
11101 		ipif->ipif_ill->ill_metric = ifr->ifr_metric;
11102 	} else {
11103 		struct lifreq   *lifr;
11104 
11105 		lifr = (struct lifreq *)if_req;
11106 		ipif->ipif_ill->ill_metric = lifr->lifr_metric;
11107 	}
11108 	return (0);
11109 }
11110 
11111 /* ARGSUSED */
11112 int
11113 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11114     ip_ioctl_cmd_t *ipip, void *if_req)
11115 {
11116 	/* Get interface metric. */
11117 	ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
11118 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11119 
11120 	if (ipip->ipi_cmd_type == IF_CMD) {
11121 		struct ifreq    *ifr;
11122 
11123 		ifr = (struct ifreq *)if_req;
11124 		ifr->ifr_metric = ipif->ipif_ill->ill_metric;
11125 	} else {
11126 		struct lifreq   *lifr;
11127 
11128 		lifr = (struct lifreq *)if_req;
11129 		lifr->lifr_metric = ipif->ipif_ill->ill_metric;
11130 	}
11131 
11132 	return (0);
11133 }
11134 
11135 /* ARGSUSED */
11136 int
11137 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11138     ip_ioctl_cmd_t *ipip, void *if_req)
11139 {
11140 	int	arp_muxid;
11141 
11142 	ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
11143 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11144 	/*
11145 	 * Set the muxid returned from I_PLINK.
11146 	 */
11147 	if (ipip->ipi_cmd_type == IF_CMD) {
11148 		struct ifreq *ifr = (struct ifreq *)if_req;
11149 
11150 		ipif->ipif_ill->ill_muxid = ifr->ifr_ip_muxid;
11151 		arp_muxid = ifr->ifr_arp_muxid;
11152 	} else {
11153 		struct lifreq *lifr = (struct lifreq *)if_req;
11154 
11155 		ipif->ipif_ill->ill_muxid = lifr->lifr_ip_muxid;
11156 		arp_muxid = lifr->lifr_arp_muxid;
11157 	}
11158 	arl_set_muxid(ipif->ipif_ill, arp_muxid);
11159 	return (0);
11160 }
11161 
11162 /* ARGSUSED */
11163 int
11164 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11165     ip_ioctl_cmd_t *ipip, void *if_req)
11166 {
11167 	int	arp_muxid = 0;
11168 
11169 	ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
11170 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11171 	/*
11172 	 * Get the muxid saved in ill for I_PUNLINK.
11173 	 */
11174 	arp_muxid = arl_get_muxid(ipif->ipif_ill);
11175 	if (ipip->ipi_cmd_type == IF_CMD) {
11176 		struct ifreq *ifr = (struct ifreq *)if_req;
11177 
11178 		ifr->ifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11179 		ifr->ifr_arp_muxid = arp_muxid;
11180 	} else {
11181 		struct lifreq *lifr = (struct lifreq *)if_req;
11182 
11183 		lifr->lifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11184 		lifr->lifr_arp_muxid = arp_muxid;
11185 	}
11186 	return (0);
11187 }
11188 
11189 /*
11190  * Set the subnet prefix. Does not modify the broadcast address.
11191  */
11192 /* ARGSUSED */
11193 int
11194 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11195     ip_ioctl_cmd_t *ipip, void *if_req)
11196 {
11197 	int err = 0;
11198 	in6_addr_t v6addr;
11199 	in6_addr_t v6mask;
11200 	boolean_t need_up = B_FALSE;
11201 	int addrlen;
11202 
11203 	ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
11204 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11205 
11206 	ASSERT(IAM_WRITER_IPIF(ipif));
11207 	addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
11208 
11209 	if (ipif->ipif_isv6) {
11210 		sin6_t *sin6;
11211 
11212 		if (sin->sin_family != AF_INET6)
11213 			return (EAFNOSUPPORT);
11214 
11215 		sin6 = (sin6_t *)sin;
11216 		v6addr = sin6->sin6_addr;
11217 		if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
11218 			return (EADDRNOTAVAIL);
11219 	} else {
11220 		ipaddr_t addr;
11221 
11222 		if (sin->sin_family != AF_INET)
11223 			return (EAFNOSUPPORT);
11224 
11225 		addr = sin->sin_addr.s_addr;
11226 		if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
11227 			return (EADDRNOTAVAIL);
11228 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11229 		/* Add 96 bits */
11230 		addrlen += IPV6_ABITS - IP_ABITS;
11231 	}
11232 
11233 	if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
11234 		return (EINVAL);
11235 
11236 	/* Check if bits in the address is set past the mask */
11237 	if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
11238 		return (EINVAL);
11239 
11240 	if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
11241 	    IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
11242 		return (0);	/* No change */
11243 
11244 	if (ipif->ipif_flags & IPIF_UP) {
11245 		/*
11246 		 * If the interface is already marked up,
11247 		 * we call ipif_down which will take care
11248 		 * of ditching any IREs that have been set
11249 		 * up based on the old interface address.
11250 		 */
11251 		err = ipif_logical_down(ipif, q, mp);
11252 		if (err == EINPROGRESS)
11253 			return (err);
11254 		(void) ipif_down_tail(ipif);
11255 		need_up = B_TRUE;
11256 	}
11257 
11258 	err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
11259 	return (err);
11260 }
11261 
11262 static int
11263 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
11264     queue_t *q, mblk_t *mp, boolean_t need_up)
11265 {
11266 	ill_t	*ill = ipif->ipif_ill;
11267 	int	err = 0;
11268 
11269 	ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
11270 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11271 
11272 	/* Set the new address. */
11273 	mutex_enter(&ill->ill_lock);
11274 	ipif->ipif_v6net_mask = v6mask;
11275 	if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11276 		V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
11277 		    ipif->ipif_v6subnet);
11278 	}
11279 	mutex_exit(&ill->ill_lock);
11280 
11281 	if (need_up) {
11282 		/*
11283 		 * Now bring the interface back up.  If this
11284 		 * is the only IPIF for the ILL, ipif_up
11285 		 * will have to re-bind to the device, so
11286 		 * we may get back EINPROGRESS, in which
11287 		 * case, this IOCTL will get completed in
11288 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11289 		 */
11290 		err = ipif_up(ipif, q, mp);
11291 		if (err == EINPROGRESS)
11292 			return (err);
11293 	}
11294 	return (err);
11295 }
11296 
11297 /* ARGSUSED */
11298 int
11299 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11300     ip_ioctl_cmd_t *ipip, void *if_req)
11301 {
11302 	int	addrlen;
11303 	in6_addr_t v6addr;
11304 	in6_addr_t v6mask;
11305 	struct lifreq *lifr = (struct lifreq *)if_req;
11306 
11307 	ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
11308 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11309 	(void) ipif_down_tail(ipif);
11310 
11311 	addrlen = lifr->lifr_addrlen;
11312 	if (ipif->ipif_isv6) {
11313 		sin6_t *sin6;
11314 
11315 		sin6 = (sin6_t *)sin;
11316 		v6addr = sin6->sin6_addr;
11317 	} else {
11318 		ipaddr_t addr;
11319 
11320 		addr = sin->sin_addr.s_addr;
11321 		IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11322 		addrlen += IPV6_ABITS - IP_ABITS;
11323 	}
11324 	(void) ip_plen_to_mask_v6(addrlen, &v6mask);
11325 
11326 	return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
11327 }
11328 
11329 /* ARGSUSED */
11330 int
11331 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11332     ip_ioctl_cmd_t *ipip, void *if_req)
11333 {
11334 	struct lifreq *lifr = (struct lifreq *)if_req;
11335 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
11336 
11337 	ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
11338 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11339 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11340 
11341 	if (ipif->ipif_isv6) {
11342 		*sin6 = sin6_null;
11343 		sin6->sin6_family = AF_INET6;
11344 		sin6->sin6_addr = ipif->ipif_v6subnet;
11345 		lifr->lifr_addrlen =
11346 		    ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11347 	} else {
11348 		*sin = sin_null;
11349 		sin->sin_family = AF_INET;
11350 		sin->sin_addr.s_addr = ipif->ipif_subnet;
11351 		lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
11352 	}
11353 	return (0);
11354 }
11355 
11356 /*
11357  * Set the IPv6 address token.
11358  */
11359 /* ARGSUSED */
11360 int
11361 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11362     ip_ioctl_cmd_t *ipi, void *if_req)
11363 {
11364 	ill_t *ill = ipif->ipif_ill;
11365 	int err;
11366 	in6_addr_t v6addr;
11367 	in6_addr_t v6mask;
11368 	boolean_t need_up = B_FALSE;
11369 	int i;
11370 	sin6_t *sin6 = (sin6_t *)sin;
11371 	struct lifreq *lifr = (struct lifreq *)if_req;
11372 	int addrlen;
11373 
11374 	ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
11375 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11376 	ASSERT(IAM_WRITER_IPIF(ipif));
11377 
11378 	addrlen = lifr->lifr_addrlen;
11379 	/* Only allow for logical unit zero i.e. not on "le0:17" */
11380 	if (ipif->ipif_id != 0)
11381 		return (EINVAL);
11382 
11383 	if (!ipif->ipif_isv6)
11384 		return (EINVAL);
11385 
11386 	if (addrlen > IPV6_ABITS)
11387 		return (EINVAL);
11388 
11389 	v6addr = sin6->sin6_addr;
11390 
11391 	/*
11392 	 * The length of the token is the length from the end.  To get
11393 	 * the proper mask for this, compute the mask of the bits not
11394 	 * in the token; ie. the prefix, and then xor to get the mask.
11395 	 */
11396 	if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
11397 		return (EINVAL);
11398 	for (i = 0; i < 4; i++) {
11399 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11400 	}
11401 
11402 	if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
11403 	    ill->ill_token_length == addrlen)
11404 		return (0);	/* No change */
11405 
11406 	if (ipif->ipif_flags & IPIF_UP) {
11407 		err = ipif_logical_down(ipif, q, mp);
11408 		if (err == EINPROGRESS)
11409 			return (err);
11410 		(void) ipif_down_tail(ipif);
11411 		need_up = B_TRUE;
11412 	}
11413 	err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
11414 	return (err);
11415 }
11416 
11417 static int
11418 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
11419     mblk_t *mp, boolean_t need_up)
11420 {
11421 	in6_addr_t v6addr;
11422 	in6_addr_t v6mask;
11423 	ill_t	*ill = ipif->ipif_ill;
11424 	int	i;
11425 	int	err = 0;
11426 
11427 	ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
11428 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11429 	v6addr = sin6->sin6_addr;
11430 	/*
11431 	 * The length of the token is the length from the end.  To get
11432 	 * the proper mask for this, compute the mask of the bits not
11433 	 * in the token; ie. the prefix, and then xor to get the mask.
11434 	 */
11435 	(void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
11436 	for (i = 0; i < 4; i++)
11437 		v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11438 
11439 	mutex_enter(&ill->ill_lock);
11440 	V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
11441 	ill->ill_token_length = addrlen;
11442 	ill->ill_manual_token = 1;
11443 
11444 	/* Reconfigure the link-local address based on this new token */
11445 	ipif_setlinklocal(ill->ill_ipif);
11446 
11447 	mutex_exit(&ill->ill_lock);
11448 
11449 	if (need_up) {
11450 		/*
11451 		 * Now bring the interface back up.  If this
11452 		 * is the only IPIF for the ILL, ipif_up
11453 		 * will have to re-bind to the device, so
11454 		 * we may get back EINPROGRESS, in which
11455 		 * case, this IOCTL will get completed in
11456 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
11457 		 */
11458 		err = ipif_up(ipif, q, mp);
11459 		if (err == EINPROGRESS)
11460 			return (err);
11461 	}
11462 	return (err);
11463 }
11464 
11465 /* ARGSUSED */
11466 int
11467 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11468     ip_ioctl_cmd_t *ipi, void *if_req)
11469 {
11470 	ill_t *ill;
11471 	sin6_t *sin6 = (sin6_t *)sin;
11472 	struct lifreq *lifr = (struct lifreq *)if_req;
11473 
11474 	ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
11475 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11476 	if (ipif->ipif_id != 0)
11477 		return (EINVAL);
11478 
11479 	ill = ipif->ipif_ill;
11480 	if (!ill->ill_isv6)
11481 		return (ENXIO);
11482 
11483 	*sin6 = sin6_null;
11484 	sin6->sin6_family = AF_INET6;
11485 	ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
11486 	sin6->sin6_addr = ill->ill_token;
11487 	lifr->lifr_addrlen = ill->ill_token_length;
11488 	return (0);
11489 }
11490 
11491 /*
11492  * Set (hardware) link specific information that might override
11493  * what was acquired through the DL_INFO_ACK.
11494  */
11495 /* ARGSUSED */
11496 int
11497 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11498     ip_ioctl_cmd_t *ipi, void *if_req)
11499 {
11500 	ill_t		*ill = ipif->ipif_ill;
11501 	int		ip_min_mtu;
11502 	struct lifreq	*lifr = (struct lifreq *)if_req;
11503 	lif_ifinfo_req_t *lir;
11504 
11505 	ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
11506 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11507 	lir = &lifr->lifr_ifinfo;
11508 	ASSERT(IAM_WRITER_IPIF(ipif));
11509 
11510 	/* Only allow for logical unit zero i.e. not on "bge0:17" */
11511 	if (ipif->ipif_id != 0)
11512 		return (EINVAL);
11513 
11514 	/* Set interface MTU. */
11515 	if (ipif->ipif_isv6)
11516 		ip_min_mtu = IPV6_MIN_MTU;
11517 	else
11518 		ip_min_mtu = IP_MIN_MTU;
11519 
11520 	/*
11521 	 * Verify values before we set anything. Allow zero to
11522 	 * mean unspecified.
11523 	 *
11524 	 * XXX We should be able to set the user-defined lir_mtu to some value
11525 	 * that is greater than ill_current_frag but less than ill_max_frag- the
11526 	 * ill_max_frag value tells us the max MTU that can be handled by the
11527 	 * datalink, whereas the ill_current_frag is dynamically computed for
11528 	 * some link-types like tunnels, based on the tunnel PMTU. However,
11529 	 * since there is currently no way of distinguishing between
11530 	 * administratively fixed link mtu values (e.g., those set via
11531 	 * /sbin/dladm) and dynamically discovered MTUs (e.g., those discovered
11532 	 * for tunnels) we conservatively choose the  ill_current_frag as the
11533 	 * upper-bound.
11534 	 */
11535 	if (lir->lir_maxmtu != 0 &&
11536 	    (lir->lir_maxmtu > ill->ill_current_frag ||
11537 	    lir->lir_maxmtu < ip_min_mtu))
11538 		return (EINVAL);
11539 	if (lir->lir_reachtime != 0 &&
11540 	    lir->lir_reachtime > ND_MAX_REACHTIME)
11541 		return (EINVAL);
11542 	if (lir->lir_reachretrans != 0 &&
11543 	    lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
11544 		return (EINVAL);
11545 
11546 	mutex_enter(&ill->ill_lock);
11547 	/*
11548 	 * The dce and fragmentation code can handle changes to ill_mtu
11549 	 * concurrent with sending/fragmenting packets.
11550 	 */
11551 	if (lir->lir_maxmtu != 0)
11552 		ill->ill_user_mtu = lir->lir_maxmtu;
11553 
11554 	if (lir->lir_reachtime != 0)
11555 		ill->ill_reachable_time = lir->lir_reachtime;
11556 
11557 	if (lir->lir_reachretrans != 0)
11558 		ill->ill_reachable_retrans_time = lir->lir_reachretrans;
11559 
11560 	ill->ill_max_hops = lir->lir_maxhops;
11561 	ill->ill_max_buf = ND_MAX_Q;
11562 	if (!(ill->ill_flags & ILLF_FIXEDMTU) && ill->ill_user_mtu != 0) {
11563 		/*
11564 		 * ill_mtu is the actual interface MTU, obtained as the min
11565 		 * of user-configured mtu and the value announced by the
11566 		 * driver (via DL_NOTE_SDU_SIZE/DL_INFO_ACK). Note that since
11567 		 * we have already made the choice of requiring
11568 		 * ill_user_mtu < ill_current_frag by the time we get here,
11569 		 * the ill_mtu effectively gets assigned to the ill_user_mtu
11570 		 * here.
11571 		 */
11572 		ill->ill_mtu = MIN(ill->ill_current_frag, ill->ill_user_mtu);
11573 		ill->ill_mc_mtu = MIN(ill->ill_mc_mtu, ill->ill_user_mtu);
11574 	}
11575 	mutex_exit(&ill->ill_lock);
11576 
11577 	/*
11578 	 * Make sure all dce_generation checks find out
11579 	 * that ill_mtu/ill_mc_mtu has changed.
11580 	 */
11581 	if (!(ill->ill_flags & ILLF_FIXEDMTU) && (lir->lir_maxmtu != 0))
11582 		dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
11583 
11584 	/*
11585 	 * Refresh IPMP meta-interface MTU if necessary.
11586 	 */
11587 	if (IS_UNDER_IPMP(ill))
11588 		ipmp_illgrp_refresh_mtu(ill->ill_grp);
11589 
11590 	return (0);
11591 }
11592 
11593 /* ARGSUSED */
11594 int
11595 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11596     ip_ioctl_cmd_t *ipi, void *if_req)
11597 {
11598 	struct lif_ifinfo_req *lir;
11599 	ill_t *ill = ipif->ipif_ill;
11600 
11601 	ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
11602 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11603 	if (ipif->ipif_id != 0)
11604 		return (EINVAL);
11605 
11606 	lir = &((struct lifreq *)if_req)->lifr_ifinfo;
11607 	lir->lir_maxhops = ill->ill_max_hops;
11608 	lir->lir_reachtime = ill->ill_reachable_time;
11609 	lir->lir_reachretrans = ill->ill_reachable_retrans_time;
11610 	lir->lir_maxmtu = ill->ill_mtu;
11611 
11612 	return (0);
11613 }
11614 
11615 /*
11616  * Return best guess as to the subnet mask for the specified address.
11617  * Based on the subnet masks for all the configured interfaces.
11618  *
11619  * We end up returning a zero mask in the case of default, multicast or
11620  * experimental.
11621  */
11622 static ipaddr_t
11623 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp, ip_stack_t *ipst)
11624 {
11625 	ipaddr_t net_mask;
11626 	ill_t	*ill;
11627 	ipif_t	*ipif;
11628 	ill_walk_context_t ctx;
11629 	ipif_t	*fallback_ipif = NULL;
11630 
11631 	net_mask = ip_net_mask(addr);
11632 	if (net_mask == 0) {
11633 		*ipifp = NULL;
11634 		return (0);
11635 	}
11636 
11637 	/* Let's check to see if this is maybe a local subnet route. */
11638 	/* this function only applies to IPv4 interfaces */
11639 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
11640 	ill = ILL_START_WALK_V4(&ctx, ipst);
11641 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
11642 		mutex_enter(&ill->ill_lock);
11643 		for (ipif = ill->ill_ipif; ipif != NULL;
11644 		    ipif = ipif->ipif_next) {
11645 			if (IPIF_IS_CONDEMNED(ipif))
11646 				continue;
11647 			if (!(ipif->ipif_flags & IPIF_UP))
11648 				continue;
11649 			if ((ipif->ipif_subnet & net_mask) ==
11650 			    (addr & net_mask)) {
11651 				/*
11652 				 * Don't trust pt-pt interfaces if there are
11653 				 * other interfaces.
11654 				 */
11655 				if (ipif->ipif_flags & IPIF_POINTOPOINT) {
11656 					if (fallback_ipif == NULL) {
11657 						ipif_refhold_locked(ipif);
11658 						fallback_ipif = ipif;
11659 					}
11660 					continue;
11661 				}
11662 
11663 				/*
11664 				 * Fine. Just assume the same net mask as the
11665 				 * directly attached subnet interface is using.
11666 				 */
11667 				ipif_refhold_locked(ipif);
11668 				mutex_exit(&ill->ill_lock);
11669 				rw_exit(&ipst->ips_ill_g_lock);
11670 				if (fallback_ipif != NULL)
11671 					ipif_refrele(fallback_ipif);
11672 				*ipifp = ipif;
11673 				return (ipif->ipif_net_mask);
11674 			}
11675 		}
11676 		mutex_exit(&ill->ill_lock);
11677 	}
11678 	rw_exit(&ipst->ips_ill_g_lock);
11679 
11680 	*ipifp = fallback_ipif;
11681 	return ((fallback_ipif != NULL) ?
11682 	    fallback_ipif->ipif_net_mask : net_mask);
11683 }
11684 
11685 /*
11686  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
11687  */
11688 static void
11689 ip_wput_ioctl(queue_t *q, mblk_t *mp)
11690 {
11691 	IOCP	iocp;
11692 	ipft_t	*ipft;
11693 	ipllc_t	*ipllc;
11694 	mblk_t	*mp1;
11695 	cred_t	*cr;
11696 	int	error = 0;
11697 	conn_t	*connp;
11698 
11699 	ip1dbg(("ip_wput_ioctl"));
11700 	iocp = (IOCP)mp->b_rptr;
11701 	mp1 = mp->b_cont;
11702 	if (mp1 == NULL) {
11703 		iocp->ioc_error = EINVAL;
11704 		mp->b_datap->db_type = M_IOCNAK;
11705 		iocp->ioc_count = 0;
11706 		qreply(q, mp);
11707 		return;
11708 	}
11709 
11710 	/*
11711 	 * These IOCTLs provide various control capabilities to
11712 	 * upstream agents such as ULPs and processes.	There
11713 	 * are currently two such IOCTLs implemented.  They
11714 	 * are used by TCP to provide update information for
11715 	 * existing IREs and to forcibly delete an IRE for a
11716 	 * host that is not responding, thereby forcing an
11717 	 * attempt at a new route.
11718 	 */
11719 	iocp->ioc_error = EINVAL;
11720 	if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
11721 		goto done;
11722 
11723 	ipllc = (ipllc_t *)mp1->b_rptr;
11724 	for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
11725 		if (ipllc->ipllc_cmd == ipft->ipft_cmd)
11726 			break;
11727 	}
11728 	/*
11729 	 * prefer credential from mblk over ioctl;
11730 	 * see ip_sioctl_copyin_setup
11731 	 */
11732 	cr = msg_getcred(mp, NULL);
11733 	if (cr == NULL)
11734 		cr = iocp->ioc_cr;
11735 
11736 	/*
11737 	 * Refhold the conn in case the request gets queued up in some lookup
11738 	 */
11739 	ASSERT(CONN_Q(q));
11740 	connp = Q_TO_CONN(q);
11741 	CONN_INC_REF(connp);
11742 	CONN_INC_IOCTLREF(connp);
11743 	if (ipft->ipft_pfi &&
11744 	    ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
11745 	    pullupmsg(mp1, ipft->ipft_min_size))) {
11746 		error = (*ipft->ipft_pfi)(q,
11747 		    (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
11748 	}
11749 	if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
11750 		/*
11751 		 * CONN_OPER_PENDING_DONE happens in the function called
11752 		 * through ipft_pfi above.
11753 		 */
11754 		return;
11755 	}
11756 
11757 	CONN_DEC_IOCTLREF(connp);
11758 	CONN_OPER_PENDING_DONE(connp);
11759 	if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
11760 		freemsg(mp);
11761 		return;
11762 	}
11763 	iocp->ioc_error = error;
11764 
11765 done:
11766 	mp->b_datap->db_type = M_IOCACK;
11767 	if (iocp->ioc_error)
11768 		iocp->ioc_count = 0;
11769 	qreply(q, mp);
11770 }
11771 
11772 /*
11773  * Assign a unique id for the ipif. This is used by sctp_addr.c
11774  * Note: remove if sctp_addr.c is redone to not shadow ill/ipif data structures.
11775  */
11776 static void
11777 ipif_assign_seqid(ipif_t *ipif)
11778 {
11779 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
11780 
11781 	ipif->ipif_seqid = atomic_inc_64_nv(&ipst->ips_ipif_g_seqid);
11782 }
11783 
11784 /*
11785  * Clone the contents of `sipif' to `dipif'.  Requires that both ipifs are
11786  * administratively down (i.e., no DAD), of the same type, and locked.  Note
11787  * that the clone is complete -- including the seqid -- and the expectation is
11788  * that the caller will either free or overwrite `sipif' before it's unlocked.
11789  */
11790 static void
11791 ipif_clone(const ipif_t *sipif, ipif_t *dipif)
11792 {
11793 	ASSERT(MUTEX_HELD(&sipif->ipif_ill->ill_lock));
11794 	ASSERT(MUTEX_HELD(&dipif->ipif_ill->ill_lock));
11795 	ASSERT(!(sipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11796 	ASSERT(!(dipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11797 	ASSERT(sipif->ipif_ire_type == dipif->ipif_ire_type);
11798 
11799 	dipif->ipif_flags = sipif->ipif_flags;
11800 	dipif->ipif_zoneid = sipif->ipif_zoneid;
11801 	dipif->ipif_v6subnet = sipif->ipif_v6subnet;
11802 	dipif->ipif_v6lcl_addr = sipif->ipif_v6lcl_addr;
11803 	dipif->ipif_v6net_mask = sipif->ipif_v6net_mask;
11804 	dipif->ipif_v6brd_addr = sipif->ipif_v6brd_addr;
11805 	dipif->ipif_v6pp_dst_addr = sipif->ipif_v6pp_dst_addr;
11806 
11807 	/*
11808 	 * As per the comment atop the function, we assume that these sipif
11809 	 * fields will be changed before sipif is unlocked.
11810 	 */
11811 	dipif->ipif_seqid = sipif->ipif_seqid;
11812 	dipif->ipif_state_flags = sipif->ipif_state_flags;
11813 }
11814 
11815 /*
11816  * Transfer the contents of `sipif' to `dipif', and then free (if `virgipif'
11817  * is NULL) or overwrite `sipif' with `virgipif', which must be a virgin
11818  * (unreferenced) ipif.  Also, if `sipif' is used by the current xop, then
11819  * transfer the xop to `dipif'.  Requires that all ipifs are administratively
11820  * down (i.e., no DAD), of the same type, and unlocked.
11821  */
11822 static void
11823 ipif_transfer(ipif_t *sipif, ipif_t *dipif, ipif_t *virgipif)
11824 {
11825 	ipsq_t *ipsq = sipif->ipif_ill->ill_phyint->phyint_ipsq;
11826 	ipxop_t *ipx = ipsq->ipsq_xop;
11827 
11828 	ASSERT(sipif != dipif);
11829 	ASSERT(sipif != virgipif);
11830 
11831 	/*
11832 	 * Grab all of the locks that protect the ipif in a defined order.
11833 	 */
11834 	GRAB_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11835 
11836 	ipif_clone(sipif, dipif);
11837 	if (virgipif != NULL) {
11838 		ipif_clone(virgipif, sipif);
11839 		mi_free(virgipif);
11840 	}
11841 
11842 	RELEASE_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11843 
11844 	/*
11845 	 * Transfer ownership of the current xop, if necessary.
11846 	 */
11847 	if (ipx->ipx_current_ipif == sipif) {
11848 		ASSERT(ipx->ipx_pending_ipif == NULL);
11849 		mutex_enter(&ipx->ipx_lock);
11850 		ipx->ipx_current_ipif = dipif;
11851 		mutex_exit(&ipx->ipx_lock);
11852 	}
11853 
11854 	if (virgipif == NULL)
11855 		mi_free(sipif);
11856 }
11857 
11858 /*
11859  * checks if:
11860  *	- <ill_name>:<ipif_id> is at most LIFNAMSIZ - 1 and
11861  *	- logical interface is within the allowed range
11862  */
11863 static int
11864 is_lifname_valid(ill_t *ill, unsigned int ipif_id)
11865 {
11866 	if (snprintf(NULL, 0, "%s:%d", ill->ill_name, ipif_id) >= LIFNAMSIZ)
11867 		return (ENAMETOOLONG);
11868 
11869 	if (ipif_id >= ill->ill_ipst->ips_ip_addrs_per_if)
11870 		return (ERANGE);
11871 	return (0);
11872 }
11873 
11874 /*
11875  * Insert the ipif, so that the list of ipifs on the ill will be sorted
11876  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
11877  * be inserted into the first space available in the list. The value of
11878  * ipif_id will then be set to the appropriate value for its position.
11879  */
11880 static int
11881 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock)
11882 {
11883 	ill_t *ill;
11884 	ipif_t *tipif;
11885 	ipif_t **tipifp;
11886 	int id, err;
11887 	ip_stack_t	*ipst;
11888 
11889 	ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
11890 	    IAM_WRITER_IPIF(ipif));
11891 
11892 	ill = ipif->ipif_ill;
11893 	ASSERT(ill != NULL);
11894 	ipst = ill->ill_ipst;
11895 
11896 	/*
11897 	 * In the case of lo0:0 we already hold the ill_g_lock.
11898 	 * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
11899 	 * ipif_insert.
11900 	 */
11901 	if (acquire_g_lock)
11902 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
11903 	mutex_enter(&ill->ill_lock);
11904 	id = ipif->ipif_id;
11905 	tipifp = &(ill->ill_ipif);
11906 	if (id == -1) {	/* need to find a real id */
11907 		id = 0;
11908 		while ((tipif = *tipifp) != NULL) {
11909 			ASSERT(tipif->ipif_id >= id);
11910 			if (tipif->ipif_id != id)
11911 				break; /* non-consecutive id */
11912 			id++;
11913 			tipifp = &(tipif->ipif_next);
11914 		}
11915 		if ((err = is_lifname_valid(ill, id)) != 0) {
11916 			mutex_exit(&ill->ill_lock);
11917 			if (acquire_g_lock)
11918 				rw_exit(&ipst->ips_ill_g_lock);
11919 			return (err);
11920 		}
11921 		ipif->ipif_id = id; /* assign new id */
11922 	} else if ((err = is_lifname_valid(ill, id)) == 0) {
11923 		/* we have a real id; insert ipif in the right place */
11924 		while ((tipif = *tipifp) != NULL) {
11925 			ASSERT(tipif->ipif_id != id);
11926 			if (tipif->ipif_id > id)
11927 				break; /* found correct location */
11928 			tipifp = &(tipif->ipif_next);
11929 		}
11930 	} else {
11931 		mutex_exit(&ill->ill_lock);
11932 		if (acquire_g_lock)
11933 			rw_exit(&ipst->ips_ill_g_lock);
11934 		return (err);
11935 	}
11936 
11937 	ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
11938 
11939 	ipif->ipif_next = tipif;
11940 	*tipifp = ipif;
11941 	mutex_exit(&ill->ill_lock);
11942 	if (acquire_g_lock)
11943 		rw_exit(&ipst->ips_ill_g_lock);
11944 
11945 	return (0);
11946 }
11947 
11948 static void
11949 ipif_remove(ipif_t *ipif)
11950 {
11951 	ipif_t	**ipifp;
11952 	ill_t	*ill = ipif->ipif_ill;
11953 
11954 	ASSERT(RW_WRITE_HELD(&ill->ill_ipst->ips_ill_g_lock));
11955 
11956 	mutex_enter(&ill->ill_lock);
11957 	ipifp = &ill->ill_ipif;
11958 	for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
11959 		if (*ipifp == ipif) {
11960 			*ipifp = ipif->ipif_next;
11961 			break;
11962 		}
11963 	}
11964 	mutex_exit(&ill->ill_lock);
11965 }
11966 
11967 /*
11968  * Allocate and initialize a new interface control structure.  (Always
11969  * called as writer.)
11970  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
11971  * is not part of the global linked list of ills. ipif_seqid is unique
11972  * in the system and to preserve the uniqueness, it is assigned only
11973  * when ill becomes part of the global list. At that point ill will
11974  * have a name. If it doesn't get assigned here, it will get assigned
11975  * in ipif_set_values() as part of SIOCSLIFNAME processing.
11976  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
11977  * the interface flags or any other information from the DL_INFO_ACK for
11978  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
11979  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
11980  * second DL_INFO_ACK comes in from the driver.
11981  */
11982 static ipif_t *
11983 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize,
11984     boolean_t insert, int *errorp)
11985 {
11986 	int err;
11987 	ipif_t	*ipif;
11988 	ip_stack_t *ipst = ill->ill_ipst;
11989 
11990 	ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
11991 	    ill->ill_name, id, (void *)ill));
11992 	ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
11993 
11994 	if (errorp != NULL)
11995 		*errorp = 0;
11996 
11997 	if ((ipif = mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL) {
11998 		if (errorp != NULL)
11999 			*errorp = ENOMEM;
12000 		return (NULL);
12001 	}
12002 	*ipif = ipif_zero;	/* start clean */
12003 
12004 	ipif->ipif_ill = ill;
12005 	ipif->ipif_id = id;	/* could be -1 */
12006 	/*
12007 	 * Inherit the zoneid from the ill; for the shared stack instance
12008 	 * this is always the global zone
12009 	 */
12010 	ipif->ipif_zoneid = ill->ill_zoneid;
12011 
12012 	ipif->ipif_refcnt = 0;
12013 
12014 	if (insert) {
12015 		if ((err = ipif_insert(ipif, ire_type != IRE_LOOPBACK)) != 0) {
12016 			mi_free(ipif);
12017 			if (errorp != NULL)
12018 				*errorp = err;
12019 			return (NULL);
12020 		}
12021 		/* -1 id should have been replaced by real id */
12022 		id = ipif->ipif_id;
12023 		ASSERT(id >= 0);
12024 	}
12025 
12026 	if (ill->ill_name[0] != '\0')
12027 		ipif_assign_seqid(ipif);
12028 
12029 	/*
12030 	 * If this is the zeroth ipif on the IPMP ill, create the illgrp
12031 	 * (which must not exist yet because the zeroth ipif is created once
12032 	 * per ill).  However, do not not link it to the ipmp_grp_t until
12033 	 * I_PLINK is called; see ip_sioctl_plink_ipmp() for details.
12034 	 */
12035 	if (id == 0 && IS_IPMP(ill)) {
12036 		if (ipmp_illgrp_create(ill) == NULL) {
12037 			if (insert) {
12038 				rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
12039 				ipif_remove(ipif);
12040 				rw_exit(&ipst->ips_ill_g_lock);
12041 			}
12042 			mi_free(ipif);
12043 			if (errorp != NULL)
12044 				*errorp = ENOMEM;
12045 			return (NULL);
12046 		}
12047 	}
12048 
12049 	/*
12050 	 * We grab ill_lock to protect the flag changes.  The ipif is still
12051 	 * not up and can't be looked up until the ioctl completes and the
12052 	 * IPIF_CHANGING flag is cleared.
12053 	 */
12054 	mutex_enter(&ill->ill_lock);
12055 
12056 	ipif->ipif_ire_type = ire_type;
12057 
12058 	if (ipif->ipif_isv6) {
12059 		ill->ill_flags |= ILLF_IPV6;
12060 	} else {
12061 		ipaddr_t inaddr_any = INADDR_ANY;
12062 
12063 		ill->ill_flags |= ILLF_IPV4;
12064 
12065 		/* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
12066 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12067 		    &ipif->ipif_v6lcl_addr);
12068 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12069 		    &ipif->ipif_v6subnet);
12070 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12071 		    &ipif->ipif_v6net_mask);
12072 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12073 		    &ipif->ipif_v6brd_addr);
12074 		IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12075 		    &ipif->ipif_v6pp_dst_addr);
12076 	}
12077 
12078 	/*
12079 	 * Don't set the interface flags etc. now, will do it in
12080 	 * ip_ll_subnet_defaults.
12081 	 */
12082 	if (!initialize)
12083 		goto out;
12084 
12085 	/*
12086 	 * NOTE: The IPMP meta-interface is special-cased because it starts
12087 	 * with no underlying interfaces (and thus an unknown broadcast
12088 	 * address length), but all interfaces that can be placed into an IPMP
12089 	 * group are required to be broadcast-capable.
12090 	 */
12091 	if (ill->ill_bcast_addr_length != 0 || IS_IPMP(ill)) {
12092 		/*
12093 		 * Later detect lack of DLPI driver multicast capability by
12094 		 * catching DL_ENABMULTI_REQ errors in ip_rput_dlpi().
12095 		 */
12096 		ill->ill_flags |= ILLF_MULTICAST;
12097 		if (!ipif->ipif_isv6)
12098 			ipif->ipif_flags |= IPIF_BROADCAST;
12099 	} else {
12100 		if (ill->ill_net_type != IRE_LOOPBACK) {
12101 			if (ipif->ipif_isv6)
12102 				/*
12103 				 * Note: xresolv interfaces will eventually need
12104 				 * NOARP set here as well, but that will require
12105 				 * those external resolvers to have some
12106 				 * knowledge of that flag and act appropriately.
12107 				 * Not to be changed at present.
12108 				 */
12109 				ill->ill_flags |= ILLF_NONUD;
12110 			else
12111 				ill->ill_flags |= ILLF_NOARP;
12112 		}
12113 		if (ill->ill_phys_addr_length == 0) {
12114 			if (IS_VNI(ill)) {
12115 				ipif->ipif_flags |= IPIF_NOXMIT;
12116 			} else {
12117 				/* pt-pt supports multicast. */
12118 				ill->ill_flags |= ILLF_MULTICAST;
12119 				if (ill->ill_net_type != IRE_LOOPBACK)
12120 					ipif->ipif_flags |= IPIF_POINTOPOINT;
12121 			}
12122 		}
12123 	}
12124 out:
12125 	mutex_exit(&ill->ill_lock);
12126 	return (ipif);
12127 }
12128 
12129 /*
12130  * Remove the neighbor cache entries associated with this logical
12131  * interface.
12132  */
12133 int
12134 ipif_arp_down(ipif_t *ipif)
12135 {
12136 	ill_t	*ill = ipif->ipif_ill;
12137 	int	err = 0;
12138 
12139 	ip1dbg(("ipif_arp_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
12140 	ASSERT(IAM_WRITER_IPIF(ipif));
12141 
12142 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_down",
12143 	    ill_t *, ill, ipif_t *, ipif);
12144 	ipif_nce_down(ipif);
12145 
12146 	/*
12147 	 * If this is the last ipif that is going down and there are no
12148 	 * duplicate addresses we may yet attempt to re-probe, then we need to
12149 	 * clean up ARP completely.
12150 	 */
12151 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
12152 	    !ill->ill_logical_down && ill->ill_net_type == IRE_IF_RESOLVER) {
12153 		/*
12154 		 * If this was the last ipif on an IPMP interface, purge any
12155 		 * static ARP entries associated with it.
12156 		 */
12157 		if (IS_IPMP(ill))
12158 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
12159 
12160 		/* UNBIND, DETACH */
12161 		err = arp_ll_down(ill);
12162 	}
12163 
12164 	return (err);
12165 }
12166 
12167 /*
12168  * Get the resolver set up for a new IP address.  (Always called as writer.)
12169  * Called both for IPv4 and IPv6 interfaces, though it only does some
12170  * basic DAD related initialization for IPv6. Honors ILLF_NOARP.
12171  *
12172  * The enumerated value res_act tunes the behavior:
12173  *	* Res_act_initial: set up all the resolver structures for a new
12174  *	  IP address.
12175  *	* Res_act_defend: tell ARP that it needs to send a single gratuitous
12176  *	  ARP message in defense of the address.
12177  *	* Res_act_rebind: tell ARP to change the hardware address for an IP
12178  *	  address (and issue gratuitous ARPs).  Used by ipmp_ill_bind_ipif().
12179  *
12180  * Returns zero on success, or an errno upon failure.
12181  */
12182 int
12183 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
12184 {
12185 	ill_t		*ill = ipif->ipif_ill;
12186 	int		err;
12187 	boolean_t	was_dup;
12188 
12189 	ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
12190 	    ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
12191 	ASSERT(IAM_WRITER_IPIF(ipif));
12192 
12193 	was_dup = B_FALSE;
12194 	if (res_act == Res_act_initial) {
12195 		ipif->ipif_addr_ready = 0;
12196 		/*
12197 		 * We're bringing an interface up here.  There's no way that we
12198 		 * should need to shut down ARP now.
12199 		 */
12200 		mutex_enter(&ill->ill_lock);
12201 		if (ipif->ipif_flags & IPIF_DUPLICATE) {
12202 			ipif->ipif_flags &= ~IPIF_DUPLICATE;
12203 			ill->ill_ipif_dup_count--;
12204 			was_dup = B_TRUE;
12205 		}
12206 		mutex_exit(&ill->ill_lock);
12207 	}
12208 	if (ipif->ipif_recovery_id != 0)
12209 		(void) untimeout(ipif->ipif_recovery_id);
12210 	ipif->ipif_recovery_id = 0;
12211 	if (ill->ill_net_type != IRE_IF_RESOLVER) {
12212 		ipif->ipif_addr_ready = 1;
12213 		return (0);
12214 	}
12215 	/* NDP will set the ipif_addr_ready flag when it's ready */
12216 	if (ill->ill_isv6)
12217 		return (0);
12218 
12219 	err = ipif_arp_up(ipif, res_act, was_dup);
12220 	return (err);
12221 }
12222 
12223 /*
12224  * This routine restarts IPv4/IPv6 duplicate address detection (DAD)
12225  * when a link has just gone back up.
12226  */
12227 static void
12228 ipif_nce_start_dad(ipif_t *ipif)
12229 {
12230 	ncec_t *ncec;
12231 	ill_t *ill = ipif->ipif_ill;
12232 	boolean_t isv6 = ill->ill_isv6;
12233 
12234 	if (isv6) {
12235 		ncec = ncec_lookup_illgrp_v6(ipif->ipif_ill,
12236 		    &ipif->ipif_v6lcl_addr);
12237 	} else {
12238 		ipaddr_t v4addr;
12239 
12240 		if (ill->ill_net_type != IRE_IF_RESOLVER ||
12241 		    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
12242 		    ipif->ipif_lcl_addr == INADDR_ANY) {
12243 			/*
12244 			 * If we can't contact ARP for some reason,
12245 			 * that's not really a problem.  Just send
12246 			 * out the routing socket notification that
12247 			 * DAD completion would have done, and continue.
12248 			 */
12249 			ipif_mask_reply(ipif);
12250 			ipif_up_notify(ipif);
12251 			ipif->ipif_addr_ready = 1;
12252 			return;
12253 		}
12254 
12255 		IN6_V4MAPPED_TO_IPADDR(&ipif->ipif_v6lcl_addr, v4addr);
12256 		ncec = ncec_lookup_illgrp_v4(ipif->ipif_ill, &v4addr);
12257 	}
12258 
12259 	if (ncec == NULL) {
12260 		ip1dbg(("couldn't find ncec for ipif %p leaving !ready\n",
12261 		    (void *)ipif));
12262 		return;
12263 	}
12264 	if (!nce_restart_dad(ncec)) {
12265 		/*
12266 		 * If we can't restart DAD for some reason, that's not really a
12267 		 * problem.  Just send out the routing socket notification that
12268 		 * DAD completion would have done, and continue.
12269 		 */
12270 		ipif_up_notify(ipif);
12271 		ipif->ipif_addr_ready = 1;
12272 	}
12273 	ncec_refrele(ncec);
12274 }
12275 
12276 /*
12277  * Restart duplicate address detection on all interfaces on the given ill.
12278  *
12279  * This is called when an interface transitions from down to up
12280  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
12281  *
12282  * Note that since the underlying physical link has transitioned, we must cause
12283  * at least one routing socket message to be sent here, either via DAD
12284  * completion or just by default on the first ipif.  (If we don't do this, then
12285  * in.mpathd will see long delays when doing link-based failure recovery.)
12286  */
12287 void
12288 ill_restart_dad(ill_t *ill, boolean_t went_up)
12289 {
12290 	ipif_t *ipif;
12291 
12292 	if (ill == NULL)
12293 		return;
12294 
12295 	/*
12296 	 * If layer two doesn't support duplicate address detection, then just
12297 	 * send the routing socket message now and be done with it.
12298 	 */
12299 	if (!ill->ill_isv6 && arp_no_defense) {
12300 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12301 		return;
12302 	}
12303 
12304 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12305 		if (went_up) {
12306 
12307 			if (ipif->ipif_flags & IPIF_UP) {
12308 				ipif_nce_start_dad(ipif);
12309 			} else if (ipif->ipif_flags & IPIF_DUPLICATE) {
12310 				/*
12311 				 * kick off the bring-up process now.
12312 				 */
12313 				ipif_do_recovery(ipif);
12314 			} else {
12315 				/*
12316 				 * Unfortunately, the first ipif is "special"
12317 				 * and represents the underlying ill in the
12318 				 * routing socket messages.  Thus, when this
12319 				 * one ipif is down, we must still notify so
12320 				 * that the user knows the IFF_RUNNING status
12321 				 * change.  (If the first ipif is up, then
12322 				 * we'll handle eventual routing socket
12323 				 * notification via DAD completion.)
12324 				 */
12325 				if (ipif == ill->ill_ipif) {
12326 					ip_rts_ifmsg(ill->ill_ipif,
12327 					    RTSQ_DEFAULT);
12328 				}
12329 			}
12330 		} else {
12331 			/*
12332 			 * After link down, we'll need to send a new routing
12333 			 * message when the link comes back, so clear
12334 			 * ipif_addr_ready.
12335 			 */
12336 			ipif->ipif_addr_ready = 0;
12337 		}
12338 	}
12339 
12340 	/*
12341 	 * If we've torn down links, then notify the user right away.
12342 	 */
12343 	if (!went_up)
12344 		ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12345 }
12346 
12347 static void
12348 ipsq_delete(ipsq_t *ipsq)
12349 {
12350 	ipxop_t *ipx = ipsq->ipsq_xop;
12351 
12352 	ipsq->ipsq_ipst = NULL;
12353 	ASSERT(ipsq->ipsq_phyint == NULL);
12354 	ASSERT(ipsq->ipsq_xop != NULL);
12355 	ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipx->ipx_mphead == NULL);
12356 	ASSERT(ipx->ipx_pending_mp == NULL);
12357 	kmem_free(ipsq, sizeof (ipsq_t));
12358 }
12359 
12360 static int
12361 ill_up_ipifs_on_ill(ill_t *ill, queue_t *q, mblk_t *mp)
12362 {
12363 	int err = 0;
12364 	ipif_t *ipif;
12365 
12366 	if (ill == NULL)
12367 		return (0);
12368 
12369 	ASSERT(IAM_WRITER_ILL(ill));
12370 	ill->ill_up_ipifs = B_TRUE;
12371 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12372 		if (ipif->ipif_was_up) {
12373 			if (!(ipif->ipif_flags & IPIF_UP))
12374 				err = ipif_up(ipif, q, mp);
12375 			ipif->ipif_was_up = B_FALSE;
12376 			if (err != 0) {
12377 				ASSERT(err == EINPROGRESS);
12378 				return (err);
12379 			}
12380 		}
12381 	}
12382 	ill->ill_up_ipifs = B_FALSE;
12383 	return (0);
12384 }
12385 
12386 /*
12387  * This function is called to bring up all the ipifs that were up before
12388  * bringing the ill down via ill_down_ipifs().
12389  */
12390 int
12391 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
12392 {
12393 	int err;
12394 
12395 	ASSERT(IAM_WRITER_ILL(ill));
12396 
12397 	if (ill->ill_replumbing) {
12398 		ill->ill_replumbing = 0;
12399 		/*
12400 		 * Send down REPLUMB_DONE notification followed by the
12401 		 * BIND_REQ on the arp stream.
12402 		 */
12403 		if (!ill->ill_isv6)
12404 			arp_send_replumb_conf(ill);
12405 	}
12406 	err = ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv4, q, mp);
12407 	if (err != 0)
12408 		return (err);
12409 
12410 	return (ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv6, q, mp));
12411 }
12412 
12413 /*
12414  * Bring down any IPIF_UP ipifs on ill. If "logical" is B_TRUE, we bring
12415  * down the ipifs without sending DL_UNBIND_REQ to the driver.
12416  */
12417 static void
12418 ill_down_ipifs(ill_t *ill, boolean_t logical)
12419 {
12420 	ipif_t *ipif;
12421 
12422 	ASSERT(IAM_WRITER_ILL(ill));
12423 
12424 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12425 		/*
12426 		 * We go through the ipif_down logic even if the ipif
12427 		 * is already down, since routes can be added based
12428 		 * on down ipifs. Going through ipif_down once again
12429 		 * will delete any IREs created based on these routes.
12430 		 */
12431 		if (ipif->ipif_flags & IPIF_UP)
12432 			ipif->ipif_was_up = B_TRUE;
12433 
12434 		if (logical) {
12435 			(void) ipif_logical_down(ipif, NULL, NULL);
12436 			ipif_non_duplicate(ipif);
12437 			(void) ipif_down_tail(ipif);
12438 		} else {
12439 			(void) ipif_down(ipif, NULL, NULL);
12440 		}
12441 	}
12442 }
12443 
12444 /*
12445  * Redo source address selection.  This makes IXAF_VERIFY_SOURCE take
12446  * a look again at valid source addresses.
12447  * This should be called each time after the set of source addresses has been
12448  * changed.
12449  */
12450 void
12451 ip_update_source_selection(ip_stack_t *ipst)
12452 {
12453 	/* We skip past SRC_GENERATION_VERIFY */
12454 	if (atomic_inc_32_nv(&ipst->ips_src_generation) ==
12455 	    SRC_GENERATION_VERIFY)
12456 		atomic_inc_32(&ipst->ips_src_generation);
12457 }
12458 
12459 /*
12460  * Finish the group join started in ip_sioctl_groupname().
12461  */
12462 /* ARGSUSED */
12463 static void
12464 ip_join_illgrps(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
12465 {
12466 	ill_t		*ill = q->q_ptr;
12467 	phyint_t	*phyi = ill->ill_phyint;
12468 	ipmp_grp_t	*grp = phyi->phyint_grp;
12469 	ip_stack_t	*ipst = ill->ill_ipst;
12470 
12471 	/* IS_UNDER_IPMP() won't work until ipmp_ill_join_illgrp() is called */
12472 	ASSERT(!IS_IPMP(ill) && grp != NULL);
12473 	ASSERT(IAM_WRITER_IPSQ(ipsq));
12474 
12475 	if (phyi->phyint_illv4 != NULL) {
12476 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12477 		VERIFY(grp->gr_pendv4-- > 0);
12478 		rw_exit(&ipst->ips_ipmp_lock);
12479 		ipmp_ill_join_illgrp(phyi->phyint_illv4, grp->gr_v4);
12480 	}
12481 	if (phyi->phyint_illv6 != NULL) {
12482 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12483 		VERIFY(grp->gr_pendv6-- > 0);
12484 		rw_exit(&ipst->ips_ipmp_lock);
12485 		ipmp_ill_join_illgrp(phyi->phyint_illv6, grp->gr_v6);
12486 	}
12487 	freemsg(mp);
12488 }
12489 
12490 /*
12491  * Process an SIOCSLIFGROUPNAME request.
12492  */
12493 /* ARGSUSED */
12494 int
12495 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12496     ip_ioctl_cmd_t *ipip, void *ifreq)
12497 {
12498 	struct lifreq	*lifr = ifreq;
12499 	ill_t		*ill = ipif->ipif_ill;
12500 	ip_stack_t	*ipst = ill->ill_ipst;
12501 	phyint_t	*phyi = ill->ill_phyint;
12502 	ipmp_grp_t	*grp = phyi->phyint_grp;
12503 	mblk_t		*ipsq_mp;
12504 	int		err = 0;
12505 
12506 	/*
12507 	 * Note that phyint_grp can only change here, where we're exclusive.
12508 	 */
12509 	ASSERT(IAM_WRITER_ILL(ill));
12510 
12511 	if (ipif->ipif_id != 0 || ill->ill_usesrc_grp_next != NULL ||
12512 	    (phyi->phyint_flags & PHYI_VIRTUAL))
12513 		return (EINVAL);
12514 
12515 	lifr->lifr_groupname[LIFGRNAMSIZ - 1] = '\0';
12516 
12517 	rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12518 
12519 	/*
12520 	 * If the name hasn't changed, there's nothing to do.
12521 	 */
12522 	if (grp != NULL && strcmp(grp->gr_name, lifr->lifr_groupname) == 0)
12523 		goto unlock;
12524 
12525 	/*
12526 	 * Handle requests to rename an IPMP meta-interface.
12527 	 *
12528 	 * Note that creation of the IPMP meta-interface is handled in
12529 	 * userland through the standard plumbing sequence.  As part of the
12530 	 * plumbing the IPMP meta-interface, its initial groupname is set to
12531 	 * the name of the interface (see ipif_set_values_tail()).
12532 	 */
12533 	if (IS_IPMP(ill)) {
12534 		err = ipmp_grp_rename(grp, lifr->lifr_groupname);
12535 		goto unlock;
12536 	}
12537 
12538 	/*
12539 	 * Handle requests to add or remove an IP interface from a group.
12540 	 */
12541 	if (lifr->lifr_groupname[0] != '\0') {			/* add */
12542 		/*
12543 		 * Moves are handled by first removing the interface from
12544 		 * its existing group, and then adding it to another group.
12545 		 * So, fail if it's already in a group.
12546 		 */
12547 		if (IS_UNDER_IPMP(ill)) {
12548 			err = EALREADY;
12549 			goto unlock;
12550 		}
12551 
12552 		grp = ipmp_grp_lookup(lifr->lifr_groupname, ipst);
12553 		if (grp == NULL) {
12554 			err = ENOENT;
12555 			goto unlock;
12556 		}
12557 
12558 		/*
12559 		 * Check if the phyint and its ills are suitable for
12560 		 * inclusion into the group.
12561 		 */
12562 		if ((err = ipmp_grp_vet_phyint(grp, phyi)) != 0)
12563 			goto unlock;
12564 
12565 		/*
12566 		 * Checks pass; join the group, and enqueue the remaining
12567 		 * illgrp joins for when we've become part of the group xop
12568 		 * and are exclusive across its IPSQs.  Since qwriter_ip()
12569 		 * requires an mblk_t to scribble on, and since `mp' will be
12570 		 * freed as part of completing the ioctl, allocate another.
12571 		 */
12572 		if ((ipsq_mp = allocb(0, BPRI_MED)) == NULL) {
12573 			err = ENOMEM;
12574 			goto unlock;
12575 		}
12576 
12577 		/*
12578 		 * Before we drop ipmp_lock, bump gr_pend* to ensure that the
12579 		 * IPMP meta-interface ills needed by `phyi' cannot go away
12580 		 * before ip_join_illgrps() is called back.  See the comments
12581 		 * in ip_sioctl_plink_ipmp() for more.
12582 		 */
12583 		if (phyi->phyint_illv4 != NULL)
12584 			grp->gr_pendv4++;
12585 		if (phyi->phyint_illv6 != NULL)
12586 			grp->gr_pendv6++;
12587 
12588 		rw_exit(&ipst->ips_ipmp_lock);
12589 
12590 		ipmp_phyint_join_grp(phyi, grp);
12591 		ill_refhold(ill);
12592 		qwriter_ip(ill, ill->ill_rq, ipsq_mp, ip_join_illgrps,
12593 		    SWITCH_OP, B_FALSE);
12594 		return (0);
12595 	} else {
12596 		/*
12597 		 * Request to remove the interface from a group.  If the
12598 		 * interface is not in a group, this trivially succeeds.
12599 		 */
12600 		rw_exit(&ipst->ips_ipmp_lock);
12601 		if (IS_UNDER_IPMP(ill))
12602 			ipmp_phyint_leave_grp(phyi);
12603 		return (0);
12604 	}
12605 unlock:
12606 	rw_exit(&ipst->ips_ipmp_lock);
12607 	return (err);
12608 }
12609 
12610 /*
12611  * Process an SIOCGLIFBINDING request.
12612  */
12613 /* ARGSUSED */
12614 int
12615 ip_sioctl_get_binding(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12616     ip_ioctl_cmd_t *ipip, void *ifreq)
12617 {
12618 	ill_t		*ill;
12619 	struct lifreq	*lifr = ifreq;
12620 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12621 
12622 	if (!IS_IPMP(ipif->ipif_ill))
12623 		return (EINVAL);
12624 
12625 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12626 	if ((ill = ipif->ipif_bound_ill) == NULL)
12627 		lifr->lifr_binding[0] = '\0';
12628 	else
12629 		(void) strlcpy(lifr->lifr_binding, ill->ill_name, LIFNAMSIZ);
12630 	rw_exit(&ipst->ips_ipmp_lock);
12631 	return (0);
12632 }
12633 
12634 /*
12635  * Process an SIOCGLIFGROUPNAME request.
12636  */
12637 /* ARGSUSED */
12638 int
12639 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12640     ip_ioctl_cmd_t *ipip, void *ifreq)
12641 {
12642 	ipmp_grp_t	*grp;
12643 	struct lifreq	*lifr = ifreq;
12644 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
12645 
12646 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12647 	if ((grp = ipif->ipif_ill->ill_phyint->phyint_grp) == NULL)
12648 		lifr->lifr_groupname[0] = '\0';
12649 	else
12650 		(void) strlcpy(lifr->lifr_groupname, grp->gr_name, LIFGRNAMSIZ);
12651 	rw_exit(&ipst->ips_ipmp_lock);
12652 	return (0);
12653 }
12654 
12655 /*
12656  * Process an SIOCGLIFGROUPINFO request.
12657  */
12658 /* ARGSUSED */
12659 int
12660 ip_sioctl_groupinfo(ipif_t *dummy_ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12661     ip_ioctl_cmd_t *ipip, void *dummy)
12662 {
12663 	ipmp_grp_t	*grp;
12664 	lifgroupinfo_t	*lifgr;
12665 	ip_stack_t	*ipst = CONNQ_TO_IPST(q);
12666 
12667 	/* ip_wput_nondata() verified mp->b_cont->b_cont */
12668 	lifgr = (lifgroupinfo_t *)mp->b_cont->b_cont->b_rptr;
12669 	lifgr->gi_grname[LIFGRNAMSIZ - 1] = '\0';
12670 
12671 	rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12672 	if ((grp = ipmp_grp_lookup(lifgr->gi_grname, ipst)) == NULL) {
12673 		rw_exit(&ipst->ips_ipmp_lock);
12674 		return (ENOENT);
12675 	}
12676 	ipmp_grp_info(grp, lifgr);
12677 	rw_exit(&ipst->ips_ipmp_lock);
12678 	return (0);
12679 }
12680 
12681 static void
12682 ill_dl_down(ill_t *ill)
12683 {
12684 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_down", ill_t *, ill);
12685 
12686 	/*
12687 	 * The ill is down; unbind but stay attached since we're still
12688 	 * associated with a PPA. If we have negotiated DLPI capabilites
12689 	 * with the data link service provider (IDS_OK) then reset them.
12690 	 * The interval between unbinding and rebinding is potentially
12691 	 * unbounded hence we cannot assume things will be the same.
12692 	 * The DLPI capabilities will be probed again when the data link
12693 	 * is brought up.
12694 	 */
12695 	mblk_t	*mp = ill->ill_unbind_mp;
12696 
12697 	ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
12698 
12699 	if (!ill->ill_replumbing) {
12700 		/* Free all ilms for this ill */
12701 		update_conn_ill(ill, ill->ill_ipst);
12702 	} else {
12703 		ill_leave_multicast(ill);
12704 	}
12705 
12706 	ill->ill_unbind_mp = NULL;
12707 	if (mp != NULL) {
12708 		ip1dbg(("ill_dl_down: %s (%u) for %s\n",
12709 		    dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
12710 		    ill->ill_name));
12711 		mutex_enter(&ill->ill_lock);
12712 		ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
12713 		mutex_exit(&ill->ill_lock);
12714 		/*
12715 		 * ip_rput does not pass up normal (M_PROTO) DLPI messages
12716 		 * after ILL_CONDEMNED is set. So in the unplumb case, we call
12717 		 * ill_capability_dld_disable disable rightaway. If this is not
12718 		 * an unplumb operation then the disable happens on receipt of
12719 		 * the capab ack via ip_rput_dlpi_writer ->
12720 		 * ill_capability_ack_thr. In both cases the order of
12721 		 * the operations seen by DLD is capability disable followed
12722 		 * by DL_UNBIND. Also the DLD capability disable needs a
12723 		 * cv_wait'able context.
12724 		 */
12725 		if (ill->ill_state_flags & ILL_CONDEMNED)
12726 			ill_capability_dld_disable(ill);
12727 		ill_capability_reset(ill, B_FALSE);
12728 		ill_dlpi_send(ill, mp);
12729 	}
12730 	mutex_enter(&ill->ill_lock);
12731 	ill->ill_dl_up = 0;
12732 	ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
12733 	mutex_exit(&ill->ill_lock);
12734 }
12735 
12736 void
12737 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
12738 {
12739 	union DL_primitives *dlp;
12740 	t_uscalar_t prim;
12741 	boolean_t waitack = B_FALSE;
12742 
12743 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12744 
12745 	dlp = (union DL_primitives *)mp->b_rptr;
12746 	prim = dlp->dl_primitive;
12747 
12748 	ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
12749 	    dl_primstr(prim), prim, ill->ill_name));
12750 
12751 	switch (prim) {
12752 	case DL_PHYS_ADDR_REQ:
12753 	{
12754 		dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
12755 		ill->ill_phys_addr_pend = dlpap->dl_addr_type;
12756 		break;
12757 	}
12758 	case DL_BIND_REQ:
12759 		mutex_enter(&ill->ill_lock);
12760 		ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
12761 		mutex_exit(&ill->ill_lock);
12762 		break;
12763 	}
12764 
12765 	/*
12766 	 * Except for the ACKs for the M_PCPROTO messages, all other ACKs
12767 	 * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
12768 	 * we only wait for the ACK of the DL_UNBIND_REQ.
12769 	 */
12770 	mutex_enter(&ill->ill_lock);
12771 	if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
12772 	    (prim == DL_UNBIND_REQ)) {
12773 		ill->ill_dlpi_pending = prim;
12774 		waitack = B_TRUE;
12775 	}
12776 
12777 	mutex_exit(&ill->ill_lock);
12778 	DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_dispatch",
12779 	    char *, dl_primstr(prim), ill_t *, ill);
12780 	putnext(ill->ill_wq, mp);
12781 
12782 	/*
12783 	 * There is no ack for DL_NOTIFY_CONF messages
12784 	 */
12785 	if (waitack && prim == DL_NOTIFY_CONF)
12786 		ill_dlpi_done(ill, prim);
12787 }
12788 
12789 /*
12790  * Helper function for ill_dlpi_send().
12791  */
12792 /* ARGSUSED */
12793 static void
12794 ill_dlpi_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
12795 {
12796 	ill_dlpi_send(q->q_ptr, mp);
12797 }
12798 
12799 /*
12800  * Send a DLPI control message to the driver but make sure there
12801  * is only one outstanding message. Uses ill_dlpi_pending to tell
12802  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
12803  * when an ACK or a NAK is received to process the next queued message.
12804  */
12805 void
12806 ill_dlpi_send(ill_t *ill, mblk_t *mp)
12807 {
12808 	mblk_t **mpp;
12809 
12810 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12811 
12812 	/*
12813 	 * To ensure that any DLPI requests for current exclusive operation
12814 	 * are always completely sent before any DLPI messages for other
12815 	 * operations, require writer access before enqueuing.
12816 	 */
12817 	if (!IAM_WRITER_ILL(ill)) {
12818 		ill_refhold(ill);
12819 		/* qwriter_ip() does the ill_refrele() */
12820 		qwriter_ip(ill, ill->ill_wq, mp, ill_dlpi_send_writer,
12821 		    NEW_OP, B_TRUE);
12822 		return;
12823 	}
12824 
12825 	mutex_enter(&ill->ill_lock);
12826 	if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
12827 		/* Must queue message. Tail insertion */
12828 		mpp = &ill->ill_dlpi_deferred;
12829 		while (*mpp != NULL)
12830 			mpp = &((*mpp)->b_next);
12831 
12832 		ip1dbg(("ill_dlpi_send: deferring request for %s "
12833 		    "while %s pending\n", ill->ill_name,
12834 		    dl_primstr(ill->ill_dlpi_pending)));
12835 
12836 		*mpp = mp;
12837 		mutex_exit(&ill->ill_lock);
12838 		return;
12839 	}
12840 	mutex_exit(&ill->ill_lock);
12841 	ill_dlpi_dispatch(ill, mp);
12842 }
12843 
12844 void
12845 ill_capability_send(ill_t *ill, mblk_t *mp)
12846 {
12847 	ill->ill_capab_pending_cnt++;
12848 	ill_dlpi_send(ill, mp);
12849 }
12850 
12851 void
12852 ill_capability_done(ill_t *ill)
12853 {
12854 	ASSERT(ill->ill_capab_pending_cnt != 0);
12855 
12856 	ill_dlpi_done(ill, DL_CAPABILITY_REQ);
12857 
12858 	ill->ill_capab_pending_cnt--;
12859 	if (ill->ill_capab_pending_cnt == 0 &&
12860 	    ill->ill_dlpi_capab_state == IDCS_OK)
12861 		ill_capability_reset_alloc(ill);
12862 }
12863 
12864 /*
12865  * Send all deferred DLPI messages without waiting for their ACKs.
12866  */
12867 void
12868 ill_dlpi_send_deferred(ill_t *ill)
12869 {
12870 	mblk_t *mp, *nextmp;
12871 
12872 	/*
12873 	 * Clear ill_dlpi_pending so that the message is not queued in
12874 	 * ill_dlpi_send().
12875 	 */
12876 	mutex_enter(&ill->ill_lock);
12877 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
12878 	mp = ill->ill_dlpi_deferred;
12879 	ill->ill_dlpi_deferred = NULL;
12880 	mutex_exit(&ill->ill_lock);
12881 
12882 	for (; mp != NULL; mp = nextmp) {
12883 		nextmp = mp->b_next;
12884 		mp->b_next = NULL;
12885 		ill_dlpi_send(ill, mp);
12886 	}
12887 }
12888 
12889 /*
12890  * Clear all the deferred DLPI messages. Called on receiving an M_ERROR
12891  * or M_HANGUP
12892  */
12893 static void
12894 ill_dlpi_clear_deferred(ill_t *ill)
12895 {
12896 	mblk_t	*mp, *nextmp;
12897 
12898 	mutex_enter(&ill->ill_lock);
12899 	ill->ill_dlpi_pending = DL_PRIM_INVAL;
12900 	mp = ill->ill_dlpi_deferred;
12901 	ill->ill_dlpi_deferred = NULL;
12902 	mutex_exit(&ill->ill_lock);
12903 
12904 	for (; mp != NULL; mp = nextmp) {
12905 		nextmp = mp->b_next;
12906 		inet_freemsg(mp);
12907 	}
12908 }
12909 
12910 /*
12911  * Check if the DLPI primitive `prim' is pending; print a warning if not.
12912  */
12913 boolean_t
12914 ill_dlpi_pending(ill_t *ill, t_uscalar_t prim)
12915 {
12916 	t_uscalar_t pending;
12917 
12918 	mutex_enter(&ill->ill_lock);
12919 	if (ill->ill_dlpi_pending == prim) {
12920 		mutex_exit(&ill->ill_lock);
12921 		return (B_TRUE);
12922 	}
12923 
12924 	/*
12925 	 * During teardown, ill_dlpi_dispatch() will send DLPI requests
12926 	 * without waiting, so don't print any warnings in that case.
12927 	 */
12928 	if (ill->ill_state_flags & ILL_CONDEMNED) {
12929 		mutex_exit(&ill->ill_lock);
12930 		return (B_FALSE);
12931 	}
12932 	pending = ill->ill_dlpi_pending;
12933 	mutex_exit(&ill->ill_lock);
12934 
12935 	if (pending == DL_PRIM_INVAL) {
12936 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12937 		    "received unsolicited ack for %s on %s\n",
12938 		    dl_primstr(prim), ill->ill_name);
12939 	} else {
12940 		(void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12941 		    "received unexpected ack for %s on %s (expecting %s)\n",
12942 		    dl_primstr(prim), ill->ill_name, dl_primstr(pending));
12943 	}
12944 	return (B_FALSE);
12945 }
12946 
12947 /*
12948  * Complete the current DLPI operation associated with `prim' on `ill' and
12949  * start the next queued DLPI operation (if any).  If there are no queued DLPI
12950  * operations and the ill's current exclusive IPSQ operation has finished
12951  * (i.e., ipsq_current_finish() was called), then clear ipsq_current_ipif to
12952  * allow the next exclusive IPSQ operation to begin upon ipsq_exit().  See
12953  * the comments above ipsq_current_finish() for details.
12954  */
12955 void
12956 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
12957 {
12958 	mblk_t *mp;
12959 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
12960 	ipxop_t *ipx = ipsq->ipsq_xop;
12961 
12962 	ASSERT(IAM_WRITER_IPSQ(ipsq));
12963 	mutex_enter(&ill->ill_lock);
12964 
12965 	ASSERT(prim != DL_PRIM_INVAL);
12966 	ASSERT(ill->ill_dlpi_pending == prim);
12967 
12968 	ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
12969 	    dl_primstr(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
12970 
12971 	if ((mp = ill->ill_dlpi_deferred) == NULL) {
12972 		ill->ill_dlpi_pending = DL_PRIM_INVAL;
12973 		if (ipx->ipx_current_done) {
12974 			mutex_enter(&ipx->ipx_lock);
12975 			ipx->ipx_current_ipif = NULL;
12976 			mutex_exit(&ipx->ipx_lock);
12977 		}
12978 		cv_signal(&ill->ill_cv);
12979 		mutex_exit(&ill->ill_lock);
12980 		return;
12981 	}
12982 
12983 	ill->ill_dlpi_deferred = mp->b_next;
12984 	mp->b_next = NULL;
12985 	mutex_exit(&ill->ill_lock);
12986 
12987 	ill_dlpi_dispatch(ill, mp);
12988 }
12989 
12990 /*
12991  * Queue a (multicast) DLPI control message to be sent to the driver by
12992  * later calling ill_dlpi_send_queued.
12993  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
12994  * are sent in order i.e., prevent a DL_DISABMULTI_REQ and DL_ENABMULTI_REQ
12995  * for the same group to race.
12996  * We send DLPI control messages in order using ill_lock.
12997  * For IPMP we should be called on the cast_ill.
12998  */
12999 void
13000 ill_dlpi_queue(ill_t *ill, mblk_t *mp)
13001 {
13002 	mblk_t **mpp;
13003 
13004 	ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
13005 
13006 	mutex_enter(&ill->ill_lock);
13007 	/* Must queue message. Tail insertion */
13008 	mpp = &ill->ill_dlpi_deferred;
13009 	while (*mpp != NULL)
13010 		mpp = &((*mpp)->b_next);
13011 
13012 	*mpp = mp;
13013 	mutex_exit(&ill->ill_lock);
13014 }
13015 
13016 /*
13017  * Send the messages that were queued. Make sure there is only
13018  * one outstanding message. ip_rput_dlpi_writer calls ill_dlpi_done()
13019  * when an ACK or a NAK is received to process the next queued message.
13020  * For IPMP we are called on the upper ill, but when send what is queued
13021  * on the cast_ill.
13022  */
13023 void
13024 ill_dlpi_send_queued(ill_t *ill)
13025 {
13026 	mblk_t	*mp;
13027 	union DL_primitives *dlp;
13028 	t_uscalar_t prim;
13029 	ill_t *release_ill = NULL;
13030 
13031 	if (IS_IPMP(ill)) {
13032 		/* On the upper IPMP ill. */
13033 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13034 		if (release_ill == NULL) {
13035 			/* Avoid ever sending anything down to the ipmpstub */
13036 			return;
13037 		}
13038 		ill = release_ill;
13039 	}
13040 	mutex_enter(&ill->ill_lock);
13041 	while ((mp = ill->ill_dlpi_deferred) != NULL) {
13042 		if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
13043 			/* Can't send. Somebody else will send it */
13044 			mutex_exit(&ill->ill_lock);
13045 			goto done;
13046 		}
13047 		ill->ill_dlpi_deferred = mp->b_next;
13048 		mp->b_next = NULL;
13049 		if (!ill->ill_dl_up) {
13050 			/*
13051 			 * Nobody there. All multicast addresses will be
13052 			 * re-joined when we get the DL_BIND_ACK bringing the
13053 			 * interface up.
13054 			 */
13055 			freemsg(mp);
13056 			continue;
13057 		}
13058 		dlp = (union DL_primitives *)mp->b_rptr;
13059 		prim = dlp->dl_primitive;
13060 
13061 		if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
13062 		    (prim == DL_UNBIND_REQ)) {
13063 			ill->ill_dlpi_pending = prim;
13064 		}
13065 		mutex_exit(&ill->ill_lock);
13066 
13067 		DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_send_queued",
13068 		    char *, dl_primstr(prim), ill_t *, ill);
13069 		putnext(ill->ill_wq, mp);
13070 		mutex_enter(&ill->ill_lock);
13071 	}
13072 	mutex_exit(&ill->ill_lock);
13073 done:
13074 	if (release_ill != NULL)
13075 		ill_refrele(release_ill);
13076 }
13077 
13078 /*
13079  * Queue an IP (IGMP/MLD) message to be sent by IP from
13080  * ill_mcast_send_queued
13081  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
13082  * are sent in order i.e., prevent a IGMP leave and IGMP join for the same
13083  * group to race.
13084  * We send them in order using ill_lock.
13085  * For IPMP we are called on the upper ill, but we queue on the cast_ill.
13086  */
13087 void
13088 ill_mcast_queue(ill_t *ill, mblk_t *mp)
13089 {
13090 	mblk_t **mpp;
13091 	ill_t *release_ill = NULL;
13092 
13093 	ASSERT(RW_LOCK_HELD(&ill->ill_mcast_lock));
13094 
13095 	if (IS_IPMP(ill)) {
13096 		/* On the upper IPMP ill. */
13097 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13098 		if (release_ill == NULL) {
13099 			/* Discard instead of queuing for the ipmp interface */
13100 			BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
13101 			ip_drop_output("ipIfStatsOutDiscards - no cast_ill",
13102 			    mp, ill);
13103 			freemsg(mp);
13104 			return;
13105 		}
13106 		ill = release_ill;
13107 	}
13108 
13109 	mutex_enter(&ill->ill_lock);
13110 	/* Must queue message. Tail insertion */
13111 	mpp = &ill->ill_mcast_deferred;
13112 	while (*mpp != NULL)
13113 		mpp = &((*mpp)->b_next);
13114 
13115 	*mpp = mp;
13116 	mutex_exit(&ill->ill_lock);
13117 	if (release_ill != NULL)
13118 		ill_refrele(release_ill);
13119 }
13120 
13121 /*
13122  * Send the IP packets that were queued by ill_mcast_queue.
13123  * These are IGMP/MLD packets.
13124  *
13125  * For IPMP we are called on the upper ill, but when send what is queued
13126  * on the cast_ill.
13127  *
13128  * Request loopback of the report if we are acting as a multicast
13129  * router, so that the process-level routing demon can hear it.
13130  * This will run multiple times for the same group if there are members
13131  * on the same group for multiple ipif's on the same ill. The
13132  * igmp_input/mld_input code will suppress this due to the loopback thus we
13133  * always loopback membership report.
13134  *
13135  * We also need to make sure that this does not get load balanced
13136  * by IPMP. We do this by passing an ill to ip_output_simple.
13137  */
13138 void
13139 ill_mcast_send_queued(ill_t *ill)
13140 {
13141 	mblk_t	*mp;
13142 	ip_xmit_attr_t ixas;
13143 	ill_t *release_ill = NULL;
13144 
13145 	if (IS_IPMP(ill)) {
13146 		/* On the upper IPMP ill. */
13147 		release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13148 		if (release_ill == NULL) {
13149 			/*
13150 			 * We should have no messages on the ipmp interface
13151 			 * but no point in trying to send them.
13152 			 */
13153 			return;
13154 		}
13155 		ill = release_ill;
13156 	}
13157 	bzero(&ixas, sizeof (ixas));
13158 	ixas.ixa_zoneid = ALL_ZONES;
13159 	ixas.ixa_cred = kcred;
13160 	ixas.ixa_cpid = NOPID;
13161 	ixas.ixa_tsl = NULL;
13162 	/*
13163 	 * Here we set ixa_ifindex. If IPMP it will be the lower ill which
13164 	 * makes ip_select_route pick the IRE_MULTICAST for the cast_ill.
13165 	 * That is necessary to handle IGMP/MLD snooping switches.
13166 	 */
13167 	ixas.ixa_ifindex = ill->ill_phyint->phyint_ifindex;
13168 	ixas.ixa_ipst = ill->ill_ipst;
13169 
13170 	mutex_enter(&ill->ill_lock);
13171 	while ((mp = ill->ill_mcast_deferred) != NULL) {
13172 		ill->ill_mcast_deferred = mp->b_next;
13173 		mp->b_next = NULL;
13174 		if (!ill->ill_dl_up) {
13175 			/*
13176 			 * Nobody there. Just drop the ip packets.
13177 			 * IGMP/MLD will resend later, if this is a replumb.
13178 			 */
13179 			freemsg(mp);
13180 			continue;
13181 		}
13182 		mutex_enter(&ill->ill_phyint->phyint_lock);
13183 		if (IS_UNDER_IPMP(ill) && !ipmp_ill_is_active(ill)) {
13184 			/*
13185 			 * When the ill is getting deactivated, we only want to
13186 			 * send the DLPI messages, so drop IGMP/MLD packets.
13187 			 * DLPI messages are handled by ill_dlpi_send_queued()
13188 			 */
13189 			mutex_exit(&ill->ill_phyint->phyint_lock);
13190 			freemsg(mp);
13191 			continue;
13192 		}
13193 		mutex_exit(&ill->ill_phyint->phyint_lock);
13194 		mutex_exit(&ill->ill_lock);
13195 
13196 		/* Check whether we are sending IPv4 or IPv6. */
13197 		if (ill->ill_isv6) {
13198 			ip6_t  *ip6h = (ip6_t *)mp->b_rptr;
13199 
13200 			ixas.ixa_multicast_ttl = ip6h->ip6_hops;
13201 			ixas.ixa_flags = IXAF_BASIC_SIMPLE_V6;
13202 		} else {
13203 			ipha_t *ipha = (ipha_t *)mp->b_rptr;
13204 
13205 			ixas.ixa_multicast_ttl = ipha->ipha_ttl;
13206 			ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13207 			ixas.ixa_flags &= ~IXAF_SET_ULP_CKSUM;
13208 		}
13209 		ixas.ixa_flags &= ~IXAF_VERIFY_SOURCE;
13210 		ixas.ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_SOURCE;
13211 		(void) ip_output_simple(mp, &ixas);
13212 		ixa_cleanup(&ixas);
13213 
13214 		mutex_enter(&ill->ill_lock);
13215 	}
13216 	mutex_exit(&ill->ill_lock);
13217 
13218 done:
13219 	if (release_ill != NULL)
13220 		ill_refrele(release_ill);
13221 }
13222 
13223 /*
13224  * Take down a specific interface, but don't lose any information about it.
13225  * (Always called as writer.)
13226  * This function goes through the down sequence even if the interface is
13227  * already down. There are 2 reasons.
13228  * a. Currently we permit interface routes that depend on down interfaces
13229  *    to be added. This behaviour itself is questionable. However it appears
13230  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
13231  *    time. We go thru the cleanup in order to remove these routes.
13232  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
13233  *    DL_ERROR_ACK in response to the DL_BIND request. The interface is
13234  *    down, but we need to cleanup i.e. do ill_dl_down and
13235  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
13236  *
13237  * IP-MT notes:
13238  *
13239  * Model of reference to interfaces.
13240  *
13241  * The following members in ipif_t track references to the ipif.
13242  *	int     ipif_refcnt;    Active reference count
13243  *
13244  * The following members in ill_t track references to the ill.
13245  *	int             ill_refcnt;     active refcnt
13246  *	uint_t          ill_ire_cnt;	Number of ires referencing ill
13247  *	uint_t          ill_ncec_cnt;	Number of ncecs referencing ill
13248  *	uint_t          ill_nce_cnt;	Number of nces referencing ill
13249  *	uint_t          ill_ilm_cnt;	Number of ilms referencing ill
13250  *
13251  * Reference to an ipif or ill can be obtained in any of the following ways.
13252  *
13253  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
13254  * Pointers to ipif / ill from other data structures viz ire and conn.
13255  * Implicit reference to the ipif / ill by holding a reference to the ire.
13256  *
13257  * The ipif/ill lookup functions return a reference held ipif / ill.
13258  * ipif_refcnt and ill_refcnt track the reference counts respectively.
13259  * This is a purely dynamic reference count associated with threads holding
13260  * references to the ipif / ill. Pointers from other structures do not
13261  * count towards this reference count.
13262  *
13263  * ill_ire_cnt is the number of ire's associated with the
13264  * ill. This is incremented whenever a new ire is created referencing the
13265  * ill. This is done atomically inside ire_add_v[46] where the ire is
13266  * actually added to the ire hash table. The count is decremented in
13267  * ire_inactive where the ire is destroyed.
13268  *
13269  * ill_ncec_cnt is the number of ncec's referencing the ill thru ncec_ill.
13270  * This is incremented atomically in
13271  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
13272  * table. Similarly it is decremented in ncec_inactive() where the ncec
13273  * is destroyed.
13274  *
13275  * ill_nce_cnt is the number of nce's referencing the ill thru nce_ill. This is
13276  * incremented atomically in nce_add() where the nce is actually added to the
13277  * ill_nce. Similarly it is decremented in nce_inactive() where the nce
13278  * is destroyed.
13279  *
13280  * ill_ilm_cnt is the ilm's reference to the ill. It is incremented in
13281  * ilm_add() and decremented before the ilm is freed in ilm_delete().
13282  *
13283  * Flow of ioctls involving interface down/up
13284  *
13285  * The following is the sequence of an attempt to set some critical flags on an
13286  * up interface.
13287  * ip_sioctl_flags
13288  * ipif_down
13289  * wait for ipif to be quiescent
13290  * ipif_down_tail
13291  * ip_sioctl_flags_tail
13292  *
13293  * All set ioctls that involve down/up sequence would have a skeleton similar
13294  * to the above. All the *tail functions are called after the refcounts have
13295  * dropped to the appropriate values.
13296  *
13297  * SIOC ioctls during the IPIF_CHANGING interval.
13298  *
13299  * Threads handling SIOC set ioctls serialize on the squeue, but this
13300  * is not done for SIOC get ioctls. Since a set ioctl can cause several
13301  * steps of internal changes to the state, some of which are visible in
13302  * ipif_flags (such as IFF_UP being cleared and later set), and we want
13303  * the set ioctl to be atomic related to the get ioctls, the SIOC get code
13304  * will wait and restart ioctls if IPIF_CHANGING is set. The mblk is then
13305  * enqueued in the ipsq and the operation is restarted by ipsq_exit() when
13306  * the current exclusive operation completes. The IPIF_CHANGING check
13307  * and enqueue is atomic using the ill_lock and ipsq_lock. The
13308  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
13309  * change while the ill_lock is held. Before dropping the ill_lock we acquire
13310  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
13311  * until we release the ipsq_lock, even though the ill/ipif state flags
13312  * can change after we drop the ill_lock.
13313  */
13314 int
13315 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13316 {
13317 	ill_t		*ill = ipif->ipif_ill;
13318 	conn_t		*connp;
13319 	boolean_t	success;
13320 	boolean_t	ipif_was_up = B_FALSE;
13321 	ip_stack_t	*ipst = ill->ill_ipst;
13322 
13323 	ASSERT(IAM_WRITER_IPIF(ipif));
13324 
13325 	ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13326 
13327 	DTRACE_PROBE3(ipif__downup, char *, "ipif_down",
13328 	    ill_t *, ill, ipif_t *, ipif);
13329 
13330 	if (ipif->ipif_flags & IPIF_UP) {
13331 		mutex_enter(&ill->ill_lock);
13332 		ipif->ipif_flags &= ~IPIF_UP;
13333 		ASSERT(ill->ill_ipif_up_count > 0);
13334 		--ill->ill_ipif_up_count;
13335 		mutex_exit(&ill->ill_lock);
13336 		ipif_was_up = B_TRUE;
13337 		/* Update status in SCTP's list */
13338 		sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
13339 		ill_nic_event_dispatch(ipif->ipif_ill,
13340 		    MAP_IPIF_ID(ipif->ipif_id), NE_LIF_DOWN, NULL, 0);
13341 	}
13342 
13343 	/*
13344 	 * Removal of the last ipif from an ill may result in a DL_UNBIND
13345 	 * being sent to the driver, and we must not send any data packets to
13346 	 * the driver after the DL_UNBIND_REQ. To ensure this, all the
13347 	 * ire and nce entries used in the data path will be cleaned
13348 	 * up, and we also set  the ILL_DOWN_IN_PROGRESS bit to make
13349 	 * sure on new entries will be added until the ill is bound
13350 	 * again. The ILL_DOWN_IN_PROGRESS bit is turned off upon
13351 	 * receipt of a DL_BIND_ACK.
13352 	 */
13353 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13354 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13355 	    ill->ill_dl_up) {
13356 		ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
13357 	}
13358 
13359 	/*
13360 	 * Blow away memberships we established in ipif_multicast_up().
13361 	 */
13362 	ipif_multicast_down(ipif);
13363 
13364 	/*
13365 	 * Remove from the mapping for __sin6_src_id. We insert only
13366 	 * when the address is not INADDR_ANY. As IPv4 addresses are
13367 	 * stored as mapped addresses, we need to check for mapped
13368 	 * INADDR_ANY also.
13369 	 */
13370 	if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
13371 	    !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
13372 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
13373 		int err;
13374 
13375 		err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
13376 		    ipif->ipif_zoneid, ipst);
13377 		if (err != 0) {
13378 			ip0dbg(("ipif_down: srcid_remove %d\n", err));
13379 		}
13380 	}
13381 
13382 	if (ipif_was_up) {
13383 		/* only delete if we'd added ire's before */
13384 		if (ipif->ipif_isv6)
13385 			ipif_delete_ires_v6(ipif);
13386 		else
13387 			ipif_delete_ires_v4(ipif);
13388 	}
13389 
13390 	if (ipif_was_up && ill->ill_ipif_up_count == 0) {
13391 		/*
13392 		 * Since the interface is now down, it may have just become
13393 		 * inactive.  Note that this needs to be done even for a
13394 		 * lll_logical_down(), or ARP entries will not get correctly
13395 		 * restored when the interface comes back up.
13396 		 */
13397 		if (IS_UNDER_IPMP(ill))
13398 			ipmp_ill_refresh_active(ill);
13399 	}
13400 
13401 	/*
13402 	 * neighbor-discovery or arp entries for this interface. The ipif
13403 	 * has to be quiesced, so we walk all the nce's and delete those
13404 	 * that point at the ipif->ipif_ill. At the same time, we also
13405 	 * update IPMP so that ipifs for data addresses are unbound. We dont
13406 	 * call ipif_arp_down to DL_UNBIND the arp stream itself here, but defer
13407 	 * that for ipif_down_tail()
13408 	 */
13409 	ipif_nce_down(ipif);
13410 
13411 	/*
13412 	 * If this is the last ipif on the ill, we also need to remove
13413 	 * any IREs with ire_ill set. Otherwise ipif_is_quiescent() will
13414 	 * never succeed.
13415 	 */
13416 	if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0)
13417 		ire_walk_ill(0, 0, ill_downi, ill, ill);
13418 
13419 	/*
13420 	 * Walk all CONNs that can have a reference on an ire for this
13421 	 * ipif (we actually walk all that now have stale references).
13422 	 */
13423 	ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
13424 
13425 	/*
13426 	 * If mp is NULL the caller will wait for the appropriate refcnt.
13427 	 * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
13428 	 * and ill_delete -> ipif_free -> ipif_down
13429 	 */
13430 	if (mp == NULL) {
13431 		ASSERT(q == NULL);
13432 		return (0);
13433 	}
13434 
13435 	if (CONN_Q(q)) {
13436 		connp = Q_TO_CONN(q);
13437 		mutex_enter(&connp->conn_lock);
13438 	} else {
13439 		connp = NULL;
13440 	}
13441 	mutex_enter(&ill->ill_lock);
13442 	/*
13443 	 * Are there any ire's pointing to this ipif that are still active ?
13444 	 * If this is the last ipif going down, are there any ire's pointing
13445 	 * to this ill that are still active ?
13446 	 */
13447 	if (ipif_is_quiescent(ipif)) {
13448 		mutex_exit(&ill->ill_lock);
13449 		if (connp != NULL)
13450 			mutex_exit(&connp->conn_lock);
13451 		return (0);
13452 	}
13453 
13454 	ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
13455 	    ill->ill_name, (void *)ill));
13456 	/*
13457 	 * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
13458 	 * drops down, the operation will be restarted by ipif_ill_refrele_tail
13459 	 * which in turn is called by the last refrele on the ipif/ill/ire.
13460 	 */
13461 	success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
13462 	if (!success) {
13463 		/* The conn is closing. So just return */
13464 		ASSERT(connp != NULL);
13465 		mutex_exit(&ill->ill_lock);
13466 		mutex_exit(&connp->conn_lock);
13467 		return (EINTR);
13468 	}
13469 
13470 	mutex_exit(&ill->ill_lock);
13471 	if (connp != NULL)
13472 		mutex_exit(&connp->conn_lock);
13473 	return (EINPROGRESS);
13474 }
13475 
13476 int
13477 ipif_down_tail(ipif_t *ipif)
13478 {
13479 	ill_t	*ill = ipif->ipif_ill;
13480 	int	err = 0;
13481 
13482 	DTRACE_PROBE3(ipif__downup, char *, "ipif_down_tail",
13483 	    ill_t *, ill, ipif_t *, ipif);
13484 
13485 	/*
13486 	 * Skip any loopback interface (null wq).
13487 	 * If this is the last logical interface on the ill
13488 	 * have ill_dl_down tell the driver we are gone (unbind)
13489 	 * Note that lun 0 can ipif_down even though
13490 	 * there are other logical units that are up.
13491 	 * This occurs e.g. when we change a "significant" IFF_ flag.
13492 	 */
13493 	if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13494 	    ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13495 	    ill->ill_dl_up) {
13496 		ill_dl_down(ill);
13497 	}
13498 	if (!ipif->ipif_isv6)
13499 		err = ipif_arp_down(ipif);
13500 
13501 	ill->ill_logical_down = 0;
13502 
13503 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
13504 	ip_rts_newaddrmsg(RTM_DELETE, 0, ipif, RTSQ_DEFAULT);
13505 	return (err);
13506 }
13507 
13508 /*
13509  * Bring interface logically down without bringing the physical interface
13510  * down e.g. when the netmask is changed. This avoids long lasting link
13511  * negotiations between an ethernet interface and a certain switches.
13512  */
13513 static int
13514 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13515 {
13516 	DTRACE_PROBE3(ipif__downup, char *, "ipif_logical_down",
13517 	    ill_t *, ipif->ipif_ill, ipif_t *, ipif);
13518 
13519 	/*
13520 	 * The ill_logical_down flag is a transient flag. It is set here
13521 	 * and is cleared once the down has completed in ipif_down_tail.
13522 	 * This flag does not indicate whether the ill stream is in the
13523 	 * DL_BOUND state with the driver. Instead this flag is used by
13524 	 * ipif_down_tail to determine whether to DL_UNBIND the stream with
13525 	 * the driver. The state of the ill stream i.e. whether it is
13526 	 * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
13527 	 */
13528 	ipif->ipif_ill->ill_logical_down = 1;
13529 	return (ipif_down(ipif, q, mp));
13530 }
13531 
13532 /*
13533  * Initiate deallocate of an IPIF. Always called as writer. Called by
13534  * ill_delete or ip_sioctl_removeif.
13535  */
13536 static void
13537 ipif_free(ipif_t *ipif)
13538 {
13539 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13540 
13541 	ASSERT(IAM_WRITER_IPIF(ipif));
13542 
13543 	if (ipif->ipif_recovery_id != 0)
13544 		(void) untimeout(ipif->ipif_recovery_id);
13545 	ipif->ipif_recovery_id = 0;
13546 
13547 	/*
13548 	 * Take down the interface. We can be called either from ill_delete
13549 	 * or from ip_sioctl_removeif.
13550 	 */
13551 	(void) ipif_down(ipif, NULL, NULL);
13552 
13553 	/*
13554 	 * Now that the interface is down, there's no chance it can still
13555 	 * become a duplicate.  Cancel any timer that may have been set while
13556 	 * tearing down.
13557 	 */
13558 	if (ipif->ipif_recovery_id != 0)
13559 		(void) untimeout(ipif->ipif_recovery_id);
13560 	ipif->ipif_recovery_id = 0;
13561 
13562 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13563 	/* Remove pointers to this ill in the multicast routing tables */
13564 	reset_mrt_vif_ipif(ipif);
13565 	/* If necessary, clear the cached source ipif rotor. */
13566 	if (ipif->ipif_ill->ill_src_ipif == ipif)
13567 		ipif->ipif_ill->ill_src_ipif = NULL;
13568 	rw_exit(&ipst->ips_ill_g_lock);
13569 }
13570 
13571 static void
13572 ipif_free_tail(ipif_t *ipif)
13573 {
13574 	ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
13575 
13576 	/*
13577 	 * Need to hold both ill_g_lock and ill_lock while
13578 	 * inserting or removing an ipif from the linked list
13579 	 * of ipifs hanging off the ill.
13580 	 */
13581 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13582 
13583 #ifdef DEBUG
13584 	ipif_trace_cleanup(ipif);
13585 #endif
13586 
13587 	/* Ask SCTP to take it out of it list */
13588 	sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
13589 	ip_rts_newaddrmsg(RTM_FREEADDR, 0, ipif, RTSQ_DEFAULT);
13590 
13591 	/* Get it out of the ILL interface list. */
13592 	ipif_remove(ipif);
13593 	rw_exit(&ipst->ips_ill_g_lock);
13594 
13595 	ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
13596 	ASSERT(ipif->ipif_recovery_id == 0);
13597 	ASSERT(ipif->ipif_ire_local == NULL);
13598 	ASSERT(ipif->ipif_ire_if == NULL);
13599 
13600 	/* Free the memory. */
13601 	mi_free(ipif);
13602 }
13603 
13604 /*
13605  * Sets `buf' to an ipif name of the form "ill_name:id", or "ill_name" if "id"
13606  * is zero.
13607  */
13608 void
13609 ipif_get_name(const ipif_t *ipif, char *buf, int len)
13610 {
13611 	char	lbuf[LIFNAMSIZ];
13612 	char	*name;
13613 	size_t	name_len;
13614 
13615 	buf[0] = '\0';
13616 	name = ipif->ipif_ill->ill_name;
13617 	name_len = ipif->ipif_ill->ill_name_length;
13618 	if (ipif->ipif_id != 0) {
13619 		(void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
13620 		    ipif->ipif_id);
13621 		name = lbuf;
13622 		name_len = mi_strlen(name) + 1;
13623 	}
13624 	len -= 1;
13625 	buf[len] = '\0';
13626 	len = MIN(len, name_len);
13627 	bcopy(name, buf, len);
13628 }
13629 
13630 /*
13631  * Sets `buf' to an ill name.
13632  */
13633 void
13634 ill_get_name(const ill_t *ill, char *buf, int len)
13635 {
13636 	char	*name;
13637 	size_t	name_len;
13638 
13639 	name = ill->ill_name;
13640 	name_len = ill->ill_name_length;
13641 	len -= 1;
13642 	buf[len] = '\0';
13643 	len = MIN(len, name_len);
13644 	bcopy(name, buf, len);
13645 }
13646 
13647 /*
13648  * Find an IPIF based on the name passed in.  Names can be of the form <phys>
13649  * (e.g., le0) or <phys>:<#> (e.g., le0:1).  When there is no colon, the
13650  * implied unit id is zero. <phys> must correspond to the name of an ILL.
13651  * (May be called as writer.)
13652  */
13653 static ipif_t *
13654 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
13655     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, ip_stack_t *ipst)
13656 {
13657 	char	*cp;
13658 	char	*endp;
13659 	long	id;
13660 	ill_t	*ill;
13661 	ipif_t	*ipif;
13662 	uint_t	ire_type;
13663 	boolean_t did_alloc = B_FALSE;
13664 	char	last;
13665 
13666 	/*
13667 	 * If the caller wants to us to create the ipif, make sure we have a
13668 	 * valid zoneid
13669 	 */
13670 	ASSERT(!do_alloc || zoneid != ALL_ZONES);
13671 
13672 	if (namelen == 0) {
13673 		return (NULL);
13674 	}
13675 
13676 	*exists = B_FALSE;
13677 	/* Look for a colon in the name. */
13678 	endp = &name[namelen];
13679 	for (cp = endp; --cp > name; ) {
13680 		if (*cp == IPIF_SEPARATOR_CHAR)
13681 			break;
13682 	}
13683 
13684 	if (*cp == IPIF_SEPARATOR_CHAR) {
13685 		/*
13686 		 * Reject any non-decimal aliases for logical
13687 		 * interfaces. Aliases with leading zeroes
13688 		 * are also rejected as they introduce ambiguity
13689 		 * in the naming of the interfaces.
13690 		 * In order to confirm with existing semantics,
13691 		 * and to not break any programs/script relying
13692 		 * on that behaviour, if<0>:0 is considered to be
13693 		 * a valid interface.
13694 		 *
13695 		 * If alias has two or more digits and the first
13696 		 * is zero, fail.
13697 		 */
13698 		if (&cp[2] < endp && cp[1] == '0') {
13699 			return (NULL);
13700 		}
13701 	}
13702 
13703 	if (cp <= name) {
13704 		cp = endp;
13705 	}
13706 	last = *cp;
13707 	*cp = '\0';
13708 
13709 	/*
13710 	 * Look up the ILL, based on the portion of the name
13711 	 * before the slash. ill_lookup_on_name returns a held ill.
13712 	 * Temporary to check whether ill exists already. If so
13713 	 * ill_lookup_on_name will clear it.
13714 	 */
13715 	ill = ill_lookup_on_name(name, do_alloc, isv6,
13716 	    &did_alloc, ipst);
13717 	*cp = last;
13718 	if (ill == NULL)
13719 		return (NULL);
13720 
13721 	/* Establish the unit number in the name. */
13722 	id = 0;
13723 	if (cp < endp && *endp == '\0') {
13724 		/* If there was a colon, the unit number follows. */
13725 		cp++;
13726 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13727 			ill_refrele(ill);
13728 			return (NULL);
13729 		}
13730 	}
13731 
13732 	mutex_enter(&ill->ill_lock);
13733 	/* Now see if there is an IPIF with this unit number. */
13734 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13735 		if (ipif->ipif_id == id) {
13736 			if (zoneid != ALL_ZONES &&
13737 			    zoneid != ipif->ipif_zoneid &&
13738 			    ipif->ipif_zoneid != ALL_ZONES) {
13739 				mutex_exit(&ill->ill_lock);
13740 				ill_refrele(ill);
13741 				return (NULL);
13742 			}
13743 			if (IPIF_CAN_LOOKUP(ipif)) {
13744 				ipif_refhold_locked(ipif);
13745 				mutex_exit(&ill->ill_lock);
13746 				if (!did_alloc)
13747 					*exists = B_TRUE;
13748 				/*
13749 				 * Drop locks before calling ill_refrele
13750 				 * since it can potentially call into
13751 				 * ipif_ill_refrele_tail which can end up
13752 				 * in trying to acquire any lock.
13753 				 */
13754 				ill_refrele(ill);
13755 				return (ipif);
13756 			}
13757 		}
13758 	}
13759 
13760 	if (!do_alloc) {
13761 		mutex_exit(&ill->ill_lock);
13762 		ill_refrele(ill);
13763 		return (NULL);
13764 	}
13765 
13766 	/*
13767 	 * If none found, atomically allocate and return a new one.
13768 	 * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
13769 	 * to support "receive only" use of lo0:1 etc. as is still done
13770 	 * below as an initial guess.
13771 	 * However, this is now likely to be overriden later in ipif_up_done()
13772 	 * when we know for sure what address has been configured on the
13773 	 * interface, since we might have more than one loopback interface
13774 	 * with a loopback address, e.g. in the case of zones, and all the
13775 	 * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
13776 	 */
13777 	if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
13778 		ire_type = IRE_LOOPBACK;
13779 	else
13780 		ire_type = IRE_LOCAL;
13781 	ipif = ipif_allocate(ill, id, ire_type, B_TRUE, B_TRUE, NULL);
13782 	if (ipif != NULL)
13783 		ipif_refhold_locked(ipif);
13784 	mutex_exit(&ill->ill_lock);
13785 	ill_refrele(ill);
13786 	return (ipif);
13787 }
13788 
13789 /*
13790  * Variant of the above that queues the request on the ipsq when
13791  * IPIF_CHANGING is set.
13792  */
13793 static ipif_t *
13794 ipif_lookup_on_name_async(char *name, size_t namelen, boolean_t isv6,
13795     zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func, int *error,
13796     ip_stack_t *ipst)
13797 {
13798 	char	*cp;
13799 	char	*endp;
13800 	long	id;
13801 	ill_t	*ill;
13802 	ipif_t	*ipif;
13803 	boolean_t did_alloc = B_FALSE;
13804 	ipsq_t	*ipsq;
13805 
13806 	if (error != NULL)
13807 		*error = 0;
13808 
13809 	if (namelen == 0) {
13810 		if (error != NULL)
13811 			*error = ENXIO;
13812 		return (NULL);
13813 	}
13814 
13815 	/* Look for a colon in the name. */
13816 	endp = &name[namelen];
13817 	for (cp = endp; --cp > name; ) {
13818 		if (*cp == IPIF_SEPARATOR_CHAR)
13819 			break;
13820 	}
13821 
13822 	if (*cp == IPIF_SEPARATOR_CHAR) {
13823 		/*
13824 		 * Reject any non-decimal aliases for logical
13825 		 * interfaces. Aliases with leading zeroes
13826 		 * are also rejected as they introduce ambiguity
13827 		 * in the naming of the interfaces.
13828 		 * In order to confirm with existing semantics,
13829 		 * and to not break any programs/script relying
13830 		 * on that behaviour, if<0>:0 is considered to be
13831 		 * a valid interface.
13832 		 *
13833 		 * If alias has two or more digits and the first
13834 		 * is zero, fail.
13835 		 */
13836 		if (&cp[2] < endp && cp[1] == '0') {
13837 			if (error != NULL)
13838 				*error = EINVAL;
13839 			return (NULL);
13840 		}
13841 	}
13842 
13843 	if (cp <= name) {
13844 		cp = endp;
13845 	} else {
13846 		*cp = '\0';
13847 	}
13848 
13849 	/*
13850 	 * Look up the ILL, based on the portion of the name
13851 	 * before the slash. ill_lookup_on_name returns a held ill.
13852 	 * Temporary to check whether ill exists already. If so
13853 	 * ill_lookup_on_name will clear it.
13854 	 */
13855 	ill = ill_lookup_on_name(name, B_FALSE, isv6, &did_alloc, ipst);
13856 	if (cp != endp)
13857 		*cp = IPIF_SEPARATOR_CHAR;
13858 	if (ill == NULL)
13859 		return (NULL);
13860 
13861 	/* Establish the unit number in the name. */
13862 	id = 0;
13863 	if (cp < endp && *endp == '\0') {
13864 		/* If there was a colon, the unit number follows. */
13865 		cp++;
13866 		if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13867 			ill_refrele(ill);
13868 			if (error != NULL)
13869 				*error = ENXIO;
13870 			return (NULL);
13871 		}
13872 	}
13873 
13874 	GRAB_CONN_LOCK(q);
13875 	mutex_enter(&ill->ill_lock);
13876 	/* Now see if there is an IPIF with this unit number. */
13877 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13878 		if (ipif->ipif_id == id) {
13879 			if (zoneid != ALL_ZONES &&
13880 			    zoneid != ipif->ipif_zoneid &&
13881 			    ipif->ipif_zoneid != ALL_ZONES) {
13882 				mutex_exit(&ill->ill_lock);
13883 				RELEASE_CONN_LOCK(q);
13884 				ill_refrele(ill);
13885 				if (error != NULL)
13886 					*error = ENXIO;
13887 				return (NULL);
13888 			}
13889 
13890 			if (!(IPIF_IS_CHANGING(ipif) ||
13891 			    IPIF_IS_CONDEMNED(ipif)) ||
13892 			    IAM_WRITER_IPIF(ipif)) {
13893 				ipif_refhold_locked(ipif);
13894 				mutex_exit(&ill->ill_lock);
13895 				/*
13896 				 * Drop locks before calling ill_refrele
13897 				 * since it can potentially call into
13898 				 * ipif_ill_refrele_tail which can end up
13899 				 * in trying to acquire any lock.
13900 				 */
13901 				RELEASE_CONN_LOCK(q);
13902 				ill_refrele(ill);
13903 				return (ipif);
13904 			} else if (q != NULL && !IPIF_IS_CONDEMNED(ipif)) {
13905 				ipsq = ill->ill_phyint->phyint_ipsq;
13906 				mutex_enter(&ipsq->ipsq_lock);
13907 				mutex_enter(&ipsq->ipsq_xop->ipx_lock);
13908 				mutex_exit(&ill->ill_lock);
13909 				ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
13910 				mutex_exit(&ipsq->ipsq_xop->ipx_lock);
13911 				mutex_exit(&ipsq->ipsq_lock);
13912 				RELEASE_CONN_LOCK(q);
13913 				ill_refrele(ill);
13914 				if (error != NULL)
13915 					*error = EINPROGRESS;
13916 				return (NULL);
13917 			}
13918 		}
13919 	}
13920 	RELEASE_CONN_LOCK(q);
13921 	mutex_exit(&ill->ill_lock);
13922 	ill_refrele(ill);
13923 	if (error != NULL)
13924 		*error = ENXIO;
13925 	return (NULL);
13926 }
13927 
13928 /*
13929  * This routine is called whenever a new address comes up on an ipif.  If
13930  * we are configured to respond to address mask requests, then we are supposed
13931  * to broadcast an address mask reply at this time.  This routine is also
13932  * called if we are already up, but a netmask change is made.  This is legal
13933  * but might not make the system manager very popular.	(May be called
13934  * as writer.)
13935  */
13936 void
13937 ipif_mask_reply(ipif_t *ipif)
13938 {
13939 	icmph_t	*icmph;
13940 	ipha_t	*ipha;
13941 	mblk_t	*mp;
13942 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
13943 	ip_xmit_attr_t ixas;
13944 
13945 #define	REPLY_LEN	(sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
13946 
13947 	if (!ipst->ips_ip_respond_to_address_mask_broadcast)
13948 		return;
13949 
13950 	/* ICMP mask reply is IPv4 only */
13951 	ASSERT(!ipif->ipif_isv6);
13952 	/* ICMP mask reply is not for a loopback interface */
13953 	ASSERT(ipif->ipif_ill->ill_wq != NULL);
13954 
13955 	if (ipif->ipif_lcl_addr == INADDR_ANY)
13956 		return;
13957 
13958 	mp = allocb(REPLY_LEN, BPRI_HI);
13959 	if (mp == NULL)
13960 		return;
13961 	mp->b_wptr = mp->b_rptr + REPLY_LEN;
13962 
13963 	ipha = (ipha_t *)mp->b_rptr;
13964 	bzero(ipha, REPLY_LEN);
13965 	*ipha = icmp_ipha;
13966 	ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
13967 	ipha->ipha_src = ipif->ipif_lcl_addr;
13968 	ipha->ipha_dst = ipif->ipif_brd_addr;
13969 	ipha->ipha_length = htons(REPLY_LEN);
13970 	ipha->ipha_ident = 0;
13971 
13972 	icmph = (icmph_t *)&ipha[1];
13973 	icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
13974 	bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
13975 	icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
13976 
13977 	bzero(&ixas, sizeof (ixas));
13978 	ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13979 	ixas.ixa_zoneid = ALL_ZONES;
13980 	ixas.ixa_ifindex = 0;
13981 	ixas.ixa_ipst = ipst;
13982 	ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
13983 	(void) ip_output_simple(mp, &ixas);
13984 	ixa_cleanup(&ixas);
13985 #undef	REPLY_LEN
13986 }
13987 
13988 /*
13989  * Join the ipif specific multicast groups.
13990  * Must be called after a mapping has been set up in the resolver.  (Always
13991  * called as writer.)
13992  */
13993 void
13994 ipif_multicast_up(ipif_t *ipif)
13995 {
13996 	int err;
13997 	ill_t *ill;
13998 	ilm_t *ilm;
13999 
14000 	ASSERT(IAM_WRITER_IPIF(ipif));
14001 
14002 	ill = ipif->ipif_ill;
14003 
14004 	ip1dbg(("ipif_multicast_up\n"));
14005 	if (!(ill->ill_flags & ILLF_MULTICAST) ||
14006 	    ipif->ipif_allhosts_ilm != NULL)
14007 		return;
14008 
14009 	if (ipif->ipif_isv6) {
14010 		in6_addr_t v6allmc = ipv6_all_hosts_mcast;
14011 		in6_addr_t v6solmc = ipv6_solicited_node_mcast;
14012 
14013 		v6solmc.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
14014 
14015 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
14016 			return;
14017 
14018 		ip1dbg(("ipif_multicast_up - addmulti\n"));
14019 
14020 		/*
14021 		 * Join the all hosts multicast address.  We skip this for
14022 		 * underlying IPMP interfaces since they should be invisible.
14023 		 */
14024 		if (!IS_UNDER_IPMP(ill)) {
14025 			ilm = ip_addmulti(&v6allmc, ill, ipif->ipif_zoneid,
14026 			    &err);
14027 			if (ilm == NULL) {
14028 				ASSERT(err != 0);
14029 				ip0dbg(("ipif_multicast_up: "
14030 				    "all_hosts_mcast failed %d\n", err));
14031 				return;
14032 			}
14033 			ipif->ipif_allhosts_ilm = ilm;
14034 		}
14035 
14036 		/*
14037 		 * Enable multicast for the solicited node multicast address.
14038 		 * If IPMP we need to put the membership on the upper ill.
14039 		 */
14040 		if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
14041 			ill_t *mcast_ill = NULL;
14042 			boolean_t need_refrele;
14043 
14044 			if (IS_UNDER_IPMP(ill) &&
14045 			    (mcast_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL) {
14046 				need_refrele = B_TRUE;
14047 			} else {
14048 				mcast_ill = ill;
14049 				need_refrele = B_FALSE;
14050 			}
14051 
14052 			ilm = ip_addmulti(&v6solmc, mcast_ill,
14053 			    ipif->ipif_zoneid, &err);
14054 			if (need_refrele)
14055 				ill_refrele(mcast_ill);
14056 
14057 			if (ilm == NULL) {
14058 				ASSERT(err != 0);
14059 				ip0dbg(("ipif_multicast_up: solicited MC"
14060 				    " failed %d\n", err));
14061 				if ((ilm = ipif->ipif_allhosts_ilm) != NULL) {
14062 					ipif->ipif_allhosts_ilm = NULL;
14063 					(void) ip_delmulti(ilm);
14064 				}
14065 				return;
14066 			}
14067 			ipif->ipif_solmulti_ilm = ilm;
14068 		}
14069 	} else {
14070 		in6_addr_t v6group;
14071 
14072 		if (ipif->ipif_lcl_addr == INADDR_ANY || IS_UNDER_IPMP(ill))
14073 			return;
14074 
14075 		/* Join the all hosts multicast address */
14076 		ip1dbg(("ipif_multicast_up - addmulti\n"));
14077 		IN6_IPADDR_TO_V4MAPPED(htonl(INADDR_ALLHOSTS_GROUP), &v6group);
14078 
14079 		ilm = ip_addmulti(&v6group, ill, ipif->ipif_zoneid, &err);
14080 		if (ilm == NULL) {
14081 			ASSERT(err != 0);
14082 			ip0dbg(("ipif_multicast_up: failed %d\n", err));
14083 			return;
14084 		}
14085 		ipif->ipif_allhosts_ilm = ilm;
14086 	}
14087 }
14088 
14089 /*
14090  * Blow away any multicast groups that we joined in ipif_multicast_up().
14091  * (ilms from explicit memberships are handled in conn_update_ill.)
14092  */
14093 void
14094 ipif_multicast_down(ipif_t *ipif)
14095 {
14096 	ASSERT(IAM_WRITER_IPIF(ipif));
14097 
14098 	ip1dbg(("ipif_multicast_down\n"));
14099 
14100 	if (ipif->ipif_allhosts_ilm != NULL) {
14101 		(void) ip_delmulti(ipif->ipif_allhosts_ilm);
14102 		ipif->ipif_allhosts_ilm = NULL;
14103 	}
14104 	if (ipif->ipif_solmulti_ilm != NULL) {
14105 		(void) ip_delmulti(ipif->ipif_solmulti_ilm);
14106 		ipif->ipif_solmulti_ilm = NULL;
14107 	}
14108 }
14109 
14110 /*
14111  * Used when an interface comes up to recreate any extra routes on this
14112  * interface.
14113  */
14114 int
14115 ill_recover_saved_ire(ill_t *ill)
14116 {
14117 	mblk_t		*mp;
14118 	ip_stack_t	*ipst = ill->ill_ipst;
14119 
14120 	ip1dbg(("ill_recover_saved_ire(%s)", ill->ill_name));
14121 
14122 	mutex_enter(&ill->ill_saved_ire_lock);
14123 	for (mp = ill->ill_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
14124 		ire_t		*ire, *nire;
14125 		ifrt_t		*ifrt;
14126 
14127 		ifrt = (ifrt_t *)mp->b_rptr;
14128 		/*
14129 		 * Create a copy of the IRE with the saved address and netmask.
14130 		 */
14131 		if (ill->ill_isv6) {
14132 			ire = ire_create_v6(
14133 			    &ifrt->ifrt_v6addr,
14134 			    &ifrt->ifrt_v6mask,
14135 			    &ifrt->ifrt_v6gateway_addr,
14136 			    ifrt->ifrt_type,
14137 			    ill,
14138 			    ifrt->ifrt_zoneid,
14139 			    ifrt->ifrt_flags,
14140 			    NULL,
14141 			    ipst);
14142 		} else {
14143 			ire = ire_create(
14144 			    (uint8_t *)&ifrt->ifrt_addr,
14145 			    (uint8_t *)&ifrt->ifrt_mask,
14146 			    (uint8_t *)&ifrt->ifrt_gateway_addr,
14147 			    ifrt->ifrt_type,
14148 			    ill,
14149 			    ifrt->ifrt_zoneid,
14150 			    ifrt->ifrt_flags,
14151 			    NULL,
14152 			    ipst);
14153 		}
14154 		if (ire == NULL) {
14155 			mutex_exit(&ill->ill_saved_ire_lock);
14156 			return (ENOMEM);
14157 		}
14158 
14159 		if (ifrt->ifrt_flags & RTF_SETSRC) {
14160 			if (ill->ill_isv6) {
14161 				ire->ire_setsrc_addr_v6 =
14162 				    ifrt->ifrt_v6setsrc_addr;
14163 			} else {
14164 				ire->ire_setsrc_addr = ifrt->ifrt_setsrc_addr;
14165 			}
14166 		}
14167 
14168 		/*
14169 		 * Some software (for example, GateD and Sun Cluster) attempts
14170 		 * to create (what amount to) IRE_PREFIX routes with the
14171 		 * loopback address as the gateway.  This is primarily done to
14172 		 * set up prefixes with the RTF_REJECT flag set (for example,
14173 		 * when generating aggregate routes.)
14174 		 *
14175 		 * If the IRE type (as defined by ill->ill_net_type) is
14176 		 * IRE_LOOPBACK, then we map the request into a
14177 		 * IRE_IF_NORESOLVER.
14178 		 */
14179 		if (ill->ill_net_type == IRE_LOOPBACK)
14180 			ire->ire_type = IRE_IF_NORESOLVER;
14181 
14182 		/*
14183 		 * ire held by ire_add, will be refreled' towards the
14184 		 * the end of ipif_up_done
14185 		 */
14186 		nire = ire_add(ire);
14187 		/*
14188 		 * Check if it was a duplicate entry. This handles
14189 		 * the case of two racing route adds for the same route
14190 		 */
14191 		if (nire == NULL) {
14192 			ip1dbg(("ill_recover_saved_ire: FAILED\n"));
14193 		} else if (nire != ire) {
14194 			ip1dbg(("ill_recover_saved_ire: duplicate ire %p\n",
14195 			    (void *)nire));
14196 			ire_delete(nire);
14197 		} else {
14198 			ip1dbg(("ill_recover_saved_ire: added ire %p\n",
14199 			    (void *)nire));
14200 		}
14201 		if (nire != NULL)
14202 			ire_refrele(nire);
14203 	}
14204 	mutex_exit(&ill->ill_saved_ire_lock);
14205 	return (0);
14206 }
14207 
14208 /*
14209  * Used to set the netmask and broadcast address to default values when the
14210  * interface is brought up.  (Always called as writer.)
14211  */
14212 static void
14213 ipif_set_default(ipif_t *ipif)
14214 {
14215 	ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14216 
14217 	if (!ipif->ipif_isv6) {
14218 		/*
14219 		 * Interface holds an IPv4 address. Default
14220 		 * mask is the natural netmask.
14221 		 */
14222 		if (!ipif->ipif_net_mask) {
14223 			ipaddr_t	v4mask;
14224 
14225 			v4mask = ip_net_mask(ipif->ipif_lcl_addr);
14226 			V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
14227 		}
14228 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14229 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14230 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14231 		} else {
14232 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14233 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14234 		}
14235 		/*
14236 		 * NOTE: SunOS 4.X does this even if the broadcast address
14237 		 * has been already set thus we do the same here.
14238 		 */
14239 		if (ipif->ipif_flags & IPIF_BROADCAST) {
14240 			ipaddr_t	v4addr;
14241 
14242 			v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
14243 			IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
14244 		}
14245 	} else {
14246 		/*
14247 		 * Interface holds an IPv6-only address.  Default
14248 		 * mask is all-ones.
14249 		 */
14250 		if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
14251 			ipif->ipif_v6net_mask = ipv6_all_ones;
14252 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14253 			/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14254 			ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14255 		} else {
14256 			V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14257 			    ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14258 		}
14259 	}
14260 }
14261 
14262 /*
14263  * Return 0 if this address can be used as local address without causing
14264  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
14265  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
14266  * Note that the same IPv6 link-local address is allowed as long as the ills
14267  * are not on the same link.
14268  */
14269 int
14270 ip_addr_availability_check(ipif_t *new_ipif)
14271 {
14272 	in6_addr_t our_v6addr;
14273 	ill_t *ill;
14274 	ipif_t *ipif;
14275 	ill_walk_context_t ctx;
14276 	ip_stack_t	*ipst = new_ipif->ipif_ill->ill_ipst;
14277 
14278 	ASSERT(IAM_WRITER_IPIF(new_ipif));
14279 	ASSERT(MUTEX_HELD(&ipst->ips_ip_addr_avail_lock));
14280 	ASSERT(RW_READ_HELD(&ipst->ips_ill_g_lock));
14281 
14282 	new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
14283 	if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
14284 	    IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
14285 		return (0);
14286 
14287 	our_v6addr = new_ipif->ipif_v6lcl_addr;
14288 
14289 	if (new_ipif->ipif_isv6)
14290 		ill = ILL_START_WALK_V6(&ctx, ipst);
14291 	else
14292 		ill = ILL_START_WALK_V4(&ctx, ipst);
14293 
14294 	for (; ill != NULL; ill = ill_next(&ctx, ill)) {
14295 		for (ipif = ill->ill_ipif; ipif != NULL;
14296 		    ipif = ipif->ipif_next) {
14297 			if ((ipif == new_ipif) ||
14298 			    !(ipif->ipif_flags & IPIF_UP) ||
14299 			    (ipif->ipif_flags & IPIF_UNNUMBERED) ||
14300 			    !IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
14301 			    &our_v6addr))
14302 				continue;
14303 
14304 			if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
14305 				new_ipif->ipif_flags |= IPIF_UNNUMBERED;
14306 			else if (ipif->ipif_flags & IPIF_POINTOPOINT)
14307 				ipif->ipif_flags |= IPIF_UNNUMBERED;
14308 			else if ((IN6_IS_ADDR_LINKLOCAL(&our_v6addr) ||
14309 			    IN6_IS_ADDR_SITELOCAL(&our_v6addr)) &&
14310 			    !IS_ON_SAME_LAN(ill, new_ipif->ipif_ill))
14311 				continue;
14312 			else if (new_ipif->ipif_zoneid != ipif->ipif_zoneid &&
14313 			    ipif->ipif_zoneid != ALL_ZONES && IS_LOOPBACK(ill))
14314 				continue;
14315 			else if (new_ipif->ipif_ill == ill)
14316 				return (EADDRINUSE);
14317 			else
14318 				return (EADDRNOTAVAIL);
14319 		}
14320 	}
14321 
14322 	return (0);
14323 }
14324 
14325 /*
14326  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
14327  * IREs for the ipif.
14328  * When the routine returns EINPROGRESS then mp has been consumed and
14329  * the ioctl will be acked from ip_rput_dlpi.
14330  */
14331 int
14332 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
14333 {
14334 	ill_t		*ill = ipif->ipif_ill;
14335 	boolean_t	isv6 = ipif->ipif_isv6;
14336 	int		err = 0;
14337 	boolean_t	success;
14338 	uint_t		ipif_orig_id;
14339 	ip_stack_t	*ipst = ill->ill_ipst;
14340 
14341 	ASSERT(IAM_WRITER_IPIF(ipif));
14342 
14343 	ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
14344 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up",
14345 	    ill_t *, ill, ipif_t *, ipif);
14346 
14347 	/* Shouldn't get here if it is already up. */
14348 	if (ipif->ipif_flags & IPIF_UP)
14349 		return (EALREADY);
14350 
14351 	/*
14352 	 * If this is a request to bring up a data address on an interface
14353 	 * under IPMP, then move the address to its IPMP meta-interface and
14354 	 * try to bring it up.  One complication is that the zeroth ipif for
14355 	 * an ill is special, in that every ill always has one, and that code
14356 	 * throughout IP deferences ill->ill_ipif without holding any locks.
14357 	 */
14358 	if (IS_UNDER_IPMP(ill) && ipmp_ipif_is_dataaddr(ipif) &&
14359 	    (!ipif->ipif_isv6 || !V6_IPIF_LINKLOCAL(ipif))) {
14360 		ipif_t	*stubipif = NULL, *moveipif = NULL;
14361 		ill_t	*ipmp_ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
14362 
14363 		/*
14364 		 * The ipif being brought up should be quiesced.  If it's not,
14365 		 * something has gone amiss and we need to bail out.  (If it's
14366 		 * quiesced, we know it will remain so via IPIF_CONDEMNED.)
14367 		 */
14368 		mutex_enter(&ill->ill_lock);
14369 		if (!ipif_is_quiescent(ipif)) {
14370 			mutex_exit(&ill->ill_lock);
14371 			return (EINVAL);
14372 		}
14373 		mutex_exit(&ill->ill_lock);
14374 
14375 		/*
14376 		 * If we're going to need to allocate ipifs, do it prior
14377 		 * to starting the move (and grabbing locks).
14378 		 */
14379 		if (ipif->ipif_id == 0) {
14380 			if ((moveipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14381 			    B_FALSE, &err)) == NULL) {
14382 				return (err);
14383 			}
14384 			if ((stubipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14385 			    B_FALSE, &err)) == NULL) {
14386 				mi_free(moveipif);
14387 				return (err);
14388 			}
14389 		}
14390 
14391 		/*
14392 		 * Grab or transfer the ipif to move.  During the move, keep
14393 		 * ill_g_lock held to prevent any ill walker threads from
14394 		 * seeing things in an inconsistent state.
14395 		 */
14396 		rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
14397 		if (ipif->ipif_id != 0) {
14398 			ipif_remove(ipif);
14399 		} else {
14400 			ipif_transfer(ipif, moveipif, stubipif);
14401 			ipif = moveipif;
14402 		}
14403 
14404 		/*
14405 		 * Place the ipif on the IPMP ill.  If the zeroth ipif on
14406 		 * the IPMP ill is a stub (0.0.0.0 down address) then we
14407 		 * replace that one.  Otherwise, pick the next available slot.
14408 		 */
14409 		ipif->ipif_ill = ipmp_ill;
14410 		ipif_orig_id = ipif->ipif_id;
14411 
14412 		if (ipmp_ipif_is_stubaddr(ipmp_ill->ill_ipif)) {
14413 			ipif_transfer(ipif, ipmp_ill->ill_ipif, NULL);
14414 			ipif = ipmp_ill->ill_ipif;
14415 		} else {
14416 			ipif->ipif_id = -1;
14417 			if ((err = ipif_insert(ipif, B_FALSE)) != 0) {
14418 				/*
14419 				 * No more available ipif_id's -- put it back
14420 				 * on the original ill and fail the operation.
14421 				 * Since we're writer on the ill, we can be
14422 				 * sure our old slot is still available.
14423 				 */
14424 				ipif->ipif_id = ipif_orig_id;
14425 				ipif->ipif_ill = ill;
14426 				if (ipif_orig_id == 0) {
14427 					ipif_transfer(ipif, ill->ill_ipif,
14428 					    NULL);
14429 				} else {
14430 					VERIFY(ipif_insert(ipif, B_FALSE) == 0);
14431 				}
14432 				rw_exit(&ipst->ips_ill_g_lock);
14433 				return (err);
14434 			}
14435 		}
14436 		rw_exit(&ipst->ips_ill_g_lock);
14437 
14438 		/*
14439 		 * Tell SCTP that the ipif has moved.  Note that even if we
14440 		 * had to allocate a new ipif, the original sequence id was
14441 		 * preserved and therefore SCTP won't know.
14442 		 */
14443 		sctp_move_ipif(ipif, ill, ipmp_ill);
14444 
14445 		/*
14446 		 * If the ipif being brought up was on slot zero, then we
14447 		 * first need to bring up the placeholder we stuck there.  In
14448 		 * ip_rput_dlpi_writer(), arp_bringup_done(), or the recursive
14449 		 * call to ipif_up() itself, if we successfully bring up the
14450 		 * placeholder, we'll check ill_move_ipif and bring it up too.
14451 		 */
14452 		if (ipif_orig_id == 0) {
14453 			ASSERT(ill->ill_move_ipif == NULL);
14454 			ill->ill_move_ipif = ipif;
14455 			if ((err = ipif_up(ill->ill_ipif, q, mp)) == 0)
14456 				ASSERT(ill->ill_move_ipif == NULL);
14457 			if (err != EINPROGRESS)
14458 				ill->ill_move_ipif = NULL;
14459 			return (err);
14460 		}
14461 
14462 		/*
14463 		 * Bring it up on the IPMP ill.
14464 		 */
14465 		return (ipif_up(ipif, q, mp));
14466 	}
14467 
14468 	/* Skip arp/ndp for any loopback interface. */
14469 	if (ill->ill_wq != NULL) {
14470 		conn_t *connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14471 		ipsq_t	*ipsq = ill->ill_phyint->phyint_ipsq;
14472 
14473 		if (!ill->ill_dl_up) {
14474 			/*
14475 			 * ill_dl_up is not yet set. i.e. we are yet to
14476 			 * DL_BIND with the driver and this is the first
14477 			 * logical interface on the ill to become "up".
14478 			 * Tell the driver to get going (via DL_BIND_REQ).
14479 			 * Note that changing "significant" IFF_ flags
14480 			 * address/netmask etc cause a down/up dance, but
14481 			 * does not cause an unbind (DL_UNBIND) with the driver
14482 			 */
14483 			return (ill_dl_up(ill, ipif, mp, q));
14484 		}
14485 
14486 		/*
14487 		 * ipif_resolver_up may end up needeing to bind/attach
14488 		 * the ARP stream, which in turn necessitates a
14489 		 * DLPI message exchange with the driver. ioctls are
14490 		 * serialized and so we cannot send more than one
14491 		 * interface up message at a time. If ipif_resolver_up
14492 		 * does need to wait for the DLPI handshake for the ARP stream,
14493 		 * we get EINPROGRESS and we will complete in arp_bringup_done.
14494 		 */
14495 
14496 		ASSERT(connp != NULL || !CONN_Q(q));
14497 		if (connp != NULL)
14498 			mutex_enter(&connp->conn_lock);
14499 		mutex_enter(&ill->ill_lock);
14500 		success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14501 		mutex_exit(&ill->ill_lock);
14502 		if (connp != NULL)
14503 			mutex_exit(&connp->conn_lock);
14504 		if (!success)
14505 			return (EINTR);
14506 
14507 		/*
14508 		 * Crank up IPv6 neighbor discovery. Unlike ARP, this should
14509 		 * complete when ipif_ndp_up returns.
14510 		 */
14511 		err = ipif_resolver_up(ipif, Res_act_initial);
14512 		if (err == EINPROGRESS) {
14513 			/* We will complete it in arp_bringup_done() */
14514 			return (err);
14515 		}
14516 
14517 		if (isv6 && err == 0)
14518 			err = ipif_ndp_up(ipif, B_TRUE);
14519 
14520 		ASSERT(err != EINPROGRESS);
14521 		mp = ipsq_pending_mp_get(ipsq, &connp);
14522 		ASSERT(mp != NULL);
14523 		if (err != 0)
14524 			return (err);
14525 	} else {
14526 		/*
14527 		 * Interfaces without underlying hardware don't do duplicate
14528 		 * address detection.
14529 		 */
14530 		ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
14531 		ipif->ipif_addr_ready = 1;
14532 		err = ill_add_ires(ill);
14533 		/* allocation failure? */
14534 		if (err != 0)
14535 			return (err);
14536 	}
14537 
14538 	err = (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
14539 	if (err == 0 && ill->ill_move_ipif != NULL) {
14540 		ipif = ill->ill_move_ipif;
14541 		ill->ill_move_ipif = NULL;
14542 		return (ipif_up(ipif, q, mp));
14543 	}
14544 	return (err);
14545 }
14546 
14547 /*
14548  * Add any IREs tied to the ill. For now this is just an IRE_MULTICAST.
14549  * The identical set of IREs need to be removed in ill_delete_ires().
14550  */
14551 int
14552 ill_add_ires(ill_t *ill)
14553 {
14554 	ire_t	*ire;
14555 	in6_addr_t dummy6 = {(uint32_t)V6_MCAST, 0, 0, 1};
14556 	in_addr_t dummy4 = htonl(INADDR_ALLHOSTS_GROUP);
14557 
14558 	if (ill->ill_ire_multicast != NULL)
14559 		return (0);
14560 
14561 	/*
14562 	 * provide some dummy ire_addr for creating the ire.
14563 	 */
14564 	if (ill->ill_isv6) {
14565 		ire = ire_create_v6(&dummy6, 0, 0, IRE_MULTICAST, ill,
14566 		    ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14567 	} else {
14568 		ire = ire_create((uchar_t *)&dummy4, 0, 0, IRE_MULTICAST, ill,
14569 		    ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14570 	}
14571 	if (ire == NULL)
14572 		return (ENOMEM);
14573 
14574 	ill->ill_ire_multicast = ire;
14575 	return (0);
14576 }
14577 
14578 void
14579 ill_delete_ires(ill_t *ill)
14580 {
14581 	if (ill->ill_ire_multicast != NULL) {
14582 		/*
14583 		 * BIND/ATTACH completed; Release the ref for ill_ire_multicast
14584 		 * which was taken without any th_tracing enabled.
14585 		 * We also mark it as condemned (note that it was never added)
14586 		 * so that caching conn's can move off of it.
14587 		 */
14588 		ire_make_condemned(ill->ill_ire_multicast);
14589 		ire_refrele_notr(ill->ill_ire_multicast);
14590 		ill->ill_ire_multicast = NULL;
14591 	}
14592 }
14593 
14594 /*
14595  * Perform a bind for the physical device.
14596  * When the routine returns EINPROGRESS then mp has been consumed and
14597  * the ioctl will be acked from ip_rput_dlpi.
14598  * Allocate an unbind message and save it until ipif_down.
14599  */
14600 static int
14601 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
14602 {
14603 	mblk_t	*bind_mp = NULL;
14604 	mblk_t	*unbind_mp = NULL;
14605 	conn_t	*connp;
14606 	boolean_t success;
14607 	int	err;
14608 
14609 	DTRACE_PROBE2(ill__downup, char *, "ill_dl_up", ill_t *, ill);
14610 
14611 	ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
14612 	ASSERT(IAM_WRITER_ILL(ill));
14613 	ASSERT(mp != NULL);
14614 
14615 	/*
14616 	 * Make sure we have an IRE_MULTICAST in case we immediately
14617 	 * start receiving packets.
14618 	 */
14619 	err = ill_add_ires(ill);
14620 	if (err != 0)
14621 		goto bad;
14622 
14623 	bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
14624 	    DL_BIND_REQ);
14625 	if (bind_mp == NULL)
14626 		goto bad;
14627 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
14628 	((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
14629 
14630 	/*
14631 	 * ill_unbind_mp would be non-null if the following sequence had
14632 	 * happened:
14633 	 * - send DL_BIND_REQ to driver, wait for response
14634 	 * - multiple ioctls that need to bring the ipif up are encountered,
14635 	 *   but they cannot enter the ipsq due to the outstanding DL_BIND_REQ.
14636 	 *   These ioctls will then be enqueued on the ipsq
14637 	 * - a DL_ERROR_ACK is returned for the DL_BIND_REQ
14638 	 * At this point, the pending ioctls in the ipsq will be drained, and
14639 	 * since ill->ill_dl_up was not set, ill_dl_up would be invoked with
14640 	 * a non-null ill->ill_unbind_mp
14641 	 */
14642 	if (ill->ill_unbind_mp == NULL) {
14643 		unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t),
14644 		    DL_UNBIND_REQ);
14645 		if (unbind_mp == NULL)
14646 			goto bad;
14647 	}
14648 	/*
14649 	 * Record state needed to complete this operation when the
14650 	 * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
14651 	 */
14652 	connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14653 	ASSERT(connp != NULL || !CONN_Q(q));
14654 	GRAB_CONN_LOCK(q);
14655 	mutex_enter(&ipif->ipif_ill->ill_lock);
14656 	success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14657 	mutex_exit(&ipif->ipif_ill->ill_lock);
14658 	RELEASE_CONN_LOCK(q);
14659 	if (!success)
14660 		goto bad;
14661 
14662 	/*
14663 	 * Save the unbind message for ill_dl_down(); it will be consumed when
14664 	 * the interface goes down.
14665 	 */
14666 	if (ill->ill_unbind_mp == NULL)
14667 		ill->ill_unbind_mp = unbind_mp;
14668 
14669 	ill_dlpi_send(ill, bind_mp);
14670 	/* Send down link-layer capabilities probe if not already done. */
14671 	ill_capability_probe(ill);
14672 
14673 	/*
14674 	 * Sysid used to rely on the fact that netboots set domainname
14675 	 * and the like. Now that miniroot boots aren't strictly netboots
14676 	 * and miniroot network configuration is driven from userland
14677 	 * these things still need to be set. This situation can be detected
14678 	 * by comparing the interface being configured here to the one
14679 	 * dhcifname was set to reference by the boot loader. Once sysid is
14680 	 * converted to use dhcp_ipc_getinfo() this call can go away.
14681 	 */
14682 	if ((ipif->ipif_flags & IPIF_DHCPRUNNING) &&
14683 	    (strcmp(ill->ill_name, dhcifname) == 0) &&
14684 	    (strlen(srpc_domain) == 0)) {
14685 		if (dhcpinit() != 0)
14686 			cmn_err(CE_WARN, "no cached dhcp response");
14687 	}
14688 
14689 	/*
14690 	 * This operation will complete in ip_rput_dlpi with either
14691 	 * a DL_BIND_ACK or DL_ERROR_ACK.
14692 	 */
14693 	return (EINPROGRESS);
14694 bad:
14695 	ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
14696 
14697 	freemsg(bind_mp);
14698 	freemsg(unbind_mp);
14699 	return (ENOMEM);
14700 }
14701 
14702 /* Add room for tcp+ip headers */
14703 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
14704 
14705 /*
14706  * DLPI and ARP is up.
14707  * Create all the IREs associated with an interface. Bring up multicast.
14708  * Set the interface flag and finish other initialization
14709  * that potentially had to be deferred to after DL_BIND_ACK.
14710  */
14711 int
14712 ipif_up_done(ipif_t *ipif)
14713 {
14714 	ill_t		*ill = ipif->ipif_ill;
14715 	int		err = 0;
14716 	boolean_t	loopback = B_FALSE;
14717 	boolean_t	update_src_selection = B_TRUE;
14718 	ipif_t		*tmp_ipif;
14719 
14720 	ip1dbg(("ipif_up_done(%s:%u)\n",
14721 	    ipif->ipif_ill->ill_name, ipif->ipif_id));
14722 	DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done",
14723 	    ill_t *, ill, ipif_t *, ipif);
14724 
14725 	/* Check if this is a loopback interface */
14726 	if (ipif->ipif_ill->ill_wq == NULL)
14727 		loopback = B_TRUE;
14728 
14729 	ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14730 
14731 	/*
14732 	 * If all other interfaces for this ill are down or DEPRECATED,
14733 	 * or otherwise unsuitable for source address selection,
14734 	 * reset the src generation numbers to make sure source
14735 	 * address selection gets to take this new ipif into account.
14736 	 * No need to hold ill_lock while traversing the ipif list since
14737 	 * we are writer
14738 	 */
14739 	for (tmp_ipif = ill->ill_ipif; tmp_ipif;
14740 	    tmp_ipif = tmp_ipif->ipif_next) {
14741 		if (((tmp_ipif->ipif_flags &
14742 		    (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
14743 		    !(tmp_ipif->ipif_flags & IPIF_UP)) ||
14744 		    (tmp_ipif == ipif))
14745 			continue;
14746 		/* first useable pre-existing interface */
14747 		update_src_selection = B_FALSE;
14748 		break;
14749 	}
14750 	if (update_src_selection)
14751 		ip_update_source_selection(ill->ill_ipst);
14752 
14753 	if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) {
14754 		nce_t *loop_nce = NULL;
14755 		uint16_t flags = (NCE_F_MYADDR | NCE_F_AUTHORITY | NCE_F_NONUD);
14756 
14757 		/*
14758 		 * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
14759 		 * ipif_lookup_on_name(), but in the case of zones we can have
14760 		 * several loopback addresses on lo0. So all the interfaces with
14761 		 * loopback addresses need to be marked IRE_LOOPBACK.
14762 		 */
14763 		if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
14764 		    htonl(INADDR_LOOPBACK))
14765 			ipif->ipif_ire_type = IRE_LOOPBACK;
14766 		else
14767 			ipif->ipif_ire_type = IRE_LOCAL;
14768 		if (ill->ill_net_type != IRE_LOOPBACK)
14769 			flags |= NCE_F_PUBLISH;
14770 
14771 		/* add unicast nce for the local addr */
14772 		err = nce_lookup_then_add_v4(ill, NULL,
14773 		    ill->ill_phys_addr_length, &ipif->ipif_lcl_addr, flags,
14774 		    ND_REACHABLE, &loop_nce);
14775 		/* A shared-IP zone sees EEXIST for lo0:N */
14776 		if (err == 0 || err == EEXIST) {
14777 			ipif->ipif_added_nce = 1;
14778 			loop_nce->nce_ipif_cnt++;
14779 			nce_refrele(loop_nce);
14780 			err = 0;
14781 		} else {
14782 			ASSERT(loop_nce == NULL);
14783 			return (err);
14784 		}
14785 	}
14786 
14787 	/* Create all the IREs associated with this interface */
14788 	err = ipif_add_ires_v4(ipif, loopback);
14789 	if (err != 0) {
14790 		/*
14791 		 * see comments about return value from
14792 		 * ip_addr_availability_check() in ipif_add_ires_v4().
14793 		 */
14794 		if (err != EADDRINUSE) {
14795 			(void) ipif_arp_down(ipif);
14796 		} else {
14797 			/*
14798 			 * Make IPMP aware of the deleted ipif so that
14799 			 * the needed ipmp cleanup (e.g., of ipif_bound_ill)
14800 			 * can be completed. Note that we do not want to
14801 			 * destroy the nce that was created on the ipmp_ill
14802 			 * for the active copy of the duplicate address in
14803 			 * use.
14804 			 */
14805 			if (IS_IPMP(ill))
14806 				ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
14807 			err = EADDRNOTAVAIL;
14808 		}
14809 		return (err);
14810 	}
14811 
14812 	if (ill->ill_ipif_up_count == 1 && !loopback) {
14813 		/* Recover any additional IREs entries for this ill */
14814 		(void) ill_recover_saved_ire(ill);
14815 	}
14816 
14817 	if (ill->ill_need_recover_multicast) {
14818 		/*
14819 		 * Need to recover all multicast memberships in the driver.
14820 		 * This had to be deferred until we had attached.  The same
14821 		 * code exists in ipif_up_done_v6() to recover IPv6
14822 		 * memberships.
14823 		 *
14824 		 * Note that it would be preferable to unconditionally do the
14825 		 * ill_recover_multicast() in ill_dl_up(), but we cannot do
14826 		 * that since ill_join_allmulti() depends on ill_dl_up being
14827 		 * set, and it is not set until we receive a DL_BIND_ACK after
14828 		 * having called ill_dl_up().
14829 		 */
14830 		ill_recover_multicast(ill);
14831 	}
14832 
14833 	if (ill->ill_ipif_up_count == 1) {
14834 		/*
14835 		 * Since the interface is now up, it may now be active.
14836 		 */
14837 		if (IS_UNDER_IPMP(ill))
14838 			ipmp_ill_refresh_active(ill);
14839 
14840 		/*
14841 		 * If this is an IPMP interface, we may now be able to
14842 		 * establish ARP entries.
14843 		 */
14844 		if (IS_IPMP(ill))
14845 			ipmp_illgrp_refresh_arpent(ill->ill_grp);
14846 	}
14847 
14848 	/* Join the allhosts multicast address */
14849 	ipif_multicast_up(ipif);
14850 
14851 	if (!loopback && !update_src_selection &&
14852 	    !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)))
14853 		ip_update_source_selection(ill->ill_ipst);
14854 
14855 	if (!loopback && ipif->ipif_addr_ready) {
14856 		/* Broadcast an address mask reply. */
14857 		ipif_mask_reply(ipif);
14858 	}
14859 	/* Perhaps ilgs should use this ill */
14860 	update_conn_ill(NULL, ill->ill_ipst);
14861 
14862 	/*
14863 	 * This had to be deferred until we had bound.  Tell routing sockets and
14864 	 * others that this interface is up if it looks like the address has
14865 	 * been validated.  Otherwise, if it isn't ready yet, wait for
14866 	 * duplicate address detection to do its thing.
14867 	 */
14868 	if (ipif->ipif_addr_ready)
14869 		ipif_up_notify(ipif);
14870 	return (0);
14871 }
14872 
14873 /*
14874  * Add the IREs associated with the ipif.
14875  * Those MUST be explicitly removed in ipif_delete_ires_v4.
14876  */
14877 static int
14878 ipif_add_ires_v4(ipif_t *ipif, boolean_t loopback)
14879 {
14880 	ill_t		*ill = ipif->ipif_ill;
14881 	ip_stack_t	*ipst = ill->ill_ipst;
14882 	ire_t		*ire_array[20];
14883 	ire_t		**irep = ire_array;
14884 	ire_t		**irep1;
14885 	ipaddr_t	net_mask = 0;
14886 	ipaddr_t	subnet_mask, route_mask;
14887 	int		err;
14888 	ire_t		*ire_local = NULL;	/* LOCAL or LOOPBACK */
14889 	ire_t		*ire_if = NULL;
14890 	uchar_t		*gw;
14891 
14892 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14893 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14894 		/*
14895 		 * If we're on a labeled system then make sure that zone-
14896 		 * private addresses have proper remote host database entries.
14897 		 */
14898 		if (is_system_labeled() &&
14899 		    ipif->ipif_ire_type != IRE_LOOPBACK &&
14900 		    !tsol_check_interface_address(ipif))
14901 			return (EINVAL);
14902 
14903 		/* Register the source address for __sin6_src_id */
14904 		err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
14905 		    ipif->ipif_zoneid, ipst);
14906 		if (err != 0) {
14907 			ip0dbg(("ipif_add_ires: srcid_insert %d\n", err));
14908 			return (err);
14909 		}
14910 
14911 		if (loopback)
14912 			gw = (uchar_t *)&ipif->ipif_lcl_addr;
14913 		else
14914 			gw = NULL;
14915 
14916 		/* If the interface address is set, create the local IRE. */
14917 		ire_local = ire_create(
14918 		    (uchar_t *)&ipif->ipif_lcl_addr,	/* dest address */
14919 		    (uchar_t *)&ip_g_all_ones,		/* mask */
14920 		    gw,					/* gateway */
14921 		    ipif->ipif_ire_type,		/* LOCAL or LOOPBACK */
14922 		    ipif->ipif_ill,
14923 		    ipif->ipif_zoneid,
14924 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
14925 		    RTF_PRIVATE : 0) | RTF_KERNEL,
14926 		    NULL,
14927 		    ipst);
14928 		ip1dbg(("ipif_add_ires: 0x%p creating IRE %p type 0x%x"
14929 		    " for 0x%x\n", (void *)ipif, (void *)ire_local,
14930 		    ipif->ipif_ire_type,
14931 		    ntohl(ipif->ipif_lcl_addr)));
14932 		if (ire_local == NULL) {
14933 			ip1dbg(("ipif_up_done: NULL ire_local\n"));
14934 			err = ENOMEM;
14935 			goto bad;
14936 		}
14937 	} else {
14938 		ip1dbg((
14939 		    "ipif_add_ires: not creating IRE %d for 0x%x: flags 0x%x\n",
14940 		    ipif->ipif_ire_type,
14941 		    ntohl(ipif->ipif_lcl_addr),
14942 		    (uint_t)ipif->ipif_flags));
14943 	}
14944 	if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14945 	    !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14946 		net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14947 	} else {
14948 		net_mask = htonl(IN_CLASSA_NET);	/* fallback */
14949 	}
14950 
14951 	subnet_mask = ipif->ipif_net_mask;
14952 
14953 	/*
14954 	 * If mask was not specified, use natural netmask of
14955 	 * interface address. Also, store this mask back into the
14956 	 * ipif struct.
14957 	 */
14958 	if (subnet_mask == 0) {
14959 		subnet_mask = net_mask;
14960 		V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
14961 		V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
14962 		    ipif->ipif_v6subnet);
14963 	}
14964 
14965 	/* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
14966 	if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
14967 	    ipif->ipif_subnet != INADDR_ANY) {
14968 		/* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14969 
14970 		if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14971 			route_mask = IP_HOST_MASK;
14972 		} else {
14973 			route_mask = subnet_mask;
14974 		}
14975 
14976 		ip1dbg(("ipif_add_ires: ipif 0x%p ill 0x%p "
14977 		    "creating if IRE ill_net_type 0x%x for 0x%x\n",
14978 		    (void *)ipif, (void *)ill, ill->ill_net_type,
14979 		    ntohl(ipif->ipif_subnet)));
14980 		ire_if = ire_create(
14981 		    (uchar_t *)&ipif->ipif_subnet,
14982 		    (uchar_t *)&route_mask,
14983 		    (uchar_t *)&ipif->ipif_lcl_addr,
14984 		    ill->ill_net_type,
14985 		    ill,
14986 		    ipif->ipif_zoneid,
14987 		    ((ipif->ipif_flags & IPIF_PRIVATE) ?
14988 		    RTF_PRIVATE: 0) | RTF_KERNEL,
14989 		    NULL,
14990 		    ipst);
14991 		if (ire_if == NULL) {
14992 			ip1dbg(("ipif_up_done: NULL ire_if\n"));
14993 			err = ENOMEM;
14994 			goto bad;
14995 		}
14996 	}
14997 
14998 	/*
14999 	 * Create any necessary broadcast IREs.
15000 	 */
15001 	if ((ipif->ipif_flags & IPIF_BROADCAST) &&
15002 	    !(ipif->ipif_flags & IPIF_NOXMIT))
15003 		irep = ipif_create_bcast_ires(ipif, irep);
15004 
15005 	/* If an earlier ire_create failed, get out now */
15006 	for (irep1 = irep; irep1 > ire_array; ) {
15007 		irep1--;
15008 		if (*irep1 == NULL) {
15009 			ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
15010 			err = ENOMEM;
15011 			goto bad;
15012 		}
15013 	}
15014 
15015 	/*
15016 	 * Need to atomically check for IP address availability under
15017 	 * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
15018 	 * ills or new ipifs can be added while we are checking availability.
15019 	 */
15020 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15021 	mutex_enter(&ipst->ips_ip_addr_avail_lock);
15022 	/* Mark it up, and increment counters. */
15023 	ipif->ipif_flags |= IPIF_UP;
15024 	ill->ill_ipif_up_count++;
15025 	err = ip_addr_availability_check(ipif);
15026 	mutex_exit(&ipst->ips_ip_addr_avail_lock);
15027 	rw_exit(&ipst->ips_ill_g_lock);
15028 
15029 	if (err != 0) {
15030 		/*
15031 		 * Our address may already be up on the same ill. In this case,
15032 		 * the ARP entry for our ipif replaced the one for the other
15033 		 * ipif. So we don't want to delete it (otherwise the other ipif
15034 		 * would be unable to send packets).
15035 		 * ip_addr_availability_check() identifies this case for us and
15036 		 * returns EADDRINUSE; Caller should turn it into EADDRNOTAVAIL
15037 		 * which is the expected error code.
15038 		 */
15039 		ill->ill_ipif_up_count--;
15040 		ipif->ipif_flags &= ~IPIF_UP;
15041 		goto bad;
15042 	}
15043 
15044 	/*
15045 	 * Add in all newly created IREs.  ire_create_bcast() has
15046 	 * already checked for duplicates of the IRE_BROADCAST type.
15047 	 * We add the IRE_INTERFACE before the IRE_LOCAL to ensure
15048 	 * that lookups find the IRE_LOCAL even if the IRE_INTERFACE is
15049 	 * a /32 route.
15050 	 */
15051 	if (ire_if != NULL) {
15052 		ire_if = ire_add(ire_if);
15053 		if (ire_if == NULL) {
15054 			err = ENOMEM;
15055 			goto bad2;
15056 		}
15057 #ifdef DEBUG
15058 		ire_refhold_notr(ire_if);
15059 		ire_refrele(ire_if);
15060 #endif
15061 	}
15062 	if (ire_local != NULL) {
15063 		ire_local = ire_add(ire_local);
15064 		if (ire_local == NULL) {
15065 			err = ENOMEM;
15066 			goto bad2;
15067 		}
15068 #ifdef DEBUG
15069 		ire_refhold_notr(ire_local);
15070 		ire_refrele(ire_local);
15071 #endif
15072 	}
15073 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15074 	if (ire_local != NULL)
15075 		ipif->ipif_ire_local = ire_local;
15076 	if (ire_if != NULL)
15077 		ipif->ipif_ire_if = ire_if;
15078 	rw_exit(&ipst->ips_ill_g_lock);
15079 	ire_local = NULL;
15080 	ire_if = NULL;
15081 
15082 	/*
15083 	 * We first add all of them, and if that succeeds we refrele the
15084 	 * bunch. That enables us to delete all of them should any of the
15085 	 * ire_adds fail.
15086 	 */
15087 	for (irep1 = irep; irep1 > ire_array; ) {
15088 		irep1--;
15089 		ASSERT(!MUTEX_HELD(&((*irep1)->ire_ill->ill_lock)));
15090 		*irep1 = ire_add(*irep1);
15091 		if (*irep1 == NULL) {
15092 			err = ENOMEM;
15093 			goto bad2;
15094 		}
15095 	}
15096 
15097 	for (irep1 = irep; irep1 > ire_array; ) {
15098 		irep1--;
15099 		/* refheld by ire_add. */
15100 		if (*irep1 != NULL) {
15101 			ire_refrele(*irep1);
15102 			*irep1 = NULL;
15103 		}
15104 	}
15105 
15106 	if (!loopback) {
15107 		/*
15108 		 * If the broadcast address has been set, make sure it makes
15109 		 * sense based on the interface address.
15110 		 * Only match on ill since we are sharing broadcast addresses.
15111 		 */
15112 		if ((ipif->ipif_brd_addr != INADDR_ANY) &&
15113 		    (ipif->ipif_flags & IPIF_BROADCAST)) {
15114 			ire_t	*ire;
15115 
15116 			ire = ire_ftable_lookup_v4(ipif->ipif_brd_addr, 0, 0,
15117 			    IRE_BROADCAST, ipif->ipif_ill, ALL_ZONES, NULL,
15118 			    (MATCH_IRE_TYPE | MATCH_IRE_ILL), 0, ipst, NULL);
15119 
15120 			if (ire == NULL) {
15121 				/*
15122 				 * If there isn't a matching broadcast IRE,
15123 				 * revert to the default for this netmask.
15124 				 */
15125 				ipif->ipif_v6brd_addr = ipv6_all_zeros;
15126 				mutex_enter(&ipif->ipif_ill->ill_lock);
15127 				ipif_set_default(ipif);
15128 				mutex_exit(&ipif->ipif_ill->ill_lock);
15129 			} else {
15130 				ire_refrele(ire);
15131 			}
15132 		}
15133 
15134 	}
15135 	return (0);
15136 
15137 bad2:
15138 	ill->ill_ipif_up_count--;
15139 	ipif->ipif_flags &= ~IPIF_UP;
15140 
15141 bad:
15142 	ip1dbg(("ipif_add_ires: FAILED \n"));
15143 	if (ire_local != NULL)
15144 		ire_delete(ire_local);
15145 	if (ire_if != NULL)
15146 		ire_delete(ire_if);
15147 
15148 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15149 	ire_local = ipif->ipif_ire_local;
15150 	ipif->ipif_ire_local = NULL;
15151 	ire_if = ipif->ipif_ire_if;
15152 	ipif->ipif_ire_if = NULL;
15153 	rw_exit(&ipst->ips_ill_g_lock);
15154 	if (ire_local != NULL) {
15155 		ire_delete(ire_local);
15156 		ire_refrele_notr(ire_local);
15157 	}
15158 	if (ire_if != NULL) {
15159 		ire_delete(ire_if);
15160 		ire_refrele_notr(ire_if);
15161 	}
15162 
15163 	while (irep > ire_array) {
15164 		irep--;
15165 		if (*irep != NULL) {
15166 			ire_delete(*irep);
15167 		}
15168 	}
15169 	(void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
15170 
15171 	return (err);
15172 }
15173 
15174 /* Remove all the IREs created by ipif_add_ires_v4 */
15175 void
15176 ipif_delete_ires_v4(ipif_t *ipif)
15177 {
15178 	ill_t		*ill = ipif->ipif_ill;
15179 	ip_stack_t	*ipst = ill->ill_ipst;
15180 	ire_t		*ire;
15181 
15182 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15183 	ire = ipif->ipif_ire_local;
15184 	ipif->ipif_ire_local = NULL;
15185 	rw_exit(&ipst->ips_ill_g_lock);
15186 	if (ire != NULL) {
15187 		/*
15188 		 * Move count to ipif so we don't loose the count due to
15189 		 * a down/up dance.
15190 		 */
15191 		atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count);
15192 
15193 		ire_delete(ire);
15194 		ire_refrele_notr(ire);
15195 	}
15196 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15197 	ire = ipif->ipif_ire_if;
15198 	ipif->ipif_ire_if = NULL;
15199 	rw_exit(&ipst->ips_ill_g_lock);
15200 	if (ire != NULL) {
15201 		ire_delete(ire);
15202 		ire_refrele_notr(ire);
15203 	}
15204 
15205 	/*
15206 	 * Delete the broadcast IREs.
15207 	 */
15208 	if ((ipif->ipif_flags & IPIF_BROADCAST) &&
15209 	    !(ipif->ipif_flags & IPIF_NOXMIT))
15210 		ipif_delete_bcast_ires(ipif);
15211 }
15212 
15213 /*
15214  * Checks for availbility of a usable source address (if there is one) when the
15215  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
15216  * this selection is done regardless of the destination.
15217  */
15218 boolean_t
15219 ipif_zone_avail(uint_t ifindex, boolean_t isv6, zoneid_t zoneid,
15220     ip_stack_t *ipst)
15221 {
15222 	ipif_t		*ipif = NULL;
15223 	ill_t		*uill;
15224 
15225 	ASSERT(ifindex != 0);
15226 
15227 	uill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
15228 	if (uill == NULL)
15229 		return (B_FALSE);
15230 
15231 	mutex_enter(&uill->ill_lock);
15232 	for (ipif = uill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15233 		if (IPIF_IS_CONDEMNED(ipif))
15234 			continue;
15235 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15236 			continue;
15237 		if (!(ipif->ipif_flags & IPIF_UP))
15238 			continue;
15239 		if (ipif->ipif_zoneid != zoneid)
15240 			continue;
15241 		if (isv6 ? IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15242 		    ipif->ipif_lcl_addr == INADDR_ANY)
15243 			continue;
15244 		mutex_exit(&uill->ill_lock);
15245 		ill_refrele(uill);
15246 		return (B_TRUE);
15247 	}
15248 	mutex_exit(&uill->ill_lock);
15249 	ill_refrele(uill);
15250 	return (B_FALSE);
15251 }
15252 
15253 /*
15254  * Find an ipif with a good local address on the ill+zoneid.
15255  */
15256 ipif_t *
15257 ipif_good_addr(ill_t *ill, zoneid_t zoneid)
15258 {
15259 	ipif_t		*ipif;
15260 
15261 	mutex_enter(&ill->ill_lock);
15262 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15263 		if (IPIF_IS_CONDEMNED(ipif))
15264 			continue;
15265 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15266 			continue;
15267 		if (!(ipif->ipif_flags & IPIF_UP))
15268 			continue;
15269 		if (ipif->ipif_zoneid != zoneid &&
15270 		    ipif->ipif_zoneid != ALL_ZONES && zoneid != ALL_ZONES)
15271 			continue;
15272 		if (ill->ill_isv6 ?
15273 		    IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15274 		    ipif->ipif_lcl_addr == INADDR_ANY)
15275 			continue;
15276 		ipif_refhold_locked(ipif);
15277 		mutex_exit(&ill->ill_lock);
15278 		return (ipif);
15279 	}
15280 	mutex_exit(&ill->ill_lock);
15281 	return (NULL);
15282 }
15283 
15284 /*
15285  * IP source address type, sorted from worst to best.  For a given type,
15286  * always prefer IP addresses on the same subnet.  All-zones addresses are
15287  * suboptimal because they pose problems with unlabeled destinations.
15288  */
15289 typedef enum {
15290 	IPIF_NONE,
15291 	IPIF_DIFFNET_DEPRECATED,	/* deprecated and different subnet */
15292 	IPIF_SAMENET_DEPRECATED,	/* deprecated and same subnet */
15293 	IPIF_DIFFNET_ALLZONES,		/* allzones and different subnet */
15294 	IPIF_SAMENET_ALLZONES,		/* allzones and same subnet */
15295 	IPIF_DIFFNET,			/* normal and different subnet */
15296 	IPIF_SAMENET,			/* normal and same subnet */
15297 	IPIF_LOCALADDR			/* local loopback */
15298 } ipif_type_t;
15299 
15300 /*
15301  * Pick the optimal ipif on `ill' for sending to destination `dst' from zone
15302  * `zoneid'.  We rate usable ipifs from low -> high as per the ipif_type_t
15303  * enumeration, and return the highest-rated ipif.  If there's a tie, we pick
15304  * the first one, unless IPMP is used in which case we round-robin among them;
15305  * see below for more.
15306  *
15307  * Returns NULL if there is no suitable source address for the ill.
15308  * This only occurs when there is no valid source address for the ill.
15309  */
15310 ipif_t *
15311 ipif_select_source_v4(ill_t *ill, ipaddr_t dst, zoneid_t zoneid,
15312     boolean_t allow_usesrc, boolean_t *notreadyp)
15313 {
15314 	ill_t	*usill = NULL;
15315 	ill_t	*ipmp_ill = NULL;
15316 	ipif_t	*start_ipif, *next_ipif, *ipif, *best_ipif;
15317 	ipif_type_t type, best_type;
15318 	tsol_tpc_t *src_rhtp, *dst_rhtp;
15319 	ip_stack_t *ipst = ill->ill_ipst;
15320 	boolean_t samenet;
15321 
15322 	if (ill->ill_usesrc_ifindex != 0 && allow_usesrc) {
15323 		usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex,
15324 		    B_FALSE, ipst);
15325 		if (usill != NULL)
15326 			ill = usill;	/* Select source from usesrc ILL */
15327 		else
15328 			return (NULL);
15329 	}
15330 
15331 	/*
15332 	 * Test addresses should never be used for source address selection,
15333 	 * so if we were passed one, switch to the IPMP meta-interface.
15334 	 */
15335 	if (IS_UNDER_IPMP(ill)) {
15336 		if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL)
15337 			ill = ipmp_ill;	/* Select source from IPMP ill */
15338 		else
15339 			return (NULL);
15340 	}
15341 
15342 	/*
15343 	 * If we're dealing with an unlabeled destination on a labeled system,
15344 	 * make sure that we ignore source addresses that are incompatible with
15345 	 * the destination's default label.  That destination's default label
15346 	 * must dominate the minimum label on the source address.
15347 	 */
15348 	dst_rhtp = NULL;
15349 	if (is_system_labeled()) {
15350 		dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
15351 		if (dst_rhtp == NULL)
15352 			return (NULL);
15353 		if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
15354 			TPC_RELE(dst_rhtp);
15355 			dst_rhtp = NULL;
15356 		}
15357 	}
15358 
15359 	/*
15360 	 * Hold the ill_g_lock as reader. This makes sure that no ipif/ill
15361 	 * can be deleted. But an ipif/ill can get CONDEMNED any time.
15362 	 * After selecting the right ipif, under ill_lock make sure ipif is
15363 	 * not condemned, and increment refcnt. If ipif is CONDEMNED,
15364 	 * we retry. Inside the loop we still need to check for CONDEMNED,
15365 	 * but not under a lock.
15366 	 */
15367 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15368 retry:
15369 	/*
15370 	 * For source address selection, we treat the ipif list as circular
15371 	 * and continue until we get back to where we started.  This allows
15372 	 * IPMP to vary source address selection (which improves inbound load
15373 	 * spreading) by caching its last ending point and starting from
15374 	 * there.  NOTE: we don't have to worry about ill_src_ipif changing
15375 	 * ills since that can't happen on the IPMP ill.
15376 	 */
15377 	start_ipif = ill->ill_ipif;
15378 	if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
15379 		start_ipif = ill->ill_src_ipif;
15380 
15381 	ipif = start_ipif;
15382 	best_ipif = NULL;
15383 	best_type = IPIF_NONE;
15384 	do {
15385 		if ((next_ipif = ipif->ipif_next) == NULL)
15386 			next_ipif = ill->ill_ipif;
15387 
15388 		if (IPIF_IS_CONDEMNED(ipif))
15389 			continue;
15390 		/* Always skip NOLOCAL and ANYCAST interfaces */
15391 		if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15392 			continue;
15393 		/* Always skip NOACCEPT interfaces */
15394 		if (ipif->ipif_ill->ill_flags & ILLF_NOACCEPT)
15395 			continue;
15396 		if (!(ipif->ipif_flags & IPIF_UP))
15397 			continue;
15398 
15399 		if (!ipif->ipif_addr_ready) {
15400 			if (notreadyp != NULL)
15401 				*notreadyp = B_TRUE;
15402 			continue;
15403 		}
15404 
15405 		if (zoneid != ALL_ZONES &&
15406 		    ipif->ipif_zoneid != zoneid &&
15407 		    ipif->ipif_zoneid != ALL_ZONES)
15408 			continue;
15409 
15410 		/*
15411 		 * Interfaces with 0.0.0.0 address are allowed to be UP, but
15412 		 * are not valid as source addresses.
15413 		 */
15414 		if (ipif->ipif_lcl_addr == INADDR_ANY)
15415 			continue;
15416 
15417 		/*
15418 		 * Check compatibility of local address for destination's
15419 		 * default label if we're on a labeled system.	Incompatible
15420 		 * addresses can't be used at all.
15421 		 */
15422 		if (dst_rhtp != NULL) {
15423 			boolean_t incompat;
15424 
15425 			src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
15426 			    IPV4_VERSION, B_FALSE);
15427 			if (src_rhtp == NULL)
15428 				continue;
15429 			incompat = src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
15430 			    src_rhtp->tpc_tp.tp_doi !=
15431 			    dst_rhtp->tpc_tp.tp_doi ||
15432 			    (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
15433 			    &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
15434 			    !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
15435 			    src_rhtp->tpc_tp.tp_sl_set_cipso));
15436 			TPC_RELE(src_rhtp);
15437 			if (incompat)
15438 				continue;
15439 		}
15440 
15441 		samenet = ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet);
15442 
15443 		if (ipif->ipif_lcl_addr == dst) {
15444 			type = IPIF_LOCALADDR;
15445 		} else if (ipif->ipif_flags & IPIF_DEPRECATED) {
15446 			type = samenet ? IPIF_SAMENET_DEPRECATED :
15447 			    IPIF_DIFFNET_DEPRECATED;
15448 		} else if (ipif->ipif_zoneid == ALL_ZONES) {
15449 			type = samenet ? IPIF_SAMENET_ALLZONES :
15450 			    IPIF_DIFFNET_ALLZONES;
15451 		} else {
15452 			type = samenet ? IPIF_SAMENET : IPIF_DIFFNET;
15453 		}
15454 
15455 		if (type > best_type) {
15456 			best_type = type;
15457 			best_ipif = ipif;
15458 			if (best_type == IPIF_LOCALADDR)
15459 				break; /* can't get better */
15460 		}
15461 	} while ((ipif = next_ipif) != start_ipif);
15462 
15463 	if ((ipif = best_ipif) != NULL) {
15464 		mutex_enter(&ipif->ipif_ill->ill_lock);
15465 		if (IPIF_IS_CONDEMNED(ipif)) {
15466 			mutex_exit(&ipif->ipif_ill->ill_lock);
15467 			goto retry;
15468 		}
15469 		ipif_refhold_locked(ipif);
15470 
15471 		/*
15472 		 * For IPMP, update the source ipif rotor to the next ipif,
15473 		 * provided we can look it up.  (We must not use it if it's
15474 		 * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
15475 		 * ipif_free() checked ill_src_ipif.)
15476 		 */
15477 		if (IS_IPMP(ill) && ipif != NULL) {
15478 			next_ipif = ipif->ipif_next;
15479 			if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif))
15480 				ill->ill_src_ipif = next_ipif;
15481 			else
15482 				ill->ill_src_ipif = NULL;
15483 		}
15484 		mutex_exit(&ipif->ipif_ill->ill_lock);
15485 	}
15486 
15487 	rw_exit(&ipst->ips_ill_g_lock);
15488 	if (usill != NULL)
15489 		ill_refrele(usill);
15490 	if (ipmp_ill != NULL)
15491 		ill_refrele(ipmp_ill);
15492 	if (dst_rhtp != NULL)
15493 		TPC_RELE(dst_rhtp);
15494 
15495 #ifdef DEBUG
15496 	if (ipif == NULL) {
15497 		char buf1[INET6_ADDRSTRLEN];
15498 
15499 		ip1dbg(("ipif_select_source_v4(%s, %s) -> NULL\n",
15500 		    ill->ill_name,
15501 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
15502 	} else {
15503 		char buf1[INET6_ADDRSTRLEN];
15504 		char buf2[INET6_ADDRSTRLEN];
15505 
15506 		ip1dbg(("ipif_select_source_v4(%s, %s) -> %s\n",
15507 		    ipif->ipif_ill->ill_name,
15508 		    inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
15509 		    inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
15510 		    buf2, sizeof (buf2))));
15511 	}
15512 #endif /* DEBUG */
15513 	return (ipif);
15514 }
15515 
15516 /*
15517  * Pick a source address based on the destination ill and an optional setsrc
15518  * address.
15519  * The result is stored in srcp. If generation is set, then put the source
15520  * generation number there before we look for the source address (to avoid
15521  * missing changes in the set of source addresses.
15522  * If flagsp is set, then us it to pass back ipif_flags.
15523  *
15524  * If the caller wants to cache the returned source address and detect when
15525  * that might be stale, the caller should pass in a generation argument,
15526  * which the caller can later compare against ips_src_generation
15527  *
15528  * The precedence order for selecting an IPv4 source address is:
15529  *  - RTF_SETSRC on the offlink ire always wins.
15530  *  - If usrsrc is set, swap the ill to be the usesrc one.
15531  *  - If IPMP is used on the ill, select a random address from the most
15532  *    preferred ones below:
15533  * 1. If onlink destination, same subnet and not deprecated, not ALL_ZONES
15534  * 2. Not deprecated, not ALL_ZONES
15535  * 3. If onlink destination, same subnet and not deprecated, ALL_ZONES
15536  * 4. Not deprecated, ALL_ZONES
15537  * 5. If onlink destination, same subnet and deprecated
15538  * 6. Deprecated.
15539  *
15540  * We have lower preference for ALL_ZONES IP addresses,
15541  * as they pose problems with unlabeled destinations.
15542  *
15543  * Note that when multiple IP addresses match e.g., #1 we pick
15544  * the first one if IPMP is not in use. With IPMP we randomize.
15545  */
15546 int
15547 ip_select_source_v4(ill_t *ill, ipaddr_t setsrc, ipaddr_t dst,
15548     ipaddr_t multicast_ifaddr,
15549     zoneid_t zoneid, ip_stack_t *ipst, ipaddr_t *srcp,
15550     uint32_t *generation, uint64_t *flagsp)
15551 {
15552 	ipif_t *ipif;
15553 	boolean_t notready = B_FALSE;	/* Set if !ipif_addr_ready found */
15554 
15555 	if (flagsp != NULL)
15556 		*flagsp = 0;
15557 
15558 	/*
15559 	 * Need to grab the generation number before we check to
15560 	 * avoid a race with a change to the set of local addresses.
15561 	 * No lock needed since the thread which updates the set of local
15562 	 * addresses use ipif/ill locks and exit those (hence a store memory
15563 	 * barrier) before doing the atomic increase of ips_src_generation.
15564 	 */
15565 	if (generation != NULL) {
15566 		*generation = ipst->ips_src_generation;
15567 	}
15568 
15569 	if (CLASSD(dst) && multicast_ifaddr != INADDR_ANY) {
15570 		*srcp = multicast_ifaddr;
15571 		return (0);
15572 	}
15573 
15574 	/* Was RTF_SETSRC set on the first IRE in the recursive lookup? */
15575 	if (setsrc != INADDR_ANY) {
15576 		*srcp = setsrc;
15577 		return (0);
15578 	}
15579 	ipif = ipif_select_source_v4(ill, dst, zoneid, B_TRUE, &notready);
15580 	if (ipif == NULL) {
15581 		if (notready)
15582 			return (ENETDOWN);
15583 		else
15584 			return (EADDRNOTAVAIL);
15585 	}
15586 	*srcp = ipif->ipif_lcl_addr;
15587 	if (flagsp != NULL)
15588 		*flagsp = ipif->ipif_flags;
15589 	ipif_refrele(ipif);
15590 	return (0);
15591 }
15592 
15593 /* ARGSUSED */
15594 int
15595 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15596     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15597 {
15598 	/*
15599 	 * ill_phyint_reinit merged the v4 and v6 into a single
15600 	 * ipsq.  We might not have been able to complete the
15601 	 * operation in ipif_set_values, if we could not become
15602 	 * exclusive.  If so restart it here.
15603 	 */
15604 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15605 }
15606 
15607 /*
15608  * Can operate on either a module or a driver queue.
15609  * Returns an error if not a module queue.
15610  */
15611 /* ARGSUSED */
15612 int
15613 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15614     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15615 {
15616 	queue_t		*q1 = q;
15617 	char		*cp;
15618 	char		interf_name[LIFNAMSIZ];
15619 	uint_t		ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
15620 
15621 	if (q->q_next == NULL) {
15622 		ip1dbg((
15623 		    "if_unitsel: IF_UNITSEL: no q_next\n"));
15624 		return (EINVAL);
15625 	}
15626 
15627 	if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
15628 		return (EALREADY);
15629 
15630 	do {
15631 		q1 = q1->q_next;
15632 	} while (q1->q_next);
15633 	cp = q1->q_qinfo->qi_minfo->mi_idname;
15634 	(void) sprintf(interf_name, "%s%d", cp, ppa);
15635 
15636 	/*
15637 	 * Here we are not going to delay the ioack until after
15638 	 * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
15639 	 * original ioctl message before sending the requests.
15640 	 */
15641 	return (ipif_set_values(q, mp, interf_name, &ppa));
15642 }
15643 
15644 /* ARGSUSED */
15645 int
15646 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15647     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15648 {
15649 	return (ENXIO);
15650 }
15651 
15652 /*
15653  * Create any IRE_BROADCAST entries for `ipif', and store those entries in
15654  * `irep'.  Returns a pointer to the next free `irep' entry
15655  * A mirror exists in ipif_delete_bcast_ires().
15656  *
15657  * The management of any "extra" or seemingly duplicate IRE_BROADCASTs is
15658  * done in ire_add.
15659  */
15660 static ire_t **
15661 ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep)
15662 {
15663 	ipaddr_t addr;
15664 	ipaddr_t netmask = ip_net_mask(ipif->ipif_lcl_addr);
15665 	ipaddr_t subnetmask = ipif->ipif_net_mask;
15666 	ill_t *ill = ipif->ipif_ill;
15667 	zoneid_t zoneid = ipif->ipif_zoneid;
15668 
15669 	ip1dbg(("ipif_create_bcast_ires: creating broadcast IREs\n"));
15670 
15671 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15672 	ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15673 
15674 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
15675 	    (ipif->ipif_flags & IPIF_NOLOCAL))
15676 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
15677 
15678 	irep = ire_create_bcast(ill, 0, zoneid, irep);
15679 	irep = ire_create_bcast(ill, INADDR_BROADCAST, zoneid, irep);
15680 
15681 	/*
15682 	 * For backward compatibility, we create net broadcast IREs based on
15683 	 * the old "IP address class system", since some old machines only
15684 	 * respond to these class derived net broadcast.  However, we must not
15685 	 * create these net broadcast IREs if the subnetmask is shorter than
15686 	 * the IP address class based derived netmask.  Otherwise, we may
15687 	 * create a net broadcast address which is the same as an IP address
15688 	 * on the subnet -- and then TCP will refuse to talk to that address.
15689 	 */
15690 	if (netmask < subnetmask) {
15691 		addr = netmask & ipif->ipif_subnet;
15692 		irep = ire_create_bcast(ill, addr, zoneid, irep);
15693 		irep = ire_create_bcast(ill, ~netmask | addr, zoneid, irep);
15694 	}
15695 
15696 	/*
15697 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15698 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15699 	 * created.  Creating these broadcast IREs will only create confusion
15700 	 * as `addr' will be the same as the IP address.
15701 	 */
15702 	if (subnetmask != 0xFFFFFFFF) {
15703 		addr = ipif->ipif_subnet;
15704 		irep = ire_create_bcast(ill, addr, zoneid, irep);
15705 		irep = ire_create_bcast(ill, ~subnetmask | addr, zoneid, irep);
15706 	}
15707 
15708 	return (irep);
15709 }
15710 
15711 /*
15712  * Mirror of ipif_create_bcast_ires()
15713  */
15714 static void
15715 ipif_delete_bcast_ires(ipif_t *ipif)
15716 {
15717 	ipaddr_t	addr;
15718 	ipaddr_t	netmask = ip_net_mask(ipif->ipif_lcl_addr);
15719 	ipaddr_t	subnetmask = ipif->ipif_net_mask;
15720 	ill_t		*ill = ipif->ipif_ill;
15721 	zoneid_t	zoneid = ipif->ipif_zoneid;
15722 	ire_t		*ire;
15723 
15724 	ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15725 	ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15726 
15727 	if (ipif->ipif_lcl_addr == INADDR_ANY ||
15728 	    (ipif->ipif_flags & IPIF_NOLOCAL))
15729 		netmask = htonl(IN_CLASSA_NET);		/* fallback */
15730 
15731 	ire = ire_lookup_bcast(ill, 0, zoneid);
15732 	ASSERT(ire != NULL);
15733 	ire_delete(ire); ire_refrele(ire);
15734 	ire = ire_lookup_bcast(ill, INADDR_BROADCAST, zoneid);
15735 	ASSERT(ire != NULL);
15736 	ire_delete(ire); ire_refrele(ire);
15737 
15738 	/*
15739 	 * For backward compatibility, we create net broadcast IREs based on
15740 	 * the old "IP address class system", since some old machines only
15741 	 * respond to these class derived net broadcast.  However, we must not
15742 	 * create these net broadcast IREs if the subnetmask is shorter than
15743 	 * the IP address class based derived netmask.  Otherwise, we may
15744 	 * create a net broadcast address which is the same as an IP address
15745 	 * on the subnet -- and then TCP will refuse to talk to that address.
15746 	 */
15747 	if (netmask < subnetmask) {
15748 		addr = netmask & ipif->ipif_subnet;
15749 		ire = ire_lookup_bcast(ill, addr, zoneid);
15750 		ASSERT(ire != NULL);
15751 		ire_delete(ire); ire_refrele(ire);
15752 		ire = ire_lookup_bcast(ill, ~netmask | addr, zoneid);
15753 		ASSERT(ire != NULL);
15754 		ire_delete(ire); ire_refrele(ire);
15755 	}
15756 
15757 	/*
15758 	 * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15759 	 * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15760 	 * created.  Creating these broadcast IREs will only create confusion
15761 	 * as `addr' will be the same as the IP address.
15762 	 */
15763 	if (subnetmask != 0xFFFFFFFF) {
15764 		addr = ipif->ipif_subnet;
15765 		ire = ire_lookup_bcast(ill, addr, zoneid);
15766 		ASSERT(ire != NULL);
15767 		ire_delete(ire); ire_refrele(ire);
15768 		ire = ire_lookup_bcast(ill, ~subnetmask | addr, zoneid);
15769 		ASSERT(ire != NULL);
15770 		ire_delete(ire); ire_refrele(ire);
15771 	}
15772 }
15773 
15774 /*
15775  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
15776  * from lifr_flags and the name from lifr_name.
15777  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
15778  * since ipif_lookup_on_name uses the _isv6 flags when matching.
15779  * Returns EINPROGRESS when mp has been consumed by queueing it on
15780  * ipx_pending_mp and the ioctl will complete in ip_rput.
15781  *
15782  * Can operate on either a module or a driver queue.
15783  * Returns an error if not a module queue.
15784  */
15785 /* ARGSUSED */
15786 int
15787 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15788     ip_ioctl_cmd_t *ipip, void *if_req)
15789 {
15790 	ill_t	*ill = q->q_ptr;
15791 	phyint_t *phyi;
15792 	ip_stack_t *ipst;
15793 	struct lifreq *lifr = if_req;
15794 	uint64_t new_flags;
15795 
15796 	ASSERT(ipif != NULL);
15797 	ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
15798 
15799 	if (q->q_next == NULL) {
15800 		ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: no q_next\n"));
15801 		return (EINVAL);
15802 	}
15803 
15804 	/*
15805 	 * If we are not writer on 'q' then this interface exists already
15806 	 * and previous lookups (ip_extract_lifreq()) found this ipif --
15807 	 * so return EALREADY.
15808 	 */
15809 	if (ill != ipif->ipif_ill)
15810 		return (EALREADY);
15811 
15812 	if (ill->ill_name[0] != '\0')
15813 		return (EALREADY);
15814 
15815 	/*
15816 	 * If there's another ill already with the requested name, ensure
15817 	 * that it's of the same type.  Otherwise, ill_phyint_reinit() will
15818 	 * fuse together two unrelated ills, which will cause chaos.
15819 	 */
15820 	ipst = ill->ill_ipst;
15821 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
15822 	    lifr->lifr_name, NULL);
15823 	if (phyi != NULL) {
15824 		ill_t *ill_mate = phyi->phyint_illv4;
15825 
15826 		if (ill_mate == NULL)
15827 			ill_mate = phyi->phyint_illv6;
15828 		ASSERT(ill_mate != NULL);
15829 
15830 		if (ill_mate->ill_media->ip_m_mac_type !=
15831 		    ill->ill_media->ip_m_mac_type) {
15832 			ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: attempt to "
15833 			    "use the same ill name on differing media\n"));
15834 			return (EINVAL);
15835 		}
15836 	}
15837 
15838 	/*
15839 	 * We start off as IFF_IPV4 in ipif_allocate and become
15840 	 * IFF_IPV4 or IFF_IPV6 here depending  on lifr_flags value.
15841 	 * The only flags that we read from user space are IFF_IPV4,
15842 	 * IFF_IPV6, and IFF_BROADCAST.
15843 	 *
15844 	 * This ill has not been inserted into the global list.
15845 	 * So we are still single threaded and don't need any lock
15846 	 *
15847 	 * Saniy check the flags.
15848 	 */
15849 
15850 	if ((lifr->lifr_flags & IFF_BROADCAST) &&
15851 	    ((lifr->lifr_flags & IFF_IPV6) ||
15852 	    (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
15853 		ip1dbg(("ip_sioctl_slifname: link not broadcast capable "
15854 		    "or IPv6 i.e., no broadcast \n"));
15855 		return (EINVAL);
15856 	}
15857 
15858 	new_flags =
15859 	    lifr->lifr_flags & (IFF_IPV6|IFF_IPV4|IFF_BROADCAST);
15860 
15861 	if ((new_flags ^ (IFF_IPV6|IFF_IPV4)) == 0) {
15862 		ip1dbg(("ip_sioctl_slifname: flags must be exactly one of "
15863 		    "IFF_IPV4 or IFF_IPV6\n"));
15864 		return (EINVAL);
15865 	}
15866 
15867 	/*
15868 	 * We always start off as IPv4, so only need to check for IPv6.
15869 	 */
15870 	if ((new_flags & IFF_IPV6) != 0) {
15871 		ill->ill_flags |= ILLF_IPV6;
15872 		ill->ill_flags &= ~ILLF_IPV4;
15873 
15874 		if (lifr->lifr_flags & IFF_NOLINKLOCAL)
15875 			ill->ill_flags |= ILLF_NOLINKLOCAL;
15876 	}
15877 
15878 	if ((new_flags & IFF_BROADCAST) != 0)
15879 		ipif->ipif_flags |= IPIF_BROADCAST;
15880 	else
15881 		ipif->ipif_flags &= ~IPIF_BROADCAST;
15882 
15883 	/* We started off as V4. */
15884 	if (ill->ill_flags & ILLF_IPV6) {
15885 		ill->ill_phyint->phyint_illv6 = ill;
15886 		ill->ill_phyint->phyint_illv4 = NULL;
15887 	}
15888 
15889 	return (ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa));
15890 }
15891 
15892 /* ARGSUSED */
15893 int
15894 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15895     ip_ioctl_cmd_t *ipip, void *if_req)
15896 {
15897 	/*
15898 	 * ill_phyint_reinit merged the v4 and v6 into a single
15899 	 * ipsq.  We might not have been able to complete the
15900 	 * slifname in ipif_set_values, if we could not become
15901 	 * exclusive.  If so restart it here
15902 	 */
15903 	return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15904 }
15905 
15906 /*
15907  * Return a pointer to the ipif which matches the index, IP version type and
15908  * zoneid.
15909  */
15910 ipif_t *
15911 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
15912     ip_stack_t *ipst)
15913 {
15914 	ill_t	*ill;
15915 	ipif_t	*ipif = NULL;
15916 
15917 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
15918 	if (ill != NULL) {
15919 		mutex_enter(&ill->ill_lock);
15920 		for (ipif = ill->ill_ipif; ipif != NULL;
15921 		    ipif = ipif->ipif_next) {
15922 			if (!IPIF_IS_CONDEMNED(ipif) && (zoneid == ALL_ZONES ||
15923 			    zoneid == ipif->ipif_zoneid ||
15924 			    ipif->ipif_zoneid == ALL_ZONES)) {
15925 				ipif_refhold_locked(ipif);
15926 				break;
15927 			}
15928 		}
15929 		mutex_exit(&ill->ill_lock);
15930 		ill_refrele(ill);
15931 	}
15932 	return (ipif);
15933 }
15934 
15935 /*
15936  * Change an existing physical interface's index. If the new index
15937  * is acceptable we update the index and the phyint_list_avl_by_index tree.
15938  * Finally, we update other systems which may have a dependence on the
15939  * index value.
15940  */
15941 /* ARGSUSED */
15942 int
15943 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15944     ip_ioctl_cmd_t *ipip, void *ifreq)
15945 {
15946 	ill_t		*ill;
15947 	phyint_t	*phyi;
15948 	struct ifreq	*ifr = (struct ifreq *)ifreq;
15949 	struct lifreq	*lifr = (struct lifreq *)ifreq;
15950 	uint_t	old_index, index;
15951 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
15952 	avl_index_t	where;
15953 
15954 	if (ipip->ipi_cmd_type == IF_CMD)
15955 		index = ifr->ifr_index;
15956 	else
15957 		index = lifr->lifr_index;
15958 
15959 	/*
15960 	 * Only allow on physical interface. Also, index zero is illegal.
15961 	 */
15962 	ill = ipif->ipif_ill;
15963 	phyi = ill->ill_phyint;
15964 	if (ipif->ipif_id != 0 || index == 0 || index > IF_INDEX_MAX) {
15965 		return (EINVAL);
15966 	}
15967 
15968 	/* If the index is not changing, no work to do */
15969 	if (phyi->phyint_ifindex == index)
15970 		return (0);
15971 
15972 	/*
15973 	 * Use phyint_exists() to determine if the new interface index
15974 	 * is already in use. If the index is unused then we need to
15975 	 * change the phyint's position in the phyint_list_avl_by_index
15976 	 * tree. If we do not do this, subsequent lookups (using the new
15977 	 * index value) will not find the phyint.
15978 	 */
15979 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15980 	if (phyint_exists(index, ipst)) {
15981 		rw_exit(&ipst->ips_ill_g_lock);
15982 		return (EEXIST);
15983 	}
15984 
15985 	/*
15986 	 * The new index is unused. Set it in the phyint. However we must not
15987 	 * forget to trigger NE_IFINDEX_CHANGE event before the ifindex
15988 	 * changes. The event must be bound to old ifindex value.
15989 	 */
15990 	ill_nic_event_dispatch(ill, 0, NE_IFINDEX_CHANGE,
15991 	    &index, sizeof (index));
15992 
15993 	old_index = phyi->phyint_ifindex;
15994 	phyi->phyint_ifindex = index;
15995 
15996 	avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index, phyi);
15997 	(void) avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
15998 	    &index, &where);
15999 	avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16000 	    phyi, where);
16001 	rw_exit(&ipst->ips_ill_g_lock);
16002 
16003 	/* Update SCTP's ILL list */
16004 	sctp_ill_reindex(ill, old_index);
16005 
16006 	/* Send the routing sockets message */
16007 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
16008 	if (ILL_OTHER(ill))
16009 		ip_rts_ifmsg(ILL_OTHER(ill)->ill_ipif, RTSQ_DEFAULT);
16010 
16011 	/* Perhaps ilgs should use this ill */
16012 	update_conn_ill(NULL, ill->ill_ipst);
16013 	return (0);
16014 }
16015 
16016 /* ARGSUSED */
16017 int
16018 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16019     ip_ioctl_cmd_t *ipip, void *ifreq)
16020 {
16021 	struct ifreq	*ifr = (struct ifreq *)ifreq;
16022 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16023 
16024 	ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
16025 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16026 	/* Get the interface index */
16027 	if (ipip->ipi_cmd_type == IF_CMD) {
16028 		ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16029 	} else {
16030 		lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16031 	}
16032 	return (0);
16033 }
16034 
16035 /* ARGSUSED */
16036 int
16037 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16038     ip_ioctl_cmd_t *ipip, void *ifreq)
16039 {
16040 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16041 
16042 	ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
16043 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16044 	/* Get the interface zone */
16045 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16046 	lifr->lifr_zoneid = ipif->ipif_zoneid;
16047 	return (0);
16048 }
16049 
16050 /*
16051  * Set the zoneid of an interface.
16052  */
16053 /* ARGSUSED */
16054 int
16055 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16056     ip_ioctl_cmd_t *ipip, void *ifreq)
16057 {
16058 	struct lifreq	*lifr = (struct lifreq *)ifreq;
16059 	int err = 0;
16060 	boolean_t need_up = B_FALSE;
16061 	zone_t *zptr;
16062 	zone_status_t status;
16063 	zoneid_t zoneid;
16064 
16065 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16066 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
16067 		if (!is_system_labeled())
16068 			return (ENOTSUP);
16069 		zoneid = GLOBAL_ZONEID;
16070 	}
16071 
16072 	/* cannot assign instance zero to a non-global zone */
16073 	if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
16074 		return (ENOTSUP);
16075 
16076 	/*
16077 	 * Cannot assign to a zone that doesn't exist or is shutting down.  In
16078 	 * the event of a race with the zone shutdown processing, since IP
16079 	 * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
16080 	 * interface will be cleaned up even if the zone is shut down
16081 	 * immediately after the status check. If the interface can't be brought
16082 	 * down right away, and the zone is shut down before the restart
16083 	 * function is called, we resolve the possible races by rechecking the
16084 	 * zone status in the restart function.
16085 	 */
16086 	if ((zptr = zone_find_by_id(zoneid)) == NULL)
16087 		return (EINVAL);
16088 	status = zone_status_get(zptr);
16089 	zone_rele(zptr);
16090 
16091 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
16092 		return (EINVAL);
16093 
16094 	if (ipif->ipif_flags & IPIF_UP) {
16095 		/*
16096 		 * If the interface is already marked up,
16097 		 * we call ipif_down which will take care
16098 		 * of ditching any IREs that have been set
16099 		 * up based on the old interface address.
16100 		 */
16101 		err = ipif_logical_down(ipif, q, mp);
16102 		if (err == EINPROGRESS)
16103 			return (err);
16104 		(void) ipif_down_tail(ipif);
16105 		need_up = B_TRUE;
16106 	}
16107 
16108 	err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
16109 	return (err);
16110 }
16111 
16112 static int
16113 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
16114     queue_t *q, mblk_t *mp, boolean_t need_up)
16115 {
16116 	int	err = 0;
16117 	ip_stack_t	*ipst;
16118 
16119 	ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
16120 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16121 
16122 	if (CONN_Q(q))
16123 		ipst = CONNQ_TO_IPST(q);
16124 	else
16125 		ipst = ILLQ_TO_IPST(q);
16126 
16127 	/*
16128 	 * For exclusive stacks we don't allow a different zoneid than
16129 	 * global.
16130 	 */
16131 	if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID &&
16132 	    zoneid != GLOBAL_ZONEID)
16133 		return (EINVAL);
16134 
16135 	/* Set the new zone id. */
16136 	ipif->ipif_zoneid = zoneid;
16137 
16138 	/* Update sctp list */
16139 	sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
16140 
16141 	/* The default multicast interface might have changed */
16142 	ire_increment_multicast_generation(ipst, ipif->ipif_ill->ill_isv6);
16143 
16144 	if (need_up) {
16145 		/*
16146 		 * Now bring the interface back up.  If this
16147 		 * is the only IPIF for the ILL, ipif_up
16148 		 * will have to re-bind to the device, so
16149 		 * we may get back EINPROGRESS, in which
16150 		 * case, this IOCTL will get completed in
16151 		 * ip_rput_dlpi when we see the DL_BIND_ACK.
16152 		 */
16153 		err = ipif_up(ipif, q, mp);
16154 	}
16155 	return (err);
16156 }
16157 
16158 /* ARGSUSED */
16159 int
16160 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16161     ip_ioctl_cmd_t *ipip, void *if_req)
16162 {
16163 	struct lifreq *lifr = (struct lifreq *)if_req;
16164 	zoneid_t zoneid;
16165 	zone_t *zptr;
16166 	zone_status_t status;
16167 
16168 	ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16169 	if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
16170 		zoneid = GLOBAL_ZONEID;
16171 
16172 	ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
16173 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16174 
16175 	/*
16176 	 * We recheck the zone status to resolve the following race condition:
16177 	 * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
16178 	 * 2) hme0:1 is up and can't be brought down right away;
16179 	 * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
16180 	 * 3) zone "myzone" is halted; the zone status switches to
16181 	 * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
16182 	 * the interfaces to remove - hme0:1 is not returned because it's not
16183 	 * yet in "myzone", so it won't be removed;
16184 	 * 4) the restart function for SIOCSLIFZONE is called; without the
16185 	 * status check here, we would have hme0:1 in "myzone" after it's been
16186 	 * destroyed.
16187 	 * Note that if the status check fails, we need to bring the interface
16188 	 * back to its state prior to ip_sioctl_slifzone(), hence the call to
16189 	 * ipif_up_done[_v6]().
16190 	 */
16191 	status = ZONE_IS_UNINITIALIZED;
16192 	if ((zptr = zone_find_by_id(zoneid)) != NULL) {
16193 		status = zone_status_get(zptr);
16194 		zone_rele(zptr);
16195 	}
16196 	if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
16197 		if (ipif->ipif_isv6) {
16198 			(void) ipif_up_done_v6(ipif);
16199 		} else {
16200 			(void) ipif_up_done(ipif);
16201 		}
16202 		return (EINVAL);
16203 	}
16204 
16205 	(void) ipif_down_tail(ipif);
16206 
16207 	return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
16208 	    B_TRUE));
16209 }
16210 
16211 /*
16212  * Return the number of addresses on `ill' with one or more of the values
16213  * in `set' set and all of the values in `clear' clear.
16214  */
16215 static uint_t
16216 ill_flagaddr_cnt(const ill_t *ill, uint64_t set, uint64_t clear)
16217 {
16218 	ipif_t	*ipif;
16219 	uint_t	cnt = 0;
16220 
16221 	ASSERT(IAM_WRITER_ILL(ill));
16222 
16223 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
16224 		if ((ipif->ipif_flags & set) && !(ipif->ipif_flags & clear))
16225 			cnt++;
16226 
16227 	return (cnt);
16228 }
16229 
16230 /*
16231  * Return the number of migratable addresses on `ill' that are under
16232  * application control.
16233  */
16234 uint_t
16235 ill_appaddr_cnt(const ill_t *ill)
16236 {
16237 	return (ill_flagaddr_cnt(ill, IPIF_DHCPRUNNING | IPIF_ADDRCONF,
16238 	    IPIF_NOFAILOVER));
16239 }
16240 
16241 /*
16242  * Return the number of point-to-point addresses on `ill'.
16243  */
16244 uint_t
16245 ill_ptpaddr_cnt(const ill_t *ill)
16246 {
16247 	return (ill_flagaddr_cnt(ill, IPIF_POINTOPOINT, 0));
16248 }
16249 
16250 /* ARGSUSED */
16251 int
16252 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16253     ip_ioctl_cmd_t *ipip, void *ifreq)
16254 {
16255 	struct lifreq	*lifr = ifreq;
16256 
16257 	ASSERT(q->q_next == NULL);
16258 	ASSERT(CONN_Q(q));
16259 
16260 	ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
16261 	    ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16262 	lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
16263 	ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
16264 
16265 	return (0);
16266 }
16267 
16268 /* Find the previous ILL in this usesrc group */
16269 static ill_t *
16270 ill_prev_usesrc(ill_t *uill)
16271 {
16272 	ill_t *ill;
16273 
16274 	for (ill = uill->ill_usesrc_grp_next;
16275 	    ASSERT(ill), ill->ill_usesrc_grp_next != uill;
16276 	    ill = ill->ill_usesrc_grp_next)
16277 		/* do nothing */;
16278 	return (ill);
16279 }
16280 
16281 /*
16282  * Release all members of the usesrc group. This routine is called
16283  * from ill_delete when the interface being unplumbed is the
16284  * group head.
16285  *
16286  * This silently clears the usesrc that ifconfig setup.
16287  * An alternative would be to keep that ifindex, and drop packets on the floor
16288  * since no source address can be selected.
16289  * Even if we keep the current semantics, don't need a lock and a linked list.
16290  * Can walk all the ills checking if they have a ill_usesrc_ifindex matching
16291  * the one that is being removed. Issue is how we return the usesrc users
16292  * (SIOCGLIFSRCOF). We want to be able to find the ills which have an
16293  * ill_usesrc_ifindex matching a target ill. We could also do that with an
16294  * ill walk, but the walker would need to insert in the ioctl response.
16295  */
16296 static void
16297 ill_disband_usesrc_group(ill_t *uill)
16298 {
16299 	ill_t *next_ill, *tmp_ill;
16300 	ip_stack_t	*ipst = uill->ill_ipst;
16301 
16302 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16303 	next_ill = uill->ill_usesrc_grp_next;
16304 
16305 	do {
16306 		ASSERT(next_ill != NULL);
16307 		tmp_ill = next_ill->ill_usesrc_grp_next;
16308 		ASSERT(tmp_ill != NULL);
16309 		next_ill->ill_usesrc_grp_next = NULL;
16310 		next_ill->ill_usesrc_ifindex = 0;
16311 		next_ill = tmp_ill;
16312 	} while (next_ill->ill_usesrc_ifindex != 0);
16313 	uill->ill_usesrc_grp_next = NULL;
16314 }
16315 
16316 /*
16317  * Remove the client usesrc ILL from the list and relink to a new list
16318  */
16319 int
16320 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
16321 {
16322 	ill_t *ill, *tmp_ill;
16323 	ip_stack_t	*ipst = ucill->ill_ipst;
16324 
16325 	ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
16326 	    (uill != NULL) && RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16327 
16328 	/*
16329 	 * Check if the usesrc client ILL passed in is not already
16330 	 * in use as a usesrc ILL i.e one whose source address is
16331 	 * in use OR a usesrc ILL is not already in use as a usesrc
16332 	 * client ILL
16333 	 */
16334 	if ((ucill->ill_usesrc_ifindex == 0) ||
16335 	    (uill->ill_usesrc_ifindex != 0)) {
16336 		return (-1);
16337 	}
16338 
16339 	ill = ill_prev_usesrc(ucill);
16340 	ASSERT(ill->ill_usesrc_grp_next != NULL);
16341 
16342 	/* Remove from the current list */
16343 	if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
16344 		/* Only two elements in the list */
16345 		ASSERT(ill->ill_usesrc_ifindex == 0);
16346 		ill->ill_usesrc_grp_next = NULL;
16347 	} else {
16348 		ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
16349 	}
16350 
16351 	if (ifindex == 0) {
16352 		ucill->ill_usesrc_ifindex = 0;
16353 		ucill->ill_usesrc_grp_next = NULL;
16354 		return (0);
16355 	}
16356 
16357 	ucill->ill_usesrc_ifindex = ifindex;
16358 	tmp_ill = uill->ill_usesrc_grp_next;
16359 	uill->ill_usesrc_grp_next = ucill;
16360 	ucill->ill_usesrc_grp_next =
16361 	    (tmp_ill != NULL) ? tmp_ill : uill;
16362 	return (0);
16363 }
16364 
16365 /*
16366  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
16367  * ip.c for locking details.
16368  */
16369 /* ARGSUSED */
16370 int
16371 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16372     ip_ioctl_cmd_t *ipip, void *ifreq)
16373 {
16374 	struct lifreq *lifr = (struct lifreq *)ifreq;
16375 	boolean_t isv6 = B_FALSE, reset_flg = B_FALSE;
16376 	ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
16377 	int err = 0, ret;
16378 	uint_t ifindex;
16379 	ipsq_t *ipsq = NULL;
16380 	ip_stack_t	*ipst = ipif->ipif_ill->ill_ipst;
16381 
16382 	ASSERT(IAM_WRITER_IPIF(ipif));
16383 	ASSERT(q->q_next == NULL);
16384 	ASSERT(CONN_Q(q));
16385 
16386 	isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
16387 
16388 	ifindex = lifr->lifr_index;
16389 	if (ifindex == 0) {
16390 		if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
16391 			/* non usesrc group interface, nothing to reset */
16392 			return (0);
16393 		}
16394 		ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
16395 		/* valid reset request */
16396 		reset_flg = B_TRUE;
16397 	}
16398 
16399 	usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
16400 	if (usesrc_ill == NULL)
16401 		return (ENXIO);
16402 	if (usesrc_ill == ipif->ipif_ill) {
16403 		ill_refrele(usesrc_ill);
16404 		return (EINVAL);
16405 	}
16406 
16407 	ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
16408 	    NEW_OP, B_TRUE);
16409 	if (ipsq == NULL) {
16410 		err = EINPROGRESS;
16411 		/* Operation enqueued on the ipsq of the usesrc ILL */
16412 		goto done;
16413 	}
16414 
16415 	/* USESRC isn't currently supported with IPMP */
16416 	if (IS_IPMP(usesrc_ill) || IS_UNDER_IPMP(usesrc_ill)) {
16417 		err = ENOTSUP;
16418 		goto done;
16419 	}
16420 
16421 	/*
16422 	 * USESRC isn't compatible with the STANDBY flag.  (STANDBY is only
16423 	 * used by IPMP underlying interfaces, but someone might think it's
16424 	 * more general and try to use it independently with VNI.)
16425 	 */
16426 	if (usesrc_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
16427 		err = ENOTSUP;
16428 		goto done;
16429 	}
16430 
16431 	/*
16432 	 * If the client is already in use as a usesrc_ill or a usesrc_ill is
16433 	 * already a client then return EINVAL
16434 	 */
16435 	if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
16436 		err = EINVAL;
16437 		goto done;
16438 	}
16439 
16440 	/*
16441 	 * If the ill_usesrc_ifindex field is already set to what it needs to
16442 	 * be then this is a duplicate operation.
16443 	 */
16444 	if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
16445 		err = 0;
16446 		goto done;
16447 	}
16448 
16449 	ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
16450 	    " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
16451 	    usesrc_ill->ill_isv6));
16452 
16453 	/*
16454 	 * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
16455 	 * and the ill_usesrc_ifindex fields
16456 	 */
16457 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
16458 
16459 	if (reset_flg) {
16460 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
16461 		if (ret != 0) {
16462 			err = EINVAL;
16463 		}
16464 		rw_exit(&ipst->ips_ill_g_usesrc_lock);
16465 		goto done;
16466 	}
16467 
16468 	/*
16469 	 * Four possibilities to consider:
16470 	 * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
16471 	 * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
16472 	 * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
16473 	 * 4. Both are part of their respective usesrc groups
16474 	 */
16475 	if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
16476 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16477 		ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
16478 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16479 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16480 		usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
16481 	} else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
16482 	    (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16483 		usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16484 		/* Insert at head of list */
16485 		usesrc_cli_ill->ill_usesrc_grp_next =
16486 		    usesrc_ill->ill_usesrc_grp_next;
16487 		usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16488 	} else {
16489 		ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
16490 		    ifindex);
16491 		if (ret != 0)
16492 			err = EINVAL;
16493 	}
16494 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
16495 
16496 done:
16497 	if (ipsq != NULL)
16498 		ipsq_exit(ipsq);
16499 	/* The refrele on the lifr_name ipif is done by ip_process_ioctl */
16500 	ill_refrele(usesrc_ill);
16501 
16502 	/* Let conn_ixa caching know that source address selection changed */
16503 	ip_update_source_selection(ipst);
16504 
16505 	return (err);
16506 }
16507 
16508 /* ARGSUSED */
16509 int
16510 ip_sioctl_get_dadstate(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16511     ip_ioctl_cmd_t *ipip, void *if_req)
16512 {
16513 	struct lifreq	*lifr = (struct lifreq *)if_req;
16514 	ill_t		*ill = ipif->ipif_ill;
16515 
16516 	/*
16517 	 * Need a lock since IFF_UP can be set even when there are
16518 	 * references to the ipif.
16519 	 */
16520 	mutex_enter(&ill->ill_lock);
16521 	if ((ipif->ipif_flags & IPIF_UP) && ipif->ipif_addr_ready == 0)
16522 		lifr->lifr_dadstate = DAD_IN_PROGRESS;
16523 	else
16524 		lifr->lifr_dadstate = DAD_DONE;
16525 	mutex_exit(&ill->ill_lock);
16526 	return (0);
16527 }
16528 
16529 /*
16530  * comparison function used by avl.
16531  */
16532 static int
16533 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
16534 {
16535 
16536 	uint_t index;
16537 
16538 	ASSERT(phyip != NULL && index_ptr != NULL);
16539 
16540 	index = *((uint_t *)index_ptr);
16541 	/*
16542 	 * let the phyint with the lowest index be on top.
16543 	 */
16544 	if (((phyint_t *)phyip)->phyint_ifindex < index)
16545 		return (1);
16546 	if (((phyint_t *)phyip)->phyint_ifindex > index)
16547 		return (-1);
16548 	return (0);
16549 }
16550 
16551 /*
16552  * comparison function used by avl.
16553  */
16554 static int
16555 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
16556 {
16557 	ill_t *ill;
16558 	int res = 0;
16559 
16560 	ASSERT(phyip != NULL && name_ptr != NULL);
16561 
16562 	if (((phyint_t *)phyip)->phyint_illv4)
16563 		ill = ((phyint_t *)phyip)->phyint_illv4;
16564 	else
16565 		ill = ((phyint_t *)phyip)->phyint_illv6;
16566 	ASSERT(ill != NULL);
16567 
16568 	res = strcmp(ill->ill_name, (char *)name_ptr);
16569 	if (res > 0)
16570 		return (1);
16571 	else if (res < 0)
16572 		return (-1);
16573 	return (0);
16574 }
16575 
16576 /*
16577  * This function is called on the unplumb path via ill_glist_delete() when
16578  * there are no ills left on the phyint and thus the phyint can be freed.
16579  */
16580 static void
16581 phyint_free(phyint_t *phyi)
16582 {
16583 	ip_stack_t *ipst = PHYINT_TO_IPST(phyi);
16584 
16585 	ASSERT(phyi->phyint_illv4 == NULL && phyi->phyint_illv6 == NULL);
16586 
16587 	/*
16588 	 * If this phyint was an IPMP meta-interface, blow away the group.
16589 	 * This is safe to do because all of the illgrps have already been
16590 	 * removed by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find us.
16591 	 * If we're cleaning up as a result of failed initialization,
16592 	 * phyint_grp may be NULL.
16593 	 */
16594 	if ((phyi->phyint_flags & PHYI_IPMP) && (phyi->phyint_grp != NULL)) {
16595 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16596 		ipmp_grp_destroy(phyi->phyint_grp);
16597 		phyi->phyint_grp = NULL;
16598 		rw_exit(&ipst->ips_ipmp_lock);
16599 	}
16600 
16601 	/*
16602 	 * If this interface was under IPMP, take it out of the group.
16603 	 */
16604 	if (phyi->phyint_grp != NULL)
16605 		ipmp_phyint_leave_grp(phyi);
16606 
16607 	/*
16608 	 * Delete the phyint and disassociate its ipsq.  The ipsq itself
16609 	 * will be freed in ipsq_exit().
16610 	 */
16611 	phyi->phyint_ipsq->ipsq_phyint = NULL;
16612 	phyi->phyint_name[0] = '\0';
16613 
16614 	mi_free(phyi);
16615 }
16616 
16617 /*
16618  * Attach the ill to the phyint structure which can be shared by both
16619  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
16620  * function is called from ipif_set_values and ill_lookup_on_name (for
16621  * loopback) where we know the name of the ill. We lookup the ill and if
16622  * there is one present already with the name use that phyint. Otherwise
16623  * reuse the one allocated by ill_init.
16624  */
16625 static void
16626 ill_phyint_reinit(ill_t *ill)
16627 {
16628 	boolean_t isv6 = ill->ill_isv6;
16629 	phyint_t *phyi_old;
16630 	phyint_t *phyi;
16631 	avl_index_t where = 0;
16632 	ill_t	*ill_other = NULL;
16633 	ip_stack_t	*ipst = ill->ill_ipst;
16634 
16635 	ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
16636 
16637 	phyi_old = ill->ill_phyint;
16638 	ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
16639 	    phyi_old->phyint_illv6 == NULL));
16640 	ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
16641 	    phyi_old->phyint_illv4 == NULL));
16642 	ASSERT(phyi_old->phyint_ifindex == 0);
16643 
16644 	/*
16645 	 * Now that our ill has a name, set it in the phyint.
16646 	 */
16647 	(void) strlcpy(ill->ill_phyint->phyint_name, ill->ill_name, LIFNAMSIZ);
16648 
16649 	phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16650 	    ill->ill_name, &where);
16651 
16652 	/*
16653 	 * 1. We grabbed the ill_g_lock before inserting this ill into
16654 	 *    the global list of ills. So no other thread could have located
16655 	 *    this ill and hence the ipsq of this ill is guaranteed to be empty.
16656 	 * 2. Now locate the other protocol instance of this ill.
16657 	 * 3. Now grab both ill locks in the right order, and the phyint lock of
16658 	 *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
16659 	 *    of neither ill can change.
16660 	 * 4. Merge the phyint and thus the ipsq as well of this ill onto the
16661 	 *    other ill.
16662 	 * 5. Release all locks.
16663 	 */
16664 
16665 	/*
16666 	 * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
16667 	 * we are initializing IPv4.
16668 	 */
16669 	if (phyi != NULL) {
16670 		ill_other = (isv6) ? phyi->phyint_illv4 : phyi->phyint_illv6;
16671 		ASSERT(ill_other->ill_phyint != NULL);
16672 		ASSERT((isv6 && !ill_other->ill_isv6) ||
16673 		    (!isv6 && ill_other->ill_isv6));
16674 		GRAB_ILL_LOCKS(ill, ill_other);
16675 		/*
16676 		 * We are potentially throwing away phyint_flags which
16677 		 * could be different from the one that we obtain from
16678 		 * ill_other->ill_phyint. But it is okay as we are assuming
16679 		 * that the state maintained within IP is correct.
16680 		 */
16681 		mutex_enter(&phyi->phyint_lock);
16682 		if (isv6) {
16683 			ASSERT(phyi->phyint_illv6 == NULL);
16684 			phyi->phyint_illv6 = ill;
16685 		} else {
16686 			ASSERT(phyi->phyint_illv4 == NULL);
16687 			phyi->phyint_illv4 = ill;
16688 		}
16689 
16690 		/*
16691 		 * Delete the old phyint and make its ipsq eligible
16692 		 * to be freed in ipsq_exit().
16693 		 */
16694 		phyi_old->phyint_illv4 = NULL;
16695 		phyi_old->phyint_illv6 = NULL;
16696 		phyi_old->phyint_ipsq->ipsq_phyint = NULL;
16697 		phyi_old->phyint_name[0] = '\0';
16698 		mi_free(phyi_old);
16699 	} else {
16700 		mutex_enter(&ill->ill_lock);
16701 		/*
16702 		 * We don't need to acquire any lock, since
16703 		 * the ill is not yet visible globally  and we
16704 		 * have not yet released the ill_g_lock.
16705 		 */
16706 		phyi = phyi_old;
16707 		mutex_enter(&phyi->phyint_lock);
16708 		/* XXX We need a recovery strategy here. */
16709 		if (!phyint_assign_ifindex(phyi, ipst))
16710 			cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
16711 
16712 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16713 		    (void *)phyi, where);
16714 
16715 		(void) avl_find(&ipst->ips_phyint_g_list->
16716 		    phyint_list_avl_by_index,
16717 		    &phyi->phyint_ifindex, &where);
16718 		avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16719 		    (void *)phyi, where);
16720 	}
16721 
16722 	/*
16723 	 * Reassigning ill_phyint automatically reassigns the ipsq also.
16724 	 * pending mp is not affected because that is per ill basis.
16725 	 */
16726 	ill->ill_phyint = phyi;
16727 
16728 	/*
16729 	 * Now that the phyint's ifindex has been assigned, complete the
16730 	 * remaining
16731 	 */
16732 	ill->ill_ip_mib->ipIfStatsIfIndex = ill->ill_phyint->phyint_ifindex;
16733 	if (ill->ill_isv6) {
16734 		ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
16735 		    ill->ill_phyint->phyint_ifindex;
16736 		ill->ill_mcast_type = ipst->ips_mld_max_version;
16737 	} else {
16738 		ill->ill_mcast_type = ipst->ips_igmp_max_version;
16739 	}
16740 
16741 	/*
16742 	 * Generate an event within the hooks framework to indicate that
16743 	 * a new interface has just been added to IP.  For this event to
16744 	 * be generated, the network interface must, at least, have an
16745 	 * ifindex assigned to it.  (We don't generate the event for
16746 	 * loopback since ill_lookup_on_name() has its own NE_PLUMB event.)
16747 	 *
16748 	 * This needs to be run inside the ill_g_lock perimeter to ensure
16749 	 * that the ordering of delivered events to listeners matches the
16750 	 * order of them in the kernel.
16751 	 */
16752 	if (!IS_LOOPBACK(ill)) {
16753 		ill_nic_event_dispatch(ill, 0, NE_PLUMB, ill->ill_name,
16754 		    ill->ill_name_length);
16755 	}
16756 	RELEASE_ILL_LOCKS(ill, ill_other);
16757 	mutex_exit(&phyi->phyint_lock);
16758 }
16759 
16760 /*
16761  * Notify any downstream modules of the name of this interface.
16762  * An M_IOCTL is used even though we don't expect a successful reply.
16763  * Any reply message from the driver (presumably an M_IOCNAK) will
16764  * eventually get discarded somewhere upstream.  The message format is
16765  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
16766  * to IP.
16767  */
16768 static void
16769 ip_ifname_notify(ill_t *ill, queue_t *q)
16770 {
16771 	mblk_t *mp1, *mp2;
16772 	struct iocblk *iocp;
16773 	struct lifreq *lifr;
16774 
16775 	mp1 = mkiocb(SIOCSLIFNAME);
16776 	if (mp1 == NULL)
16777 		return;
16778 	mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
16779 	if (mp2 == NULL) {
16780 		freeb(mp1);
16781 		return;
16782 	}
16783 
16784 	mp1->b_cont = mp2;
16785 	iocp = (struct iocblk *)mp1->b_rptr;
16786 	iocp->ioc_count = sizeof (struct lifreq);
16787 
16788 	lifr = (struct lifreq *)mp2->b_rptr;
16789 	mp2->b_wptr += sizeof (struct lifreq);
16790 	bzero(lifr, sizeof (struct lifreq));
16791 
16792 	(void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
16793 	lifr->lifr_ppa = ill->ill_ppa;
16794 	lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
16795 
16796 	DTRACE_PROBE3(ill__dlpi, char *, "ip_ifname_notify",
16797 	    char *, "SIOCSLIFNAME", ill_t *, ill);
16798 	putnext(q, mp1);
16799 }
16800 
16801 static int
16802 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
16803 {
16804 	int		err;
16805 	ip_stack_t	*ipst = ill->ill_ipst;
16806 	phyint_t	*phyi = ill->ill_phyint;
16807 
16808 	/*
16809 	 * Now that ill_name is set, the configuration for the IPMP
16810 	 * meta-interface can be performed.
16811 	 */
16812 	if (IS_IPMP(ill)) {
16813 		rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16814 		/*
16815 		 * If phyi->phyint_grp is NULL, then this is the first IPMP
16816 		 * meta-interface and we need to create the IPMP group.
16817 		 */
16818 		if (phyi->phyint_grp == NULL) {
16819 			/*
16820 			 * If someone has renamed another IPMP group to have
16821 			 * the same name as our interface, bail.
16822 			 */
16823 			if (ipmp_grp_lookup(ill->ill_name, ipst) != NULL) {
16824 				rw_exit(&ipst->ips_ipmp_lock);
16825 				return (EEXIST);
16826 			}
16827 			phyi->phyint_grp = ipmp_grp_create(ill->ill_name, phyi);
16828 			if (phyi->phyint_grp == NULL) {
16829 				rw_exit(&ipst->ips_ipmp_lock);
16830 				return (ENOMEM);
16831 			}
16832 		}
16833 		rw_exit(&ipst->ips_ipmp_lock);
16834 	}
16835 
16836 	/* Tell downstream modules where they are. */
16837 	ip_ifname_notify(ill, q);
16838 
16839 	/*
16840 	 * ill_dl_phys returns EINPROGRESS in the usual case.
16841 	 * Error cases are ENOMEM ...
16842 	 */
16843 	err = ill_dl_phys(ill, ipif, mp, q);
16844 
16845 	if (ill->ill_isv6) {
16846 		mutex_enter(&ipst->ips_mld_slowtimeout_lock);
16847 		if (ipst->ips_mld_slowtimeout_id == 0) {
16848 			ipst->ips_mld_slowtimeout_id = timeout(mld_slowtimo,
16849 			    (void *)ipst,
16850 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16851 		}
16852 		mutex_exit(&ipst->ips_mld_slowtimeout_lock);
16853 	} else {
16854 		mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
16855 		if (ipst->ips_igmp_slowtimeout_id == 0) {
16856 			ipst->ips_igmp_slowtimeout_id = timeout(igmp_slowtimo,
16857 			    (void *)ipst,
16858 			    MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16859 		}
16860 		mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
16861 	}
16862 
16863 	return (err);
16864 }
16865 
16866 /*
16867  * Common routine for ppa and ifname setting. Should be called exclusive.
16868  *
16869  * Returns EINPROGRESS when mp has been consumed by queueing it on
16870  * ipx_pending_mp and the ioctl will complete in ip_rput.
16871  *
16872  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
16873  * the new name and new ppa in lifr_name and lifr_ppa respectively.
16874  * For SLIFNAME, we pass these values back to the userland.
16875  */
16876 static int
16877 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
16878 {
16879 	ill_t	*ill;
16880 	ipif_t	*ipif;
16881 	ipsq_t	*ipsq;
16882 	char	*ppa_ptr;
16883 	char	*old_ptr;
16884 	char	old_char;
16885 	int	error;
16886 	ip_stack_t	*ipst;
16887 
16888 	ip1dbg(("ipif_set_values: interface %s\n", interf_name));
16889 	ASSERT(q->q_next != NULL);
16890 	ASSERT(interf_name != NULL);
16891 
16892 	ill = (ill_t *)q->q_ptr;
16893 	ipst = ill->ill_ipst;
16894 
16895 	ASSERT(ill->ill_ipst != NULL);
16896 	ASSERT(ill->ill_name[0] == '\0');
16897 	ASSERT(IAM_WRITER_ILL(ill));
16898 	ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
16899 	ASSERT(ill->ill_ppa == UINT_MAX);
16900 
16901 	ill->ill_defend_start = ill->ill_defend_count = 0;
16902 	/* The ppa is sent down by ifconfig or is chosen */
16903 	if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
16904 		return (EINVAL);
16905 	}
16906 
16907 	/*
16908 	 * make sure ppa passed in is same as ppa in the name.
16909 	 * This check is not made when ppa == UINT_MAX in that case ppa
16910 	 * in the name could be anything. System will choose a ppa and
16911 	 * update new_ppa_ptr and inter_name to contain the choosen ppa.
16912 	 */
16913 	if (*new_ppa_ptr != UINT_MAX) {
16914 		/* stoi changes the pointer */
16915 		old_ptr = ppa_ptr;
16916 		/*
16917 		 * ifconfig passed in 0 for the ppa for DLPI 1 style devices
16918 		 * (they don't have an externally visible ppa).  We assign one
16919 		 * here so that we can manage the interface.  Note that in
16920 		 * the past this value was always 0 for DLPI 1 drivers.
16921 		 */
16922 		if (*new_ppa_ptr == 0)
16923 			*new_ppa_ptr = stoi(&old_ptr);
16924 		else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
16925 			return (EINVAL);
16926 	}
16927 	/*
16928 	 * terminate string before ppa
16929 	 * save char at that location.
16930 	 */
16931 	old_char = ppa_ptr[0];
16932 	ppa_ptr[0] = '\0';
16933 
16934 	ill->ill_ppa = *new_ppa_ptr;
16935 	/*
16936 	 * Finish as much work now as possible before calling ill_glist_insert
16937 	 * which makes the ill globally visible and also merges it with the
16938 	 * other protocol instance of this phyint. The remaining work is
16939 	 * done after entering the ipsq which may happen sometime later.
16940 	 */
16941 	ipif = ill->ill_ipif;
16942 
16943 	/* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
16944 	ipif_assign_seqid(ipif);
16945 
16946 	if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
16947 		ill->ill_flags |= ILLF_IPV4;
16948 
16949 	ASSERT(ipif->ipif_next == NULL);	/* Only one ipif on ill */
16950 	ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
16951 
16952 	if (ill->ill_flags & ILLF_IPV6) {
16953 
16954 		ill->ill_isv6 = B_TRUE;
16955 		ill_set_inputfn(ill);
16956 		if (ill->ill_rq != NULL) {
16957 			ill->ill_rq->q_qinfo = &iprinitv6;
16958 		}
16959 
16960 		/* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
16961 		ipif->ipif_v6lcl_addr = ipv6_all_zeros;
16962 		ipif->ipif_v6subnet = ipv6_all_zeros;
16963 		ipif->ipif_v6net_mask = ipv6_all_zeros;
16964 		ipif->ipif_v6brd_addr = ipv6_all_zeros;
16965 		ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
16966 		ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
16967 		/*
16968 		 * point-to-point or Non-mulicast capable
16969 		 * interfaces won't do NUD unless explicitly
16970 		 * configured to do so.
16971 		 */
16972 		if (ipif->ipif_flags & IPIF_POINTOPOINT ||
16973 		    !(ill->ill_flags & ILLF_MULTICAST)) {
16974 			ill->ill_flags |= ILLF_NONUD;
16975 		}
16976 		/* Make sure IPv4 specific flag is not set on IPv6 if */
16977 		if (ill->ill_flags & ILLF_NOARP) {
16978 			/*
16979 			 * Note: xresolv interfaces will eventually need
16980 			 * NOARP set here as well, but that will require
16981 			 * those external resolvers to have some
16982 			 * knowledge of that flag and act appropriately.
16983 			 * Not to be changed at present.
16984 			 */
16985 			ill->ill_flags &= ~ILLF_NOARP;
16986 		}
16987 		/*
16988 		 * Set the ILLF_ROUTER flag according to the global
16989 		 * IPv6 forwarding policy.
16990 		 */
16991 		if (ipst->ips_ipv6_forwarding != 0)
16992 			ill->ill_flags |= ILLF_ROUTER;
16993 	} else if (ill->ill_flags & ILLF_IPV4) {
16994 		ill->ill_isv6 = B_FALSE;
16995 		ill_set_inputfn(ill);
16996 		ill->ill_reachable_retrans_time = ARP_RETRANS_TIMER;
16997 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
16998 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
16999 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
17000 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
17001 		IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
17002 		/*
17003 		 * Set the ILLF_ROUTER flag according to the global
17004 		 * IPv4 forwarding policy.
17005 		 */
17006 		if (ipst->ips_ip_forwarding != 0)
17007 			ill->ill_flags |= ILLF_ROUTER;
17008 	}
17009 
17010 	ASSERT(ill->ill_phyint != NULL);
17011 
17012 	/*
17013 	 * The ipIfStatsIfindex and ipv6IfIcmpIfIndex assignments will
17014 	 * be completed in ill_glist_insert -> ill_phyint_reinit
17015 	 */
17016 	if (!ill_allocate_mibs(ill))
17017 		return (ENOMEM);
17018 
17019 	/*
17020 	 * Pick a default sap until we get the DL_INFO_ACK back from
17021 	 * the driver.
17022 	 */
17023 	ill->ill_sap = (ill->ill_isv6) ? ill->ill_media->ip_m_ipv6sap :
17024 	    ill->ill_media->ip_m_ipv4sap;
17025 
17026 	ill->ill_ifname_pending = 1;
17027 	ill->ill_ifname_pending_err = 0;
17028 
17029 	/*
17030 	 * When the first ipif comes up in ipif_up_done(), multicast groups
17031 	 * that were joined while this ill was not bound to the DLPI link need
17032 	 * to be recovered by ill_recover_multicast().
17033 	 */
17034 	ill->ill_need_recover_multicast = 1;
17035 
17036 	ill_refhold(ill);
17037 	rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
17038 	if ((error = ill_glist_insert(ill, interf_name,
17039 	    (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
17040 		ill->ill_ppa = UINT_MAX;
17041 		ill->ill_name[0] = '\0';
17042 		/*
17043 		 * undo null termination done above.
17044 		 */
17045 		ppa_ptr[0] = old_char;
17046 		rw_exit(&ipst->ips_ill_g_lock);
17047 		ill_refrele(ill);
17048 		return (error);
17049 	}
17050 
17051 	ASSERT(ill->ill_name_length <= LIFNAMSIZ);
17052 
17053 	/*
17054 	 * When we return the buffer pointed to by interf_name should contain
17055 	 * the same name as in ill_name.
17056 	 * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
17057 	 * the buffer pointed to by new_ppa_ptr would not contain the right ppa
17058 	 * so copy full name and update the ppa ptr.
17059 	 * When ppa passed in != UINT_MAX all values are correct just undo
17060 	 * null termination, this saves a bcopy.
17061 	 */
17062 	if (*new_ppa_ptr == UINT_MAX) {
17063 		bcopy(ill->ill_name, interf_name, ill->ill_name_length);
17064 		*new_ppa_ptr = ill->ill_ppa;
17065 	} else {
17066 		/*
17067 		 * undo null termination done above.
17068 		 */
17069 		ppa_ptr[0] = old_char;
17070 	}
17071 
17072 	/* Let SCTP know about this ILL */
17073 	sctp_update_ill(ill, SCTP_ILL_INSERT);
17074 
17075 	/*
17076 	 * ill_glist_insert has made the ill visible globally, and
17077 	 * ill_phyint_reinit could have changed the ipsq. At this point,
17078 	 * we need to hold the ips_ill_g_lock across the call to enter the
17079 	 * ipsq to enforce atomicity and prevent reordering. In the event
17080 	 * the ipsq has changed, and if the new ipsq is currently busy,
17081 	 * we need to make sure that this half-completed ioctl is ahead of
17082 	 * any subsequent ioctl. We achieve this by not dropping the
17083 	 * ips_ill_g_lock which prevents any ill lookup itself thereby
17084 	 * ensuring that new ioctls can't start.
17085 	 */
17086 	ipsq = ipsq_try_enter_internal(ill, q, mp, ip_reprocess_ioctl, NEW_OP,
17087 	    B_TRUE);
17088 
17089 	rw_exit(&ipst->ips_ill_g_lock);
17090 	ill_refrele(ill);
17091 	if (ipsq == NULL)
17092 		return (EINPROGRESS);
17093 
17094 	/*
17095 	 * If ill_phyint_reinit() changed our ipsq, then start on the new ipsq.
17096 	 */
17097 	if (ipsq->ipsq_xop->ipx_current_ipif == NULL)
17098 		ipsq_current_start(ipsq, ipif, SIOCSLIFNAME);
17099 	else
17100 		ASSERT(ipsq->ipsq_xop->ipx_current_ipif == ipif);
17101 
17102 	error = ipif_set_values_tail(ill, ipif, mp, q);
17103 	ipsq_exit(ipsq);
17104 	if (error != 0 && error != EINPROGRESS) {
17105 		/*
17106 		 * restore previous values
17107 		 */
17108 		ill->ill_isv6 = B_FALSE;
17109 		ill_set_inputfn(ill);
17110 	}
17111 	return (error);
17112 }
17113 
17114 void
17115 ipif_init(ip_stack_t *ipst)
17116 {
17117 	int i;
17118 
17119 	for (i = 0; i < MAX_G_HEADS; i++) {
17120 		ipst->ips_ill_g_heads[i].ill_g_list_head =
17121 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
17122 		ipst->ips_ill_g_heads[i].ill_g_list_tail =
17123 		    (ill_if_t *)&ipst->ips_ill_g_heads[i];
17124 	}
17125 
17126 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17127 	    ill_phyint_compare_index,
17128 	    sizeof (phyint_t),
17129 	    offsetof(struct phyint, phyint_avl_by_index));
17130 	avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
17131 	    ill_phyint_compare_name,
17132 	    sizeof (phyint_t),
17133 	    offsetof(struct phyint, phyint_avl_by_name));
17134 }
17135 
17136 /*
17137  * Save enough information so that we can recreate the IRE if
17138  * the interface goes down and then up.
17139  */
17140 void
17141 ill_save_ire(ill_t *ill, ire_t *ire)
17142 {
17143 	mblk_t	*save_mp;
17144 
17145 	save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
17146 	if (save_mp != NULL) {
17147 		ifrt_t	*ifrt;
17148 
17149 		save_mp->b_wptr += sizeof (ifrt_t);
17150 		ifrt = (ifrt_t *)save_mp->b_rptr;
17151 		bzero(ifrt, sizeof (ifrt_t));
17152 		ifrt->ifrt_type = ire->ire_type;
17153 		if (ire->ire_ipversion == IPV4_VERSION) {
17154 			ASSERT(!ill->ill_isv6);
17155 			ifrt->ifrt_addr = ire->ire_addr;
17156 			ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
17157 			ifrt->ifrt_setsrc_addr = ire->ire_setsrc_addr;
17158 			ifrt->ifrt_mask = ire->ire_mask;
17159 		} else {
17160 			ASSERT(ill->ill_isv6);
17161 			ifrt->ifrt_v6addr = ire->ire_addr_v6;
17162 			/* ire_gateway_addr_v6 can change due to RTM_CHANGE */
17163 			mutex_enter(&ire->ire_lock);
17164 			ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
17165 			mutex_exit(&ire->ire_lock);
17166 			ifrt->ifrt_v6setsrc_addr = ire->ire_setsrc_addr_v6;
17167 			ifrt->ifrt_v6mask = ire->ire_mask_v6;
17168 		}
17169 		ifrt->ifrt_flags = ire->ire_flags;
17170 		ifrt->ifrt_zoneid = ire->ire_zoneid;
17171 		mutex_enter(&ill->ill_saved_ire_lock);
17172 		save_mp->b_cont = ill->ill_saved_ire_mp;
17173 		ill->ill_saved_ire_mp = save_mp;
17174 		ill->ill_saved_ire_cnt++;
17175 		mutex_exit(&ill->ill_saved_ire_lock);
17176 	}
17177 }
17178 
17179 /*
17180  * Remove one entry from ill_saved_ire_mp.
17181  */
17182 void
17183 ill_remove_saved_ire(ill_t *ill, ire_t *ire)
17184 {
17185 	mblk_t	**mpp;
17186 	mblk_t	*mp;
17187 	ifrt_t	*ifrt;
17188 
17189 	/* Remove from ill_saved_ire_mp list if it is there */
17190 	mutex_enter(&ill->ill_saved_ire_lock);
17191 	for (mpp = &ill->ill_saved_ire_mp; *mpp != NULL;
17192 	    mpp = &(*mpp)->b_cont) {
17193 		in6_addr_t	gw_addr_v6;
17194 
17195 		/*
17196 		 * On a given ill, the tuple of address, gateway, mask,
17197 		 * ire_type, and zoneid is unique for each saved IRE.
17198 		 */
17199 		mp = *mpp;
17200 		ifrt = (ifrt_t *)mp->b_rptr;
17201 		/* ire_gateway_addr_v6 can change - need lock */
17202 		mutex_enter(&ire->ire_lock);
17203 		gw_addr_v6 = ire->ire_gateway_addr_v6;
17204 		mutex_exit(&ire->ire_lock);
17205 
17206 		if (ifrt->ifrt_zoneid != ire->ire_zoneid ||
17207 		    ifrt->ifrt_type != ire->ire_type)
17208 			continue;
17209 
17210 		if (ill->ill_isv6 ?
17211 		    (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
17212 		    &ire->ire_addr_v6) &&
17213 		    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
17214 		    &gw_addr_v6) &&
17215 		    IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
17216 		    &ire->ire_mask_v6)) :
17217 		    (ifrt->ifrt_addr == ire->ire_addr &&
17218 		    ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
17219 		    ifrt->ifrt_mask == ire->ire_mask)) {
17220 			*mpp = mp->b_cont;
17221 			ill->ill_saved_ire_cnt--;
17222 			freeb(mp);
17223 			break;
17224 		}
17225 	}
17226 	mutex_exit(&ill->ill_saved_ire_lock);
17227 }
17228 
17229 /*
17230  * IP multirouting broadcast routes handling
17231  * Append CGTP broadcast IREs to regular ones created
17232  * at ifconfig time.
17233  * The usage is a route add <cgtp_bc> <nic_bc> -multirt i.e., both
17234  * the destination and the gateway are broadcast addresses.
17235  * The caller has verified that the destination is an IRE_BROADCAST and that
17236  * RTF_MULTIRT was set. Here if the gateway is a broadcast address, then
17237  * we create a MULTIRT IRE_BROADCAST.
17238  * Note that the IRE_HOST created by ire_rt_add doesn't get found by anything
17239  * since the IRE_BROADCAST takes precedence; ire_add_v4 does head insertion.
17240  */
17241 static void
17242 ip_cgtp_bcast_add(ire_t *ire, ip_stack_t *ipst)
17243 {
17244 	ire_t *ire_prim;
17245 
17246 	ASSERT(ire != NULL);
17247 
17248 	ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17249 	    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
17250 	    NULL);
17251 	if (ire_prim != NULL) {
17252 		/*
17253 		 * We are in the special case of broadcasts for
17254 		 * CGTP. We add an IRE_BROADCAST that holds
17255 		 * the RTF_MULTIRT flag, the destination
17256 		 * address and the low level
17257 		 * info of ire_prim. In other words, CGTP
17258 		 * broadcast is added to the redundant ipif.
17259 		 */
17260 		ill_t *ill_prim;
17261 		ire_t  *bcast_ire;
17262 
17263 		ill_prim = ire_prim->ire_ill;
17264 
17265 		ip2dbg(("ip_cgtp_filter_bcast_add: ire_prim %p, ill_prim %p\n",
17266 		    (void *)ire_prim, (void *)ill_prim));
17267 
17268 		bcast_ire = ire_create(
17269 		    (uchar_t *)&ire->ire_addr,
17270 		    (uchar_t *)&ip_g_all_ones,
17271 		    (uchar_t *)&ire->ire_gateway_addr,
17272 		    IRE_BROADCAST,
17273 		    ill_prim,
17274 		    GLOBAL_ZONEID,	/* CGTP is only for the global zone */
17275 		    ire->ire_flags | RTF_KERNEL,
17276 		    NULL,
17277 		    ipst);
17278 
17279 		/*
17280 		 * Here we assume that ire_add does head insertion so that
17281 		 * the added IRE_BROADCAST comes before the existing IRE_HOST.
17282 		 */
17283 		if (bcast_ire != NULL) {
17284 			if (ire->ire_flags & RTF_SETSRC) {
17285 				bcast_ire->ire_setsrc_addr =
17286 				    ire->ire_setsrc_addr;
17287 			}
17288 			bcast_ire = ire_add(bcast_ire);
17289 			if (bcast_ire != NULL) {
17290 				ip2dbg(("ip_cgtp_filter_bcast_add: "
17291 				    "added bcast_ire %p\n",
17292 				    (void *)bcast_ire));
17293 
17294 				ill_save_ire(ill_prim, bcast_ire);
17295 				ire_refrele(bcast_ire);
17296 			}
17297 		}
17298 		ire_refrele(ire_prim);
17299 	}
17300 }
17301 
17302 /*
17303  * IP multirouting broadcast routes handling
17304  * Remove the broadcast ire.
17305  * The usage is a route delete <cgtp_bc> <nic_bc> -multirt i.e., both
17306  * the destination and the gateway are broadcast addresses.
17307  * The caller has only verified that RTF_MULTIRT was set. We check
17308  * that the destination is broadcast and that the gateway is a broadcast
17309  * address, and if so delete the IRE added by ip_cgtp_bcast_add().
17310  */
17311 static void
17312 ip_cgtp_bcast_delete(ire_t *ire, ip_stack_t *ipst)
17313 {
17314 	ASSERT(ire != NULL);
17315 
17316 	if (ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST) {
17317 		ire_t *ire_prim;
17318 
17319 		ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17320 		    IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0,
17321 		    ipst, NULL);
17322 		if (ire_prim != NULL) {
17323 			ill_t *ill_prim;
17324 			ire_t  *bcast_ire;
17325 
17326 			ill_prim = ire_prim->ire_ill;
17327 
17328 			ip2dbg(("ip_cgtp_filter_bcast_delete: "
17329 			    "ire_prim %p, ill_prim %p\n",
17330 			    (void *)ire_prim, (void *)ill_prim));
17331 
17332 			bcast_ire = ire_ftable_lookup_v4(ire->ire_addr, 0,
17333 			    ire->ire_gateway_addr, IRE_BROADCAST,
17334 			    ill_prim, ALL_ZONES, NULL,
17335 			    MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_ILL |
17336 			    MATCH_IRE_MASK, 0, ipst, NULL);
17337 
17338 			if (bcast_ire != NULL) {
17339 				ip2dbg(("ip_cgtp_filter_bcast_delete: "
17340 				    "looked up bcast_ire %p\n",
17341 				    (void *)bcast_ire));
17342 				ill_remove_saved_ire(bcast_ire->ire_ill,
17343 				    bcast_ire);
17344 				ire_delete(bcast_ire);
17345 				ire_refrele(bcast_ire);
17346 			}
17347 			ire_refrele(ire_prim);
17348 		}
17349 	}
17350 }
17351 
17352 /*
17353  * Derive an interface id from the link layer address.
17354  * Knows about IEEE 802 and IEEE EUI-64 mappings.
17355  */
17356 static void
17357 ip_ether_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17358 {
17359 	char		*addr;
17360 
17361 	/*
17362 	 * Note that some IPv6 interfaces get plumbed over links that claim to
17363 	 * be DL_ETHER, but don't actually have Ethernet MAC addresses (e.g.
17364 	 * PPP links).  The ETHERADDRL check here ensures that we only set the
17365 	 * interface ID on IPv6 interfaces above links that actually have real
17366 	 * Ethernet addresses.
17367 	 */
17368 	if (ill->ill_phys_addr_length == ETHERADDRL) {
17369 		/* Form EUI-64 like address */
17370 		addr = (char *)&v6addr->s6_addr32[2];
17371 		bcopy(ill->ill_phys_addr, addr, 3);
17372 		addr[0] ^= 0x2;		/* Toggle Universal/Local bit */
17373 		addr[3] = (char)0xff;
17374 		addr[4] = (char)0xfe;
17375 		bcopy(ill->ill_phys_addr + 3, addr + 5, 3);
17376 	}
17377 }
17378 
17379 /* ARGSUSED */
17380 static void
17381 ip_nodef_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17382 {
17383 }
17384 
17385 typedef struct ipmp_ifcookie {
17386 	uint32_t	ic_hostid;
17387 	char		ic_ifname[LIFNAMSIZ];
17388 	char		ic_zonename[ZONENAME_MAX];
17389 } ipmp_ifcookie_t;
17390 
17391 /*
17392  * Construct a pseudo-random interface ID for the IPMP interface that's both
17393  * predictable and (almost) guaranteed to be unique.
17394  */
17395 static void
17396 ip_ipmp_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17397 {
17398 	zone_t		*zp;
17399 	uint8_t		*addr;
17400 	uchar_t		hash[16];
17401 	ulong_t		hostid;
17402 	MD5_CTX		ctx;
17403 	ipmp_ifcookie_t	ic = { 0 };
17404 
17405 	ASSERT(IS_IPMP(ill));
17406 
17407 	(void) ddi_strtoul(hw_serial, NULL, 10, &hostid);
17408 	ic.ic_hostid = htonl((uint32_t)hostid);
17409 
17410 	(void) strlcpy(ic.ic_ifname, ill->ill_name, LIFNAMSIZ);
17411 
17412 	if ((zp = zone_find_by_id(ill->ill_zoneid)) != NULL) {
17413 		(void) strlcpy(ic.ic_zonename, zp->zone_name, ZONENAME_MAX);
17414 		zone_rele(zp);
17415 	}
17416 
17417 	MD5Init(&ctx);
17418 	MD5Update(&ctx, &ic, sizeof (ic));
17419 	MD5Final(hash, &ctx);
17420 
17421 	/*
17422 	 * Map the hash to an interface ID per the basic approach in RFC3041.
17423 	 */
17424 	addr = &v6addr->s6_addr8[8];
17425 	bcopy(hash + 8, addr, sizeof (uint64_t));
17426 	addr[0] &= ~0x2;				/* set local bit */
17427 }
17428 
17429 /*
17430  * Map the multicast in6_addr_t in m_ip6addr to the physaddr for ethernet.
17431  */
17432 static void
17433 ip_ether_v6_mapping(ill_t *ill, uchar_t *m_ip6addr, uchar_t *m_physaddr)
17434 {
17435 	phyint_t *phyi = ill->ill_phyint;
17436 
17437 	/*
17438 	 * Check PHYI_MULTI_BCAST and length of physical
17439 	 * address to determine if we use the mapping or the
17440 	 * broadcast address.
17441 	 */
17442 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17443 	    ill->ill_phys_addr_length != ETHERADDRL) {
17444 		ip_mbcast_mapping(ill, m_ip6addr, m_physaddr);
17445 		return;
17446 	}
17447 	m_physaddr[0] = 0x33;
17448 	m_physaddr[1] = 0x33;
17449 	m_physaddr[2] = m_ip6addr[12];
17450 	m_physaddr[3] = m_ip6addr[13];
17451 	m_physaddr[4] = m_ip6addr[14];
17452 	m_physaddr[5] = m_ip6addr[15];
17453 }
17454 
17455 /*
17456  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for ethernet.
17457  */
17458 static void
17459 ip_ether_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17460 {
17461 	phyint_t *phyi = ill->ill_phyint;
17462 
17463 	/*
17464 	 * Check PHYI_MULTI_BCAST and length of physical
17465 	 * address to determine if we use the mapping or the
17466 	 * broadcast address.
17467 	 */
17468 	if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17469 	    ill->ill_phys_addr_length != ETHERADDRL) {
17470 		ip_mbcast_mapping(ill, m_ipaddr, m_physaddr);
17471 		return;
17472 	}
17473 	m_physaddr[0] = 0x01;
17474 	m_physaddr[1] = 0x00;
17475 	m_physaddr[2] = 0x5e;
17476 	m_physaddr[3] = m_ipaddr[1] & 0x7f;
17477 	m_physaddr[4] = m_ipaddr[2];
17478 	m_physaddr[5] = m_ipaddr[3];
17479 }
17480 
17481 /* ARGSUSED */
17482 static void
17483 ip_mbcast_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17484 {
17485 	/*
17486 	 * for the MULTI_BCAST case and other cases when we want to
17487 	 * use the link-layer broadcast address for multicast.
17488 	 */
17489 	uint8_t	*bphys_addr;
17490 	dl_unitdata_req_t *dlur;
17491 
17492 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17493 	if (ill->ill_sap_length < 0) {
17494 		bphys_addr = (uchar_t *)dlur +
17495 		    dlur->dl_dest_addr_offset;
17496 	} else  {
17497 		bphys_addr = (uchar_t *)dlur +
17498 		    dlur->dl_dest_addr_offset + ill->ill_sap_length;
17499 	}
17500 
17501 	bcopy(bphys_addr, m_physaddr, ill->ill_phys_addr_length);
17502 }
17503 
17504 /*
17505  * Derive IPoIB interface id from the link layer address.
17506  */
17507 static void
17508 ip_ib_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17509 {
17510 	char		*addr;
17511 
17512 	ASSERT(ill->ill_phys_addr_length == 20);
17513 	addr = (char *)&v6addr->s6_addr32[2];
17514 	bcopy(ill->ill_phys_addr + 12, addr, 8);
17515 	/*
17516 	 * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
17517 	 * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
17518 	 * rules. In these cases, the IBA considers these GUIDs to be in
17519 	 * "Modified EUI-64" format, and thus toggling the u/l bit is not
17520 	 * required; vendors are required not to assign global EUI-64's
17521 	 * that differ only in u/l bit values, thus guaranteeing uniqueness
17522 	 * of the interface identifier. Whether the GUID is in modified
17523 	 * or proper EUI-64 format, the ipv6 identifier must have the u/l
17524 	 * bit set to 1.
17525 	 */
17526 	addr[0] |= 2;			/* Set Universal/Local bit to 1 */
17527 }
17528 
17529 /*
17530  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for InfiniBand.
17531  * Note on mapping from multicast IP addresses to IPoIB multicast link
17532  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
17533  * The format of an IPoIB multicast address is:
17534  *
17535  *  4 byte QPN      Scope Sign.  Pkey
17536  * +--------------------------------------------+
17537  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
17538  * +--------------------------------------------+
17539  *
17540  * The Scope and Pkey components are properties of the IBA port and
17541  * network interface. They can be ascertained from the broadcast address.
17542  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
17543  */
17544 static void
17545 ip_ib_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17546 {
17547 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17548 	    0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
17549 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17550 	uint8_t	*bphys_addr;
17551 	dl_unitdata_req_t *dlur;
17552 
17553 	bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17554 
17555 	/*
17556 	 * RFC 4391: IPv4 MGID is 28-bit long.
17557 	 */
17558 	m_physaddr[16] = m_ipaddr[0] & 0x0f;
17559 	m_physaddr[17] = m_ipaddr[1];
17560 	m_physaddr[18] = m_ipaddr[2];
17561 	m_physaddr[19] = m_ipaddr[3];
17562 
17563 
17564 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17565 	if (ill->ill_sap_length < 0) {
17566 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17567 	} else  {
17568 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17569 		    ill->ill_sap_length;
17570 	}
17571 	/*
17572 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
17573 	 */
17574 	m_physaddr[5] = bphys_addr[5];
17575 	m_physaddr[8] = bphys_addr[8];
17576 	m_physaddr[9] = bphys_addr[9];
17577 }
17578 
17579 static void
17580 ip_ib_v6_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17581 {
17582 	static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17583 	    0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
17584 	    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17585 	uint8_t	*bphys_addr;
17586 	dl_unitdata_req_t *dlur;
17587 
17588 	bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17589 
17590 	/*
17591 	 * RFC 4391: IPv4 MGID is 80-bit long.
17592 	 */
17593 	bcopy(&m_ipaddr[6], &m_physaddr[10], 10);
17594 
17595 	dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17596 	if (ill->ill_sap_length < 0) {
17597 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17598 	} else  {
17599 		bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17600 		    ill->ill_sap_length;
17601 	}
17602 	/*
17603 	 * Now fill in the IBA scope/Pkey values from the broadcast address.
17604 	 */
17605 	m_physaddr[5] = bphys_addr[5];
17606 	m_physaddr[8] = bphys_addr[8];
17607 	m_physaddr[9] = bphys_addr[9];
17608 }
17609 
17610 /*
17611  * Derive IPv6 interface id from an IPv4 link-layer address (e.g. from an IPv4
17612  * tunnel).  The IPv4 address simply get placed in the lower 4 bytes of the
17613  * IPv6 interface id.  This is a suggested mechanism described in section 3.7
17614  * of RFC4213.
17615  */
17616 static void
17617 ip_ipv4_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17618 {
17619 	ASSERT(ill->ill_phys_addr_length == sizeof (ipaddr_t));
17620 	v6addr->s6_addr32[2] = 0;
17621 	bcopy(physaddr, &v6addr->s6_addr32[3], sizeof (ipaddr_t));
17622 }
17623 
17624 /*
17625  * Derive IPv6 interface id from an IPv6 link-layer address (e.g. from an IPv6
17626  * tunnel).  The lower 8 bytes of the IPv6 address simply become the interface
17627  * id.
17628  */
17629 static void
17630 ip_ipv6_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17631 {
17632 	in6_addr_t *v6lladdr = (in6_addr_t *)physaddr;
17633 
17634 	ASSERT(ill->ill_phys_addr_length == sizeof (in6_addr_t));
17635 	bcopy(&v6lladdr->s6_addr32[2], &v6addr->s6_addr32[2], 8);
17636 }
17637 
17638 static void
17639 ip_ipv6_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17640 {
17641 	ip_ipv6_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17642 }
17643 
17644 static void
17645 ip_ipv6_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17646 {
17647 	ip_ipv6_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17648 }
17649 
17650 static void
17651 ip_ipv4_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17652 {
17653 	ip_ipv4_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17654 }
17655 
17656 static void
17657 ip_ipv4_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17658 {
17659 	ip_ipv4_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17660 }
17661 
17662 /*
17663  * Lookup an ill and verify that the zoneid has an ipif on that ill.
17664  * Returns an held ill, or NULL.
17665  */
17666 ill_t *
17667 ill_lookup_on_ifindex_zoneid(uint_t index, zoneid_t zoneid, boolean_t isv6,
17668     ip_stack_t *ipst)
17669 {
17670 	ill_t	*ill;
17671 	ipif_t	*ipif;
17672 
17673 	ill = ill_lookup_on_ifindex(index, isv6, ipst);
17674 	if (ill == NULL)
17675 		return (NULL);
17676 
17677 	mutex_enter(&ill->ill_lock);
17678 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17679 		if (IPIF_IS_CONDEMNED(ipif))
17680 			continue;
17681 		if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
17682 		    ipif->ipif_zoneid != ALL_ZONES)
17683 			continue;
17684 
17685 		mutex_exit(&ill->ill_lock);
17686 		return (ill);
17687 	}
17688 	mutex_exit(&ill->ill_lock);
17689 	ill_refrele(ill);
17690 	return (NULL);
17691 }
17692 
17693 /*
17694  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
17695  * If a pointer to an ipif_t is returned then the caller will need to do
17696  * an ill_refrele().
17697  */
17698 ipif_t *
17699 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6,
17700     ip_stack_t *ipst)
17701 {
17702 	ipif_t *ipif;
17703 	ill_t *ill;
17704 
17705 	ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
17706 	if (ill == NULL)
17707 		return (NULL);
17708 
17709 	mutex_enter(&ill->ill_lock);
17710 	if (ill->ill_state_flags & ILL_CONDEMNED) {
17711 		mutex_exit(&ill->ill_lock);
17712 		ill_refrele(ill);
17713 		return (NULL);
17714 	}
17715 
17716 	for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17717 		if (!IPIF_CAN_LOOKUP(ipif))
17718 			continue;
17719 		if (lifidx == ipif->ipif_id) {
17720 			ipif_refhold_locked(ipif);
17721 			break;
17722 		}
17723 	}
17724 
17725 	mutex_exit(&ill->ill_lock);
17726 	ill_refrele(ill);
17727 	return (ipif);
17728 }
17729 
17730 /*
17731  * Set ill_inputfn based on the current know state.
17732  * This needs to be called when any of the factors taken into
17733  * account changes.
17734  */
17735 void
17736 ill_set_inputfn(ill_t *ill)
17737 {
17738 	ip_stack_t	*ipst = ill->ill_ipst;
17739 
17740 	if (ill->ill_isv6) {
17741 		if (is_system_labeled())
17742 			ill->ill_inputfn = ill_input_full_v6;
17743 		else
17744 			ill->ill_inputfn = ill_input_short_v6;
17745 	} else {
17746 		if (is_system_labeled())
17747 			ill->ill_inputfn = ill_input_full_v4;
17748 		else if (ill->ill_dhcpinit != 0)
17749 			ill->ill_inputfn = ill_input_full_v4;
17750 		else if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head
17751 		    != NULL)
17752 			ill->ill_inputfn = ill_input_full_v4;
17753 		else if (ipst->ips_ip_cgtp_filter &&
17754 		    ipst->ips_ip_cgtp_filter_ops != NULL)
17755 			ill->ill_inputfn = ill_input_full_v4;
17756 		else
17757 			ill->ill_inputfn = ill_input_short_v4;
17758 	}
17759 }
17760 
17761 /*
17762  * Re-evaluate ill_inputfn for all the IPv4 ills.
17763  * Used when RSVP and CGTP comes and goes.
17764  */
17765 void
17766 ill_set_inputfn_all(ip_stack_t *ipst)
17767 {
17768 	ill_walk_context_t	ctx;
17769 	ill_t			*ill;
17770 
17771 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
17772 	ill = ILL_START_WALK_V4(&ctx, ipst);
17773 	for (; ill != NULL; ill = ill_next(&ctx, ill))
17774 		ill_set_inputfn(ill);
17775 
17776 	rw_exit(&ipst->ips_ill_g_lock);
17777 }
17778 
17779 /*
17780  * Set the physical address information for `ill' to the contents of the
17781  * dl_notify_ind_t pointed to by `mp'.  Must be called as writer, and will be
17782  * asynchronous if `ill' cannot immediately be quiesced -- in which case
17783  * EINPROGRESS will be returned.
17784  */
17785 int
17786 ill_set_phys_addr(ill_t *ill, mblk_t *mp)
17787 {
17788 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17789 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)mp->b_rptr;
17790 
17791 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17792 
17793 	if (dlindp->dl_data != DL_IPV6_LINK_LAYER_ADDR &&
17794 	    dlindp->dl_data != DL_CURR_DEST_ADDR &&
17795 	    dlindp->dl_data != DL_CURR_PHYS_ADDR) {
17796 		/* Changing DL_IPV6_TOKEN is not yet supported */
17797 		return (0);
17798 	}
17799 
17800 	/*
17801 	 * We need to store up to two copies of `mp' in `ill'.  Due to the
17802 	 * design of ipsq_pending_mp_add(), we can't pass them as separate
17803 	 * arguments to ill_set_phys_addr_tail().  Instead, chain them
17804 	 * together here, then pull 'em apart in ill_set_phys_addr_tail().
17805 	 */
17806 	if ((mp = copyb(mp)) == NULL || (mp->b_cont = copyb(mp)) == NULL) {
17807 		freemsg(mp);
17808 		return (ENOMEM);
17809 	}
17810 
17811 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
17812 
17813 	/*
17814 	 * Since we'll only do a logical down, we can't rely on ipif_down
17815 	 * to turn on ILL_DOWN_IN_PROGRESS, or for the DL_BIND_ACK to reset
17816 	 * ILL_DOWN_IN_PROGRESS. We instead manage this separately for this
17817 	 * case, to quiesce ire's and nce's for ill_is_quiescent.
17818 	 */
17819 	mutex_enter(&ill->ill_lock);
17820 	ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
17821 	/* no more ire/nce addition allowed */
17822 	mutex_exit(&ill->ill_lock);
17823 
17824 	/*
17825 	 * If we can quiesce the ill, then set the address.  If not, then
17826 	 * ill_set_phys_addr_tail() will be called from ipif_ill_refrele_tail().
17827 	 */
17828 	ill_down_ipifs(ill, B_TRUE);
17829 	mutex_enter(&ill->ill_lock);
17830 	if (!ill_is_quiescent(ill)) {
17831 		/* call cannot fail since `conn_t *' argument is NULL */
17832 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
17833 		    mp, ILL_DOWN);
17834 		mutex_exit(&ill->ill_lock);
17835 		return (EINPROGRESS);
17836 	}
17837 	mutex_exit(&ill->ill_lock);
17838 
17839 	ill_set_phys_addr_tail(ipsq, ill->ill_rq, mp, NULL);
17840 	return (0);
17841 }
17842 
17843 /*
17844  * When the allowed-ips link property is set on the datalink, IP receives a
17845  * DL_NOTE_ALLOWED_IPS notification that is processed in ill_set_allowed_ips()
17846  * to initialize the ill_allowed_ips[] array in the ill_t. This array is then
17847  * used to vet addresses passed to ip_sioctl_addr() and to ensure that the
17848  * only IP addresses configured on the ill_t are those in the ill_allowed_ips[]
17849  * array.
17850  */
17851 void
17852 ill_set_allowed_ips(ill_t *ill, mblk_t *mp)
17853 {
17854 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17855 	dl_notify_ind_t	*dlip = (dl_notify_ind_t *)mp->b_rptr;
17856 	mac_protect_t *mrp;
17857 	int i;
17858 
17859 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17860 	mrp = (mac_protect_t *)&dlip[1];
17861 
17862 	if (mrp->mp_ipaddrcnt == 0) { /* reset allowed-ips */
17863 		kmem_free(ill->ill_allowed_ips,
17864 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17865 		ill->ill_allowed_ips_cnt = 0;
17866 		ill->ill_allowed_ips = NULL;
17867 		mutex_enter(&ill->ill_phyint->phyint_lock);
17868 		ill->ill_phyint->phyint_flags &= ~PHYI_L3PROTECT;
17869 		mutex_exit(&ill->ill_phyint->phyint_lock);
17870 		return;
17871 	}
17872 
17873 	if (ill->ill_allowed_ips != NULL) {
17874 		kmem_free(ill->ill_allowed_ips,
17875 		    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17876 	}
17877 	ill->ill_allowed_ips_cnt = mrp->mp_ipaddrcnt;
17878 	ill->ill_allowed_ips = kmem_alloc(
17879 	    ill->ill_allowed_ips_cnt * sizeof (in6_addr_t), KM_SLEEP);
17880 	for (i = 0; i < mrp->mp_ipaddrcnt;  i++)
17881 		ill->ill_allowed_ips[i] = mrp->mp_ipaddrs[i].ip_addr;
17882 
17883 	mutex_enter(&ill->ill_phyint->phyint_lock);
17884 	ill->ill_phyint->phyint_flags |= PHYI_L3PROTECT;
17885 	mutex_exit(&ill->ill_phyint->phyint_lock);
17886 }
17887 
17888 /*
17889  * Once the ill associated with `q' has quiesced, set its physical address
17890  * information to the values in `addrmp'.  Note that two copies of `addrmp'
17891  * are passed (linked by b_cont), since we sometimes need to save two distinct
17892  * copies in the ill_t, and our context doesn't permit sleeping or allocation
17893  * failure (we'll free the other copy if it's not needed).  Since the ill_t
17894  * is quiesced, we know any stale nce's with the old address information have
17895  * already been removed, so we don't need to call nce_flush().
17896  */
17897 /* ARGSUSED */
17898 static void
17899 ill_set_phys_addr_tail(ipsq_t *ipsq, queue_t *q, mblk_t *addrmp, void *dummy)
17900 {
17901 	ill_t		*ill = q->q_ptr;
17902 	mblk_t		*addrmp2 = unlinkb(addrmp);
17903 	dl_notify_ind_t	*dlindp = (dl_notify_ind_t *)addrmp->b_rptr;
17904 	uint_t		addrlen, addroff;
17905 	int		status;
17906 
17907 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17908 
17909 	addroff	= dlindp->dl_addr_offset;
17910 	addrlen = dlindp->dl_addr_length - ABS(ill->ill_sap_length);
17911 
17912 	switch (dlindp->dl_data) {
17913 	case DL_IPV6_LINK_LAYER_ADDR:
17914 		ill_set_ndmp(ill, addrmp, addroff, addrlen);
17915 		freemsg(addrmp2);
17916 		break;
17917 
17918 	case DL_CURR_DEST_ADDR:
17919 		freemsg(ill->ill_dest_addr_mp);
17920 		ill->ill_dest_addr = addrmp->b_rptr + addroff;
17921 		ill->ill_dest_addr_mp = addrmp;
17922 		if (ill->ill_isv6) {
17923 			ill_setdesttoken(ill);
17924 			ipif_setdestlinklocal(ill->ill_ipif);
17925 		}
17926 		freemsg(addrmp2);
17927 		break;
17928 
17929 	case DL_CURR_PHYS_ADDR:
17930 		freemsg(ill->ill_phys_addr_mp);
17931 		ill->ill_phys_addr = addrmp->b_rptr + addroff;
17932 		ill->ill_phys_addr_mp = addrmp;
17933 		ill->ill_phys_addr_length = addrlen;
17934 		if (ill->ill_isv6)
17935 			ill_set_ndmp(ill, addrmp2, addroff, addrlen);
17936 		else
17937 			freemsg(addrmp2);
17938 		if (ill->ill_isv6) {
17939 			ill_setdefaulttoken(ill);
17940 			ipif_setlinklocal(ill->ill_ipif);
17941 		}
17942 		break;
17943 	default:
17944 		ASSERT(0);
17945 	}
17946 
17947 	/*
17948 	 * reset ILL_DOWN_IN_PROGRESS so that we can successfully add ires
17949 	 * as we bring the ipifs up again.
17950 	 */
17951 	mutex_enter(&ill->ill_lock);
17952 	ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
17953 	mutex_exit(&ill->ill_lock);
17954 	/*
17955 	 * If there are ipifs to bring up, ill_up_ipifs() will return
17956 	 * EINPROGRESS, and ipsq_current_finish() will be called by
17957 	 * ip_rput_dlpi_writer() or arp_bringup_done() when the last ipif is
17958 	 * brought up.
17959 	 */
17960 	status = ill_up_ipifs(ill, q, addrmp);
17961 	if (status != EINPROGRESS)
17962 		ipsq_current_finish(ipsq);
17963 }
17964 
17965 /*
17966  * Helper routine for setting the ill_nd_lla fields.
17967  */
17968 void
17969 ill_set_ndmp(ill_t *ill, mblk_t *ndmp, uint_t addroff, uint_t addrlen)
17970 {
17971 	freemsg(ill->ill_nd_lla_mp);
17972 	ill->ill_nd_lla = ndmp->b_rptr + addroff;
17973 	ill->ill_nd_lla_mp = ndmp;
17974 	ill->ill_nd_lla_len = addrlen;
17975 }
17976 
17977 /*
17978  * Replumb the ill.
17979  */
17980 int
17981 ill_replumb(ill_t *ill, mblk_t *mp)
17982 {
17983 	ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17984 
17985 	ASSERT(IAM_WRITER_IPSQ(ipsq));
17986 
17987 	ipsq_current_start(ipsq, ill->ill_ipif, 0);
17988 
17989 	/*
17990 	 * If we can quiesce the ill, then continue.  If not, then
17991 	 * ill_replumb_tail() will be called from ipif_ill_refrele_tail().
17992 	 */
17993 	ill_down_ipifs(ill, B_FALSE);
17994 
17995 	mutex_enter(&ill->ill_lock);
17996 	if (!ill_is_quiescent(ill)) {
17997 		/* call cannot fail since `conn_t *' argument is NULL */
17998 		(void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
17999 		    mp, ILL_DOWN);
18000 		mutex_exit(&ill->ill_lock);
18001 		return (EINPROGRESS);
18002 	}
18003 	mutex_exit(&ill->ill_lock);
18004 
18005 	ill_replumb_tail(ipsq, ill->ill_rq, mp, NULL);
18006 	return (0);
18007 }
18008 
18009 /* ARGSUSED */
18010 static void
18011 ill_replumb_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
18012 {
18013 	ill_t *ill = q->q_ptr;
18014 	int err;
18015 	conn_t *connp = NULL;
18016 
18017 	ASSERT(IAM_WRITER_IPSQ(ipsq));
18018 	freemsg(ill->ill_replumb_mp);
18019 	ill->ill_replumb_mp = copyb(mp);
18020 
18021 	if (ill->ill_replumb_mp == NULL) {
18022 		/* out of memory */
18023 		ipsq_current_finish(ipsq);
18024 		return;
18025 	}
18026 
18027 	mutex_enter(&ill->ill_lock);
18028 	ill->ill_up_ipifs = ipsq_pending_mp_add(NULL, ill->ill_ipif,
18029 	    ill->ill_rq, ill->ill_replumb_mp, 0);
18030 	mutex_exit(&ill->ill_lock);
18031 
18032 	if (!ill->ill_up_ipifs) {
18033 		/* already closing */
18034 		ipsq_current_finish(ipsq);
18035 		return;
18036 	}
18037 	ill->ill_replumbing = 1;
18038 	err = ill_down_ipifs_tail(ill);
18039 
18040 	/*
18041 	 * Successfully quiesced and brought down the interface, now we send
18042 	 * the DL_NOTE_REPLUMB_DONE message down to the driver. Reuse the
18043 	 * DL_NOTE_REPLUMB message.
18044 	 */
18045 	mp = mexchange(NULL, mp, sizeof (dl_notify_conf_t), M_PROTO,
18046 	    DL_NOTIFY_CONF);
18047 	ASSERT(mp != NULL);
18048 	((dl_notify_conf_t *)mp->b_rptr)->dl_notification =
18049 	    DL_NOTE_REPLUMB_DONE;
18050 	ill_dlpi_send(ill, mp);
18051 
18052 	/*
18053 	 * For IPv4, we would usually get EINPROGRESS because the ETHERTYPE_ARP
18054 	 * streams have to be unbound. When all the DLPI exchanges are done,
18055 	 * ipsq_current_finish() will be called by arp_bringup_done(). The
18056 	 * remainder of ipif bringup via ill_up_ipifs() will also be done in
18057 	 * arp_bringup_done().
18058 	 */
18059 	ASSERT(ill->ill_replumb_mp != NULL);
18060 	if (err == EINPROGRESS)
18061 		return;
18062 	else
18063 		ill->ill_replumb_mp = ipsq_pending_mp_get(ipsq, &connp);
18064 	ASSERT(connp == NULL);
18065 	if (err == 0 && ill->ill_replumb_mp != NULL &&
18066 	    ill_up_ipifs(ill, q, ill->ill_replumb_mp) == EINPROGRESS) {
18067 		return;
18068 	}
18069 	ipsq_current_finish(ipsq);
18070 }
18071 
18072 /*
18073  * Issue ioctl `cmd' on `lh'; caller provides the initial payload in `buf'
18074  * which is `bufsize' bytes.  On success, zero is returned and `buf' updated
18075  * as per the ioctl.  On failure, an errno is returned.
18076  */
18077 static int
18078 ip_ioctl(ldi_handle_t lh, int cmd, void *buf, uint_t bufsize, cred_t *cr)
18079 {
18080 	int rval;
18081 	struct strioctl iocb;
18082 
18083 	iocb.ic_cmd = cmd;
18084 	iocb.ic_timout = 15;
18085 	iocb.ic_len = bufsize;
18086 	iocb.ic_dp = buf;
18087 
18088 	return (ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval));
18089 }
18090 
18091 /*
18092  * Issue an SIOCGLIFCONF for address family `af' and store the result into a
18093  * dynamically-allocated `lifcp' that will be `bufsizep' bytes on success.
18094  */
18095 static int
18096 ip_lifconf_ioctl(ldi_handle_t lh, int af, struct lifconf *lifcp,
18097     uint_t *bufsizep, cred_t *cr)
18098 {
18099 	int err;
18100 	struct lifnum lifn;
18101 
18102 	bzero(&lifn, sizeof (lifn));
18103 	lifn.lifn_family = af;
18104 	lifn.lifn_flags = LIFC_UNDER_IPMP;
18105 
18106 	if ((err = ip_ioctl(lh, SIOCGLIFNUM, &lifn, sizeof (lifn), cr)) != 0)
18107 		return (err);
18108 
18109 	/*
18110 	 * Pad the interface count to account for additional interfaces that
18111 	 * may have been configured between the SIOCGLIFNUM and SIOCGLIFCONF.
18112 	 */
18113 	lifn.lifn_count += 4;
18114 	bzero(lifcp, sizeof (*lifcp));
18115 	lifcp->lifc_flags = LIFC_UNDER_IPMP;
18116 	lifcp->lifc_family = af;
18117 	lifcp->lifc_len = *bufsizep = lifn.lifn_count * sizeof (struct lifreq);
18118 	lifcp->lifc_buf = kmem_zalloc(*bufsizep, KM_SLEEP);
18119 
18120 	err = ip_ioctl(lh, SIOCGLIFCONF, lifcp, sizeof (*lifcp), cr);
18121 	if (err != 0) {
18122 		kmem_free(lifcp->lifc_buf, *bufsizep);
18123 		return (err);
18124 	}
18125 
18126 	return (0);
18127 }
18128 
18129 /*
18130  * Helper for ip_interface_cleanup() that removes the loopback interface.
18131  */
18132 static void
18133 ip_loopback_removeif(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18134 {
18135 	int err;
18136 	struct lifreq lifr;
18137 
18138 	bzero(&lifr, sizeof (lifr));
18139 	(void) strcpy(lifr.lifr_name, ipif_loopback_name);
18140 
18141 	/*
18142 	 * Attempt to remove the interface.  It may legitimately not exist
18143 	 * (e.g. the zone administrator unplumbed it), so ignore ENXIO.
18144 	 */
18145 	err = ip_ioctl(lh, SIOCLIFREMOVEIF, &lifr, sizeof (lifr), cr);
18146 	if (err != 0 && err != ENXIO) {
18147 		ip0dbg(("ip_loopback_removeif: IP%s SIOCLIFREMOVEIF failed: "
18148 		    "error %d\n", isv6 ? "v6" : "v4", err));
18149 	}
18150 }
18151 
18152 /*
18153  * Helper for ip_interface_cleanup() that ensures no IP interfaces are in IPMP
18154  * groups and that IPMP data addresses are down.  These conditions must be met
18155  * so that IPMP interfaces can be I_PUNLINK'd, as per ip_sioctl_plink_ipmp().
18156  */
18157 static void
18158 ip_ipmp_cleanup(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18159 {
18160 	int af = isv6 ? AF_INET6 : AF_INET;
18161 	int i, nifs;
18162 	int err;
18163 	uint_t bufsize;
18164 	uint_t lifrsize = sizeof (struct lifreq);
18165 	struct lifconf lifc;
18166 	struct lifreq *lifrp;
18167 
18168 	if ((err = ip_lifconf_ioctl(lh, af, &lifc, &bufsize, cr)) != 0) {
18169 		cmn_err(CE_WARN, "ip_ipmp_cleanup: cannot get interface list "
18170 		    "(error %d); any IPMP interfaces cannot be shutdown", err);
18171 		return;
18172 	}
18173 
18174 	nifs = lifc.lifc_len / lifrsize;
18175 	for (lifrp = lifc.lifc_req, i = 0; i < nifs; i++, lifrp++) {
18176 		err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18177 		if (err != 0) {
18178 			cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot get "
18179 			    "flags: error %d", lifrp->lifr_name, err);
18180 			continue;
18181 		}
18182 
18183 		if (lifrp->lifr_flags & IFF_IPMP) {
18184 			if ((lifrp->lifr_flags & (IFF_UP|IFF_DUPLICATE)) == 0)
18185 				continue;
18186 
18187 			lifrp->lifr_flags &= ~IFF_UP;
18188 			err = ip_ioctl(lh, SIOCSLIFFLAGS, lifrp, lifrsize, cr);
18189 			if (err != 0) {
18190 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18191 				    "bring down (error %d); IPMP interface may "
18192 				    "not be shutdown", lifrp->lifr_name, err);
18193 			}
18194 
18195 			/*
18196 			 * Check if IFF_DUPLICATE is still set -- and if so,
18197 			 * reset the address to clear it.
18198 			 */
18199 			err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18200 			if (err != 0 || !(lifrp->lifr_flags & IFF_DUPLICATE))
18201 				continue;
18202 
18203 			err = ip_ioctl(lh, SIOCGLIFADDR, lifrp, lifrsize, cr);
18204 			if (err != 0 || (err = ip_ioctl(lh, SIOCGLIFADDR,
18205 			    lifrp, lifrsize, cr)) != 0) {
18206 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18207 				    "reset DAD (error %d); IPMP interface may "
18208 				    "not be shutdown", lifrp->lifr_name, err);
18209 			}
18210 			continue;
18211 		}
18212 
18213 		if (strchr(lifrp->lifr_name, IPIF_SEPARATOR_CHAR) == 0) {
18214 			lifrp->lifr_groupname[0] = '\0';
18215 			if ((err = ip_ioctl(lh, SIOCSLIFGROUPNAME, lifrp,
18216 			    lifrsize, cr)) != 0) {
18217 				cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18218 				    "leave IPMP group (error %d); associated "
18219 				    "IPMP interface may not be shutdown",
18220 				    lifrp->lifr_name, err);
18221 				continue;
18222 			}
18223 		}
18224 	}
18225 
18226 	kmem_free(lifc.lifc_buf, bufsize);
18227 }
18228 
18229 #define	UDPDEV		"/devices/pseudo/udp@0:udp"
18230 #define	UDP6DEV		"/devices/pseudo/udp6@0:udp6"
18231 
18232 /*
18233  * Remove the loopback interfaces and prep the IPMP interfaces to be torn down.
18234  * Non-loopback interfaces are either I_LINK'd or I_PLINK'd; the former go away
18235  * when the user-level processes in the zone are killed and the latter are
18236  * cleaned up by str_stack_shutdown().
18237  */
18238 void
18239 ip_interface_cleanup(ip_stack_t *ipst)
18240 {
18241 	ldi_handle_t	lh;
18242 	ldi_ident_t	li;
18243 	cred_t		*cr;
18244 	int		err;
18245 	int		i;
18246 	char		*devs[] = { UDP6DEV, UDPDEV };
18247 	netstackid_t	stackid = ipst->ips_netstack->netstack_stackid;
18248 
18249 	if ((err = ldi_ident_from_major(ddi_name_to_major("ip"), &li)) != 0) {
18250 		cmn_err(CE_WARN, "ip_interface_cleanup: cannot get ldi ident:"
18251 		    " error %d", err);
18252 		return;
18253 	}
18254 
18255 	cr = zone_get_kcred(netstackid_to_zoneid(stackid));
18256 	ASSERT(cr != NULL);
18257 
18258 	/*
18259 	 * NOTE: loop executes exactly twice and is hardcoded to know that the
18260 	 * first iteration is IPv6.  (Unrolling yields repetitious code, hence
18261 	 * the loop.)
18262 	 */
18263 	for (i = 0; i < 2; i++) {
18264 		err = ldi_open_by_name(devs[i], FREAD|FWRITE, cr, &lh, li);
18265 		if (err != 0) {
18266 			cmn_err(CE_WARN, "ip_interface_cleanup: cannot open %s:"
18267 			    " error %d", devs[i], err);
18268 			continue;
18269 		}
18270 
18271 		ip_loopback_removeif(lh, i == 0, cr);
18272 		ip_ipmp_cleanup(lh, i == 0, cr);
18273 
18274 		(void) ldi_close(lh, FREAD|FWRITE, cr);
18275 	}
18276 
18277 	ldi_ident_release(li);
18278 	crfree(cr);
18279 }
18280 
18281 /*
18282  * This needs to be in-sync with nic_event_t definition
18283  */
18284 static const char *
18285 ill_hook_event2str(nic_event_t event)
18286 {
18287 	switch (event) {
18288 	case NE_PLUMB:
18289 		return ("PLUMB");
18290 	case NE_UNPLUMB:
18291 		return ("UNPLUMB");
18292 	case NE_UP:
18293 		return ("UP");
18294 	case NE_DOWN:
18295 		return ("DOWN");
18296 	case NE_ADDRESS_CHANGE:
18297 		return ("ADDRESS_CHANGE");
18298 	case NE_LIF_UP:
18299 		return ("LIF_UP");
18300 	case NE_LIF_DOWN:
18301 		return ("LIF_DOWN");
18302 	case NE_IFINDEX_CHANGE:
18303 		return ("IFINDEX_CHANGE");
18304 	default:
18305 		return ("UNKNOWN");
18306 	}
18307 }
18308 
18309 void
18310 ill_nic_event_dispatch(ill_t *ill, lif_if_t lif, nic_event_t event,
18311     nic_event_data_t data, size_t datalen)
18312 {
18313 	ip_stack_t		*ipst = ill->ill_ipst;
18314 	hook_nic_event_int_t	*info;
18315 	const char		*str = NULL;
18316 
18317 	/* create a new nic event info */
18318 	if ((info = kmem_alloc(sizeof (*info), KM_NOSLEEP)) == NULL)
18319 		goto fail;
18320 
18321 	info->hnei_event.hne_nic = ill->ill_phyint->phyint_ifindex;
18322 	info->hnei_event.hne_lif = lif;
18323 	info->hnei_event.hne_event = event;
18324 	info->hnei_event.hne_protocol = ill->ill_isv6 ?
18325 	    ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data;
18326 	info->hnei_event.hne_data = NULL;
18327 	info->hnei_event.hne_datalen = 0;
18328 	info->hnei_stackid = ipst->ips_netstack->netstack_stackid;
18329 
18330 	if (data != NULL && datalen != 0) {
18331 		info->hnei_event.hne_data = kmem_alloc(datalen, KM_NOSLEEP);
18332 		if (info->hnei_event.hne_data == NULL)
18333 			goto fail;
18334 		bcopy(data, info->hnei_event.hne_data, datalen);
18335 		info->hnei_event.hne_datalen = datalen;
18336 	}
18337 
18338 	if (ddi_taskq_dispatch(eventq_queue_nic, ip_ne_queue_func, info,
18339 	    DDI_NOSLEEP) == DDI_SUCCESS)
18340 		return;
18341 
18342 fail:
18343 	if (info != NULL) {
18344 		if (info->hnei_event.hne_data != NULL) {
18345 			kmem_free(info->hnei_event.hne_data,
18346 			    info->hnei_event.hne_datalen);
18347 		}
18348 		kmem_free(info, sizeof (hook_nic_event_t));
18349 	}
18350 	str = ill_hook_event2str(event);
18351 	ip2dbg(("ill_nic_event_dispatch: could not dispatch %s nic event "
18352 	    "information for %s (ENOMEM)\n", str, ill->ill_name));
18353 }
18354 
18355 static int
18356 ipif_arp_up_done_tail(ipif_t *ipif, enum ip_resolver_action res_act)
18357 {
18358 	int		err = 0;
18359 	const in_addr_t	*addr = NULL;
18360 	nce_t		*nce = NULL;
18361 	ill_t		*ill = ipif->ipif_ill;
18362 	ill_t		*bound_ill;
18363 	boolean_t	added_ipif = B_FALSE;
18364 	uint16_t	state;
18365 	uint16_t	flags;
18366 
18367 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up_done_tail",
18368 	    ill_t *, ill, ipif_t *, ipif);
18369 	if (ipif->ipif_lcl_addr != INADDR_ANY) {
18370 		addr = &ipif->ipif_lcl_addr;
18371 	}
18372 
18373 	if ((ipif->ipif_flags & IPIF_UNNUMBERED) || addr == NULL) {
18374 		if (res_act != Res_act_initial)
18375 			return (EINVAL);
18376 	}
18377 
18378 	if (addr != NULL) {
18379 		ipmp_illgrp_t	*illg = ill->ill_grp;
18380 
18381 		/* add unicast nce for the local addr */
18382 
18383 		if (IS_IPMP(ill)) {
18384 			/*
18385 			 * If we're here via ipif_up(), then the ipif
18386 			 * won't be bound yet -- add it to the group,
18387 			 * which will bind it if possible. (We would
18388 			 * add it in ipif_up(), but deleting on failure
18389 			 * there is gruesome.)  If we're here via
18390 			 * ipmp_ill_bind_ipif(), then the ipif has
18391 			 * already been added to the group and we
18392 			 * just need to use the binding.
18393 			 */
18394 			if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
18395 				bound_ill  = ipmp_illgrp_add_ipif(illg, ipif);
18396 				if (bound_ill == NULL) {
18397 					/*
18398 					 * We couldn't bind the ipif to an ill
18399 					 * yet, so we have nothing to publish.
18400 					 * Mark the address as ready and return.
18401 					 */
18402 					ipif->ipif_addr_ready = 1;
18403 					return (0);
18404 				}
18405 				added_ipif = B_TRUE;
18406 			}
18407 		} else {
18408 			bound_ill = ill;
18409 		}
18410 
18411 		flags = (NCE_F_MYADDR | NCE_F_PUBLISH | NCE_F_AUTHORITY |
18412 		    NCE_F_NONUD);
18413 		/*
18414 		 * If this is an initial bring-up (or the ipif was never
18415 		 * completely brought up), do DAD.  Otherwise, we're here
18416 		 * because IPMP has rebound an address to this ill: send
18417 		 * unsolicited advertisements (ARP announcements) to
18418 		 * inform others.
18419 		 */
18420 		if (res_act == Res_act_initial || !ipif->ipif_addr_ready) {
18421 			state = ND_UNCHANGED; /* compute in nce_add_common() */
18422 		} else {
18423 			state = ND_REACHABLE;
18424 			flags |= NCE_F_UNSOL_ADV;
18425 		}
18426 
18427 retry:
18428 		err = nce_lookup_then_add_v4(ill,
18429 		    bound_ill->ill_phys_addr, bound_ill->ill_phys_addr_length,
18430 		    addr, flags, state, &nce);
18431 
18432 		/*
18433 		 * note that we may encounter EEXIST if we are moving
18434 		 * the nce as a result of a rebind operation.
18435 		 */
18436 		switch (err) {
18437 		case 0:
18438 			ipif->ipif_added_nce = 1;
18439 			nce->nce_ipif_cnt++;
18440 			break;
18441 		case EEXIST:
18442 			ip1dbg(("ipif_arp_up: NCE already exists for %s\n",
18443 			    ill->ill_name));
18444 			if (!NCE_MYADDR(nce->nce_common)) {
18445 				/*
18446 				 * A leftover nce from before this address
18447 				 * existed
18448 				 */
18449 				ncec_delete(nce->nce_common);
18450 				nce_refrele(nce);
18451 				nce = NULL;
18452 				goto retry;
18453 			}
18454 			if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
18455 				nce_refrele(nce);
18456 				nce = NULL;
18457 				ip1dbg(("ipif_arp_up: NCE already exists "
18458 				    "for %s:%u\n", ill->ill_name,
18459 				    ipif->ipif_id));
18460 				goto arp_up_done;
18461 			}
18462 			/*
18463 			 * Duplicate local addresses are permissible for
18464 			 * IPIF_POINTOPOINT interfaces which will get marked
18465 			 * IPIF_UNNUMBERED later in
18466 			 * ip_addr_availability_check().
18467 			 *
18468 			 * The nce_ipif_cnt field tracks the number of
18469 			 * ipifs that have nce_addr as their local address.
18470 			 */
18471 			ipif->ipif_addr_ready = 1;
18472 			ipif->ipif_added_nce = 1;
18473 			nce->nce_ipif_cnt++;
18474 			err = 0;
18475 			break;
18476 		default:
18477 			ASSERT(nce == NULL);
18478 			goto arp_up_done;
18479 		}
18480 		if (arp_no_defense) {
18481 			if ((ipif->ipif_flags & IPIF_UP) &&
18482 			    !ipif->ipif_addr_ready)
18483 				ipif_up_notify(ipif);
18484 			ipif->ipif_addr_ready = 1;
18485 		}
18486 	} else {
18487 		/* zero address. nothing to publish */
18488 		ipif->ipif_addr_ready = 1;
18489 	}
18490 	if (nce != NULL)
18491 		nce_refrele(nce);
18492 arp_up_done:
18493 	if (added_ipif && err != 0)
18494 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18495 	return (err);
18496 }
18497 
18498 int
18499 ipif_arp_up(ipif_t *ipif, enum ip_resolver_action res_act, boolean_t was_dup)
18500 {
18501 	int		err = 0;
18502 	ill_t		*ill = ipif->ipif_ill;
18503 	boolean_t	first_interface, wait_for_dlpi = B_FALSE;
18504 
18505 	DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up",
18506 	    ill_t *, ill, ipif_t *, ipif);
18507 
18508 	/*
18509 	 * need to bring up ARP or setup mcast mapping only
18510 	 * when the first interface is coming UP.
18511 	 */
18512 	first_interface = (ill->ill_ipif_up_count == 0 &&
18513 	    ill->ill_ipif_dup_count == 0 && !was_dup);
18514 
18515 	if (res_act == Res_act_initial && first_interface) {
18516 		/*
18517 		 * Send ATTACH + BIND
18518 		 */
18519 		err = arp_ll_up(ill);
18520 		if (err != EINPROGRESS && err != 0)
18521 			return (err);
18522 
18523 		/*
18524 		 * Add NCE for local address. Start DAD.
18525 		 * we'll wait to hear that DAD has finished
18526 		 * before using the interface.
18527 		 */
18528 		if (err == EINPROGRESS)
18529 			wait_for_dlpi = B_TRUE;
18530 	}
18531 
18532 	if (!wait_for_dlpi)
18533 		(void) ipif_arp_up_done_tail(ipif, res_act);
18534 
18535 	return (!wait_for_dlpi ? 0 : EINPROGRESS);
18536 }
18537 
18538 /*
18539  * Finish processing of "arp_up" after all the DLPI message
18540  * exchanges have completed between arp and the driver.
18541  */
18542 void
18543 arp_bringup_done(ill_t *ill, int err)
18544 {
18545 	mblk_t	*mp1;
18546 	ipif_t  *ipif;
18547 	conn_t *connp = NULL;
18548 	ipsq_t	*ipsq;
18549 	queue_t *q;
18550 
18551 	ip1dbg(("arp_bringup_done(%s)\n", ill->ill_name));
18552 
18553 	ASSERT(IAM_WRITER_ILL(ill));
18554 
18555 	ipsq = ill->ill_phyint->phyint_ipsq;
18556 	ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18557 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
18558 	ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18559 	if (mp1 == NULL) /* bringup was aborted by the user */
18560 		return;
18561 
18562 	/*
18563 	 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18564 	 * must have an associated conn_t.  Otherwise, we're bringing this
18565 	 * interface back up as part of handling an asynchronous event (e.g.,
18566 	 * physical address change).
18567 	 */
18568 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18569 		ASSERT(connp != NULL);
18570 		q = CONNP_TO_WQ(connp);
18571 	} else {
18572 		ASSERT(connp == NULL);
18573 		q = ill->ill_rq;
18574 	}
18575 	if (err == 0) {
18576 		if (ipif->ipif_isv6) {
18577 			if ((err = ipif_up_done_v6(ipif)) != 0)
18578 				ip0dbg(("arp_bringup_done: init failed\n"));
18579 		} else {
18580 			err = ipif_arp_up_done_tail(ipif, Res_act_initial);
18581 			if (err != 0 ||
18582 			    (err = ipif_up_done(ipif)) != 0) {
18583 				ip0dbg(("arp_bringup_done: "
18584 				    "init failed err %x\n", err));
18585 				(void) ipif_arp_down(ipif);
18586 			}
18587 
18588 		}
18589 	} else {
18590 		ip0dbg(("arp_bringup_done: DL_BIND_REQ failed\n"));
18591 	}
18592 
18593 	if ((err == 0) && (ill->ill_up_ipifs)) {
18594 		err = ill_up_ipifs(ill, q, mp1);
18595 		if (err == EINPROGRESS)
18596 			return;
18597 	}
18598 
18599 	/*
18600 	 * If we have a moved ipif to bring up, and everything has succeeded
18601 	 * to this point, bring it up on the IPMP ill.  Otherwise, leave it
18602 	 * down -- the admin can try to bring it up by hand if need be.
18603 	 */
18604 	if (ill->ill_move_ipif != NULL) {
18605 		ipif = ill->ill_move_ipif;
18606 		ip1dbg(("bringing up ipif %p on ill %s\n", (void *)ipif,
18607 		    ipif->ipif_ill->ill_name));
18608 		ill->ill_move_ipif = NULL;
18609 		if (err == 0) {
18610 			err = ipif_up(ipif, q, mp1);
18611 			if (err == EINPROGRESS)
18612 				return;
18613 		}
18614 	}
18615 
18616 	/*
18617 	 * The operation must complete without EINPROGRESS since
18618 	 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18619 	 * Otherwise, the operation will be stuck forever in the ipsq.
18620 	 */
18621 	ASSERT(err != EINPROGRESS);
18622 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18623 		DTRACE_PROBE4(ipif__ioctl, char *, "arp_bringup_done finish",
18624 		    int, ipsq->ipsq_xop->ipx_current_ioctl,
18625 		    ill_t *, ill, ipif_t *, ipif);
18626 		ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18627 	} else {
18628 		ipsq_current_finish(ipsq);
18629 	}
18630 }
18631 
18632 /*
18633  * Finish processing of arp replumb after all the DLPI message
18634  * exchanges have completed between arp and the driver.
18635  */
18636 void
18637 arp_replumb_done(ill_t *ill, int err)
18638 {
18639 	mblk_t	*mp1;
18640 	ipif_t  *ipif;
18641 	conn_t *connp = NULL;
18642 	ipsq_t	*ipsq;
18643 	queue_t *q;
18644 
18645 	ASSERT(IAM_WRITER_ILL(ill));
18646 
18647 	ipsq = ill->ill_phyint->phyint_ipsq;
18648 	ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18649 	mp1 = ipsq_pending_mp_get(ipsq, &connp);
18650 	ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18651 	if (mp1 == NULL) {
18652 		ip0dbg(("arp_replumb_done: bringup aborted ioctl %x\n",
18653 		    ipsq->ipsq_xop->ipx_current_ioctl));
18654 		/* bringup was aborted by the user */
18655 		return;
18656 	}
18657 	/*
18658 	 * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18659 	 * must have an associated conn_t.  Otherwise, we're bringing this
18660 	 * interface back up as part of handling an asynchronous event (e.g.,
18661 	 * physical address change).
18662 	 */
18663 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18664 		ASSERT(connp != NULL);
18665 		q = CONNP_TO_WQ(connp);
18666 	} else {
18667 		ASSERT(connp == NULL);
18668 		q = ill->ill_rq;
18669 	}
18670 	if ((err == 0) && (ill->ill_up_ipifs)) {
18671 		err = ill_up_ipifs(ill, q, mp1);
18672 		if (err == EINPROGRESS)
18673 			return;
18674 	}
18675 	/*
18676 	 * The operation must complete without EINPROGRESS since
18677 	 * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18678 	 * Otherwise, the operation will be stuck forever in the ipsq.
18679 	 */
18680 	ASSERT(err != EINPROGRESS);
18681 	if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18682 		DTRACE_PROBE4(ipif__ioctl, char *,
18683 		    "arp_replumb_done finish",
18684 		    int, ipsq->ipsq_xop->ipx_current_ioctl,
18685 		    ill_t *, ill, ipif_t *, ipif);
18686 		ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18687 	} else {
18688 		ipsq_current_finish(ipsq);
18689 	}
18690 }
18691 
18692 void
18693 ipif_up_notify(ipif_t *ipif)
18694 {
18695 	ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
18696 	ip_rts_newaddrmsg(RTM_ADD, 0, ipif, RTSQ_DEFAULT);
18697 	sctp_update_ipif(ipif, SCTP_IPIF_UP);
18698 	ill_nic_event_dispatch(ipif->ipif_ill, MAP_IPIF_ID(ipif->ipif_id),
18699 	    NE_LIF_UP, NULL, 0);
18700 }
18701 
18702 /*
18703  * ILB ioctl uses cv_wait (such as deleting a rule or adding a server) and
18704  * this assumes the context is cv_wait'able.  Hence it shouldnt' be used on
18705  * TPI end points with STREAMS modules pushed above.  This is assured by not
18706  * having the IPI_MODOK flag for the ioctl.  And IP ensures the ILB ioctl
18707  * never ends up on an ipsq, otherwise we may end up processing the ioctl
18708  * while unwinding from the ispq and that could be a thread from the bottom.
18709  */
18710 /* ARGSUSED */
18711 int
18712 ip_sioctl_ilb_cmd(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18713     ip_ioctl_cmd_t *ipip, void *arg)
18714 {
18715 	mblk_t *cmd_mp = mp->b_cont->b_cont;
18716 	ilb_cmd_t command = *((ilb_cmd_t *)cmd_mp->b_rptr);
18717 	int ret = 0;
18718 	int i;
18719 	size_t size;
18720 	ip_stack_t *ipst;
18721 	zoneid_t zoneid;
18722 	ilb_stack_t *ilbs;
18723 
18724 	ipst = CONNQ_TO_IPST(q);
18725 	ilbs = ipst->ips_netstack->netstack_ilb;
18726 	zoneid = Q_TO_CONN(q)->conn_zoneid;
18727 
18728 	switch (command) {
18729 	case ILB_CREATE_RULE: {
18730 		ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18731 
18732 		if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18733 			ret = EINVAL;
18734 			break;
18735 		}
18736 
18737 		ret = ilb_rule_add(ilbs, zoneid, cmd);
18738 		break;
18739 	}
18740 	case ILB_DESTROY_RULE:
18741 	case ILB_ENABLE_RULE:
18742 	case ILB_DISABLE_RULE: {
18743 		ilb_name_cmd_t *cmd = (ilb_name_cmd_t *)cmd_mp->b_rptr;
18744 
18745 		if (MBLKL(cmd_mp) != sizeof (ilb_name_cmd_t)) {
18746 			ret = EINVAL;
18747 			break;
18748 		}
18749 
18750 		if (cmd->flags & ILB_RULE_ALLRULES) {
18751 			if (command == ILB_DESTROY_RULE) {
18752 				ilb_rule_del_all(ilbs, zoneid);
18753 				break;
18754 			} else if (command == ILB_ENABLE_RULE) {
18755 				ilb_rule_enable_all(ilbs, zoneid);
18756 				break;
18757 			} else if (command == ILB_DISABLE_RULE) {
18758 				ilb_rule_disable_all(ilbs, zoneid);
18759 				break;
18760 			}
18761 		} else {
18762 			if (command == ILB_DESTROY_RULE) {
18763 				ret = ilb_rule_del(ilbs, zoneid, cmd->name);
18764 			} else if (command == ILB_ENABLE_RULE) {
18765 				ret = ilb_rule_enable(ilbs, zoneid, cmd->name,
18766 				    NULL);
18767 			} else if (command == ILB_DISABLE_RULE) {
18768 				ret = ilb_rule_disable(ilbs, zoneid, cmd->name,
18769 				    NULL);
18770 			}
18771 		}
18772 		break;
18773 	}
18774 	case ILB_NUM_RULES: {
18775 		ilb_num_rules_cmd_t *cmd;
18776 
18777 		if (MBLKL(cmd_mp) != sizeof (ilb_num_rules_cmd_t)) {
18778 			ret = EINVAL;
18779 			break;
18780 		}
18781 		cmd = (ilb_num_rules_cmd_t *)cmd_mp->b_rptr;
18782 		ilb_get_num_rules(ilbs, zoneid, &(cmd->num));
18783 		break;
18784 	}
18785 	case ILB_RULE_NAMES: {
18786 		ilb_rule_names_cmd_t *cmd;
18787 
18788 		cmd = (ilb_rule_names_cmd_t *)cmd_mp->b_rptr;
18789 		if (MBLKL(cmd_mp) < sizeof (ilb_rule_names_cmd_t) ||
18790 		    cmd->num_names == 0) {
18791 			ret = EINVAL;
18792 			break;
18793 		}
18794 		size = cmd->num_names * ILB_RULE_NAMESZ;
18795 		if (cmd_mp->b_rptr + offsetof(ilb_rule_names_cmd_t, buf) +
18796 		    size != cmd_mp->b_wptr) {
18797 			ret = EINVAL;
18798 			break;
18799 		}
18800 		ilb_get_rulenames(ilbs, zoneid, &cmd->num_names, cmd->buf);
18801 		break;
18802 	}
18803 	case ILB_NUM_SERVERS: {
18804 		ilb_num_servers_cmd_t *cmd;
18805 
18806 		if (MBLKL(cmd_mp) != sizeof (ilb_num_servers_cmd_t)) {
18807 			ret = EINVAL;
18808 			break;
18809 		}
18810 		cmd = (ilb_num_servers_cmd_t *)cmd_mp->b_rptr;
18811 		ret = ilb_get_num_servers(ilbs, zoneid, cmd->name,
18812 		    &(cmd->num));
18813 		break;
18814 	}
18815 	case ILB_LIST_RULE: {
18816 		ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18817 
18818 		if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18819 			ret = EINVAL;
18820 			break;
18821 		}
18822 		ret = ilb_rule_list(ilbs, zoneid, cmd);
18823 		break;
18824 	}
18825 	case ILB_LIST_SERVERS: {
18826 		ilb_servers_info_cmd_t *cmd;
18827 
18828 		cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18829 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t) ||
18830 		    cmd->num_servers == 0) {
18831 			ret = EINVAL;
18832 			break;
18833 		}
18834 		size = cmd->num_servers * sizeof (ilb_server_info_t);
18835 		if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18836 		    size != cmd_mp->b_wptr) {
18837 			ret = EINVAL;
18838 			break;
18839 		}
18840 
18841 		ret = ilb_get_servers(ilbs, zoneid, cmd->name, cmd->servers,
18842 		    &cmd->num_servers);
18843 		break;
18844 	}
18845 	case ILB_ADD_SERVERS: {
18846 		ilb_servers_info_cmd_t *cmd;
18847 		ilb_rule_t *rule;
18848 
18849 		cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18850 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t)) {
18851 			ret = EINVAL;
18852 			break;
18853 		}
18854 		size = cmd->num_servers * sizeof (ilb_server_info_t);
18855 		if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18856 		    size != cmd_mp->b_wptr) {
18857 			ret = EINVAL;
18858 			break;
18859 		}
18860 		rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18861 		if (rule == NULL) {
18862 			ASSERT(ret != 0);
18863 			break;
18864 		}
18865 		for (i = 0; i < cmd->num_servers; i++) {
18866 			ilb_server_info_t *s;
18867 
18868 			s = &cmd->servers[i];
18869 			s->err = ilb_server_add(ilbs, rule, s);
18870 		}
18871 		ILB_RULE_REFRELE(rule);
18872 		break;
18873 	}
18874 	case ILB_DEL_SERVERS:
18875 	case ILB_ENABLE_SERVERS:
18876 	case ILB_DISABLE_SERVERS: {
18877 		ilb_servers_cmd_t *cmd;
18878 		ilb_rule_t *rule;
18879 		int (*f)();
18880 
18881 		cmd = (ilb_servers_cmd_t *)cmd_mp->b_rptr;
18882 		if (MBLKL(cmd_mp) < sizeof (ilb_servers_cmd_t)) {
18883 			ret = EINVAL;
18884 			break;
18885 		}
18886 		size = cmd->num_servers * sizeof (ilb_server_arg_t);
18887 		if (cmd_mp->b_rptr + offsetof(ilb_servers_cmd_t, servers) +
18888 		    size != cmd_mp->b_wptr) {
18889 			ret = EINVAL;
18890 			break;
18891 		}
18892 
18893 		if (command == ILB_DEL_SERVERS)
18894 			f = ilb_server_del;
18895 		else if (command == ILB_ENABLE_SERVERS)
18896 			f = ilb_server_enable;
18897 		else if (command == ILB_DISABLE_SERVERS)
18898 			f = ilb_server_disable;
18899 
18900 		rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18901 		if (rule == NULL) {
18902 			ASSERT(ret != 0);
18903 			break;
18904 		}
18905 
18906 		for (i = 0; i < cmd->num_servers; i++) {
18907 			ilb_server_arg_t *s;
18908 
18909 			s = &cmd->servers[i];
18910 			s->err = f(ilbs, zoneid, NULL, rule, &s->addr);
18911 		}
18912 		ILB_RULE_REFRELE(rule);
18913 		break;
18914 	}
18915 	case ILB_LIST_NAT_TABLE: {
18916 		ilb_list_nat_cmd_t *cmd;
18917 
18918 		cmd = (ilb_list_nat_cmd_t *)cmd_mp->b_rptr;
18919 		if (MBLKL(cmd_mp) < sizeof (ilb_list_nat_cmd_t)) {
18920 			ret = EINVAL;
18921 			break;
18922 		}
18923 		size = cmd->num_nat * sizeof (ilb_nat_entry_t);
18924 		if (cmd_mp->b_rptr + offsetof(ilb_list_nat_cmd_t, entries) +
18925 		    size != cmd_mp->b_wptr) {
18926 			ret = EINVAL;
18927 			break;
18928 		}
18929 
18930 		ret = ilb_list_nat(ilbs, zoneid, cmd->entries, &cmd->num_nat,
18931 		    &cmd->flags);
18932 		break;
18933 	}
18934 	case ILB_LIST_STICKY_TABLE: {
18935 		ilb_list_sticky_cmd_t *cmd;
18936 
18937 		cmd = (ilb_list_sticky_cmd_t *)cmd_mp->b_rptr;
18938 		if (MBLKL(cmd_mp) < sizeof (ilb_list_sticky_cmd_t)) {
18939 			ret = EINVAL;
18940 			break;
18941 		}
18942 		size = cmd->num_sticky * sizeof (ilb_sticky_entry_t);
18943 		if (cmd_mp->b_rptr + offsetof(ilb_list_sticky_cmd_t, entries) +
18944 		    size != cmd_mp->b_wptr) {
18945 			ret = EINVAL;
18946 			break;
18947 		}
18948 
18949 		ret = ilb_list_sticky(ilbs, zoneid, cmd->entries,
18950 		    &cmd->num_sticky, &cmd->flags);
18951 		break;
18952 	}
18953 	default:
18954 		ret = EINVAL;
18955 		break;
18956 	}
18957 done:
18958 	return (ret);
18959 }
18960 
18961 /* Remove all cache entries for this logical interface */
18962 void
18963 ipif_nce_down(ipif_t *ipif)
18964 {
18965 	ill_t *ill = ipif->ipif_ill;
18966 	nce_t *nce;
18967 
18968 	DTRACE_PROBE3(ipif__downup, char *, "ipif_nce_down",
18969 	    ill_t *, ill, ipif_t *, ipif);
18970 	if (ipif->ipif_added_nce) {
18971 		if (ipif->ipif_isv6)
18972 			nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
18973 		else
18974 			nce = nce_lookup_v4(ill, &ipif->ipif_lcl_addr);
18975 		if (nce != NULL) {
18976 			if (--nce->nce_ipif_cnt == 0)
18977 				ncec_delete(nce->nce_common);
18978 			ipif->ipif_added_nce = 0;
18979 			nce_refrele(nce);
18980 		} else {
18981 			/*
18982 			 * nce may already be NULL because it was already
18983 			 * flushed, e.g., due to a call to nce_flush
18984 			 */
18985 			ipif->ipif_added_nce = 0;
18986 		}
18987 	}
18988 	/*
18989 	 * Make IPMP aware of the deleted data address.
18990 	 */
18991 	if (IS_IPMP(ill))
18992 		ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18993 
18994 	/*
18995 	 * Remove all other nces dependent on this ill when the last ipif
18996 	 * is going away.
18997 	 */
18998 	if (ill->ill_ipif_up_count == 0) {
18999 		ncec_walk(ill, ncec_delete_per_ill, ill, ill->ill_ipst);
19000 		if (IS_UNDER_IPMP(ill))
19001 			nce_flush(ill, B_TRUE);
19002 	}
19003 }
19004 
19005 /*
19006  * find the first interface that uses usill for its source address.
19007  */
19008 ill_t *
19009 ill_lookup_usesrc(ill_t *usill)
19010 {
19011 	ip_stack_t *ipst = usill->ill_ipst;
19012 	ill_t *ill;
19013 
19014 	ASSERT(usill != NULL);
19015 
19016 	/* ill_g_usesrc_lock protects ill_usesrc_grp_next */
19017 	rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
19018 	rw_enter(&ipst->ips_ill_g_lock, RW_READER);
19019 	for (ill = usill->ill_usesrc_grp_next; ill != NULL && ill != usill;
19020 	    ill = ill->ill_usesrc_grp_next) {
19021 		if (!IS_UNDER_IPMP(ill) && (ill->ill_flags & ILLF_MULTICAST) &&
19022 		    !ILL_IS_CONDEMNED(ill)) {
19023 			ill_refhold(ill);
19024 			break;
19025 		}
19026 	}
19027 	rw_exit(&ipst->ips_ill_g_lock);
19028 	rw_exit(&ipst->ips_ill_g_usesrc_lock);
19029 	return (ill);
19030 }
19031 
19032 /*
19033  * This comment applies to both ip_sioctl_get_ifhwaddr and
19034  * ip_sioctl_get_lifhwaddr as the basic function of these two functions
19035  * is the same.
19036  *
19037  * The goal here is to find an IP interface that corresponds to the name
19038  * provided by the caller in the ifreq/lifreq structure held in the mblk_t
19039  * chain and to fill out a sockaddr/sockaddr_storage structure with the
19040  * mac address.
19041  *
19042  * The SIOCGIFHWADDR/SIOCGLIFHWADDR ioctl may return an error for a number
19043  * of different reasons:
19044  * ENXIO - the device name is not known to IP.
19045  * EADDRNOTAVAIL - the device has no hardware address. This is indicated
19046  * by ill_phys_addr not pointing to an actual address.
19047  * EPFNOSUPPORT - this will indicate that a request is being made for a
19048  * mac address that will not fit in the data structure supplier (struct
19049  * sockaddr).
19050  *
19051  */
19052 /* ARGSUSED */
19053 int
19054 ip_sioctl_get_ifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19055     ip_ioctl_cmd_t *ipip, void *if_req)
19056 {
19057 	struct sockaddr *sock;
19058 	struct ifreq *ifr;
19059 	mblk_t *mp1;
19060 	ill_t *ill;
19061 
19062 	ASSERT(ipif != NULL);
19063 	ill = ipif->ipif_ill;
19064 
19065 	if (ill->ill_phys_addr == NULL) {
19066 		return (EADDRNOTAVAIL);
19067 	}
19068 	if (ill->ill_phys_addr_length > sizeof (sock->sa_data)) {
19069 		return (EPFNOSUPPORT);
19070 	}
19071 
19072 	ip1dbg(("ip_sioctl_get_hwaddr(%s)\n", ill->ill_name));
19073 
19074 	/* Existence of mp1 has been checked in ip_wput_nondata */
19075 	mp1 = mp->b_cont->b_cont;
19076 	ifr = (struct ifreq *)mp1->b_rptr;
19077 
19078 	sock = &ifr->ifr_addr;
19079 	/*
19080 	 * The "family" field in the returned structure is set to a value
19081 	 * that represents the type of device to which the address belongs.
19082 	 * The value returned may differ to that on Linux but it will still
19083 	 * represent the correct symbol on Solaris.
19084 	 */
19085 	sock->sa_family = arp_hw_type(ill->ill_mactype);
19086 	bcopy(ill->ill_phys_addr, &sock->sa_data, ill->ill_phys_addr_length);
19087 
19088 	return (0);
19089 }
19090 
19091 /*
19092  * The expection of applications using SIOCGIFHWADDR is that data will
19093  * be returned in the sa_data field of the sockaddr structure. With
19094  * SIOCGLIFHWADDR, we're breaking new ground as there is no Linux
19095  * equivalent. In light of this, struct sockaddr_dl is used as it
19096  * offers more space for address storage in sll_data.
19097  */
19098 /* ARGSUSED */
19099 int
19100 ip_sioctl_get_lifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19101     ip_ioctl_cmd_t *ipip, void *if_req)
19102 {
19103 	struct sockaddr_dl *sock;
19104 	struct lifreq *lifr;
19105 	mblk_t *mp1;
19106 	ill_t *ill;
19107 
19108 	ASSERT(ipif != NULL);
19109 	ill = ipif->ipif_ill;
19110 
19111 	if (ill->ill_phys_addr == NULL) {
19112 		return (EADDRNOTAVAIL);
19113 	}
19114 	if (ill->ill_phys_addr_length > sizeof (sock->sdl_data)) {
19115 		return (EPFNOSUPPORT);
19116 	}
19117 
19118 	ip1dbg(("ip_sioctl_get_lifhwaddr(%s)\n", ill->ill_name));
19119 
19120 	/* Existence of mp1 has been checked in ip_wput_nondata */
19121 	mp1 = mp->b_cont->b_cont;
19122 	lifr = (struct lifreq *)mp1->b_rptr;
19123 
19124 	/*
19125 	 * sockaddr_ll is used here because it is also the structure used in
19126 	 * responding to the same ioctl in sockpfp. The only other choice is
19127 	 * sockaddr_dl which contains fields that are not required here
19128 	 * because its purpose is different.
19129 	 */
19130 	lifr->lifr_type = ill->ill_type;
19131 	sock = (struct sockaddr_dl *)&lifr->lifr_addr;
19132 	sock->sdl_family = AF_LINK;
19133 	sock->sdl_index = ill->ill_phyint->phyint_ifindex;
19134 	sock->sdl_type = ill->ill_mactype;
19135 	sock->sdl_nlen = 0;
19136 	sock->sdl_slen = 0;
19137 	sock->sdl_alen = ill->ill_phys_addr_length;
19138 	bcopy(ill->ill_phys_addr, sock->sdl_data, ill->ill_phys_addr_length);
19139 
19140 	return (0);
19141 }
19142