1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  23  * Copyright (c) 1990 Mentat Inc.
  24  * Copyright (c) 2013 by Delphix. All rights reserved.
  25  * Copyright 2013 Joyent, Inc.
  26  * Copyright (c) 2014, OmniTI Computer Consulting, Inc. All rights reserved.
  27  */
  28 
  29 /*
  30  * This file contains the interface control functions for IP.
  31  */
  32 
  33 #include <sys/types.h>
  34 #include <sys/stream.h>
  35 #include <sys/dlpi.h>
  36 #include <sys/stropts.h>
  37 #include <sys/strsun.h>
  38 #include <sys/sysmacros.h>
  39 #include <sys/strsubr.h>
  40 #include <sys/strlog.h>
  41 #include <sys/ddi.h>
  42 #include <sys/sunddi.h>
  43 #include <sys/cmn_err.h>
  44 #include <sys/kstat.h>
  45 #include <sys/debug.h>
  46 #include <sys/zone.h>
  47 #include <sys/sunldi.h>
  48 #include <sys/file.h>
  49 #include <sys/bitmap.h>
  50 #include <sys/cpuvar.h>
  51 #include <sys/time.h>
  52 #include <sys/ctype.h>
  53 #include <sys/kmem.h>
  54 #include <sys/systm.h>
  55 #include <sys/param.h>
  56 #include <sys/socket.h>
  57 #include <sys/isa_defs.h>
  58 #include <net/if.h>
  59 #include <net/if_arp.h>
  60 #include <net/if_types.h>
  61 #include <net/if_dl.h>
  62 #include <net/route.h>
  63 #include <sys/sockio.h>
  64 #include <netinet/in.h>
  65 #include <netinet/ip6.h>
  66 #include <netinet/icmp6.h>
  67 #include <netinet/igmp_var.h>
  68 #include <sys/policy.h>
  69 #include <sys/ethernet.h>
  70 #include <sys/callb.h>
  71 #include <sys/md5.h>
  72 
  73 #include <inet/common.h>   /* for various inet/mi.h and inet/nd.h needs */
  74 #include <inet/mi.h>
  75 #include <inet/nd.h>
  76 #include <inet/tunables.h>
  77 #include <inet/arp.h>
  78 #include <inet/ip_arp.h>
  79 #include <inet/mib2.h>
  80 #include <inet/ip.h>
  81 #include <inet/ip6.h>
  82 #include <inet/ip6_asp.h>
  83 #include <inet/tcp.h>
  84 #include <inet/ip_multi.h>
  85 #include <inet/ip_ire.h>
  86 #include <inet/ip_ftable.h>
  87 #include <inet/ip_rts.h>
  88 #include <inet/ip_ndp.h>
  89 #include <inet/ip_if.h>
  90 #include <inet/ip_impl.h>
  91 #include <inet/sctp_ip.h>
  92 #include <inet/ip_netinfo.h>
  93 #include <inet/ilb_ip.h>
  94 
  95 #include <netinet/igmp.h>
  96 #include <inet/ip_listutils.h>
  97 #include <inet/ipclassifier.h>
  98 #include <sys/mac_client.h>
  99 #include <sys/dld.h>
 100 #include <sys/mac_flow.h>
 101 
 102 #include <sys/systeminfo.h>
 103 #include <sys/bootconf.h>
 104 
 105 #include <sys/tsol/tndb.h>
 106 #include <sys/tsol/tnet.h>
 107 
 108 #include <inet/rawip_impl.h> /* needed for icmp_stack_t */
 109 #include <inet/udp_impl.h> /* needed for udp_stack_t */
 110 
 111 /* The character which tells where the ill_name ends */
 112 #define IPIF_SEPARATOR_CHAR     ':'
 113 
 114 /* IP ioctl function table entry */
 115 typedef struct ipft_s {
 116         int     ipft_cmd;
 117         pfi_t   ipft_pfi;
 118         int     ipft_min_size;
 119         int     ipft_flags;
 120 } ipft_t;
 121 #define IPFT_F_NO_REPLY         0x1     /* IP ioctl does not expect any reply */
 122 #define IPFT_F_SELF_REPLY       0x2     /* ioctl callee does the ioctl reply */
 123 
 124 static int      nd_ill_forward_get(queue_t *, mblk_t *, caddr_t, cred_t *);
 125 static int      nd_ill_forward_set(queue_t *q, mblk_t *mp,
 126                     char *value, caddr_t cp, cred_t *ioc_cr);
 127 
 128 static boolean_t ill_is_quiescent(ill_t *);
 129 static boolean_t ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask);
 130 static ip_m_t   *ip_m_lookup(t_uscalar_t mac_type);
 131 static int      ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
 132     mblk_t *mp, boolean_t need_up);
 133 static int      ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
 134     mblk_t *mp, boolean_t need_up);
 135 static int      ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
 136     queue_t *q, mblk_t *mp, boolean_t need_up);
 137 static int      ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q,
 138     mblk_t *mp);
 139 static int      ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q,
 140     mblk_t *mp);
 141 static int      ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t, in6_addr_t,
 142     queue_t *q, mblk_t *mp, boolean_t need_up);
 143 static int      ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp,
 144     int ioccmd, struct linkblk *li);
 145 static ipaddr_t ip_subnet_mask(ipaddr_t addr, ipif_t **, ip_stack_t *);
 146 static void     ip_wput_ioctl(queue_t *q, mblk_t *mp);
 147 static void     ipsq_flush(ill_t *ill);
 148 
 149 static  int     ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen,
 150     queue_t *q, mblk_t *mp, boolean_t need_up);
 151 static void     ipsq_delete(ipsq_t *);
 152 
 153 static ipif_t   *ipif_allocate(ill_t *ill, int id, uint_t ire_type,
 154     boolean_t initialize, boolean_t insert, int *errorp);
 155 static ire_t    **ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep);
 156 static void     ipif_delete_bcast_ires(ipif_t *ipif);
 157 static int      ipif_add_ires_v4(ipif_t *, boolean_t);
 158 static boolean_t ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif,
 159                     boolean_t isv6);
 160 static int      ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp);
 161 static void     ipif_free(ipif_t *ipif);
 162 static void     ipif_free_tail(ipif_t *ipif);
 163 static void     ipif_set_default(ipif_t *ipif);
 164 static int      ipif_set_values(queue_t *q, mblk_t *mp,
 165     char *interf_name, uint_t *ppa);
 166 static int      ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp,
 167     queue_t *q);
 168 static ipif_t   *ipif_lookup_on_name(char *name, size_t namelen,
 169     boolean_t do_alloc, boolean_t *exists, boolean_t isv6, zoneid_t zoneid,
 170     ip_stack_t *);
 171 static ipif_t   *ipif_lookup_on_name_async(char *name, size_t namelen,
 172     boolean_t isv6, zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func,
 173     int *error, ip_stack_t *);
 174 
 175 static int      ill_alloc_ppa(ill_if_t *, ill_t *);
 176 static void     ill_delete_interface_type(ill_if_t *);
 177 static int      ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q);
 178 static void     ill_dl_down(ill_t *ill);
 179 static void     ill_down(ill_t *ill);
 180 static void     ill_down_ipifs(ill_t *, boolean_t);
 181 static void     ill_free_mib(ill_t *ill);
 182 static void     ill_glist_delete(ill_t *);
 183 static void     ill_phyint_reinit(ill_t *ill);
 184 static void     ill_set_nce_router_flags(ill_t *, boolean_t);
 185 static void     ill_set_phys_addr_tail(ipsq_t *, queue_t *, mblk_t *, void *);
 186 static void     ill_replumb_tail(ipsq_t *, queue_t *, mblk_t *, void *);
 187 
 188 static ip_v6intfid_func_t ip_ether_v6intfid, ip_ib_v6intfid;
 189 static ip_v6intfid_func_t ip_ipv4_v6intfid, ip_ipv6_v6intfid;
 190 static ip_v6intfid_func_t ip_ipmp_v6intfid, ip_nodef_v6intfid;
 191 static ip_v6intfid_func_t ip_ipv4_v6destintfid, ip_ipv6_v6destintfid;
 192 static ip_v4mapinfo_func_t ip_ether_v4_mapping;
 193 static ip_v6mapinfo_func_t ip_ether_v6_mapping;
 194 static ip_v4mapinfo_func_t ip_ib_v4_mapping;
 195 static ip_v6mapinfo_func_t ip_ib_v6_mapping;
 196 static ip_v4mapinfo_func_t ip_mbcast_mapping;
 197 static void     ip_cgtp_bcast_add(ire_t *, ip_stack_t *);
 198 static void     ip_cgtp_bcast_delete(ire_t *, ip_stack_t *);
 199 static void     phyint_free(phyint_t *);
 200 
 201 static void ill_capability_dispatch(ill_t *, mblk_t *, dl_capability_sub_t *);
 202 static void ill_capability_id_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
 203 static void ill_capability_vrrp_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
 204 static void ill_capability_hcksum_ack(ill_t *, mblk_t *, dl_capability_sub_t *);
 205 static void ill_capability_hcksum_reset_fill(ill_t *, mblk_t *);
 206 static void ill_capability_zerocopy_ack(ill_t *, mblk_t *,
 207     dl_capability_sub_t *);
 208 static void ill_capability_zerocopy_reset_fill(ill_t *, mblk_t *);
 209 static void     ill_capability_dld_reset_fill(ill_t *, mblk_t *);
 210 static void     ill_capability_dld_ack(ill_t *, mblk_t *,
 211                     dl_capability_sub_t *);
 212 static void     ill_capability_dld_enable(ill_t *);
 213 static void     ill_capability_ack_thr(void *);
 214 static void     ill_capability_lso_enable(ill_t *);
 215 
 216 static ill_t    *ill_prev_usesrc(ill_t *);
 217 static int      ill_relink_usesrc_ills(ill_t *, ill_t *, uint_t);
 218 static void     ill_disband_usesrc_group(ill_t *);
 219 static void     ip_sioctl_garp_reply(mblk_t *, ill_t *, void *, int);
 220 
 221 #ifdef DEBUG
 222 static  void    ill_trace_cleanup(const ill_t *);
 223 static  void    ipif_trace_cleanup(const ipif_t *);
 224 #endif
 225 
 226 static  void    ill_dlpi_clear_deferred(ill_t *ill);
 227 
 228 static  void    phyint_flags_init(phyint_t *, t_uscalar_t);
 229 
 230 /*
 231  * if we go over the memory footprint limit more than once in this msec
 232  * interval, we'll start pruning aggressively.
 233  */
 234 int ip_min_frag_prune_time = 0;
 235 
 236 static ipft_t   ip_ioctl_ftbl[] = {
 237         { IP_IOC_IRE_DELETE, ip_ire_delete, sizeof (ipid_t), 0 },
 238         { IP_IOC_IRE_DELETE_NO_REPLY, ip_ire_delete, sizeof (ipid_t),
 239                 IPFT_F_NO_REPLY },
 240         { IP_IOC_RTS_REQUEST, ip_rts_request, 0, IPFT_F_SELF_REPLY },
 241         { 0 }
 242 };
 243 
 244 /* Simple ICMP IP Header Template */
 245 static ipha_t icmp_ipha = {
 246         IP_SIMPLE_HDR_VERSION, 0, 0, 0, 0, 0, IPPROTO_ICMP
 247 };
 248 
 249 static uchar_t  ip_six_byte_all_ones[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 250 
 251 static ip_m_t   ip_m_tbl[] = {
 252         { DL_ETHER, IFT_ETHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
 253             ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
 254             ip_nodef_v6intfid },
 255         { DL_CSMACD, IFT_ISO88023, ETHERTYPE_IP, ETHERTYPE_IPV6,
 256             ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
 257             ip_nodef_v6intfid },
 258         { DL_TPB, IFT_ISO88024, ETHERTYPE_IP, ETHERTYPE_IPV6,
 259             ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
 260             ip_nodef_v6intfid },
 261         { DL_TPR, IFT_ISO88025, ETHERTYPE_IP, ETHERTYPE_IPV6,
 262             ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
 263             ip_nodef_v6intfid },
 264         { DL_FDDI, IFT_FDDI, ETHERTYPE_IP, ETHERTYPE_IPV6,
 265             ip_ether_v4_mapping, ip_ether_v6_mapping, ip_ether_v6intfid,
 266             ip_nodef_v6intfid },
 267         { DL_IB, IFT_IB, ETHERTYPE_IP, ETHERTYPE_IPV6,
 268             ip_ib_v4_mapping, ip_ib_v6_mapping, ip_ib_v6intfid,
 269             ip_nodef_v6intfid },
 270         { DL_IPV4, IFT_IPV4, IPPROTO_ENCAP, IPPROTO_IPV6,
 271             ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
 272             ip_ipv4_v6destintfid },
 273         { DL_IPV6, IFT_IPV6, IPPROTO_ENCAP, IPPROTO_IPV6,
 274             ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv6_v6intfid,
 275             ip_ipv6_v6destintfid },
 276         { DL_6TO4, IFT_6TO4, IPPROTO_ENCAP, IPPROTO_IPV6,
 277             ip_mbcast_mapping, ip_mbcast_mapping, ip_ipv4_v6intfid,
 278             ip_nodef_v6intfid },
 279         { SUNW_DL_VNI, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
 280             NULL, NULL, ip_nodef_v6intfid, ip_nodef_v6intfid },
 281         { SUNW_DL_IPMP, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
 282             NULL, NULL, ip_ipmp_v6intfid, ip_nodef_v6intfid },
 283         { DL_OTHER, IFT_OTHER, ETHERTYPE_IP, ETHERTYPE_IPV6,
 284             ip_ether_v4_mapping, ip_ether_v6_mapping, ip_nodef_v6intfid,
 285             ip_nodef_v6intfid }
 286 };
 287 
 288 char    ipif_loopback_name[] = "lo0";
 289 
 290 /* These are used by all IP network modules. */
 291 sin6_t  sin6_null;      /* Zero address for quick clears */
 292 sin_t   sin_null;       /* Zero address for quick clears */
 293 
 294 /* When set search for unused ipif_seqid */
 295 static ipif_t   ipif_zero;
 296 
 297 /*
 298  * ppa arena is created after these many
 299  * interfaces have been plumbed.
 300  */
 301 uint_t  ill_no_arena = 12;      /* Setable in /etc/system */
 302 
 303 /*
 304  * Allocate per-interface mibs.
 305  * Returns true if ok. False otherwise.
 306  *  ipsq  may not yet be allocated (loopback case ).
 307  */
 308 static boolean_t
 309 ill_allocate_mibs(ill_t *ill)
 310 {
 311         /* Already allocated? */
 312         if (ill->ill_ip_mib != NULL) {
 313                 if (ill->ill_isv6)
 314                         ASSERT(ill->ill_icmp6_mib != NULL);
 315                 return (B_TRUE);
 316         }
 317 
 318         ill->ill_ip_mib = kmem_zalloc(sizeof (*ill->ill_ip_mib),
 319             KM_NOSLEEP);
 320         if (ill->ill_ip_mib == NULL) {
 321                 return (B_FALSE);
 322         }
 323 
 324         /* Setup static information */
 325         SET_MIB(ill->ill_ip_mib->ipIfStatsEntrySize,
 326             sizeof (mib2_ipIfStatsEntry_t));
 327         if (ill->ill_isv6) {
 328                 ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv6;
 329                 SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
 330                     sizeof (mib2_ipv6AddrEntry_t));
 331                 SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
 332                     sizeof (mib2_ipv6RouteEntry_t));
 333                 SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
 334                     sizeof (mib2_ipv6NetToMediaEntry_t));
 335                 SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
 336                     sizeof (ipv6_member_t));
 337                 SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
 338                     sizeof (ipv6_grpsrc_t));
 339         } else {
 340                 ill->ill_ip_mib->ipIfStatsIPVersion = MIB2_INETADDRESSTYPE_ipv4;
 341                 SET_MIB(ill->ill_ip_mib->ipIfStatsAddrEntrySize,
 342                     sizeof (mib2_ipAddrEntry_t));
 343                 SET_MIB(ill->ill_ip_mib->ipIfStatsRouteEntrySize,
 344                     sizeof (mib2_ipRouteEntry_t));
 345                 SET_MIB(ill->ill_ip_mib->ipIfStatsNetToMediaEntrySize,
 346                     sizeof (mib2_ipNetToMediaEntry_t));
 347                 SET_MIB(ill->ill_ip_mib->ipIfStatsMemberEntrySize,
 348                     sizeof (ip_member_t));
 349                 SET_MIB(ill->ill_ip_mib->ipIfStatsGroupSourceEntrySize,
 350                     sizeof (ip_grpsrc_t));
 351 
 352                 /*
 353                  * For a v4 ill, we are done at this point, because per ill
 354                  * icmp mibs are only used for v6.
 355                  */
 356                 return (B_TRUE);
 357         }
 358 
 359         ill->ill_icmp6_mib = kmem_zalloc(sizeof (*ill->ill_icmp6_mib),
 360             KM_NOSLEEP);
 361         if (ill->ill_icmp6_mib == NULL) {
 362                 kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
 363                 ill->ill_ip_mib = NULL;
 364                 return (B_FALSE);
 365         }
 366         /* static icmp info */
 367         ill->ill_icmp6_mib->ipv6IfIcmpEntrySize =
 368             sizeof (mib2_ipv6IfIcmpEntry_t);
 369         /*
 370          * The ipIfStatsIfindex and ipv6IfIcmpIndex will be assigned later
 371          * after the phyint merge occurs in ipif_set_values -> ill_glist_insert
 372          * -> ill_phyint_reinit
 373          */
 374         return (B_TRUE);
 375 }
 376 
 377 /*
 378  * Completely vaporize a lower level tap and all associated interfaces.
 379  * ill_delete is called only out of ip_close when the device control
 380  * stream is being closed.
 381  */
 382 void
 383 ill_delete(ill_t *ill)
 384 {
 385         ipif_t  *ipif;
 386         ill_t   *prev_ill;
 387         ip_stack_t      *ipst = ill->ill_ipst;
 388 
 389         /*
 390          * ill_delete may be forcibly entering the ipsq. The previous
 391          * ioctl may not have completed and may need to be aborted.
 392          * ipsq_flush takes care of it. If we don't need to enter the
 393          * the ipsq forcibly, the 2nd invocation of ipsq_flush in
 394          * ill_delete_tail is sufficient.
 395          */
 396         ipsq_flush(ill);
 397 
 398         /*
 399          * Nuke all interfaces.  ipif_free will take down the interface,
 400          * remove it from the list, and free the data structure.
 401          * Walk down the ipif list and remove the logical interfaces
 402          * first before removing the main ipif. We can't unplumb
 403          * zeroth interface first in the case of IPv6 as update_conn_ill
 404          * -> ip_ll_multireq de-references ill_ipif for checking
 405          * POINTOPOINT.
 406          *
 407          * If ill_ipif was not properly initialized (i.e low on memory),
 408          * then no interfaces to clean up. In this case just clean up the
 409          * ill.
 410          */
 411         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
 412                 ipif_free(ipif);
 413 
 414         /*
 415          * clean out all the nce_t entries that depend on this
 416          * ill for the ill_phys_addr.
 417          */
 418         nce_flush(ill, B_TRUE);
 419 
 420         /* Clean up msgs on pending upcalls for mrouted */
 421         reset_mrt_ill(ill);
 422 
 423         update_conn_ill(ill, ipst);
 424 
 425         /*
 426          * Remove multicast references added as a result of calls to
 427          * ip_join_allmulti().
 428          */
 429         ip_purge_allmulti(ill);
 430 
 431         /*
 432          * If the ill being deleted is under IPMP, boot it out of the illgrp.
 433          */
 434         if (IS_UNDER_IPMP(ill))
 435                 ipmp_ill_leave_illgrp(ill);
 436 
 437         /*
 438          * ill_down will arrange to blow off any IRE's dependent on this
 439          * ILL, and shut down fragmentation reassembly.
 440          */
 441         ill_down(ill);
 442 
 443         /* Let SCTP know, so that it can remove this from its list. */
 444         sctp_update_ill(ill, SCTP_ILL_REMOVE);
 445 
 446         /*
 447          * Walk all CONNs that can have a reference on an ire or nce for this
 448          * ill (we actually walk all that now have stale references).
 449          */
 450         ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
 451 
 452         /* With IPv6 we have dce_ifindex. Cleanup for neatness */
 453         if (ill->ill_isv6)
 454                 dce_cleanup(ill->ill_phyint->phyint_ifindex, ipst);
 455 
 456         /*
 457          * If an address on this ILL is being used as a source address then
 458          * clear out the pointers in other ILLs that point to this ILL.
 459          */
 460         rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
 461         if (ill->ill_usesrc_grp_next != NULL) {
 462                 if (ill->ill_usesrc_ifindex == 0) { /* usesrc ILL ? */
 463                         ill_disband_usesrc_group(ill);
 464                 } else {        /* consumer of the usesrc ILL */
 465                         prev_ill = ill_prev_usesrc(ill);
 466                         prev_ill->ill_usesrc_grp_next =
 467                             ill->ill_usesrc_grp_next;
 468                 }
 469         }
 470         rw_exit(&ipst->ips_ill_g_usesrc_lock);
 471 }
 472 
 473 static void
 474 ipif_non_duplicate(ipif_t *ipif)
 475 {
 476         ill_t *ill = ipif->ipif_ill;
 477         mutex_enter(&ill->ill_lock);
 478         if (ipif->ipif_flags & IPIF_DUPLICATE) {
 479                 ipif->ipif_flags &= ~IPIF_DUPLICATE;
 480                 ASSERT(ill->ill_ipif_dup_count > 0);
 481                 ill->ill_ipif_dup_count--;
 482         }
 483         mutex_exit(&ill->ill_lock);
 484 }
 485 
 486 /*
 487  * ill_delete_tail is called from ip_modclose after all references
 488  * to the closing ill are gone. The wait is done in ip_modclose
 489  */
 490 void
 491 ill_delete_tail(ill_t *ill)
 492 {
 493         mblk_t  **mpp;
 494         ipif_t  *ipif;
 495         ip_stack_t *ipst = ill->ill_ipst;
 496 
 497         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
 498                 ipif_non_duplicate(ipif);
 499                 (void) ipif_down_tail(ipif);
 500         }
 501 
 502         ASSERT(ill->ill_ipif_dup_count == 0);
 503 
 504         /*
 505          * If polling capability is enabled (which signifies direct
 506          * upcall into IP and driver has ill saved as a handle),
 507          * we need to make sure that unbind has completed before we
 508          * let the ill disappear and driver no longer has any reference
 509          * to this ill.
 510          */
 511         mutex_enter(&ill->ill_lock);
 512         while (ill->ill_state_flags & ILL_DL_UNBIND_IN_PROGRESS)
 513                 cv_wait(&ill->ill_cv, &ill->ill_lock);
 514         mutex_exit(&ill->ill_lock);
 515         ASSERT(!(ill->ill_capabilities &
 516             (ILL_CAPAB_DLD | ILL_CAPAB_DLD_POLL | ILL_CAPAB_DLD_DIRECT)));
 517 
 518         if (ill->ill_net_type != IRE_LOOPBACK)
 519                 qprocsoff(ill->ill_rq);
 520 
 521         /*
 522          * We do an ipsq_flush once again now. New messages could have
 523          * landed up from below (M_ERROR or M_HANGUP). Similarly ioctls
 524          * could also have landed up if an ioctl thread had looked up
 525          * the ill before we set the ILL_CONDEMNED flag, but not yet
 526          * enqueued the ioctl when we did the ipsq_flush last time.
 527          */
 528         ipsq_flush(ill);
 529 
 530         /*
 531          * Free capabilities.
 532          */
 533         if (ill->ill_hcksum_capab != NULL) {
 534                 kmem_free(ill->ill_hcksum_capab, sizeof (ill_hcksum_capab_t));
 535                 ill->ill_hcksum_capab = NULL;
 536         }
 537 
 538         if (ill->ill_zerocopy_capab != NULL) {
 539                 kmem_free(ill->ill_zerocopy_capab,
 540                     sizeof (ill_zerocopy_capab_t));
 541                 ill->ill_zerocopy_capab = NULL;
 542         }
 543 
 544         if (ill->ill_lso_capab != NULL) {
 545                 kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
 546                 ill->ill_lso_capab = NULL;
 547         }
 548 
 549         if (ill->ill_dld_capab != NULL) {
 550                 kmem_free(ill->ill_dld_capab, sizeof (ill_dld_capab_t));
 551                 ill->ill_dld_capab = NULL;
 552         }
 553 
 554         /* Clean up ill_allowed_ips* related state */
 555         if (ill->ill_allowed_ips != NULL) {
 556                 ASSERT(ill->ill_allowed_ips_cnt > 0);
 557                 kmem_free(ill->ill_allowed_ips,
 558                     ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
 559                 ill->ill_allowed_ips = NULL;
 560                 ill->ill_allowed_ips_cnt = 0;
 561         }
 562 
 563         while (ill->ill_ipif != NULL)
 564                 ipif_free_tail(ill->ill_ipif);
 565 
 566         /*
 567          * We have removed all references to ilm from conn and the ones joined
 568          * within the kernel.
 569          *
 570          * We don't walk conns, mrts and ires because
 571          *
 572          * 1) update_conn_ill and reset_mrt_ill cleans up conns and mrts.
 573          * 2) ill_down ->ill_downi walks all the ires and cleans up
 574          *    ill references.
 575          */
 576 
 577         /*
 578          * If this ill is an IPMP meta-interface, blow away the illgrp.  This
 579          * is safe to do because the illgrp has already been unlinked from the
 580          * group by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find it.
 581          */
 582         if (IS_IPMP(ill)) {
 583                 ipmp_illgrp_destroy(ill->ill_grp);
 584                 ill->ill_grp = NULL;
 585         }
 586 
 587         if (ill->ill_mphysaddr_list != NULL) {
 588                 multiphysaddr_t *mpa, *tmpa;
 589 
 590                 mpa = ill->ill_mphysaddr_list;
 591                 ill->ill_mphysaddr_list = NULL;
 592                 while (mpa) {
 593                         tmpa = mpa->mpa_next;
 594                         kmem_free(mpa, sizeof (*mpa));
 595                         mpa = tmpa;
 596                 }
 597         }
 598         /*
 599          * Take us out of the list of ILLs. ill_glist_delete -> phyint_free
 600          * could free the phyint. No more reference to the phyint after this
 601          * point.
 602          */
 603         (void) ill_glist_delete(ill);
 604 
 605         if (ill->ill_frag_ptr != NULL) {
 606                 uint_t count;
 607 
 608                 for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
 609                         mutex_destroy(&ill->ill_frag_hash_tbl[count].ipfb_lock);
 610                 }
 611                 mi_free(ill->ill_frag_ptr);
 612                 ill->ill_frag_ptr = NULL;
 613                 ill->ill_frag_hash_tbl = NULL;
 614         }
 615 
 616         freemsg(ill->ill_nd_lla_mp);
 617         /* Free all retained control messages. */
 618         mpp = &ill->ill_first_mp_to_free;
 619         do {
 620                 while (mpp[0]) {
 621                         mblk_t  *mp;
 622                         mblk_t  *mp1;
 623 
 624                         mp = mpp[0];
 625                         mpp[0] = mp->b_next;
 626                         for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
 627                                 mp1->b_next = NULL;
 628                                 mp1->b_prev = NULL;
 629                         }
 630                         freemsg(mp);
 631                 }
 632         } while (mpp++ != &ill->ill_last_mp_to_free);
 633 
 634         ill_free_mib(ill);
 635 
 636 #ifdef DEBUG
 637         ill_trace_cleanup(ill);
 638 #endif
 639 
 640         /* The default multicast interface might have changed */
 641         ire_increment_multicast_generation(ipst, ill->ill_isv6);
 642 
 643         /* Drop refcnt here */
 644         netstack_rele(ill->ill_ipst->ips_netstack);
 645         ill->ill_ipst = NULL;
 646 }
 647 
 648 static void
 649 ill_free_mib(ill_t *ill)
 650 {
 651         ip_stack_t *ipst = ill->ill_ipst;
 652 
 653         /*
 654          * MIB statistics must not be lost, so when an interface
 655          * goes away the counter values will be added to the global
 656          * MIBs.
 657          */
 658         if (ill->ill_ip_mib != NULL) {
 659                 if (ill->ill_isv6) {
 660                         ip_mib2_add_ip_stats(&ipst->ips_ip6_mib,
 661                             ill->ill_ip_mib);
 662                 } else {
 663                         ip_mib2_add_ip_stats(&ipst->ips_ip_mib,
 664                             ill->ill_ip_mib);
 665                 }
 666 
 667                 kmem_free(ill->ill_ip_mib, sizeof (*ill->ill_ip_mib));
 668                 ill->ill_ip_mib = NULL;
 669         }
 670         if (ill->ill_icmp6_mib != NULL) {
 671                 ip_mib2_add_icmp6_stats(&ipst->ips_icmp6_mib,
 672                     ill->ill_icmp6_mib);
 673                 kmem_free(ill->ill_icmp6_mib, sizeof (*ill->ill_icmp6_mib));
 674                 ill->ill_icmp6_mib = NULL;
 675         }
 676 }
 677 
 678 /*
 679  * Concatenate together a physical address and a sap.
 680  *
 681  * Sap_lengths are interpreted as follows:
 682  *   sap_length == 0    ==>  no sap
 683  *   sap_length > 0  ==>  sap is at the head of the dlpi address
 684  *   sap_length < 0  ==>  sap is at the tail of the dlpi address
 685  */
 686 static void
 687 ill_dlur_copy_address(uchar_t *phys_src, uint_t phys_length,
 688     t_scalar_t sap_src, t_scalar_t sap_length, uchar_t *dst)
 689 {
 690         uint16_t sap_addr = (uint16_t)sap_src;
 691 
 692         if (sap_length == 0) {
 693                 if (phys_src == NULL)
 694                         bzero(dst, phys_length);
 695                 else
 696                         bcopy(phys_src, dst, phys_length);
 697         } else if (sap_length < 0) {
 698                 if (phys_src == NULL)
 699                         bzero(dst, phys_length);
 700                 else
 701                         bcopy(phys_src, dst, phys_length);
 702                 bcopy(&sap_addr, (char *)dst + phys_length, sizeof (sap_addr));
 703         } else {
 704                 bcopy(&sap_addr, dst, sizeof (sap_addr));
 705                 if (phys_src == NULL)
 706                         bzero((char *)dst + sap_length, phys_length);
 707                 else
 708                         bcopy(phys_src, (char *)dst + sap_length, phys_length);
 709         }
 710 }
 711 
 712 /*
 713  * Generate a dl_unitdata_req mblk for the device and address given.
 714  * addr_length is the length of the physical portion of the address.
 715  * If addr is NULL include an all zero address of the specified length.
 716  * TRUE? In any case, addr_length is taken to be the entire length of the
 717  * dlpi address, including the absolute value of sap_length.
 718  */
 719 mblk_t *
 720 ill_dlur_gen(uchar_t *addr, uint_t addr_length, t_uscalar_t sap,
 721                 t_scalar_t sap_length)
 722 {
 723         dl_unitdata_req_t *dlur;
 724         mblk_t  *mp;
 725         t_scalar_t      abs_sap_length;         /* absolute value */
 726 
 727         abs_sap_length = ABS(sap_length);
 728         mp = ip_dlpi_alloc(sizeof (*dlur) + addr_length + abs_sap_length,
 729             DL_UNITDATA_REQ);
 730         if (mp == NULL)
 731                 return (NULL);
 732         dlur = (dl_unitdata_req_t *)mp->b_rptr;
 733         /* HACK: accomodate incompatible DLPI drivers */
 734         if (addr_length == 8)
 735                 addr_length = 6;
 736         dlur->dl_dest_addr_length = addr_length + abs_sap_length;
 737         dlur->dl_dest_addr_offset = sizeof (*dlur);
 738         dlur->dl_priority.dl_min = 0;
 739         dlur->dl_priority.dl_max = 0;
 740         ill_dlur_copy_address(addr, addr_length, sap, sap_length,
 741             (uchar_t *)&dlur[1]);
 742         return (mp);
 743 }
 744 
 745 /*
 746  * Add the pending mp to the list. There can be only 1 pending mp
 747  * in the list. Any exclusive ioctl that needs to wait for a response
 748  * from another module or driver needs to use this function to set
 749  * the ipx_pending_mp to the ioctl mblk and wait for the response from
 750  * the other module/driver. This is also used while waiting for the
 751  * ipif/ill/ire refcnts to drop to zero in bringing down an ipif.
 752  */
 753 boolean_t
 754 ipsq_pending_mp_add(conn_t *connp, ipif_t *ipif, queue_t *q, mblk_t *add_mp,
 755     int waitfor)
 756 {
 757         ipxop_t *ipx = ipif->ipif_ill->ill_phyint->phyint_ipsq->ipsq_xop;
 758 
 759         ASSERT(IAM_WRITER_IPIF(ipif));
 760         ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
 761         ASSERT((add_mp->b_next == NULL) && (add_mp->b_prev == NULL));
 762         ASSERT(ipx->ipx_pending_mp == NULL);
 763         /*
 764          * The caller may be using a different ipif than the one passed into
 765          * ipsq_current_start() (e.g., suppose an ioctl that came in on the V4
 766          * ill needs to wait for the V6 ill to quiesce).  So we can't ASSERT
 767          * that `ipx_current_ipif == ipif'.
 768          */
 769         ASSERT(ipx->ipx_current_ipif != NULL);
 770 
 771         /*
 772          * M_IOCDATA from ioctls, M_ERROR/M_HANGUP/M_PROTO/M_PCPROTO from the
 773          * driver.
 774          */
 775         ASSERT((DB_TYPE(add_mp) == M_IOCDATA) || (DB_TYPE(add_mp) == M_ERROR) ||
 776             (DB_TYPE(add_mp) == M_HANGUP) || (DB_TYPE(add_mp) == M_PROTO) ||
 777             (DB_TYPE(add_mp) == M_PCPROTO));
 778 
 779         if (connp != NULL) {
 780                 ASSERT(MUTEX_HELD(&connp->conn_lock));
 781                 /*
 782                  * Return error if the conn has started closing. The conn
 783                  * could have finished cleaning up the pending mp list,
 784                  * If so we should not add another mp to the list negating
 785                  * the cleanup.
 786                  */
 787                 if (connp->conn_state_flags & CONN_CLOSING)
 788                         return (B_FALSE);
 789         }
 790         mutex_enter(&ipx->ipx_lock);
 791         ipx->ipx_pending_ipif = ipif;
 792         /*
 793          * Note down the queue in b_queue. This will be returned by
 794          * ipsq_pending_mp_get. Caller will then use these values to restart
 795          * the processing
 796          */
 797         add_mp->b_next = NULL;
 798         add_mp->b_queue = q;
 799         ipx->ipx_pending_mp = add_mp;
 800         ipx->ipx_waitfor = waitfor;
 801         mutex_exit(&ipx->ipx_lock);
 802 
 803         if (connp != NULL)
 804                 connp->conn_oper_pending_ill = ipif->ipif_ill;
 805 
 806         return (B_TRUE);
 807 }
 808 
 809 /*
 810  * Retrieve the ipx_pending_mp and return it. There can be only 1 mp
 811  * queued in the list.
 812  */
 813 mblk_t *
 814 ipsq_pending_mp_get(ipsq_t *ipsq, conn_t **connpp)
 815 {
 816         mblk_t  *curr = NULL;
 817         ipxop_t *ipx = ipsq->ipsq_xop;
 818 
 819         *connpp = NULL;
 820         mutex_enter(&ipx->ipx_lock);
 821         if (ipx->ipx_pending_mp == NULL) {
 822                 mutex_exit(&ipx->ipx_lock);
 823                 return (NULL);
 824         }
 825 
 826         /* There can be only 1 such excl message */
 827         curr = ipx->ipx_pending_mp;
 828         ASSERT(curr->b_next == NULL);
 829         ipx->ipx_pending_ipif = NULL;
 830         ipx->ipx_pending_mp = NULL;
 831         ipx->ipx_waitfor = 0;
 832         mutex_exit(&ipx->ipx_lock);
 833 
 834         if (CONN_Q(curr->b_queue)) {
 835                 /*
 836                  * This mp did a refhold on the conn, at the start of the ioctl.
 837                  * So we can safely return a pointer to the conn to the caller.
 838                  */
 839                 *connpp = Q_TO_CONN(curr->b_queue);
 840         } else {
 841                 *connpp = NULL;
 842         }
 843         curr->b_next = NULL;
 844         curr->b_prev = NULL;
 845         return (curr);
 846 }
 847 
 848 /*
 849  * Cleanup the ioctl mp queued in ipx_pending_mp
 850  * - Called in the ill_delete path
 851  * - Called in the M_ERROR or M_HANGUP path on the ill.
 852  * - Called in the conn close path.
 853  *
 854  * Returns success on finding the pending mblk associated with the ioctl or
 855  * exclusive operation in progress, failure otherwise.
 856  */
 857 boolean_t
 858 ipsq_pending_mp_cleanup(ill_t *ill, conn_t *connp)
 859 {
 860         mblk_t  *mp;
 861         ipxop_t *ipx;
 862         queue_t *q;
 863         ipif_t  *ipif;
 864         int     cmd;
 865 
 866         ASSERT(IAM_WRITER_ILL(ill));
 867         ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
 868 
 869         mutex_enter(&ipx->ipx_lock);
 870         mp = ipx->ipx_pending_mp;
 871         if (connp != NULL) {
 872                 if (mp == NULL || mp->b_queue != CONNP_TO_WQ(connp)) {
 873                         /*
 874                          * Nothing to clean since the conn that is closing
 875                          * does not have a matching pending mblk in
 876                          * ipx_pending_mp.
 877                          */
 878                         mutex_exit(&ipx->ipx_lock);
 879                         return (B_FALSE);
 880                 }
 881         } else {
 882                 /*
 883                  * A non-zero ill_error signifies we are called in the
 884                  * M_ERROR or M_HANGUP path and we need to unconditionally
 885                  * abort any current ioctl and do the corresponding cleanup.
 886                  * A zero ill_error means we are in the ill_delete path and
 887                  * we do the cleanup only if there is a pending mp.
 888                  */
 889                 if (mp == NULL && ill->ill_error == 0) {
 890                         mutex_exit(&ipx->ipx_lock);
 891                         return (B_FALSE);
 892                 }
 893         }
 894 
 895         /* Now remove from the ipx_pending_mp */
 896         ipx->ipx_pending_mp = NULL;
 897         ipif = ipx->ipx_pending_ipif;
 898         ipx->ipx_pending_ipif = NULL;
 899         ipx->ipx_waitfor = 0;
 900         ipx->ipx_current_ipif = NULL;
 901         cmd = ipx->ipx_current_ioctl;
 902         ipx->ipx_current_ioctl = 0;
 903         ipx->ipx_current_done = B_TRUE;
 904         mutex_exit(&ipx->ipx_lock);
 905 
 906         if (mp == NULL)
 907                 return (B_FALSE);
 908 
 909         q = mp->b_queue;
 910         mp->b_next = NULL;
 911         mp->b_prev = NULL;
 912         mp->b_queue = NULL;
 913 
 914         if (DB_TYPE(mp) == M_IOCTL || DB_TYPE(mp) == M_IOCDATA) {
 915                 DTRACE_PROBE4(ipif__ioctl,
 916                     char *, "ipsq_pending_mp_cleanup",
 917                     int, cmd, ill_t *, ipif == NULL ? NULL : ipif->ipif_ill,
 918                     ipif_t *, ipif);
 919                 if (connp == NULL) {
 920                         ip_ioctl_finish(q, mp, ENXIO, NO_COPYOUT, NULL);
 921                 } else {
 922                         ip_ioctl_finish(q, mp, ENXIO, CONN_CLOSE, NULL);
 923                         mutex_enter(&ipif->ipif_ill->ill_lock);
 924                         ipif->ipif_state_flags &= ~IPIF_CHANGING;
 925                         mutex_exit(&ipif->ipif_ill->ill_lock);
 926                 }
 927         } else {
 928                 inet_freemsg(mp);
 929         }
 930         return (B_TRUE);
 931 }
 932 
 933 /*
 934  * Called in the conn close path and ill delete path
 935  */
 936 static void
 937 ipsq_xopq_mp_cleanup(ill_t *ill, conn_t *connp)
 938 {
 939         ipsq_t  *ipsq;
 940         mblk_t  *prev;
 941         mblk_t  *curr;
 942         mblk_t  *next;
 943         queue_t *wq, *rq = NULL;
 944         mblk_t  *tmp_list = NULL;
 945 
 946         ASSERT(IAM_WRITER_ILL(ill));
 947         if (connp != NULL)
 948                 wq = CONNP_TO_WQ(connp);
 949         else
 950                 wq = ill->ill_wq;
 951 
 952         /*
 953          * In the case of lo0 being unplumbed, ill_wq will be NULL. Guard
 954          * against this here.
 955          */
 956         if (wq != NULL)
 957                 rq = RD(wq);
 958 
 959         ipsq = ill->ill_phyint->phyint_ipsq;
 960         /*
 961          * Cleanup the ioctl mp's queued in ipsq_xopq_pending_mp if any.
 962          * In the case of ioctl from a conn, there can be only 1 mp
 963          * queued on the ipsq. If an ill is being unplumbed flush all
 964          * the messages.
 965          */
 966         mutex_enter(&ipsq->ipsq_lock);
 967         for (prev = NULL, curr = ipsq->ipsq_xopq_mphead; curr != NULL;
 968             curr = next) {
 969                 next = curr->b_next;
 970                 if (connp == NULL ||
 971                     (curr->b_queue == wq || curr->b_queue == rq)) {
 972                         /* Unlink the mblk from the pending mp list */
 973                         if (prev != NULL) {
 974                                 prev->b_next = curr->b_next;
 975                         } else {
 976                                 ASSERT(ipsq->ipsq_xopq_mphead == curr);
 977                                 ipsq->ipsq_xopq_mphead = curr->b_next;
 978                         }
 979                         if (ipsq->ipsq_xopq_mptail == curr)
 980                                 ipsq->ipsq_xopq_mptail = prev;
 981                         /*
 982                          * Create a temporary list and release the ipsq lock
 983                          * New elements are added to the head of the tmp_list
 984                          */
 985                         curr->b_next = tmp_list;
 986                         tmp_list = curr;
 987                 } else {
 988                         prev = curr;
 989                 }
 990         }
 991         mutex_exit(&ipsq->ipsq_lock);
 992 
 993         while (tmp_list != NULL) {
 994                 curr = tmp_list;
 995                 tmp_list = curr->b_next;
 996                 curr->b_next = NULL;
 997                 curr->b_prev = NULL;
 998                 wq = curr->b_queue;
 999                 curr->b_queue = NULL;
1000                 if (DB_TYPE(curr) == M_IOCTL || DB_TYPE(curr) == M_IOCDATA) {
1001                         DTRACE_PROBE4(ipif__ioctl,
1002                             char *, "ipsq_xopq_mp_cleanup",
1003                             int, 0, ill_t *, NULL, ipif_t *, NULL);
1004                         ip_ioctl_finish(wq, curr, ENXIO, connp != NULL ?
1005                             CONN_CLOSE : NO_COPYOUT, NULL);
1006                 } else {
1007                         /*
1008                          * IP-MT XXX In the case of TLI/XTI bind / optmgmt
1009                          * this can't be just inet_freemsg. we have to
1010                          * restart it otherwise the thread will be stuck.
1011                          */
1012                         inet_freemsg(curr);
1013                 }
1014         }
1015 }
1016 
1017 /*
1018  * This conn has started closing. Cleanup any pending ioctl from this conn.
1019  * STREAMS ensures that there can be at most 1 active ioctl on a stream.
1020  */
1021 void
1022 conn_ioctl_cleanup(conn_t *connp)
1023 {
1024         ipsq_t  *ipsq;
1025         ill_t   *ill;
1026         boolean_t refheld;
1027 
1028         /*
1029          * Check for a queued ioctl. If the ioctl has not yet started, the mp
1030          * is pending in the list headed by ipsq_xopq_head. If the ioctl has
1031          * started the mp could be present in ipx_pending_mp. Note that if
1032          * conn_oper_pending_ill is NULL, the ioctl may still be in flight and
1033          * not yet queued anywhere. In this case, the conn close code will wait
1034          * until the conn_ref is dropped. If the stream was a tcp stream, then
1035          * tcp_close will wait first until all ioctls have completed for this
1036          * conn.
1037          */
1038         mutex_enter(&connp->conn_lock);
1039         ill = connp->conn_oper_pending_ill;
1040         if (ill == NULL) {
1041                 mutex_exit(&connp->conn_lock);
1042                 return;
1043         }
1044 
1045         /*
1046          * We may not be able to refhold the ill if the ill/ipif
1047          * is changing. But we need to make sure that the ill will
1048          * not vanish. So we just bump up the ill_waiter count.
1049          */
1050         refheld = ill_waiter_inc(ill);
1051         mutex_exit(&connp->conn_lock);
1052         if (refheld) {
1053                 if (ipsq_enter(ill, B_TRUE, NEW_OP)) {
1054                         ill_waiter_dcr(ill);
1055                         /*
1056                          * Check whether this ioctl has started and is
1057                          * pending. If it is not found there then check
1058                          * whether this ioctl has not even started and is in
1059                          * the ipsq_xopq list.
1060                          */
1061                         if (!ipsq_pending_mp_cleanup(ill, connp))
1062                                 ipsq_xopq_mp_cleanup(ill, connp);
1063                         ipsq = ill->ill_phyint->phyint_ipsq;
1064                         ipsq_exit(ipsq);
1065                         return;
1066                 }
1067         }
1068 
1069         /*
1070          * The ill is also closing and we could not bump up the
1071          * ill_waiter_count or we could not enter the ipsq. Leave
1072          * the cleanup to ill_delete
1073          */
1074         mutex_enter(&connp->conn_lock);
1075         while (connp->conn_oper_pending_ill != NULL)
1076                 cv_wait(&connp->conn_refcv, &connp->conn_lock);
1077         mutex_exit(&connp->conn_lock);
1078         if (refheld)
1079                 ill_waiter_dcr(ill);
1080 }
1081 
1082 /*
1083  * ipcl_walk function for cleaning up conn_*_ill fields.
1084  * Note that we leave ixa_multicast_ifindex, conn_incoming_ifindex, and
1085  * conn_bound_if in place. We prefer dropping
1086  * packets instead of sending them out the wrong interface, or accepting
1087  * packets from the wrong ifindex.
1088  */
1089 static void
1090 conn_cleanup_ill(conn_t *connp, caddr_t arg)
1091 {
1092         ill_t   *ill = (ill_t *)arg;
1093 
1094         mutex_enter(&connp->conn_lock);
1095         if (connp->conn_dhcpinit_ill == ill) {
1096                 connp->conn_dhcpinit_ill = NULL;
1097                 ASSERT(ill->ill_dhcpinit != 0);
1098                 atomic_dec_32(&ill->ill_dhcpinit);
1099                 ill_set_inputfn(ill);
1100         }
1101         mutex_exit(&connp->conn_lock);
1102 }
1103 
1104 static int
1105 ill_down_ipifs_tail(ill_t *ill)
1106 {
1107         ipif_t  *ipif;
1108         int err;
1109 
1110         ASSERT(IAM_WRITER_ILL(ill));
1111         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
1112                 ipif_non_duplicate(ipif);
1113                 /*
1114                  * ipif_down_tail will call arp_ll_down on the last ipif
1115                  * and typically return EINPROGRESS when the DL_UNBIND is sent.
1116                  */
1117                 if ((err = ipif_down_tail(ipif)) != 0)
1118                         return (err);
1119         }
1120         return (0);
1121 }
1122 
1123 /* ARGSUSED */
1124 void
1125 ipif_all_down_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
1126 {
1127         ASSERT(IAM_WRITER_IPSQ(ipsq));
1128         (void) ill_down_ipifs_tail(q->q_ptr);
1129         freemsg(mp);
1130         ipsq_current_finish(ipsq);
1131 }
1132 
1133 /*
1134  * ill_down_start is called when we want to down this ill and bring it up again
1135  * It is called when we receive an M_ERROR / M_HANGUP. In this case we shut down
1136  * all interfaces, but don't tear down any plumbing.
1137  */
1138 boolean_t
1139 ill_down_start(queue_t *q, mblk_t *mp)
1140 {
1141         ill_t   *ill = q->q_ptr;
1142         ipif_t  *ipif;
1143 
1144         ASSERT(IAM_WRITER_ILL(ill));
1145         /*
1146          * It is possible that some ioctl is already in progress while we
1147          * received the M_ERROR / M_HANGUP in which case, we need to abort
1148          * the ioctl. ill_down_start() is being processed as CUR_OP rather
1149          * than as NEW_OP since the cause of the M_ERROR / M_HANGUP may prevent
1150          * the in progress ioctl from ever completing.
1151          *
1152          * The thread that started the ioctl (if any) must have returned,
1153          * since we are now executing as writer. After the 2 calls below,
1154          * the state of the ipsq and the ill would reflect no trace of any
1155          * pending operation. Subsequently if there is any response to the
1156          * original ioctl from the driver, it would be discarded as an
1157          * unsolicited message from the driver.
1158          */
1159         (void) ipsq_pending_mp_cleanup(ill, NULL);
1160         ill_dlpi_clear_deferred(ill);
1161 
1162         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
1163                 (void) ipif_down(ipif, NULL, NULL);
1164 
1165         ill_down(ill);
1166 
1167         /*
1168          * Walk all CONNs that can have a reference on an ire or nce for this
1169          * ill (we actually walk all that now have stale references).
1170          */
1171         ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ill->ill_ipst);
1172 
1173         /* With IPv6 we have dce_ifindex. Cleanup for neatness */
1174         if (ill->ill_isv6)
1175                 dce_cleanup(ill->ill_phyint->phyint_ifindex, ill->ill_ipst);
1176 
1177         ipsq_current_start(ill->ill_phyint->phyint_ipsq, ill->ill_ipif, 0);
1178 
1179         /*
1180          * Atomically test and add the pending mp if references are active.
1181          */
1182         mutex_enter(&ill->ill_lock);
1183         if (!ill_is_quiescent(ill)) {
1184                 /* call cannot fail since `conn_t *' argument is NULL */
1185                 (void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
1186                     mp, ILL_DOWN);
1187                 mutex_exit(&ill->ill_lock);
1188                 return (B_FALSE);
1189         }
1190         mutex_exit(&ill->ill_lock);
1191         return (B_TRUE);
1192 }
1193 
1194 static void
1195 ill_down(ill_t *ill)
1196 {
1197         mblk_t  *mp;
1198         ip_stack_t      *ipst = ill->ill_ipst;
1199 
1200         /*
1201          * Blow off any IREs dependent on this ILL.
1202          * The caller needs to handle conn_ixa_cleanup
1203          */
1204         ill_delete_ires(ill);
1205 
1206         ire_walk_ill(0, 0, ill_downi, ill, ill);
1207 
1208         /* Remove any conn_*_ill depending on this ill */
1209         ipcl_walk(conn_cleanup_ill, (caddr_t)ill, ipst);
1210 
1211         /*
1212          * Free state for additional IREs.
1213          */
1214         mutex_enter(&ill->ill_saved_ire_lock);
1215         mp = ill->ill_saved_ire_mp;
1216         ill->ill_saved_ire_mp = NULL;
1217         ill->ill_saved_ire_cnt = 0;
1218         mutex_exit(&ill->ill_saved_ire_lock);
1219         freemsg(mp);
1220 }
1221 
1222 /*
1223  * ire_walk routine used to delete every IRE that depends on
1224  * 'ill'.  (Always called as writer, and may only be called from ire_walk.)
1225  *
1226  * Note: since the routes added by the kernel are deleted separately,
1227  * this will only be 1) IRE_IF_CLONE and 2) manually added IRE_INTERFACE.
1228  *
1229  * We also remove references on ire_nce_cache entries that refer to the ill.
1230  */
1231 void
1232 ill_downi(ire_t *ire, char *ill_arg)
1233 {
1234         ill_t   *ill = (ill_t *)ill_arg;
1235         nce_t   *nce;
1236 
1237         mutex_enter(&ire->ire_lock);
1238         nce = ire->ire_nce_cache;
1239         if (nce != NULL && nce->nce_ill == ill)
1240                 ire->ire_nce_cache = NULL;
1241         else
1242                 nce = NULL;
1243         mutex_exit(&ire->ire_lock);
1244         if (nce != NULL)
1245                 nce_refrele(nce);
1246         if (ire->ire_ill == ill) {
1247                 /*
1248                  * The existing interface binding for ire must be
1249                  * deleted before trying to bind the route to another
1250                  * interface. However, since we are using the contents of the
1251                  * ire after ire_delete, the caller has to ensure that
1252                  * CONDEMNED (deleted) ire's are not removed from the list
1253                  * when ire_delete() returns. Currently ill_downi() is
1254                  * only called as part of ire_walk*() routines, so that
1255                  * the irb_refhold() done by ire_walk*() will ensure that
1256                  * ire_delete() does not lead to ire_inactive().
1257                  */
1258                 ASSERT(ire->ire_bucket->irb_refcnt > 0);
1259                 ire_delete(ire);
1260                 if (ire->ire_unbound)
1261                         ire_rebind(ire);
1262         }
1263 }
1264 
1265 /* Remove IRE_IF_CLONE on this ill */
1266 void
1267 ill_downi_if_clone(ire_t *ire, char *ill_arg)
1268 {
1269         ill_t   *ill = (ill_t *)ill_arg;
1270 
1271         ASSERT(ire->ire_type & IRE_IF_CLONE);
1272         if (ire->ire_ill == ill)
1273                 ire_delete(ire);
1274 }
1275 
1276 /* Consume an M_IOCACK of the fastpath probe. */
1277 void
1278 ill_fastpath_ack(ill_t *ill, mblk_t *mp)
1279 {
1280         mblk_t  *mp1 = mp;
1281 
1282         /*
1283          * If this was the first attempt turn on the fastpath probing.
1284          */
1285         mutex_enter(&ill->ill_lock);
1286         if (ill->ill_dlpi_fastpath_state == IDS_INPROGRESS)
1287                 ill->ill_dlpi_fastpath_state = IDS_OK;
1288         mutex_exit(&ill->ill_lock);
1289 
1290         /* Free the M_IOCACK mblk, hold on to the data */
1291         mp = mp->b_cont;
1292         freeb(mp1);
1293         if (mp == NULL)
1294                 return;
1295         if (mp->b_cont != NULL)
1296                 nce_fastpath_update(ill, mp);
1297         else
1298                 ip0dbg(("ill_fastpath_ack:  no b_cont\n"));
1299         freemsg(mp);
1300 }
1301 
1302 /*
1303  * Throw an M_IOCTL message downstream asking "do you know fastpath?"
1304  * The data portion of the request is a dl_unitdata_req_t template for
1305  * what we would send downstream in the absence of a fastpath confirmation.
1306  */
1307 int
1308 ill_fastpath_probe(ill_t *ill, mblk_t *dlur_mp)
1309 {
1310         struct iocblk   *ioc;
1311         mblk_t  *mp;
1312 
1313         if (dlur_mp == NULL)
1314                 return (EINVAL);
1315 
1316         mutex_enter(&ill->ill_lock);
1317         switch (ill->ill_dlpi_fastpath_state) {
1318         case IDS_FAILED:
1319                 /*
1320                  * Driver NAKed the first fastpath ioctl - assume it doesn't
1321                  * support it.
1322                  */
1323                 mutex_exit(&ill->ill_lock);
1324                 return (ENOTSUP);
1325         case IDS_UNKNOWN:
1326                 /* This is the first probe */
1327                 ill->ill_dlpi_fastpath_state = IDS_INPROGRESS;
1328                 break;
1329         default:
1330                 break;
1331         }
1332         mutex_exit(&ill->ill_lock);
1333 
1334         if ((mp = mkiocb(DL_IOC_HDR_INFO)) == NULL)
1335                 return (EAGAIN);
1336 
1337         mp->b_cont = copyb(dlur_mp);
1338         if (mp->b_cont == NULL) {
1339                 freeb(mp);
1340                 return (EAGAIN);
1341         }
1342 
1343         ioc = (struct iocblk *)mp->b_rptr;
1344         ioc->ioc_count = msgdsize(mp->b_cont);
1345 
1346         DTRACE_PROBE3(ill__dlpi, char *, "ill_fastpath_probe",
1347             char *, "DL_IOC_HDR_INFO", ill_t *, ill);
1348         putnext(ill->ill_wq, mp);
1349         return (0);
1350 }
1351 
1352 void
1353 ill_capability_probe(ill_t *ill)
1354 {
1355         mblk_t  *mp;
1356 
1357         ASSERT(IAM_WRITER_ILL(ill));
1358 
1359         if (ill->ill_dlpi_capab_state != IDCS_UNKNOWN &&
1360             ill->ill_dlpi_capab_state != IDCS_FAILED)
1361                 return;
1362 
1363         /*
1364          * We are starting a new cycle of capability negotiation.
1365          * Free up the capab reset messages of any previous incarnation.
1366          * We will do a fresh allocation when we get the response to our probe
1367          */
1368         if (ill->ill_capab_reset_mp != NULL) {
1369                 freemsg(ill->ill_capab_reset_mp);
1370                 ill->ill_capab_reset_mp = NULL;
1371         }
1372 
1373         ip1dbg(("ill_capability_probe: starting capability negotiation\n"));
1374 
1375         mp = ip_dlpi_alloc(sizeof (dl_capability_req_t), DL_CAPABILITY_REQ);
1376         if (mp == NULL)
1377                 return;
1378 
1379         ill_capability_send(ill, mp);
1380         ill->ill_dlpi_capab_state = IDCS_PROBE_SENT;
1381 }
1382 
1383 void
1384 ill_capability_reset(ill_t *ill, boolean_t reneg)
1385 {
1386         ASSERT(IAM_WRITER_ILL(ill));
1387 
1388         if (ill->ill_dlpi_capab_state != IDCS_OK)
1389                 return;
1390 
1391         ill->ill_dlpi_capab_state = reneg ? IDCS_RENEG : IDCS_RESET_SENT;
1392 
1393         ill_capability_send(ill, ill->ill_capab_reset_mp);
1394         ill->ill_capab_reset_mp = NULL;
1395         /*
1396          * We turn off all capabilities except those pertaining to
1397          * direct function call capabilities viz. ILL_CAPAB_DLD*
1398          * which will be turned off by the corresponding reset functions.
1399          */
1400         ill->ill_capabilities &= ~(ILL_CAPAB_HCKSUM  | ILL_CAPAB_ZEROCOPY);
1401 }
1402 
1403 static void
1404 ill_capability_reset_alloc(ill_t *ill)
1405 {
1406         mblk_t *mp;
1407         size_t  size = 0;
1408         int     err;
1409         dl_capability_req_t     *capb;
1410 
1411         ASSERT(IAM_WRITER_ILL(ill));
1412         ASSERT(ill->ill_capab_reset_mp == NULL);
1413 
1414         if (ILL_HCKSUM_CAPABLE(ill)) {
1415                 size += sizeof (dl_capability_sub_t) +
1416                     sizeof (dl_capab_hcksum_t);
1417         }
1418 
1419         if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) {
1420                 size += sizeof (dl_capability_sub_t) +
1421                     sizeof (dl_capab_zerocopy_t);
1422         }
1423 
1424         if (ill->ill_capabilities & ILL_CAPAB_DLD) {
1425                 size += sizeof (dl_capability_sub_t) +
1426                     sizeof (dl_capab_dld_t);
1427         }
1428 
1429         mp = allocb_wait(size + sizeof (dl_capability_req_t), BPRI_MED,
1430             STR_NOSIG, &err);
1431 
1432         mp->b_datap->db_type = M_PROTO;
1433         bzero(mp->b_rptr, size + sizeof (dl_capability_req_t));
1434 
1435         capb = (dl_capability_req_t *)mp->b_rptr;
1436         capb->dl_primitive = DL_CAPABILITY_REQ;
1437         capb->dl_sub_offset = sizeof (dl_capability_req_t);
1438         capb->dl_sub_length = size;
1439 
1440         mp->b_wptr += sizeof (dl_capability_req_t);
1441 
1442         /*
1443          * Each handler fills in the corresponding dl_capability_sub_t
1444          * inside the mblk,
1445          */
1446         ill_capability_hcksum_reset_fill(ill, mp);
1447         ill_capability_zerocopy_reset_fill(ill, mp);
1448         ill_capability_dld_reset_fill(ill, mp);
1449 
1450         ill->ill_capab_reset_mp = mp;
1451 }
1452 
1453 static void
1454 ill_capability_id_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *outers)
1455 {
1456         dl_capab_id_t *id_ic;
1457         uint_t sub_dl_cap = outers->dl_cap;
1458         dl_capability_sub_t *inners;
1459         uint8_t *capend;
1460 
1461         ASSERT(sub_dl_cap == DL_CAPAB_ID_WRAPPER);
1462 
1463         /*
1464          * Note: range checks here are not absolutely sufficient to
1465          * make us robust against malformed messages sent by drivers;
1466          * this is in keeping with the rest of IP's dlpi handling.
1467          * (Remember, it's coming from something else in the kernel
1468          * address space)
1469          */
1470 
1471         capend = (uint8_t *)(outers + 1) + outers->dl_length;
1472         if (capend > mp->b_wptr) {
1473                 cmn_err(CE_WARN, "ill_capability_id_ack: "
1474                     "malformed sub-capability too long for mblk");
1475                 return;
1476         }
1477 
1478         id_ic = (dl_capab_id_t *)(outers + 1);
1479 
1480         if (outers->dl_length < sizeof (*id_ic) ||
1481             (inners = &id_ic->id_subcap,
1482             inners->dl_length > (outers->dl_length - sizeof (*inners)))) {
1483                 cmn_err(CE_WARN, "ill_capability_id_ack: malformed "
1484                     "encapsulated capab type %d too long for mblk",
1485                     inners->dl_cap);
1486                 return;
1487         }
1488 
1489         if (!dlcapabcheckqid(&id_ic->id_mid, ill->ill_lmod_rq)) {
1490                 ip1dbg(("ill_capability_id_ack: mid token for capab type %d "
1491                     "isn't as expected; pass-thru module(s) detected, "
1492                     "discarding capability\n", inners->dl_cap));
1493                 return;
1494         }
1495 
1496         /* Process the encapsulated sub-capability */
1497         ill_capability_dispatch(ill, mp, inners);
1498 }
1499 
1500 static void
1501 ill_capability_dld_reset_fill(ill_t *ill, mblk_t *mp)
1502 {
1503         dl_capability_sub_t *dl_subcap;
1504 
1505         if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
1506                 return;
1507 
1508         /*
1509          * The dl_capab_dld_t that follows the dl_capability_sub_t is not
1510          * initialized below since it is not used by DLD.
1511          */
1512         dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1513         dl_subcap->dl_cap = DL_CAPAB_DLD;
1514         dl_subcap->dl_length = sizeof (dl_capab_dld_t);
1515 
1516         mp->b_wptr += sizeof (dl_capability_sub_t) + sizeof (dl_capab_dld_t);
1517 }
1518 
1519 static void
1520 ill_capability_dispatch(ill_t *ill, mblk_t *mp, dl_capability_sub_t *subp)
1521 {
1522         /*
1523          * If no ipif was brought up over this ill, this DL_CAPABILITY_REQ/ACK
1524          * is only to get the VRRP capability.
1525          *
1526          * Note that we cannot check ill_ipif_up_count here since
1527          * ill_ipif_up_count is only incremented when the resolver is setup.
1528          * That is done asynchronously, and can race with this function.
1529          */
1530         if (!ill->ill_dl_up) {
1531                 if (subp->dl_cap == DL_CAPAB_VRRP)
1532                         ill_capability_vrrp_ack(ill, mp, subp);
1533                 return;
1534         }
1535 
1536         switch (subp->dl_cap) {
1537         case DL_CAPAB_HCKSUM:
1538                 ill_capability_hcksum_ack(ill, mp, subp);
1539                 break;
1540         case DL_CAPAB_ZEROCOPY:
1541                 ill_capability_zerocopy_ack(ill, mp, subp);
1542                 break;
1543         case DL_CAPAB_DLD:
1544                 ill_capability_dld_ack(ill, mp, subp);
1545                 break;
1546         case DL_CAPAB_VRRP:
1547                 break;
1548         default:
1549                 ip1dbg(("ill_capability_dispatch: unknown capab type %d\n",
1550                     subp->dl_cap));
1551         }
1552 }
1553 
1554 /*
1555  * Process the vrrp capability received from a DLS Provider. isub must point
1556  * to the sub-capability (DL_CAPAB_VRRP) of a DL_CAPABILITY_ACK message.
1557  */
1558 static void
1559 ill_capability_vrrp_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1560 {
1561         dl_capab_vrrp_t *vrrp;
1562         uint_t          sub_dl_cap = isub->dl_cap;
1563         uint8_t         *capend;
1564 
1565         ASSERT(IAM_WRITER_ILL(ill));
1566         ASSERT(sub_dl_cap == DL_CAPAB_VRRP);
1567 
1568         /*
1569          * Note: range checks here are not absolutely sufficient to
1570          * make us robust against malformed messages sent by drivers;
1571          * this is in keeping with the rest of IP's dlpi handling.
1572          * (Remember, it's coming from something else in the kernel
1573          * address space)
1574          */
1575         capend = (uint8_t *)(isub + 1) + isub->dl_length;
1576         if (capend > mp->b_wptr) {
1577                 cmn_err(CE_WARN, "ill_capability_vrrp_ack: "
1578                     "malformed sub-capability too long for mblk");
1579                 return;
1580         }
1581         vrrp = (dl_capab_vrrp_t *)(isub + 1);
1582 
1583         /*
1584          * Compare the IP address family and set ILLF_VRRP for the right ill.
1585          */
1586         if ((vrrp->vrrp_af == AF_INET6 && ill->ill_isv6) ||
1587             (vrrp->vrrp_af == AF_INET && !ill->ill_isv6)) {
1588                 ill->ill_flags |= ILLF_VRRP;
1589         }
1590 }
1591 
1592 /*
1593  * Process a hardware checksum offload capability negotiation ack received
1594  * from a DLS Provider.isub must point to the sub-capability (DL_CAPAB_HCKSUM)
1595  * of a DL_CAPABILITY_ACK message.
1596  */
1597 static void
1598 ill_capability_hcksum_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1599 {
1600         dl_capability_req_t     *ocap;
1601         dl_capab_hcksum_t       *ihck, *ohck;
1602         ill_hcksum_capab_t      **ill_hcksum;
1603         mblk_t                  *nmp = NULL;
1604         uint_t                  sub_dl_cap = isub->dl_cap;
1605         uint8_t                 *capend;
1606 
1607         ASSERT(sub_dl_cap == DL_CAPAB_HCKSUM);
1608 
1609         ill_hcksum = (ill_hcksum_capab_t **)&ill->ill_hcksum_capab;
1610 
1611         /*
1612          * Note: range checks here are not absolutely sufficient to
1613          * make us robust against malformed messages sent by drivers;
1614          * this is in keeping with the rest of IP's dlpi handling.
1615          * (Remember, it's coming from something else in the kernel
1616          * address space)
1617          */
1618         capend = (uint8_t *)(isub + 1) + isub->dl_length;
1619         if (capend > mp->b_wptr) {
1620                 cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1621                     "malformed sub-capability too long for mblk");
1622                 return;
1623         }
1624 
1625         /*
1626          * There are two types of acks we process here:
1627          * 1. acks in reply to a (first form) generic capability req
1628          *    (no ENABLE flag set)
1629          * 2. acks in reply to a ENABLE capability req.
1630          *    (ENABLE flag set)
1631          */
1632         ihck = (dl_capab_hcksum_t *)(isub + 1);
1633 
1634         if (ihck->hcksum_version != HCKSUM_VERSION_1) {
1635                 cmn_err(CE_CONT, "ill_capability_hcksum_ack: "
1636                     "unsupported hardware checksum "
1637                     "sub-capability (version %d, expected %d)",
1638                     ihck->hcksum_version, HCKSUM_VERSION_1);
1639                 return;
1640         }
1641 
1642         if (!dlcapabcheckqid(&ihck->hcksum_mid, ill->ill_lmod_rq)) {
1643                 ip1dbg(("ill_capability_hcksum_ack: mid token for hardware "
1644                     "checksum capability isn't as expected; pass-thru "
1645                     "module(s) detected, discarding capability\n"));
1646                 return;
1647         }
1648 
1649 #define CURR_HCKSUM_CAPAB                               \
1650         (HCKSUM_INET_PARTIAL | HCKSUM_INET_FULL_V4 |    \
1651         HCKSUM_INET_FULL_V6 | HCKSUM_IPHDRCKSUM)
1652 
1653         if ((ihck->hcksum_txflags & HCKSUM_ENABLE) &&
1654             (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB)) {
1655                 /* do ENABLE processing */
1656                 if (*ill_hcksum == NULL) {
1657                         *ill_hcksum = kmem_zalloc(sizeof (ill_hcksum_capab_t),
1658                             KM_NOSLEEP);
1659 
1660                         if (*ill_hcksum == NULL) {
1661                                 cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1662                                     "could not enable hcksum version %d "
1663                                     "for %s (ENOMEM)\n", HCKSUM_CURRENT_VERSION,
1664                                     ill->ill_name);
1665                                 return;
1666                         }
1667                 }
1668 
1669                 (*ill_hcksum)->ill_hcksum_version = ihck->hcksum_version;
1670                 (*ill_hcksum)->ill_hcksum_txflags = ihck->hcksum_txflags;
1671                 ill->ill_capabilities |= ILL_CAPAB_HCKSUM;
1672                 ip1dbg(("ill_capability_hcksum_ack: interface %s "
1673                     "has enabled hardware checksumming\n ",
1674                     ill->ill_name));
1675         } else if (ihck->hcksum_txflags & CURR_HCKSUM_CAPAB) {
1676                 /*
1677                  * Enabling hardware checksum offload
1678                  * Currently IP supports {TCP,UDP}/IPv4
1679                  * partial and full cksum offload and
1680                  * IPv4 header checksum offload.
1681                  * Allocate new mblk which will
1682                  * contain a new capability request
1683                  * to enable hardware checksum offload.
1684                  */
1685                 uint_t  size;
1686                 uchar_t *rptr;
1687 
1688                 size = sizeof (dl_capability_req_t) +
1689                     sizeof (dl_capability_sub_t) + isub->dl_length;
1690 
1691                 if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1692                         cmn_err(CE_WARN, "ill_capability_hcksum_ack: "
1693                             "could not enable hardware cksum for %s (ENOMEM)\n",
1694                             ill->ill_name);
1695                         return;
1696                 }
1697 
1698                 rptr = nmp->b_rptr;
1699                 /* initialize dl_capability_req_t */
1700                 ocap = (dl_capability_req_t *)nmp->b_rptr;
1701                 ocap->dl_sub_offset =
1702                     sizeof (dl_capability_req_t);
1703                 ocap->dl_sub_length =
1704                     sizeof (dl_capability_sub_t) +
1705                     isub->dl_length;
1706                 nmp->b_rptr += sizeof (dl_capability_req_t);
1707 
1708                 /* initialize dl_capability_sub_t */
1709                 bcopy(isub, nmp->b_rptr, sizeof (*isub));
1710                 nmp->b_rptr += sizeof (*isub);
1711 
1712                 /* initialize dl_capab_hcksum_t */
1713                 ohck = (dl_capab_hcksum_t *)nmp->b_rptr;
1714                 bcopy(ihck, ohck, sizeof (*ihck));
1715 
1716                 nmp->b_rptr = rptr;
1717                 ASSERT(nmp->b_wptr == (nmp->b_rptr + size));
1718 
1719                 /* Set ENABLE flag */
1720                 ohck->hcksum_txflags &= CURR_HCKSUM_CAPAB;
1721                 ohck->hcksum_txflags |= HCKSUM_ENABLE;
1722 
1723                 /*
1724                  * nmp points to a DL_CAPABILITY_REQ message to enable
1725                  * hardware checksum acceleration.
1726                  */
1727                 ill_capability_send(ill, nmp);
1728         } else {
1729                 ip1dbg(("ill_capability_hcksum_ack: interface %s has "
1730                     "advertised %x hardware checksum capability flags\n",
1731                     ill->ill_name, ihck->hcksum_txflags));
1732         }
1733 }
1734 
1735 static void
1736 ill_capability_hcksum_reset_fill(ill_t *ill, mblk_t *mp)
1737 {
1738         dl_capab_hcksum_t *hck_subcap;
1739         dl_capability_sub_t *dl_subcap;
1740 
1741         if (!ILL_HCKSUM_CAPABLE(ill))
1742                 return;
1743 
1744         ASSERT(ill->ill_hcksum_capab != NULL);
1745 
1746         dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1747         dl_subcap->dl_cap = DL_CAPAB_HCKSUM;
1748         dl_subcap->dl_length = sizeof (*hck_subcap);
1749 
1750         hck_subcap = (dl_capab_hcksum_t *)(dl_subcap + 1);
1751         hck_subcap->hcksum_version = ill->ill_hcksum_capab->ill_hcksum_version;
1752         hck_subcap->hcksum_txflags = 0;
1753 
1754         mp->b_wptr += sizeof (*dl_subcap) + sizeof (*hck_subcap);
1755 }
1756 
1757 static void
1758 ill_capability_zerocopy_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1759 {
1760         mblk_t *nmp = NULL;
1761         dl_capability_req_t *oc;
1762         dl_capab_zerocopy_t *zc_ic, *zc_oc;
1763         ill_zerocopy_capab_t **ill_zerocopy_capab;
1764         uint_t sub_dl_cap = isub->dl_cap;
1765         uint8_t *capend;
1766 
1767         ASSERT(sub_dl_cap == DL_CAPAB_ZEROCOPY);
1768 
1769         ill_zerocopy_capab = (ill_zerocopy_capab_t **)&ill->ill_zerocopy_capab;
1770 
1771         /*
1772          * Note: range checks here are not absolutely sufficient to
1773          * make us robust against malformed messages sent by drivers;
1774          * this is in keeping with the rest of IP's dlpi handling.
1775          * (Remember, it's coming from something else in the kernel
1776          * address space)
1777          */
1778         capend = (uint8_t *)(isub + 1) + isub->dl_length;
1779         if (capend > mp->b_wptr) {
1780                 cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1781                     "malformed sub-capability too long for mblk");
1782                 return;
1783         }
1784 
1785         zc_ic = (dl_capab_zerocopy_t *)(isub + 1);
1786         if (zc_ic->zerocopy_version != ZEROCOPY_VERSION_1) {
1787                 cmn_err(CE_CONT, "ill_capability_zerocopy_ack: "
1788                     "unsupported ZEROCOPY sub-capability (version %d, "
1789                     "expected %d)", zc_ic->zerocopy_version,
1790                     ZEROCOPY_VERSION_1);
1791                 return;
1792         }
1793 
1794         if (!dlcapabcheckqid(&zc_ic->zerocopy_mid, ill->ill_lmod_rq)) {
1795                 ip1dbg(("ill_capability_zerocopy_ack: mid token for zerocopy "
1796                     "capability isn't as expected; pass-thru module(s) "
1797                     "detected, discarding capability\n"));
1798                 return;
1799         }
1800 
1801         if ((zc_ic->zerocopy_flags & DL_CAPAB_VMSAFE_MEM) != 0) {
1802                 if (*ill_zerocopy_capab == NULL) {
1803                         *ill_zerocopy_capab =
1804                             kmem_zalloc(sizeof (ill_zerocopy_capab_t),
1805                             KM_NOSLEEP);
1806 
1807                         if (*ill_zerocopy_capab == NULL) {
1808                                 cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1809                                     "could not enable Zero-copy version %d "
1810                                     "for %s (ENOMEM)\n", ZEROCOPY_VERSION_1,
1811                                     ill->ill_name);
1812                                 return;
1813                         }
1814                 }
1815 
1816                 ip1dbg(("ill_capability_zerocopy_ack: interface %s "
1817                     "supports Zero-copy version %d\n", ill->ill_name,
1818                     ZEROCOPY_VERSION_1));
1819 
1820                 (*ill_zerocopy_capab)->ill_zerocopy_version =
1821                     zc_ic->zerocopy_version;
1822                 (*ill_zerocopy_capab)->ill_zerocopy_flags =
1823                     zc_ic->zerocopy_flags;
1824 
1825                 ill->ill_capabilities |= ILL_CAPAB_ZEROCOPY;
1826         } else {
1827                 uint_t size;
1828                 uchar_t *rptr;
1829 
1830                 size = sizeof (dl_capability_req_t) +
1831                     sizeof (dl_capability_sub_t) +
1832                     sizeof (dl_capab_zerocopy_t);
1833 
1834                 if ((nmp = ip_dlpi_alloc(size, DL_CAPABILITY_REQ)) == NULL) {
1835                         cmn_err(CE_WARN, "ill_capability_zerocopy_ack: "
1836                             "could not enable zerocopy for %s (ENOMEM)\n",
1837                             ill->ill_name);
1838                         return;
1839                 }
1840 
1841                 rptr = nmp->b_rptr;
1842                 /* initialize dl_capability_req_t */
1843                 oc = (dl_capability_req_t *)rptr;
1844                 oc->dl_sub_offset = sizeof (dl_capability_req_t);
1845                 oc->dl_sub_length = sizeof (dl_capability_sub_t) +
1846                     sizeof (dl_capab_zerocopy_t);
1847                 rptr += sizeof (dl_capability_req_t);
1848 
1849                 /* initialize dl_capability_sub_t */
1850                 bcopy(isub, rptr, sizeof (*isub));
1851                 rptr += sizeof (*isub);
1852 
1853                 /* initialize dl_capab_zerocopy_t */
1854                 zc_oc = (dl_capab_zerocopy_t *)rptr;
1855                 *zc_oc = *zc_ic;
1856 
1857                 ip1dbg(("ill_capability_zerocopy_ack: asking interface %s "
1858                     "to enable zero-copy version %d\n", ill->ill_name,
1859                     ZEROCOPY_VERSION_1));
1860 
1861                 /* set VMSAFE_MEM flag */
1862                 zc_oc->zerocopy_flags |= DL_CAPAB_VMSAFE_MEM;
1863 
1864                 /* nmp points to a DL_CAPABILITY_REQ message to enable zcopy */
1865                 ill_capability_send(ill, nmp);
1866         }
1867 }
1868 
1869 static void
1870 ill_capability_zerocopy_reset_fill(ill_t *ill, mblk_t *mp)
1871 {
1872         dl_capab_zerocopy_t *zerocopy_subcap;
1873         dl_capability_sub_t *dl_subcap;
1874 
1875         if (!(ill->ill_capabilities & ILL_CAPAB_ZEROCOPY))
1876                 return;
1877 
1878         ASSERT(ill->ill_zerocopy_capab != NULL);
1879 
1880         dl_subcap = (dl_capability_sub_t *)mp->b_wptr;
1881         dl_subcap->dl_cap = DL_CAPAB_ZEROCOPY;
1882         dl_subcap->dl_length = sizeof (*zerocopy_subcap);
1883 
1884         zerocopy_subcap = (dl_capab_zerocopy_t *)(dl_subcap + 1);
1885         zerocopy_subcap->zerocopy_version =
1886             ill->ill_zerocopy_capab->ill_zerocopy_version;
1887         zerocopy_subcap->zerocopy_flags = 0;
1888 
1889         mp->b_wptr += sizeof (*dl_subcap) + sizeof (*zerocopy_subcap);
1890 }
1891 
1892 /*
1893  * DLD capability
1894  * Refer to dld.h for more information regarding the purpose and usage
1895  * of this capability.
1896  */
1897 static void
1898 ill_capability_dld_ack(ill_t *ill, mblk_t *mp, dl_capability_sub_t *isub)
1899 {
1900         dl_capab_dld_t          *dld_ic, dld;
1901         uint_t                  sub_dl_cap = isub->dl_cap;
1902         uint8_t                 *capend;
1903         ill_dld_capab_t         *idc;
1904 
1905         ASSERT(IAM_WRITER_ILL(ill));
1906         ASSERT(sub_dl_cap == DL_CAPAB_DLD);
1907 
1908         /*
1909          * Note: range checks here are not absolutely sufficient to
1910          * make us robust against malformed messages sent by drivers;
1911          * this is in keeping with the rest of IP's dlpi handling.
1912          * (Remember, it's coming from something else in the kernel
1913          * address space)
1914          */
1915         capend = (uint8_t *)(isub + 1) + isub->dl_length;
1916         if (capend > mp->b_wptr) {
1917                 cmn_err(CE_WARN, "ill_capability_dld_ack: "
1918                     "malformed sub-capability too long for mblk");
1919                 return;
1920         }
1921         dld_ic = (dl_capab_dld_t *)(isub + 1);
1922         if (dld_ic->dld_version != DLD_CURRENT_VERSION) {
1923                 cmn_err(CE_CONT, "ill_capability_dld_ack: "
1924                     "unsupported DLD sub-capability (version %d, "
1925                     "expected %d)", dld_ic->dld_version,
1926                     DLD_CURRENT_VERSION);
1927                 return;
1928         }
1929         if (!dlcapabcheckqid(&dld_ic->dld_mid, ill->ill_lmod_rq)) {
1930                 ip1dbg(("ill_capability_dld_ack: mid token for dld "
1931                     "capability isn't as expected; pass-thru module(s) "
1932                     "detected, discarding capability\n"));
1933                 return;
1934         }
1935 
1936         /*
1937          * Copy locally to ensure alignment.
1938          */
1939         bcopy(dld_ic, &dld, sizeof (dl_capab_dld_t));
1940 
1941         if ((idc = ill->ill_dld_capab) == NULL) {
1942                 idc = kmem_zalloc(sizeof (ill_dld_capab_t), KM_NOSLEEP);
1943                 if (idc == NULL) {
1944                         cmn_err(CE_WARN, "ill_capability_dld_ack: "
1945                             "could not enable DLD version %d "
1946                             "for %s (ENOMEM)\n", DLD_CURRENT_VERSION,
1947                             ill->ill_name);
1948                         return;
1949                 }
1950                 ill->ill_dld_capab = idc;
1951         }
1952         idc->idc_capab_df = (ip_capab_func_t)dld.dld_capab;
1953         idc->idc_capab_dh = (void *)dld.dld_capab_handle;
1954         ip1dbg(("ill_capability_dld_ack: interface %s "
1955             "supports DLD version %d\n", ill->ill_name, DLD_CURRENT_VERSION));
1956 
1957         ill_capability_dld_enable(ill);
1958 }
1959 
1960 /*
1961  * Typically capability negotiation between IP and the driver happens via
1962  * DLPI message exchange. However GLD also offers a direct function call
1963  * mechanism to exchange the DLD_DIRECT_CAPAB and DLD_POLL_CAPAB capabilities,
1964  * But arbitrary function calls into IP or GLD are not permitted, since both
1965  * of them are protected by their own perimeter mechanism. The perimeter can
1966  * be viewed as a coarse lock or serialization mechanism. The hierarchy of
1967  * these perimeters is IP -> MAC. Thus for example to enable the squeue
1968  * polling, IP needs to enter its perimeter, then call ill_mac_perim_enter
1969  * to enter the mac perimeter and then do the direct function calls into
1970  * GLD to enable squeue polling. The ring related callbacks from the mac into
1971  * the stack to add, bind, quiesce, restart or cleanup a ring are all
1972  * protected by the mac perimeter.
1973  */
1974 static void
1975 ill_mac_perim_enter(ill_t *ill, mac_perim_handle_t *mphp)
1976 {
1977         ill_dld_capab_t         *idc = ill->ill_dld_capab;
1978         int                     err;
1979 
1980         err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mphp,
1981             DLD_ENABLE);
1982         ASSERT(err == 0);
1983 }
1984 
1985 static void
1986 ill_mac_perim_exit(ill_t *ill, mac_perim_handle_t mph)
1987 {
1988         ill_dld_capab_t         *idc = ill->ill_dld_capab;
1989         int                     err;
1990 
1991         err = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, mph,
1992             DLD_DISABLE);
1993         ASSERT(err == 0);
1994 }
1995 
1996 boolean_t
1997 ill_mac_perim_held(ill_t *ill)
1998 {
1999         ill_dld_capab_t         *idc = ill->ill_dld_capab;
2000 
2001         return (idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_PERIM, NULL,
2002             DLD_QUERY));
2003 }
2004 
2005 static void
2006 ill_capability_direct_enable(ill_t *ill)
2007 {
2008         ill_dld_capab_t         *idc = ill->ill_dld_capab;
2009         ill_dld_direct_t        *idd = &idc->idc_direct;
2010         dld_capab_direct_t      direct;
2011         int                     rc;
2012 
2013         ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2014 
2015         bzero(&direct, sizeof (direct));
2016         direct.di_rx_cf = (uintptr_t)ip_input;
2017         direct.di_rx_ch = ill;
2018 
2019         rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT, &direct,
2020             DLD_ENABLE);
2021         if (rc == 0) {
2022                 idd->idd_tx_df = (ip_dld_tx_t)direct.di_tx_df;
2023                 idd->idd_tx_dh = direct.di_tx_dh;
2024                 idd->idd_tx_cb_df = (ip_dld_callb_t)direct.di_tx_cb_df;
2025                 idd->idd_tx_cb_dh = direct.di_tx_cb_dh;
2026                 idd->idd_tx_fctl_df = (ip_dld_fctl_t)direct.di_tx_fctl_df;
2027                 idd->idd_tx_fctl_dh = direct.di_tx_fctl_dh;
2028                 ASSERT(idd->idd_tx_cb_df != NULL);
2029                 ASSERT(idd->idd_tx_fctl_df != NULL);
2030                 ASSERT(idd->idd_tx_df != NULL);
2031                 /*
2032                  * One time registration of flow enable callback function
2033                  */
2034                 ill->ill_flownotify_mh = idd->idd_tx_cb_df(idd->idd_tx_cb_dh,
2035                     ill_flow_enable, ill);
2036                 ill->ill_capabilities |= ILL_CAPAB_DLD_DIRECT;
2037                 DTRACE_PROBE1(direct_on, (ill_t *), ill);
2038         } else {
2039                 cmn_err(CE_WARN, "warning: could not enable DIRECT "
2040                     "capability, rc = %d\n", rc);
2041                 DTRACE_PROBE2(direct_off, (ill_t *), ill, (int), rc);
2042         }
2043 }
2044 
2045 static void
2046 ill_capability_poll_enable(ill_t *ill)
2047 {
2048         ill_dld_capab_t         *idc = ill->ill_dld_capab;
2049         dld_capab_poll_t        poll;
2050         int                     rc;
2051 
2052         ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2053 
2054         bzero(&poll, sizeof (poll));
2055         poll.poll_ring_add_cf = (uintptr_t)ip_squeue_add_ring;
2056         poll.poll_ring_remove_cf = (uintptr_t)ip_squeue_clean_ring;
2057         poll.poll_ring_quiesce_cf = (uintptr_t)ip_squeue_quiesce_ring;
2058         poll.poll_ring_restart_cf = (uintptr_t)ip_squeue_restart_ring;
2059         poll.poll_ring_bind_cf = (uintptr_t)ip_squeue_bind_ring;
2060         poll.poll_ring_ch = ill;
2061         rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL, &poll,
2062             DLD_ENABLE);
2063         if (rc == 0) {
2064                 ill->ill_capabilities |= ILL_CAPAB_DLD_POLL;
2065                 DTRACE_PROBE1(poll_on, (ill_t *), ill);
2066         } else {
2067                 ip1dbg(("warning: could not enable POLL "
2068                     "capability, rc = %d\n", rc));
2069                 DTRACE_PROBE2(poll_off, (ill_t *), ill, (int), rc);
2070         }
2071 }
2072 
2073 /*
2074  * Enable the LSO capability.
2075  */
2076 static void
2077 ill_capability_lso_enable(ill_t *ill)
2078 {
2079         ill_dld_capab_t *idc = ill->ill_dld_capab;
2080         dld_capab_lso_t lso;
2081         int rc;
2082 
2083         ASSERT(!ill->ill_isv6 && IAM_WRITER_ILL(ill));
2084 
2085         if (ill->ill_lso_capab == NULL) {
2086                 ill->ill_lso_capab = kmem_zalloc(sizeof (ill_lso_capab_t),
2087                     KM_NOSLEEP);
2088                 if (ill->ill_lso_capab == NULL) {
2089                         cmn_err(CE_WARN, "ill_capability_lso_enable: "
2090                             "could not enable LSO for %s (ENOMEM)\n",
2091                             ill->ill_name);
2092                         return;
2093                 }
2094         }
2095 
2096         bzero(&lso, sizeof (lso));
2097         if ((rc = idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO, &lso,
2098             DLD_ENABLE)) == 0) {
2099                 ill->ill_lso_capab->ill_lso_flags = lso.lso_flags;
2100                 ill->ill_lso_capab->ill_lso_max = lso.lso_max;
2101                 ill->ill_capabilities |= ILL_CAPAB_LSO;
2102                 ip1dbg(("ill_capability_lso_enable: interface %s "
2103                     "has enabled LSO\n ", ill->ill_name));
2104         } else {
2105                 kmem_free(ill->ill_lso_capab, sizeof (ill_lso_capab_t));
2106                 ill->ill_lso_capab = NULL;
2107                 DTRACE_PROBE2(lso_off, (ill_t *), ill, (int), rc);
2108         }
2109 }
2110 
2111 static void
2112 ill_capability_dld_enable(ill_t *ill)
2113 {
2114         mac_perim_handle_t mph;
2115 
2116         ASSERT(IAM_WRITER_ILL(ill));
2117 
2118         if (ill->ill_isv6)
2119                 return;
2120 
2121         ill_mac_perim_enter(ill, &mph);
2122         if (!ill->ill_isv6) {
2123                 ill_capability_direct_enable(ill);
2124                 ill_capability_poll_enable(ill);
2125                 ill_capability_lso_enable(ill);
2126         }
2127         ill->ill_capabilities |= ILL_CAPAB_DLD;
2128         ill_mac_perim_exit(ill, mph);
2129 }
2130 
2131 static void
2132 ill_capability_dld_disable(ill_t *ill)
2133 {
2134         ill_dld_capab_t *idc;
2135         ill_dld_direct_t *idd;
2136         mac_perim_handle_t      mph;
2137 
2138         ASSERT(IAM_WRITER_ILL(ill));
2139 
2140         if (!(ill->ill_capabilities & ILL_CAPAB_DLD))
2141                 return;
2142 
2143         ill_mac_perim_enter(ill, &mph);
2144 
2145         idc = ill->ill_dld_capab;
2146         if ((ill->ill_capabilities & ILL_CAPAB_DLD_DIRECT) != 0) {
2147                 /*
2148                  * For performance we avoid locks in the transmit data path
2149                  * and don't maintain a count of the number of threads using
2150                  * direct calls. Thus some threads could be using direct
2151                  * transmit calls to GLD, even after the capability mechanism
2152                  * turns it off. This is still safe since the handles used in
2153                  * the direct calls continue to be valid until the unplumb is
2154                  * completed. Remove the callback that was added (1-time) at
2155                  * capab enable time.
2156                  */
2157                 mutex_enter(&ill->ill_lock);
2158                 ill->ill_capabilities &= ~ILL_CAPAB_DLD_DIRECT;
2159                 mutex_exit(&ill->ill_lock);
2160                 if (ill->ill_flownotify_mh != NULL) {
2161                         idd = &idc->idc_direct;
2162                         idd->idd_tx_cb_df(idd->idd_tx_cb_dh, NULL,
2163                             ill->ill_flownotify_mh);
2164                         ill->ill_flownotify_mh = NULL;
2165                 }
2166                 (void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_DIRECT,
2167                     NULL, DLD_DISABLE);
2168         }
2169 
2170         if ((ill->ill_capabilities & ILL_CAPAB_DLD_POLL) != 0) {
2171                 ill->ill_capabilities &= ~ILL_CAPAB_DLD_POLL;
2172                 ip_squeue_clean_all(ill);
2173                 (void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_POLL,
2174                     NULL, DLD_DISABLE);
2175         }
2176 
2177         if ((ill->ill_capabilities & ILL_CAPAB_LSO) != 0) {
2178                 ASSERT(ill->ill_lso_capab != NULL);
2179                 /*
2180                  * Clear the capability flag for LSO but retain the
2181                  * ill_lso_capab structure since it's possible that another
2182                  * thread is still referring to it.  The structure only gets
2183                  * deallocated when we destroy the ill.
2184                  */
2185 
2186                 ill->ill_capabilities &= ~ILL_CAPAB_LSO;
2187                 (void) idc->idc_capab_df(idc->idc_capab_dh, DLD_CAPAB_LSO,
2188                     NULL, DLD_DISABLE);
2189         }
2190 
2191         ill->ill_capabilities &= ~ILL_CAPAB_DLD;
2192         ill_mac_perim_exit(ill, mph);
2193 }
2194 
2195 /*
2196  * Capability Negotiation protocol
2197  *
2198  * We don't wait for DLPI capability operations to finish during interface
2199  * bringup or teardown. Doing so would introduce more asynchrony and the
2200  * interface up/down operations will need multiple return and restarts.
2201  * Instead the 'ipsq_current_ipif' of the ipsq is not cleared as long as
2202  * the 'ill_dlpi_deferred' chain is non-empty. This ensures that the next
2203  * exclusive operation won't start until the DLPI operations of the previous
2204  * exclusive operation complete.
2205  *
2206  * The capability state machine is shown below.
2207  *
2208  * state                next state              event, action
2209  *
2210  * IDCS_UNKNOWN         IDCS_PROBE_SENT         ill_capability_probe
2211  * IDCS_PROBE_SENT      IDCS_OK                 ill_capability_ack
2212  * IDCS_PROBE_SENT      IDCS_FAILED             ip_rput_dlpi_writer (nack)
2213  * IDCS_OK              IDCS_RENEG              Receipt of DL_NOTE_CAPAB_RENEG
2214  * IDCS_OK              IDCS_RESET_SENT         ill_capability_reset
2215  * IDCS_RESET_SENT      IDCS_UNKNOWN            ill_capability_ack_thr
2216  * IDCS_RENEG           IDCS_PROBE_SENT         ill_capability_ack_thr ->
2217  *                                                  ill_capability_probe.
2218  */
2219 
2220 /*
2221  * Dedicated thread started from ip_stack_init that handles capability
2222  * disable. This thread ensures the taskq dispatch does not fail by waiting
2223  * for resources using TQ_SLEEP. The taskq mechanism is used to ensure
2224  * that direct calls to DLD are done in a cv_waitable context.
2225  */
2226 void
2227 ill_taskq_dispatch(ip_stack_t *ipst)
2228 {
2229         callb_cpr_t cprinfo;
2230         char    name[64];
2231         mblk_t  *mp;
2232 
2233         (void) snprintf(name, sizeof (name), "ill_taskq_dispatch_%d",
2234             ipst->ips_netstack->netstack_stackid);
2235         CALLB_CPR_INIT(&cprinfo, &ipst->ips_capab_taskq_lock, callb_generic_cpr,
2236             name);
2237         mutex_enter(&ipst->ips_capab_taskq_lock);
2238 
2239         for (;;) {
2240                 mp = ipst->ips_capab_taskq_head;
2241                 while (mp != NULL) {
2242                         ipst->ips_capab_taskq_head = mp->b_next;
2243                         if (ipst->ips_capab_taskq_head == NULL)
2244                                 ipst->ips_capab_taskq_tail = NULL;
2245                         mutex_exit(&ipst->ips_capab_taskq_lock);
2246                         mp->b_next = NULL;
2247 
2248                         VERIFY(taskq_dispatch(system_taskq,
2249                             ill_capability_ack_thr, mp, TQ_SLEEP) != 0);
2250                         mutex_enter(&ipst->ips_capab_taskq_lock);
2251                         mp = ipst->ips_capab_taskq_head;
2252                 }
2253 
2254                 if (ipst->ips_capab_taskq_quit)
2255                         break;
2256                 CALLB_CPR_SAFE_BEGIN(&cprinfo);
2257                 cv_wait(&ipst->ips_capab_taskq_cv, &ipst->ips_capab_taskq_lock);
2258                 CALLB_CPR_SAFE_END(&cprinfo, &ipst->ips_capab_taskq_lock);
2259         }
2260         VERIFY(ipst->ips_capab_taskq_head == NULL);
2261         VERIFY(ipst->ips_capab_taskq_tail == NULL);
2262         CALLB_CPR_EXIT(&cprinfo);
2263         thread_exit();
2264 }
2265 
2266 /*
2267  * Consume a new-style hardware capabilities negotiation ack.
2268  * Called via taskq on receipt of DL_CAPABILITY_ACK.
2269  */
2270 static void
2271 ill_capability_ack_thr(void *arg)
2272 {
2273         mblk_t  *mp = arg;
2274         dl_capability_ack_t *capp;
2275         dl_capability_sub_t *subp, *endp;
2276         ill_t   *ill;
2277         boolean_t reneg;
2278 
2279         ill = (ill_t *)mp->b_prev;
2280         mp->b_prev = NULL;
2281 
2282         VERIFY(ipsq_enter(ill, B_FALSE, CUR_OP) == B_TRUE);
2283 
2284         if (ill->ill_dlpi_capab_state == IDCS_RESET_SENT ||
2285             ill->ill_dlpi_capab_state == IDCS_RENEG) {
2286                 /*
2287                  * We have received the ack for our DL_CAPAB reset request.
2288                  * There isnt' anything in the message that needs processing.
2289                  * All message based capabilities have been disabled, now
2290                  * do the function call based capability disable.
2291                  */
2292                 reneg = ill->ill_dlpi_capab_state == IDCS_RENEG;
2293                 ill_capability_dld_disable(ill);
2294                 ill->ill_dlpi_capab_state = IDCS_UNKNOWN;
2295                 if (reneg)
2296                         ill_capability_probe(ill);
2297                 goto done;
2298         }
2299 
2300         if (ill->ill_dlpi_capab_state == IDCS_PROBE_SENT)
2301                 ill->ill_dlpi_capab_state = IDCS_OK;
2302 
2303         capp = (dl_capability_ack_t *)mp->b_rptr;
2304 
2305         if (capp->dl_sub_length == 0) {
2306                 /* no new-style capabilities */
2307                 goto done;
2308         }
2309 
2310         /* make sure the driver supplied correct dl_sub_length */
2311         if ((sizeof (*capp) + capp->dl_sub_length) > MBLKL(mp)) {
2312                 ip0dbg(("ill_capability_ack: bad DL_CAPABILITY_ACK, "
2313                     "invalid dl_sub_length (%d)\n", capp->dl_sub_length));
2314                 goto done;
2315         }
2316 
2317 #define SC(base, offset) (dl_capability_sub_t *)(((uchar_t *)(base))+(offset))
2318         /*
2319          * There are sub-capabilities. Process the ones we know about.
2320          * Loop until we don't have room for another sub-cap header..
2321          */
2322         for (subp = SC(capp, capp->dl_sub_offset),
2323             endp = SC(subp, capp->dl_sub_length - sizeof (*subp));
2324             subp <= endp;
2325             subp = SC(subp, sizeof (dl_capability_sub_t) + subp->dl_length)) {
2326 
2327                 switch (subp->dl_cap) {
2328                 case DL_CAPAB_ID_WRAPPER:
2329                         ill_capability_id_ack(ill, mp, subp);
2330                         break;
2331                 default:
2332                         ill_capability_dispatch(ill, mp, subp);
2333                         break;
2334                 }
2335         }
2336 #undef SC
2337 done:
2338         inet_freemsg(mp);
2339         ill_capability_done(ill);
2340         ipsq_exit(ill->ill_phyint->phyint_ipsq);
2341 }
2342 
2343 /*
2344  * This needs to be started in a taskq thread to provide a cv_waitable
2345  * context.
2346  */
2347 void
2348 ill_capability_ack(ill_t *ill, mblk_t *mp)
2349 {
2350         ip_stack_t      *ipst = ill->ill_ipst;
2351 
2352         mp->b_prev = (mblk_t *)ill;
2353         ASSERT(mp->b_next == NULL);
2354 
2355         if (taskq_dispatch(system_taskq, ill_capability_ack_thr, mp,
2356             TQ_NOSLEEP) != 0)
2357                 return;
2358 
2359         /*
2360          * The taskq dispatch failed. Signal the ill_taskq_dispatch thread
2361          * which will do the dispatch using TQ_SLEEP to guarantee success.
2362          */
2363         mutex_enter(&ipst->ips_capab_taskq_lock);
2364         if (ipst->ips_capab_taskq_head == NULL) {
2365                 ASSERT(ipst->ips_capab_taskq_tail == NULL);
2366                 ipst->ips_capab_taskq_head = mp;
2367         } else {
2368                 ipst->ips_capab_taskq_tail->b_next = mp;
2369         }
2370         ipst->ips_capab_taskq_tail = mp;
2371 
2372         cv_signal(&ipst->ips_capab_taskq_cv);
2373         mutex_exit(&ipst->ips_capab_taskq_lock);
2374 }
2375 
2376 /*
2377  * This routine is called to scan the fragmentation reassembly table for
2378  * the specified ILL for any packets that are starting to smell.
2379  * dead_interval is the maximum time in seconds that will be tolerated.  It
2380  * will either be the value specified in ip_g_frag_timeout, or zero if the
2381  * ILL is shutting down and it is time to blow everything off.
2382  *
2383  * It returns the number of seconds (as a time_t) that the next frag timer
2384  * should be scheduled for, 0 meaning that the timer doesn't need to be
2385  * re-started.  Note that the method of calculating next_timeout isn't
2386  * entirely accurate since time will flow between the time we grab
2387  * current_time and the time we schedule the next timeout.  This isn't a
2388  * big problem since this is the timer for sending an ICMP reassembly time
2389  * exceeded messages, and it doesn't have to be exactly accurate.
2390  *
2391  * This function is
2392  * sometimes called as writer, although this is not required.
2393  */
2394 time_t
2395 ill_frag_timeout(ill_t *ill, time_t dead_interval)
2396 {
2397         ipfb_t  *ipfb;
2398         ipfb_t  *endp;
2399         ipf_t   *ipf;
2400         ipf_t   *ipfnext;
2401         mblk_t  *mp;
2402         time_t  current_time = gethrestime_sec();
2403         time_t  next_timeout = 0;
2404         uint32_t        hdr_length;
2405         mblk_t  *send_icmp_head;
2406         mblk_t  *send_icmp_head_v6;
2407         ip_stack_t *ipst = ill->ill_ipst;
2408         ip_recv_attr_t iras;
2409 
2410         bzero(&iras, sizeof (iras));
2411         iras.ira_flags = 0;
2412         iras.ira_ill = iras.ira_rill = ill;
2413         iras.ira_ruifindex = ill->ill_phyint->phyint_ifindex;
2414         iras.ira_rifindex = iras.ira_ruifindex;
2415 
2416         ipfb = ill->ill_frag_hash_tbl;
2417         if (ipfb == NULL)
2418                 return (B_FALSE);
2419         endp = &ipfb[ILL_FRAG_HASH_TBL_COUNT];
2420         /* Walk the frag hash table. */
2421         for (; ipfb < endp; ipfb++) {
2422                 send_icmp_head = NULL;
2423                 send_icmp_head_v6 = NULL;
2424                 mutex_enter(&ipfb->ipfb_lock);
2425                 while ((ipf = ipfb->ipfb_ipf) != 0) {
2426                         time_t frag_time = current_time - ipf->ipf_timestamp;
2427                         time_t frag_timeout;
2428 
2429                         if (frag_time < dead_interval) {
2430                                 /*
2431                                  * There are some outstanding fragments
2432                                  * that will timeout later.  Make note of
2433                                  * the time so that we can reschedule the
2434                                  * next timeout appropriately.
2435                                  */
2436                                 frag_timeout = dead_interval - frag_time;
2437                                 if (next_timeout == 0 ||
2438                                     frag_timeout < next_timeout) {
2439                                         next_timeout = frag_timeout;
2440                                 }
2441                                 break;
2442                         }
2443                         /* Time's up.  Get it out of here. */
2444                         hdr_length = ipf->ipf_nf_hdr_len;
2445                         ipfnext = ipf->ipf_hash_next;
2446                         if (ipfnext)
2447                                 ipfnext->ipf_ptphn = ipf->ipf_ptphn;
2448                         *ipf->ipf_ptphn = ipfnext;
2449                         mp = ipf->ipf_mp->b_cont;
2450                         for (; mp; mp = mp->b_cont) {
2451                                 /* Extra points for neatness. */
2452                                 IP_REASS_SET_START(mp, 0);
2453                                 IP_REASS_SET_END(mp, 0);
2454                         }
2455                         mp = ipf->ipf_mp->b_cont;
2456                         atomic_add_32(&ill->ill_frag_count, -ipf->ipf_count);
2457                         ASSERT(ipfb->ipfb_count >= ipf->ipf_count);
2458                         ipfb->ipfb_count -= ipf->ipf_count;
2459                         ASSERT(ipfb->ipfb_frag_pkts > 0);
2460                         ipfb->ipfb_frag_pkts--;
2461                         /*
2462                          * We do not send any icmp message from here because
2463                          * we currently are holding the ipfb_lock for this
2464                          * hash chain. If we try and send any icmp messages
2465                          * from here we may end up via a put back into ip
2466                          * trying to get the same lock, causing a recursive
2467                          * mutex panic. Instead we build a list and send all
2468                          * the icmp messages after we have dropped the lock.
2469                          */
2470                         if (ill->ill_isv6) {
2471                                 if (hdr_length != 0) {
2472                                         mp->b_next = send_icmp_head_v6;
2473                                         send_icmp_head_v6 = mp;
2474                                 } else {
2475                                         freemsg(mp);
2476                                 }
2477                         } else {
2478                                 if (hdr_length != 0) {
2479                                         mp->b_next = send_icmp_head;
2480                                         send_icmp_head = mp;
2481                                 } else {
2482                                         freemsg(mp);
2483                                 }
2484                         }
2485                         BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2486                         ip_drop_input("ipIfStatsReasmFails", ipf->ipf_mp, ill);
2487                         freeb(ipf->ipf_mp);
2488                 }
2489                 mutex_exit(&ipfb->ipfb_lock);
2490                 /*
2491                  * Now need to send any icmp messages that we delayed from
2492                  * above.
2493                  */
2494                 while (send_icmp_head_v6 != NULL) {
2495                         ip6_t *ip6h;
2496 
2497                         mp = send_icmp_head_v6;
2498                         send_icmp_head_v6 = send_icmp_head_v6->b_next;
2499                         mp->b_next = NULL;
2500                         ip6h = (ip6_t *)mp->b_rptr;
2501                         iras.ira_flags = 0;
2502                         /*
2503                          * This will result in an incorrect ALL_ZONES zoneid
2504                          * for multicast packets, but we
2505                          * don't send ICMP errors for those in any case.
2506                          */
2507                         iras.ira_zoneid =
2508                             ipif_lookup_addr_zoneid_v6(&ip6h->ip6_dst,
2509                             ill, ipst);
2510                         ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2511                         icmp_time_exceeded_v6(mp,
2512                             ICMP_REASSEMBLY_TIME_EXCEEDED, B_FALSE,
2513                             &iras);
2514                         ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2515                 }
2516                 while (send_icmp_head != NULL) {
2517                         ipaddr_t dst;
2518 
2519                         mp = send_icmp_head;
2520                         send_icmp_head = send_icmp_head->b_next;
2521                         mp->b_next = NULL;
2522 
2523                         dst = ((ipha_t *)mp->b_rptr)->ipha_dst;
2524 
2525                         iras.ira_flags = IRAF_IS_IPV4;
2526                         /*
2527                          * This will result in an incorrect ALL_ZONES zoneid
2528                          * for broadcast and multicast packets, but we
2529                          * don't send ICMP errors for those in any case.
2530                          */
2531                         iras.ira_zoneid = ipif_lookup_addr_zoneid(dst,
2532                             ill, ipst);
2533                         ip_drop_input("ICMP_TIME_EXCEEDED reass", mp, ill);
2534                         icmp_time_exceeded(mp,
2535                             ICMP_REASSEMBLY_TIME_EXCEEDED, &iras);
2536                         ASSERT(!(iras.ira_flags & IRAF_IPSEC_SECURE));
2537                 }
2538         }
2539         /*
2540          * A non-dying ILL will use the return value to decide whether to
2541          * restart the frag timer, and for how long.
2542          */
2543         return (next_timeout);
2544 }
2545 
2546 /*
2547  * This routine is called when the approximate count of mblk memory used
2548  * for the specified ILL has exceeded max_count.
2549  */
2550 void
2551 ill_frag_prune(ill_t *ill, uint_t max_count)
2552 {
2553         ipfb_t  *ipfb;
2554         ipf_t   *ipf;
2555         size_t  count;
2556         clock_t now;
2557 
2558         /*
2559          * If we are here within ip_min_frag_prune_time msecs remove
2560          * ill_frag_free_num_pkts oldest packets from each bucket and increment
2561          * ill_frag_free_num_pkts.
2562          */
2563         mutex_enter(&ill->ill_lock);
2564         now = ddi_get_lbolt();
2565         if (TICK_TO_MSEC(now - ill->ill_last_frag_clean_time) <=
2566             (ip_min_frag_prune_time != 0 ?
2567             ip_min_frag_prune_time : msec_per_tick)) {
2568 
2569                 ill->ill_frag_free_num_pkts++;
2570 
2571         } else {
2572                 ill->ill_frag_free_num_pkts = 0;
2573         }
2574         ill->ill_last_frag_clean_time = now;
2575         mutex_exit(&ill->ill_lock);
2576 
2577         /*
2578          * free ill_frag_free_num_pkts oldest packets from each bucket.
2579          */
2580         if (ill->ill_frag_free_num_pkts != 0) {
2581                 int ix;
2582 
2583                 for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2584                         ipfb = &ill->ill_frag_hash_tbl[ix];
2585                         mutex_enter(&ipfb->ipfb_lock);
2586                         if (ipfb->ipfb_ipf != NULL) {
2587                                 ill_frag_free_pkts(ill, ipfb, ipfb->ipfb_ipf,
2588                                     ill->ill_frag_free_num_pkts);
2589                         }
2590                         mutex_exit(&ipfb->ipfb_lock);
2591                 }
2592         }
2593         /*
2594          * While the reassembly list for this ILL is too big, prune a fragment
2595          * queue by age, oldest first.
2596          */
2597         while (ill->ill_frag_count > max_count) {
2598                 int     ix;
2599                 ipfb_t  *oipfb = NULL;
2600                 uint_t  oldest = UINT_MAX;
2601 
2602                 count = 0;
2603                 for (ix = 0; ix < ILL_FRAG_HASH_TBL_COUNT; ix++) {
2604                         ipfb = &ill->ill_frag_hash_tbl[ix];
2605                         mutex_enter(&ipfb->ipfb_lock);
2606                         ipf = ipfb->ipfb_ipf;
2607                         if (ipf != NULL && ipf->ipf_gen < oldest) {
2608                                 oldest = ipf->ipf_gen;
2609                                 oipfb = ipfb;
2610                         }
2611                         count += ipfb->ipfb_count;
2612                         mutex_exit(&ipfb->ipfb_lock);
2613                 }
2614                 if (oipfb == NULL)
2615                         break;
2616 
2617                 if (count <= max_count)
2618                         return; /* Somebody beat us to it, nothing to do */
2619                 mutex_enter(&oipfb->ipfb_lock);
2620                 ipf = oipfb->ipfb_ipf;
2621                 if (ipf != NULL) {
2622                         ill_frag_free_pkts(ill, oipfb, ipf, 1);
2623                 }
2624                 mutex_exit(&oipfb->ipfb_lock);
2625         }
2626 }
2627 
2628 /*
2629  * free 'free_cnt' fragmented packets starting at ipf.
2630  */
2631 void
2632 ill_frag_free_pkts(ill_t *ill, ipfb_t *ipfb, ipf_t *ipf, int free_cnt)
2633 {
2634         size_t  count;
2635         mblk_t  *mp;
2636         mblk_t  *tmp;
2637         ipf_t **ipfp = ipf->ipf_ptphn;
2638 
2639         ASSERT(MUTEX_HELD(&ipfb->ipfb_lock));
2640         ASSERT(ipfp != NULL);
2641         ASSERT(ipf != NULL);
2642 
2643         while (ipf != NULL && free_cnt-- > 0) {
2644                 count = ipf->ipf_count;
2645                 mp = ipf->ipf_mp;
2646                 ipf = ipf->ipf_hash_next;
2647                 for (tmp = mp; tmp; tmp = tmp->b_cont) {
2648                         IP_REASS_SET_START(tmp, 0);
2649                         IP_REASS_SET_END(tmp, 0);
2650                 }
2651                 atomic_add_32(&ill->ill_frag_count, -count);
2652                 ASSERT(ipfb->ipfb_count >= count);
2653                 ipfb->ipfb_count -= count;
2654                 ASSERT(ipfb->ipfb_frag_pkts > 0);
2655                 ipfb->ipfb_frag_pkts--;
2656                 BUMP_MIB(ill->ill_ip_mib, ipIfStatsReasmFails);
2657                 ip_drop_input("ipIfStatsReasmFails", mp, ill);
2658                 freemsg(mp);
2659         }
2660 
2661         if (ipf)
2662                 ipf->ipf_ptphn = ipfp;
2663         ipfp[0] = ipf;
2664 }
2665 
2666 /*
2667  * Helper function for ill_forward_set().
2668  */
2669 static void
2670 ill_forward_set_on_ill(ill_t *ill, boolean_t enable)
2671 {
2672         ip_stack_t      *ipst = ill->ill_ipst;
2673 
2674         ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2675 
2676         ip1dbg(("ill_forward_set: %s %s forwarding on %s",
2677             (enable ? "Enabling" : "Disabling"),
2678             (ill->ill_isv6 ? "IPv6" : "IPv4"), ill->ill_name));
2679         mutex_enter(&ill->ill_lock);
2680         if (enable)
2681                 ill->ill_flags |= ILLF_ROUTER;
2682         else
2683                 ill->ill_flags &= ~ILLF_ROUTER;
2684         mutex_exit(&ill->ill_lock);
2685         if (ill->ill_isv6)
2686                 ill_set_nce_router_flags(ill, enable);
2687         /* Notify routing socket listeners of this change. */
2688         if (ill->ill_ipif != NULL)
2689                 ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
2690 }
2691 
2692 /*
2693  * Set an ill's ILLF_ROUTER flag appropriately.  Send up RTS_IFINFO routing
2694  * socket messages for each interface whose flags we change.
2695  */
2696 int
2697 ill_forward_set(ill_t *ill, boolean_t enable)
2698 {
2699         ipmp_illgrp_t *illg;
2700         ip_stack_t *ipst = ill->ill_ipst;
2701 
2702         ASSERT(IAM_WRITER_ILL(ill) || RW_READ_HELD(&ipst->ips_ill_g_lock));
2703 
2704         if ((enable && (ill->ill_flags & ILLF_ROUTER)) ||
2705             (!enable && !(ill->ill_flags & ILLF_ROUTER)))
2706                 return (0);
2707 
2708         if (IS_LOOPBACK(ill))
2709                 return (EINVAL);
2710 
2711         if (enable && ill->ill_allowed_ips_cnt > 0)
2712                 return (EPERM);
2713 
2714         if (IS_IPMP(ill) || IS_UNDER_IPMP(ill)) {
2715                 /*
2716                  * Update all of the interfaces in the group.
2717                  */
2718                 illg = ill->ill_grp;
2719                 ill = list_head(&illg->ig_if);
2720                 for (; ill != NULL; ill = list_next(&illg->ig_if, ill))
2721                         ill_forward_set_on_ill(ill, enable);
2722 
2723                 /*
2724                  * Update the IPMP meta-interface.
2725                  */
2726                 ill_forward_set_on_ill(ipmp_illgrp_ipmp_ill(illg), enable);
2727                 return (0);
2728         }
2729 
2730         ill_forward_set_on_ill(ill, enable);
2731         return (0);
2732 }
2733 
2734 /*
2735  * Based on the ILLF_ROUTER flag of an ill, make sure all local nce's for
2736  * addresses assigned to the ill have the NCE_F_ISROUTER flag appropriately
2737  * set or clear.
2738  */
2739 static void
2740 ill_set_nce_router_flags(ill_t *ill, boolean_t enable)
2741 {
2742         ipif_t *ipif;
2743         ncec_t *ncec;
2744         nce_t *nce;
2745 
2746         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
2747                 /*
2748                  * NOTE: we match across the illgrp because nce's for
2749                  * addresses on IPMP interfaces have an nce_ill that points to
2750                  * the bound underlying ill.
2751                  */
2752                 nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
2753                 if (nce != NULL) {
2754                         ncec = nce->nce_common;
2755                         mutex_enter(&ncec->ncec_lock);
2756                         if (enable)
2757                                 ncec->ncec_flags |= NCE_F_ISROUTER;
2758                         else
2759                                 ncec->ncec_flags &= ~NCE_F_ISROUTER;
2760                         mutex_exit(&ncec->ncec_lock);
2761                         nce_refrele(nce);
2762                 }
2763         }
2764 }
2765 
2766 /*
2767  * Intializes the context structure and returns the first ill in the list
2768  * cuurently start_list and end_list can have values:
2769  * MAX_G_HEADS          Traverse both IPV4 and IPV6 lists.
2770  * IP_V4_G_HEAD         Traverse IPV4 list only.
2771  * IP_V6_G_HEAD         Traverse IPV6 list only.
2772  */
2773 
2774 /*
2775  * We don't check for CONDEMNED ills here. Caller must do that if
2776  * necessary under the ill lock.
2777  */
2778 ill_t *
2779 ill_first(int start_list, int end_list, ill_walk_context_t *ctx,
2780     ip_stack_t *ipst)
2781 {
2782         ill_if_t *ifp;
2783         ill_t *ill;
2784         avl_tree_t *avl_tree;
2785 
2786         ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
2787         ASSERT(end_list <= MAX_G_HEADS && start_list >= 0);
2788 
2789         /*
2790          * setup the lists to search
2791          */
2792         if (end_list != MAX_G_HEADS) {
2793                 ctx->ctx_current_list = start_list;
2794                 ctx->ctx_last_list = end_list;
2795         } else {
2796                 ctx->ctx_last_list = MAX_G_HEADS - 1;
2797                 ctx->ctx_current_list = 0;
2798         }
2799 
2800         while (ctx->ctx_current_list <= ctx->ctx_last_list) {
2801                 ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2802                 if (ifp != (ill_if_t *)
2803                     &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2804                         avl_tree = &ifp->illif_avl_by_ppa;
2805                         ill = avl_first(avl_tree);
2806                         /*
2807                          * ill is guaranteed to be non NULL or ifp should have
2808                          * not existed.
2809                          */
2810                         ASSERT(ill != NULL);
2811                         return (ill);
2812                 }
2813                 ctx->ctx_current_list++;
2814         }
2815 
2816         return (NULL);
2817 }
2818 
2819 /*
2820  * returns the next ill in the list. ill_first() must have been called
2821  * before calling ill_next() or bad things will happen.
2822  */
2823 
2824 /*
2825  * We don't check for CONDEMNED ills here. Caller must do that if
2826  * necessary under the ill lock.
2827  */
2828 ill_t *
2829 ill_next(ill_walk_context_t *ctx, ill_t *lastill)
2830 {
2831         ill_if_t *ifp;
2832         ill_t *ill;
2833         ip_stack_t      *ipst = lastill->ill_ipst;
2834 
2835         ASSERT(lastill->ill_ifptr != (ill_if_t *)
2836             &IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst));
2837         if ((ill = avl_walk(&lastill->ill_ifptr->illif_avl_by_ppa, lastill,
2838             AVL_AFTER)) != NULL) {
2839                 return (ill);
2840         }
2841 
2842         /* goto next ill_ifp in the list. */
2843         ifp = lastill->ill_ifptr->illif_next;
2844 
2845         /* make sure not at end of circular list */
2846         while (ifp ==
2847             (ill_if_t *)&IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst)) {
2848                 if (++ctx->ctx_current_list > ctx->ctx_last_list)
2849                         return (NULL);
2850                 ifp = IP_VX_ILL_G_LIST(ctx->ctx_current_list, ipst);
2851         }
2852 
2853         return (avl_first(&ifp->illif_avl_by_ppa));
2854 }
2855 
2856 /*
2857  * Check interface name for correct format: [a-zA-Z]+[a-zA-Z0-9._]*[0-9]+
2858  * The final number (PPA) must not have any leading zeros.  Upon success, a
2859  * pointer to the start of the PPA is returned; otherwise NULL is returned.
2860  */
2861 static char *
2862 ill_get_ppa_ptr(char *name)
2863 {
2864         int namelen = strlen(name);
2865         int end_ndx = namelen - 1;
2866         int ppa_ndx, i;
2867 
2868         /*
2869          * Check that the first character is [a-zA-Z], and that the last
2870          * character is [0-9].
2871          */
2872         if (namelen == 0 || !isalpha(name[0]) || !isdigit(name[end_ndx]))
2873                 return (NULL);
2874 
2875         /*
2876          * Set `ppa_ndx' to the PPA start, and check for leading zeroes.
2877          */
2878         for (ppa_ndx = end_ndx; ppa_ndx > 0; ppa_ndx--)
2879                 if (!isdigit(name[ppa_ndx - 1]))
2880                         break;
2881 
2882         if (name[ppa_ndx] == '0' && ppa_ndx < end_ndx)
2883                 return (NULL);
2884 
2885         /*
2886          * Check that the intermediate characters are [a-z0-9.]
2887          */
2888         for (i = 1; i < ppa_ndx; i++) {
2889                 if (!isalpha(name[i]) && !isdigit(name[i]) &&
2890                     name[i] != '.' && name[i] != '_') {
2891                         return (NULL);
2892                 }
2893         }
2894 
2895         return (name + ppa_ndx);
2896 }
2897 
2898 /*
2899  * use avl tree to locate the ill.
2900  */
2901 static ill_t *
2902 ill_find_by_name(char *name, boolean_t isv6, ip_stack_t *ipst)
2903 {
2904         char *ppa_ptr = NULL;
2905         int len;
2906         uint_t ppa;
2907         ill_t *ill = NULL;
2908         ill_if_t *ifp;
2909         int list;
2910 
2911         /*
2912          * get ppa ptr
2913          */
2914         if (isv6)
2915                 list = IP_V6_G_HEAD;
2916         else
2917                 list = IP_V4_G_HEAD;
2918 
2919         if ((ppa_ptr = ill_get_ppa_ptr(name)) == NULL) {
2920                 return (NULL);
2921         }
2922 
2923         len = ppa_ptr - name + 1;
2924 
2925         ppa = stoi(&ppa_ptr);
2926 
2927         ifp = IP_VX_ILL_G_LIST(list, ipst);
2928 
2929         while (ifp != (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2930                 /*
2931                  * match is done on len - 1 as the name is not null
2932                  * terminated it contains ppa in addition to the interface
2933                  * name.
2934                  */
2935                 if ((ifp->illif_name_len == len) &&
2936                     bcmp(ifp->illif_name, name, len - 1) == 0) {
2937                         break;
2938                 } else {
2939                         ifp = ifp->illif_next;
2940                 }
2941         }
2942 
2943         if (ifp == (ill_if_t *)&IP_VX_ILL_G_LIST(list, ipst)) {
2944                 /*
2945                  * Even the interface type does not exist.
2946                  */
2947                 return (NULL);
2948         }
2949 
2950         ill = avl_find(&ifp->illif_avl_by_ppa, (void *) &ppa, NULL);
2951         if (ill != NULL) {
2952                 mutex_enter(&ill->ill_lock);
2953                 if (ILL_CAN_LOOKUP(ill)) {
2954                         ill_refhold_locked(ill);
2955                         mutex_exit(&ill->ill_lock);
2956                         return (ill);
2957                 }
2958                 mutex_exit(&ill->ill_lock);
2959         }
2960         return (NULL);
2961 }
2962 
2963 /*
2964  * comparison function for use with avl.
2965  */
2966 static int
2967 ill_compare_ppa(const void *ppa_ptr, const void *ill_ptr)
2968 {
2969         uint_t ppa;
2970         uint_t ill_ppa;
2971 
2972         ASSERT(ppa_ptr != NULL && ill_ptr != NULL);
2973 
2974         ppa = *((uint_t *)ppa_ptr);
2975         ill_ppa = ((const ill_t *)ill_ptr)->ill_ppa;
2976         /*
2977          * We want the ill with the lowest ppa to be on the
2978          * top.
2979          */
2980         if (ill_ppa < ppa)
2981                 return (1);
2982         if (ill_ppa > ppa)
2983                 return (-1);
2984         return (0);
2985 }
2986 
2987 /*
2988  * remove an interface type from the global list.
2989  */
2990 static void
2991 ill_delete_interface_type(ill_if_t *interface)
2992 {
2993         ASSERT(interface != NULL);
2994         ASSERT(avl_numnodes(&interface->illif_avl_by_ppa) == 0);
2995 
2996         avl_destroy(&interface->illif_avl_by_ppa);
2997         if (interface->illif_ppa_arena != NULL)
2998                 vmem_destroy(interface->illif_ppa_arena);
2999 
3000         remque(interface);
3001 
3002         mi_free(interface);
3003 }
3004 
3005 /*
3006  * remove ill from the global list.
3007  */
3008 static void
3009 ill_glist_delete(ill_t *ill)
3010 {
3011         ip_stack_t      *ipst;
3012         phyint_t        *phyi;
3013 
3014         if (ill == NULL)
3015                 return;
3016         ipst = ill->ill_ipst;
3017         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3018 
3019         /*
3020          * If the ill was never inserted into the AVL tree
3021          * we skip the if branch.
3022          */
3023         if (ill->ill_ifptr != NULL) {
3024                 /*
3025                  * remove from AVL tree and free ppa number
3026                  */
3027                 avl_remove(&ill->ill_ifptr->illif_avl_by_ppa, ill);
3028 
3029                 if (ill->ill_ifptr->illif_ppa_arena != NULL) {
3030                         vmem_free(ill->ill_ifptr->illif_ppa_arena,
3031                             (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3032                 }
3033                 if (avl_numnodes(&ill->ill_ifptr->illif_avl_by_ppa) == 0) {
3034                         ill_delete_interface_type(ill->ill_ifptr);
3035                 }
3036 
3037                 /*
3038                  * Indicate ill is no longer in the list.
3039                  */
3040                 ill->ill_ifptr = NULL;
3041                 ill->ill_name_length = 0;
3042                 ill->ill_name[0] = '\0';
3043                 ill->ill_ppa = UINT_MAX;
3044         }
3045 
3046         /* Generate one last event for this ill. */
3047         ill_nic_event_dispatch(ill, 0, NE_UNPLUMB, ill->ill_name,
3048             ill->ill_name_length);
3049 
3050         ASSERT(ill->ill_phyint != NULL);
3051         phyi = ill->ill_phyint;
3052         ill->ill_phyint = NULL;
3053 
3054         /*
3055          * ill_init allocates a phyint always to store the copy
3056          * of flags relevant to phyint. At that point in time, we could
3057          * not assign the name and hence phyint_illv4/v6 could not be
3058          * initialized. Later in ipif_set_values, we assign the name to
3059          * the ill, at which point in time we assign phyint_illv4/v6.
3060          * Thus we don't rely on phyint_illv6 to be initialized always.
3061          */
3062         if (ill->ill_flags & ILLF_IPV6)
3063                 phyi->phyint_illv6 = NULL;
3064         else
3065                 phyi->phyint_illv4 = NULL;
3066 
3067         if (phyi->phyint_illv4 != NULL || phyi->phyint_illv6 != NULL) {
3068                 rw_exit(&ipst->ips_ill_g_lock);
3069                 return;
3070         }
3071 
3072         /*
3073          * There are no ills left on this phyint; pull it out of the phyint
3074          * avl trees, and free it.
3075          */
3076         if (phyi->phyint_ifindex > 0) {
3077                 avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3078                     phyi);
3079                 avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
3080                     phyi);
3081         }
3082         rw_exit(&ipst->ips_ill_g_lock);
3083 
3084         phyint_free(phyi);
3085 }
3086 
3087 /*
3088  * allocate a ppa, if the number of plumbed interfaces of this type are
3089  * less than ill_no_arena do a linear search to find a unused ppa.
3090  * When the number goes beyond ill_no_arena switch to using an arena.
3091  * Note: ppa value of zero cannot be allocated from vmem_arena as it
3092  * is the return value for an error condition, so allocation starts at one
3093  * and is decremented by one.
3094  */
3095 static int
3096 ill_alloc_ppa(ill_if_t *ifp, ill_t *ill)
3097 {
3098         ill_t *tmp_ill;
3099         uint_t start, end;
3100         int ppa;
3101 
3102         if (ifp->illif_ppa_arena == NULL &&
3103             (avl_numnodes(&ifp->illif_avl_by_ppa) + 1 > ill_no_arena)) {
3104                 /*
3105                  * Create an arena.
3106                  */
3107                 ifp->illif_ppa_arena = vmem_create(ifp->illif_name,
3108                     (void *)1, UINT_MAX - 1, 1, NULL, NULL,
3109                     NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
3110                         /* allocate what has already been assigned */
3111                 for (tmp_ill = avl_first(&ifp->illif_avl_by_ppa);
3112                     tmp_ill != NULL; tmp_ill = avl_walk(&ifp->illif_avl_by_ppa,
3113                     tmp_ill, AVL_AFTER)) {
3114                         ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3115                             1,          /* size */
3116                             1,          /* align/quantum */
3117                             0,          /* phase */
3118                             0,          /* nocross */
3119                             /* minaddr */
3120                             (void *)((uintptr_t)tmp_ill->ill_ppa + 1),
3121                             /* maxaddr */
3122                             (void *)((uintptr_t)tmp_ill->ill_ppa + 2),
3123                             VM_NOSLEEP|VM_FIRSTFIT);
3124                         if (ppa == 0) {
3125                                 ip1dbg(("ill_alloc_ppa: ppa allocation"
3126                                     " failed while switching"));
3127                                 vmem_destroy(ifp->illif_ppa_arena);
3128                                 ifp->illif_ppa_arena = NULL;
3129                                 break;
3130                         }
3131                 }
3132         }
3133 
3134         if (ifp->illif_ppa_arena != NULL) {
3135                 if (ill->ill_ppa == UINT_MAX) {
3136                         ppa = (int)(uintptr_t)vmem_alloc(ifp->illif_ppa_arena,
3137                             1, VM_NOSLEEP|VM_FIRSTFIT);
3138                         if (ppa == 0)
3139                                 return (EAGAIN);
3140                         ill->ill_ppa = --ppa;
3141                 } else {
3142                         ppa = (int)(uintptr_t)vmem_xalloc(ifp->illif_ppa_arena,
3143                             1,          /* size */
3144                             1,          /* align/quantum */
3145                             0,          /* phase */
3146                             0,          /* nocross */
3147                             (void *)(uintptr_t)(ill->ill_ppa + 1), /* minaddr */
3148                             (void *)(uintptr_t)(ill->ill_ppa + 2), /* maxaddr */
3149                             VM_NOSLEEP|VM_FIRSTFIT);
3150                         /*
3151                          * Most likely the allocation failed because
3152                          * the requested ppa was in use.
3153                          */
3154                         if (ppa == 0)
3155                                 return (EEXIST);
3156                 }
3157                 return (0);
3158         }
3159 
3160         /*
3161          * No arena is in use and not enough (>ill_no_arena) interfaces have
3162          * been plumbed to create one. Do a linear search to get a unused ppa.
3163          */
3164         if (ill->ill_ppa == UINT_MAX) {
3165                 end = UINT_MAX - 1;
3166                 start = 0;
3167         } else {
3168                 end = start = ill->ill_ppa;
3169         }
3170 
3171         tmp_ill = avl_find(&ifp->illif_avl_by_ppa, (void *)&start, NULL);
3172         while (tmp_ill != NULL && tmp_ill->ill_ppa == start) {
3173                 if (start++ >= end) {
3174                         if (ill->ill_ppa == UINT_MAX)
3175                                 return (EAGAIN);
3176                         else
3177                                 return (EEXIST);
3178                 }
3179                 tmp_ill = avl_walk(&ifp->illif_avl_by_ppa, tmp_ill, AVL_AFTER);
3180         }
3181         ill->ill_ppa = start;
3182         return (0);
3183 }
3184 
3185 /*
3186  * Insert ill into the list of configured ill's. Once this function completes,
3187  * the ill is globally visible and is available through lookups. More precisely
3188  * this happens after the caller drops the ill_g_lock.
3189  */
3190 static int
3191 ill_glist_insert(ill_t *ill, char *name, boolean_t isv6)
3192 {
3193         ill_if_t *ill_interface;
3194         avl_index_t where = 0;
3195         int error;
3196         int name_length;
3197         int index;
3198         boolean_t check_length = B_FALSE;
3199         ip_stack_t      *ipst = ill->ill_ipst;
3200 
3201         ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
3202 
3203         name_length = mi_strlen(name) + 1;
3204 
3205         if (isv6)
3206                 index = IP_V6_G_HEAD;
3207         else
3208                 index = IP_V4_G_HEAD;
3209 
3210         ill_interface = IP_VX_ILL_G_LIST(index, ipst);
3211         /*
3212          * Search for interface type based on name
3213          */
3214         while (ill_interface != (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3215                 if ((ill_interface->illif_name_len == name_length) &&
3216                     (strcmp(ill_interface->illif_name, name) == 0)) {
3217                         break;
3218                 }
3219                 ill_interface = ill_interface->illif_next;
3220         }
3221 
3222         /*
3223          * Interface type not found, create one.
3224          */
3225         if (ill_interface == (ill_if_t *)&IP_VX_ILL_G_LIST(index, ipst)) {
3226                 ill_g_head_t ghead;
3227 
3228                 /*
3229                  * allocate ill_if_t structure
3230                  */
3231                 ill_interface = (ill_if_t *)mi_zalloc(sizeof (ill_if_t));
3232                 if (ill_interface == NULL) {
3233                         return (ENOMEM);
3234                 }
3235 
3236                 (void) strcpy(ill_interface->illif_name, name);
3237                 ill_interface->illif_name_len = name_length;
3238 
3239                 avl_create(&ill_interface->illif_avl_by_ppa,
3240                     ill_compare_ppa, sizeof (ill_t),
3241                     offsetof(struct ill_s, ill_avl_byppa));
3242 
3243                 /*
3244                  * link the structure in the back to maintain order
3245                  * of configuration for ifconfig output.
3246                  */
3247                 ghead = ipst->ips_ill_g_heads[index];
3248                 insque(ill_interface, ghead.ill_g_list_tail);
3249         }
3250 
3251         if (ill->ill_ppa == UINT_MAX)
3252                 check_length = B_TRUE;
3253 
3254         error = ill_alloc_ppa(ill_interface, ill);
3255         if (error != 0) {
3256                 if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3257                         ill_delete_interface_type(ill->ill_ifptr);
3258                 return (error);
3259         }
3260 
3261         /*
3262          * When the ppa is choosen by the system, check that there is
3263          * enough space to insert ppa. if a specific ppa was passed in this
3264          * check is not required as the interface name passed in will have
3265          * the right ppa in it.
3266          */
3267         if (check_length) {
3268                 /*
3269                  * UINT_MAX - 1 should fit in 10 chars, alloc 12 chars.
3270                  */
3271                 char buf[sizeof (uint_t) * 3];
3272 
3273                 /*
3274                  * convert ppa to string to calculate the amount of space
3275                  * required for it in the name.
3276                  */
3277                 numtos(ill->ill_ppa, buf);
3278 
3279                 /* Do we have enough space to insert ppa ? */
3280 
3281                 if ((mi_strlen(name) + mi_strlen(buf) + 1) > LIFNAMSIZ) {
3282                         /* Free ppa and interface type struct */
3283                         if (ill_interface->illif_ppa_arena != NULL) {
3284                                 vmem_free(ill_interface->illif_ppa_arena,
3285                                     (void *)(uintptr_t)(ill->ill_ppa+1), 1);
3286                         }
3287                         if (avl_numnodes(&ill_interface->illif_avl_by_ppa) == 0)
3288                                 ill_delete_interface_type(ill->ill_ifptr);
3289 
3290                         return (EINVAL);
3291                 }
3292         }
3293 
3294         (void) sprintf(ill->ill_name, "%s%u", name, ill->ill_ppa);
3295         ill->ill_name_length = mi_strlen(ill->ill_name) + 1;
3296 
3297         (void) avl_find(&ill_interface->illif_avl_by_ppa, &ill->ill_ppa,
3298             &where);
3299         ill->ill_ifptr = ill_interface;
3300         avl_insert(&ill_interface->illif_avl_by_ppa, ill, where);
3301 
3302         ill_phyint_reinit(ill);
3303         return (0);
3304 }
3305 
3306 /* Initialize the per phyint ipsq used for serialization */
3307 static boolean_t
3308 ipsq_init(ill_t *ill, boolean_t enter)
3309 {
3310         ipsq_t  *ipsq;
3311         ipxop_t *ipx;
3312 
3313         if ((ipsq = kmem_zalloc(sizeof (ipsq_t), KM_NOSLEEP)) == NULL)
3314                 return (B_FALSE);
3315 
3316         ill->ill_phyint->phyint_ipsq = ipsq;
3317         ipx = ipsq->ipsq_xop = &ipsq->ipsq_ownxop;
3318         ipx->ipx_ipsq = ipsq;
3319         ipsq->ipsq_next = ipsq;
3320         ipsq->ipsq_phyint = ill->ill_phyint;
3321         mutex_init(&ipsq->ipsq_lock, NULL, MUTEX_DEFAULT, 0);
3322         mutex_init(&ipx->ipx_lock, NULL, MUTEX_DEFAULT, 0);
3323         ipsq->ipsq_ipst = ill->ill_ipst;  /* No netstack_hold */
3324         if (enter) {
3325                 ipx->ipx_writer = curthread;
3326                 ipx->ipx_forced = B_FALSE;
3327                 ipx->ipx_reentry_cnt = 1;
3328 #ifdef DEBUG
3329                 ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
3330 #endif
3331         }
3332         return (B_TRUE);
3333 }
3334 
3335 /*
3336  * Here we perform initialisation of the ill_t common to both regular
3337  * interface ILLs and the special loopback ILL created by ill_lookup_on_name.
3338  */
3339 static int
3340 ill_init_common(ill_t *ill, queue_t *q, boolean_t isv6, boolean_t is_loopback,
3341     boolean_t ipsq_enter)
3342 {
3343         int count;
3344         uchar_t *frag_ptr;
3345 
3346         mutex_init(&ill->ill_lock, NULL, MUTEX_DEFAULT, 0);
3347         mutex_init(&ill->ill_saved_ire_lock, NULL, MUTEX_DEFAULT, NULL);
3348         ill->ill_saved_ire_cnt = 0;
3349 
3350         if (is_loopback) {
3351                 ill->ill_max_frag = isv6 ? ip_loopback_mtu_v6plus :
3352                     ip_loopback_mtuplus;
3353                 /*
3354                  * No resolver here.
3355                  */
3356                 ill->ill_net_type = IRE_LOOPBACK;
3357         } else {
3358                 ill->ill_rq = q;
3359                 ill->ill_wq = WR(q);
3360                 ill->ill_ppa = UINT_MAX;
3361         }
3362 
3363         ill->ill_isv6 = isv6;
3364 
3365         /*
3366          * Allocate sufficient space to contain our fragment hash table and
3367          * the device name.
3368          */
3369         frag_ptr = (uchar_t *)mi_zalloc(ILL_FRAG_HASH_TBL_SIZE + 2 * LIFNAMSIZ);
3370         if (frag_ptr == NULL)
3371                 return (ENOMEM);
3372         ill->ill_frag_ptr = frag_ptr;
3373         ill->ill_frag_free_num_pkts = 0;
3374         ill->ill_last_frag_clean_time = 0;
3375         ill->ill_frag_hash_tbl = (ipfb_t *)frag_ptr;
3376         ill->ill_name = (char *)(frag_ptr + ILL_FRAG_HASH_TBL_SIZE);
3377         for (count = 0; count < ILL_FRAG_HASH_TBL_COUNT; count++) {
3378                 mutex_init(&ill->ill_frag_hash_tbl[count].ipfb_lock,
3379                     NULL, MUTEX_DEFAULT, NULL);
3380         }
3381 
3382         ill->ill_phyint = (phyint_t *)mi_zalloc(sizeof (phyint_t));
3383         if (ill->ill_phyint == NULL) {
3384                 mi_free(frag_ptr);
3385                 return (ENOMEM);
3386         }
3387 
3388         mutex_init(&ill->ill_phyint->phyint_lock, NULL, MUTEX_DEFAULT, 0);
3389         if (isv6) {
3390                 ill->ill_phyint->phyint_illv6 = ill;
3391         } else {
3392                 ill->ill_phyint->phyint_illv4 = ill;
3393         }
3394         if (is_loopback) {
3395                 phyint_flags_init(ill->ill_phyint, DL_LOOP);
3396         }
3397 
3398         list_create(&ill->ill_nce, sizeof (nce_t), offsetof(nce_t, nce_node));
3399 
3400         ill_set_inputfn(ill);
3401 
3402         if (!ipsq_init(ill, ipsq_enter)) {
3403                 mi_free(frag_ptr);
3404                 mi_free(ill->ill_phyint);
3405                 return (ENOMEM);
3406         }
3407 
3408         /* Frag queue limit stuff */
3409         ill->ill_frag_count = 0;
3410         ill->ill_ipf_gen = 0;
3411 
3412         rw_init(&ill->ill_mcast_lock, NULL, RW_DEFAULT, NULL);
3413         mutex_init(&ill->ill_mcast_serializer, NULL, MUTEX_DEFAULT, NULL);
3414         ill->ill_global_timer = INFINITY;
3415         ill->ill_mcast_v1_time = ill->ill_mcast_v2_time = 0;
3416         ill->ill_mcast_v1_tset = ill->ill_mcast_v2_tset = 0;
3417         ill->ill_mcast_rv = MCAST_DEF_ROBUSTNESS;
3418         ill->ill_mcast_qi = MCAST_DEF_QUERY_INTERVAL;
3419 
3420         /*
3421          * Initialize IPv6 configuration variables.  The IP module is always
3422          * opened as an IPv4 module.  Instead tracking down the cases where
3423          * it switches to do ipv6, we'll just initialize the IPv6 configuration
3424          * here for convenience, this has no effect until the ill is set to do
3425          * IPv6.
3426          */
3427         ill->ill_reachable_time = ND_REACHABLE_TIME;
3428         ill->ill_xmit_count = ND_MAX_MULTICAST_SOLICIT;
3429         ill->ill_max_buf = ND_MAX_Q;
3430         ill->ill_refcnt = 0;
3431 
3432         return (0);
3433 }
3434 
3435 /*
3436  * ill_init is called by ip_open when a device control stream is opened.
3437  * It does a few initializations, and shoots a DL_INFO_REQ message down
3438  * to the driver.  The response is later picked up in ip_rput_dlpi and
3439  * used to set up default mechanisms for talking to the driver.  (Always
3440  * called as writer.)
3441  *
3442  * If this function returns error, ip_open will call ip_close which in
3443  * turn will call ill_delete to clean up any memory allocated here that
3444  * is not yet freed.
3445  *
3446  * Note: ill_ipst and ill_zoneid must be set before calling ill_init.
3447  */
3448 int
3449 ill_init(queue_t *q, ill_t *ill)
3450 {
3451         int ret;
3452         dl_info_req_t   *dlir;
3453         mblk_t  *info_mp;
3454 
3455         info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
3456             BPRI_HI);
3457         if (info_mp == NULL)
3458                 return (ENOMEM);
3459 
3460         /*
3461          * For now pretend this is a v4 ill. We need to set phyint_ill*
3462          * at this point because of the following reason. If we can't
3463          * enter the ipsq at some point and cv_wait, the writer that
3464          * wakes us up tries to locate us using the list of all phyints
3465          * in an ipsq and the ills from the phyint thru the phyint_ill*.
3466          * If we don't set it now, we risk a missed wakeup.
3467          */
3468         if ((ret = ill_init_common(ill, q, B_FALSE, B_FALSE, B_TRUE)) != 0) {
3469                 freemsg(info_mp);
3470                 return (ret);
3471         }
3472 
3473         ill->ill_state_flags |= ILL_LL_SUBNET_PENDING;
3474 
3475         /* Send down the Info Request to the driver. */
3476         info_mp->b_datap->db_type = M_PCPROTO;
3477         dlir = (dl_info_req_t *)info_mp->b_rptr;
3478         info_mp->b_wptr = (uchar_t *)&dlir[1];
3479         dlir->dl_primitive = DL_INFO_REQ;
3480 
3481         ill->ill_dlpi_pending = DL_PRIM_INVAL;
3482 
3483         qprocson(q);
3484         ill_dlpi_send(ill, info_mp);
3485 
3486         return (0);
3487 }
3488 
3489 /*
3490  * ill_dls_info
3491  * creates datalink socket info from the device.
3492  */
3493 int
3494 ill_dls_info(struct sockaddr_dl *sdl, const ill_t *ill)
3495 {
3496         size_t  len;
3497 
3498         sdl->sdl_family = AF_LINK;
3499         sdl->sdl_index = ill_get_upper_ifindex(ill);
3500         sdl->sdl_type = ill->ill_type;
3501         ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3502         len = strlen(sdl->sdl_data);
3503         ASSERT(len < 256);
3504         sdl->sdl_nlen = (uchar_t)len;
3505         sdl->sdl_alen = ill->ill_phys_addr_length;
3506         sdl->sdl_slen = 0;
3507         if (ill->ill_phys_addr_length != 0 && ill->ill_phys_addr != NULL)
3508                 bcopy(ill->ill_phys_addr, &sdl->sdl_data[len], sdl->sdl_alen);
3509 
3510         return (sizeof (struct sockaddr_dl));
3511 }
3512 
3513 /*
3514  * ill_xarp_info
3515  * creates xarp info from the device.
3516  */
3517 static int
3518 ill_xarp_info(struct sockaddr_dl *sdl, ill_t *ill)
3519 {
3520         sdl->sdl_family = AF_LINK;
3521         sdl->sdl_index = ill->ill_phyint->phyint_ifindex;
3522         sdl->sdl_type = ill->ill_type;
3523         ill_get_name(ill, sdl->sdl_data, sizeof (sdl->sdl_data));
3524         sdl->sdl_nlen = (uchar_t)mi_strlen(sdl->sdl_data);
3525         sdl->sdl_alen = ill->ill_phys_addr_length;
3526         sdl->sdl_slen = 0;
3527         return (sdl->sdl_nlen);
3528 }
3529 
3530 static int
3531 loopback_kstat_update(kstat_t *ksp, int rw)
3532 {
3533         kstat_named_t *kn;
3534         netstackid_t    stackid;
3535         netstack_t      *ns;
3536         ip_stack_t      *ipst;
3537 
3538         if (ksp == NULL || ksp->ks_data == NULL)
3539                 return (EIO);
3540 
3541         if (rw == KSTAT_WRITE)
3542                 return (EACCES);
3543 
3544         kn = KSTAT_NAMED_PTR(ksp);
3545         stackid = (zoneid_t)(uintptr_t)ksp->ks_private;
3546 
3547         ns = netstack_find_by_stackid(stackid);
3548         if (ns == NULL)
3549                 return (-1);
3550 
3551         ipst = ns->netstack_ip;
3552         if (ipst == NULL) {
3553                 netstack_rele(ns);
3554                 return (-1);
3555         }
3556         kn[0].value.ui32 = ipst->ips_loopback_packets;
3557         kn[1].value.ui32 = ipst->ips_loopback_packets;
3558         netstack_rele(ns);
3559         return (0);
3560 }
3561 
3562 /*
3563  * Has ifindex been plumbed already?
3564  */
3565 static boolean_t
3566 phyint_exists(uint_t index, ip_stack_t *ipst)
3567 {
3568         ASSERT(index != 0);
3569         ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
3570 
3571         return (avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3572             &index, NULL) != NULL);
3573 }
3574 
3575 /*
3576  * Pick a unique ifindex.
3577  * When the index counter passes IF_INDEX_MAX for the first time, the wrap
3578  * flag is set so that next time time ip_assign_ifindex() is called, it
3579  * falls through and resets the index counter back to 1, the minimum value
3580  * for the interface index. The logic below assumes that ips_ill_index
3581  * can hold a value of IF_INDEX_MAX+1 without there being any loss
3582  * (i.e. reset back to 0.)
3583  */
3584 boolean_t
3585 ip_assign_ifindex(uint_t *indexp, ip_stack_t *ipst)
3586 {
3587         uint_t loops;
3588 
3589         if (!ipst->ips_ill_index_wrap) {
3590                 *indexp = ipst->ips_ill_index++;
3591                 if (ipst->ips_ill_index > IF_INDEX_MAX) {
3592                         /*
3593                          * Reached the maximum ifindex value, set the wrap
3594                          * flag to indicate that it is no longer possible
3595                          * to assume that a given index is unallocated.
3596                          */
3597                         ipst->ips_ill_index_wrap = B_TRUE;
3598                 }
3599                 return (B_TRUE);
3600         }
3601 
3602         if (ipst->ips_ill_index > IF_INDEX_MAX)
3603                 ipst->ips_ill_index = 1;
3604 
3605         /*
3606          * Start reusing unused indexes. Note that we hold the ill_g_lock
3607          * at this point and don't want to call any function that attempts
3608          * to get the lock again.
3609          */
3610         for (loops = IF_INDEX_MAX; loops > 0; loops--) {
3611                 if (!phyint_exists(ipst->ips_ill_index, ipst)) {
3612                         /* found unused index - use it */
3613                         *indexp = ipst->ips_ill_index;
3614                         return (B_TRUE);
3615                 }
3616 
3617                 ipst->ips_ill_index++;
3618                 if (ipst->ips_ill_index > IF_INDEX_MAX)
3619                         ipst->ips_ill_index = 1;
3620         }
3621 
3622         /*
3623          * all interface indicies are inuse.
3624          */
3625         return (B_FALSE);
3626 }
3627 
3628 /*
3629  * Assign a unique interface index for the phyint.
3630  */
3631 static boolean_t
3632 phyint_assign_ifindex(phyint_t *phyi, ip_stack_t *ipst)
3633 {
3634         ASSERT(phyi->phyint_ifindex == 0);
3635         return (ip_assign_ifindex(&phyi->phyint_ifindex, ipst));
3636 }
3637 
3638 /*
3639  * Initialize the flags on `phyi' as per the provided mactype.
3640  */
3641 static void
3642 phyint_flags_init(phyint_t *phyi, t_uscalar_t mactype)
3643 {
3644         uint64_t flags = 0;
3645 
3646         /*
3647          * Initialize PHYI_RUNNING and PHYI_FAILED.  For non-IPMP interfaces,
3648          * we always presume the underlying hardware is working and set
3649          * PHYI_RUNNING (if it's not, the driver will subsequently send a
3650          * DL_NOTE_LINK_DOWN message).  For IPMP interfaces, at initialization
3651          * there are no active interfaces in the group so we set PHYI_FAILED.
3652          */
3653         if (mactype == SUNW_DL_IPMP)
3654                 flags |= PHYI_FAILED;
3655         else
3656                 flags |= PHYI_RUNNING;
3657 
3658         switch (mactype) {
3659         case SUNW_DL_VNI:
3660                 flags |= PHYI_VIRTUAL;
3661                 break;
3662         case SUNW_DL_IPMP:
3663                 flags |= PHYI_IPMP;
3664                 break;
3665         case DL_LOOP:
3666                 flags |= (PHYI_LOOPBACK | PHYI_VIRTUAL);
3667                 break;
3668         }
3669 
3670         mutex_enter(&phyi->phyint_lock);
3671         phyi->phyint_flags |= flags;
3672         mutex_exit(&phyi->phyint_lock);
3673 }
3674 
3675 /*
3676  * Return a pointer to the ill which matches the supplied name.  Note that
3677  * the ill name length includes the null termination character.  (May be
3678  * called as writer.)
3679  * If do_alloc and the interface is "lo0" it will be automatically created.
3680  * Cannot bump up reference on condemned ills. So dup detect can't be done
3681  * using this func.
3682  */
3683 ill_t *
3684 ill_lookup_on_name(char *name, boolean_t do_alloc, boolean_t isv6,
3685     boolean_t *did_alloc, ip_stack_t *ipst)
3686 {
3687         ill_t   *ill;
3688         ipif_t  *ipif;
3689         ipsq_t  *ipsq;
3690         kstat_named_t   *kn;
3691         boolean_t isloopback;
3692         in6_addr_t ov6addr;
3693 
3694         isloopback = mi_strcmp(name, ipif_loopback_name) == 0;
3695 
3696         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3697         ill = ill_find_by_name(name, isv6, ipst);
3698         rw_exit(&ipst->ips_ill_g_lock);
3699         if (ill != NULL)
3700                 return (ill);
3701 
3702         /*
3703          * Couldn't find it.  Does this happen to be a lookup for the
3704          * loopback device and are we allowed to allocate it?
3705          */
3706         if (!isloopback || !do_alloc)
3707                 return (NULL);
3708 
3709         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
3710         ill = ill_find_by_name(name, isv6, ipst);
3711         if (ill != NULL) {
3712                 rw_exit(&ipst->ips_ill_g_lock);
3713                 return (ill);
3714         }
3715 
3716         /* Create the loopback device on demand */
3717         ill = (ill_t *)(mi_alloc(sizeof (ill_t) +
3718             sizeof (ipif_loopback_name), BPRI_MED));
3719         if (ill == NULL)
3720                 goto done;
3721 
3722         bzero(ill, sizeof (*ill));
3723         ill->ill_ipst = ipst;
3724         netstack_hold(ipst->ips_netstack);
3725         /*
3726          * For exclusive stacks we set the zoneid to zero
3727          * to make IP operate as if in the global zone.
3728          */
3729         ill->ill_zoneid = GLOBAL_ZONEID;
3730 
3731         if (ill_init_common(ill, NULL, isv6, B_TRUE, B_FALSE) != 0)
3732                 goto done;
3733 
3734         if (!ill_allocate_mibs(ill))
3735                 goto done;
3736 
3737         ill->ill_current_frag = ill->ill_max_frag;
3738         ill->ill_mtu = ill->ill_max_frag; /* Initial value */
3739         ill->ill_mc_mtu = ill->ill_mtu;
3740         /*
3741          * ipif_loopback_name can't be pointed at directly because its used
3742          * by both the ipv4 and ipv6 interfaces.  When the ill is removed
3743          * from the glist, ill_glist_delete() sets the first character of
3744          * ill_name to '\0'.
3745          */
3746         ill->ill_name = (char *)ill + sizeof (*ill);
3747         (void) strcpy(ill->ill_name, ipif_loopback_name);
3748         ill->ill_name_length = sizeof (ipif_loopback_name);
3749         /* Set ill_dlpi_pending for ipsq_current_finish() to work properly */
3750         ill->ill_dlpi_pending = DL_PRIM_INVAL;
3751 
3752         ipif = ipif_allocate(ill, 0L, IRE_LOOPBACK, B_TRUE, B_TRUE, NULL);
3753         if (ipif == NULL)
3754                 goto done;
3755 
3756         ill->ill_flags = ILLF_MULTICAST;
3757 
3758         ov6addr = ipif->ipif_v6lcl_addr;
3759         /* Set up default loopback address and mask. */
3760         if (!isv6) {
3761                 ipaddr_t inaddr_loopback = htonl(INADDR_LOOPBACK);
3762 
3763                 IN6_IPADDR_TO_V4MAPPED(inaddr_loopback, &ipif->ipif_v6lcl_addr);
3764                 V4MASK_TO_V6(htonl(IN_CLASSA_NET), ipif->ipif_v6net_mask);
3765                 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3766                     ipif->ipif_v6subnet);
3767                 ill->ill_flags |= ILLF_IPV4;
3768         } else {
3769                 ipif->ipif_v6lcl_addr = ipv6_loopback;
3770                 ipif->ipif_v6net_mask = ipv6_all_ones;
3771                 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
3772                     ipif->ipif_v6subnet);
3773                 ill->ill_flags |= ILLF_IPV6;
3774         }
3775 
3776         /*
3777          * Chain us in at the end of the ill list. hold the ill
3778          * before we make it globally visible. 1 for the lookup.
3779          */
3780         ill_refhold(ill);
3781 
3782         ipsq = ill->ill_phyint->phyint_ipsq;
3783 
3784         if (ill_glist_insert(ill, "lo", isv6) != 0)
3785                 cmn_err(CE_PANIC, "cannot insert loopback interface");
3786 
3787         /* Let SCTP know so that it can add this to its list */
3788         sctp_update_ill(ill, SCTP_ILL_INSERT);
3789 
3790         /*
3791          * We have already assigned ipif_v6lcl_addr above, but we need to
3792          * call sctp_update_ipif_addr() after SCTP_ILL_INSERT, which
3793          * requires to be after ill_glist_insert() since we need the
3794          * ill_index set. Pass on ipv6_loopback as the old address.
3795          */
3796         sctp_update_ipif_addr(ipif, ov6addr);
3797 
3798         ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
3799 
3800         /*
3801          * ill_glist_insert() -> ill_phyint_reinit() may have merged IPSQs.
3802          * If so, free our original one.
3803          */
3804         if (ipsq != ill->ill_phyint->phyint_ipsq)
3805                 ipsq_delete(ipsq);
3806 
3807         if (ipst->ips_loopback_ksp == NULL) {
3808                 /* Export loopback interface statistics */
3809                 ipst->ips_loopback_ksp = kstat_create_netstack("lo", 0,
3810                     ipif_loopback_name, "net",
3811                     KSTAT_TYPE_NAMED, 2, 0,
3812                     ipst->ips_netstack->netstack_stackid);
3813                 if (ipst->ips_loopback_ksp != NULL) {
3814                         ipst->ips_loopback_ksp->ks_update =
3815                             loopback_kstat_update;
3816                         kn = KSTAT_NAMED_PTR(ipst->ips_loopback_ksp);
3817                         kstat_named_init(&kn[0], "ipackets", KSTAT_DATA_UINT32);
3818                         kstat_named_init(&kn[1], "opackets", KSTAT_DATA_UINT32);
3819                         ipst->ips_loopback_ksp->ks_private =
3820                             (void *)(uintptr_t)ipst->ips_netstack->
3821                             netstack_stackid;
3822                         kstat_install(ipst->ips_loopback_ksp);
3823                 }
3824         }
3825 
3826         *did_alloc = B_TRUE;
3827         rw_exit(&ipst->ips_ill_g_lock);
3828         ill_nic_event_dispatch(ill, MAP_IPIF_ID(ill->ill_ipif->ipif_id),
3829             NE_PLUMB, ill->ill_name, ill->ill_name_length);
3830         return (ill);
3831 done:
3832         if (ill != NULL) {
3833                 if (ill->ill_phyint != NULL) {
3834                         ipsq = ill->ill_phyint->phyint_ipsq;
3835                         if (ipsq != NULL) {
3836                                 ipsq->ipsq_phyint = NULL;
3837                                 ipsq_delete(ipsq);
3838                         }
3839                         mi_free(ill->ill_phyint);
3840                 }
3841                 ill_free_mib(ill);
3842                 if (ill->ill_ipst != NULL)
3843                         netstack_rele(ill->ill_ipst->ips_netstack);
3844                 mi_free(ill);
3845         }
3846         rw_exit(&ipst->ips_ill_g_lock);
3847         return (NULL);
3848 }
3849 
3850 /*
3851  * For IPP calls - use the ip_stack_t for global stack.
3852  */
3853 ill_t *
3854 ill_lookup_on_ifindex_global_instance(uint_t index, boolean_t isv6)
3855 {
3856         ip_stack_t      *ipst;
3857         ill_t           *ill;
3858 
3859         ipst = netstack_find_by_stackid(GLOBAL_NETSTACKID)->netstack_ip;
3860         if (ipst == NULL) {
3861                 cmn_err(CE_WARN, "No ip_stack_t for zoneid zero!\n");
3862                 return (NULL);
3863         }
3864 
3865         ill = ill_lookup_on_ifindex(index, isv6, ipst);
3866         netstack_rele(ipst->ips_netstack);
3867         return (ill);
3868 }
3869 
3870 /*
3871  * Return a pointer to the ill which matches the index and IP version type.
3872  */
3873 ill_t *
3874 ill_lookup_on_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3875 {
3876         ill_t   *ill;
3877         phyint_t *phyi;
3878 
3879         /*
3880          * Indexes are stored in the phyint - a common structure
3881          * to both IPv4 and IPv6.
3882          */
3883         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3884         phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3885             (void *) &index, NULL);
3886         if (phyi != NULL) {
3887                 ill = isv6 ? phyi->phyint_illv6: phyi->phyint_illv4;
3888                 if (ill != NULL) {
3889                         mutex_enter(&ill->ill_lock);
3890                         if (!ILL_IS_CONDEMNED(ill)) {
3891                                 ill_refhold_locked(ill);
3892                                 mutex_exit(&ill->ill_lock);
3893                                 rw_exit(&ipst->ips_ill_g_lock);
3894                                 return (ill);
3895                         }
3896                         mutex_exit(&ill->ill_lock);
3897                 }
3898         }
3899         rw_exit(&ipst->ips_ill_g_lock);
3900         return (NULL);
3901 }
3902 
3903 /*
3904  * Verify whether or not an interface index is valid for the specified zoneid
3905  * to transmit packets.
3906  * It can be zero (meaning "reset") or an interface index assigned
3907  * to a non-VNI interface. (We don't use VNI interface to send packets.)
3908  */
3909 boolean_t
3910 ip_xmit_ifindex_valid(uint_t ifindex, zoneid_t zoneid, boolean_t isv6,
3911     ip_stack_t *ipst)
3912 {
3913         ill_t           *ill;
3914 
3915         if (ifindex == 0)
3916                 return (B_TRUE);
3917 
3918         ill = ill_lookup_on_ifindex_zoneid(ifindex, zoneid, isv6, ipst);
3919         if (ill == NULL)
3920                 return (B_FALSE);
3921         if (IS_VNI(ill)) {
3922                 ill_refrele(ill);
3923                 return (B_FALSE);
3924         }
3925         ill_refrele(ill);
3926         return (B_TRUE);
3927 }
3928 
3929 /*
3930  * Return the ifindex next in sequence after the passed in ifindex.
3931  * If there is no next ifindex for the given protocol, return 0.
3932  */
3933 uint_t
3934 ill_get_next_ifindex(uint_t index, boolean_t isv6, ip_stack_t *ipst)
3935 {
3936         phyint_t *phyi;
3937         phyint_t *phyi_initial;
3938         uint_t   ifindex;
3939 
3940         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3941 
3942         if (index == 0) {
3943                 phyi = avl_first(
3944                     &ipst->ips_phyint_g_list->phyint_list_avl_by_index);
3945         } else {
3946                 phyi = phyi_initial = avl_find(
3947                     &ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3948                     (void *) &index, NULL);
3949         }
3950 
3951         for (; phyi != NULL;
3952             phyi = avl_walk(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
3953             phyi, AVL_AFTER)) {
3954                 /*
3955                  * If we're not returning the first interface in the tree
3956                  * and we still haven't moved past the phyint_t that
3957                  * corresponds to index, avl_walk needs to be called again
3958                  */
3959                 if (!((index != 0) && (phyi == phyi_initial))) {
3960                         if (isv6) {
3961                                 if ((phyi->phyint_illv6) &&
3962                                     ILL_CAN_LOOKUP(phyi->phyint_illv6) &&
3963                                     (phyi->phyint_illv6->ill_isv6 == 1))
3964                                         break;
3965                         } else {
3966                                 if ((phyi->phyint_illv4) &&
3967                                     ILL_CAN_LOOKUP(phyi->phyint_illv4) &&
3968                                     (phyi->phyint_illv4->ill_isv6 == 0))
3969                                         break;
3970                         }
3971                 }
3972         }
3973 
3974         rw_exit(&ipst->ips_ill_g_lock);
3975 
3976         if (phyi != NULL)
3977                 ifindex = phyi->phyint_ifindex;
3978         else
3979                 ifindex = 0;
3980 
3981         return (ifindex);
3982 }
3983 
3984 /*
3985  * Return the ifindex for the named interface.
3986  * If there is no next ifindex for the interface, return 0.
3987  */
3988 uint_t
3989 ill_get_ifindex_by_name(char *name, ip_stack_t *ipst)
3990 {
3991         phyint_t        *phyi;
3992         avl_index_t     where = 0;
3993         uint_t          ifindex;
3994 
3995         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
3996 
3997         if ((phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
3998             name, &where)) == NULL) {
3999                 rw_exit(&ipst->ips_ill_g_lock);
4000                 return (0);
4001         }
4002 
4003         ifindex = phyi->phyint_ifindex;
4004 
4005         rw_exit(&ipst->ips_ill_g_lock);
4006 
4007         return (ifindex);
4008 }
4009 
4010 /*
4011  * Return the ifindex to be used by upper layer protocols for instance
4012  * for IPV6_RECVPKTINFO. If IPMP this is the one for the upper ill.
4013  */
4014 uint_t
4015 ill_get_upper_ifindex(const ill_t *ill)
4016 {
4017         if (IS_UNDER_IPMP(ill))
4018                 return (ipmp_ill_get_ipmp_ifindex(ill));
4019         else
4020                 return (ill->ill_phyint->phyint_ifindex);
4021 }
4022 
4023 
4024 /*
4025  * Obtain a reference to the ill. The ill_refcnt is a dynamic refcnt
4026  * that gives a running thread a reference to the ill. This reference must be
4027  * released by the thread when it is done accessing the ill and related
4028  * objects. ill_refcnt can not be used to account for static references
4029  * such as other structures pointing to an ill. Callers must generally
4030  * check whether an ill can be refheld by using ILL_CAN_LOOKUP macros
4031  * or be sure that the ill is not being deleted or changing state before
4032  * calling the refhold functions. A non-zero ill_refcnt ensures that the
4033  * ill won't change any of its critical state such as address, netmask etc.
4034  */
4035 void
4036 ill_refhold(ill_t *ill)
4037 {
4038         mutex_enter(&ill->ill_lock);
4039         ill->ill_refcnt++;
4040         ILL_TRACE_REF(ill);
4041         mutex_exit(&ill->ill_lock);
4042 }
4043 
4044 void
4045 ill_refhold_locked(ill_t *ill)
4046 {
4047         ASSERT(MUTEX_HELD(&ill->ill_lock));
4048         ill->ill_refcnt++;
4049         ILL_TRACE_REF(ill);
4050 }
4051 
4052 /* Returns true if we managed to get a refhold */
4053 boolean_t
4054 ill_check_and_refhold(ill_t *ill)
4055 {
4056         mutex_enter(&ill->ill_lock);
4057         if (!ILL_IS_CONDEMNED(ill)) {
4058                 ill_refhold_locked(ill);
4059                 mutex_exit(&ill->ill_lock);
4060                 return (B_TRUE);
4061         }
4062         mutex_exit(&ill->ill_lock);
4063         return (B_FALSE);
4064 }
4065 
4066 /*
4067  * Must not be called while holding any locks. Otherwise if this is
4068  * the last reference to be released, there is a chance of recursive mutex
4069  * panic due to ill_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
4070  * to restart an ioctl.
4071  */
4072 void
4073 ill_refrele(ill_t *ill)
4074 {
4075         mutex_enter(&ill->ill_lock);
4076         ASSERT(ill->ill_refcnt != 0);
4077         ill->ill_refcnt--;
4078         ILL_UNTRACE_REF(ill);
4079         if (ill->ill_refcnt != 0) {
4080                 /* Every ire pointing to the ill adds 1 to ill_refcnt */
4081                 mutex_exit(&ill->ill_lock);
4082                 return;
4083         }
4084 
4085         /* Drops the ill_lock */
4086         ipif_ill_refrele_tail(ill);
4087 }
4088 
4089 /*
4090  * Obtain a weak reference count on the ill. This reference ensures the
4091  * ill won't be freed, but the ill may change any of its critical state
4092  * such as netmask, address etc. Returns an error if the ill has started
4093  * closing.
4094  */
4095 boolean_t
4096 ill_waiter_inc(ill_t *ill)
4097 {
4098         mutex_enter(&ill->ill_lock);
4099         if (ill->ill_state_flags & ILL_CONDEMNED) {
4100                 mutex_exit(&ill->ill_lock);
4101                 return (B_FALSE);
4102         }
4103         ill->ill_waiters++;
4104         mutex_exit(&ill->ill_lock);
4105         return (B_TRUE);
4106 }
4107 
4108 void
4109 ill_waiter_dcr(ill_t *ill)
4110 {
4111         mutex_enter(&ill->ill_lock);
4112         ill->ill_waiters--;
4113         if (ill->ill_waiters == 0)
4114                 cv_broadcast(&ill->ill_cv);
4115         mutex_exit(&ill->ill_lock);
4116 }
4117 
4118 /*
4119  * ip_ll_subnet_defaults is called when we get the DL_INFO_ACK back from the
4120  * driver.  We construct best guess defaults for lower level information that
4121  * we need.  If an interface is brought up without injection of any overriding
4122  * information from outside, we have to be ready to go with these defaults.
4123  * When we get the first DL_INFO_ACK (from ip_open() sending a DL_INFO_REQ)
4124  * we primarely want the dl_provider_style.
4125  * The subsequent DL_INFO_ACK is received after doing a DL_ATTACH and DL_BIND
4126  * at which point we assume the other part of the information is valid.
4127  */
4128 void
4129 ip_ll_subnet_defaults(ill_t *ill, mblk_t *mp)
4130 {
4131         uchar_t         *brdcst_addr;
4132         uint_t          brdcst_addr_length, phys_addr_length;
4133         t_scalar_t      sap_length;
4134         dl_info_ack_t   *dlia;
4135         ip_m_t          *ipm;
4136         dl_qos_cl_sel1_t *sel1;
4137         int             min_mtu;
4138 
4139         ASSERT(IAM_WRITER_ILL(ill));
4140 
4141         /*
4142          * Till the ill is fully up  the ill is not globally visible.
4143          * So no need for a lock.
4144          */
4145         dlia = (dl_info_ack_t *)mp->b_rptr;
4146         ill->ill_mactype = dlia->dl_mac_type;
4147 
4148         ipm = ip_m_lookup(dlia->dl_mac_type);
4149         if (ipm == NULL) {
4150                 ipm = ip_m_lookup(DL_OTHER);
4151                 ASSERT(ipm != NULL);
4152         }
4153         ill->ill_media = ipm;
4154 
4155         /*
4156          * When the new DLPI stuff is ready we'll pull lengths
4157          * from dlia.
4158          */
4159         if (dlia->dl_version == DL_VERSION_2) {
4160                 brdcst_addr_length = dlia->dl_brdcst_addr_length;
4161                 brdcst_addr = mi_offset_param(mp, dlia->dl_brdcst_addr_offset,
4162                     brdcst_addr_length);
4163                 if (brdcst_addr == NULL) {
4164                         brdcst_addr_length = 0;
4165                 }
4166                 sap_length = dlia->dl_sap_length;
4167                 phys_addr_length = dlia->dl_addr_length - ABS(sap_length);
4168                 ip1dbg(("ip: bcast_len %d, sap_len %d, phys_len %d\n",
4169                     brdcst_addr_length, sap_length, phys_addr_length));
4170         } else {
4171                 brdcst_addr_length = 6;
4172                 brdcst_addr = ip_six_byte_all_ones;
4173                 sap_length = -2;
4174                 phys_addr_length = brdcst_addr_length;
4175         }
4176 
4177         ill->ill_bcast_addr_length = brdcst_addr_length;
4178         ill->ill_phys_addr_length = phys_addr_length;
4179         ill->ill_sap_length = sap_length;
4180 
4181         /*
4182          * Synthetic DLPI types such as SUNW_DL_IPMP specify a zero SDU,
4183          * but we must ensure a minimum IP MTU is used since other bits of
4184          * IP will fly apart otherwise.
4185          */
4186         min_mtu = ill->ill_isv6 ? IPV6_MIN_MTU : IP_MIN_MTU;
4187         ill->ill_max_frag = MAX(min_mtu, dlia->dl_max_sdu);
4188         ill->ill_current_frag = ill->ill_max_frag;
4189         ill->ill_mtu = ill->ill_max_frag;
4190         ill->ill_mc_mtu = ill->ill_mtu;   /* Overridden by DL_NOTE_SDU_SIZE2 */
4191 
4192         ill->ill_type = ipm->ip_m_type;
4193 
4194         if (!ill->ill_dlpi_style_set) {
4195                 if (dlia->dl_provider_style == DL_STYLE2)
4196                         ill->ill_needs_attach = 1;
4197 
4198                 phyint_flags_init(ill->ill_phyint, ill->ill_mactype);
4199 
4200                 /*
4201                  * Allocate the first ipif on this ill.  We don't delay it
4202                  * further as ioctl handling assumes at least one ipif exists.
4203                  *
4204                  * At this point we don't know whether the ill is v4 or v6.
4205                  * We will know this whan the SIOCSLIFNAME happens and
4206                  * the correct value for ill_isv6 will be assigned in
4207                  * ipif_set_values(). We need to hold the ill lock and
4208                  * clear the ILL_LL_SUBNET_PENDING flag and atomically do
4209                  * the wakeup.
4210                  */
4211                 (void) ipif_allocate(ill, 0, IRE_LOCAL,
4212                     dlia->dl_provider_style != DL_STYLE2, B_TRUE, NULL);
4213                 mutex_enter(&ill->ill_lock);
4214                 ASSERT(ill->ill_dlpi_style_set == 0);
4215                 ill->ill_dlpi_style_set = 1;
4216                 ill->ill_state_flags &= ~ILL_LL_SUBNET_PENDING;
4217                 cv_broadcast(&ill->ill_cv);
4218                 mutex_exit(&ill->ill_lock);
4219                 freemsg(mp);
4220                 return;
4221         }
4222         ASSERT(ill->ill_ipif != NULL);
4223         /*
4224          * We know whether it is IPv4 or IPv6 now, as this is the
4225          * second DL_INFO_ACK we are recieving in response to the
4226          * DL_INFO_REQ sent in ipif_set_values.
4227          */
4228         ill->ill_sap = (ill->ill_isv6) ? ipm->ip_m_ipv6sap : ipm->ip_m_ipv4sap;
4229         /*
4230          * Clear all the flags that were set based on ill_bcast_addr_length
4231          * and ill_phys_addr_length (in ipif_set_values) as these could have
4232          * changed now and we need to re-evaluate.
4233          */
4234         ill->ill_flags &= ~(ILLF_MULTICAST | ILLF_NONUD | ILLF_NOARP);
4235         ill->ill_ipif->ipif_flags &= ~(IPIF_BROADCAST | IPIF_POINTOPOINT);
4236 
4237         /*
4238          * Free ill_bcast_mp as things could have changed now.
4239          *
4240          * NOTE: The IPMP meta-interface is special-cased because it starts
4241          * with no underlying interfaces (and thus an unknown broadcast
4242          * address length), but we enforce that an interface is broadcast-
4243          * capable as part of allowing it to join a group.
4244          */
4245         if (ill->ill_bcast_addr_length == 0 && !IS_IPMP(ill)) {
4246                 if (ill->ill_bcast_mp != NULL)
4247                         freemsg(ill->ill_bcast_mp);
4248                 ill->ill_net_type = IRE_IF_NORESOLVER;
4249 
4250                 ill->ill_bcast_mp = ill_dlur_gen(NULL,
4251                     ill->ill_phys_addr_length,
4252                     ill->ill_sap,
4253                     ill->ill_sap_length);
4254 
4255                 if (ill->ill_isv6)
4256                         /*
4257                          * Note: xresolv interfaces will eventually need NOARP
4258                          * set here as well, but that will require those
4259                          * external resolvers to have some knowledge of
4260                          * that flag and act appropriately. Not to be changed
4261                          * at present.
4262                          */
4263                         ill->ill_flags |= ILLF_NONUD;
4264                 else
4265                         ill->ill_flags |= ILLF_NOARP;
4266 
4267                 if (ill->ill_mactype == SUNW_DL_VNI) {
4268                         ill->ill_ipif->ipif_flags |= IPIF_NOXMIT;
4269                 } else if (ill->ill_phys_addr_length == 0 ||
4270                     ill->ill_mactype == DL_IPV4 ||
4271                     ill->ill_mactype == DL_IPV6) {
4272                         /*
4273                          * The underying link is point-to-point, so mark the
4274                          * interface as such.  We can do IP multicast over
4275                          * such a link since it transmits all network-layer
4276                          * packets to the remote side the same way.
4277                          */
4278                         ill->ill_flags |= ILLF_MULTICAST;
4279                         ill->ill_ipif->ipif_flags |= IPIF_POINTOPOINT;
4280                 }
4281         } else {
4282                 ill->ill_net_type = IRE_IF_RESOLVER;
4283                 if (ill->ill_bcast_mp != NULL)
4284                         freemsg(ill->ill_bcast_mp);
4285                 ill->ill_bcast_mp = ill_dlur_gen(brdcst_addr,
4286                     ill->ill_bcast_addr_length, ill->ill_sap,
4287                     ill->ill_sap_length);
4288                 /*
4289                  * Later detect lack of DLPI driver multicast
4290                  * capability by catching DL_ENABMULTI errors in
4291                  * ip_rput_dlpi.
4292                  */
4293                 ill->ill_flags |= ILLF_MULTICAST;
4294                 if (!ill->ill_isv6)
4295                         ill->ill_ipif->ipif_flags |= IPIF_BROADCAST;
4296         }
4297 
4298         /* For IPMP, PHYI_IPMP should already be set by phyint_flags_init() */
4299         if (ill->ill_mactype == SUNW_DL_IPMP)
4300                 ASSERT(ill->ill_phyint->phyint_flags & PHYI_IPMP);
4301 
4302         /* By default an interface does not support any CoS marking */
4303         ill->ill_flags &= ~ILLF_COS_ENABLED;
4304 
4305         /*
4306          * If we get QoS information in DL_INFO_ACK, the device supports
4307          * some form of CoS marking, set ILLF_COS_ENABLED.
4308          */
4309         sel1 = (dl_qos_cl_sel1_t *)mi_offset_param(mp, dlia->dl_qos_offset,
4310             dlia->dl_qos_length);
4311         if ((sel1 != NULL) && (sel1->dl_qos_type == DL_QOS_CL_SEL1)) {
4312                 ill->ill_flags |= ILLF_COS_ENABLED;
4313         }
4314 
4315         /* Clear any previous error indication. */
4316         ill->ill_error = 0;
4317         freemsg(mp);
4318 }
4319 
4320 /*
4321  * Perform various checks to verify that an address would make sense as a
4322  * local, remote, or subnet interface address.
4323  */
4324 static boolean_t
4325 ip_addr_ok_v4(ipaddr_t addr, ipaddr_t subnet_mask)
4326 {
4327         ipaddr_t        net_mask;
4328 
4329         /*
4330          * Don't allow all zeroes, or all ones, but allow
4331          * all ones netmask.
4332          */
4333         if ((net_mask = ip_net_mask(addr)) == 0)
4334                 return (B_FALSE);
4335         /* A given netmask overrides the "guess" netmask */
4336         if (subnet_mask != 0)
4337                 net_mask = subnet_mask;
4338         if ((net_mask != ~(ipaddr_t)0) && ((addr == (addr & net_mask)) ||
4339             (addr == (addr | ~net_mask)))) {
4340                 return (B_FALSE);
4341         }
4342 
4343         /*
4344          * Even if the netmask is all ones, we do not allow address to be
4345          * 255.255.255.255
4346          */
4347         if (addr == INADDR_BROADCAST)
4348                 return (B_FALSE);
4349 
4350         if (CLASSD(addr))
4351                 return (B_FALSE);
4352 
4353         return (B_TRUE);
4354 }
4355 
4356 #define V6_IPIF_LINKLOCAL(p)    \
4357         IN6_IS_ADDR_LINKLOCAL(&(p)->ipif_v6lcl_addr)
4358 
4359 /*
4360  * Compare two given ipifs and check if the second one is better than
4361  * the first one using the order of preference (not taking deprecated
4362  * into acount) specified in ipif_lookup_multicast().
4363  */
4364 static boolean_t
4365 ipif_comp_multi(ipif_t *old_ipif, ipif_t *new_ipif, boolean_t isv6)
4366 {
4367         /* Check the least preferred first. */
4368         if (IS_LOOPBACK(old_ipif->ipif_ill)) {
4369                 /* If both ipifs are the same, use the first one. */
4370                 if (IS_LOOPBACK(new_ipif->ipif_ill))
4371                         return (B_FALSE);
4372                 else
4373                         return (B_TRUE);
4374         }
4375 
4376         /* For IPv6, check for link local address. */
4377         if (isv6 && V6_IPIF_LINKLOCAL(old_ipif)) {
4378                 if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4379                     V6_IPIF_LINKLOCAL(new_ipif)) {
4380                         /* The second one is equal or less preferred. */
4381                         return (B_FALSE);
4382                 } else {
4383                         return (B_TRUE);
4384                 }
4385         }
4386 
4387         /* Then check for point to point interface. */
4388         if (old_ipif->ipif_flags & IPIF_POINTOPOINT) {
4389                 if (IS_LOOPBACK(new_ipif->ipif_ill) ||
4390                     (isv6 && V6_IPIF_LINKLOCAL(new_ipif)) ||
4391                     (new_ipif->ipif_flags & IPIF_POINTOPOINT)) {
4392                         return (B_FALSE);
4393                 } else {
4394                         return (B_TRUE);
4395                 }
4396         }
4397 
4398         /* old_ipif is a normal interface, so no need to use the new one. */
4399         return (B_FALSE);
4400 }
4401 
4402 /*
4403  * Find a mulitcast-capable ipif given an IP instance and zoneid.
4404  * The ipif must be up, and its ill must multicast-capable, not
4405  * condemned, not an underlying interface in an IPMP group, and
4406  * not a VNI interface.  Order of preference:
4407  *
4408  *      1a. normal
4409  *      1b. normal, but deprecated
4410  *      2a. point to point
4411  *      2b. point to point, but deprecated
4412  *      3a. link local
4413  *      3b. link local, but deprecated
4414  *      4. loopback.
4415  */
4416 static ipif_t *
4417 ipif_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4418 {
4419         ill_t                   *ill;
4420         ill_walk_context_t      ctx;
4421         ipif_t                  *ipif;
4422         ipif_t                  *saved_ipif = NULL;
4423         ipif_t                  *dep_ipif = NULL;
4424 
4425         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4426         if (isv6)
4427                 ill = ILL_START_WALK_V6(&ctx, ipst);
4428         else
4429                 ill = ILL_START_WALK_V4(&ctx, ipst);
4430 
4431         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4432                 mutex_enter(&ill->ill_lock);
4433                 if (IS_VNI(ill) || IS_UNDER_IPMP(ill) ||
4434                     ILL_IS_CONDEMNED(ill) ||
4435                     !(ill->ill_flags & ILLF_MULTICAST)) {
4436                         mutex_exit(&ill->ill_lock);
4437                         continue;
4438                 }
4439                 for (ipif = ill->ill_ipif; ipif != NULL;
4440                     ipif = ipif->ipif_next) {
4441                         if (zoneid != ipif->ipif_zoneid &&
4442                             zoneid != ALL_ZONES &&
4443                             ipif->ipif_zoneid != ALL_ZONES) {
4444                                 continue;
4445                         }
4446                         if (!(ipif->ipif_flags & IPIF_UP) ||
4447                             IPIF_IS_CONDEMNED(ipif)) {
4448                                 continue;
4449                         }
4450 
4451                         /*
4452                          * Found one candidate.  If it is deprecated,
4453                          * remember it in dep_ipif.  If it is not deprecated,
4454                          * remember it in saved_ipif.
4455                          */
4456                         if (ipif->ipif_flags & IPIF_DEPRECATED) {
4457                                 if (dep_ipif == NULL) {
4458                                         dep_ipif = ipif;
4459                                 } else if (ipif_comp_multi(dep_ipif, ipif,
4460                                     isv6)) {
4461                                         /*
4462                                          * If the previous dep_ipif does not
4463                                          * belong to the same ill, we've done
4464                                          * a ipif_refhold() on it.  So we need
4465                                          * to release it.
4466                                          */
4467                                         if (dep_ipif->ipif_ill != ill)
4468                                                 ipif_refrele(dep_ipif);
4469                                         dep_ipif = ipif;
4470                                 }
4471                                 continue;
4472                         }
4473                         if (saved_ipif == NULL) {
4474                                 saved_ipif = ipif;
4475                         } else {
4476                                 if (ipif_comp_multi(saved_ipif, ipif, isv6)) {
4477                                         if (saved_ipif->ipif_ill != ill)
4478                                                 ipif_refrele(saved_ipif);
4479                                         saved_ipif = ipif;
4480                                 }
4481                         }
4482                 }
4483                 /*
4484                  * Before going to the next ill, do a ipif_refhold() on the
4485                  * saved ones.
4486                  */
4487                 if (saved_ipif != NULL && saved_ipif->ipif_ill == ill)
4488                         ipif_refhold_locked(saved_ipif);
4489                 if (dep_ipif != NULL && dep_ipif->ipif_ill == ill)
4490                         ipif_refhold_locked(dep_ipif);
4491                 mutex_exit(&ill->ill_lock);
4492         }
4493         rw_exit(&ipst->ips_ill_g_lock);
4494 
4495         /*
4496          * If we have only the saved_ipif, return it.  But if we have both
4497          * saved_ipif and dep_ipif, check to see which one is better.
4498          */
4499         if (saved_ipif != NULL) {
4500                 if (dep_ipif != NULL) {
4501                         if (ipif_comp_multi(saved_ipif, dep_ipif, isv6)) {
4502                                 ipif_refrele(saved_ipif);
4503                                 return (dep_ipif);
4504                         } else {
4505                                 ipif_refrele(dep_ipif);
4506                                 return (saved_ipif);
4507                         }
4508                 }
4509                 return (saved_ipif);
4510         } else {
4511                 return (dep_ipif);
4512         }
4513 }
4514 
4515 ill_t *
4516 ill_lookup_multicast(ip_stack_t *ipst, zoneid_t zoneid, boolean_t isv6)
4517 {
4518         ipif_t *ipif;
4519         ill_t *ill;
4520 
4521         ipif = ipif_lookup_multicast(ipst, zoneid, isv6);
4522         if (ipif == NULL)
4523                 return (NULL);
4524 
4525         ill = ipif->ipif_ill;
4526         ill_refhold(ill);
4527         ipif_refrele(ipif);
4528         return (ill);
4529 }
4530 
4531 /*
4532  * This function is called when an application does not specify an interface
4533  * to be used for multicast traffic (joining a group/sending data).  It
4534  * calls ire_lookup_multi() to look for an interface route for the
4535  * specified multicast group.  Doing this allows the administrator to add
4536  * prefix routes for multicast to indicate which interface to be used for
4537  * multicast traffic in the above scenario.  The route could be for all
4538  * multicast (224.0/4), for a single multicast group (a /32 route) or
4539  * anything in between.  If there is no such multicast route, we just find
4540  * any multicast capable interface and return it.  The returned ipif
4541  * is refhold'ed.
4542  *
4543  * We support MULTIRT and RTF_SETSRC on the multicast routes added to the
4544  * unicast table. This is used by CGTP.
4545  */
4546 ill_t *
4547 ill_lookup_group_v4(ipaddr_t group, zoneid_t zoneid, ip_stack_t *ipst,
4548     boolean_t *multirtp, ipaddr_t *setsrcp)
4549 {
4550         ill_t                   *ill;
4551 
4552         ill = ire_lookup_multi_ill_v4(group, zoneid, ipst, multirtp, setsrcp);
4553         if (ill != NULL)
4554                 return (ill);
4555 
4556         return (ill_lookup_multicast(ipst, zoneid, B_FALSE));
4557 }
4558 
4559 /*
4560  * Look for an ipif with the specified interface address and destination.
4561  * The destination address is used only for matching point-to-point interfaces.
4562  */
4563 ipif_t *
4564 ipif_lookup_interface(ipaddr_t if_addr, ipaddr_t dst, ip_stack_t *ipst)
4565 {
4566         ipif_t  *ipif;
4567         ill_t   *ill;
4568         ill_walk_context_t ctx;
4569 
4570         /*
4571          * First match all the point-to-point interfaces
4572          * before looking at non-point-to-point interfaces.
4573          * This is done to avoid returning non-point-to-point
4574          * ipif instead of unnumbered point-to-point ipif.
4575          */
4576         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4577         ill = ILL_START_WALK_V4(&ctx, ipst);
4578         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4579                 mutex_enter(&ill->ill_lock);
4580                 for (ipif = ill->ill_ipif; ipif != NULL;
4581                     ipif = ipif->ipif_next) {
4582                         /* Allow the ipif to be down */
4583                         if ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
4584                             (ipif->ipif_lcl_addr == if_addr) &&
4585                             (ipif->ipif_pp_dst_addr == dst)) {
4586                                 if (!IPIF_IS_CONDEMNED(ipif)) {
4587                                         ipif_refhold_locked(ipif);
4588                                         mutex_exit(&ill->ill_lock);
4589                                         rw_exit(&ipst->ips_ill_g_lock);
4590                                         return (ipif);
4591                                 }
4592                         }
4593                 }
4594                 mutex_exit(&ill->ill_lock);
4595         }
4596         rw_exit(&ipst->ips_ill_g_lock);
4597 
4598         /* lookup the ipif based on interface address */
4599         ipif = ipif_lookup_addr(if_addr, NULL, ALL_ZONES, ipst);
4600         ASSERT(ipif == NULL || !ipif->ipif_isv6);
4601         return (ipif);
4602 }
4603 
4604 /*
4605  * Common function for ipif_lookup_addr() and ipif_lookup_addr_exact().
4606  */
4607 static ipif_t *
4608 ipif_lookup_addr_common(ipaddr_t addr, ill_t *match_ill, uint32_t match_flags,
4609     zoneid_t zoneid, ip_stack_t *ipst)
4610 {
4611         ipif_t  *ipif;
4612         ill_t   *ill;
4613         boolean_t ptp = B_FALSE;
4614         ill_walk_context_t      ctx;
4615         boolean_t match_illgrp = (match_flags & IPIF_MATCH_ILLGRP);
4616         boolean_t no_duplicate = (match_flags & IPIF_MATCH_NONDUP);
4617 
4618         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4619         /*
4620          * Repeat twice, first based on local addresses and
4621          * next time for pointopoint.
4622          */
4623 repeat:
4624         ill = ILL_START_WALK_V4(&ctx, ipst);
4625         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4626                 if (match_ill != NULL && ill != match_ill &&
4627                     (!match_illgrp || !IS_IN_SAME_ILLGRP(ill, match_ill))) {
4628                         continue;
4629                 }
4630                 mutex_enter(&ill->ill_lock);
4631                 for (ipif = ill->ill_ipif; ipif != NULL;
4632                     ipif = ipif->ipif_next) {
4633                         if (zoneid != ALL_ZONES &&
4634                             zoneid != ipif->ipif_zoneid &&
4635                             ipif->ipif_zoneid != ALL_ZONES)
4636                                 continue;
4637 
4638                         if (no_duplicate && !(ipif->ipif_flags & IPIF_UP))
4639                                 continue;
4640 
4641                         /* Allow the ipif to be down */
4642                         if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4643                             ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4644                             (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4645                             (ipif->ipif_pp_dst_addr == addr))) {
4646                                 if (!IPIF_IS_CONDEMNED(ipif)) {
4647                                         ipif_refhold_locked(ipif);
4648                                         mutex_exit(&ill->ill_lock);
4649                                         rw_exit(&ipst->ips_ill_g_lock);
4650                                         return (ipif);
4651                                 }
4652                         }
4653                 }
4654                 mutex_exit(&ill->ill_lock);
4655         }
4656 
4657         /* If we already did the ptp case, then we are done */
4658         if (ptp) {
4659                 rw_exit(&ipst->ips_ill_g_lock);
4660                 return (NULL);
4661         }
4662         ptp = B_TRUE;
4663         goto repeat;
4664 }
4665 
4666 /*
4667  * Lookup an ipif with the specified address.  For point-to-point links we
4668  * look for matches on either the destination address or the local address,
4669  * but we skip the local address check if IPIF_UNNUMBERED is set.  If the
4670  * `match_ill' argument is non-NULL, the lookup is restricted to that ill
4671  * (or illgrp if `match_ill' is in an IPMP group).
4672  */
4673 ipif_t *
4674 ipif_lookup_addr(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4675     ip_stack_t *ipst)
4676 {
4677         return (ipif_lookup_addr_common(addr, match_ill, IPIF_MATCH_ILLGRP,
4678             zoneid, ipst));
4679 }
4680 
4681 /*
4682  * Lookup an ipif with the specified address. Similar to ipif_lookup_addr,
4683  * except that we will only return an address if it is not marked as
4684  * IPIF_DUPLICATE
4685  */
4686 ipif_t *
4687 ipif_lookup_addr_nondup(ipaddr_t addr, ill_t *match_ill, zoneid_t zoneid,
4688     ip_stack_t *ipst)
4689 {
4690         return (ipif_lookup_addr_common(addr, match_ill,
4691             (IPIF_MATCH_ILLGRP | IPIF_MATCH_NONDUP),
4692             zoneid, ipst));
4693 }
4694 
4695 /*
4696  * Special abbreviated version of ipif_lookup_addr() that doesn't match
4697  * `match_ill' across the IPMP group.  This function is only needed in some
4698  * corner-cases; almost everything should use ipif_lookup_addr().
4699  */
4700 ipif_t *
4701 ipif_lookup_addr_exact(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4702 {
4703         ASSERT(match_ill != NULL);
4704         return (ipif_lookup_addr_common(addr, match_ill, 0, ALL_ZONES,
4705             ipst));
4706 }
4707 
4708 /*
4709  * Look for an ipif with the specified address. For point-point links
4710  * we look for matches on either the destination address and the local
4711  * address, but we ignore the check on the local address if IPIF_UNNUMBERED
4712  * is set.
4713  * If the `match_ill' argument is non-NULL, the lookup is restricted to that
4714  * ill (or illgrp if `match_ill' is in an IPMP group).
4715  * Return the zoneid for the ipif which matches. ALL_ZONES if no match.
4716  */
4717 zoneid_t
4718 ipif_lookup_addr_zoneid(ipaddr_t addr, ill_t *match_ill, ip_stack_t *ipst)
4719 {
4720         zoneid_t zoneid;
4721         ipif_t  *ipif;
4722         ill_t   *ill;
4723         boolean_t ptp = B_FALSE;
4724         ill_walk_context_t      ctx;
4725 
4726         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
4727         /*
4728          * Repeat twice, first based on local addresses and
4729          * next time for pointopoint.
4730          */
4731 repeat:
4732         ill = ILL_START_WALK_V4(&ctx, ipst);
4733         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
4734                 if (match_ill != NULL && ill != match_ill &&
4735                     !IS_IN_SAME_ILLGRP(ill, match_ill)) {
4736                         continue;
4737                 }
4738                 mutex_enter(&ill->ill_lock);
4739                 for (ipif = ill->ill_ipif; ipif != NULL;
4740                     ipif = ipif->ipif_next) {
4741                         /* Allow the ipif to be down */
4742                         if ((!ptp && (ipif->ipif_lcl_addr == addr) &&
4743                             ((ipif->ipif_flags & IPIF_UNNUMBERED) == 0)) ||
4744                             (ptp && (ipif->ipif_flags & IPIF_POINTOPOINT) &&
4745                             (ipif->ipif_pp_dst_addr == addr)) &&
4746                             !(ipif->ipif_state_flags & IPIF_CONDEMNED)) {
4747                                 zoneid = ipif->ipif_zoneid;
4748                                 mutex_exit(&ill->ill_lock);
4749                                 rw_exit(&ipst->ips_ill_g_lock);
4750                                 /*
4751                                  * If ipif_zoneid was ALL_ZONES then we have
4752                                  * a trusted extensions shared IP address.
4753                                  * In that case GLOBAL_ZONEID works to send.
4754                                  */
4755                                 if (zoneid == ALL_ZONES)
4756                                         zoneid = GLOBAL_ZONEID;
4757                                 return (zoneid);
4758                         }
4759                 }
4760                 mutex_exit(&ill->ill_lock);
4761         }
4762 
4763         /* If we already did the ptp case, then we are done */
4764         if (ptp) {
4765                 rw_exit(&ipst->ips_ill_g_lock);
4766                 return (ALL_ZONES);
4767         }
4768         ptp = B_TRUE;
4769         goto repeat;
4770 }
4771 
4772 /*
4773  * Look for an ipif that matches the specified remote address i.e. the
4774  * ipif that would receive the specified packet.
4775  * First look for directly connected interfaces and then do a recursive
4776  * IRE lookup and pick the first ipif corresponding to the source address in the
4777  * ire.
4778  * Returns: held ipif
4779  *
4780  * This is only used for ICMP_ADDRESS_MASK_REQUESTs
4781  */
4782 ipif_t *
4783 ipif_lookup_remote(ill_t *ill, ipaddr_t addr, zoneid_t zoneid)
4784 {
4785         ipif_t  *ipif;
4786 
4787         ASSERT(!ill->ill_isv6);
4788 
4789         /*
4790          * Someone could be changing this ipif currently or change it
4791          * after we return this. Thus  a few packets could use the old
4792          * old values. However structure updates/creates (ire, ilg, ilm etc)
4793          * will atomically be updated or cleaned up with the new value
4794          * Thus we don't need a lock to check the flags or other attrs below.
4795          */
4796         mutex_enter(&ill->ill_lock);
4797         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4798                 if (IPIF_IS_CONDEMNED(ipif))
4799                         continue;
4800                 if (zoneid != ALL_ZONES && zoneid != ipif->ipif_zoneid &&
4801                     ipif->ipif_zoneid != ALL_ZONES)
4802                         continue;
4803                 /* Allow the ipif to be down */
4804                 if (ipif->ipif_flags & IPIF_POINTOPOINT) {
4805                         if ((ipif->ipif_pp_dst_addr == addr) ||
4806                             (!(ipif->ipif_flags & IPIF_UNNUMBERED) &&
4807                             ipif->ipif_lcl_addr == addr)) {
4808                                 ipif_refhold_locked(ipif);
4809                                 mutex_exit(&ill->ill_lock);
4810                                 return (ipif);
4811                         }
4812                 } else if (ipif->ipif_subnet == (addr & ipif->ipif_net_mask)) {
4813                         ipif_refhold_locked(ipif);
4814                         mutex_exit(&ill->ill_lock);
4815                         return (ipif);
4816                 }
4817         }
4818         mutex_exit(&ill->ill_lock);
4819         /*
4820          * For a remote destination it isn't possible to nail down a particular
4821          * ipif.
4822          */
4823 
4824         /* Pick the first interface */
4825         ipif = ipif_get_next_ipif(NULL, ill);
4826         return (ipif);
4827 }
4828 
4829 /*
4830  * This func does not prevent refcnt from increasing. But if
4831  * the caller has taken steps to that effect, then this func
4832  * can be used to determine whether the ill has become quiescent
4833  */
4834 static boolean_t
4835 ill_is_quiescent(ill_t *ill)
4836 {
4837         ipif_t  *ipif;
4838 
4839         ASSERT(MUTEX_HELD(&ill->ill_lock));
4840 
4841         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4842                 if (ipif->ipif_refcnt != 0)
4843                         return (B_FALSE);
4844         }
4845         if (!ILL_DOWN_OK(ill) || ill->ill_refcnt != 0) {
4846                 return (B_FALSE);
4847         }
4848         return (B_TRUE);
4849 }
4850 
4851 boolean_t
4852 ill_is_freeable(ill_t *ill)
4853 {
4854         ipif_t  *ipif;
4855 
4856         ASSERT(MUTEX_HELD(&ill->ill_lock));
4857 
4858         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
4859                 if (ipif->ipif_refcnt != 0) {
4860                         return (B_FALSE);
4861                 }
4862         }
4863         if (!ILL_FREE_OK(ill) || ill->ill_refcnt != 0) {
4864                 return (B_FALSE);
4865         }
4866         return (B_TRUE);
4867 }
4868 
4869 /*
4870  * This func does not prevent refcnt from increasing. But if
4871  * the caller has taken steps to that effect, then this func
4872  * can be used to determine whether the ipif has become quiescent
4873  */
4874 static boolean_t
4875 ipif_is_quiescent(ipif_t *ipif)
4876 {
4877         ill_t *ill;
4878 
4879         ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4880 
4881         if (ipif->ipif_refcnt != 0)
4882                 return (B_FALSE);
4883 
4884         ill = ipif->ipif_ill;
4885         if (ill->ill_ipif_up_count != 0 || ill->ill_ipif_dup_count != 0 ||
4886             ill->ill_logical_down) {
4887                 return (B_TRUE);
4888         }
4889 
4890         /* This is the last ipif going down or being deleted on this ill */
4891         if (ill->ill_ire_cnt != 0 || ill->ill_refcnt != 0) {
4892                 return (B_FALSE);
4893         }
4894 
4895         return (B_TRUE);
4896 }
4897 
4898 /*
4899  * return true if the ipif can be destroyed: the ipif has to be quiescent
4900  * with zero references from ire/ilm to it.
4901  */
4902 static boolean_t
4903 ipif_is_freeable(ipif_t *ipif)
4904 {
4905         ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
4906         ASSERT(ipif->ipif_id != 0);
4907         return (ipif->ipif_refcnt == 0);
4908 }
4909 
4910 /*
4911  * The ipif/ill/ire has been refreled. Do the tail processing.
4912  * Determine if the ipif or ill in question has become quiescent and if so
4913  * wakeup close and/or restart any queued pending ioctl that is waiting
4914  * for the ipif_down (or ill_down)
4915  */
4916 void
4917 ipif_ill_refrele_tail(ill_t *ill)
4918 {
4919         mblk_t  *mp;
4920         conn_t  *connp;
4921         ipsq_t  *ipsq;
4922         ipxop_t *ipx;
4923         ipif_t  *ipif;
4924         dl_notify_ind_t *dlindp;
4925 
4926         ASSERT(MUTEX_HELD(&ill->ill_lock));
4927 
4928         if ((ill->ill_state_flags & ILL_CONDEMNED) && ill_is_freeable(ill)) {
4929                 /* ip_modclose() may be waiting */
4930                 cv_broadcast(&ill->ill_cv);
4931         }
4932 
4933         ipsq = ill->ill_phyint->phyint_ipsq;
4934         mutex_enter(&ipsq->ipsq_lock);
4935         ipx = ipsq->ipsq_xop;
4936         mutex_enter(&ipx->ipx_lock);
4937         if (ipx->ipx_waitfor == 0)   /* no one's waiting; bail */
4938                 goto unlock;
4939 
4940         ASSERT(ipx->ipx_pending_mp != NULL && ipx->ipx_pending_ipif != NULL);
4941 
4942         ipif = ipx->ipx_pending_ipif;
4943         if (ipif->ipif_ill != ill)   /* wait is for another ill; bail */
4944                 goto unlock;
4945 
4946         switch (ipx->ipx_waitfor) {
4947         case IPIF_DOWN:
4948                 if (!ipif_is_quiescent(ipif))
4949                         goto unlock;
4950                 break;
4951         case IPIF_FREE:
4952                 if (!ipif_is_freeable(ipif))
4953                         goto unlock;
4954                 break;
4955         case ILL_DOWN:
4956                 if (!ill_is_quiescent(ill))
4957                         goto unlock;
4958                 break;
4959         case ILL_FREE:
4960                 /*
4961                  * ILL_FREE is only for loopback; normal ill teardown waits
4962                  * synchronously in ip_modclose() without using ipx_waitfor,
4963                  * handled by the cv_broadcast() at the top of this function.
4964                  */
4965                 if (!ill_is_freeable(ill))
4966                         goto unlock;
4967                 break;
4968         default:
4969                 cmn_err(CE_PANIC, "ipsq: %p unknown ipx_waitfor %d\n",
4970                     (void *)ipsq, ipx->ipx_waitfor);
4971         }
4972 
4973         ill_refhold_locked(ill);        /* for qwriter_ip() call below */
4974         mutex_exit(&ipx->ipx_lock);
4975         mp = ipsq_pending_mp_get(ipsq, &connp);
4976         mutex_exit(&ipsq->ipsq_lock);
4977         mutex_exit(&ill->ill_lock);
4978 
4979         ASSERT(mp != NULL);
4980         /*
4981          * NOTE: all of the qwriter_ip() calls below use CUR_OP since
4982          * we can only get here when the current operation decides it
4983          * it needs to quiesce via ipsq_pending_mp_add().
4984          */
4985         switch (mp->b_datap->db_type) {
4986         case M_PCPROTO:
4987         case M_PROTO:
4988                 /*
4989                  * For now, only DL_NOTIFY_IND messages can use this facility.
4990                  */
4991                 dlindp = (dl_notify_ind_t *)mp->b_rptr;
4992                 ASSERT(dlindp->dl_primitive == DL_NOTIFY_IND);
4993 
4994                 switch (dlindp->dl_notification) {
4995                 case DL_NOTE_PHYS_ADDR:
4996                         qwriter_ip(ill, ill->ill_rq, mp,
4997                             ill_set_phys_addr_tail, CUR_OP, B_TRUE);
4998                         return;
4999                 case DL_NOTE_REPLUMB:
5000                         qwriter_ip(ill, ill->ill_rq, mp,
5001                             ill_replumb_tail, CUR_OP, B_TRUE);
5002                         return;
5003                 default:
5004                         ASSERT(0);
5005                         ill_refrele(ill);
5006                 }
5007                 break;
5008 
5009         case M_ERROR:
5010         case M_HANGUP:
5011                 qwriter_ip(ill, ill->ill_rq, mp, ipif_all_down_tail, CUR_OP,
5012                     B_TRUE);
5013                 return;
5014 
5015         case M_IOCTL:
5016         case M_IOCDATA:
5017                 qwriter_ip(ill, (connp != NULL ? CONNP_TO_WQ(connp) :
5018                     ill->ill_wq), mp, ip_reprocess_ioctl, CUR_OP, B_TRUE);
5019                 return;
5020 
5021         default:
5022                 cmn_err(CE_PANIC, "ipif_ill_refrele_tail mp %p "
5023                     "db_type %d\n", (void *)mp, mp->b_datap->db_type);
5024         }
5025         return;
5026 unlock:
5027         mutex_exit(&ipsq->ipsq_lock);
5028         mutex_exit(&ipx->ipx_lock);
5029         mutex_exit(&ill->ill_lock);
5030 }
5031 
5032 #ifdef DEBUG
5033 /* Reuse trace buffer from beginning (if reached the end) and record trace */
5034 static void
5035 th_trace_rrecord(th_trace_t *th_trace)
5036 {
5037         tr_buf_t *tr_buf;
5038         uint_t lastref;
5039 
5040         lastref = th_trace->th_trace_lastref;
5041         lastref++;
5042         if (lastref == TR_BUF_MAX)
5043                 lastref = 0;
5044         th_trace->th_trace_lastref = lastref;
5045         tr_buf = &th_trace->th_trbuf[lastref];
5046         tr_buf->tr_time = ddi_get_lbolt();
5047         tr_buf->tr_depth = getpcstack(tr_buf->tr_stack, TR_STACK_DEPTH);
5048 }
5049 
5050 static void
5051 th_trace_free(void *value)
5052 {
5053         th_trace_t *th_trace = value;
5054 
5055         ASSERT(th_trace->th_refcnt == 0);
5056         kmem_free(th_trace, sizeof (*th_trace));
5057 }
5058 
5059 /*
5060  * Find or create the per-thread hash table used to track object references.
5061  * The ipst argument is NULL if we shouldn't allocate.
5062  *
5063  * Accesses per-thread data, so there's no need to lock here.
5064  */
5065 static mod_hash_t *
5066 th_trace_gethash(ip_stack_t *ipst)
5067 {
5068         th_hash_t *thh;
5069 
5070         if ((thh = tsd_get(ip_thread_data)) == NULL && ipst != NULL) {
5071                 mod_hash_t *mh;
5072                 char name[256];
5073                 size_t objsize, rshift;
5074                 int retv;
5075 
5076                 if ((thh = kmem_alloc(sizeof (*thh), KM_NOSLEEP)) == NULL)
5077                         return (NULL);
5078                 (void) snprintf(name, sizeof (name), "th_trace_%p",
5079                     (void *)curthread);
5080 
5081                 /*
5082                  * We use mod_hash_create_extended here rather than the more
5083                  * obvious mod_hash_create_ptrhash because the latter has a
5084                  * hard-coded KM_SLEEP, and we'd prefer to fail rather than
5085                  * block.
5086                  */
5087                 objsize = MAX(MAX(sizeof (ill_t), sizeof (ipif_t)),
5088                     MAX(sizeof (ire_t), sizeof (ncec_t)));
5089                 rshift = highbit(objsize);
5090                 mh = mod_hash_create_extended(name, 64, mod_hash_null_keydtor,
5091                     th_trace_free, mod_hash_byptr, (void *)rshift,
5092                     mod_hash_ptrkey_cmp, KM_NOSLEEP);
5093                 if (mh == NULL) {
5094                         kmem_free(thh, sizeof (*thh));
5095                         return (NULL);
5096                 }
5097                 thh->thh_hash = mh;
5098                 thh->thh_ipst = ipst;
5099                 /*
5100                  * We trace ills, ipifs, ires, and nces.  All of these are
5101                  * per-IP-stack, so the lock on the thread list is as well.
5102                  */
5103                 rw_enter(&ip_thread_rwlock, RW_WRITER);
5104                 list_insert_tail(&ip_thread_list, thh);
5105                 rw_exit(&ip_thread_rwlock);
5106                 retv = tsd_set(ip_thread_data, thh);
5107                 ASSERT(retv == 0);
5108         }
5109         return (thh != NULL ? thh->thh_hash : NULL);
5110 }
5111 
5112 boolean_t
5113 th_trace_ref(const void *obj, ip_stack_t *ipst)
5114 {
5115         th_trace_t *th_trace;
5116         mod_hash_t *mh;
5117         mod_hash_val_t val;
5118 
5119         if ((mh = th_trace_gethash(ipst)) == NULL)
5120                 return (B_FALSE);
5121 
5122         /*
5123          * Attempt to locate the trace buffer for this obj and thread.
5124          * If it does not exist, then allocate a new trace buffer and
5125          * insert into the hash.
5126          */
5127         if (mod_hash_find(mh, (mod_hash_key_t)obj, &val) == MH_ERR_NOTFOUND) {
5128                 th_trace = kmem_zalloc(sizeof (th_trace_t), KM_NOSLEEP);
5129                 if (th_trace == NULL)
5130                         return (B_FALSE);
5131 
5132                 th_trace->th_id = curthread;
5133                 if (mod_hash_insert(mh, (mod_hash_key_t)obj,
5134                     (mod_hash_val_t)th_trace) != 0) {
5135                         kmem_free(th_trace, sizeof (th_trace_t));
5136                         return (B_FALSE);
5137                 }
5138         } else {
5139                 th_trace = (th_trace_t *)val;
5140         }
5141 
5142         ASSERT(th_trace->th_refcnt >= 0 &&
5143             th_trace->th_refcnt < TR_BUF_MAX - 1);
5144 
5145         th_trace->th_refcnt++;
5146         th_trace_rrecord(th_trace);
5147         return (B_TRUE);
5148 }
5149 
5150 /*
5151  * For the purpose of tracing a reference release, we assume that global
5152  * tracing is always on and that the same thread initiated the reference hold
5153  * is releasing.
5154  */
5155 void
5156 th_trace_unref(const void *obj)
5157 {
5158         int retv;
5159         mod_hash_t *mh;
5160         th_trace_t *th_trace;
5161         mod_hash_val_t val;
5162 
5163         mh = th_trace_gethash(NULL);
5164         retv = mod_hash_find(mh, (mod_hash_key_t)obj, &val);
5165         ASSERT(retv == 0);
5166         th_trace = (th_trace_t *)val;
5167 
5168         ASSERT(th_trace->th_refcnt > 0);
5169         th_trace->th_refcnt--;
5170         th_trace_rrecord(th_trace);
5171 }
5172 
5173 /*
5174  * If tracing has been disabled, then we assume that the reference counts are
5175  * now useless, and we clear them out before destroying the entries.
5176  */
5177 void
5178 th_trace_cleanup(const void *obj, boolean_t trace_disable)
5179 {
5180         th_hash_t       *thh;
5181         mod_hash_t      *mh;
5182         mod_hash_val_t  val;
5183         th_trace_t      *th_trace;
5184         int             retv;
5185 
5186         rw_enter(&ip_thread_rwlock, RW_READER);
5187         for (thh = list_head(&ip_thread_list); thh != NULL;
5188             thh = list_next(&ip_thread_list, thh)) {
5189                 if (mod_hash_find(mh = thh->thh_hash, (mod_hash_key_t)obj,
5190                     &val) == 0) {
5191                         th_trace = (th_trace_t *)val;
5192                         if (trace_disable)
5193                                 th_trace->th_refcnt = 0;
5194                         retv = mod_hash_destroy(mh, (mod_hash_key_t)obj);
5195                         ASSERT(retv == 0);
5196                 }
5197         }
5198         rw_exit(&ip_thread_rwlock);
5199 }
5200 
5201 void
5202 ipif_trace_ref(ipif_t *ipif)
5203 {
5204         ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5205 
5206         if (ipif->ipif_trace_disable)
5207                 return;
5208 
5209         if (!th_trace_ref(ipif, ipif->ipif_ill->ill_ipst)) {
5210                 ipif->ipif_trace_disable = B_TRUE;
5211                 ipif_trace_cleanup(ipif);
5212         }
5213 }
5214 
5215 void
5216 ipif_untrace_ref(ipif_t *ipif)
5217 {
5218         ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5219 
5220         if (!ipif->ipif_trace_disable)
5221                 th_trace_unref(ipif);
5222 }
5223 
5224 void
5225 ill_trace_ref(ill_t *ill)
5226 {
5227         ASSERT(MUTEX_HELD(&ill->ill_lock));
5228 
5229         if (ill->ill_trace_disable)
5230                 return;
5231 
5232         if (!th_trace_ref(ill, ill->ill_ipst)) {
5233                 ill->ill_trace_disable = B_TRUE;
5234                 ill_trace_cleanup(ill);
5235         }
5236 }
5237 
5238 void
5239 ill_untrace_ref(ill_t *ill)
5240 {
5241         ASSERT(MUTEX_HELD(&ill->ill_lock));
5242 
5243         if (!ill->ill_trace_disable)
5244                 th_trace_unref(ill);
5245 }
5246 
5247 /*
5248  * Called when ipif is unplumbed or when memory alloc fails.  Note that on
5249  * failure, ipif_trace_disable is set.
5250  */
5251 static void
5252 ipif_trace_cleanup(const ipif_t *ipif)
5253 {
5254         th_trace_cleanup(ipif, ipif->ipif_trace_disable);
5255 }
5256 
5257 /*
5258  * Called when ill is unplumbed or when memory alloc fails.  Note that on
5259  * failure, ill_trace_disable is set.
5260  */
5261 static void
5262 ill_trace_cleanup(const ill_t *ill)
5263 {
5264         th_trace_cleanup(ill, ill->ill_trace_disable);
5265 }
5266 #endif /* DEBUG */
5267 
5268 void
5269 ipif_refhold_locked(ipif_t *ipif)
5270 {
5271         ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
5272         ipif->ipif_refcnt++;
5273         IPIF_TRACE_REF(ipif);
5274 }
5275 
5276 void
5277 ipif_refhold(ipif_t *ipif)
5278 {
5279         ill_t   *ill;
5280 
5281         ill = ipif->ipif_ill;
5282         mutex_enter(&ill->ill_lock);
5283         ipif->ipif_refcnt++;
5284         IPIF_TRACE_REF(ipif);
5285         mutex_exit(&ill->ill_lock);
5286 }
5287 
5288 /*
5289  * Must not be called while holding any locks. Otherwise if this is
5290  * the last reference to be released there is a chance of recursive mutex
5291  * panic due to ipif_refrele -> ipif_ill_refrele_tail -> qwriter_ip trying
5292  * to restart an ioctl.
5293  */
5294 void
5295 ipif_refrele(ipif_t *ipif)
5296 {
5297         ill_t   *ill;
5298 
5299         ill = ipif->ipif_ill;
5300 
5301         mutex_enter(&ill->ill_lock);
5302         ASSERT(ipif->ipif_refcnt != 0);
5303         ipif->ipif_refcnt--;
5304         IPIF_UNTRACE_REF(ipif);
5305         if (ipif->ipif_refcnt != 0) {
5306                 mutex_exit(&ill->ill_lock);
5307                 return;
5308         }
5309 
5310         /* Drops the ill_lock */
5311         ipif_ill_refrele_tail(ill);
5312 }
5313 
5314 ipif_t *
5315 ipif_get_next_ipif(ipif_t *curr, ill_t *ill)
5316 {
5317         ipif_t  *ipif;
5318 
5319         mutex_enter(&ill->ill_lock);
5320         for (ipif = (curr == NULL ? ill->ill_ipif : curr->ipif_next);
5321             ipif != NULL; ipif = ipif->ipif_next) {
5322                 if (IPIF_IS_CONDEMNED(ipif))
5323                         continue;
5324                 ipif_refhold_locked(ipif);
5325                 mutex_exit(&ill->ill_lock);
5326                 return (ipif);
5327         }
5328         mutex_exit(&ill->ill_lock);
5329         return (NULL);
5330 }
5331 
5332 /*
5333  * TODO: make this table extendible at run time
5334  * Return a pointer to the mac type info for 'mac_type'
5335  */
5336 static ip_m_t *
5337 ip_m_lookup(t_uscalar_t mac_type)
5338 {
5339         ip_m_t  *ipm;
5340 
5341         for (ipm = ip_m_tbl; ipm < A_END(ip_m_tbl); ipm++)
5342                 if (ipm->ip_m_mac_type == mac_type)
5343                         return (ipm);
5344         return (NULL);
5345 }
5346 
5347 /*
5348  * Make a link layer address from the multicast IP address *addr.
5349  * To form the link layer address, invoke the ip_m_v*mapping function
5350  * associated with the link-layer type.
5351  */
5352 void
5353 ip_mcast_mapping(ill_t *ill, uchar_t *addr, uchar_t *hwaddr)
5354 {
5355         ip_m_t *ipm;
5356 
5357         if (ill->ill_net_type == IRE_IF_NORESOLVER)
5358                 return;
5359 
5360         ASSERT(addr != NULL);
5361 
5362         ipm = ip_m_lookup(ill->ill_mactype);
5363         if (ipm == NULL ||
5364             (ill->ill_isv6 && ipm->ip_m_v6mapping == NULL) ||
5365             (!ill->ill_isv6 && ipm->ip_m_v4mapping == NULL)) {
5366                 ip0dbg(("no mapping for ill %s mactype 0x%x\n",
5367                     ill->ill_name, ill->ill_mactype));
5368                 return;
5369         }
5370         if (ill->ill_isv6)
5371                 (*ipm->ip_m_v6mapping)(ill, addr, hwaddr);
5372         else
5373                 (*ipm->ip_m_v4mapping)(ill, addr, hwaddr);
5374 }
5375 
5376 /*
5377  * Returns B_FALSE if the IPv4 netmask pointed by `mask' is non-contiguous.
5378  * Otherwise returns B_TRUE.
5379  *
5380  * The netmask can be verified to be contiguous with 32 shifts and or
5381  * operations. Take the contiguous mask (in host byte order) and compute
5382  *      mask | mask << 1 | mask << 2 | ... | mask << 31
5383  * the result will be the same as the 'mask' for contiguous mask.
5384  */
5385 static boolean_t
5386 ip_contiguous_mask(uint32_t mask)
5387 {
5388         uint32_t        m = mask;
5389         int             i;
5390 
5391         for (i = 1; i < 32; i++)
5392                 m |= (mask << i);
5393 
5394         return (m == mask);
5395 }
5396 
5397 /*
5398  * ip_rt_add is called to add an IPv4 route to the forwarding table.
5399  * ill is passed in to associate it with the correct interface.
5400  * If ire_arg is set, then we return the held IRE in that location.
5401  */
5402 int
5403 ip_rt_add(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5404     ipaddr_t src_addr, int flags, ill_t *ill, ire_t **ire_arg,
5405     boolean_t ioctl_msg, struct rtsa_s *sp, ip_stack_t *ipst, zoneid_t zoneid)
5406 {
5407         ire_t   *ire, *nire;
5408         ire_t   *gw_ire = NULL;
5409         ipif_t  *ipif = NULL;
5410         uint_t  type;
5411         int     match_flags = MATCH_IRE_TYPE;
5412         tsol_gc_t *gc = NULL;
5413         tsol_gcgrp_t *gcgrp = NULL;
5414         boolean_t gcgrp_xtraref = B_FALSE;
5415         boolean_t cgtp_broadcast;
5416         boolean_t unbound = B_FALSE;
5417 
5418         ip1dbg(("ip_rt_add:"));
5419 
5420         if (ire_arg != NULL)
5421                 *ire_arg = NULL;
5422 
5423         /* disallow non-contiguous netmasks */
5424         if (!ip_contiguous_mask(ntohl(mask)))
5425                 return (ENOTSUP);
5426 
5427         /*
5428          * If this is the case of RTF_HOST being set, then we set the netmask
5429          * to all ones (regardless if one was supplied).
5430          */
5431         if (flags & RTF_HOST)
5432                 mask = IP_HOST_MASK;
5433 
5434         /*
5435          * Prevent routes with a zero gateway from being created (since
5436          * interfaces can currently be plumbed and brought up no assigned
5437          * address).
5438          */
5439         if (gw_addr == 0)
5440                 return (ENETUNREACH);
5441         /*
5442          * Get the ipif, if any, corresponding to the gw_addr
5443          * If -ifp was specified we restrict ourselves to the ill, otherwise
5444          * we match on the gatway and destination to handle unnumbered pt-pt
5445          * interfaces.
5446          */
5447         if (ill != NULL)
5448                 ipif = ipif_lookup_addr(gw_addr, ill, ALL_ZONES, ipst);
5449         else
5450                 ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
5451         if (ipif != NULL) {
5452                 if (IS_VNI(ipif->ipif_ill)) {
5453                         ipif_refrele(ipif);
5454                         return (EINVAL);
5455                 }
5456         }
5457 
5458         /*
5459          * GateD will attempt to create routes with a loopback interface
5460          * address as the gateway and with RTF_GATEWAY set.  We allow
5461          * these routes to be added, but create them as interface routes
5462          * since the gateway is an interface address.
5463          */
5464         if ((ipif != NULL) && (ipif->ipif_ire_type == IRE_LOOPBACK)) {
5465                 flags &= ~RTF_GATEWAY;
5466                 if (gw_addr == INADDR_LOOPBACK && dst_addr == INADDR_LOOPBACK &&
5467                     mask == IP_HOST_MASK) {
5468                         ire = ire_ftable_lookup_v4(dst_addr, 0, 0, IRE_LOOPBACK,
5469                             NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
5470                             NULL);
5471                         if (ire != NULL) {
5472                                 ire_refrele(ire);
5473                                 ipif_refrele(ipif);
5474                                 return (EEXIST);
5475                         }
5476                         ip1dbg(("ip_rt_add: 0x%p creating IRE 0x%x"
5477                             "for 0x%x\n", (void *)ipif,
5478                             ipif->ipif_ire_type,
5479                             ntohl(ipif->ipif_lcl_addr)));
5480                         ire = ire_create(
5481                             (uchar_t *)&dst_addr,   /* dest address */
5482                             (uchar_t *)&mask,               /* mask */
5483                             NULL,                       /* no gateway */
5484                             ipif->ipif_ire_type,     /* LOOPBACK */
5485                             ipif->ipif_ill,
5486                             zoneid,
5487                             (ipif->ipif_flags & IPIF_PRIVATE) ? RTF_PRIVATE : 0,
5488                             NULL,
5489                             ipst);
5490 
5491                         if (ire == NULL) {
5492                                 ipif_refrele(ipif);
5493                                 return (ENOMEM);
5494                         }
5495                         /* src address assigned by the caller? */
5496                         if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5497                                 ire->ire_setsrc_addr = src_addr;
5498 
5499                         nire = ire_add(ire);
5500                         if (nire == NULL) {
5501                                 /*
5502                                  * In the result of failure, ire_add() will have
5503                                  * already deleted the ire in question, so there
5504                                  * is no need to do that here.
5505                                  */
5506                                 ipif_refrele(ipif);
5507                                 return (ENOMEM);
5508                         }
5509                         /*
5510                          * Check if it was a duplicate entry. This handles
5511                          * the case of two racing route adds for the same route
5512                          */
5513                         if (nire != ire) {
5514                                 ASSERT(nire->ire_identical_ref > 1);
5515                                 ire_delete(nire);
5516                                 ire_refrele(nire);
5517                                 ipif_refrele(ipif);
5518                                 return (EEXIST);
5519                         }
5520                         ire = nire;
5521                         goto save_ire;
5522                 }
5523         }
5524 
5525         /*
5526          * The routes for multicast with CGTP are quite special in that
5527          * the gateway is the local interface address, yet RTF_GATEWAY
5528          * is set. We turn off RTF_GATEWAY to provide compatibility with
5529          * this undocumented and unusual use of multicast routes.
5530          */
5531         if ((flags & RTF_MULTIRT) && ipif != NULL)
5532                 flags &= ~RTF_GATEWAY;
5533 
5534         /*
5535          * Traditionally, interface routes are ones where RTF_GATEWAY isn't set
5536          * and the gateway address provided is one of the system's interface
5537          * addresses.  By using the routing socket interface and supplying an
5538          * RTA_IFP sockaddr with an interface index, an alternate method of
5539          * specifying an interface route to be created is available which uses
5540          * the interface index that specifies the outgoing interface rather than
5541          * the address of an outgoing interface (which may not be able to
5542          * uniquely identify an interface).  When coupled with the RTF_GATEWAY
5543          * flag, routes can be specified which not only specify the next-hop to
5544          * be used when routing to a certain prefix, but also which outgoing
5545          * interface should be used.
5546          *
5547          * Previously, interfaces would have unique addresses assigned to them
5548          * and so the address assigned to a particular interface could be used
5549          * to identify a particular interface.  One exception to this was the
5550          * case of an unnumbered interface (where IPIF_UNNUMBERED was set).
5551          *
5552          * With the advent of IPv6 and its link-local addresses, this
5553          * restriction was relaxed and interfaces could share addresses between
5554          * themselves.  In fact, typically all of the link-local interfaces on
5555          * an IPv6 node or router will have the same link-local address.  In
5556          * order to differentiate between these interfaces, the use of an
5557          * interface index is necessary and this index can be carried inside a
5558          * RTA_IFP sockaddr (which is actually a sockaddr_dl).  One restriction
5559          * of using the interface index, however, is that all of the ipif's that
5560          * are part of an ill have the same index and so the RTA_IFP sockaddr
5561          * cannot be used to differentiate between ipif's (or logical
5562          * interfaces) that belong to the same ill (physical interface).
5563          *
5564          * For example, in the following case involving IPv4 interfaces and
5565          * logical interfaces
5566          *
5567          *      192.0.2.32      255.255.255.224 192.0.2.33      U       if0
5568          *      192.0.2.32      255.255.255.224 192.0.2.34      U       if0
5569          *      192.0.2.32      255.255.255.224 192.0.2.35      U       if0
5570          *
5571          * the ipif's corresponding to each of these interface routes can be
5572          * uniquely identified by the "gateway" (actually interface address).
5573          *
5574          * In this case involving multiple IPv6 default routes to a particular
5575          * link-local gateway, the use of RTA_IFP is necessary to specify which
5576          * default route is of interest:
5577          *
5578          *      default         fe80::123:4567:89ab:cdef        U       if0
5579          *      default         fe80::123:4567:89ab:cdef        U       if1
5580          */
5581 
5582         /* RTF_GATEWAY not set */
5583         if (!(flags & RTF_GATEWAY)) {
5584                 if (sp != NULL) {
5585                         ip2dbg(("ip_rt_add: gateway security attributes "
5586                             "cannot be set with interface route\n"));
5587                         if (ipif != NULL)
5588                                 ipif_refrele(ipif);
5589                         return (EINVAL);
5590                 }
5591 
5592                 /*
5593                  * Whether or not ill (RTA_IFP) is set, we require that
5594                  * the gateway is one of our local addresses.
5595                  */
5596                 if (ipif == NULL)
5597                         return (ENETUNREACH);
5598 
5599                 /*
5600                  * We use MATCH_IRE_ILL here. If the caller specified an
5601                  * interface (from the RTA_IFP sockaddr) we use it, otherwise
5602                  * we use the ill derived from the gateway address.
5603                  * We can always match the gateway address since we record it
5604                  * in ire_gateway_addr.
5605                  * We don't allow RTA_IFP to specify a different ill than the
5606                  * one matching the ipif to make sure we can delete the route.
5607                  */
5608                 match_flags |= MATCH_IRE_GW | MATCH_IRE_ILL;
5609                 if (ill == NULL) {
5610                         ill = ipif->ipif_ill;
5611                 } else if (ill != ipif->ipif_ill) {
5612                         ipif_refrele(ipif);
5613                         return (EINVAL);
5614                 }
5615 
5616                 /*
5617                  * We check for an existing entry at this point.
5618                  *
5619                  * Since a netmask isn't passed in via the ioctl interface
5620                  * (SIOCADDRT), we don't check for a matching netmask in that
5621                  * case.
5622                  */
5623                 if (!ioctl_msg)
5624                         match_flags |= MATCH_IRE_MASK;
5625                 ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
5626                     IRE_INTERFACE, ill, ALL_ZONES, NULL, match_flags, 0, ipst,
5627                     NULL);
5628                 if (ire != NULL) {
5629                         ire_refrele(ire);
5630                         ipif_refrele(ipif);
5631                         return (EEXIST);
5632                 }
5633 
5634                 /*
5635                  * Some software (for example, GateD and Sun Cluster) attempts
5636                  * to create (what amount to) IRE_PREFIX routes with the
5637                  * loopback address as the gateway.  This is primarily done to
5638                  * set up prefixes with the RTF_REJECT flag set (for example,
5639                  * when generating aggregate routes.)
5640                  *
5641                  * If the IRE type (as defined by ill->ill_net_type) would be
5642                  * IRE_LOOPBACK, then we map the request into a
5643                  * IRE_IF_NORESOLVER. We also OR in the RTF_BLACKHOLE flag as
5644                  * these interface routes, by definition, can only be that.
5645                  *
5646                  * Needless to say, the real IRE_LOOPBACK is NOT created by this
5647                  * routine, but rather using ire_create() directly.
5648                  *
5649                  */
5650                 type = ill->ill_net_type;
5651                 if (type == IRE_LOOPBACK) {
5652                         type = IRE_IF_NORESOLVER;
5653                         flags |= RTF_BLACKHOLE;
5654                 }
5655 
5656                 /*
5657                  * Create a copy of the IRE_IF_NORESOLVER or
5658                  * IRE_IF_RESOLVER with the modified address, netmask, and
5659                  * gateway.
5660                  */
5661                 ire = ire_create(
5662                     (uchar_t *)&dst_addr,
5663                     (uint8_t *)&mask,
5664                     (uint8_t *)&gw_addr,
5665                     type,
5666                     ill,
5667                     zoneid,
5668                     flags,
5669                     NULL,
5670                     ipst);
5671                 if (ire == NULL) {
5672                         ipif_refrele(ipif);
5673                         return (ENOMEM);
5674                 }
5675 
5676                 /* src address assigned by the caller? */
5677                 if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5678                         ire->ire_setsrc_addr = src_addr;
5679 
5680                 nire = ire_add(ire);
5681                 if (nire == NULL) {
5682                         /*
5683                          * In the result of failure, ire_add() will have
5684                          * already deleted the ire in question, so there
5685                          * is no need to do that here.
5686                          */
5687                         ipif_refrele(ipif);
5688                         return (ENOMEM);
5689                 }
5690                 /*
5691                  * Check if it was a duplicate entry. This handles
5692                  * the case of two racing route adds for the same route
5693                  */
5694                 if (nire != ire) {
5695                         ire_delete(nire);
5696                         ire_refrele(nire);
5697                         ipif_refrele(ipif);
5698                         return (EEXIST);
5699                 }
5700                 ire = nire;
5701                 goto save_ire;
5702         }
5703 
5704         /*
5705          * Get an interface IRE for the specified gateway.
5706          * If we don't have an IRE_IF_NORESOLVER or IRE_IF_RESOLVER for the
5707          * gateway, it is currently unreachable and we fail the request
5708          * accordingly. We reject any RTF_GATEWAY routes where the gateway
5709          * is an IRE_LOCAL or IRE_LOOPBACK.
5710          * If RTA_IFP was specified we look on that particular ill.
5711          */
5712         if (ill != NULL)
5713                 match_flags |= MATCH_IRE_ILL;
5714 
5715         /* Check whether the gateway is reachable. */
5716 again:
5717         type = IRE_INTERFACE | IRE_LOCAL | IRE_LOOPBACK;
5718         if (flags & RTF_INDIRECT)
5719                 type |= IRE_OFFLINK;
5720 
5721         gw_ire = ire_ftable_lookup_v4(gw_addr, 0, 0, type, ill,
5722             ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
5723         if (gw_ire == NULL) {
5724                 /*
5725                  * With IPMP, we allow host routes to influence in.mpathd's
5726                  * target selection.  However, if the test addresses are on
5727                  * their own network, the above lookup will fail since the
5728                  * underlying IRE_INTERFACEs are marked hidden.  So allow
5729                  * hidden test IREs to be found and try again.
5730                  */
5731                 if (!(match_flags & MATCH_IRE_TESTHIDDEN))  {
5732                         match_flags |= MATCH_IRE_TESTHIDDEN;
5733                         goto again;
5734                 }
5735                 if (ipif != NULL)
5736                         ipif_refrele(ipif);
5737                 return (ENETUNREACH);
5738         }
5739         if (gw_ire->ire_type & (IRE_LOCAL|IRE_LOOPBACK)) {
5740                 ire_refrele(gw_ire);
5741                 if (ipif != NULL)
5742                         ipif_refrele(ipif);
5743                 return (ENETUNREACH);
5744         }
5745 
5746         if (ill == NULL && !(flags & RTF_INDIRECT)) {
5747                 unbound = B_TRUE;
5748                 if (ipst->ips_ip_strict_src_multihoming > 0)
5749                         ill = gw_ire->ire_ill;
5750         }
5751 
5752         /*
5753          * We create one of three types of IREs as a result of this request
5754          * based on the netmask.  A netmask of all ones (which is automatically
5755          * assumed when RTF_HOST is set) results in an IRE_HOST being created.
5756          * An all zeroes netmask implies a default route so an IRE_DEFAULT is
5757          * created.  Otherwise, an IRE_PREFIX route is created for the
5758          * destination prefix.
5759          */
5760         if (mask == IP_HOST_MASK)
5761                 type = IRE_HOST;
5762         else if (mask == 0)
5763                 type = IRE_DEFAULT;
5764         else
5765                 type = IRE_PREFIX;
5766 
5767         /* check for a duplicate entry */
5768         ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
5769             ALL_ZONES, NULL, match_flags | MATCH_IRE_MASK | MATCH_IRE_GW,
5770             0, ipst, NULL);
5771         if (ire != NULL) {
5772                 if (ipif != NULL)
5773                         ipif_refrele(ipif);
5774                 ire_refrele(gw_ire);
5775                 ire_refrele(ire);
5776                 return (EEXIST);
5777         }
5778 
5779         /* Security attribute exists */
5780         if (sp != NULL) {
5781                 tsol_gcgrp_addr_t ga;
5782 
5783                 /* find or create the gateway credentials group */
5784                 ga.ga_af = AF_INET;
5785                 IN6_IPADDR_TO_V4MAPPED(gw_addr, &ga.ga_addr);
5786 
5787                 /* we hold reference to it upon success */
5788                 gcgrp = gcgrp_lookup(&ga, B_TRUE);
5789                 if (gcgrp == NULL) {
5790                         if (ipif != NULL)
5791                                 ipif_refrele(ipif);
5792                         ire_refrele(gw_ire);
5793                         return (ENOMEM);
5794                 }
5795 
5796                 /*
5797                  * Create and add the security attribute to the group; a
5798                  * reference to the group is made upon allocating a new
5799                  * entry successfully.  If it finds an already-existing
5800                  * entry for the security attribute in the group, it simply
5801                  * returns it and no new reference is made to the group.
5802                  */
5803                 gc = gc_create(sp, gcgrp, &gcgrp_xtraref);
5804                 if (gc == NULL) {
5805                         if (ipif != NULL)
5806                                 ipif_refrele(ipif);
5807                         /* release reference held by gcgrp_lookup */
5808                         GCGRP_REFRELE(gcgrp);
5809                         ire_refrele(gw_ire);
5810                         return (ENOMEM);
5811                 }
5812         }
5813 
5814         /* Create the IRE. */
5815         ire = ire_create(
5816             (uchar_t *)&dst_addr,           /* dest address */
5817             (uchar_t *)&mask,                       /* mask */
5818             (uchar_t *)&gw_addr,            /* gateway address */
5819             (ushort_t)type,                     /* IRE type */
5820             ill,
5821             zoneid,
5822             flags,
5823             gc,                                 /* security attribute */
5824             ipst);
5825 
5826         /*
5827          * The ire holds a reference to the 'gc' and the 'gc' holds a
5828          * reference to the 'gcgrp'. We can now release the extra reference
5829          * the 'gcgrp' acquired in the gcgrp_lookup, if it was not used.
5830          */
5831         if (gcgrp_xtraref)
5832                 GCGRP_REFRELE(gcgrp);
5833         if (ire == NULL) {
5834                 if (gc != NULL)
5835                         GC_REFRELE(gc);
5836                 if (ipif != NULL)
5837                         ipif_refrele(ipif);
5838                 ire_refrele(gw_ire);
5839                 return (ENOMEM);
5840         }
5841 
5842         /* Before we add, check if an extra CGTP broadcast is needed */
5843         cgtp_broadcast = ((flags & RTF_MULTIRT) &&
5844             ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST);
5845 
5846         /* src address assigned by the caller? */
5847         if ((src_addr != INADDR_ANY) && (flags & RTF_SETSRC))
5848                 ire->ire_setsrc_addr = src_addr;
5849 
5850         ire->ire_unbound = unbound;
5851 
5852         /*
5853          * POLICY: should we allow an RTF_HOST with address INADDR_ANY?
5854          * SUN/OS socket stuff does but do we really want to allow 0.0.0.0?
5855          */
5856 
5857         /* Add the new IRE. */
5858         nire = ire_add(ire);
5859         if (nire == NULL) {
5860                 /*
5861                  * In the result of failure, ire_add() will have
5862                  * already deleted the ire in question, so there
5863                  * is no need to do that here.
5864                  */
5865                 if (ipif != NULL)
5866                         ipif_refrele(ipif);
5867                 ire_refrele(gw_ire);
5868                 return (ENOMEM);
5869         }
5870         /*
5871          * Check if it was a duplicate entry. This handles
5872          * the case of two racing route adds for the same route
5873          */
5874         if (nire != ire) {
5875                 ire_delete(nire);
5876                 ire_refrele(nire);
5877                 if (ipif != NULL)
5878                         ipif_refrele(ipif);
5879                 ire_refrele(gw_ire);
5880                 return (EEXIST);
5881         }
5882         ire = nire;
5883 
5884         if (flags & RTF_MULTIRT) {
5885                 /*
5886                  * Invoke the CGTP (multirouting) filtering module
5887                  * to add the dst address in the filtering database.
5888                  * Replicated inbound packets coming from that address
5889                  * will be filtered to discard the duplicates.
5890                  * It is not necessary to call the CGTP filter hook
5891                  * when the dst address is a broadcast or multicast,
5892                  * because an IP source address cannot be a broadcast
5893                  * or a multicast.
5894                  */
5895                 if (cgtp_broadcast) {
5896                         ip_cgtp_bcast_add(ire, ipst);
5897                         goto save_ire;
5898                 }
5899                 if (ipst->ips_ip_cgtp_filter_ops != NULL &&
5900                     !CLASSD(ire->ire_addr)) {
5901                         int res;
5902                         ipif_t *src_ipif;
5903 
5904                         /* Find the source address corresponding to gw_ire */
5905                         src_ipif = ipif_lookup_addr(gw_ire->ire_gateway_addr,
5906                             NULL, zoneid, ipst);
5907                         if (src_ipif != NULL) {
5908                                 res = ipst->ips_ip_cgtp_filter_ops->
5909                                     cfo_add_dest_v4(
5910                                     ipst->ips_netstack->netstack_stackid,
5911                                     ire->ire_addr,
5912                                     ire->ire_gateway_addr,
5913                                     ire->ire_setsrc_addr,
5914                                     src_ipif->ipif_lcl_addr);
5915                                 ipif_refrele(src_ipif);
5916                         } else {
5917                                 res = EADDRNOTAVAIL;
5918                         }
5919                         if (res != 0) {
5920                                 if (ipif != NULL)
5921                                         ipif_refrele(ipif);
5922                                 ire_refrele(gw_ire);
5923                                 ire_delete(ire);
5924                                 ire_refrele(ire);       /* Held in ire_add */
5925                                 return (res);
5926                         }
5927                 }
5928         }
5929 
5930 save_ire:
5931         if (gw_ire != NULL) {
5932                 ire_refrele(gw_ire);
5933                 gw_ire = NULL;
5934         }
5935         if (ill != NULL) {
5936                 /*
5937                  * Save enough information so that we can recreate the IRE if
5938                  * the interface goes down and then up.  The metrics associated
5939                  * with the route will be saved as well when rts_setmetrics() is
5940                  * called after the IRE has been created.  In the case where
5941                  * memory cannot be allocated, none of this information will be
5942                  * saved.
5943                  */
5944                 ill_save_ire(ill, ire);
5945         }
5946         if (ioctl_msg)
5947                 ip_rts_rtmsg(RTM_OLDADD, ire, 0, ipst);
5948         if (ire_arg != NULL) {
5949                 /*
5950                  * Store the ire that was successfully added into where ire_arg
5951                  * points to so that callers don't have to look it up
5952                  * themselves (but they are responsible for ire_refrele()ing
5953                  * the ire when they are finished with it).
5954                  */
5955                 *ire_arg = ire;
5956         } else {
5957                 ire_refrele(ire);               /* Held in ire_add */
5958         }
5959         if (ipif != NULL)
5960                 ipif_refrele(ipif);
5961         return (0);
5962 }
5963 
5964 /*
5965  * ip_rt_delete is called to delete an IPv4 route.
5966  * ill is passed in to associate it with the correct interface.
5967  */
5968 /* ARGSUSED4 */
5969 int
5970 ip_rt_delete(ipaddr_t dst_addr, ipaddr_t mask, ipaddr_t gw_addr,
5971     uint_t rtm_addrs, int flags, ill_t *ill, boolean_t ioctl_msg,
5972     ip_stack_t *ipst, zoneid_t zoneid)
5973 {
5974         ire_t   *ire = NULL;
5975         ipif_t  *ipif;
5976         uint_t  type;
5977         uint_t  match_flags = MATCH_IRE_TYPE;
5978         int     err = 0;
5979 
5980         ip1dbg(("ip_rt_delete:"));
5981         /*
5982          * If this is the case of RTF_HOST being set, then we set the netmask
5983          * to all ones.  Otherwise, we use the netmask if one was supplied.
5984          */
5985         if (flags & RTF_HOST) {
5986                 mask = IP_HOST_MASK;
5987                 match_flags |= MATCH_IRE_MASK;
5988         } else if (rtm_addrs & RTA_NETMASK) {
5989                 match_flags |= MATCH_IRE_MASK;
5990         }
5991 
5992         /*
5993          * Note that RTF_GATEWAY is never set on a delete, therefore
5994          * we check if the gateway address is one of our interfaces first,
5995          * and fall back on RTF_GATEWAY routes.
5996          *
5997          * This makes it possible to delete an original
5998          * IRE_IF_NORESOLVER/IRE_IF_RESOLVER - consistent with SunOS 4.1.
5999          * However, we have RTF_KERNEL set on the ones created by ipif_up
6000          * and those can not be deleted here.
6001          *
6002          * We use MATCH_IRE_ILL if we know the interface. If the caller
6003          * specified an interface (from the RTA_IFP sockaddr) we use it,
6004          * otherwise we use the ill derived from the gateway address.
6005          * We can always match the gateway address since we record it
6006          * in ire_gateway_addr.
6007          *
6008          * For more detail on specifying routes by gateway address and by
6009          * interface index, see the comments in ip_rt_add().
6010          */
6011         ipif = ipif_lookup_interface(gw_addr, dst_addr, ipst);
6012         if (ipif != NULL) {
6013                 ill_t   *ill_match;
6014 
6015                 if (ill != NULL)
6016                         ill_match = ill;
6017                 else
6018                         ill_match = ipif->ipif_ill;
6019 
6020                 match_flags |= MATCH_IRE_ILL;
6021                 if (ipif->ipif_ire_type == IRE_LOOPBACK) {
6022                         ire = ire_ftable_lookup_v4(dst_addr, mask, 0,
6023                             IRE_LOOPBACK, ill_match, ALL_ZONES, NULL,
6024                             match_flags, 0, ipst, NULL);
6025                 }
6026                 if (ire == NULL) {
6027                         match_flags |= MATCH_IRE_GW;
6028                         ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr,
6029                             IRE_INTERFACE, ill_match, ALL_ZONES, NULL,
6030                             match_flags, 0, ipst, NULL);
6031                 }
6032                 /* Avoid deleting routes created by kernel from an ipif */
6033                 if (ire != NULL && (ire->ire_flags & RTF_KERNEL)) {
6034                         ire_refrele(ire);
6035                         ire = NULL;
6036                 }
6037 
6038                 /* Restore in case we didn't find a match */
6039                 match_flags &= ~(MATCH_IRE_GW|MATCH_IRE_ILL);
6040         }
6041 
6042         if (ire == NULL) {
6043                 /*
6044                  * At this point, the gateway address is not one of our own
6045                  * addresses or a matching interface route was not found.  We
6046                  * set the IRE type to lookup based on whether
6047                  * this is a host route, a default route or just a prefix.
6048                  *
6049                  * If an ill was passed in, then the lookup is based on an
6050                  * interface index so MATCH_IRE_ILL is added to match_flags.
6051                  */
6052                 match_flags |= MATCH_IRE_GW;
6053                 if (ill != NULL)
6054                         match_flags |= MATCH_IRE_ILL;
6055                 if (mask == IP_HOST_MASK)
6056                         type = IRE_HOST;
6057                 else if (mask == 0)
6058                         type = IRE_DEFAULT;
6059                 else
6060                         type = IRE_PREFIX;
6061                 ire = ire_ftable_lookup_v4(dst_addr, mask, gw_addr, type, ill,
6062                     ALL_ZONES, NULL, match_flags, 0, ipst, NULL);
6063         }
6064 
6065         if (ipif != NULL) {
6066                 ipif_refrele(ipif);
6067                 ipif = NULL;
6068         }
6069 
6070         if (ire == NULL)
6071                 return (ESRCH);
6072 
6073         if (ire->ire_flags & RTF_MULTIRT) {
6074                 /*
6075                  * Invoke the CGTP (multirouting) filtering module
6076                  * to remove the dst address from the filtering database.
6077                  * Packets coming from that address will no longer be
6078                  * filtered to remove duplicates.
6079                  */
6080                 if (ipst->ips_ip_cgtp_filter_ops != NULL) {
6081                         err = ipst->ips_ip_cgtp_filter_ops->cfo_del_dest_v4(
6082                             ipst->ips_netstack->netstack_stackid,
6083                             ire->ire_addr, ire->ire_gateway_addr);
6084                 }
6085                 ip_cgtp_bcast_delete(ire, ipst);
6086         }
6087 
6088         ill = ire->ire_ill;
6089         if (ill != NULL)
6090                 ill_remove_saved_ire(ill, ire);
6091         if (ioctl_msg)
6092                 ip_rts_rtmsg(RTM_OLDDEL, ire, 0, ipst);
6093         ire_delete(ire);
6094         ire_refrele(ire);
6095         return (err);
6096 }
6097 
6098 /*
6099  * ip_siocaddrt is called to complete processing of an SIOCADDRT IOCTL.
6100  */
6101 /* ARGSUSED */
6102 int
6103 ip_siocaddrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6104     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6105 {
6106         ipaddr_t dst_addr;
6107         ipaddr_t gw_addr;
6108         ipaddr_t mask;
6109         int error = 0;
6110         mblk_t *mp1;
6111         struct rtentry *rt;
6112         ipif_t *ipif = NULL;
6113         ip_stack_t      *ipst;
6114 
6115         ASSERT(q->q_next == NULL);
6116         ipst = CONNQ_TO_IPST(q);
6117 
6118         ip1dbg(("ip_siocaddrt:"));
6119         /* Existence of mp1 verified in ip_wput_nondata */
6120         mp1 = mp->b_cont->b_cont;
6121         rt = (struct rtentry *)mp1->b_rptr;
6122 
6123         dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6124         gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6125 
6126         /*
6127          * If the RTF_HOST flag is on, this is a request to assign a gateway
6128          * to a particular host address.  In this case, we set the netmask to
6129          * all ones for the particular destination address.  Otherwise,
6130          * determine the netmask to be used based on dst_addr and the interfaces
6131          * in use.
6132          */
6133         if (rt->rt_flags & RTF_HOST) {
6134                 mask = IP_HOST_MASK;
6135         } else {
6136                 /*
6137                  * Note that ip_subnet_mask returns a zero mask in the case of
6138                  * default (an all-zeroes address).
6139                  */
6140                 mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6141         }
6142 
6143         error = ip_rt_add(dst_addr, mask, gw_addr, 0, rt->rt_flags, NULL, NULL,
6144             B_TRUE, NULL, ipst, ALL_ZONES);
6145         if (ipif != NULL)
6146                 ipif_refrele(ipif);
6147         return (error);
6148 }
6149 
6150 /*
6151  * ip_siocdelrt is called to complete processing of an SIOCDELRT IOCTL.
6152  */
6153 /* ARGSUSED */
6154 int
6155 ip_siocdelrt(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
6156     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
6157 {
6158         ipaddr_t dst_addr;
6159         ipaddr_t gw_addr;
6160         ipaddr_t mask;
6161         int error;
6162         mblk_t *mp1;
6163         struct rtentry *rt;
6164         ipif_t *ipif = NULL;
6165         ip_stack_t      *ipst;
6166 
6167         ASSERT(q->q_next == NULL);
6168         ipst = CONNQ_TO_IPST(q);
6169 
6170         ip1dbg(("ip_siocdelrt:"));
6171         /* Existence of mp1 verified in ip_wput_nondata */
6172         mp1 = mp->b_cont->b_cont;
6173         rt = (struct rtentry *)mp1->b_rptr;
6174 
6175         dst_addr = ((sin_t *)&rt->rt_dst)->sin_addr.s_addr;
6176         gw_addr = ((sin_t *)&rt->rt_gateway)->sin_addr.s_addr;
6177 
6178         /*
6179          * If the RTF_HOST flag is on, this is a request to delete a gateway
6180          * to a particular host address.  In this case, we set the netmask to
6181          * all ones for the particular destination address.  Otherwise,
6182          * determine the netmask to be used based on dst_addr and the interfaces
6183          * in use.
6184          */
6185         if (rt->rt_flags & RTF_HOST) {
6186                 mask = IP_HOST_MASK;
6187         } else {
6188                 /*
6189                  * Note that ip_subnet_mask returns a zero mask in the case of
6190                  * default (an all-zeroes address).
6191                  */
6192                 mask = ip_subnet_mask(dst_addr, &ipif, ipst);
6193         }
6194 
6195         error = ip_rt_delete(dst_addr, mask, gw_addr,
6196             RTA_DST | RTA_GATEWAY | RTA_NETMASK, rt->rt_flags, NULL, B_TRUE,
6197             ipst, ALL_ZONES);
6198         if (ipif != NULL)
6199                 ipif_refrele(ipif);
6200         return (error);
6201 }
6202 
6203 /*
6204  * Enqueue the mp onto the ipsq, chained by b_next.
6205  * b_prev stores the function to be executed later, and b_queue the queue
6206  * where this mp originated.
6207  */
6208 void
6209 ipsq_enq(ipsq_t *ipsq, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6210     ill_t *pending_ill)
6211 {
6212         conn_t  *connp;
6213         ipxop_t *ipx = ipsq->ipsq_xop;
6214 
6215         ASSERT(MUTEX_HELD(&ipsq->ipsq_lock));
6216         ASSERT(MUTEX_HELD(&ipx->ipx_lock));
6217         ASSERT(func != NULL);
6218 
6219         mp->b_queue = q;
6220         mp->b_prev = (void *)func;
6221         mp->b_next = NULL;
6222 
6223         switch (type) {
6224         case CUR_OP:
6225                 if (ipx->ipx_mptail != NULL) {
6226                         ASSERT(ipx->ipx_mphead != NULL);
6227                         ipx->ipx_mptail->b_next = mp;
6228                 } else {
6229                         ASSERT(ipx->ipx_mphead == NULL);
6230                         ipx->ipx_mphead = mp;
6231                 }
6232                 ipx->ipx_mptail = mp;
6233                 break;
6234 
6235         case NEW_OP:
6236                 if (ipsq->ipsq_xopq_mptail != NULL) {
6237                         ASSERT(ipsq->ipsq_xopq_mphead != NULL);
6238                         ipsq->ipsq_xopq_mptail->b_next = mp;
6239                 } else {
6240                         ASSERT(ipsq->ipsq_xopq_mphead == NULL);
6241                         ipsq->ipsq_xopq_mphead = mp;
6242                 }
6243                 ipsq->ipsq_xopq_mptail = mp;
6244                 ipx->ipx_ipsq_queued = B_TRUE;
6245                 break;
6246 
6247         case SWITCH_OP:
6248                 ASSERT(ipsq->ipsq_swxop != NULL);
6249                 /* only one switch operation is currently allowed */
6250                 ASSERT(ipsq->ipsq_switch_mp == NULL);
6251                 ipsq->ipsq_switch_mp = mp;
6252                 ipx->ipx_ipsq_queued = B_TRUE;
6253                 break;
6254         default:
6255                 cmn_err(CE_PANIC, "ipsq_enq %d type \n", type);
6256         }
6257 
6258         if (CONN_Q(q) && pending_ill != NULL) {
6259                 connp = Q_TO_CONN(q);
6260                 ASSERT(MUTEX_HELD(&connp->conn_lock));
6261                 connp->conn_oper_pending_ill = pending_ill;
6262         }
6263 }
6264 
6265 /*
6266  * Dequeue the next message that requested exclusive access to this IPSQ's
6267  * xop.  Specifically:
6268  *
6269  *  1. If we're still processing the current operation on `ipsq', then
6270  *     dequeue the next message for the operation (from ipx_mphead), or
6271  *     return NULL if there are no queued messages for the operation.
6272  *     These messages are queued via CUR_OP to qwriter_ip() and friends.
6273  *
6274  *  2. If the current operation on `ipsq' has completed (ipx_current_ipif is
6275  *     not set) see if the ipsq has requested an xop switch.  If so, switch
6276  *     `ipsq' to a different xop.  Xop switches only happen when joining or
6277  *     leaving IPMP groups and require a careful dance -- see the comments
6278  *     in-line below for details.  If we're leaving a group xop or if we're
6279  *     joining a group xop and become writer on it, then we proceed to (3).
6280  *     Otherwise, we return NULL and exit the xop.
6281  *
6282  *  3. For each IPSQ in the xop, return any switch operation stored on
6283  *     ipsq_switch_mp (set via SWITCH_OP); these must be processed before
6284  *     any other messages queued on the IPSQ.  Otherwise, dequeue the next
6285  *     exclusive operation (queued via NEW_OP) stored on ipsq_xopq_mphead.
6286  *     Note that if the phyint tied to `ipsq' is not using IPMP there will
6287  *     only be one IPSQ in the xop.  Otherwise, there will be one IPSQ for
6288  *     each phyint in the group, including the IPMP meta-interface phyint.
6289  */
6290 static mblk_t *
6291 ipsq_dq(ipsq_t *ipsq)
6292 {
6293         ill_t   *illv4, *illv6;
6294         mblk_t  *mp;
6295         ipsq_t  *xopipsq;
6296         ipsq_t  *leftipsq = NULL;
6297         ipxop_t *ipx;
6298         phyint_t *phyi = ipsq->ipsq_phyint;
6299         ip_stack_t *ipst = ipsq->ipsq_ipst;
6300         boolean_t emptied = B_FALSE;
6301 
6302         /*
6303          * Grab all the locks we need in the defined order (ill_g_lock ->
6304          * ipsq_lock -> ipx_lock); ill_g_lock is needed to use ipsq_next.
6305          */
6306         rw_enter(&ipst->ips_ill_g_lock,
6307             ipsq->ipsq_swxop != NULL ? RW_WRITER : RW_READER);
6308         mutex_enter(&ipsq->ipsq_lock);
6309         ipx = ipsq->ipsq_xop;
6310         mutex_enter(&ipx->ipx_lock);
6311 
6312         /*
6313          * Dequeue the next message associated with the current exclusive
6314          * operation, if any.
6315          */
6316         if ((mp = ipx->ipx_mphead) != NULL) {
6317                 ipx->ipx_mphead = mp->b_next;
6318                 if (ipx->ipx_mphead == NULL)
6319                         ipx->ipx_mptail = NULL;
6320                 mp->b_next = (void *)ipsq;
6321                 goto out;
6322         }
6323 
6324         if (ipx->ipx_current_ipif != NULL)
6325                 goto empty;
6326 
6327         if (ipsq->ipsq_swxop != NULL) {
6328                 /*
6329                  * The exclusive operation that is now being completed has
6330                  * requested a switch to a different xop.  This happens
6331                  * when an interface joins or leaves an IPMP group.  Joins
6332                  * happen through SIOCSLIFGROUPNAME (ip_sioctl_groupname()).
6333                  * Leaves happen via SIOCSLIFGROUPNAME, interface unplumb
6334                  * (phyint_free()), or interface plumb for an ill type
6335                  * not in the IPMP group (ip_rput_dlpi_writer()).
6336                  *
6337                  * Xop switches are not allowed on the IPMP meta-interface.
6338                  */
6339                 ASSERT(phyi == NULL || !(phyi->phyint_flags & PHYI_IPMP));
6340                 ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
6341                 DTRACE_PROBE1(ipsq__switch, (ipsq_t *), ipsq);
6342 
6343                 if (ipsq->ipsq_swxop == &ipsq->ipsq_ownxop) {
6344                         /*
6345                          * We're switching back to our own xop, so we have two
6346                          * xop's to drain/exit: our own, and the group xop
6347                          * that we are leaving.
6348                          *
6349                          * First, pull ourselves out of the group ipsq list.
6350                          * This is safe since we're writer on ill_g_lock.
6351                          */
6352                         ASSERT(ipsq->ipsq_xop != &ipsq->ipsq_ownxop);
6353 
6354                         xopipsq = ipx->ipx_ipsq;
6355                         while (xopipsq->ipsq_next != ipsq)
6356                                 xopipsq = xopipsq->ipsq_next;
6357 
6358                         xopipsq->ipsq_next = ipsq->ipsq_next;
6359                         ipsq->ipsq_next = ipsq;
6360                         ipsq->ipsq_xop = ipsq->ipsq_swxop;
6361                         ipsq->ipsq_swxop = NULL;
6362 
6363                         /*
6364                          * Second, prepare to exit the group xop.  The actual
6365                          * ipsq_exit() is done at the end of this function
6366                          * since we cannot hold any locks across ipsq_exit().
6367                          * Note that although we drop the group's ipx_lock, no
6368                          * threads can proceed since we're still ipx_writer.
6369                          */
6370                         leftipsq = xopipsq;
6371                         mutex_exit(&ipx->ipx_lock);
6372 
6373                         /*
6374                          * Third, set ipx to point to our own xop (which was
6375                          * inactive and therefore can be entered).
6376                          */
6377                         ipx = ipsq->ipsq_xop;
6378                         mutex_enter(&ipx->ipx_lock);
6379                         ASSERT(ipx->ipx_writer == NULL);
6380                         ASSERT(ipx->ipx_current_ipif == NULL);
6381                 } else {
6382                         /*
6383                          * We're switching from our own xop to a group xop.
6384                          * The requestor of the switch must ensure that the
6385                          * group xop cannot go away (e.g. by ensuring the
6386                          * phyint associated with the xop cannot go away).
6387                          *
6388                          * If we can become writer on our new xop, then we'll
6389                          * do the drain.  Otherwise, the current writer of our
6390                          * new xop will do the drain when it exits.
6391                          *
6392                          * First, splice ourselves into the group IPSQ list.
6393                          * This is safe since we're writer on ill_g_lock.
6394                          */
6395                         ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6396 
6397                         xopipsq = ipsq->ipsq_swxop->ipx_ipsq;
6398                         while (xopipsq->ipsq_next != ipsq->ipsq_swxop->ipx_ipsq)
6399                                 xopipsq = xopipsq->ipsq_next;
6400 
6401                         xopipsq->ipsq_next = ipsq;
6402                         ipsq->ipsq_next = ipsq->ipsq_swxop->ipx_ipsq;
6403                         ipsq->ipsq_xop = ipsq->ipsq_swxop;
6404                         ipsq->ipsq_swxop = NULL;
6405 
6406                         /*
6407                          * Second, exit our own xop, since it's now unused.
6408                          * This is safe since we've got the only reference.
6409                          */
6410                         ASSERT(ipx->ipx_writer == curthread);
6411                         ipx->ipx_writer = NULL;
6412                         VERIFY(--ipx->ipx_reentry_cnt == 0);
6413                         ipx->ipx_ipsq_queued = B_FALSE;
6414                         mutex_exit(&ipx->ipx_lock);
6415 
6416                         /*
6417                          * Third, set ipx to point to our new xop, and check
6418                          * if we can become writer on it.  If we cannot, then
6419                          * the current writer will drain the IPSQ group when
6420                          * it exits.  Our ipsq_xop is guaranteed to be stable
6421                          * because we're still holding ipsq_lock.
6422                          */
6423                         ipx = ipsq->ipsq_xop;
6424                         mutex_enter(&ipx->ipx_lock);
6425                         if (ipx->ipx_writer != NULL ||
6426                             ipx->ipx_current_ipif != NULL) {
6427                                 goto out;
6428                         }
6429                 }
6430 
6431                 /*
6432                  * Fourth, become writer on our new ipx before we continue
6433                  * with the drain.  Note that we never dropped ipsq_lock
6434                  * above, so no other thread could've raced with us to
6435                  * become writer first.  Also, we're holding ipx_lock, so
6436                  * no other thread can examine the ipx right now.
6437                  */
6438                 ASSERT(ipx->ipx_current_ipif == NULL);
6439                 ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6440                 VERIFY(ipx->ipx_reentry_cnt++ == 0);
6441                 ipx->ipx_writer = curthread;
6442                 ipx->ipx_forced = B_FALSE;
6443 #ifdef DEBUG
6444                 ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6445 #endif
6446         }
6447 
6448         xopipsq = ipsq;
6449         do {
6450                 /*
6451                  * So that other operations operate on a consistent and
6452                  * complete phyint, a switch message on an IPSQ must be
6453                  * handled prior to any other operations on that IPSQ.
6454                  */
6455                 if ((mp = xopipsq->ipsq_switch_mp) != NULL) {
6456                         xopipsq->ipsq_switch_mp = NULL;
6457                         ASSERT(mp->b_next == NULL);
6458                         mp->b_next = (void *)xopipsq;
6459                         goto out;
6460                 }
6461 
6462                 if ((mp = xopipsq->ipsq_xopq_mphead) != NULL) {
6463                         xopipsq->ipsq_xopq_mphead = mp->b_next;
6464                         if (xopipsq->ipsq_xopq_mphead == NULL)
6465                                 xopipsq->ipsq_xopq_mptail = NULL;
6466                         mp->b_next = (void *)xopipsq;
6467                         goto out;
6468                 }
6469         } while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6470 empty:
6471         /*
6472          * There are no messages.  Further, we are holding ipx_lock, hence no
6473          * new messages can end up on any IPSQ in the xop.
6474          */
6475         ipx->ipx_writer = NULL;
6476         ipx->ipx_forced = B_FALSE;
6477         VERIFY(--ipx->ipx_reentry_cnt == 0);
6478         ipx->ipx_ipsq_queued = B_FALSE;
6479         emptied = B_TRUE;
6480 #ifdef  DEBUG
6481         ipx->ipx_depth = 0;
6482 #endif
6483 out:
6484         mutex_exit(&ipx->ipx_lock);
6485         mutex_exit(&ipsq->ipsq_lock);
6486 
6487         /*
6488          * If we completely emptied the xop, then wake up any threads waiting
6489          * to enter any of the IPSQ's associated with it.
6490          */
6491         if (emptied) {
6492                 xopipsq = ipsq;
6493                 do {
6494                         if ((phyi = xopipsq->ipsq_phyint) == NULL)
6495                                 continue;
6496 
6497                         illv4 = phyi->phyint_illv4;
6498                         illv6 = phyi->phyint_illv6;
6499 
6500                         GRAB_ILL_LOCKS(illv4, illv6);
6501                         if (illv4 != NULL)
6502                                 cv_broadcast(&illv4->ill_cv);
6503                         if (illv6 != NULL)
6504                                 cv_broadcast(&illv6->ill_cv);
6505                         RELEASE_ILL_LOCKS(illv4, illv6);
6506                 } while ((xopipsq = xopipsq->ipsq_next) != ipsq);
6507         }
6508         rw_exit(&ipst->ips_ill_g_lock);
6509 
6510         /*
6511          * Now that all locks are dropped, exit the IPSQ we left.
6512          */
6513         if (leftipsq != NULL)
6514                 ipsq_exit(leftipsq);
6515 
6516         return (mp);
6517 }
6518 
6519 /*
6520  * Return completion status of previously initiated DLPI operations on
6521  * ills in the purview of an ipsq.
6522  */
6523 static boolean_t
6524 ipsq_dlpi_done(ipsq_t *ipsq)
6525 {
6526         ipsq_t          *ipsq_start;
6527         phyint_t        *phyi;
6528         ill_t           *ill;
6529 
6530         ASSERT(RW_LOCK_HELD(&ipsq->ipsq_ipst->ips_ill_g_lock));
6531         ipsq_start = ipsq;
6532 
6533         do {
6534                 /*
6535                  * The only current users of this function are ipsq_try_enter
6536                  * and ipsq_enter which have made sure that ipsq_writer is
6537                  * NULL before we reach here. ill_dlpi_pending is modified
6538                  * only by an ipsq writer
6539                  */
6540                 ASSERT(ipsq->ipsq_xop->ipx_writer == NULL);
6541                 phyi = ipsq->ipsq_phyint;
6542                 /*
6543                  * phyi could be NULL if a phyint that is part of an
6544                  * IPMP group is being unplumbed. A more detailed
6545                  * comment is in ipmp_grp_update_kstats()
6546                  */
6547                 if (phyi != NULL) {
6548                         ill = phyi->phyint_illv4;
6549                         if (ill != NULL &&
6550                             (ill->ill_dlpi_pending != DL_PRIM_INVAL ||
6551                             ill->ill_arl_dlpi_pending))
6552                                 return (B_FALSE);
6553 
6554                         ill = phyi->phyint_illv6;
6555                         if (ill != NULL &&
6556                             ill->ill_dlpi_pending != DL_PRIM_INVAL)
6557                                 return (B_FALSE);
6558                 }
6559 
6560         } while ((ipsq = ipsq->ipsq_next) != ipsq_start);
6561 
6562         return (B_TRUE);
6563 }
6564 
6565 /*
6566  * Enter the ipsq corresponding to ill, by waiting synchronously till
6567  * we can enter the ipsq exclusively. Unless 'force' is used, the ipsq
6568  * will have to drain completely before ipsq_enter returns success.
6569  * ipx_current_ipif will be set if some exclusive op is in progress,
6570  * and the ipsq_exit logic will start the next enqueued op after
6571  * completion of the current op. If 'force' is used, we don't wait
6572  * for the enqueued ops. This is needed when a conn_close wants to
6573  * enter the ipsq and abort an ioctl that is somehow stuck. Unplumb
6574  * of an ill can also use this option. But we dont' use it currently.
6575  */
6576 #define ENTER_SQ_WAIT_TICKS 100
6577 boolean_t
6578 ipsq_enter(ill_t *ill, boolean_t force, int type)
6579 {
6580         ipsq_t  *ipsq;
6581         ipxop_t *ipx;
6582         boolean_t waited_enough = B_FALSE;
6583         ip_stack_t *ipst = ill->ill_ipst;
6584 
6585         /*
6586          * Note that the relationship between ill and ipsq is fixed as long as
6587          * the ill is not ILL_CONDEMNED.  Holding ipsq_lock ensures the
6588          * relationship between the IPSQ and xop cannot change.  However,
6589          * since we cannot hold ipsq_lock across the cv_wait(), it may change
6590          * while we're waiting.  We wait on ill_cv and rely on ipsq_exit()
6591          * waking up all ills in the xop when it becomes available.
6592          */
6593         for (;;) {
6594                 rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6595                 mutex_enter(&ill->ill_lock);
6596                 if (ill->ill_state_flags & ILL_CONDEMNED) {
6597                         mutex_exit(&ill->ill_lock);
6598                         rw_exit(&ipst->ips_ill_g_lock);
6599                         return (B_FALSE);
6600                 }
6601 
6602                 ipsq = ill->ill_phyint->phyint_ipsq;
6603                 mutex_enter(&ipsq->ipsq_lock);
6604                 ipx = ipsq->ipsq_xop;
6605                 mutex_enter(&ipx->ipx_lock);
6606 
6607                 if (ipx->ipx_writer == NULL && (type == CUR_OP ||
6608                     (ipx->ipx_current_ipif == NULL && ipsq_dlpi_done(ipsq)) ||
6609                     waited_enough))
6610                         break;
6611 
6612                 rw_exit(&ipst->ips_ill_g_lock);
6613 
6614                 if (!force || ipx->ipx_writer != NULL) {
6615                         mutex_exit(&ipx->ipx_lock);
6616                         mutex_exit(&ipsq->ipsq_lock);
6617                         cv_wait(&ill->ill_cv, &ill->ill_lock);
6618                 } else {
6619                         mutex_exit(&ipx->ipx_lock);
6620                         mutex_exit(&ipsq->ipsq_lock);
6621                         (void) cv_reltimedwait(&ill->ill_cv,
6622                             &ill->ill_lock, ENTER_SQ_WAIT_TICKS, TR_CLOCK_TICK);
6623                         waited_enough = B_TRUE;
6624                 }
6625                 mutex_exit(&ill->ill_lock);
6626         }
6627 
6628         ASSERT(ipx->ipx_mphead == NULL && ipx->ipx_mptail == NULL);
6629         ASSERT(ipx->ipx_reentry_cnt == 0);
6630         ipx->ipx_writer = curthread;
6631         ipx->ipx_forced = (ipx->ipx_current_ipif != NULL);
6632         ipx->ipx_reentry_cnt++;
6633 #ifdef DEBUG
6634         ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6635 #endif
6636         mutex_exit(&ipx->ipx_lock);
6637         mutex_exit(&ipsq->ipsq_lock);
6638         mutex_exit(&ill->ill_lock);
6639         rw_exit(&ipst->ips_ill_g_lock);
6640 
6641         return (B_TRUE);
6642 }
6643 
6644 /*
6645  * ipif_set_values() has a constraint that it cannot drop the ips_ill_g_lock
6646  * across the call to the core interface ipsq_try_enter() and hence calls this
6647  * function directly. This is explained more fully in ipif_set_values().
6648  * In order to support the above constraint, ipsq_try_enter is implemented as
6649  * a wrapper that grabs the ips_ill_g_lock and calls this function subsequently
6650  */
6651 static ipsq_t *
6652 ipsq_try_enter_internal(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func,
6653     int type, boolean_t reentry_ok)
6654 {
6655         ipsq_t  *ipsq;
6656         ipxop_t *ipx;
6657         ip_stack_t *ipst = ill->ill_ipst;
6658 
6659         /*
6660          * lock ordering:
6661          * ill_g_lock -> conn_lock -> ill_lock -> ipsq_lock -> ipx_lock.
6662          *
6663          * ipx of an ipsq can't change when ipsq_lock is held.
6664          */
6665         ASSERT(RW_LOCK_HELD(&ipst->ips_ill_g_lock));
6666         GRAB_CONN_LOCK(q);
6667         mutex_enter(&ill->ill_lock);
6668         ipsq = ill->ill_phyint->phyint_ipsq;
6669         mutex_enter(&ipsq->ipsq_lock);
6670         ipx = ipsq->ipsq_xop;
6671         mutex_enter(&ipx->ipx_lock);
6672 
6673         /*
6674          * 1. Enter the ipsq if we are already writer and reentry is ok.
6675          *    (Note: If the caller does not specify reentry_ok then neither
6676          *    'func' nor any of its callees must ever attempt to enter the ipsq
6677          *    again. Otherwise it can lead to an infinite loop
6678          * 2. Enter the ipsq if there is no current writer and this attempted
6679          *    entry is part of the current operation
6680          * 3. Enter the ipsq if there is no current writer and this is a new
6681          *    operation and the operation queue is empty and there is no
6682          *    operation currently in progress and if all previously initiated
6683          *    DLPI operations have completed.
6684          */
6685         if ((ipx->ipx_writer == curthread && reentry_ok) ||
6686             (ipx->ipx_writer == NULL && (type == CUR_OP || (type == NEW_OP &&
6687             !ipx->ipx_ipsq_queued && ipx->ipx_current_ipif == NULL &&
6688             ipsq_dlpi_done(ipsq))))) {
6689                 /* Success. */
6690                 ipx->ipx_reentry_cnt++;
6691                 ipx->ipx_writer = curthread;
6692                 ipx->ipx_forced = B_FALSE;
6693                 mutex_exit(&ipx->ipx_lock);
6694                 mutex_exit(&ipsq->ipsq_lock);
6695                 mutex_exit(&ill->ill_lock);
6696                 RELEASE_CONN_LOCK(q);
6697 #ifdef DEBUG
6698                 ipx->ipx_depth = getpcstack(ipx->ipx_stack, IPX_STACK_DEPTH);
6699 #endif
6700                 return (ipsq);
6701         }
6702 
6703         if (func != NULL)
6704                 ipsq_enq(ipsq, q, mp, func, type, ill);
6705 
6706         mutex_exit(&ipx->ipx_lock);
6707         mutex_exit(&ipsq->ipsq_lock);
6708         mutex_exit(&ill->ill_lock);
6709         RELEASE_CONN_LOCK(q);
6710         return (NULL);
6711 }
6712 
6713 /*
6714  * The ipsq_t (ipsq) is the synchronization data structure used to serialize
6715  * certain critical operations like plumbing (i.e. most set ioctls), etc.
6716  * There is one ipsq per phyint. The ipsq
6717  * serializes exclusive ioctls issued by applications on a per ipsq basis in
6718  * ipsq_xopq_mphead. It also protects against multiple threads executing in
6719  * the ipsq. Responses from the driver pertain to the current ioctl (say a
6720  * DL_BIND_ACK in response to a DL_BIND_REQ initiated as part of bringing
6721  * up the interface) and are enqueued in ipx_mphead.
6722  *
6723  * If a thread does not want to reenter the ipsq when it is already writer,
6724  * it must make sure that the specified reentry point to be called later
6725  * when the ipsq is empty, nor any code path starting from the specified reentry
6726  * point must never ever try to enter the ipsq again. Otherwise it can lead
6727  * to an infinite loop. The reentry point ip_rput_dlpi_writer is an example.
6728  * When the thread that is currently exclusive finishes, it (ipsq_exit)
6729  * dequeues the requests waiting to become exclusive in ipx_mphead and calls
6730  * the reentry point. When the list at ipx_mphead becomes empty ipsq_exit
6731  * proceeds to dequeue the next ioctl in ipsq_xopq_mphead and start the next
6732  * ioctl if the current ioctl has completed. If the current ioctl is still
6733  * in progress it simply returns. The current ioctl could be waiting for
6734  * a response from another module (the driver or could be waiting for
6735  * the ipif/ill/ire refcnts to drop to zero. In such a case the ipx_pending_mp
6736  * and ipx_pending_ipif are set. ipx_current_ipif is set throughout the
6737  * execution of the ioctl and ipsq_exit does not start the next ioctl unless
6738  * ipx_current_ipif is NULL which happens only once the ioctl is complete and
6739  * all associated DLPI operations have completed.
6740  */
6741 
6742 /*
6743  * Try to enter the IPSQ corresponding to `ipif' or `ill' exclusively (`ipif'
6744  * and `ill' cannot both be specified).  Returns a pointer to the entered IPSQ
6745  * on success, or NULL on failure.  The caller ensures ipif/ill is valid by
6746  * refholding it as necessary.  If the IPSQ cannot be entered and `func' is
6747  * non-NULL, then `func' will be called back with `q' and `mp' once the IPSQ
6748  * can be entered.  If `func' is NULL, then `q' and `mp' are ignored.
6749  */
6750 ipsq_t *
6751 ipsq_try_enter(ipif_t *ipif, ill_t *ill, queue_t *q, mblk_t *mp,
6752     ipsq_func_t func, int type, boolean_t reentry_ok)
6753 {
6754         ip_stack_t      *ipst;
6755         ipsq_t          *ipsq;
6756 
6757         /* Only 1 of ipif or ill can be specified */
6758         ASSERT((ipif != NULL) ^ (ill != NULL));
6759 
6760         if (ipif != NULL)
6761                 ill = ipif->ipif_ill;
6762         ipst = ill->ill_ipst;
6763 
6764         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
6765         ipsq = ipsq_try_enter_internal(ill, q, mp, func, type, reentry_ok);
6766         rw_exit(&ipst->ips_ill_g_lock);
6767 
6768         return (ipsq);
6769 }
6770 
6771 /*
6772  * Try to enter the IPSQ corresponding to `ill' as writer.  The caller ensures
6773  * ill is valid by refholding it if necessary; we will refrele.  If the IPSQ
6774  * cannot be entered, the mp is queued for completion.
6775  */
6776 void
6777 qwriter_ip(ill_t *ill, queue_t *q, mblk_t *mp, ipsq_func_t func, int type,
6778     boolean_t reentry_ok)
6779 {
6780         ipsq_t  *ipsq;
6781 
6782         ipsq = ipsq_try_enter(NULL, ill, q, mp, func, type, reentry_ok);
6783 
6784         /*
6785          * Drop the caller's refhold on the ill.  This is safe since we either
6786          * entered the IPSQ (and thus are exclusive), or failed to enter the
6787          * IPSQ, in which case we return without accessing ill anymore.  This
6788          * is needed because func needs to see the correct refcount.
6789          * e.g. removeif can work only then.
6790          */
6791         ill_refrele(ill);
6792         if (ipsq != NULL) {
6793                 (*func)(ipsq, q, mp, NULL);
6794                 ipsq_exit(ipsq);
6795         }
6796 }
6797 
6798 /*
6799  * Exit the specified IPSQ.  If this is the final exit on it then drain it
6800  * prior to exiting.  Caller must be writer on the specified IPSQ.
6801  */
6802 void
6803 ipsq_exit(ipsq_t *ipsq)
6804 {
6805         mblk_t *mp;
6806         ipsq_t *mp_ipsq;
6807         queue_t *q;
6808         phyint_t *phyi;
6809         ipsq_func_t func;
6810 
6811         ASSERT(IAM_WRITER_IPSQ(ipsq));
6812 
6813         ASSERT(ipsq->ipsq_xop->ipx_reentry_cnt >= 1);
6814         if (ipsq->ipsq_xop->ipx_reentry_cnt != 1) {
6815                 ipsq->ipsq_xop->ipx_reentry_cnt--;
6816                 return;
6817         }
6818 
6819         for (;;) {
6820                 phyi = ipsq->ipsq_phyint;
6821                 mp = ipsq_dq(ipsq);
6822                 mp_ipsq = (mp == NULL) ? NULL : (ipsq_t *)mp->b_next;
6823 
6824                 /*
6825                  * If we've changed to a new IPSQ, and the phyint associated
6826                  * with the old one has gone away, free the old IPSQ.  Note
6827                  * that this cannot happen while the IPSQ is in a group.
6828                  */
6829                 if (mp_ipsq != ipsq && phyi == NULL) {
6830                         ASSERT(ipsq->ipsq_next == ipsq);
6831                         ASSERT(ipsq->ipsq_xop == &ipsq->ipsq_ownxop);
6832                         ipsq_delete(ipsq);
6833                 }
6834 
6835                 if (mp == NULL)
6836                         break;
6837 
6838                 q = mp->b_queue;
6839                 func = (ipsq_func_t)mp->b_prev;
6840                 ipsq = mp_ipsq;
6841                 mp->b_next = mp->b_prev = NULL;
6842                 mp->b_queue = NULL;
6843 
6844                 /*
6845                  * If 'q' is an conn queue, it is valid, since we did a
6846                  * a refhold on the conn at the start of the ioctl.
6847                  * If 'q' is an ill queue, it is valid, since close of an
6848                  * ill will clean up its IPSQ.
6849                  */
6850                 (*func)(ipsq, q, mp, NULL);
6851         }
6852 }
6853 
6854 /*
6855  * Used to start any igmp or mld timers that could not be started
6856  * while holding ill_mcast_lock. The timers can't be started while holding
6857  * the lock, since mld/igmp_start_timers may need to call untimeout()
6858  * which can't be done while holding the lock which the timeout handler
6859  * acquires. Otherwise
6860  * there could be a deadlock since the timeout handlers
6861  * mld_timeout_handler_per_ill/igmp_timeout_handler_per_ill also acquire
6862  * ill_mcast_lock.
6863  */
6864 void
6865 ill_mcast_timer_start(ip_stack_t *ipst)
6866 {
6867         int             next;
6868 
6869         mutex_enter(&ipst->ips_igmp_timer_lock);
6870         next = ipst->ips_igmp_deferred_next;
6871         ipst->ips_igmp_deferred_next = INFINITY;
6872         mutex_exit(&ipst->ips_igmp_timer_lock);
6873 
6874         if (next != INFINITY)
6875                 igmp_start_timers(next, ipst);
6876 
6877         mutex_enter(&ipst->ips_mld_timer_lock);
6878         next = ipst->ips_mld_deferred_next;
6879         ipst->ips_mld_deferred_next = INFINITY;
6880         mutex_exit(&ipst->ips_mld_timer_lock);
6881 
6882         if (next != INFINITY)
6883                 mld_start_timers(next, ipst);
6884 }
6885 
6886 /*
6887  * Start the current exclusive operation on `ipsq'; associate it with `ipif'
6888  * and `ioccmd'.
6889  */
6890 void
6891 ipsq_current_start(ipsq_t *ipsq, ipif_t *ipif, int ioccmd)
6892 {
6893         ill_t *ill = ipif->ipif_ill;
6894         ipxop_t *ipx = ipsq->ipsq_xop;
6895 
6896         ASSERT(IAM_WRITER_IPSQ(ipsq));
6897         ASSERT(ipx->ipx_current_ipif == NULL);
6898         ASSERT(ipx->ipx_current_ioctl == 0);
6899 
6900         ipx->ipx_current_done = B_FALSE;
6901         ipx->ipx_current_ioctl = ioccmd;
6902         mutex_enter(&ipx->ipx_lock);
6903         ipx->ipx_current_ipif = ipif;
6904         mutex_exit(&ipx->ipx_lock);
6905 
6906         /*
6907          * Set IPIF_CHANGING on one or more ipifs associated with the
6908          * current exclusive operation.  IPIF_CHANGING prevents any new
6909          * references to the ipif (so that the references will eventually
6910          * drop to zero) and also prevents any "get" operations (e.g.,
6911          * SIOCGLIFFLAGS) from being able to access the ipif until the
6912          * operation has completed and the ipif is again in a stable state.
6913          *
6914          * For ioctls, IPIF_CHANGING is set on the ipif associated with the
6915          * ioctl.  For internal operations (where ioccmd is zero), all ipifs
6916          * on the ill are marked with IPIF_CHANGING since it's unclear which
6917          * ipifs will be affected.
6918          *
6919          * Note that SIOCLIFREMOVEIF is a special case as it sets
6920          * IPIF_CONDEMNED internally after identifying the right ipif to
6921          * operate on.
6922          */
6923         switch (ioccmd) {
6924         case SIOCLIFREMOVEIF:
6925                 break;
6926         case 0:
6927                 mutex_enter(&ill->ill_lock);
6928                 ipif = ipif->ipif_ill->ill_ipif;
6929                 for (; ipif != NULL; ipif = ipif->ipif_next)
6930                         ipif->ipif_state_flags |= IPIF_CHANGING;
6931                 mutex_exit(&ill->ill_lock);
6932                 break;
6933         default:
6934                 mutex_enter(&ill->ill_lock);
6935                 ipif->ipif_state_flags |= IPIF_CHANGING;
6936                 mutex_exit(&ill->ill_lock);
6937         }
6938 }
6939 
6940 /*
6941  * Finish the current exclusive operation on `ipsq'.  Usually, this will allow
6942  * the next exclusive operation to begin once we ipsq_exit().  However, if
6943  * pending DLPI operations remain, then we will wait for the queue to drain
6944  * before allowing the next exclusive operation to begin.  This ensures that
6945  * DLPI operations from one exclusive operation are never improperly processed
6946  * as part of a subsequent exclusive operation.
6947  */
6948 void
6949 ipsq_current_finish(ipsq_t *ipsq)
6950 {
6951         ipxop_t *ipx = ipsq->ipsq_xop;
6952         t_uscalar_t dlpi_pending = DL_PRIM_INVAL;
6953         ipif_t  *ipif = ipx->ipx_current_ipif;
6954 
6955         ASSERT(IAM_WRITER_IPSQ(ipsq));
6956 
6957         /*
6958          * For SIOCLIFREMOVEIF, the ipif has been already been blown away
6959          * (but in that case, IPIF_CHANGING will already be clear and no
6960          * pending DLPI messages can remain).
6961          */
6962         if (ipx->ipx_current_ioctl != SIOCLIFREMOVEIF) {
6963                 ill_t *ill = ipif->ipif_ill;
6964 
6965                 mutex_enter(&ill->ill_lock);
6966                 dlpi_pending = ill->ill_dlpi_pending;
6967                 if (ipx->ipx_current_ioctl == 0) {
6968                         ipif = ill->ill_ipif;
6969                         for (; ipif != NULL; ipif = ipif->ipif_next)
6970                                 ipif->ipif_state_flags &= ~IPIF_CHANGING;
6971                 } else {
6972                         ipif->ipif_state_flags &= ~IPIF_CHANGING;
6973                 }
6974                 mutex_exit(&ill->ill_lock);
6975         }
6976 
6977         ASSERT(!ipx->ipx_current_done);
6978         ipx->ipx_current_done = B_TRUE;
6979         ipx->ipx_current_ioctl = 0;
6980         if (dlpi_pending == DL_PRIM_INVAL) {
6981                 mutex_enter(&ipx->ipx_lock);
6982                 ipx->ipx_current_ipif = NULL;
6983                 mutex_exit(&ipx->ipx_lock);
6984         }
6985 }
6986 
6987 /*
6988  * The ill is closing. Flush all messages on the ipsq that originated
6989  * from this ill. Usually there wont' be any messages on the ipsq_xopq_mphead
6990  * for this ill since ipsq_enter could not have entered until then.
6991  * New messages can't be queued since the CONDEMNED flag is set.
6992  */
6993 static void
6994 ipsq_flush(ill_t *ill)
6995 {
6996         queue_t *q;
6997         mblk_t  *prev;
6998         mblk_t  *mp;
6999         mblk_t  *mp_next;
7000         ipxop_t *ipx = ill->ill_phyint->phyint_ipsq->ipsq_xop;
7001 
7002         ASSERT(IAM_WRITER_ILL(ill));
7003 
7004         /*
7005          * Flush any messages sent up by the driver.
7006          */
7007         mutex_enter(&ipx->ipx_lock);
7008         for (prev = NULL, mp = ipx->ipx_mphead; mp != NULL; mp = mp_next) {
7009                 mp_next = mp->b_next;
7010                 q = mp->b_queue;
7011                 if (q == ill->ill_rq || q == ill->ill_wq) {
7012                         /* dequeue mp */
7013                         if (prev == NULL)
7014                                 ipx->ipx_mphead = mp->b_next;
7015                         else
7016                                 prev->b_next = mp->b_next;
7017                         if (ipx->ipx_mptail == mp) {
7018                                 ASSERT(mp_next == NULL);
7019                                 ipx->ipx_mptail = prev;
7020                         }
7021                         inet_freemsg(mp);
7022                 } else {
7023                         prev = mp;
7024                 }
7025         }
7026         mutex_exit(&ipx->ipx_lock);
7027         (void) ipsq_pending_mp_cleanup(ill, NULL);
7028         ipsq_xopq_mp_cleanup(ill, NULL);
7029 }
7030 
7031 /*
7032  * Parse an ifreq or lifreq struct coming down ioctls and refhold
7033  * and return the associated ipif.
7034  * Return value:
7035  *      Non zero: An error has occurred. ci may not be filled out.
7036  *      zero : ci is filled out with the ioctl cmd in ci.ci_name, and
7037  *      a held ipif in ci.ci_ipif.
7038  */
7039 int
7040 ip_extract_lifreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
7041     cmd_info_t *ci)
7042 {
7043         char            *name;
7044         struct ifreq    *ifr;
7045         struct lifreq    *lifr;
7046         ipif_t          *ipif = NULL;
7047         ill_t           *ill;
7048         conn_t          *connp;
7049         boolean_t       isv6;
7050         int             err;
7051         mblk_t          *mp1;
7052         zoneid_t        zoneid;
7053         ip_stack_t      *ipst;
7054 
7055         if (q->q_next != NULL) {
7056                 ill = (ill_t *)q->q_ptr;
7057                 isv6 = ill->ill_isv6;
7058                 connp = NULL;
7059                 zoneid = ALL_ZONES;
7060                 ipst = ill->ill_ipst;
7061         } else {
7062                 ill = NULL;
7063                 connp = Q_TO_CONN(q);
7064                 isv6 = (connp->conn_family == AF_INET6);
7065                 zoneid = connp->conn_zoneid;
7066                 if (zoneid == GLOBAL_ZONEID) {
7067                         /* global zone can access ipifs in all zones */
7068                         zoneid = ALL_ZONES;
7069                 }
7070                 ipst = connp->conn_netstack->netstack_ip;
7071         }
7072 
7073         /* Has been checked in ip_wput_nondata */
7074         mp1 = mp->b_cont->b_cont;
7075 
7076         if (ipip->ipi_cmd_type == IF_CMD) {
7077                 /* This a old style SIOC[GS]IF* command */
7078                 ifr = (struct ifreq *)mp1->b_rptr;
7079                 /*
7080                  * Null terminate the string to protect against buffer
7081                  * overrun. String was generated by user code and may not
7082                  * be trusted.
7083                  */
7084                 ifr->ifr_name[IFNAMSIZ - 1] = '\0';
7085                 name = ifr->ifr_name;
7086                 ci->ci_sin = (sin_t *)&ifr->ifr_addr;
7087                 ci->ci_sin6 = NULL;
7088                 ci->ci_lifr = (struct lifreq *)ifr;
7089         } else {
7090                 /* This a new style SIOC[GS]LIF* command */
7091                 ASSERT(ipip->ipi_cmd_type == LIF_CMD);
7092                 lifr = (struct lifreq *)mp1->b_rptr;
7093                 /*
7094                  * Null terminate the string to protect against buffer
7095                  * overrun. String was generated by user code and may not
7096                  * be trusted.
7097                  */
7098                 lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
7099                 name = lifr->lifr_name;
7100                 ci->ci_sin = (sin_t *)&lifr->lifr_addr;
7101                 ci->ci_sin6 = (sin6_t *)&lifr->lifr_addr;
7102                 ci->ci_lifr = lifr;
7103         }
7104 
7105         if (ipip->ipi_cmd == SIOCSLIFNAME) {
7106                 /*
7107                  * The ioctl will be failed if the ioctl comes down
7108                  * an conn stream
7109                  */
7110                 if (ill == NULL) {
7111                         /*
7112                          * Not an ill queue, return EINVAL same as the
7113                          * old error code.
7114                          */
7115                         return (ENXIO);
7116                 }
7117                 ipif = ill->ill_ipif;
7118                 ipif_refhold(ipif);
7119         } else {
7120                 /*
7121                  * Ensure that ioctls don't see any internal state changes
7122                  * caused by set ioctls by deferring them if IPIF_CHANGING is
7123                  * set.
7124                  */
7125                 ipif = ipif_lookup_on_name_async(name, mi_strlen(name),
7126                     isv6, zoneid, q, mp, ip_process_ioctl, &err, ipst);
7127                 if (ipif == NULL) {
7128                         if (err == EINPROGRESS)
7129                                 return (err);
7130                         err = 0;        /* Ensure we don't use it below */
7131                 }
7132         }
7133 
7134         /*
7135          * Old style [GS]IFCMD does not admit IPv6 ipif
7136          */
7137         if (ipif != NULL && ipif->ipif_isv6 && ipip->ipi_cmd_type == IF_CMD) {
7138                 ipif_refrele(ipif);
7139                 return (ENXIO);
7140         }
7141 
7142         if (ipif == NULL && ill != NULL && ill->ill_ipif != NULL &&
7143             name[0] == '\0') {
7144                 /*
7145                  * Handle a or a SIOC?IF* with a null name
7146                  * during plumb (on the ill queue before the I_PLINK).
7147                  */
7148                 ipif = ill->ill_ipif;
7149                 ipif_refhold(ipif);
7150         }
7151 
7152         if (ipif == NULL)
7153                 return (ENXIO);
7154 
7155         DTRACE_PROBE4(ipif__ioctl, char *, "ip_extract_lifreq",
7156             int, ipip->ipi_cmd, ill_t *, ipif->ipif_ill, ipif_t *, ipif);
7157 
7158         ci->ci_ipif = ipif;
7159         return (0);
7160 }
7161 
7162 /*
7163  * Return the total number of ipifs.
7164  */
7165 static uint_t
7166 ip_get_numifs(zoneid_t zoneid, ip_stack_t *ipst)
7167 {
7168         uint_t numifs = 0;
7169         ill_t   *ill;
7170         ill_walk_context_t      ctx;
7171         ipif_t  *ipif;
7172 
7173         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7174         ill = ILL_START_WALK_V4(&ctx, ipst);
7175         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7176                 if (IS_UNDER_IPMP(ill))
7177                         continue;
7178                 for (ipif = ill->ill_ipif; ipif != NULL;
7179                     ipif = ipif->ipif_next) {
7180                         if (ipif->ipif_zoneid == zoneid ||
7181                             ipif->ipif_zoneid == ALL_ZONES)
7182                                 numifs++;
7183                 }
7184         }
7185         rw_exit(&ipst->ips_ill_g_lock);
7186         return (numifs);
7187 }
7188 
7189 /*
7190  * Return the total number of ipifs.
7191  */
7192 static uint_t
7193 ip_get_numlifs(int family, int lifn_flags, zoneid_t zoneid, ip_stack_t *ipst)
7194 {
7195         uint_t numifs = 0;
7196         ill_t   *ill;
7197         ipif_t  *ipif;
7198         ill_walk_context_t      ctx;
7199 
7200         ip1dbg(("ip_get_numlifs(%d %u %d)\n", family, lifn_flags, (int)zoneid));
7201 
7202         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7203         if (family == AF_INET)
7204                 ill = ILL_START_WALK_V4(&ctx, ipst);
7205         else if (family == AF_INET6)
7206                 ill = ILL_START_WALK_V6(&ctx, ipst);
7207         else
7208                 ill = ILL_START_WALK_ALL(&ctx, ipst);
7209 
7210         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7211                 if (IS_UNDER_IPMP(ill) && !(lifn_flags & LIFC_UNDER_IPMP))
7212                         continue;
7213 
7214                 for (ipif = ill->ill_ipif; ipif != NULL;
7215                     ipif = ipif->ipif_next) {
7216                         if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7217                             !(lifn_flags & LIFC_NOXMIT))
7218                                 continue;
7219                         if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7220                             !(lifn_flags & LIFC_TEMPORARY))
7221                                 continue;
7222                         if (((ipif->ipif_flags &
7223                             (IPIF_NOXMIT|IPIF_NOLOCAL|
7224                             IPIF_DEPRECATED)) ||
7225                             IS_LOOPBACK(ill) ||
7226                             !(ipif->ipif_flags & IPIF_UP)) &&
7227                             (lifn_flags & LIFC_EXTERNAL_SOURCE))
7228                                 continue;
7229 
7230                         if (zoneid != ipif->ipif_zoneid &&
7231                             ipif->ipif_zoneid != ALL_ZONES &&
7232                             (zoneid != GLOBAL_ZONEID ||
7233                             !(lifn_flags & LIFC_ALLZONES)))
7234                                 continue;
7235 
7236                         numifs++;
7237                 }
7238         }
7239         rw_exit(&ipst->ips_ill_g_lock);
7240         return (numifs);
7241 }
7242 
7243 uint_t
7244 ip_get_lifsrcofnum(ill_t *ill)
7245 {
7246         uint_t numifs = 0;
7247         ill_t   *ill_head = ill;
7248         ip_stack_t      *ipst = ill->ill_ipst;
7249 
7250         /*
7251          * ill_g_usesrc_lock protects ill_usesrc_grp_next, for example, some
7252          * other thread may be trying to relink the ILLs in this usesrc group
7253          * and adjusting the ill_usesrc_grp_next pointers
7254          */
7255         rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7256         if ((ill->ill_usesrc_ifindex == 0) &&
7257             (ill->ill_usesrc_grp_next != NULL)) {
7258                 for (; (ill != NULL) && (ill->ill_usesrc_grp_next != ill_head);
7259                     ill = ill->ill_usesrc_grp_next)
7260                         numifs++;
7261         }
7262         rw_exit(&ipst->ips_ill_g_usesrc_lock);
7263 
7264         return (numifs);
7265 }
7266 
7267 /* Null values are passed in for ipif, sin, and ifreq */
7268 /* ARGSUSED */
7269 int
7270 ip_sioctl_get_ifnum(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7271     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7272 {
7273         int *nump;
7274         conn_t *connp = Q_TO_CONN(q);
7275 
7276         ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7277 
7278         /* Existence of b_cont->b_cont checked in ip_wput_nondata */
7279         nump = (int *)mp->b_cont->b_cont->b_rptr;
7280 
7281         *nump = ip_get_numifs(connp->conn_zoneid,
7282             connp->conn_netstack->netstack_ip);
7283         ip1dbg(("ip_sioctl_get_ifnum numifs %d", *nump));
7284         return (0);
7285 }
7286 
7287 /* Null values are passed in for ipif, sin, and ifreq */
7288 /* ARGSUSED */
7289 int
7290 ip_sioctl_get_lifnum(ipif_t *dummy_ipif, sin_t *dummy_sin,
7291     queue_t *q, mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7292 {
7293         struct lifnum *lifn;
7294         mblk_t  *mp1;
7295         conn_t *connp = Q_TO_CONN(q);
7296 
7297         ASSERT(q->q_next == NULL); /* not a valid ioctl for ip as a module */
7298 
7299         /* Existence checked in ip_wput_nondata */
7300         mp1 = mp->b_cont->b_cont;
7301 
7302         lifn = (struct lifnum *)mp1->b_rptr;
7303         switch (lifn->lifn_family) {
7304         case AF_UNSPEC:
7305         case AF_INET:
7306         case AF_INET6:
7307                 break;
7308         default:
7309                 return (EAFNOSUPPORT);
7310         }
7311 
7312         lifn->lifn_count = ip_get_numlifs(lifn->lifn_family, lifn->lifn_flags,
7313             connp->conn_zoneid, connp->conn_netstack->netstack_ip);
7314         ip1dbg(("ip_sioctl_get_lifnum numifs %d", lifn->lifn_count));
7315         return (0);
7316 }
7317 
7318 /* ARGSUSED */
7319 int
7320 ip_sioctl_get_ifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7321     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7322 {
7323         STRUCT_HANDLE(ifconf, ifc);
7324         mblk_t *mp1;
7325         struct iocblk *iocp;
7326         struct ifreq *ifr;
7327         ill_walk_context_t      ctx;
7328         ill_t   *ill;
7329         ipif_t  *ipif;
7330         struct sockaddr_in *sin;
7331         int32_t ifclen;
7332         zoneid_t zoneid;
7333         ip_stack_t *ipst = CONNQ_TO_IPST(q);
7334 
7335         ASSERT(q->q_next == NULL); /* not valid ioctls for ip as a module */
7336 
7337         ip1dbg(("ip_sioctl_get_ifconf"));
7338         /* Existence verified in ip_wput_nondata */
7339         mp1 = mp->b_cont->b_cont;
7340         iocp = (struct iocblk *)mp->b_rptr;
7341         zoneid = Q_TO_CONN(q)->conn_zoneid;
7342 
7343         /*
7344          * The original SIOCGIFCONF passed in a struct ifconf which specified
7345          * the user buffer address and length into which the list of struct
7346          * ifreqs was to be copied.  Since AT&T Streams does not seem to
7347          * allow M_COPYOUT to be used in conjunction with I_STR IOCTLS,
7348          * the SIOCGIFCONF operation was redefined to simply provide
7349          * a large output buffer into which we are supposed to jam the ifreq
7350          * array.  The same ioctl command code was used, despite the fact that
7351          * both the applications and the kernel code had to change, thus making
7352          * it impossible to support both interfaces.
7353          *
7354          * For reasons not good enough to try to explain, the following
7355          * algorithm is used for deciding what to do with one of these:
7356          * If the IOCTL comes in as an I_STR, it is assumed to be of the new
7357          * form with the output buffer coming down as the continuation message.
7358          * If it arrives as a TRANSPARENT IOCTL, it is assumed to be old style,
7359          * and we have to copy in the ifconf structure to find out how big the
7360          * output buffer is and where to copy out to.  Sure no problem...
7361          *
7362          */
7363         STRUCT_SET_HANDLE(ifc, iocp->ioc_flag, NULL);
7364         if ((mp1->b_wptr - mp1->b_rptr) == STRUCT_SIZE(ifc)) {
7365                 int numifs = 0;
7366                 size_t ifc_bufsize;
7367 
7368                 /*
7369                  * Must be (better be!) continuation of a TRANSPARENT
7370                  * IOCTL.  We just copied in the ifconf structure.
7371                  */
7372                 STRUCT_SET_HANDLE(ifc, iocp->ioc_flag,
7373                     (struct ifconf *)mp1->b_rptr);
7374 
7375                 /*
7376                  * Allocate a buffer to hold requested information.
7377                  *
7378                  * If ifc_len is larger than what is needed, we only
7379                  * allocate what we will use.
7380                  *
7381                  * If ifc_len is smaller than what is needed, return
7382                  * EINVAL.
7383                  *
7384                  * XXX: the ill_t structure can hava 2 counters, for
7385                  * v4 and v6 (not just ill_ipif_up_count) to store the
7386                  * number of interfaces for a device, so we don't need
7387                  * to count them here...
7388                  */
7389                 numifs = ip_get_numifs(zoneid, ipst);
7390 
7391                 ifclen = STRUCT_FGET(ifc, ifc_len);
7392                 ifc_bufsize = numifs * sizeof (struct ifreq);
7393                 if (ifc_bufsize > ifclen) {
7394                         if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7395                                 /* old behaviour */
7396                                 return (EINVAL);
7397                         } else {
7398                                 ifc_bufsize = ifclen;
7399                         }
7400                 }
7401 
7402                 mp1 = mi_copyout_alloc(q, mp,
7403                     STRUCT_FGETP(ifc, ifc_buf), ifc_bufsize, B_FALSE);
7404                 if (mp1 == NULL)
7405                         return (ENOMEM);
7406 
7407                 mp1->b_wptr = mp1->b_rptr + ifc_bufsize;
7408         }
7409         bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7410         /*
7411          * the SIOCGIFCONF ioctl only knows about
7412          * IPv4 addresses, so don't try to tell
7413          * it about interfaces with IPv6-only
7414          * addresses. (Last parm 'isv6' is B_FALSE)
7415          */
7416 
7417         ifr = (struct ifreq *)mp1->b_rptr;
7418 
7419         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7420         ill = ILL_START_WALK_V4(&ctx, ipst);
7421         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7422                 if (IS_UNDER_IPMP(ill))
7423                         continue;
7424                 for (ipif = ill->ill_ipif; ipif != NULL;
7425                     ipif = ipif->ipif_next) {
7426                         if (zoneid != ipif->ipif_zoneid &&
7427                             ipif->ipif_zoneid != ALL_ZONES)
7428                                 continue;
7429                         if ((uchar_t *)&ifr[1] > mp1->b_wptr) {
7430                                 if (iocp->ioc_cmd == O_SIOCGIFCONF) {
7431                                         /* old behaviour */
7432                                         rw_exit(&ipst->ips_ill_g_lock);
7433                                         return (EINVAL);
7434                                 } else {
7435                                         goto if_copydone;
7436                                 }
7437                         }
7438                         ipif_get_name(ipif, ifr->ifr_name,
7439                             sizeof (ifr->ifr_name));
7440                         sin = (sin_t *)&ifr->ifr_addr;
7441                         *sin = sin_null;
7442                         sin->sin_family = AF_INET;
7443                         sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7444                         ifr++;
7445                 }
7446         }
7447 if_copydone:
7448         rw_exit(&ipst->ips_ill_g_lock);
7449         mp1->b_wptr = (uchar_t *)ifr;
7450 
7451         if (STRUCT_BUF(ifc) != NULL) {
7452                 STRUCT_FSET(ifc, ifc_len,
7453                     (int)((uchar_t *)ifr - mp1->b_rptr));
7454         }
7455         return (0);
7456 }
7457 
7458 /*
7459  * Get the interfaces using the address hosted on the interface passed in,
7460  * as a source adddress
7461  */
7462 /* ARGSUSED */
7463 int
7464 ip_sioctl_get_lifsrcof(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7465     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7466 {
7467         mblk_t *mp1;
7468         ill_t   *ill, *ill_head;
7469         ipif_t  *ipif, *orig_ipif;
7470         int     numlifs = 0;
7471         size_t  lifs_bufsize, lifsmaxlen;
7472         struct  lifreq *lifr;
7473         struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7474         uint_t  ifindex;
7475         zoneid_t zoneid;
7476         boolean_t isv6 = B_FALSE;
7477         struct  sockaddr_in     *sin;
7478         struct  sockaddr_in6    *sin6;
7479         STRUCT_HANDLE(lifsrcof, lifs);
7480         ip_stack_t              *ipst;
7481 
7482         ipst = CONNQ_TO_IPST(q);
7483 
7484         ASSERT(q->q_next == NULL);
7485 
7486         zoneid = Q_TO_CONN(q)->conn_zoneid;
7487 
7488         /* Existence verified in ip_wput_nondata */
7489         mp1 = mp->b_cont->b_cont;
7490 
7491         /*
7492          * Must be (better be!) continuation of a TRANSPARENT
7493          * IOCTL.  We just copied in the lifsrcof structure.
7494          */
7495         STRUCT_SET_HANDLE(lifs, iocp->ioc_flag,
7496             (struct lifsrcof *)mp1->b_rptr);
7497 
7498         if (MBLKL(mp1) != STRUCT_SIZE(lifs))
7499                 return (EINVAL);
7500 
7501         ifindex = STRUCT_FGET(lifs, lifs_ifindex);
7502         isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
7503         ipif = ipif_lookup_on_ifindex(ifindex, isv6, zoneid, ipst);
7504         if (ipif == NULL) {
7505                 ip1dbg(("ip_sioctl_get_lifsrcof: no ipif for ifindex %d\n",
7506                     ifindex));
7507                 return (ENXIO);
7508         }
7509 
7510         /* Allocate a buffer to hold requested information */
7511         numlifs = ip_get_lifsrcofnum(ipif->ipif_ill);
7512         lifs_bufsize = numlifs * sizeof (struct lifreq);
7513         lifsmaxlen =  STRUCT_FGET(lifs, lifs_maxlen);
7514         /* The actual size needed is always returned in lifs_len */
7515         STRUCT_FSET(lifs, lifs_len, lifs_bufsize);
7516 
7517         /* If the amount we need is more than what is passed in, abort */
7518         if (lifs_bufsize > lifsmaxlen || lifs_bufsize == 0) {
7519                 ipif_refrele(ipif);
7520                 return (0);
7521         }
7522 
7523         mp1 = mi_copyout_alloc(q, mp,
7524             STRUCT_FGETP(lifs, lifs_buf), lifs_bufsize, B_FALSE);
7525         if (mp1 == NULL) {
7526                 ipif_refrele(ipif);
7527                 return (ENOMEM);
7528         }
7529 
7530         mp1->b_wptr = mp1->b_rptr + lifs_bufsize;
7531         bzero(mp1->b_rptr, lifs_bufsize);
7532 
7533         lifr = (struct lifreq *)mp1->b_rptr;
7534 
7535         ill = ill_head = ipif->ipif_ill;
7536         orig_ipif = ipif;
7537 
7538         /* ill_g_usesrc_lock protects ill_usesrc_grp_next */
7539         rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_READER);
7540         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7541 
7542         ill = ill->ill_usesrc_grp_next; /* start from next ill */
7543         for (; (ill != NULL) && (ill != ill_head);
7544             ill = ill->ill_usesrc_grp_next) {
7545 
7546                 if ((uchar_t *)&lifr[1] > mp1->b_wptr)
7547                         break;
7548 
7549                 ipif = ill->ill_ipif;
7550                 ipif_get_name(ipif, lifr->lifr_name, sizeof (lifr->lifr_name));
7551                 if (ipif->ipif_isv6) {
7552                         sin6 = (sin6_t *)&lifr->lifr_addr;
7553                         *sin6 = sin6_null;
7554                         sin6->sin6_family = AF_INET6;
7555                         sin6->sin6_addr = ipif->ipif_v6lcl_addr;
7556                         lifr->lifr_addrlen = ip_mask_to_plen_v6(
7557                             &ipif->ipif_v6net_mask);
7558                 } else {
7559                         sin = (sin_t *)&lifr->lifr_addr;
7560                         *sin = sin_null;
7561                         sin->sin_family = AF_INET;
7562                         sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
7563                         lifr->lifr_addrlen = ip_mask_to_plen(
7564                             ipif->ipif_net_mask);
7565                 }
7566                 lifr++;
7567         }
7568         rw_exit(&ipst->ips_ill_g_lock);
7569         rw_exit(&ipst->ips_ill_g_usesrc_lock);
7570         ipif_refrele(orig_ipif);
7571         mp1->b_wptr = (uchar_t *)lifr;
7572         STRUCT_FSET(lifs, lifs_len, (int)((uchar_t *)lifr - mp1->b_rptr));
7573 
7574         return (0);
7575 }
7576 
7577 /* ARGSUSED */
7578 int
7579 ip_sioctl_get_lifconf(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q,
7580     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *ifreq)
7581 {
7582         mblk_t *mp1;
7583         int     list;
7584         ill_t   *ill;
7585         ipif_t  *ipif;
7586         int     flags;
7587         int     numlifs = 0;
7588         size_t  lifc_bufsize;
7589         struct  lifreq *lifr;
7590         sa_family_t     family;
7591         struct  sockaddr_in     *sin;
7592         struct  sockaddr_in6    *sin6;
7593         ill_walk_context_t      ctx;
7594         struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7595         int32_t lifclen;
7596         zoneid_t zoneid;
7597         STRUCT_HANDLE(lifconf, lifc);
7598         ip_stack_t *ipst = CONNQ_TO_IPST(q);
7599 
7600         ip1dbg(("ip_sioctl_get_lifconf"));
7601 
7602         ASSERT(q->q_next == NULL);
7603 
7604         zoneid = Q_TO_CONN(q)->conn_zoneid;
7605 
7606         /* Existence verified in ip_wput_nondata */
7607         mp1 = mp->b_cont->b_cont;
7608 
7609         /*
7610          * An extended version of SIOCGIFCONF that takes an
7611          * additional address family and flags field.
7612          * AF_UNSPEC retrieve both IPv4 and IPv6.
7613          * Unless LIFC_NOXMIT is specified the IPIF_NOXMIT
7614          * interfaces are omitted.
7615          * Similarly, IPIF_TEMPORARY interfaces are omitted
7616          * unless LIFC_TEMPORARY is specified.
7617          * If LIFC_EXTERNAL_SOURCE is specified, IPIF_NOXMIT,
7618          * IPIF_NOLOCAL, PHYI_LOOPBACK, IPIF_DEPRECATED and
7619          * not IPIF_UP interfaces are omitted. LIFC_EXTERNAL_SOURCE
7620          * has priority over LIFC_NOXMIT.
7621          */
7622         STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, NULL);
7623 
7624         if ((mp1->b_wptr - mp1->b_rptr) != STRUCT_SIZE(lifc))
7625                 return (EINVAL);
7626 
7627         /*
7628          * Must be (better be!) continuation of a TRANSPARENT
7629          * IOCTL.  We just copied in the lifconf structure.
7630          */
7631         STRUCT_SET_HANDLE(lifc, iocp->ioc_flag, (struct lifconf *)mp1->b_rptr);
7632 
7633         family = STRUCT_FGET(lifc, lifc_family);
7634         flags = STRUCT_FGET(lifc, lifc_flags);
7635 
7636         switch (family) {
7637         case AF_UNSPEC:
7638                 /*
7639                  * walk all ILL's.
7640                  */
7641                 list = MAX_G_HEADS;
7642                 break;
7643         case AF_INET:
7644                 /*
7645                  * walk only IPV4 ILL's.
7646                  */
7647                 list = IP_V4_G_HEAD;
7648                 break;
7649         case AF_INET6:
7650                 /*
7651                  * walk only IPV6 ILL's.
7652                  */
7653                 list = IP_V6_G_HEAD;
7654                 break;
7655         default:
7656                 return (EAFNOSUPPORT);
7657         }
7658 
7659         /*
7660          * Allocate a buffer to hold requested information.
7661          *
7662          * If lifc_len is larger than what is needed, we only
7663          * allocate what we will use.
7664          *
7665          * If lifc_len is smaller than what is needed, return
7666          * EINVAL.
7667          */
7668         numlifs = ip_get_numlifs(family, flags, zoneid, ipst);
7669         lifc_bufsize = numlifs * sizeof (struct lifreq);
7670         lifclen = STRUCT_FGET(lifc, lifc_len);
7671         if (lifc_bufsize > lifclen) {
7672                 if (iocp->ioc_cmd == O_SIOCGLIFCONF)
7673                         return (EINVAL);
7674                 else
7675                         lifc_bufsize = lifclen;
7676         }
7677 
7678         mp1 = mi_copyout_alloc(q, mp,
7679             STRUCT_FGETP(lifc, lifc_buf), lifc_bufsize, B_FALSE);
7680         if (mp1 == NULL)
7681                 return (ENOMEM);
7682 
7683         mp1->b_wptr = mp1->b_rptr + lifc_bufsize;
7684         bzero(mp1->b_rptr, mp1->b_wptr - mp1->b_rptr);
7685 
7686         lifr = (struct lifreq *)mp1->b_rptr;
7687 
7688         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
7689         ill = ill_first(list, list, &ctx, ipst);
7690         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
7691                 if (IS_UNDER_IPMP(ill) && !(flags & LIFC_UNDER_IPMP))
7692                         continue;
7693 
7694                 for (ipif = ill->ill_ipif; ipif != NULL;
7695                     ipif = ipif->ipif_next) {
7696                         if ((ipif->ipif_flags & IPIF_NOXMIT) &&
7697                             !(flags & LIFC_NOXMIT))
7698                                 continue;
7699 
7700                         if ((ipif->ipif_flags & IPIF_TEMPORARY) &&
7701                             !(flags & LIFC_TEMPORARY))
7702                                 continue;
7703 
7704                         if (((ipif->ipif_flags &
7705                             (IPIF_NOXMIT|IPIF_NOLOCAL|
7706                             IPIF_DEPRECATED)) ||
7707                             IS_LOOPBACK(ill) ||
7708                             !(ipif->ipif_flags & IPIF_UP)) &&
7709                             (flags & LIFC_EXTERNAL_SOURCE))
7710                                 continue;
7711 
7712                         if (zoneid != ipif->ipif_zoneid &&
7713                             ipif->ipif_zoneid != ALL_ZONES &&
7714                             (zoneid != GLOBAL_ZONEID ||
7715                             !(flags & LIFC_ALLZONES)))
7716                                 continue;
7717 
7718                         if ((uchar_t *)&lifr[1] > mp1->b_wptr) {
7719                                 if (iocp->ioc_cmd == O_SIOCGLIFCONF) {
7720                                         rw_exit(&ipst->ips_ill_g_lock);
7721                                         return (EINVAL);
7722                                 } else {
7723                                         goto lif_copydone;
7724                                 }
7725                         }
7726 
7727                         ipif_get_name(ipif, lifr->lifr_name,
7728                             sizeof (lifr->lifr_name));
7729                         lifr->lifr_type = ill->ill_type;
7730                         if (ipif->ipif_isv6) {
7731                                 sin6 = (sin6_t *)&lifr->lifr_addr;
7732                                 *sin6 = sin6_null;
7733                                 sin6->sin6_family = AF_INET6;
7734                                 sin6->sin6_addr =
7735                                     ipif->ipif_v6lcl_addr;
7736                                 lifr->lifr_addrlen =
7737                                     ip_mask_to_plen_v6(
7738                                     &ipif->ipif_v6net_mask);
7739                         } else {
7740                                 sin = (sin_t *)&lifr->lifr_addr;
7741                                 *sin = sin_null;
7742                                 sin->sin_family = AF_INET;
7743                                 sin->sin_addr.s_addr =
7744                                     ipif->ipif_lcl_addr;
7745                                 lifr->lifr_addrlen =
7746                                     ip_mask_to_plen(
7747                                     ipif->ipif_net_mask);
7748                         }
7749                         lifr++;
7750                 }
7751         }
7752 lif_copydone:
7753         rw_exit(&ipst->ips_ill_g_lock);
7754 
7755         mp1->b_wptr = (uchar_t *)lifr;
7756         if (STRUCT_BUF(lifc) != NULL) {
7757                 STRUCT_FSET(lifc, lifc_len,
7758                     (int)((uchar_t *)lifr - mp1->b_rptr));
7759         }
7760         return (0);
7761 }
7762 
7763 static void
7764 ip_sioctl_ip6addrpolicy(queue_t *q, mblk_t *mp)
7765 {
7766         ip6_asp_t *table;
7767         size_t table_size;
7768         mblk_t *data_mp;
7769         struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7770         ip_stack_t      *ipst;
7771 
7772         if (q->q_next == NULL)
7773                 ipst = CONNQ_TO_IPST(q);
7774         else
7775                 ipst = ILLQ_TO_IPST(q);
7776 
7777         /* These two ioctls are I_STR only */
7778         if (iocp->ioc_count == TRANSPARENT) {
7779                 miocnak(q, mp, 0, EINVAL);
7780                 return;
7781         }
7782 
7783         data_mp = mp->b_cont;
7784         if (data_mp == NULL) {
7785                 /* The user passed us a NULL argument */
7786                 table = NULL;
7787                 table_size = iocp->ioc_count;
7788         } else {
7789                 /*
7790                  * The user provided a table.  The stream head
7791                  * may have copied in the user data in chunks,
7792                  * so make sure everything is pulled up
7793                  * properly.
7794                  */
7795                 if (MBLKL(data_mp) < iocp->ioc_count) {
7796                         mblk_t *new_data_mp;
7797                         if ((new_data_mp = msgpullup(data_mp, -1)) ==
7798                             NULL) {
7799                                 miocnak(q, mp, 0, ENOMEM);
7800                                 return;
7801                         }
7802                         freemsg(data_mp);
7803                         data_mp = new_data_mp;
7804                         mp->b_cont = data_mp;
7805                 }
7806                 table = (ip6_asp_t *)data_mp->b_rptr;
7807                 table_size = iocp->ioc_count;
7808         }
7809 
7810         switch (iocp->ioc_cmd) {
7811         case SIOCGIP6ADDRPOLICY:
7812                 iocp->ioc_rval = ip6_asp_get(table, table_size, ipst);
7813                 if (iocp->ioc_rval == -1)
7814                         iocp->ioc_error = EINVAL;
7815 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7816                 else if (table != NULL &&
7817                     (iocp->ioc_flag & IOC_MODELS) == IOC_ILP32) {
7818                         ip6_asp_t *src = table;
7819                         ip6_asp32_t *dst = (void *)table;
7820                         int count = table_size / sizeof (ip6_asp_t);
7821                         int i;
7822 
7823                         /*
7824                          * We need to do an in-place shrink of the array
7825                          * to match the alignment attributes of the
7826                          * 32-bit ABI looking at it.
7827                          */
7828                         /* LINTED: logical expression always true: op "||" */
7829                         ASSERT(sizeof (*src) > sizeof (*dst));
7830                         for (i = 1; i < count; i++)
7831                                 bcopy(src + i, dst + i, sizeof (*dst));
7832                 }
7833 #endif
7834                 break;
7835 
7836         case SIOCSIP6ADDRPOLICY:
7837                 ASSERT(mp->b_prev == NULL);
7838                 mp->b_prev = (void *)q;
7839 #if defined(_SYSCALL32_IMPL) && _LONG_LONG_ALIGNMENT_32 == 4
7840                 /*
7841                  * We pass in the datamodel here so that the ip6_asp_replace()
7842                  * routine can handle converting from 32-bit to native formats
7843                  * where necessary.
7844                  *
7845                  * A better way to handle this might be to convert the inbound
7846                  * data structure here, and hang it off a new 'mp'; thus the
7847                  * ip6_asp_replace() logic would always be dealing with native
7848                  * format data structures..
7849                  *
7850                  * (An even simpler way to handle these ioctls is to just
7851                  * add a 32-bit trailing 'pad' field to the ip6_asp_t structure
7852                  * and just recompile everything that depends on it.)
7853                  */
7854 #endif
7855                 ip6_asp_replace(mp, table, table_size, B_FALSE, ipst,
7856                     iocp->ioc_flag & IOC_MODELS);
7857                 return;
7858         }
7859 
7860         DB_TYPE(mp) =  (iocp->ioc_error == 0) ? M_IOCACK : M_IOCNAK;
7861         qreply(q, mp);
7862 }
7863 
7864 static void
7865 ip_sioctl_dstinfo(queue_t *q, mblk_t *mp)
7866 {
7867         mblk_t          *data_mp;
7868         struct dstinforeq       *dir;
7869         uint8_t         *end, *cur;
7870         in6_addr_t      *daddr, *saddr;
7871         ipaddr_t        v4daddr;
7872         ire_t           *ire;
7873         ipaddr_t        v4setsrc;
7874         in6_addr_t      v6setsrc;
7875         char            *slabel, *dlabel;
7876         boolean_t       isipv4;
7877         int             match_ire;
7878         ill_t           *dst_ill;
7879         struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
7880         conn_t          *connp = Q_TO_CONN(q);
7881         zoneid_t        zoneid = IPCL_ZONEID(connp);
7882         ip_stack_t      *ipst = connp->conn_netstack->netstack_ip;
7883         uint64_t        ipif_flags;
7884 
7885         ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
7886 
7887         /*
7888          * This ioctl is I_STR only, and must have a
7889          * data mblk following the M_IOCTL mblk.
7890          */
7891         data_mp = mp->b_cont;
7892         if (iocp->ioc_count == TRANSPARENT || data_mp == NULL) {
7893                 miocnak(q, mp, 0, EINVAL);
7894                 return;
7895         }
7896 
7897         if (MBLKL(data_mp) < iocp->ioc_count) {
7898                 mblk_t *new_data_mp;
7899 
7900                 if ((new_data_mp = msgpullup(data_mp, -1)) == NULL) {
7901                         miocnak(q, mp, 0, ENOMEM);
7902                         return;
7903                 }
7904                 freemsg(data_mp);
7905                 data_mp = new_data_mp;
7906                 mp->b_cont = data_mp;
7907         }
7908         match_ire = MATCH_IRE_DSTONLY;
7909 
7910         for (cur = data_mp->b_rptr, end = data_mp->b_wptr;
7911             end - cur >= sizeof (struct dstinforeq);
7912             cur += sizeof (struct dstinforeq)) {
7913                 dir = (struct dstinforeq *)cur;
7914                 daddr = &dir->dir_daddr;
7915                 saddr = &dir->dir_saddr;
7916 
7917                 /*
7918                  * ip_addr_scope_v6() and ip6_asp_lookup() handle
7919                  * v4 mapped addresses; ire_ftable_lookup_v6()
7920                  * and ip_select_source_v6() do not.
7921                  */
7922                 dir->dir_dscope = ip_addr_scope_v6(daddr);
7923                 dlabel = ip6_asp_lookup(daddr, &dir->dir_precedence, ipst);
7924 
7925                 isipv4 = IN6_IS_ADDR_V4MAPPED(daddr);
7926                 if (isipv4) {
7927                         IN6_V4MAPPED_TO_IPADDR(daddr, v4daddr);
7928                         v4setsrc = INADDR_ANY;
7929                         ire = ire_route_recursive_v4(v4daddr, 0, NULL, zoneid,
7930                             NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v4setsrc,
7931                             NULL, NULL);
7932                 } else {
7933                         v6setsrc = ipv6_all_zeros;
7934                         ire = ire_route_recursive_v6(daddr, 0, NULL, zoneid,
7935                             NULL, match_ire, IRR_ALLOCATE, 0, ipst, &v6setsrc,
7936                             NULL, NULL);
7937                 }
7938                 ASSERT(ire != NULL);
7939                 if (ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE)) {
7940                         ire_refrele(ire);
7941                         dir->dir_dreachable = 0;
7942 
7943                         /* move on to next dst addr */
7944                         continue;
7945                 }
7946                 dir->dir_dreachable = 1;
7947 
7948                 dst_ill = ire_nexthop_ill(ire);
7949                 if (dst_ill == NULL) {
7950                         ire_refrele(ire);
7951                         continue;
7952                 }
7953 
7954                 /* With ipmp we most likely look at the ipmp ill here */
7955                 dir->dir_dmactype = dst_ill->ill_mactype;
7956 
7957                 if (isipv4) {
7958                         ipaddr_t v4saddr;
7959 
7960                         if (ip_select_source_v4(dst_ill, v4setsrc, v4daddr,
7961                             connp->conn_ixa->ixa_multicast_ifaddr, zoneid, ipst,
7962                             &v4saddr, NULL, &ipif_flags) != 0) {
7963                                 v4saddr = INADDR_ANY;
7964                                 ipif_flags = 0;
7965                         }
7966                         IN6_IPADDR_TO_V4MAPPED(v4saddr, saddr);
7967                 } else {
7968                         if (ip_select_source_v6(dst_ill, &v6setsrc, daddr,
7969                             zoneid, ipst, B_FALSE, IPV6_PREFER_SRC_DEFAULT,
7970                             saddr, NULL, &ipif_flags) != 0) {
7971                                 *saddr = ipv6_all_zeros;
7972                                 ipif_flags = 0;
7973                         }
7974                 }
7975 
7976                 dir->dir_sscope = ip_addr_scope_v6(saddr);
7977                 slabel = ip6_asp_lookup(saddr, NULL, ipst);
7978                 dir->dir_labelmatch = ip6_asp_labelcmp(dlabel, slabel);
7979                 dir->dir_sdeprecated = (ipif_flags & IPIF_DEPRECATED) ? 1 : 0;
7980                 ire_refrele(ire);
7981                 ill_refrele(dst_ill);
7982         }
7983         miocack(q, mp, iocp->ioc_count, 0);
7984 }
7985 
7986 /*
7987  * Check if this is an address assigned to this machine.
7988  * Skips interfaces that are down by using ire checks.
7989  * Translates mapped addresses to v4 addresses and then
7990  * treats them as such, returning true if the v4 address
7991  * associated with this mapped address is configured.
7992  * Note: Applications will have to be careful what they do
7993  * with the response; use of mapped addresses limits
7994  * what can be done with the socket, especially with
7995  * respect to socket options and ioctls - neither IPv4
7996  * options nor IPv6 sticky options/ancillary data options
7997  * may be used.
7998  */
7999 /* ARGSUSED */
8000 int
8001 ip_sioctl_tmyaddr(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8002     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8003 {
8004         struct sioc_addrreq *sia;
8005         sin_t *sin;
8006         ire_t *ire;
8007         mblk_t *mp1;
8008         zoneid_t zoneid;
8009         ip_stack_t      *ipst;
8010 
8011         ip1dbg(("ip_sioctl_tmyaddr"));
8012 
8013         ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8014         zoneid = Q_TO_CONN(q)->conn_zoneid;
8015         ipst = CONNQ_TO_IPST(q);
8016 
8017         /* Existence verified in ip_wput_nondata */
8018         mp1 = mp->b_cont->b_cont;
8019         sia = (struct sioc_addrreq *)mp1->b_rptr;
8020         sin = (sin_t *)&sia->sa_addr;
8021         switch (sin->sin_family) {
8022         case AF_INET6: {
8023                 sin6_t *sin6 = (sin6_t *)sin;
8024 
8025                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8026                         ipaddr_t v4_addr;
8027 
8028                         IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8029                             v4_addr);
8030                         ire = ire_ftable_lookup_v4(v4_addr, 0, 0,
8031                             IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8032                             MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8033                 } else {
8034                         in6_addr_t v6addr;
8035 
8036                         v6addr = sin6->sin6_addr;
8037                         ire = ire_ftable_lookup_v6(&v6addr, 0, 0,
8038                             IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid, NULL,
8039                             MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8040                 }
8041                 break;
8042         }
8043         case AF_INET: {
8044                 ipaddr_t v4addr;
8045 
8046                 v4addr = sin->sin_addr.s_addr;
8047                 ire = ire_ftable_lookup_v4(v4addr, 0, 0,
8048                     IRE_LOCAL|IRE_LOOPBACK, NULL, zoneid,
8049                     NULL, MATCH_IRE_TYPE | MATCH_IRE_ZONEONLY, 0, ipst, NULL);
8050                 break;
8051         }
8052         default:
8053                 return (EAFNOSUPPORT);
8054         }
8055         if (ire != NULL) {
8056                 sia->sa_res = 1;
8057                 ire_refrele(ire);
8058         } else {
8059                 sia->sa_res = 0;
8060         }
8061         return (0);
8062 }
8063 
8064 /*
8065  * Check if this is an address assigned on-link i.e. neighbor,
8066  * and makes sure it's reachable from the current zone.
8067  * Returns true for my addresses as well.
8068  * Translates mapped addresses to v4 addresses and then
8069  * treats them as such, returning true if the v4 address
8070  * associated with this mapped address is configured.
8071  * Note: Applications will have to be careful what they do
8072  * with the response; use of mapped addresses limits
8073  * what can be done with the socket, especially with
8074  * respect to socket options and ioctls - neither IPv4
8075  * options nor IPv6 sticky options/ancillary data options
8076  * may be used.
8077  */
8078 /* ARGSUSED */
8079 int
8080 ip_sioctl_tonlink(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
8081     ip_ioctl_cmd_t *ipip, void *duymmy_ifreq)
8082 {
8083         struct sioc_addrreq *sia;
8084         sin_t *sin;
8085         mblk_t  *mp1;
8086         ire_t *ire = NULL;
8087         zoneid_t zoneid;
8088         ip_stack_t      *ipst;
8089 
8090         ip1dbg(("ip_sioctl_tonlink"));
8091 
8092         ASSERT(q->q_next == NULL); /* this ioctl not allowed if ip is module */
8093         zoneid = Q_TO_CONN(q)->conn_zoneid;
8094         ipst = CONNQ_TO_IPST(q);
8095 
8096         /* Existence verified in ip_wput_nondata */
8097         mp1 = mp->b_cont->b_cont;
8098         sia = (struct sioc_addrreq *)mp1->b_rptr;
8099         sin = (sin_t *)&sia->sa_addr;
8100 
8101         /*
8102          * We check for IRE_ONLINK and exclude IRE_BROADCAST|IRE_MULTICAST
8103          * to make sure we only look at on-link unicast address.
8104          */
8105         switch (sin->sin_family) {
8106         case AF_INET6: {
8107                 sin6_t *sin6 = (sin6_t *)sin;
8108 
8109                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
8110                         ipaddr_t v4_addr;
8111 
8112                         IN6_V4MAPPED_TO_IPADDR(&sin6->sin6_addr,
8113                             v4_addr);
8114                         if (!CLASSD(v4_addr)) {
8115                                 ire = ire_ftable_lookup_v4(v4_addr, 0, 0, 0,
8116                                     NULL, zoneid, NULL, MATCH_IRE_DSTONLY,
8117                                     0, ipst, NULL);
8118                         }
8119                 } else {
8120                         in6_addr_t v6addr;
8121 
8122                         v6addr = sin6->sin6_addr;
8123                         if (!IN6_IS_ADDR_MULTICAST(&v6addr)) {
8124                                 ire = ire_ftable_lookup_v6(&v6addr, 0, 0, 0,
8125                                     NULL, zoneid, NULL, MATCH_IRE_DSTONLY, 0,
8126                                     ipst, NULL);
8127                         }
8128                 }
8129                 break;
8130         }
8131         case AF_INET: {
8132                 ipaddr_t v4addr;
8133 
8134                 v4addr = sin->sin_addr.s_addr;
8135                 if (!CLASSD(v4addr)) {
8136                         ire = ire_ftable_lookup_v4(v4addr, 0, 0, 0, NULL,
8137                             zoneid, NULL, MATCH_IRE_DSTONLY, 0, ipst, NULL);
8138                 }
8139                 break;
8140         }
8141         default:
8142                 return (EAFNOSUPPORT);
8143         }
8144         sia->sa_res = 0;
8145         if (ire != NULL) {
8146                 ASSERT(!(ire->ire_type & IRE_MULTICAST));
8147 
8148                 if ((ire->ire_type & IRE_ONLINK) &&
8149                     !(ire->ire_type & IRE_BROADCAST))
8150                         sia->sa_res = 1;
8151                 ire_refrele(ire);
8152         }
8153         return (0);
8154 }
8155 
8156 /*
8157  * TBD: implement when kernel maintaines a list of site prefixes.
8158  */
8159 /* ARGSUSED */
8160 int
8161 ip_sioctl_tmysite(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8162     ip_ioctl_cmd_t *ipip, void *ifreq)
8163 {
8164         return (ENXIO);
8165 }
8166 
8167 /* ARP IOCTLs. */
8168 /* ARGSUSED */
8169 int
8170 ip_sioctl_arp(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
8171     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
8172 {
8173         int             err;
8174         ipaddr_t        ipaddr;
8175         struct iocblk   *iocp;
8176         conn_t          *connp;
8177         struct arpreq   *ar;
8178         struct xarpreq  *xar;
8179         int             arp_flags, flags, alength;
8180         uchar_t         *lladdr;
8181         ip_stack_t      *ipst;
8182         ill_t           *ill = ipif->ipif_ill;
8183         ill_t           *proxy_ill = NULL;
8184         ipmp_arpent_t   *entp = NULL;
8185         boolean_t       proxyarp = B_FALSE;
8186         boolean_t       if_arp_ioctl = B_FALSE;
8187         ncec_t          *ncec = NULL;
8188         nce_t           *nce;
8189 
8190         ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8191         connp = Q_TO_CONN(q);
8192         ipst = connp->conn_netstack->netstack_ip;
8193         iocp = (struct iocblk *)mp->b_rptr;
8194 
8195         if (ipip->ipi_cmd_type == XARP_CMD) {
8196                 /* We have a chain - M_IOCTL-->MI_COPY_MBLK-->XARPREQ_MBLK */
8197                 xar = (struct xarpreq *)mp->b_cont->b_cont->b_rptr;
8198                 ar = NULL;
8199 
8200                 arp_flags = xar->xarp_flags;
8201                 lladdr = (uchar_t *)LLADDR(&xar->xarp_ha);
8202                 if_arp_ioctl = (xar->xarp_ha.sdl_nlen != 0);
8203                 /*
8204                  * Validate against user's link layer address length
8205                  * input and name and addr length limits.
8206                  */
8207                 alength = ill->ill_phys_addr_length;
8208                 if (ipip->ipi_cmd == SIOCSXARP) {
8209                         if (alength != xar->xarp_ha.sdl_alen ||
8210                             (alength + xar->xarp_ha.sdl_nlen >
8211                             sizeof (xar->xarp_ha.sdl_data)))
8212                                 return (EINVAL);
8213                 }
8214         } else {
8215                 /* We have a chain - M_IOCTL-->MI_COPY_MBLK-->ARPREQ_MBLK */
8216                 ar = (struct arpreq *)mp->b_cont->b_cont->b_rptr;
8217                 xar = NULL;
8218 
8219                 arp_flags = ar->arp_flags;
8220                 lladdr = (uchar_t *)ar->arp_ha.sa_data;
8221                 /*
8222                  * Theoretically, the sa_family could tell us what link
8223                  * layer type this operation is trying to deal with. By
8224                  * common usage AF_UNSPEC means ethernet. We'll assume
8225                  * any attempt to use the SIOC?ARP ioctls is for ethernet,
8226                  * for now. Our new SIOC*XARP ioctls can be used more
8227                  * generally.
8228                  *
8229                  * If the underlying media happens to have a non 6 byte
8230                  * address, arp module will fail set/get, but the del
8231                  * operation will succeed.
8232                  */
8233                 alength = 6;
8234                 if ((ipip->ipi_cmd != SIOCDARP) &&
8235                     (alength != ill->ill_phys_addr_length)) {
8236                         return (EINVAL);
8237                 }
8238         }
8239 
8240         /* Translate ATF* flags to NCE* flags */
8241         flags = 0;
8242         if (arp_flags & ATF_AUTHORITY)
8243                 flags |= NCE_F_AUTHORITY;
8244         if (arp_flags & ATF_PERM)
8245                 flags |= NCE_F_NONUD; /* not subject to aging */
8246         if (arp_flags & ATF_PUBL)
8247                 flags |= NCE_F_PUBLISH;
8248 
8249         /*
8250          * IPMP ARP special handling:
8251          *
8252          * 1. Since ARP mappings must appear consistent across the group,
8253          *    prohibit changing ARP mappings on the underlying interfaces.
8254          *
8255          * 2. Since ARP mappings for IPMP data addresses are maintained by
8256          *    IP itself, prohibit changing them.
8257          *
8258          * 3. For proxy ARP, use a functioning hardware address in the group,
8259          *    provided one exists.  If one doesn't, just add the entry as-is;
8260          *    ipmp_illgrp_refresh_arpent() will refresh it if things change.
8261          */
8262         if (IS_UNDER_IPMP(ill)) {
8263                 if (ipip->ipi_cmd != SIOCGARP && ipip->ipi_cmd != SIOCGXARP)
8264                         return (EPERM);
8265         }
8266         if (IS_IPMP(ill)) {
8267                 ipmp_illgrp_t *illg = ill->ill_grp;
8268 
8269                 switch (ipip->ipi_cmd) {
8270                 case SIOCSARP:
8271                 case SIOCSXARP:
8272                         proxy_ill = ipmp_illgrp_find_ill(illg, lladdr, alength);
8273                         if (proxy_ill != NULL) {
8274                                 proxyarp = B_TRUE;
8275                                 if (!ipmp_ill_is_active(proxy_ill))
8276                                         proxy_ill = ipmp_illgrp_next_ill(illg);
8277                                 if (proxy_ill != NULL)
8278                                         lladdr = proxy_ill->ill_phys_addr;
8279                         }
8280                         /* FALLTHRU */
8281                 }
8282         }
8283 
8284         ipaddr = sin->sin_addr.s_addr;
8285         /*
8286          * don't match across illgrp per case (1) and (2).
8287          * XXX use IS_IPMP(ill) like ndp_sioc_update?
8288          */
8289         nce = nce_lookup_v4(ill, &ipaddr);
8290         if (nce != NULL)
8291                 ncec = nce->nce_common;
8292 
8293         switch (iocp->ioc_cmd) {
8294         case SIOCDARP:
8295         case SIOCDXARP: {
8296                 /*
8297                  * Delete the NCE if any.
8298                  */
8299                 if (ncec == NULL) {
8300                         iocp->ioc_error = ENXIO;
8301                         break;
8302                 }
8303                 /* Don't allow changes to arp mappings of local addresses. */
8304                 if (NCE_MYADDR(ncec)) {
8305                         nce_refrele(nce);
8306                         return (ENOTSUP);
8307                 }
8308                 iocp->ioc_error = 0;
8309 
8310                 /*
8311                  * Delete the nce_common which has ncec_ill set to ipmp_ill.
8312                  * This will delete all the nce entries on the under_ills.
8313                  */
8314                 ncec_delete(ncec);
8315                 /*
8316                  * Once the NCE has been deleted, then the ire_dep* consistency
8317                  * mechanism will find any IRE which depended on the now
8318                  * condemned NCE (as part of sending packets).
8319                  * That mechanism handles redirects by deleting redirects
8320                  * that refer to UNREACHABLE nces.
8321                  */
8322                 break;
8323         }
8324         case SIOCGARP:
8325         case SIOCGXARP:
8326                 if (ncec != NULL) {
8327                         lladdr = ncec->ncec_lladdr;
8328                         flags = ncec->ncec_flags;
8329                         iocp->ioc_error = 0;
8330                         ip_sioctl_garp_reply(mp, ncec->ncec_ill, lladdr, flags);
8331                 } else {
8332                         iocp->ioc_error = ENXIO;
8333                 }
8334                 break;
8335         case SIOCSARP:
8336         case SIOCSXARP:
8337                 /* Don't allow changes to arp mappings of local addresses. */
8338                 if (ncec != NULL && NCE_MYADDR(ncec)) {
8339                         nce_refrele(nce);
8340                         return (ENOTSUP);
8341                 }
8342 
8343                 /* static arp entries will undergo NUD if ATF_PERM is not set */
8344                 flags |= NCE_F_STATIC;
8345                 if (!if_arp_ioctl) {
8346                         ip_nce_lookup_and_update(&ipaddr, NULL, ipst,
8347                             lladdr, alength, flags);
8348                 } else {
8349                         ipif_t *ipif = ipif_get_next_ipif(NULL, ill);
8350                         if (ipif != NULL) {
8351                                 ip_nce_lookup_and_update(&ipaddr, ipif, ipst,
8352                                     lladdr, alength, flags);
8353                                 ipif_refrele(ipif);
8354                         }
8355                 }
8356                 if (nce != NULL) {
8357                         nce_refrele(nce);
8358                         nce = NULL;
8359                 }
8360                 /*
8361                  * NCE_F_STATIC entries will be added in state ND_REACHABLE
8362                  * by nce_add_common()
8363                  */
8364                 err = nce_lookup_then_add_v4(ill, lladdr,
8365                     ill->ill_phys_addr_length, &ipaddr, flags, ND_UNCHANGED,
8366                     &nce);
8367                 if (err == EEXIST) {
8368                         ncec = nce->nce_common;
8369                         mutex_enter(&ncec->ncec_lock);
8370                         ncec->ncec_state = ND_REACHABLE;
8371                         ncec->ncec_flags = flags;
8372                         nce_update(ncec, ND_UNCHANGED, lladdr);
8373                         mutex_exit(&ncec->ncec_lock);
8374                         err = 0;
8375                 }
8376                 if (nce != NULL) {
8377                         nce_refrele(nce);
8378                         nce = NULL;
8379                 }
8380                 if (IS_IPMP(ill) && err == 0) {
8381                         entp = ipmp_illgrp_create_arpent(ill->ill_grp,
8382                             proxyarp, ipaddr, lladdr, ill->ill_phys_addr_length,
8383                             flags);
8384                         if (entp == NULL || (proxyarp && proxy_ill == NULL)) {
8385                                 iocp->ioc_error = (entp == NULL ? ENOMEM : 0);
8386                                 break;
8387                         }
8388                 }
8389                 iocp->ioc_error = err;
8390         }
8391 
8392         if (nce != NULL) {
8393                 nce_refrele(nce);
8394         }
8395 
8396         /*
8397          * If we created an IPMP ARP entry, mark that we've notified ARP.
8398          */
8399         if (entp != NULL)
8400                 ipmp_illgrp_mark_arpent(ill->ill_grp, entp);
8401 
8402         return (iocp->ioc_error);
8403 }
8404 
8405 /*
8406  * Parse an [x]arpreq structure coming down SIOC[GSD][X]ARP ioctls, identify
8407  * the associated sin and refhold and return the associated ipif via `ci'.
8408  */
8409 int
8410 ip_extract_arpreq(queue_t *q, mblk_t *mp, const ip_ioctl_cmd_t *ipip,
8411     cmd_info_t *ci)
8412 {
8413         mblk_t  *mp1;
8414         sin_t   *sin;
8415         conn_t  *connp;
8416         ipif_t  *ipif;
8417         ire_t   *ire = NULL;
8418         ill_t   *ill = NULL;
8419         boolean_t exists;
8420         ip_stack_t *ipst;
8421         struct arpreq *ar;
8422         struct xarpreq *xar;
8423         struct sockaddr_dl *sdl;
8424 
8425         /* ioctl comes down on a conn */
8426         ASSERT(!(q->q_flag & QREADR) && q->q_next == NULL);
8427         connp = Q_TO_CONN(q);
8428         if (connp->conn_family == AF_INET6)
8429                 return (ENXIO);
8430 
8431         ipst = connp->conn_netstack->netstack_ip;
8432 
8433         /* Verified in ip_wput_nondata */
8434         mp1 = mp->b_cont->b_cont;
8435 
8436         if (ipip->ipi_cmd_type == XARP_CMD) {
8437                 ASSERT(MBLKL(mp1) >= sizeof (struct xarpreq));
8438                 xar = (struct xarpreq *)mp1->b_rptr;
8439                 sin = (sin_t *)&xar->xarp_pa;
8440                 sdl = &xar->xarp_ha;
8441 
8442                 if (sdl->sdl_family != AF_LINK || sin->sin_family != AF_INET)
8443                         return (ENXIO);
8444                 if (sdl->sdl_nlen >= LIFNAMSIZ)
8445                         return (EINVAL);
8446         } else {
8447                 ASSERT(ipip->ipi_cmd_type == ARP_CMD);
8448                 ASSERT(MBLKL(mp1) >= sizeof (struct arpreq));
8449                 ar = (struct arpreq *)mp1->b_rptr;
8450                 sin = (sin_t *)&ar->arp_pa;
8451         }
8452 
8453         if (ipip->ipi_cmd_type == XARP_CMD && sdl->sdl_nlen != 0) {
8454                 ipif = ipif_lookup_on_name(sdl->sdl_data, sdl->sdl_nlen,
8455                     B_FALSE, &exists, B_FALSE, ALL_ZONES, ipst);
8456                 if (ipif == NULL)
8457                         return (ENXIO);
8458                 if (ipif->ipif_id != 0) {
8459                         ipif_refrele(ipif);
8460                         return (ENXIO);
8461                 }
8462         } else {
8463                 /*
8464                  * Either an SIOC[DGS]ARP or an SIOC[DGS]XARP with an sdl_nlen
8465                  * of 0: use the IP address to find the ipif.  If the IP
8466                  * address is an IPMP test address, ire_ftable_lookup() will
8467                  * find the wrong ill, so we first do an ipif_lookup_addr().
8468                  */
8469                 ipif = ipif_lookup_addr(sin->sin_addr.s_addr, NULL, ALL_ZONES,
8470                     ipst);
8471                 if (ipif == NULL) {
8472                         ire = ire_ftable_lookup_v4(sin->sin_addr.s_addr,
8473                             0, 0, IRE_IF_RESOLVER, NULL, ALL_ZONES,
8474                             NULL, MATCH_IRE_TYPE, 0, ipst, NULL);
8475                         if (ire == NULL || ((ill = ire->ire_ill) == NULL)) {
8476                                 if (ire != NULL)
8477                                         ire_refrele(ire);
8478                                 return (ENXIO);
8479                         }
8480                         ASSERT(ire != NULL && ill != NULL);
8481                         ipif = ill->ill_ipif;
8482                         ipif_refhold(ipif);
8483                         ire_refrele(ire);
8484                 }
8485         }
8486 
8487         if (ipif->ipif_ill->ill_net_type != IRE_IF_RESOLVER) {
8488                 ipif_refrele(ipif);
8489                 return (ENXIO);
8490         }
8491 
8492         ci->ci_sin = sin;
8493         ci->ci_ipif = ipif;
8494         return (0);
8495 }
8496 
8497 /*
8498  * Link or unlink the illgrp on IPMP meta-interface `ill' depending on the
8499  * value of `ioccmd'.  While an illgrp is linked to an ipmp_grp_t, it is
8500  * accessible from that ipmp_grp_t, which means SIOCSLIFGROUPNAME can look it
8501  * up and thus an ill can join that illgrp.
8502  *
8503  * We use I_PLINK/I_PUNLINK to do the link/unlink operations rather than
8504  * open()/close() primarily because close() is not allowed to fail or block
8505  * forever.  On the other hand, I_PUNLINK *can* fail, and there's no reason
8506  * why anyone should ever need to I_PUNLINK an in-use IPMP stream.  To ensure
8507  * symmetric behavior (e.g., doing an I_PLINK after and I_PUNLINK undoes the
8508  * I_PUNLINK) we defer linking to I_PLINK.  Separately, we also fail attempts
8509  * to I_LINK since I_UNLINK is optional and we'd end up in an inconsistent
8510  * state if I_UNLINK didn't occur.
8511  *
8512  * Note that for each plumb/unplumb operation, we may end up here more than
8513  * once because of the way ifconfig works.  However, it's OK to link the same
8514  * illgrp more than once, or unlink an illgrp that's already unlinked.
8515  */
8516 static int
8517 ip_sioctl_plink_ipmp(ill_t *ill, int ioccmd)
8518 {
8519         int err;
8520         ip_stack_t *ipst = ill->ill_ipst;
8521 
8522         ASSERT(IS_IPMP(ill));
8523         ASSERT(IAM_WRITER_ILL(ill));
8524 
8525         switch (ioccmd) {
8526         case I_LINK:
8527                 return (ENOTSUP);
8528 
8529         case I_PLINK:
8530                 rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8531                 ipmp_illgrp_link_grp(ill->ill_grp, ill->ill_phyint->phyint_grp);
8532                 rw_exit(&ipst->ips_ipmp_lock);
8533                 break;
8534 
8535         case I_PUNLINK:
8536                 /*
8537                  * Require all UP ipifs be brought down prior to unlinking the
8538                  * illgrp so any associated IREs (and other state) is torched.
8539                  */
8540                 if (ill->ill_ipif_up_count + ill->ill_ipif_dup_count > 0)
8541                         return (EBUSY);
8542 
8543                 /*
8544                  * NOTE: We hold ipmp_lock across the unlink to prevent a race
8545                  * with an SIOCSLIFGROUPNAME request from an ill trying to
8546                  * join this group.  Specifically: ills trying to join grab
8547                  * ipmp_lock and bump a "pending join" counter checked by
8548                  * ipmp_illgrp_unlink_grp().  During the unlink no new pending
8549                  * joins can occur (since we have ipmp_lock).  Once we drop
8550                  * ipmp_lock, subsequent SIOCSLIFGROUPNAME requests will not
8551                  * find the illgrp (since we unlinked it) and will return
8552                  * EAFNOSUPPORT.  This will then take them back through the
8553                  * IPMP meta-interface plumbing logic in ifconfig, and thus
8554                  * back through I_PLINK above.
8555                  */
8556                 rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
8557                 err = ipmp_illgrp_unlink_grp(ill->ill_grp);
8558                 rw_exit(&ipst->ips_ipmp_lock);
8559                 return (err);
8560         default:
8561                 break;
8562         }
8563         return (0);
8564 }
8565 
8566 /*
8567  * Do I_PLINK/I_LINK or I_PUNLINK/I_UNLINK with consistency checks and also
8568  * atomically set/clear the muxids. Also complete the ioctl by acking or
8569  * naking it.  Note that the code is structured such that the link type,
8570  * whether it's persistent or not, is treated equally.  ifconfig(1M) and
8571  * its clones use the persistent link, while pppd(1M) and perhaps many
8572  * other daemons may use non-persistent link.  When combined with some
8573  * ill_t states, linking and unlinking lower streams may be used as
8574  * indicators of dynamic re-plumbing events [see PSARC/1999/348].
8575  */
8576 /* ARGSUSED */
8577 void
8578 ip_sioctl_plink(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
8579 {
8580         mblk_t          *mp1;
8581         struct linkblk  *li;
8582         int             ioccmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
8583         int             err = 0;
8584 
8585         ASSERT(ioccmd == I_PLINK || ioccmd == I_PUNLINK ||
8586             ioccmd == I_LINK || ioccmd == I_UNLINK);
8587 
8588         mp1 = mp->b_cont;    /* This is the linkblk info */
8589         li = (struct linkblk *)mp1->b_rptr;
8590 
8591         err = ip_sioctl_plink_ipmod(ipsq, q, mp, ioccmd, li);
8592         if (err == EINPROGRESS)
8593                 return;
8594         if (err == 0)
8595                 miocack(q, mp, 0, 0);
8596         else
8597                 miocnak(q, mp, 0, err);
8598 
8599         /* Conn was refheld in ip_sioctl_copyin_setup */
8600         if (CONN_Q(q)) {
8601                 CONN_DEC_IOCTLREF(Q_TO_CONN(q));
8602                 CONN_OPER_PENDING_DONE(Q_TO_CONN(q));
8603         }
8604 }
8605 
8606 /*
8607  * Process I_{P}LINK and I_{P}UNLINK requests named by `ioccmd' and pointed to
8608  * by `mp' and `li' for the IP module stream (if li->q_bot is in fact an IP
8609  * module stream).
8610  * Returns zero on success, EINPROGRESS if the operation is still pending, or
8611  * an error code on failure.
8612  */
8613 static int
8614 ip_sioctl_plink_ipmod(ipsq_t *ipsq, queue_t *q, mblk_t *mp, int ioccmd,
8615     struct linkblk *li)
8616 {
8617         int             err = 0;
8618         ill_t           *ill;
8619         queue_t         *ipwq, *dwq;
8620         const char      *name;
8621         struct qinit    *qinfo;
8622         boolean_t       islink = (ioccmd == I_PLINK || ioccmd == I_LINK);
8623         boolean_t       entered_ipsq = B_FALSE;
8624         boolean_t       is_ip = B_FALSE;
8625         arl_t           *arl;
8626 
8627         /*
8628          * Walk the lower stream to verify it's the IP module stream.
8629          * The IP module is identified by its name, wput function,
8630          * and non-NULL q_next.  STREAMS ensures that the lower stream
8631          * (li->l_qbot) will not vanish until this ioctl completes.
8632          */
8633         for (ipwq = li->l_qbot; ipwq != NULL; ipwq = ipwq->q_next) {
8634                 qinfo = ipwq->q_qinfo;
8635                 name = qinfo->qi_minfo->mi_idname;
8636                 if (name != NULL && strcmp(name, ip_mod_info.mi_idname) == 0 &&
8637                     qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
8638                         is_ip = B_TRUE;
8639                         break;
8640                 }
8641                 if (name != NULL && strcmp(name, arp_mod_info.mi_idname) == 0 &&
8642                     qinfo->qi_putp != (pfi_t)ip_lwput && ipwq->q_next != NULL) {
8643                         break;
8644                 }
8645         }
8646 
8647         /*
8648          * If this isn't an IP module stream, bail.
8649          */
8650         if (ipwq == NULL)
8651                 return (0);
8652 
8653         if (!is_ip) {
8654                 arl = (arl_t *)ipwq->q_ptr;
8655                 ill = arl_to_ill(arl);
8656                 if (ill == NULL)
8657                         return (0);
8658         } else {
8659                 ill = ipwq->q_ptr;
8660         }
8661         ASSERT(ill != NULL);
8662 
8663         if (ipsq == NULL) {
8664                 ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_sioctl_plink,
8665                     NEW_OP, B_FALSE);
8666                 if (ipsq == NULL) {
8667                         if (!is_ip)
8668                                 ill_refrele(ill);
8669                         return (EINPROGRESS);
8670                 }
8671                 entered_ipsq = B_TRUE;
8672         }
8673         ASSERT(IAM_WRITER_ILL(ill));
8674         mutex_enter(&ill->ill_lock);
8675         if (!is_ip) {
8676                 if (islink && ill->ill_muxid == 0) {
8677                         /*
8678                          * Plumbing has to be done with IP plumbed first, arp
8679                          * second, but here we have arp being plumbed first.
8680                          */
8681                         mutex_exit(&ill->ill_lock);
8682                         if (entered_ipsq)
8683                                 ipsq_exit(ipsq);
8684                         ill_refrele(ill);
8685                         return (EINVAL);
8686                 }
8687         }
8688         mutex_exit(&ill->ill_lock);
8689         if (!is_ip) {
8690                 arl->arl_muxid = islink ? li->l_index : 0;
8691                 ill_refrele(ill);
8692                 goto done;
8693         }
8694 
8695         if (IS_IPMP(ill) && (err = ip_sioctl_plink_ipmp(ill, ioccmd)) != 0)
8696                 goto done;
8697 
8698         /*
8699          * As part of I_{P}LINKing, stash the number of downstream modules and
8700          * the read queue of the module immediately below IP in the ill.
8701          * These are used during the capability negotiation below.
8702          */
8703         ill->ill_lmod_rq = NULL;
8704         ill->ill_lmod_cnt = 0;
8705         if (islink && ((dwq = ipwq->q_next) != NULL)) {
8706                 ill->ill_lmod_rq = RD(dwq);
8707                 for (; dwq != NULL; dwq = dwq->q_next)
8708                         ill->ill_lmod_cnt++;
8709         }
8710 
8711         ill->ill_muxid = islink ? li->l_index : 0;
8712 
8713         /*
8714          * Mark the ipsq busy until the capability operations initiated below
8715          * complete. The PLINK/UNLINK ioctl itself completes when our caller
8716          * returns, but the capability operation may complete asynchronously
8717          * much later.
8718          */
8719         ipsq_current_start(ipsq, ill->ill_ipif, ioccmd);
8720         /*
8721          * If there's at least one up ipif on this ill, then we're bound to
8722          * the underlying driver via DLPI.  In that case, renegotiate
8723          * capabilities to account for any possible change in modules
8724          * interposed between IP and the driver.
8725          */
8726         if (ill->ill_ipif_up_count > 0) {
8727                 if (islink)
8728                         ill_capability_probe(ill);
8729                 else
8730                         ill_capability_reset(ill, B_FALSE);
8731         }
8732         ipsq_current_finish(ipsq);
8733 done:
8734         if (entered_ipsq)
8735                 ipsq_exit(ipsq);
8736 
8737         return (err);
8738 }
8739 
8740 /*
8741  * Search the ioctl command in the ioctl tables and return a pointer
8742  * to the ioctl command information. The ioctl command tables are
8743  * static and fully populated at compile time.
8744  */
8745 ip_ioctl_cmd_t *
8746 ip_sioctl_lookup(int ioc_cmd)
8747 {
8748         int index;
8749         ip_ioctl_cmd_t *ipip;
8750         ip_ioctl_cmd_t *ipip_end;
8751 
8752         if (ioc_cmd == IPI_DONTCARE)
8753                 return (NULL);
8754 
8755         /*
8756          * Do a 2 step search. First search the indexed table
8757          * based on the least significant byte of the ioctl cmd.
8758          * If we don't find a match, then search the misc table
8759          * serially.
8760          */
8761         index = ioc_cmd & 0xFF;
8762         if (index < ip_ndx_ioctl_count) {
8763                 ipip = &ip_ndx_ioctl_table[index];
8764                 if (ipip->ipi_cmd == ioc_cmd) {
8765                         /* Found a match in the ndx table */
8766                         return (ipip);
8767                 }
8768         }
8769 
8770         /* Search the misc table */
8771         ipip_end = &ip_misc_ioctl_table[ip_misc_ioctl_count];
8772         for (ipip = ip_misc_ioctl_table; ipip < ipip_end; ipip++) {
8773                 if (ipip->ipi_cmd == ioc_cmd)
8774                         /* Found a match in the misc table */
8775                         return (ipip);
8776         }
8777 
8778         return (NULL);
8779 }
8780 
8781 /*
8782  * helper function for ip_sioctl_getsetprop(), which does some sanity checks
8783  */
8784 static boolean_t
8785 getset_ioctl_checks(mblk_t *mp)
8786 {
8787         struct iocblk   *iocp = (struct iocblk *)mp->b_rptr;
8788         mblk_t          *mp1 = mp->b_cont;
8789         mod_ioc_prop_t  *pioc;
8790         uint_t          flags;
8791         uint_t          pioc_size;
8792 
8793         /* do sanity checks on various arguments */
8794         if (mp1 == NULL || iocp->ioc_count == 0 ||
8795             iocp->ioc_count == TRANSPARENT) {
8796                 return (B_FALSE);
8797         }
8798         if (msgdsize(mp1) < iocp->ioc_count) {
8799                 if (!pullupmsg(mp1, iocp->ioc_count))
8800                         return (B_FALSE);
8801         }
8802 
8803         pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8804 
8805         /* sanity checks on mpr_valsize */
8806         pioc_size = sizeof (mod_ioc_prop_t);
8807         if (pioc->mpr_valsize != 0)
8808                 pioc_size += pioc->mpr_valsize - 1;
8809 
8810         if (iocp->ioc_count != pioc_size)
8811                 return (B_FALSE);
8812 
8813         flags = pioc->mpr_flags;
8814         if (iocp->ioc_cmd == SIOCSETPROP) {
8815                 /*
8816                  * One can either reset the value to it's default value or
8817                  * change the current value or append/remove the value from
8818                  * a multi-valued properties.
8819                  */
8820                 if ((flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8821                     flags != MOD_PROP_ACTIVE &&
8822                     flags != (MOD_PROP_ACTIVE|MOD_PROP_APPEND) &&
8823                     flags != (MOD_PROP_ACTIVE|MOD_PROP_REMOVE))
8824                         return (B_FALSE);
8825         } else {
8826                 ASSERT(iocp->ioc_cmd == SIOCGETPROP);
8827 
8828                 /*
8829                  * One can retrieve only one kind of property information
8830                  * at a time.
8831                  */
8832                 if ((flags & MOD_PROP_ACTIVE) != MOD_PROP_ACTIVE &&
8833                     (flags & MOD_PROP_DEFAULT) != MOD_PROP_DEFAULT &&
8834                     (flags & MOD_PROP_POSSIBLE) != MOD_PROP_POSSIBLE &&
8835                     (flags & MOD_PROP_PERM) != MOD_PROP_PERM)
8836                         return (B_FALSE);
8837         }
8838 
8839         return (B_TRUE);
8840 }
8841 
8842 /*
8843  * process the SIOC{SET|GET}PROP ioctl's
8844  */
8845 /* ARGSUSED */
8846 static void
8847 ip_sioctl_getsetprop(queue_t *q, mblk_t *mp)
8848 {
8849         struct iocblk   *iocp = (struct iocblk *)mp->b_rptr;
8850         mblk_t          *mp1 = mp->b_cont;
8851         mod_ioc_prop_t  *pioc;
8852         mod_prop_info_t *ptbl = NULL, *pinfo = NULL;
8853         ip_stack_t      *ipst;
8854         netstack_t      *stack;
8855         cred_t          *cr;
8856         boolean_t       set;
8857         int             err;
8858 
8859         ASSERT(q->q_next == NULL);
8860         ASSERT(CONN_Q(q));
8861 
8862         if (!getset_ioctl_checks(mp)) {
8863                 miocnak(q, mp, 0, EINVAL);
8864                 return;
8865         }
8866         ipst = CONNQ_TO_IPST(q);
8867         stack = ipst->ips_netstack;
8868         pioc = (mod_ioc_prop_t *)mp1->b_rptr;
8869 
8870         switch (pioc->mpr_proto) {
8871         case MOD_PROTO_IP:
8872         case MOD_PROTO_IPV4:
8873         case MOD_PROTO_IPV6:
8874                 ptbl = ipst->ips_propinfo_tbl;
8875                 break;
8876         case MOD_PROTO_RAWIP:
8877                 ptbl = stack->netstack_icmp->is_propinfo_tbl;
8878                 break;
8879         case MOD_PROTO_TCP:
8880                 ptbl = stack->netstack_tcp->tcps_propinfo_tbl;
8881                 break;
8882         case MOD_PROTO_UDP:
8883                 ptbl = stack->netstack_udp->us_propinfo_tbl;
8884                 break;
8885         case MOD_PROTO_SCTP:
8886                 ptbl = stack->netstack_sctp->sctps_propinfo_tbl;
8887                 break;
8888         default:
8889                 miocnak(q, mp, 0, EINVAL);
8890                 return;
8891         }
8892 
8893         pinfo = mod_prop_lookup(ptbl, pioc->mpr_name, pioc->mpr_proto);
8894         if (pinfo == NULL) {
8895                 miocnak(q, mp, 0, ENOENT);
8896                 return;
8897         }
8898 
8899         set = (iocp->ioc_cmd == SIOCSETPROP) ? B_TRUE : B_FALSE;
8900         if (set && pinfo->mpi_setf != NULL) {
8901                 cr = msg_getcred(mp, NULL);
8902                 if (cr == NULL)
8903                         cr = iocp->ioc_cr;
8904                 err = pinfo->mpi_setf(stack, cr, pinfo, pioc->mpr_ifname,
8905                     pioc->mpr_val, pioc->mpr_flags);
8906         } else if (!set && pinfo->mpi_getf != NULL) {
8907                 err = pinfo->mpi_getf(stack, pinfo, pioc->mpr_ifname,
8908                     pioc->mpr_val, pioc->mpr_valsize, pioc->mpr_flags);
8909         } else {
8910                 err = EPERM;
8911         }
8912 
8913         if (err != 0) {
8914                 miocnak(q, mp, 0, err);
8915         } else {
8916                 if (set)
8917                         miocack(q, mp, 0, 0);
8918                 else    /* For get, we need to return back the data */
8919                         miocack(q, mp, iocp->ioc_count, 0);
8920         }
8921 }
8922 
8923 /*
8924  * process the legacy ND_GET, ND_SET ioctl just for {ip|ip6}_forwarding
8925  * as several routing daemons have unfortunately used this 'unpublished'
8926  * but well-known ioctls.
8927  */
8928 /* ARGSUSED */
8929 static void
8930 ip_process_legacy_nddprop(queue_t *q, mblk_t *mp)
8931 {
8932         struct iocblk   *iocp = (struct iocblk *)mp->b_rptr;
8933         mblk_t          *mp1 = mp->b_cont;
8934         char            *pname, *pval, *buf;
8935         uint_t          bufsize, proto;
8936         mod_prop_info_t *pinfo = NULL;
8937         ip_stack_t      *ipst;
8938         int             err = 0;
8939 
8940         ASSERT(CONN_Q(q));
8941         ipst = CONNQ_TO_IPST(q);
8942 
8943         if (iocp->ioc_count == 0 || mp1 == NULL) {
8944                 miocnak(q, mp, 0, EINVAL);
8945                 return;
8946         }
8947 
8948         mp1->b_datap->db_lim[-1] = '\0';  /* Force null termination */
8949         pval = buf = pname = (char *)mp1->b_rptr;
8950         bufsize = MBLKL(mp1);
8951 
8952         if (strcmp(pname, "ip_forwarding") == 0) {
8953                 pname = "forwarding";
8954                 proto = MOD_PROTO_IPV4;
8955         } else if (strcmp(pname, "ip6_forwarding") == 0) {
8956                 pname = "forwarding";
8957                 proto = MOD_PROTO_IPV6;
8958         } else {
8959                 miocnak(q, mp, 0, EINVAL);
8960                 return;
8961         }
8962 
8963         pinfo = mod_prop_lookup(ipst->ips_propinfo_tbl, pname, proto);
8964 
8965         switch (iocp->ioc_cmd) {
8966         case ND_GET:
8967                 if ((err = pinfo->mpi_getf(ipst->ips_netstack, pinfo, NULL, buf,
8968                     bufsize, 0)) == 0) {
8969                         miocack(q, mp, iocp->ioc_count, 0);
8970                         return;
8971                 }
8972                 break;
8973         case ND_SET:
8974                 /*
8975                  * buffer will have property name and value in the following
8976                  * format,
8977                  * <property name>'\0'<property value>'\0', extract them;
8978                  */
8979                 while (*pval++)
8980                         noop;
8981 
8982                 if (!*pval || pval >= (char *)mp1->b_wptr) {
8983                         err = EINVAL;
8984                 } else if ((err = pinfo->mpi_setf(ipst->ips_netstack, NULL,
8985                     pinfo, NULL, pval, 0)) == 0) {
8986                         miocack(q, mp, 0, 0);
8987                         return;
8988                 }
8989                 break;
8990         default:
8991                 err = EINVAL;
8992                 break;
8993         }
8994         miocnak(q, mp, 0, err);
8995 }
8996 
8997 /*
8998  * Wrapper function for resuming deferred ioctl processing
8999  * Used for SIOCGDSTINFO, SIOCGIP6ADDRPOLICY, SIOCGMSFILTER,
9000  * SIOCSMSFILTER, SIOCGIPMSFILTER, and SIOCSIPMSFILTER currently.
9001  */
9002 /* ARGSUSED */
9003 void
9004 ip_sioctl_copyin_resume(ipsq_t *dummy_ipsq, queue_t *q, mblk_t *mp,
9005     void *dummy_arg)
9006 {
9007         ip_sioctl_copyin_setup(q, mp);
9008 }
9009 
9010 /*
9011  * ip_sioctl_copyin_setup is called by ip_wput_nondata with any M_IOCTL message
9012  * that arrives.  Most of the IOCTLs are "socket" IOCTLs which we handle
9013  * in either I_STR or TRANSPARENT form, using the mi_copy facility.
9014  * We establish here the size of the block to be copied in.  mi_copyin
9015  * arranges for this to happen, an processing continues in ip_wput_nondata with
9016  * an M_IOCDATA message.
9017  */
9018 void
9019 ip_sioctl_copyin_setup(queue_t *q, mblk_t *mp)
9020 {
9021         int     copyin_size;
9022         struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
9023         ip_ioctl_cmd_t *ipip;
9024         cred_t *cr;
9025         ip_stack_t      *ipst;
9026 
9027         if (CONN_Q(q))
9028                 ipst = CONNQ_TO_IPST(q);
9029         else
9030                 ipst = ILLQ_TO_IPST(q);
9031 
9032         ipip = ip_sioctl_lookup(iocp->ioc_cmd);
9033         if (ipip == NULL) {
9034                 /*
9035                  * The ioctl is not one we understand or own.
9036                  * Pass it along to be processed down stream,
9037                  * if this is a module instance of IP, else nak
9038                  * the ioctl.
9039                  */
9040                 if (q->q_next == NULL) {
9041                         goto nak;
9042                 } else {
9043                         putnext(q, mp);
9044                         return;
9045                 }
9046         }
9047 
9048         /*
9049          * If this is deferred, then we will do all the checks when we
9050          * come back.
9051          */
9052         if ((iocp->ioc_cmd == SIOCGDSTINFO ||
9053             iocp->ioc_cmd == SIOCGIP6ADDRPOLICY) && !ip6_asp_can_lookup(ipst)) {
9054                 ip6_asp_pending_op(q, mp, ip_sioctl_copyin_resume);
9055                 return;
9056         }
9057 
9058         /*
9059          * Only allow a very small subset of IP ioctls on this stream if
9060          * IP is a module and not a driver. Allowing ioctls to be processed
9061          * in this case may cause assert failures or data corruption.
9062          * Typically G[L]IFFLAGS, SLIFNAME/IF_UNITSEL are the only few
9063          * ioctls allowed on an IP module stream, after which this stream
9064          * normally becomes a multiplexor (at which time the stream head
9065          * will fail all ioctls).
9066          */
9067         if ((q->q_next != NULL) && !(ipip->ipi_flags & IPI_MODOK)) {
9068                 goto nak;
9069         }
9070 
9071         /* Make sure we have ioctl data to process. */
9072         if (mp->b_cont == NULL && !(ipip->ipi_flags & IPI_NULL_BCONT))
9073                 goto nak;
9074 
9075         /*
9076          * Prefer dblk credential over ioctl credential; some synthesized
9077          * ioctls have kcred set because there's no way to crhold()
9078          * a credential in some contexts.  (ioc_cr is not crfree() by
9079          * the framework; the caller of ioctl needs to hold the reference
9080          * for the duration of the call).
9081          */
9082         cr = msg_getcred(mp, NULL);
9083         if (cr == NULL)
9084                 cr = iocp->ioc_cr;
9085 
9086         /* Make sure normal users don't send down privileged ioctls */
9087         if ((ipip->ipi_flags & IPI_PRIV) &&
9088             (cr != NULL) && secpolicy_ip_config(cr, B_TRUE) != 0) {
9089                 /* We checked the privilege earlier but log it here */
9090                 miocnak(q, mp, 0, secpolicy_ip_config(cr, B_FALSE));
9091                 return;
9092         }
9093 
9094         /*
9095          * The ioctl command tables can only encode fixed length
9096          * ioctl data. If the length is variable, the table will
9097          * encode the length as zero. Such special cases are handled
9098          * below in the switch.
9099          */
9100         if (ipip->ipi_copyin_size != 0) {
9101                 mi_copyin(q, mp, NULL, ipip->ipi_copyin_size);
9102                 return;
9103         }
9104 
9105         switch (iocp->ioc_cmd) {
9106         case O_SIOCGIFCONF:
9107         case SIOCGIFCONF:
9108                 /*
9109                  * This IOCTL is hilarious.  See comments in
9110                  * ip_sioctl_get_ifconf for the story.
9111                  */
9112                 if (iocp->ioc_count == TRANSPARENT)
9113                         copyin_size = SIZEOF_STRUCT(ifconf,
9114                             iocp->ioc_flag);
9115                 else
9116                         copyin_size = iocp->ioc_count;
9117                 mi_copyin(q, mp, NULL, copyin_size);
9118                 return;
9119 
9120         case O_SIOCGLIFCONF:
9121         case SIOCGLIFCONF:
9122                 copyin_size = SIZEOF_STRUCT(lifconf, iocp->ioc_flag);
9123                 mi_copyin(q, mp, NULL, copyin_size);
9124                 return;
9125 
9126         case SIOCGLIFSRCOF:
9127                 copyin_size = SIZEOF_STRUCT(lifsrcof, iocp->ioc_flag);
9128                 mi_copyin(q, mp, NULL, copyin_size);
9129                 return;
9130 
9131         case SIOCGIP6ADDRPOLICY:
9132                 ip_sioctl_ip6addrpolicy(q, mp);
9133                 ip6_asp_table_refrele(ipst);
9134                 return;
9135 
9136         case SIOCSIP6ADDRPOLICY:
9137                 ip_sioctl_ip6addrpolicy(q, mp);
9138                 return;
9139 
9140         case SIOCGDSTINFO:
9141                 ip_sioctl_dstinfo(q, mp);
9142                 ip6_asp_table_refrele(ipst);
9143                 return;
9144 
9145         case ND_SET:
9146         case ND_GET:
9147                 ip_process_legacy_nddprop(q, mp);
9148                 return;
9149 
9150         case SIOCSETPROP:
9151         case SIOCGETPROP:
9152                 ip_sioctl_getsetprop(q, mp);
9153                 return;
9154 
9155         case I_PLINK:
9156         case I_PUNLINK:
9157         case I_LINK:
9158         case I_UNLINK:
9159                 /*
9160                  * We treat non-persistent link similarly as the persistent
9161                  * link case, in terms of plumbing/unplumbing, as well as
9162                  * dynamic re-plumbing events indicator.  See comments
9163                  * in ip_sioctl_plink() for more.
9164                  *
9165                  * Request can be enqueued in the 'ipsq' while waiting
9166                  * to become exclusive. So bump up the conn ref.
9167                  */
9168                 if (CONN_Q(q)) {
9169                         CONN_INC_REF(Q_TO_CONN(q));
9170                         CONN_INC_IOCTLREF(Q_TO_CONN(q))
9171                 }
9172                 ip_sioctl_plink(NULL, q, mp, NULL);
9173                 return;
9174 
9175         case IP_IOCTL:
9176                 ip_wput_ioctl(q, mp);
9177                 return;
9178 
9179         case SIOCILB:
9180                 /* The ioctl length varies depending on the ILB command. */
9181                 copyin_size = iocp->ioc_count;
9182                 if (copyin_size < sizeof (ilb_cmd_t))
9183                         goto nak;
9184                 mi_copyin(q, mp, NULL, copyin_size);
9185                 return;
9186 
9187         default:
9188                 cmn_err(CE_WARN, "Unknown ioctl %d/0x%x slipped through.",
9189                     iocp->ioc_cmd, iocp->ioc_cmd);
9190                 /* FALLTHRU */
9191         }
9192 nak:
9193         if (mp->b_cont != NULL) {
9194                 freemsg(mp->b_cont);
9195                 mp->b_cont = NULL;
9196         }
9197         iocp->ioc_error = EINVAL;
9198         mp->b_datap->db_type = M_IOCNAK;
9199         iocp->ioc_count = 0;
9200         qreply(q, mp);
9201 }
9202 
9203 static void
9204 ip_sioctl_garp_reply(mblk_t *mp, ill_t *ill, void *hwaddr, int flags)
9205 {
9206         struct arpreq *ar;
9207         struct xarpreq *xar;
9208         mblk_t  *tmp;
9209         struct iocblk *iocp;
9210         int x_arp_ioctl = B_FALSE;
9211         int *flagsp;
9212         char *storage = NULL;
9213 
9214         ASSERT(ill != NULL);
9215 
9216         iocp = (struct iocblk *)mp->b_rptr;
9217         ASSERT(iocp->ioc_cmd == SIOCGXARP || iocp->ioc_cmd == SIOCGARP);
9218 
9219         tmp = (mp->b_cont)->b_cont; /* xarpreq/arpreq */
9220         if ((iocp->ioc_cmd == SIOCGXARP) ||
9221             (iocp->ioc_cmd == SIOCSXARP)) {
9222                 x_arp_ioctl = B_TRUE;
9223                 xar = (struct xarpreq *)tmp->b_rptr;
9224                 flagsp = &xar->xarp_flags;
9225                 storage = xar->xarp_ha.sdl_data;
9226         } else {
9227                 ar = (struct arpreq *)tmp->b_rptr;
9228                 flagsp = &ar->arp_flags;
9229                 storage = ar->arp_ha.sa_data;
9230         }
9231 
9232         /*
9233          * We're done if this is not an SIOCG{X}ARP
9234          */
9235         if (x_arp_ioctl) {
9236                 storage += ill_xarp_info(&xar->xarp_ha, ill);
9237                 if ((ill->ill_phys_addr_length + ill->ill_name_length) >
9238                     sizeof (xar->xarp_ha.sdl_data)) {
9239                         iocp->ioc_error = EINVAL;
9240                         return;
9241                 }
9242         }
9243         *flagsp = ATF_INUSE;
9244         /*
9245          * If /sbin/arp told us we are the authority using the "permanent"
9246          * flag, or if this is one of my addresses print "permanent"
9247          * in the /sbin/arp output.
9248          */
9249         if ((flags & NCE_F_MYADDR) || (flags & NCE_F_AUTHORITY))
9250                 *flagsp |= ATF_AUTHORITY;
9251         if (flags & NCE_F_NONUD)
9252                 *flagsp |= ATF_PERM; /* not subject to aging */
9253         if (flags & NCE_F_PUBLISH)
9254                 *flagsp |= ATF_PUBL;
9255         if (hwaddr != NULL) {
9256                 *flagsp |= ATF_COM;
9257                 bcopy((char *)hwaddr, storage, ill->ill_phys_addr_length);
9258         }
9259 }
9260 
9261 /*
9262  * Create a new logical interface. If ipif_id is zero (i.e. not a logical
9263  * interface) create the next available logical interface for this
9264  * physical interface.
9265  * If ipif is NULL (i.e. the lookup didn't find one) attempt to create an
9266  * ipif with the specified name.
9267  *
9268  * If the address family is not AF_UNSPEC then set the address as well.
9269  *
9270  * If ip_sioctl_addr returns EINPROGRESS then the ioctl (the copyout)
9271  * is completed when the DL_BIND_ACK arrive in ip_rput_dlpi_writer.
9272  *
9273  * Executed as a writer on the ill.
9274  * So no lock is needed to traverse the ipif chain, or examine the
9275  * phyint flags.
9276  */
9277 /* ARGSUSED */
9278 int
9279 ip_sioctl_addif(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
9280     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9281 {
9282         mblk_t  *mp1;
9283         struct lifreq *lifr;
9284         boolean_t       isv6;
9285         boolean_t       exists;
9286         char    *name;
9287         char    *endp;
9288         char    *cp;
9289         int     namelen;
9290         ipif_t  *ipif;
9291         long    id;
9292         ipsq_t  *ipsq;
9293         ill_t   *ill;
9294         sin_t   *sin;
9295         int     err = 0;
9296         boolean_t found_sep = B_FALSE;
9297         conn_t  *connp;
9298         zoneid_t zoneid;
9299         ip_stack_t *ipst = CONNQ_TO_IPST(q);
9300 
9301         ASSERT(q->q_next == NULL);
9302         ip1dbg(("ip_sioctl_addif\n"));
9303         /* Existence of mp1 has been checked in ip_wput_nondata */
9304         mp1 = mp->b_cont->b_cont;
9305         /*
9306          * Null terminate the string to protect against buffer
9307          * overrun. String was generated by user code and may not
9308          * be trusted.
9309          */
9310         lifr = (struct lifreq *)mp1->b_rptr;
9311         lifr->lifr_name[LIFNAMSIZ - 1] = '\0';
9312         name = lifr->lifr_name;
9313         ASSERT(CONN_Q(q));
9314         connp = Q_TO_CONN(q);
9315         isv6 = (connp->conn_family == AF_INET6);
9316         zoneid = connp->conn_zoneid;
9317         namelen = mi_strlen(name);
9318         if (namelen == 0)
9319                 return (EINVAL);
9320 
9321         exists = B_FALSE;
9322         if ((namelen + 1 == sizeof (ipif_loopback_name)) &&
9323             (mi_strcmp(name, ipif_loopback_name) == 0)) {
9324                 /*
9325                  * Allow creating lo0 using SIOCLIFADDIF.
9326                  * can't be any other writer thread. So can pass null below
9327                  * for the last 4 args to ipif_lookup_name.
9328                  */
9329                 ipif = ipif_lookup_on_name(lifr->lifr_name, namelen, B_TRUE,
9330                     &exists, isv6, zoneid, ipst);
9331                 /* Prevent any further action */
9332                 if (ipif == NULL) {
9333                         return (ENOBUFS);
9334                 } else if (!exists) {
9335                         /* We created the ipif now and as writer */
9336                         ipif_refrele(ipif);
9337                         return (0);
9338                 } else {
9339                         ill = ipif->ipif_ill;
9340                         ill_refhold(ill);
9341                         ipif_refrele(ipif);
9342                 }
9343         } else {
9344                 /* Look for a colon in the name. */
9345                 endp = &name[namelen];
9346                 for (cp = endp; --cp > name; ) {
9347                         if (*cp == IPIF_SEPARATOR_CHAR) {
9348                                 found_sep = B_TRUE;
9349                                 /*
9350                                  * Reject any non-decimal aliases for plumbing
9351                                  * of logical interfaces. Aliases with leading
9352                                  * zeroes are also rejected as they introduce
9353                                  * ambiguity in the naming of the interfaces.
9354                                  * Comparing with "0" takes care of all such
9355                                  * cases.
9356                                  */
9357                                 if ((strncmp("0", cp+1, 1)) == 0)
9358                                         return (EINVAL);
9359 
9360                                 if (ddi_strtol(cp+1, &endp, 10, &id) != 0 ||
9361                                     id <= 0 || *endp != '\0') {
9362                                         return (EINVAL);
9363                                 }
9364                                 *cp = '\0';
9365                                 break;
9366                         }
9367                 }
9368                 ill = ill_lookup_on_name(name, B_FALSE, isv6, NULL, ipst);
9369                 if (found_sep)
9370                         *cp = IPIF_SEPARATOR_CHAR;
9371                 if (ill == NULL)
9372                         return (ENXIO);
9373         }
9374 
9375         ipsq = ipsq_try_enter(NULL, ill, q, mp, ip_process_ioctl, NEW_OP,
9376             B_TRUE);
9377 
9378         /*
9379          * Release the refhold due to the lookup, now that we are excl
9380          * or we are just returning
9381          */
9382         ill_refrele(ill);
9383 
9384         if (ipsq == NULL)
9385                 return (EINPROGRESS);
9386 
9387         /* We are now exclusive on the IPSQ */
9388         ASSERT(IAM_WRITER_ILL(ill));
9389 
9390         if (found_sep) {
9391                 /* Now see if there is an IPIF with this unit number. */
9392                 for (ipif = ill->ill_ipif; ipif != NULL;
9393                     ipif = ipif->ipif_next) {
9394                         if (ipif->ipif_id == id) {
9395                                 err = EEXIST;
9396                                 goto done;
9397                         }
9398                 }
9399         }
9400 
9401         /*
9402          * We use IRE_LOCAL for lo0:1 etc. for "receive only" use
9403          * of lo0.  Plumbing for lo0:0 happens in ipif_lookup_on_name()
9404          * instead.
9405          */
9406         if ((ipif = ipif_allocate(ill, found_sep ? id : -1, IRE_LOCAL,
9407             B_TRUE, B_TRUE, &err)) == NULL) {
9408                 goto done;
9409         }
9410 
9411         /* Return created name with ioctl */
9412         (void) sprintf(lifr->lifr_name, "%s%c%d", ill->ill_name,
9413             IPIF_SEPARATOR_CHAR, ipif->ipif_id);
9414         ip1dbg(("created %s\n", lifr->lifr_name));
9415 
9416         /* Set address */
9417         sin = (sin_t *)&lifr->lifr_addr;
9418         if (sin->sin_family != AF_UNSPEC) {
9419                 err = ip_sioctl_addr(ipif, sin, q, mp,
9420                     &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], lifr);
9421         }
9422 
9423 done:
9424         ipsq_exit(ipsq);
9425         return (err);
9426 }
9427 
9428 /*
9429  * Remove an existing logical interface. If ipif_id is zero (i.e. not a logical
9430  * interface) delete it based on the IP address (on this physical interface).
9431  * Otherwise delete it based on the ipif_id.
9432  * Also, special handling to allow a removeif of lo0.
9433  */
9434 /* ARGSUSED */
9435 int
9436 ip_sioctl_removeif(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9437     ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9438 {
9439         conn_t          *connp;
9440         ill_t           *ill = ipif->ipif_ill;
9441         boolean_t        success;
9442         ip_stack_t      *ipst;
9443 
9444         ipst = CONNQ_TO_IPST(q);
9445 
9446         ASSERT(q->q_next == NULL);
9447         ip1dbg(("ip_sioctl_remove_if(%s:%u %p)\n",
9448             ill->ill_name, ipif->ipif_id, (void *)ipif));
9449         ASSERT(IAM_WRITER_IPIF(ipif));
9450 
9451         connp = Q_TO_CONN(q);
9452         /*
9453          * Special case for unplumbing lo0 (the loopback physical interface).
9454          * If unplumbing lo0, the incoming address structure has been
9455          * initialized to all zeros. When unplumbing lo0, all its logical
9456          * interfaces must be removed too.
9457          *
9458          * Note that this interface may be called to remove a specific
9459          * loopback logical interface (eg, lo0:1). But in that case
9460          * ipif->ipif_id != 0 so that the code path for that case is the
9461          * same as any other interface (meaning it skips the code directly
9462          * below).
9463          */
9464         if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9465                 if (sin->sin_family == AF_UNSPEC &&
9466                     (IN6_IS_ADDR_UNSPECIFIED(&((sin6_t *)sin)->sin6_addr))) {
9467                         /*
9468                          * Mark it condemned. No new ref. will be made to ill.
9469                          */
9470                         mutex_enter(&ill->ill_lock);
9471                         ill->ill_state_flags |= ILL_CONDEMNED;
9472                         for (ipif = ill->ill_ipif; ipif != NULL;
9473                             ipif = ipif->ipif_next) {
9474                                 ipif->ipif_state_flags |= IPIF_CONDEMNED;
9475                         }
9476                         mutex_exit(&ill->ill_lock);
9477 
9478                         ipif = ill->ill_ipif;
9479                         /* unplumb the loopback interface */
9480                         ill_delete(ill);
9481                         mutex_enter(&connp->conn_lock);
9482                         mutex_enter(&ill->ill_lock);
9483 
9484                         /* Are any references to this ill active */
9485                         if (ill_is_freeable(ill)) {
9486                                 mutex_exit(&ill->ill_lock);
9487                                 mutex_exit(&connp->conn_lock);
9488                                 ill_delete_tail(ill);
9489                                 mi_free(ill);
9490                                 return (0);
9491                         }
9492                         success = ipsq_pending_mp_add(connp, ipif,
9493                             CONNP_TO_WQ(connp), mp, ILL_FREE);
9494                         mutex_exit(&connp->conn_lock);
9495                         mutex_exit(&ill->ill_lock);
9496                         if (success)
9497                                 return (EINPROGRESS);
9498                         else
9499                                 return (EINTR);
9500                 }
9501         }
9502 
9503         if (ipif->ipif_id == 0) {
9504                 ipsq_t *ipsq;
9505 
9506                 /* Find based on address */
9507                 if (ipif->ipif_isv6) {
9508                         sin6_t *sin6;
9509 
9510                         if (sin->sin_family != AF_INET6)
9511                                 return (EAFNOSUPPORT);
9512 
9513                         sin6 = (sin6_t *)sin;
9514                         /* We are a writer, so we should be able to lookup */
9515                         ipif = ipif_lookup_addr_exact_v6(&sin6->sin6_addr, ill,
9516                             ipst);
9517                 } else {
9518                         if (sin->sin_family != AF_INET)
9519                                 return (EAFNOSUPPORT);
9520 
9521                         /* We are a writer, so we should be able to lookup */
9522                         ipif = ipif_lookup_addr_exact(sin->sin_addr.s_addr, ill,
9523                             ipst);
9524                 }
9525                 if (ipif == NULL) {
9526                         return (EADDRNOTAVAIL);
9527                 }
9528 
9529                 /*
9530                  * It is possible for a user to send an SIOCLIFREMOVEIF with
9531                  * lifr_name of the physical interface but with an ip address
9532                  * lifr_addr of a logical interface plumbed over it.
9533                  * So update ipx_current_ipif now that ipif points to the
9534                  * correct one.
9535                  */
9536                 ipsq = ipif->ipif_ill->ill_phyint->phyint_ipsq;
9537                 ipsq->ipsq_xop->ipx_current_ipif = ipif;
9538 
9539                 /* This is a writer */
9540                 ipif_refrele(ipif);
9541         }
9542 
9543         /*
9544          * Can not delete instance zero since it is tied to the ill.
9545          */
9546         if (ipif->ipif_id == 0)
9547                 return (EBUSY);
9548 
9549         mutex_enter(&ill->ill_lock);
9550         ipif->ipif_state_flags |= IPIF_CONDEMNED;
9551         mutex_exit(&ill->ill_lock);
9552 
9553         ipif_free(ipif);
9554 
9555         mutex_enter(&connp->conn_lock);
9556         mutex_enter(&ill->ill_lock);
9557 
9558         /* Are any references to this ipif active */
9559         if (ipif_is_freeable(ipif)) {
9560                 mutex_exit(&ill->ill_lock);
9561                 mutex_exit(&connp->conn_lock);
9562                 ipif_non_duplicate(ipif);
9563                 (void) ipif_down_tail(ipif);
9564                 ipif_free_tail(ipif); /* frees ipif */
9565                 return (0);
9566         }
9567         success = ipsq_pending_mp_add(connp, ipif, CONNP_TO_WQ(connp), mp,
9568             IPIF_FREE);
9569         mutex_exit(&ill->ill_lock);
9570         mutex_exit(&connp->conn_lock);
9571         if (success)
9572                 return (EINPROGRESS);
9573         else
9574                 return (EINTR);
9575 }
9576 
9577 /*
9578  * Restart the removeif ioctl. The refcnt has gone down to 0.
9579  * The ipif is already condemned. So can't find it thru lookups.
9580  */
9581 /* ARGSUSED */
9582 int
9583 ip_sioctl_removeif_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q,
9584     mblk_t *mp, ip_ioctl_cmd_t *ipip, void *dummy_if_req)
9585 {
9586         ill_t *ill = ipif->ipif_ill;
9587 
9588         ASSERT(IAM_WRITER_IPIF(ipif));
9589         ASSERT(ipif->ipif_state_flags & IPIF_CONDEMNED);
9590 
9591         ip1dbg(("ip_sioctl_removeif_restart(%s:%u %p)\n",
9592             ill->ill_name, ipif->ipif_id, (void *)ipif));
9593 
9594         if (ipif->ipif_id == 0 && ill->ill_net_type == IRE_LOOPBACK) {
9595                 ASSERT(ill->ill_state_flags & ILL_CONDEMNED);
9596                 ill_delete_tail(ill);
9597                 mi_free(ill);
9598                 return (0);
9599         }
9600 
9601         ipif_non_duplicate(ipif);
9602         (void) ipif_down_tail(ipif);
9603         ipif_free_tail(ipif);
9604 
9605         return (0);
9606 }
9607 
9608 /*
9609  * Set the local interface address using the given prefix and ill_token.
9610  */
9611 /* ARGSUSED */
9612 int
9613 ip_sioctl_prefix(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9614     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9615 {
9616         int err;
9617         in6_addr_t v6addr;
9618         sin6_t *sin6;
9619         ill_t *ill;
9620         int i;
9621 
9622         ip1dbg(("ip_sioctl_prefix(%s:%u %p)\n",
9623             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9624 
9625         ASSERT(IAM_WRITER_IPIF(ipif));
9626 
9627         if (!ipif->ipif_isv6)
9628                 return (EINVAL);
9629 
9630         if (sin->sin_family != AF_INET6)
9631                 return (EAFNOSUPPORT);
9632 
9633         sin6 = (sin6_t *)sin;
9634         v6addr = sin6->sin6_addr;
9635         ill = ipif->ipif_ill;
9636 
9637         if (IN6_IS_ADDR_UNSPECIFIED(&v6addr) ||
9638             IN6_IS_ADDR_UNSPECIFIED(&ill->ill_token))
9639                 return (EADDRNOTAVAIL);
9640 
9641         for (i = 0; i < 4; i++)
9642                 sin6->sin6_addr.s6_addr32[i] |= ill->ill_token.s6_addr32[i];
9643 
9644         err = ip_sioctl_addr(ipif, sin, q, mp,
9645             &ip_ndx_ioctl_table[SIOCLIFADDR_NDX], dummy_ifreq);
9646         return (err);
9647 }
9648 
9649 /*
9650  * Restart entry point to restart the address set operation after the
9651  * refcounts have dropped to zero.
9652  */
9653 /* ARGSUSED */
9654 int
9655 ip_sioctl_prefix_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9656     ip_ioctl_cmd_t *ipip, void *ifreq)
9657 {
9658         ip1dbg(("ip_sioctl_prefix_restart(%s:%u %p)\n",
9659             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9660         return (ip_sioctl_addr_restart(ipif, sin, q, mp, ipip, ifreq));
9661 }
9662 
9663 /*
9664  * Set the local interface address.
9665  * Allow an address of all zero when the interface is down.
9666  */
9667 /* ARGSUSED */
9668 int
9669 ip_sioctl_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9670     ip_ioctl_cmd_t *dummy_ipip, void *dummy_ifreq)
9671 {
9672         int err = 0;
9673         in6_addr_t v6addr;
9674         boolean_t need_up = B_FALSE;
9675         ill_t *ill;
9676         int i;
9677 
9678         ip1dbg(("ip_sioctl_addr(%s:%u %p)\n",
9679             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9680 
9681         ASSERT(IAM_WRITER_IPIF(ipif));
9682 
9683         ill = ipif->ipif_ill;
9684         if (ipif->ipif_isv6) {
9685                 sin6_t *sin6;
9686                 phyint_t *phyi;
9687 
9688                 if (sin->sin_family != AF_INET6)
9689                         return (EAFNOSUPPORT);
9690 
9691                 sin6 = (sin6_t *)sin;
9692                 v6addr = sin6->sin6_addr;
9693                 phyi = ill->ill_phyint;
9694 
9695                 /*
9696                  * Enforce that true multicast interfaces have a link-local
9697                  * address for logical unit 0.
9698                  *
9699                  * However for those ipif's for which link-local address was
9700                  * not created by default, also allow setting :: as the address.
9701                  * This scenario would arise, when we delete an address on ipif
9702                  * with logical unit 0, we would want to set :: as the address.
9703                  */
9704                 if (ipif->ipif_id == 0 &&
9705                     (ill->ill_flags & ILLF_MULTICAST) &&
9706                     !(ipif->ipif_flags & (IPIF_POINTOPOINT)) &&
9707                     !(phyi->phyint_flags & (PHYI_LOOPBACK)) &&
9708                     !IN6_IS_ADDR_LINKLOCAL(&v6addr)) {
9709 
9710                         /*
9711                          * if default link-local was not created by kernel for
9712                          * this ill, allow setting :: as the address on ipif:0.
9713                          */
9714                         if (ill->ill_flags & ILLF_NOLINKLOCAL) {
9715                                 if (!IN6_IS_ADDR_UNSPECIFIED(&v6addr))
9716                                         return (EADDRNOTAVAIL);
9717                         } else {
9718                                 return (EADDRNOTAVAIL);
9719                         }
9720                 }
9721 
9722                 /*
9723                  * up interfaces shouldn't have the unspecified address
9724                  * unless they also have the IPIF_NOLOCAL flags set and
9725                  * have a subnet assigned.
9726                  */
9727                 if ((ipif->ipif_flags & IPIF_UP) &&
9728                     IN6_IS_ADDR_UNSPECIFIED(&v6addr) &&
9729                     (!(ipif->ipif_flags & IPIF_NOLOCAL) ||
9730                     IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) {
9731                         return (EADDRNOTAVAIL);
9732                 }
9733 
9734                 if (!ip_local_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
9735                         return (EADDRNOTAVAIL);
9736         } else {
9737                 ipaddr_t addr;
9738 
9739                 if (sin->sin_family != AF_INET)
9740                         return (EAFNOSUPPORT);
9741 
9742                 addr = sin->sin_addr.s_addr;
9743 
9744                 /* Allow INADDR_ANY as the local address. */
9745                 if (addr != INADDR_ANY &&
9746                     !ip_addr_ok_v4(addr, ipif->ipif_net_mask))
9747                         return (EADDRNOTAVAIL);
9748 
9749                 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9750         }
9751         /*
9752          * verify that the address being configured is permitted by the
9753          * ill_allowed_ips[] for the interface.
9754          */
9755         if (ill->ill_allowed_ips_cnt > 0) {
9756                 for (i = 0; i < ill->ill_allowed_ips_cnt; i++) {
9757                         if (IN6_ARE_ADDR_EQUAL(&ill->ill_allowed_ips[i],
9758                             &v6addr))
9759                                 break;
9760                 }
9761                 if (i == ill->ill_allowed_ips_cnt) {
9762                         pr_addr_dbg("!allowed addr %s\n", AF_INET6, &v6addr);
9763                         return (EPERM);
9764                 }
9765         }
9766         /*
9767          * Even if there is no change we redo things just to rerun
9768          * ipif_set_default.
9769          */
9770         if (ipif->ipif_flags & IPIF_UP) {
9771                 /*
9772                  * Setting a new local address, make sure
9773                  * we have net and subnet bcast ire's for
9774                  * the old address if we need them.
9775                  */
9776                 /*
9777                  * If the interface is already marked up,
9778                  * we call ipif_down which will take care
9779                  * of ditching any IREs that have been set
9780                  * up based on the old interface address.
9781                  */
9782                 err = ipif_logical_down(ipif, q, mp);
9783                 if (err == EINPROGRESS)
9784                         return (err);
9785                 (void) ipif_down_tail(ipif);
9786                 need_up = 1;
9787         }
9788 
9789         err = ip_sioctl_addr_tail(ipif, sin, q, mp, need_up);
9790         return (err);
9791 }
9792 
9793 int
9794 ip_sioctl_addr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9795     boolean_t need_up)
9796 {
9797         in6_addr_t v6addr;
9798         in6_addr_t ov6addr;
9799         ipaddr_t addr;
9800         sin6_t  *sin6;
9801         int     sinlen;
9802         int     err = 0;
9803         ill_t   *ill = ipif->ipif_ill;
9804         boolean_t need_dl_down;
9805         boolean_t need_arp_down;
9806         struct iocblk *iocp;
9807 
9808         iocp = (mp != NULL) ? (struct iocblk *)mp->b_rptr : NULL;
9809 
9810         ip1dbg(("ip_sioctl_addr_tail(%s:%u %p)\n",
9811             ill->ill_name, ipif->ipif_id, (void *)ipif));
9812         ASSERT(IAM_WRITER_IPIF(ipif));
9813 
9814         /* Must cancel any pending timer before taking the ill_lock */
9815         if (ipif->ipif_recovery_id != 0)
9816                 (void) untimeout(ipif->ipif_recovery_id);
9817         ipif->ipif_recovery_id = 0;
9818 
9819         if (ipif->ipif_isv6) {
9820                 sin6 = (sin6_t *)sin;
9821                 v6addr = sin6->sin6_addr;
9822                 sinlen = sizeof (struct sockaddr_in6);
9823         } else {
9824                 addr = sin->sin_addr.s_addr;
9825                 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
9826                 sinlen = sizeof (struct sockaddr_in);
9827         }
9828         mutex_enter(&ill->ill_lock);
9829         ov6addr = ipif->ipif_v6lcl_addr;
9830         ipif->ipif_v6lcl_addr = v6addr;
9831         sctp_update_ipif_addr(ipif, ov6addr);
9832         ipif->ipif_addr_ready = 0;
9833 
9834         ip_rts_newaddrmsg(RTM_CHGADDR, 0, ipif, RTSQ_DEFAULT);
9835 
9836         /*
9837          * If the interface was previously marked as a duplicate, then since
9838          * we've now got a "new" address, it should no longer be considered a
9839          * duplicate -- even if the "new" address is the same as the old one.
9840          * Note that if all ipifs are down, we may have a pending ARP down
9841          * event to handle.  This is because we want to recover from duplicates
9842          * and thus delay tearing down ARP until the duplicates have been
9843          * removed or disabled.
9844          */
9845         need_dl_down = need_arp_down = B_FALSE;
9846         if (ipif->ipif_flags & IPIF_DUPLICATE) {
9847                 need_arp_down = !need_up;
9848                 ipif->ipif_flags &= ~IPIF_DUPLICATE;
9849                 if (--ill->ill_ipif_dup_count == 0 && !need_up &&
9850                     ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
9851                         need_dl_down = B_TRUE;
9852                 }
9853         }
9854 
9855         ipif_set_default(ipif);
9856 
9857         /*
9858          * If we've just manually set the IPv6 link-local address (0th ipif),
9859          * tag the ill so that future updates to the interface ID don't result
9860          * in this address getting automatically reconfigured from under the
9861          * administrator.
9862          */
9863         if (ipif->ipif_isv6 && ipif->ipif_id == 0) {
9864                 if (iocp == NULL || (iocp->ioc_cmd == SIOCSLIFADDR &&
9865                     !IN6_IS_ADDR_UNSPECIFIED(&v6addr)))
9866                         ill->ill_manual_linklocal = 1;
9867         }
9868 
9869         /*
9870          * When publishing an interface address change event, we only notify
9871          * the event listeners of the new address.  It is assumed that if they
9872          * actively care about the addresses assigned that they will have
9873          * already discovered the previous address assigned (if there was one.)
9874          *
9875          * Don't attach nic event message for SIOCLIFADDIF ioctl.
9876          */
9877         if (iocp != NULL && iocp->ioc_cmd != SIOCLIFADDIF) {
9878                 ill_nic_event_dispatch(ill, MAP_IPIF_ID(ipif->ipif_id),
9879                     NE_ADDRESS_CHANGE, sin, sinlen);
9880         }
9881 
9882         mutex_exit(&ill->ill_lock);
9883 
9884         if (need_up) {
9885                 /*
9886                  * Now bring the interface back up.  If this
9887                  * is the only IPIF for the ILL, ipif_up
9888                  * will have to re-bind to the device, so
9889                  * we may get back EINPROGRESS, in which
9890                  * case, this IOCTL will get completed in
9891                  * ip_rput_dlpi when we see the DL_BIND_ACK.
9892                  */
9893                 err = ipif_up(ipif, q, mp);
9894         } else {
9895                 /* Perhaps ilgs should use this ill */
9896                 update_conn_ill(NULL, ill->ill_ipst);
9897         }
9898 
9899         if (need_dl_down)
9900                 ill_dl_down(ill);
9901 
9902         if (need_arp_down && !ill->ill_isv6)
9903                 (void) ipif_arp_down(ipif);
9904 
9905         /*
9906          * The default multicast interface might have changed (for
9907          * instance if the IPv6 scope of the address changed)
9908          */
9909         ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
9910 
9911         return (err);
9912 }
9913 
9914 /*
9915  * Restart entry point to restart the address set operation after the
9916  * refcounts have dropped to zero.
9917  */
9918 /* ARGSUSED */
9919 int
9920 ip_sioctl_addr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9921     ip_ioctl_cmd_t *ipip, void *ifreq)
9922 {
9923         ip1dbg(("ip_sioctl_addr_restart(%s:%u %p)\n",
9924             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9925         ASSERT(IAM_WRITER_IPIF(ipif));
9926         (void) ipif_down_tail(ipif);
9927         return (ip_sioctl_addr_tail(ipif, sin, q, mp, B_TRUE));
9928 }
9929 
9930 /* ARGSUSED */
9931 int
9932 ip_sioctl_get_addr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9933     ip_ioctl_cmd_t *ipip, void *if_req)
9934 {
9935         sin6_t *sin6 = (struct sockaddr_in6 *)sin;
9936         struct lifreq *lifr = (struct lifreq *)if_req;
9937 
9938         ip1dbg(("ip_sioctl_get_addr(%s:%u %p)\n",
9939             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9940         /*
9941          * The net mask and address can't change since we have a
9942          * reference to the ipif. So no lock is necessary.
9943          */
9944         if (ipif->ipif_isv6) {
9945                 *sin6 = sin6_null;
9946                 sin6->sin6_family = AF_INET6;
9947                 sin6->sin6_addr = ipif->ipif_v6lcl_addr;
9948                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
9949                         sin6->sin6_scope_id =
9950                             ipif->ipif_ill->ill_phyint->phyint_ifindex;
9951                 }
9952                 ASSERT(ipip->ipi_cmd_type == LIF_CMD);
9953                 lifr->lifr_addrlen =
9954                     ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
9955         } else {
9956                 *sin = sin_null;
9957                 sin->sin_family = AF_INET;
9958                 sin->sin_addr.s_addr = ipif->ipif_lcl_addr;
9959                 if (ipip->ipi_cmd_type == LIF_CMD) {
9960                         lifr->lifr_addrlen =
9961                             ip_mask_to_plen(ipif->ipif_net_mask);
9962                 }
9963         }
9964         return (0);
9965 }
9966 
9967 /*
9968  * Set the destination address for a pt-pt interface.
9969  */
9970 /* ARGSUSED */
9971 int
9972 ip_sioctl_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
9973     ip_ioctl_cmd_t *ipip, void *if_req)
9974 {
9975         int err = 0;
9976         in6_addr_t v6addr;
9977         boolean_t need_up = B_FALSE;
9978 
9979         ip1dbg(("ip_sioctl_dstaddr(%s:%u %p)\n",
9980             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
9981         ASSERT(IAM_WRITER_IPIF(ipif));
9982 
9983         if (ipif->ipif_isv6) {
9984                 sin6_t *sin6;
9985 
9986                 if (sin->sin_family != AF_INET6)
9987                         return (EAFNOSUPPORT);
9988 
9989                 sin6 = (sin6_t *)sin;
9990                 v6addr = sin6->sin6_addr;
9991 
9992                 if (!ip_remote_addr_ok_v6(&v6addr, &ipif->ipif_v6net_mask))
9993                         return (EADDRNOTAVAIL);
9994         } else {
9995                 ipaddr_t addr;
9996 
9997                 if (sin->sin_family != AF_INET)
9998                         return (EAFNOSUPPORT);
9999 
10000                 addr = sin->sin_addr.s_addr;
10001                 if (addr != INADDR_ANY &&
10002                     !ip_addr_ok_v4(addr, ipif->ipif_net_mask)) {
10003                         return (EADDRNOTAVAIL);
10004                 }
10005 
10006                 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10007         }
10008 
10009         if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6pp_dst_addr, &v6addr))
10010                 return (0);     /* No change */
10011 
10012         if (ipif->ipif_flags & IPIF_UP) {
10013                 /*
10014                  * If the interface is already marked up,
10015                  * we call ipif_down which will take care
10016                  * of ditching any IREs that have been set
10017                  * up based on the old pp dst address.
10018                  */
10019                 err = ipif_logical_down(ipif, q, mp);
10020                 if (err == EINPROGRESS)
10021                         return (err);
10022                 (void) ipif_down_tail(ipif);
10023                 need_up = B_TRUE;
10024         }
10025         /*
10026          * could return EINPROGRESS. If so ioctl will complete in
10027          * ip_rput_dlpi_writer
10028          */
10029         err = ip_sioctl_dstaddr_tail(ipif, sin, q, mp, need_up);
10030         return (err);
10031 }
10032 
10033 static int
10034 ip_sioctl_dstaddr_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10035     boolean_t need_up)
10036 {
10037         in6_addr_t v6addr;
10038         ill_t   *ill = ipif->ipif_ill;
10039         int     err = 0;
10040         boolean_t need_dl_down;
10041         boolean_t need_arp_down;
10042 
10043         ip1dbg(("ip_sioctl_dstaddr_tail(%s:%u %p)\n", ill->ill_name,
10044             ipif->ipif_id, (void *)ipif));
10045 
10046         /* Must cancel any pending timer before taking the ill_lock */
10047         if (ipif->ipif_recovery_id != 0)
10048                 (void) untimeout(ipif->ipif_recovery_id);
10049         ipif->ipif_recovery_id = 0;
10050 
10051         if (ipif->ipif_isv6) {
10052                 sin6_t *sin6;
10053 
10054                 sin6 = (sin6_t *)sin;
10055                 v6addr = sin6->sin6_addr;
10056         } else {
10057                 ipaddr_t addr;
10058 
10059                 addr = sin->sin_addr.s_addr;
10060                 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
10061         }
10062         mutex_enter(&ill->ill_lock);
10063         /* Set point to point destination address. */
10064         if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10065                 /*
10066                  * Allow this as a means of creating logical
10067                  * pt-pt interfaces on top of e.g. an Ethernet.
10068                  * XXX Undocumented HACK for testing.
10069                  * pt-pt interfaces are created with NUD disabled.
10070                  */
10071                 ipif->ipif_flags |= IPIF_POINTOPOINT;
10072                 ipif->ipif_flags &= ~IPIF_BROADCAST;
10073                 if (ipif->ipif_isv6)
10074                         ill->ill_flags |= ILLF_NONUD;
10075         }
10076 
10077         /*
10078          * If the interface was previously marked as a duplicate, then since
10079          * we've now got a "new" address, it should no longer be considered a
10080          * duplicate -- even if the "new" address is the same as the old one.
10081          * Note that if all ipifs are down, we may have a pending ARP down
10082          * event to handle.
10083          */
10084         need_dl_down = need_arp_down = B_FALSE;
10085         if (ipif->ipif_flags & IPIF_DUPLICATE) {
10086                 need_arp_down = !need_up;
10087                 ipif->ipif_flags &= ~IPIF_DUPLICATE;
10088                 if (--ill->ill_ipif_dup_count == 0 && !need_up &&
10089                     ill->ill_ipif_up_count == 0 && ill->ill_dl_up) {
10090                         need_dl_down = B_TRUE;
10091                 }
10092         }
10093 
10094         /*
10095          * If we've just manually set the IPv6 destination link-local address
10096          * (0th ipif), tag the ill so that future updates to the destination
10097          * interface ID (as can happen with interfaces over IP tunnels) don't
10098          * result in this address getting automatically reconfigured from
10099          * under the administrator.
10100          */
10101         if (ipif->ipif_isv6 && ipif->ipif_id == 0)
10102                 ill->ill_manual_dst_linklocal = 1;
10103 
10104         /* Set the new address. */
10105         ipif->ipif_v6pp_dst_addr = v6addr;
10106         /* Make sure subnet tracks pp_dst */
10107         ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
10108         mutex_exit(&ill->ill_lock);
10109 
10110         if (need_up) {
10111                 /*
10112                  * Now bring the interface back up.  If this
10113                  * is the only IPIF for the ILL, ipif_up
10114                  * will have to re-bind to the device, so
10115                  * we may get back EINPROGRESS, in which
10116                  * case, this IOCTL will get completed in
10117                  * ip_rput_dlpi when we see the DL_BIND_ACK.
10118                  */
10119                 err = ipif_up(ipif, q, mp);
10120         }
10121 
10122         if (need_dl_down)
10123                 ill_dl_down(ill);
10124         if (need_arp_down && !ipif->ipif_isv6)
10125                 (void) ipif_arp_down(ipif);
10126 
10127         return (err);
10128 }
10129 
10130 /*
10131  * Restart entry point to restart the dstaddress set operation after the
10132  * refcounts have dropped to zero.
10133  */
10134 /* ARGSUSED */
10135 int
10136 ip_sioctl_dstaddr_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10137     ip_ioctl_cmd_t *ipip, void *ifreq)
10138 {
10139         ip1dbg(("ip_sioctl_dstaddr_restart(%s:%u %p)\n",
10140             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10141         (void) ipif_down_tail(ipif);
10142         return (ip_sioctl_dstaddr_tail(ipif, sin, q, mp, B_TRUE));
10143 }
10144 
10145 /* ARGSUSED */
10146 int
10147 ip_sioctl_get_dstaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10148     ip_ioctl_cmd_t *ipip, void *if_req)
10149 {
10150         sin6_t  *sin6 = (struct sockaddr_in6 *)sin;
10151 
10152         ip1dbg(("ip_sioctl_get_dstaddr(%s:%u %p)\n",
10153             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10154         /*
10155          * Get point to point destination address. The addresses can't
10156          * change since we hold a reference to the ipif.
10157          */
10158         if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0)
10159                 return (EADDRNOTAVAIL);
10160 
10161         if (ipif->ipif_isv6) {
10162                 ASSERT(ipip->ipi_cmd_type == LIF_CMD);
10163                 *sin6 = sin6_null;
10164                 sin6->sin6_family = AF_INET6;
10165                 sin6->sin6_addr = ipif->ipif_v6pp_dst_addr;
10166         } else {
10167                 *sin = sin_null;
10168                 sin->sin_family = AF_INET;
10169                 sin->sin_addr.s_addr = ipif->ipif_pp_dst_addr;
10170         }
10171         return (0);
10172 }
10173 
10174 /*
10175  * Check which flags will change by the given flags being set
10176  * silently ignore flags which userland is not allowed to control.
10177  * (Because these flags may change between SIOCGLIFFLAGS and
10178  * SIOCSLIFFLAGS, and that's outside of userland's control,
10179  * we need to silently ignore them rather than fail.)
10180  */
10181 static void
10182 ip_sioctl_flags_onoff(ipif_t *ipif, uint64_t flags, uint64_t *onp,
10183     uint64_t *offp)
10184 {
10185         ill_t           *ill = ipif->ipif_ill;
10186         phyint_t        *phyi = ill->ill_phyint;
10187         uint64_t        cantchange_flags, intf_flags;
10188         uint64_t        turn_on, turn_off;
10189 
10190         intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10191         cantchange_flags = IFF_CANTCHANGE;
10192         if (IS_IPMP(ill))
10193                 cantchange_flags |= IFF_IPMP_CANTCHANGE;
10194         turn_on = (flags ^ intf_flags) & ~cantchange_flags;
10195         turn_off = intf_flags & turn_on;
10196         turn_on ^= turn_off;
10197         *onp = turn_on;
10198         *offp = turn_off;
10199 }
10200 
10201 /*
10202  * Set interface flags.  Many flags require special handling (e.g.,
10203  * bringing the interface down); see below for details.
10204  *
10205  * NOTE : We really don't enforce that ipif_id zero should be used
10206  *        for setting any flags other than IFF_LOGINT_FLAGS. This
10207  *        is because applications generally does SICGLIFFLAGS and
10208  *        ORs in the new flags (that affects the logical) and does a
10209  *        SIOCSLIFFLAGS. Thus, "flags" below could contain bits other
10210  *        than IFF_LOGINT_FLAGS. One could check whether "turn_on" - the
10211  *        flags that will be turned on is correct with respect to
10212  *        ipif_id 0. For backward compatibility reasons, it is not done.
10213  */
10214 /* ARGSUSED */
10215 int
10216 ip_sioctl_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10217     ip_ioctl_cmd_t *ipip, void *if_req)
10218 {
10219         uint64_t turn_on;
10220         uint64_t turn_off;
10221         int     err = 0;
10222         phyint_t *phyi;
10223         ill_t *ill;
10224         conn_t *connp;
10225         uint64_t intf_flags;
10226         boolean_t phyint_flags_modified = B_FALSE;
10227         uint64_t flags;
10228         struct ifreq *ifr;
10229         struct lifreq *lifr;
10230         boolean_t set_linklocal = B_FALSE;
10231 
10232         ip1dbg(("ip_sioctl_flags(%s:%u %p)\n",
10233             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10234 
10235         ASSERT(IAM_WRITER_IPIF(ipif));
10236 
10237         ill = ipif->ipif_ill;
10238         phyi = ill->ill_phyint;
10239 
10240         if (ipip->ipi_cmd_type == IF_CMD) {
10241                 ifr = (struct ifreq *)if_req;
10242                 flags =  (uint64_t)(ifr->ifr_flags & 0x0000ffff);
10243         } else {
10244                 lifr = (struct lifreq *)if_req;
10245                 flags = lifr->lifr_flags;
10246         }
10247 
10248         intf_flags = ipif->ipif_flags | ill->ill_flags | phyi->phyint_flags;
10249 
10250         /*
10251          * Have the flags been set correctly until now?
10252          */
10253         ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10254         ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10255         ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10256         /*
10257          * Compare the new flags to the old, and partition
10258          * into those coming on and those going off.
10259          * For the 16 bit command keep the bits above bit 16 unchanged.
10260          */
10261         if (ipip->ipi_cmd == SIOCSIFFLAGS)
10262                 flags |= intf_flags & ~0xFFFF;
10263 
10264         /*
10265          * Explicitly fail attempts to change flags that are always invalid on
10266          * an IPMP meta-interface.
10267          */
10268         if (IS_IPMP(ill) && ((flags ^ intf_flags) & IFF_IPMP_INVALID))
10269                 return (EINVAL);
10270 
10271         ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10272         if ((turn_on|turn_off) == 0)
10273                 return (0);     /* No change */
10274 
10275         /*
10276          * All test addresses must be IFF_DEPRECATED (to ensure source address
10277          * selection avoids them) -- so force IFF_DEPRECATED on, and do not
10278          * allow it to be turned off.
10279          */
10280         if ((turn_off & (IFF_DEPRECATED|IFF_NOFAILOVER)) == IFF_DEPRECATED &&
10281             (turn_on|intf_flags) & IFF_NOFAILOVER)
10282                 return (EINVAL);
10283 
10284         if ((connp = Q_TO_CONN(q)) == NULL)
10285                 return (EINVAL);
10286 
10287         /*
10288          * Only vrrp control socket is allowed to change IFF_UP and
10289          * IFF_NOACCEPT flags when IFF_VRRP is set.
10290          */
10291         if ((intf_flags & IFF_VRRP) && ((turn_off | turn_on) & IFF_UP)) {
10292                 if (!connp->conn_isvrrp)
10293                         return (EINVAL);
10294         }
10295 
10296         /*
10297          * The IFF_NOACCEPT flag can only be set on an IFF_VRRP IP address by
10298          * VRRP control socket.
10299          */
10300         if ((turn_off | turn_on) & IFF_NOACCEPT) {
10301                 if (!connp->conn_isvrrp || !(intf_flags & IFF_VRRP))
10302                         return (EINVAL);
10303         }
10304 
10305         if (turn_on & IFF_NOFAILOVER) {
10306                 turn_on |= IFF_DEPRECATED;
10307                 flags |= IFF_DEPRECATED;
10308         }
10309 
10310         /*
10311          * On underlying interfaces, only allow applications to manage test
10312          * addresses -- otherwise, they may get confused when the address
10313          * moves as part of being brought up.  Likewise, prevent an
10314          * application-managed test address from being converted to a data
10315          * address.  To prevent migration of administratively up addresses in
10316          * the kernel, we don't allow them to be converted either.
10317          */
10318         if (IS_UNDER_IPMP(ill)) {
10319                 const uint64_t appflags = IFF_DHCPRUNNING | IFF_ADDRCONF;
10320 
10321                 if ((turn_on & appflags) && !(flags & IFF_NOFAILOVER))
10322                         return (EINVAL);
10323 
10324                 if ((turn_off & IFF_NOFAILOVER) &&
10325                     (flags & (appflags | IFF_UP | IFF_DUPLICATE)))
10326                         return (EINVAL);
10327         }
10328 
10329         /*
10330          * Only allow IFF_TEMPORARY flag to be set on
10331          * IPv6 interfaces.
10332          */
10333         if ((turn_on & IFF_TEMPORARY) && !(ipif->ipif_isv6))
10334                 return (EINVAL);
10335 
10336         /*
10337          * cannot turn off IFF_NOXMIT on  VNI interfaces.
10338          */
10339         if ((turn_off & IFF_NOXMIT) && IS_VNI(ipif->ipif_ill))
10340                 return (EINVAL);
10341 
10342         /*
10343          * Don't allow the IFF_ROUTER flag to be turned on on loopback
10344          * interfaces.  It makes no sense in that context.
10345          */
10346         if ((turn_on & IFF_ROUTER) && (phyi->phyint_flags & PHYI_LOOPBACK))
10347                 return (EINVAL);
10348 
10349         /*
10350          * For IPv6 ipif_id 0, don't allow the interface to be up without
10351          * a link local address if IFF_NOLOCAL or IFF_ANYCAST are not set.
10352          * If the link local address isn't set, and can be set, it will get
10353          * set later on in this function.
10354          */
10355         if (ipif->ipif_id == 0 && ipif->ipif_isv6 &&
10356             (flags & IFF_UP) && !(flags & (IFF_NOLOCAL|IFF_ANYCAST)) &&
10357             IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr)) {
10358                 if (ipif_cant_setlinklocal(ipif))
10359                         return (EINVAL);
10360                 set_linklocal = B_TRUE;
10361         }
10362 
10363         /*
10364          * If we modify physical interface flags, we'll potentially need to
10365          * send up two routing socket messages for the changes (one for the
10366          * IPv4 ill, and another for the IPv6 ill).  Note that here.
10367          */
10368         if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10369                 phyint_flags_modified = B_TRUE;
10370 
10371         /*
10372          * All functioning PHYI_STANDBY interfaces start life PHYI_INACTIVE
10373          * (otherwise, we'd immediately use them, defeating standby).  Also,
10374          * since PHYI_INACTIVE has a separate meaning when PHYI_STANDBY is not
10375          * set, don't allow PHYI_STANDBY to be set if PHYI_INACTIVE is already
10376          * set, and clear PHYI_INACTIVE if PHYI_STANDBY is being cleared.  We
10377          * also don't allow PHYI_STANDBY if VNI is enabled since its semantics
10378          * will not be honored.
10379          */
10380         if (turn_on & PHYI_STANDBY) {
10381                 /*
10382                  * No need to grab ill_g_usesrc_lock here; see the
10383                  * synchronization notes in ip.c.
10384                  */
10385                 if (ill->ill_usesrc_grp_next != NULL ||
10386                     intf_flags & PHYI_INACTIVE)
10387                         return (EINVAL);
10388                 if (!(flags & PHYI_FAILED)) {
10389                         flags |= PHYI_INACTIVE;
10390                         turn_on |= PHYI_INACTIVE;
10391                 }
10392         }
10393 
10394         if (turn_off & PHYI_STANDBY) {
10395                 flags &= ~PHYI_INACTIVE;
10396                 turn_off |= PHYI_INACTIVE;
10397         }
10398 
10399         /*
10400          * PHYI_FAILED and PHYI_INACTIVE are mutually exclusive; fail if both
10401          * would end up on.
10402          */
10403         if ((flags & (PHYI_FAILED | PHYI_INACTIVE)) ==
10404             (PHYI_FAILED | PHYI_INACTIVE))
10405                 return (EINVAL);
10406 
10407         /*
10408          * If ILLF_ROUTER changes, we need to change the ip forwarding
10409          * status of the interface.
10410          */
10411         if ((turn_on | turn_off) & ILLF_ROUTER) {
10412                 err = ill_forward_set(ill, ((turn_on & ILLF_ROUTER) != 0));
10413                 if (err != 0)
10414                         return (err);
10415         }
10416 
10417         /*
10418          * If the interface is not UP and we are not going to
10419          * bring it UP, record the flags and return. When the
10420          * interface comes UP later, the right actions will be
10421          * taken.
10422          */
10423         if (!(ipif->ipif_flags & IPIF_UP) &&
10424             !(turn_on & IPIF_UP)) {
10425                 /* Record new flags in their respective places. */
10426                 mutex_enter(&ill->ill_lock);
10427                 mutex_enter(&ill->ill_phyint->phyint_lock);
10428                 ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10429                 ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10430                 ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10431                 ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10432                 phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10433                 phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10434                 mutex_exit(&ill->ill_lock);
10435                 mutex_exit(&ill->ill_phyint->phyint_lock);
10436 
10437                 /*
10438                  * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the
10439                  * same to the kernel: if any of them has been set by
10440                  * userland, the interface cannot be used for data traffic.
10441                  */
10442                 if ((turn_on|turn_off) &
10443                     (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10444                         ASSERT(!IS_IPMP(ill));
10445                         /*
10446                          * It's possible the ill is part of an "anonymous"
10447                          * IPMP group rather than a real group.  In that case,
10448                          * there are no other interfaces in the group and thus
10449                          * no need to call ipmp_phyint_refresh_active().
10450                          */
10451                         if (IS_UNDER_IPMP(ill))
10452                                 ipmp_phyint_refresh_active(phyi);
10453                 }
10454 
10455                 if (phyint_flags_modified) {
10456                         if (phyi->phyint_illv4 != NULL) {
10457                                 ip_rts_ifmsg(phyi->phyint_illv4->
10458                                     ill_ipif, RTSQ_DEFAULT);
10459                         }
10460                         if (phyi->phyint_illv6 != NULL) {
10461                                 ip_rts_ifmsg(phyi->phyint_illv6->
10462                                     ill_ipif, RTSQ_DEFAULT);
10463                         }
10464                 }
10465                 /* The default multicast interface might have changed */
10466                 ire_increment_multicast_generation(ill->ill_ipst,
10467                     ill->ill_isv6);
10468 
10469                 return (0);
10470         } else if (set_linklocal) {
10471                 mutex_enter(&ill->ill_lock);
10472                 if (set_linklocal)
10473                         ipif->ipif_state_flags |= IPIF_SET_LINKLOCAL;
10474                 mutex_exit(&ill->ill_lock);
10475         }
10476 
10477         /*
10478          * Disallow IPv6 interfaces coming up that have the unspecified address,
10479          * or point-to-point interfaces with an unspecified destination. We do
10480          * allow the address to be unspecified for IPIF_NOLOCAL interfaces that
10481          * have a subnet assigned, which is how in.ndpd currently manages its
10482          * onlink prefix list when no addresses are configured with those
10483          * prefixes.
10484          */
10485         if (ipif->ipif_isv6 &&
10486             ((IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
10487             (!(ipif->ipif_flags & IPIF_NOLOCAL) && !(turn_on & IPIF_NOLOCAL) ||
10488             IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6subnet))) ||
10489             ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10490             IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6pp_dst_addr)))) {
10491                 return (EINVAL);
10492         }
10493 
10494         /*
10495          * Prevent IPv4 point-to-point interfaces with a 0.0.0.0 destination
10496          * from being brought up.
10497          */
10498         if (!ipif->ipif_isv6 &&
10499             ((ipif->ipif_flags & IPIF_POINTOPOINT) &&
10500             ipif->ipif_pp_dst_addr == INADDR_ANY)) {
10501                 return (EINVAL);
10502         }
10503 
10504         /*
10505          * If we are going to change one or more of the flags that are
10506          * IPIF_UP, IPIF_DEPRECATED, IPIF_NOXMIT, IPIF_NOLOCAL, ILLF_NOARP,
10507          * ILLF_NONUD, IPIF_PRIVATE, IPIF_ANYCAST, IPIF_PREFERRED, and
10508          * IPIF_NOFAILOVER, we will take special action.  This is
10509          * done by bring the ipif down, changing the flags and bringing
10510          * it back up again.  For IPIF_NOFAILOVER, the act of bringing it
10511          * back up will trigger the address to be moved.
10512          *
10513          * If we are going to change IFF_NOACCEPT, we need to bring
10514          * all the ipifs down then bring them up again.  The act of
10515          * bringing all the ipifs back up will trigger the local
10516          * ires being recreated with "no_accept" set/cleared.
10517          *
10518          * Note that ILLF_NOACCEPT is always set separately from the
10519          * other flags.
10520          */
10521         if ((turn_on|turn_off) &
10522             (IPIF_UP|IPIF_DEPRECATED|IPIF_NOXMIT|IPIF_NOLOCAL|ILLF_NOARP|
10523             ILLF_NONUD|IPIF_PRIVATE|IPIF_ANYCAST|IPIF_PREFERRED|
10524             IPIF_NOFAILOVER)) {
10525                 /*
10526                  * ipif_down() will ire_delete bcast ire's for the subnet,
10527                  * while the ire_identical_ref tracks the case of IRE_BROADCAST
10528                  * entries shared between multiple ipifs on the same subnet.
10529                  */
10530                 if (((ipif->ipif_flags | turn_on) & IPIF_UP) &&
10531                     !(turn_off & IPIF_UP)) {
10532                         if (ipif->ipif_flags & IPIF_UP)
10533                                 ill->ill_logical_down = 1;
10534                         turn_on &= ~IPIF_UP;
10535                 }
10536                 err = ipif_down(ipif, q, mp);
10537                 ip1dbg(("ipif_down returns %d err ", err));
10538                 if (err == EINPROGRESS)
10539                         return (err);
10540                 (void) ipif_down_tail(ipif);
10541         } else if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10542                 /*
10543                  * If we can quiesce the ill, then continue.  If not, then
10544                  * ip_sioctl_flags_tail() will be called from
10545                  * ipif_ill_refrele_tail().
10546                  */
10547                 ill_down_ipifs(ill, B_TRUE);
10548 
10549                 mutex_enter(&connp->conn_lock);
10550                 mutex_enter(&ill->ill_lock);
10551                 if (!ill_is_quiescent(ill)) {
10552                         boolean_t success;
10553 
10554                         success = ipsq_pending_mp_add(connp, ill->ill_ipif,
10555                             q, mp, ILL_DOWN);
10556                         mutex_exit(&ill->ill_lock);
10557                         mutex_exit(&connp->conn_lock);
10558                         return (success ? EINPROGRESS : EINTR);
10559                 }
10560                 mutex_exit(&ill->ill_lock);
10561                 mutex_exit(&connp->conn_lock);
10562         }
10563         return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10564 }
10565 
10566 static int
10567 ip_sioctl_flags_tail(ipif_t *ipif, uint64_t flags, queue_t *q, mblk_t *mp)
10568 {
10569         ill_t   *ill;
10570         phyint_t *phyi;
10571         uint64_t turn_on, turn_off;
10572         boolean_t phyint_flags_modified = B_FALSE;
10573         int     err = 0;
10574         boolean_t set_linklocal = B_FALSE;
10575 
10576         ip1dbg(("ip_sioctl_flags_tail(%s:%u)\n",
10577             ipif->ipif_ill->ill_name, ipif->ipif_id));
10578 
10579         ASSERT(IAM_WRITER_IPIF(ipif));
10580 
10581         ill = ipif->ipif_ill;
10582         phyi = ill->ill_phyint;
10583 
10584         ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10585 
10586         /*
10587          * IFF_UP is handled separately.
10588          */
10589         turn_on &= ~IFF_UP;
10590         turn_off &= ~IFF_UP;
10591 
10592         if ((turn_on|turn_off) & IFF_PHYINT_FLAGS)
10593                 phyint_flags_modified = B_TRUE;
10594 
10595         /*
10596          * Now we change the flags. Track current value of
10597          * other flags in their respective places.
10598          */
10599         mutex_enter(&ill->ill_lock);
10600         mutex_enter(&phyi->phyint_lock);
10601         ipif->ipif_flags |= (turn_on & IFF_LOGINT_FLAGS);
10602         ipif->ipif_flags &= (~turn_off & IFF_LOGINT_FLAGS);
10603         ill->ill_flags |= (turn_on & IFF_PHYINTINST_FLAGS);
10604         ill->ill_flags &= (~turn_off & IFF_PHYINTINST_FLAGS);
10605         phyi->phyint_flags |= (turn_on & IFF_PHYINT_FLAGS);
10606         phyi->phyint_flags &= (~turn_off & IFF_PHYINT_FLAGS);
10607         if (ipif->ipif_state_flags & IPIF_SET_LINKLOCAL) {
10608                 set_linklocal = B_TRUE;
10609                 ipif->ipif_state_flags &= ~IPIF_SET_LINKLOCAL;
10610         }
10611 
10612         mutex_exit(&ill->ill_lock);
10613         mutex_exit(&phyi->phyint_lock);
10614 
10615         if (set_linklocal)
10616                 (void) ipif_setlinklocal(ipif);
10617 
10618         /*
10619          * PHYI_FAILED, PHYI_INACTIVE, and PHYI_OFFLINE are all the same to
10620          * the kernel: if any of them has been set by userland, the interface
10621          * cannot be used for data traffic.
10622          */
10623         if ((turn_on|turn_off) & (PHYI_FAILED | PHYI_INACTIVE | PHYI_OFFLINE)) {
10624                 ASSERT(!IS_IPMP(ill));
10625                 /*
10626                  * It's possible the ill is part of an "anonymous" IPMP group
10627                  * rather than a real group.  In that case, there are no other
10628                  * interfaces in the group and thus no need for us to call
10629                  * ipmp_phyint_refresh_active().
10630                  */
10631                 if (IS_UNDER_IPMP(ill))
10632                         ipmp_phyint_refresh_active(phyi);
10633         }
10634 
10635         if ((turn_on|turn_off) & ILLF_NOACCEPT) {
10636                 /*
10637                  * If the ILLF_NOACCEPT flag is changed, bring up all the
10638                  * ipifs that were brought down.
10639                  *
10640                  * The routing sockets messages are sent as the result
10641                  * of ill_up_ipifs(), further, SCTP's IPIF list was updated
10642                  * as well.
10643                  */
10644                 err = ill_up_ipifs(ill, q, mp);
10645         } else if ((flags & IFF_UP) && !(ipif->ipif_flags & IPIF_UP)) {
10646                 /*
10647                  * XXX ipif_up really does not know whether a phyint flags
10648                  * was modified or not. So, it sends up information on
10649                  * only one routing sockets message. As we don't bring up
10650                  * the interface and also set PHYI_ flags simultaneously
10651                  * it should be okay.
10652                  */
10653                 err = ipif_up(ipif, q, mp);
10654         } else {
10655                 /*
10656                  * Make sure routing socket sees all changes to the flags.
10657                  * ipif_up_done* handles this when we use ipif_up.
10658                  */
10659                 if (phyint_flags_modified) {
10660                         if (phyi->phyint_illv4 != NULL) {
10661                                 ip_rts_ifmsg(phyi->phyint_illv4->
10662                                     ill_ipif, RTSQ_DEFAULT);
10663                         }
10664                         if (phyi->phyint_illv6 != NULL) {
10665                                 ip_rts_ifmsg(phyi->phyint_illv6->
10666                                     ill_ipif, RTSQ_DEFAULT);
10667                         }
10668                 } else {
10669                         ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
10670                 }
10671                 /*
10672                  * Update the flags in SCTP's IPIF list, ipif_up() will do
10673                  * this in need_up case.
10674                  */
10675                 sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10676         }
10677 
10678         /* The default multicast interface might have changed */
10679         ire_increment_multicast_generation(ill->ill_ipst, ill->ill_isv6);
10680         return (err);
10681 }
10682 
10683 /*
10684  * Restart the flags operation now that the refcounts have dropped to zero.
10685  */
10686 /* ARGSUSED */
10687 int
10688 ip_sioctl_flags_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10689     ip_ioctl_cmd_t *ipip, void *if_req)
10690 {
10691         uint64_t flags;
10692         struct ifreq *ifr = if_req;
10693         struct lifreq *lifr = if_req;
10694         uint64_t turn_on, turn_off;
10695 
10696         ip1dbg(("ip_sioctl_flags_restart(%s:%u %p)\n",
10697             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10698 
10699         if (ipip->ipi_cmd_type == IF_CMD) {
10700                 /* cast to uint16_t prevents unwanted sign extension */
10701                 flags = (uint16_t)ifr->ifr_flags;
10702         } else {
10703                 flags = lifr->lifr_flags;
10704         }
10705 
10706         /*
10707          * If this function call is a result of the ILLF_NOACCEPT flag
10708          * change, do not call ipif_down_tail(). See ip_sioctl_flags().
10709          */
10710         ip_sioctl_flags_onoff(ipif, flags, &turn_on, &turn_off);
10711         if (!((turn_on|turn_off) & ILLF_NOACCEPT))
10712                 (void) ipif_down_tail(ipif);
10713 
10714         return (ip_sioctl_flags_tail(ipif, flags, q, mp));
10715 }
10716 
10717 /*
10718  * Can operate on either a module or a driver queue.
10719  */
10720 /* ARGSUSED */
10721 int
10722 ip_sioctl_get_flags(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10723     ip_ioctl_cmd_t *ipip, void *if_req)
10724 {
10725         /*
10726          * Has the flags been set correctly till now ?
10727          */
10728         ill_t *ill = ipif->ipif_ill;
10729         phyint_t *phyi = ill->ill_phyint;
10730 
10731         ip1dbg(("ip_sioctl_get_flags(%s:%u %p)\n",
10732             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10733         ASSERT((phyi->phyint_flags & ~(IFF_PHYINT_FLAGS)) == 0);
10734         ASSERT((ill->ill_flags & ~(IFF_PHYINTINST_FLAGS)) == 0);
10735         ASSERT((ipif->ipif_flags & ~(IFF_LOGINT_FLAGS)) == 0);
10736 
10737         /*
10738          * Need a lock since some flags can be set even when there are
10739          * references to the ipif.
10740          */
10741         mutex_enter(&ill->ill_lock);
10742         if (ipip->ipi_cmd_type == IF_CMD) {
10743                 struct ifreq *ifr = (struct ifreq *)if_req;
10744 
10745                 /* Get interface flags (low 16 only). */
10746                 ifr->ifr_flags = ((ipif->ipif_flags |
10747                     ill->ill_flags | phyi->phyint_flags) & 0xffff);
10748         } else {
10749                 struct lifreq *lifr = (struct lifreq *)if_req;
10750 
10751                 /* Get interface flags. */
10752                 lifr->lifr_flags = ipif->ipif_flags |
10753                     ill->ill_flags | phyi->phyint_flags;
10754         }
10755         mutex_exit(&ill->ill_lock);
10756         return (0);
10757 }
10758 
10759 /*
10760  * We allow the MTU to be set on an ILL, but not have it be different
10761  * for different IPIFs since we don't actually send packets on IPIFs.
10762  */
10763 /* ARGSUSED */
10764 int
10765 ip_sioctl_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10766     ip_ioctl_cmd_t *ipip, void *if_req)
10767 {
10768         int mtu;
10769         int ip_min_mtu;
10770         struct ifreq    *ifr;
10771         struct lifreq *lifr;
10772         ill_t   *ill;
10773 
10774         ip1dbg(("ip_sioctl_mtu(%s:%u %p)\n", ipif->ipif_ill->ill_name,
10775             ipif->ipif_id, (void *)ipif));
10776         if (ipip->ipi_cmd_type == IF_CMD) {
10777                 ifr = (struct ifreq *)if_req;
10778                 mtu = ifr->ifr_metric;
10779         } else {
10780                 lifr = (struct lifreq *)if_req;
10781                 mtu = lifr->lifr_mtu;
10782         }
10783         /* Only allow for logical unit zero i.e. not on "bge0:17" */
10784         if (ipif->ipif_id != 0)
10785                 return (EINVAL);
10786 
10787         ill = ipif->ipif_ill;
10788         if (ipif->ipif_isv6)
10789                 ip_min_mtu = IPV6_MIN_MTU;
10790         else
10791                 ip_min_mtu = IP_MIN_MTU;
10792 
10793         mutex_enter(&ill->ill_lock);
10794         if (mtu > ill->ill_max_frag || mtu < ip_min_mtu) {
10795                 mutex_exit(&ill->ill_lock);
10796                 return (EINVAL);
10797         }
10798         /* Avoid increasing ill_mc_mtu */
10799         if (ill->ill_mc_mtu > mtu)
10800                 ill->ill_mc_mtu = mtu;
10801 
10802         /*
10803          * The dce and fragmentation code can handle changes to ill_mtu
10804          * concurrent with sending/fragmenting packets.
10805          */
10806         ill->ill_mtu = mtu;
10807         ill->ill_flags |= ILLF_FIXEDMTU;
10808         mutex_exit(&ill->ill_lock);
10809 
10810         /*
10811          * Make sure all dce_generation checks find out
10812          * that ill_mtu/ill_mc_mtu has changed.
10813          */
10814         dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
10815 
10816         /*
10817          * Refresh IPMP meta-interface MTU if necessary.
10818          */
10819         if (IS_UNDER_IPMP(ill))
10820                 ipmp_illgrp_refresh_mtu(ill->ill_grp);
10821 
10822         /* Update the MTU in SCTP's list */
10823         sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
10824         return (0);
10825 }
10826 
10827 /* Get interface MTU. */
10828 /* ARGSUSED */
10829 int
10830 ip_sioctl_get_mtu(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10831         ip_ioctl_cmd_t *ipip, void *if_req)
10832 {
10833         struct ifreq    *ifr;
10834         struct lifreq   *lifr;
10835 
10836         ip1dbg(("ip_sioctl_get_mtu(%s:%u %p)\n",
10837             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10838 
10839         /*
10840          * We allow a get on any logical interface even though the set
10841          * can only be done on logical unit 0.
10842          */
10843         if (ipip->ipi_cmd_type == IF_CMD) {
10844                 ifr = (struct ifreq *)if_req;
10845                 ifr->ifr_metric = ipif->ipif_ill->ill_mtu;
10846         } else {
10847                 lifr = (struct lifreq *)if_req;
10848                 lifr->lifr_mtu = ipif->ipif_ill->ill_mtu;
10849         }
10850         return (0);
10851 }
10852 
10853 /* Set interface broadcast address. */
10854 /* ARGSUSED2 */
10855 int
10856 ip_sioctl_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10857         ip_ioctl_cmd_t *ipip, void *if_req)
10858 {
10859         ipaddr_t addr;
10860         ire_t   *ire;
10861         ill_t           *ill = ipif->ipif_ill;
10862         ip_stack_t      *ipst = ill->ill_ipst;
10863 
10864         ip1dbg(("ip_sioctl_brdaddr(%s:%u)\n", ill->ill_name,
10865             ipif->ipif_id));
10866 
10867         ASSERT(IAM_WRITER_IPIF(ipif));
10868         if (!(ipif->ipif_flags & IPIF_BROADCAST))
10869                 return (EADDRNOTAVAIL);
10870 
10871         ASSERT(!(ipif->ipif_isv6));  /* No IPv6 broadcast */
10872 
10873         if (sin->sin_family != AF_INET)
10874                 return (EAFNOSUPPORT);
10875 
10876         addr = sin->sin_addr.s_addr;
10877 
10878         if (ipif->ipif_flags & IPIF_UP) {
10879                 /*
10880                  * If we are already up, make sure the new
10881                  * broadcast address makes sense.  If it does,
10882                  * there should be an IRE for it already.
10883                  */
10884                 ire = ire_ftable_lookup_v4(addr, 0, 0, IRE_BROADCAST,
10885                     ill, ipif->ipif_zoneid, NULL,
10886                     (MATCH_IRE_ILL | MATCH_IRE_TYPE), 0, ipst, NULL);
10887                 if (ire == NULL) {
10888                         return (EINVAL);
10889                 } else {
10890                         ire_refrele(ire);
10891                 }
10892         }
10893         /*
10894          * Changing the broadcast addr for this ipif. Since the IRE_BROADCAST
10895          * needs to already exist we never need to change the set of
10896          * IRE_BROADCASTs when we are UP.
10897          */
10898         if (addr != ipif->ipif_brd_addr)
10899                 IN6_IPADDR_TO_V4MAPPED(addr, &ipif->ipif_v6brd_addr);
10900 
10901         return (0);
10902 }
10903 
10904 /* Get interface broadcast address. */
10905 /* ARGSUSED */
10906 int
10907 ip_sioctl_get_brdaddr(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10908     ip_ioctl_cmd_t *ipip, void *if_req)
10909 {
10910         ip1dbg(("ip_sioctl_get_brdaddr(%s:%u %p)\n",
10911             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10912         if (!(ipif->ipif_flags & IPIF_BROADCAST))
10913                 return (EADDRNOTAVAIL);
10914 
10915         /* IPIF_BROADCAST not possible with IPv6 */
10916         ASSERT(!ipif->ipif_isv6);
10917         *sin = sin_null;
10918         sin->sin_family = AF_INET;
10919         sin->sin_addr.s_addr = ipif->ipif_brd_addr;
10920         return (0);
10921 }
10922 
10923 /*
10924  * This routine is called to handle the SIOCS*IFNETMASK IOCTL.
10925  */
10926 /* ARGSUSED */
10927 int
10928 ip_sioctl_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
10929     ip_ioctl_cmd_t *ipip, void *if_req)
10930 {
10931         int err = 0;
10932         in6_addr_t v6mask;
10933 
10934         ip1dbg(("ip_sioctl_netmask(%s:%u %p)\n",
10935             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10936 
10937         ASSERT(IAM_WRITER_IPIF(ipif));
10938 
10939         if (ipif->ipif_isv6) {
10940                 sin6_t *sin6;
10941 
10942                 if (sin->sin_family != AF_INET6)
10943                         return (EAFNOSUPPORT);
10944 
10945                 sin6 = (sin6_t *)sin;
10946                 v6mask = sin6->sin6_addr;
10947         } else {
10948                 ipaddr_t mask;
10949 
10950                 if (sin->sin_family != AF_INET)
10951                         return (EAFNOSUPPORT);
10952 
10953                 mask = sin->sin_addr.s_addr;
10954                 if (!ip_contiguous_mask(ntohl(mask)))
10955                         return (ENOTSUP);
10956                 V4MASK_TO_V6(mask, v6mask);
10957         }
10958 
10959         /*
10960          * No big deal if the interface isn't already up, or the mask
10961          * isn't really changing, or this is pt-pt.
10962          */
10963         if (!(ipif->ipif_flags & IPIF_UP) ||
10964             IN6_ARE_ADDR_EQUAL(&v6mask, &ipif->ipif_v6net_mask) ||
10965             (ipif->ipif_flags & IPIF_POINTOPOINT)) {
10966                 ipif->ipif_v6net_mask = v6mask;
10967                 if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
10968                         V6_MASK_COPY(ipif->ipif_v6lcl_addr,
10969                             ipif->ipif_v6net_mask,
10970                             ipif->ipif_v6subnet);
10971                 }
10972                 return (0);
10973         }
10974         /*
10975          * Make sure we have valid net and subnet broadcast ire's
10976          * for the old netmask, if needed by other logical interfaces.
10977          */
10978         err = ipif_logical_down(ipif, q, mp);
10979         if (err == EINPROGRESS)
10980                 return (err);
10981         (void) ipif_down_tail(ipif);
10982         err = ip_sioctl_netmask_tail(ipif, sin, q, mp);
10983         return (err);
10984 }
10985 
10986 static int
10987 ip_sioctl_netmask_tail(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp)
10988 {
10989         in6_addr_t v6mask;
10990         int err = 0;
10991 
10992         ip1dbg(("ip_sioctl_netmask_tail(%s:%u %p)\n",
10993             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
10994 
10995         if (ipif->ipif_isv6) {
10996                 sin6_t *sin6;
10997 
10998                 sin6 = (sin6_t *)sin;
10999                 v6mask = sin6->sin6_addr;
11000         } else {
11001                 ipaddr_t mask;
11002 
11003                 mask = sin->sin_addr.s_addr;
11004                 V4MASK_TO_V6(mask, v6mask);
11005         }
11006 
11007         ipif->ipif_v6net_mask = v6mask;
11008         if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11009                 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
11010                     ipif->ipif_v6subnet);
11011         }
11012         err = ipif_up(ipif, q, mp);
11013 
11014         if (err == 0 || err == EINPROGRESS) {
11015                 /*
11016                  * The interface must be DL_BOUND if this packet has to
11017                  * go out on the wire. Since we only go through a logical
11018                  * down and are bound with the driver during an internal
11019                  * down/up that is satisfied.
11020                  */
11021                 if (!ipif->ipif_isv6 && ipif->ipif_ill->ill_wq != NULL) {
11022                         /* Potentially broadcast an address mask reply. */
11023                         ipif_mask_reply(ipif);
11024                 }
11025         }
11026         return (err);
11027 }
11028 
11029 /* ARGSUSED */
11030 int
11031 ip_sioctl_netmask_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11032     ip_ioctl_cmd_t *ipip, void *if_req)
11033 {
11034         ip1dbg(("ip_sioctl_netmask_restart(%s:%u %p)\n",
11035             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11036         (void) ipif_down_tail(ipif);
11037         return (ip_sioctl_netmask_tail(ipif, sin, q, mp));
11038 }
11039 
11040 /* Get interface net mask. */
11041 /* ARGSUSED */
11042 int
11043 ip_sioctl_get_netmask(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11044     ip_ioctl_cmd_t *ipip, void *if_req)
11045 {
11046         struct lifreq *lifr = (struct lifreq *)if_req;
11047         struct sockaddr_in6 *sin6 = (sin6_t *)sin;
11048 
11049         ip1dbg(("ip_sioctl_get_netmask(%s:%u %p)\n",
11050             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11051 
11052         /*
11053          * net mask can't change since we have a reference to the ipif.
11054          */
11055         if (ipif->ipif_isv6) {
11056                 ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11057                 *sin6 = sin6_null;
11058                 sin6->sin6_family = AF_INET6;
11059                 sin6->sin6_addr = ipif->ipif_v6net_mask;
11060                 lifr->lifr_addrlen =
11061                     ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11062         } else {
11063                 *sin = sin_null;
11064                 sin->sin_family = AF_INET;
11065                 sin->sin_addr.s_addr = ipif->ipif_net_mask;
11066                 if (ipip->ipi_cmd_type == LIF_CMD) {
11067                         lifr->lifr_addrlen =
11068                             ip_mask_to_plen(ipif->ipif_net_mask);
11069                 }
11070         }
11071         return (0);
11072 }
11073 
11074 /* ARGSUSED */
11075 int
11076 ip_sioctl_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11077     ip_ioctl_cmd_t *ipip, void *if_req)
11078 {
11079         ip1dbg(("ip_sioctl_metric(%s:%u %p)\n",
11080             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11081 
11082         /*
11083          * Since no applications should ever be setting metrics on underlying
11084          * interfaces, we explicitly fail to smoke 'em out.
11085          */
11086         if (IS_UNDER_IPMP(ipif->ipif_ill))
11087                 return (EINVAL);
11088 
11089         /*
11090          * Set interface metric.  We don't use this for
11091          * anything but we keep track of it in case it is
11092          * important to routing applications or such.
11093          */
11094         if (ipip->ipi_cmd_type == IF_CMD) {
11095                 struct ifreq    *ifr;
11096 
11097                 ifr = (struct ifreq *)if_req;
11098                 ipif->ipif_ill->ill_metric = ifr->ifr_metric;
11099         } else {
11100                 struct lifreq   *lifr;
11101 
11102                 lifr = (struct lifreq *)if_req;
11103                 ipif->ipif_ill->ill_metric = lifr->lifr_metric;
11104         }
11105         return (0);
11106 }
11107 
11108 /* ARGSUSED */
11109 int
11110 ip_sioctl_get_metric(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11111     ip_ioctl_cmd_t *ipip, void *if_req)
11112 {
11113         /* Get interface metric. */
11114         ip1dbg(("ip_sioctl_get_metric(%s:%u %p)\n",
11115             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11116 
11117         if (ipip->ipi_cmd_type == IF_CMD) {
11118                 struct ifreq    *ifr;
11119 
11120                 ifr = (struct ifreq *)if_req;
11121                 ifr->ifr_metric = ipif->ipif_ill->ill_metric;
11122         } else {
11123                 struct lifreq   *lifr;
11124 
11125                 lifr = (struct lifreq *)if_req;
11126                 lifr->lifr_metric = ipif->ipif_ill->ill_metric;
11127         }
11128 
11129         return (0);
11130 }
11131 
11132 /* ARGSUSED */
11133 int
11134 ip_sioctl_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11135     ip_ioctl_cmd_t *ipip, void *if_req)
11136 {
11137         int     arp_muxid;
11138 
11139         ip1dbg(("ip_sioctl_muxid(%s:%u %p)\n",
11140             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11141         /*
11142          * Set the muxid returned from I_PLINK.
11143          */
11144         if (ipip->ipi_cmd_type == IF_CMD) {
11145                 struct ifreq *ifr = (struct ifreq *)if_req;
11146 
11147                 ipif->ipif_ill->ill_muxid = ifr->ifr_ip_muxid;
11148                 arp_muxid = ifr->ifr_arp_muxid;
11149         } else {
11150                 struct lifreq *lifr = (struct lifreq *)if_req;
11151 
11152                 ipif->ipif_ill->ill_muxid = lifr->lifr_ip_muxid;
11153                 arp_muxid = lifr->lifr_arp_muxid;
11154         }
11155         arl_set_muxid(ipif->ipif_ill, arp_muxid);
11156         return (0);
11157 }
11158 
11159 /* ARGSUSED */
11160 int
11161 ip_sioctl_get_muxid(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11162     ip_ioctl_cmd_t *ipip, void *if_req)
11163 {
11164         int     arp_muxid = 0;
11165 
11166         ip1dbg(("ip_sioctl_get_muxid(%s:%u %p)\n",
11167             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11168         /*
11169          * Get the muxid saved in ill for I_PUNLINK.
11170          */
11171         arp_muxid = arl_get_muxid(ipif->ipif_ill);
11172         if (ipip->ipi_cmd_type == IF_CMD) {
11173                 struct ifreq *ifr = (struct ifreq *)if_req;
11174 
11175                 ifr->ifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11176                 ifr->ifr_arp_muxid = arp_muxid;
11177         } else {
11178                 struct lifreq *lifr = (struct lifreq *)if_req;
11179 
11180                 lifr->lifr_ip_muxid = ipif->ipif_ill->ill_muxid;
11181                 lifr->lifr_arp_muxid = arp_muxid;
11182         }
11183         return (0);
11184 }
11185 
11186 /*
11187  * Set the subnet prefix. Does not modify the broadcast address.
11188  */
11189 /* ARGSUSED */
11190 int
11191 ip_sioctl_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11192     ip_ioctl_cmd_t *ipip, void *if_req)
11193 {
11194         int err = 0;
11195         in6_addr_t v6addr;
11196         in6_addr_t v6mask;
11197         boolean_t need_up = B_FALSE;
11198         int addrlen;
11199 
11200         ip1dbg(("ip_sioctl_subnet(%s:%u %p)\n",
11201             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11202 
11203         ASSERT(IAM_WRITER_IPIF(ipif));
11204         addrlen = ((struct lifreq *)if_req)->lifr_addrlen;
11205 
11206         if (ipif->ipif_isv6) {
11207                 sin6_t *sin6;
11208 
11209                 if (sin->sin_family != AF_INET6)
11210                         return (EAFNOSUPPORT);
11211 
11212                 sin6 = (sin6_t *)sin;
11213                 v6addr = sin6->sin6_addr;
11214                 if (!ip_remote_addr_ok_v6(&v6addr, &ipv6_all_ones))
11215                         return (EADDRNOTAVAIL);
11216         } else {
11217                 ipaddr_t addr;
11218 
11219                 if (sin->sin_family != AF_INET)
11220                         return (EAFNOSUPPORT);
11221 
11222                 addr = sin->sin_addr.s_addr;
11223                 if (!ip_addr_ok_v4(addr, 0xFFFFFFFF))
11224                         return (EADDRNOTAVAIL);
11225                 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11226                 /* Add 96 bits */
11227                 addrlen += IPV6_ABITS - IP_ABITS;
11228         }
11229 
11230         if (ip_plen_to_mask_v6(addrlen, &v6mask) == NULL)
11231                 return (EINVAL);
11232 
11233         /* Check if bits in the address is set past the mask */
11234         if (!V6_MASK_EQ(v6addr, v6mask, v6addr))
11235                 return (EINVAL);
11236 
11237         if (IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6subnet, &v6addr) &&
11238             IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6net_mask, &v6mask))
11239                 return (0);     /* No change */
11240 
11241         if (ipif->ipif_flags & IPIF_UP) {
11242                 /*
11243                  * If the interface is already marked up,
11244                  * we call ipif_down which will take care
11245                  * of ditching any IREs that have been set
11246                  * up based on the old interface address.
11247                  */
11248                 err = ipif_logical_down(ipif, q, mp);
11249                 if (err == EINPROGRESS)
11250                         return (err);
11251                 (void) ipif_down_tail(ipif);
11252                 need_up = B_TRUE;
11253         }
11254 
11255         err = ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, need_up);
11256         return (err);
11257 }
11258 
11259 static int
11260 ip_sioctl_subnet_tail(ipif_t *ipif, in6_addr_t v6addr, in6_addr_t v6mask,
11261     queue_t *q, mblk_t *mp, boolean_t need_up)
11262 {
11263         ill_t   *ill = ipif->ipif_ill;
11264         int     err = 0;
11265 
11266         ip1dbg(("ip_sioctl_subnet_tail(%s:%u %p)\n",
11267             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11268 
11269         /* Set the new address. */
11270         mutex_enter(&ill->ill_lock);
11271         ipif->ipif_v6net_mask = v6mask;
11272         if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
11273                 V6_MASK_COPY(v6addr, ipif->ipif_v6net_mask,
11274                     ipif->ipif_v6subnet);
11275         }
11276         mutex_exit(&ill->ill_lock);
11277 
11278         if (need_up) {
11279                 /*
11280                  * Now bring the interface back up.  If this
11281                  * is the only IPIF for the ILL, ipif_up
11282                  * will have to re-bind to the device, so
11283                  * we may get back EINPROGRESS, in which
11284                  * case, this IOCTL will get completed in
11285                  * ip_rput_dlpi when we see the DL_BIND_ACK.
11286                  */
11287                 err = ipif_up(ipif, q, mp);
11288                 if (err == EINPROGRESS)
11289                         return (err);
11290         }
11291         return (err);
11292 }
11293 
11294 /* ARGSUSED */
11295 int
11296 ip_sioctl_subnet_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11297     ip_ioctl_cmd_t *ipip, void *if_req)
11298 {
11299         int     addrlen;
11300         in6_addr_t v6addr;
11301         in6_addr_t v6mask;
11302         struct lifreq *lifr = (struct lifreq *)if_req;
11303 
11304         ip1dbg(("ip_sioctl_subnet_restart(%s:%u %p)\n",
11305             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11306         (void) ipif_down_tail(ipif);
11307 
11308         addrlen = lifr->lifr_addrlen;
11309         if (ipif->ipif_isv6) {
11310                 sin6_t *sin6;
11311 
11312                 sin6 = (sin6_t *)sin;
11313                 v6addr = sin6->sin6_addr;
11314         } else {
11315                 ipaddr_t addr;
11316 
11317                 addr = sin->sin_addr.s_addr;
11318                 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
11319                 addrlen += IPV6_ABITS - IP_ABITS;
11320         }
11321         (void) ip_plen_to_mask_v6(addrlen, &v6mask);
11322 
11323         return (ip_sioctl_subnet_tail(ipif, v6addr, v6mask, q, mp, B_TRUE));
11324 }
11325 
11326 /* ARGSUSED */
11327 int
11328 ip_sioctl_get_subnet(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11329     ip_ioctl_cmd_t *ipip, void *if_req)
11330 {
11331         struct lifreq *lifr = (struct lifreq *)if_req;
11332         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
11333 
11334         ip1dbg(("ip_sioctl_get_subnet(%s:%u %p)\n",
11335             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11336         ASSERT(ipip->ipi_cmd_type == LIF_CMD);
11337 
11338         if (ipif->ipif_isv6) {
11339                 *sin6 = sin6_null;
11340                 sin6->sin6_family = AF_INET6;
11341                 sin6->sin6_addr = ipif->ipif_v6subnet;
11342                 lifr->lifr_addrlen =
11343                     ip_mask_to_plen_v6(&ipif->ipif_v6net_mask);
11344         } else {
11345                 *sin = sin_null;
11346                 sin->sin_family = AF_INET;
11347                 sin->sin_addr.s_addr = ipif->ipif_subnet;
11348                 lifr->lifr_addrlen = ip_mask_to_plen(ipif->ipif_net_mask);
11349         }
11350         return (0);
11351 }
11352 
11353 /*
11354  * Set the IPv6 address token.
11355  */
11356 /* ARGSUSED */
11357 int
11358 ip_sioctl_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11359     ip_ioctl_cmd_t *ipi, void *if_req)
11360 {
11361         ill_t *ill = ipif->ipif_ill;
11362         int err;
11363         in6_addr_t v6addr;
11364         in6_addr_t v6mask;
11365         boolean_t need_up = B_FALSE;
11366         int i;
11367         sin6_t *sin6 = (sin6_t *)sin;
11368         struct lifreq *lifr = (struct lifreq *)if_req;
11369         int addrlen;
11370 
11371         ip1dbg(("ip_sioctl_token(%s:%u %p)\n",
11372             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11373         ASSERT(IAM_WRITER_IPIF(ipif));
11374 
11375         addrlen = lifr->lifr_addrlen;
11376         /* Only allow for logical unit zero i.e. not on "le0:17" */
11377         if (ipif->ipif_id != 0)
11378                 return (EINVAL);
11379 
11380         if (!ipif->ipif_isv6)
11381                 return (EINVAL);
11382 
11383         if (addrlen > IPV6_ABITS)
11384                 return (EINVAL);
11385 
11386         v6addr = sin6->sin6_addr;
11387 
11388         /*
11389          * The length of the token is the length from the end.  To get
11390          * the proper mask for this, compute the mask of the bits not
11391          * in the token; ie. the prefix, and then xor to get the mask.
11392          */
11393         if (ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask) == NULL)
11394                 return (EINVAL);
11395         for (i = 0; i < 4; i++) {
11396                 v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11397         }
11398 
11399         if (V6_MASK_EQ(v6addr, v6mask, ill->ill_token) &&
11400             ill->ill_token_length == addrlen)
11401                 return (0);     /* No change */
11402 
11403         if (ipif->ipif_flags & IPIF_UP) {
11404                 err = ipif_logical_down(ipif, q, mp);
11405                 if (err == EINPROGRESS)
11406                         return (err);
11407                 (void) ipif_down_tail(ipif);
11408                 need_up = B_TRUE;
11409         }
11410         err = ip_sioctl_token_tail(ipif, sin6, addrlen, q, mp, need_up);
11411         return (err);
11412 }
11413 
11414 static int
11415 ip_sioctl_token_tail(ipif_t *ipif, sin6_t *sin6, int addrlen, queue_t *q,
11416     mblk_t *mp, boolean_t need_up)
11417 {
11418         in6_addr_t v6addr;
11419         in6_addr_t v6mask;
11420         ill_t   *ill = ipif->ipif_ill;
11421         int     i;
11422         int     err = 0;
11423 
11424         ip1dbg(("ip_sioctl_token_tail(%s:%u %p)\n",
11425             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11426         v6addr = sin6->sin6_addr;
11427         /*
11428          * The length of the token is the length from the end.  To get
11429          * the proper mask for this, compute the mask of the bits not
11430          * in the token; ie. the prefix, and then xor to get the mask.
11431          */
11432         (void) ip_plen_to_mask_v6(IPV6_ABITS - addrlen, &v6mask);
11433         for (i = 0; i < 4; i++)
11434                 v6mask.s6_addr32[i] ^= (uint32_t)0xffffffff;
11435 
11436         mutex_enter(&ill->ill_lock);
11437         V6_MASK_COPY(v6addr, v6mask, ill->ill_token);
11438         ill->ill_token_length = addrlen;
11439         ill->ill_manual_token = 1;
11440 
11441         /* Reconfigure the link-local address based on this new token */
11442         ipif_setlinklocal(ill->ill_ipif);
11443 
11444         mutex_exit(&ill->ill_lock);
11445 
11446         if (need_up) {
11447                 /*
11448                  * Now bring the interface back up.  If this
11449                  * is the only IPIF for the ILL, ipif_up
11450                  * will have to re-bind to the device, so
11451                  * we may get back EINPROGRESS, in which
11452                  * case, this IOCTL will get completed in
11453                  * ip_rput_dlpi when we see the DL_BIND_ACK.
11454                  */
11455                 err = ipif_up(ipif, q, mp);
11456                 if (err == EINPROGRESS)
11457                         return (err);
11458         }
11459         return (err);
11460 }
11461 
11462 /* ARGSUSED */
11463 int
11464 ip_sioctl_get_token(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11465     ip_ioctl_cmd_t *ipi, void *if_req)
11466 {
11467         ill_t *ill;
11468         sin6_t *sin6 = (sin6_t *)sin;
11469         struct lifreq *lifr = (struct lifreq *)if_req;
11470 
11471         ip1dbg(("ip_sioctl_get_token(%s:%u %p)\n",
11472             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11473         if (ipif->ipif_id != 0)
11474                 return (EINVAL);
11475 
11476         ill = ipif->ipif_ill;
11477         if (!ill->ill_isv6)
11478                 return (ENXIO);
11479 
11480         *sin6 = sin6_null;
11481         sin6->sin6_family = AF_INET6;
11482         ASSERT(!IN6_IS_ADDR_V4MAPPED(&ill->ill_token));
11483         sin6->sin6_addr = ill->ill_token;
11484         lifr->lifr_addrlen = ill->ill_token_length;
11485         return (0);
11486 }
11487 
11488 /*
11489  * Set (hardware) link specific information that might override
11490  * what was acquired through the DL_INFO_ACK.
11491  */
11492 /* ARGSUSED */
11493 int
11494 ip_sioctl_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11495     ip_ioctl_cmd_t *ipi, void *if_req)
11496 {
11497         ill_t           *ill = ipif->ipif_ill;
11498         int             ip_min_mtu;
11499         struct lifreq   *lifr = (struct lifreq *)if_req;
11500         lif_ifinfo_req_t *lir;
11501 
11502         ip1dbg(("ip_sioctl_lnkinfo(%s:%u %p)\n",
11503             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11504         lir = &lifr->lifr_ifinfo;
11505         ASSERT(IAM_WRITER_IPIF(ipif));
11506 
11507         /* Only allow for logical unit zero i.e. not on "bge0:17" */
11508         if (ipif->ipif_id != 0)
11509                 return (EINVAL);
11510 
11511         /* Set interface MTU. */
11512         if (ipif->ipif_isv6)
11513                 ip_min_mtu = IPV6_MIN_MTU;
11514         else
11515                 ip_min_mtu = IP_MIN_MTU;
11516 
11517         /*
11518          * Verify values before we set anything. Allow zero to
11519          * mean unspecified.
11520          *
11521          * XXX We should be able to set the user-defined lir_mtu to some value
11522          * that is greater than ill_current_frag but less than ill_max_frag- the
11523          * ill_max_frag value tells us the max MTU that can be handled by the
11524          * datalink, whereas the ill_current_frag is dynamically computed for
11525          * some link-types like tunnels, based on the tunnel PMTU. However,
11526          * since there is currently no way of distinguishing between
11527          * administratively fixed link mtu values (e.g., those set via
11528          * /sbin/dladm) and dynamically discovered MTUs (e.g., those discovered
11529          * for tunnels) we conservatively choose the  ill_current_frag as the
11530          * upper-bound.
11531          */
11532         if (lir->lir_maxmtu != 0 &&
11533             (lir->lir_maxmtu > ill->ill_current_frag ||
11534             lir->lir_maxmtu < ip_min_mtu))
11535                 return (EINVAL);
11536         if (lir->lir_reachtime != 0 &&
11537             lir->lir_reachtime > ND_MAX_REACHTIME)
11538                 return (EINVAL);
11539         if (lir->lir_reachretrans != 0 &&
11540             lir->lir_reachretrans > ND_MAX_REACHRETRANSTIME)
11541                 return (EINVAL);
11542 
11543         mutex_enter(&ill->ill_lock);
11544         /*
11545          * The dce and fragmentation code can handle changes to ill_mtu
11546          * concurrent with sending/fragmenting packets.
11547          */
11548         if (lir->lir_maxmtu != 0)
11549                 ill->ill_user_mtu = lir->lir_maxmtu;
11550 
11551         if (lir->lir_reachtime != 0)
11552                 ill->ill_reachable_time = lir->lir_reachtime;
11553 
11554         if (lir->lir_reachretrans != 0)
11555                 ill->ill_reachable_retrans_time = lir->lir_reachretrans;
11556 
11557         ill->ill_max_hops = lir->lir_maxhops;
11558         ill->ill_max_buf = ND_MAX_Q;
11559         if (!(ill->ill_flags & ILLF_FIXEDMTU) && ill->ill_user_mtu != 0) {
11560                 /*
11561                  * ill_mtu is the actual interface MTU, obtained as the min
11562                  * of user-configured mtu and the value announced by the
11563                  * driver (via DL_NOTE_SDU_SIZE/DL_INFO_ACK). Note that since
11564                  * we have already made the choice of requiring
11565                  * ill_user_mtu < ill_current_frag by the time we get here,
11566                  * the ill_mtu effectively gets assigned to the ill_user_mtu
11567                  * here.
11568                  */
11569                 ill->ill_mtu = MIN(ill->ill_current_frag, ill->ill_user_mtu);
11570                 ill->ill_mc_mtu = MIN(ill->ill_mc_mtu, ill->ill_user_mtu);
11571         }
11572         mutex_exit(&ill->ill_lock);
11573 
11574         /*
11575          * Make sure all dce_generation checks find out
11576          * that ill_mtu/ill_mc_mtu has changed.
11577          */
11578         if (!(ill->ill_flags & ILLF_FIXEDMTU) && (lir->lir_maxmtu != 0))
11579                 dce_increment_all_generations(ill->ill_isv6, ill->ill_ipst);
11580 
11581         /*
11582          * Refresh IPMP meta-interface MTU if necessary.
11583          */
11584         if (IS_UNDER_IPMP(ill))
11585                 ipmp_illgrp_refresh_mtu(ill->ill_grp);
11586 
11587         return (0);
11588 }
11589 
11590 /* ARGSUSED */
11591 int
11592 ip_sioctl_get_lnkinfo(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
11593     ip_ioctl_cmd_t *ipi, void *if_req)
11594 {
11595         struct lif_ifinfo_req *lir;
11596         ill_t *ill = ipif->ipif_ill;
11597 
11598         ip1dbg(("ip_sioctl_get_lnkinfo(%s:%u %p)\n",
11599             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
11600         if (ipif->ipif_id != 0)
11601                 return (EINVAL);
11602 
11603         lir = &((struct lifreq *)if_req)->lifr_ifinfo;
11604         lir->lir_maxhops = ill->ill_max_hops;
11605         lir->lir_reachtime = ill->ill_reachable_time;
11606         lir->lir_reachretrans = ill->ill_reachable_retrans_time;
11607         lir->lir_maxmtu = ill->ill_mtu;
11608 
11609         return (0);
11610 }
11611 
11612 /*
11613  * Return best guess as to the subnet mask for the specified address.
11614  * Based on the subnet masks for all the configured interfaces.
11615  *
11616  * We end up returning a zero mask in the case of default, multicast or
11617  * experimental.
11618  */
11619 static ipaddr_t
11620 ip_subnet_mask(ipaddr_t addr, ipif_t **ipifp, ip_stack_t *ipst)
11621 {
11622         ipaddr_t net_mask;
11623         ill_t   *ill;
11624         ipif_t  *ipif;
11625         ill_walk_context_t ctx;
11626         ipif_t  *fallback_ipif = NULL;
11627 
11628         net_mask = ip_net_mask(addr);
11629         if (net_mask == 0) {
11630                 *ipifp = NULL;
11631                 return (0);
11632         }
11633 
11634         /* Let's check to see if this is maybe a local subnet route. */
11635         /* this function only applies to IPv4 interfaces */
11636         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
11637         ill = ILL_START_WALK_V4(&ctx, ipst);
11638         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
11639                 mutex_enter(&ill->ill_lock);
11640                 for (ipif = ill->ill_ipif; ipif != NULL;
11641                     ipif = ipif->ipif_next) {
11642                         if (IPIF_IS_CONDEMNED(ipif))
11643                                 continue;
11644                         if (!(ipif->ipif_flags & IPIF_UP))
11645                                 continue;
11646                         if ((ipif->ipif_subnet & net_mask) ==
11647                             (addr & net_mask)) {
11648                                 /*
11649                                  * Don't trust pt-pt interfaces if there are
11650                                  * other interfaces.
11651                                  */
11652                                 if (ipif->ipif_flags & IPIF_POINTOPOINT) {
11653                                         if (fallback_ipif == NULL) {
11654                                                 ipif_refhold_locked(ipif);
11655                                                 fallback_ipif = ipif;
11656                                         }
11657                                         continue;
11658                                 }
11659 
11660                                 /*
11661                                  * Fine. Just assume the same net mask as the
11662                                  * directly attached subnet interface is using.
11663                                  */
11664                                 ipif_refhold_locked(ipif);
11665                                 mutex_exit(&ill->ill_lock);
11666                                 rw_exit(&ipst->ips_ill_g_lock);
11667                                 if (fallback_ipif != NULL)
11668                                         ipif_refrele(fallback_ipif);
11669                                 *ipifp = ipif;
11670                                 return (ipif->ipif_net_mask);
11671                         }
11672                 }
11673                 mutex_exit(&ill->ill_lock);
11674         }
11675         rw_exit(&ipst->ips_ill_g_lock);
11676 
11677         *ipifp = fallback_ipif;
11678         return ((fallback_ipif != NULL) ?
11679             fallback_ipif->ipif_net_mask : net_mask);
11680 }
11681 
11682 /*
11683  * ip_sioctl_copyin_setup calls ip_wput_ioctl to process the IP_IOCTL ioctl.
11684  */
11685 static void
11686 ip_wput_ioctl(queue_t *q, mblk_t *mp)
11687 {
11688         IOCP    iocp;
11689         ipft_t  *ipft;
11690         ipllc_t *ipllc;
11691         mblk_t  *mp1;
11692         cred_t  *cr;
11693         int     error = 0;
11694         conn_t  *connp;
11695 
11696         ip1dbg(("ip_wput_ioctl"));
11697         iocp = (IOCP)mp->b_rptr;
11698         mp1 = mp->b_cont;
11699         if (mp1 == NULL) {
11700                 iocp->ioc_error = EINVAL;
11701                 mp->b_datap->db_type = M_IOCNAK;
11702                 iocp->ioc_count = 0;
11703                 qreply(q, mp);
11704                 return;
11705         }
11706 
11707         /*
11708          * These IOCTLs provide various control capabilities to
11709          * upstream agents such as ULPs and processes.  There
11710          * are currently two such IOCTLs implemented.  They
11711          * are used by TCP to provide update information for
11712          * existing IREs and to forcibly delete an IRE for a
11713          * host that is not responding, thereby forcing an
11714          * attempt at a new route.
11715          */
11716         iocp->ioc_error = EINVAL;
11717         if (!pullupmsg(mp1, sizeof (ipllc->ipllc_cmd)))
11718                 goto done;
11719 
11720         ipllc = (ipllc_t *)mp1->b_rptr;
11721         for (ipft = ip_ioctl_ftbl; ipft->ipft_pfi; ipft++) {
11722                 if (ipllc->ipllc_cmd == ipft->ipft_cmd)
11723                         break;
11724         }
11725         /*
11726          * prefer credential from mblk over ioctl;
11727          * see ip_sioctl_copyin_setup
11728          */
11729         cr = msg_getcred(mp, NULL);
11730         if (cr == NULL)
11731                 cr = iocp->ioc_cr;
11732 
11733         /*
11734          * Refhold the conn in case the request gets queued up in some lookup
11735          */
11736         ASSERT(CONN_Q(q));
11737         connp = Q_TO_CONN(q);
11738         CONN_INC_REF(connp);
11739         CONN_INC_IOCTLREF(connp);
11740         if (ipft->ipft_pfi &&
11741             ((mp1->b_wptr - mp1->b_rptr) >= ipft->ipft_min_size ||
11742             pullupmsg(mp1, ipft->ipft_min_size))) {
11743                 error = (*ipft->ipft_pfi)(q,
11744                     (ipft->ipft_flags & IPFT_F_SELF_REPLY) ? mp : mp1, cr);
11745         }
11746         if (ipft->ipft_flags & IPFT_F_SELF_REPLY) {
11747                 /*
11748                  * CONN_OPER_PENDING_DONE happens in the function called
11749                  * through ipft_pfi above.
11750                  */
11751                 return;
11752         }
11753 
11754         CONN_DEC_IOCTLREF(connp);
11755         CONN_OPER_PENDING_DONE(connp);
11756         if (ipft->ipft_flags & IPFT_F_NO_REPLY) {
11757                 freemsg(mp);
11758                 return;
11759         }
11760         iocp->ioc_error = error;
11761 
11762 done:
11763         mp->b_datap->db_type = M_IOCACK;
11764         if (iocp->ioc_error)
11765                 iocp->ioc_count = 0;
11766         qreply(q, mp);
11767 }
11768 
11769 /*
11770  * Assign a unique id for the ipif. This is used by sctp_addr.c
11771  * Note: remove if sctp_addr.c is redone to not shadow ill/ipif data structures.
11772  */
11773 static void
11774 ipif_assign_seqid(ipif_t *ipif)
11775 {
11776         ip_stack_t      *ipst = ipif->ipif_ill->ill_ipst;
11777 
11778         ipif->ipif_seqid = atomic_inc_64_nv(&ipst->ips_ipif_g_seqid);
11779 }
11780 
11781 /*
11782  * Clone the contents of `sipif' to `dipif'.  Requires that both ipifs are
11783  * administratively down (i.e., no DAD), of the same type, and locked.  Note
11784  * that the clone is complete -- including the seqid -- and the expectation is
11785  * that the caller will either free or overwrite `sipif' before it's unlocked.
11786  */
11787 static void
11788 ipif_clone(const ipif_t *sipif, ipif_t *dipif)
11789 {
11790         ASSERT(MUTEX_HELD(&sipif->ipif_ill->ill_lock));
11791         ASSERT(MUTEX_HELD(&dipif->ipif_ill->ill_lock));
11792         ASSERT(!(sipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11793         ASSERT(!(dipif->ipif_flags & (IPIF_UP|IPIF_DUPLICATE)));
11794         ASSERT(sipif->ipif_ire_type == dipif->ipif_ire_type);
11795 
11796         dipif->ipif_flags = sipif->ipif_flags;
11797         dipif->ipif_zoneid = sipif->ipif_zoneid;
11798         dipif->ipif_v6subnet = sipif->ipif_v6subnet;
11799         dipif->ipif_v6lcl_addr = sipif->ipif_v6lcl_addr;
11800         dipif->ipif_v6net_mask = sipif->ipif_v6net_mask;
11801         dipif->ipif_v6brd_addr = sipif->ipif_v6brd_addr;
11802         dipif->ipif_v6pp_dst_addr = sipif->ipif_v6pp_dst_addr;
11803 
11804         /*
11805          * As per the comment atop the function, we assume that these sipif
11806          * fields will be changed before sipif is unlocked.
11807          */
11808         dipif->ipif_seqid = sipif->ipif_seqid;
11809         dipif->ipif_state_flags = sipif->ipif_state_flags;
11810 }
11811 
11812 /*
11813  * Transfer the contents of `sipif' to `dipif', and then free (if `virgipif'
11814  * is NULL) or overwrite `sipif' with `virgipif', which must be a virgin
11815  * (unreferenced) ipif.  Also, if `sipif' is used by the current xop, then
11816  * transfer the xop to `dipif'.  Requires that all ipifs are administratively
11817  * down (i.e., no DAD), of the same type, and unlocked.
11818  */
11819 static void
11820 ipif_transfer(ipif_t *sipif, ipif_t *dipif, ipif_t *virgipif)
11821 {
11822         ipsq_t *ipsq = sipif->ipif_ill->ill_phyint->phyint_ipsq;
11823         ipxop_t *ipx = ipsq->ipsq_xop;
11824 
11825         ASSERT(sipif != dipif);
11826         ASSERT(sipif != virgipif);
11827 
11828         /*
11829          * Grab all of the locks that protect the ipif in a defined order.
11830          */
11831         GRAB_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11832 
11833         ipif_clone(sipif, dipif);
11834         if (virgipif != NULL) {
11835                 ipif_clone(virgipif, sipif);
11836                 mi_free(virgipif);
11837         }
11838 
11839         RELEASE_ILL_LOCKS(sipif->ipif_ill, dipif->ipif_ill);
11840 
11841         /*
11842          * Transfer ownership of the current xop, if necessary.
11843          */
11844         if (ipx->ipx_current_ipif == sipif) {
11845                 ASSERT(ipx->ipx_pending_ipif == NULL);
11846                 mutex_enter(&ipx->ipx_lock);
11847                 ipx->ipx_current_ipif = dipif;
11848                 mutex_exit(&ipx->ipx_lock);
11849         }
11850 
11851         if (virgipif == NULL)
11852                 mi_free(sipif);
11853 }
11854 
11855 /*
11856  * checks if:
11857  *      - <ill_name>:<ipif_id> is at most LIFNAMSIZ - 1 and
11858  *      - logical interface is within the allowed range
11859  */
11860 static int
11861 is_lifname_valid(ill_t *ill, unsigned int ipif_id)
11862 {
11863         if (snprintf(NULL, 0, "%s:%d", ill->ill_name, ipif_id) >= LIFNAMSIZ)
11864                 return (ENAMETOOLONG);
11865 
11866         if (ipif_id >= ill->ill_ipst->ips_ip_addrs_per_if)
11867                 return (ERANGE);
11868         return (0);
11869 }
11870 
11871 /*
11872  * Insert the ipif, so that the list of ipifs on the ill will be sorted
11873  * with respect to ipif_id. Note that an ipif with an ipif_id of -1 will
11874  * be inserted into the first space available in the list. The value of
11875  * ipif_id will then be set to the appropriate value for its position.
11876  */
11877 static int
11878 ipif_insert(ipif_t *ipif, boolean_t acquire_g_lock)
11879 {
11880         ill_t *ill;
11881         ipif_t *tipif;
11882         ipif_t **tipifp;
11883         int id, err;
11884         ip_stack_t      *ipst;
11885 
11886         ASSERT(ipif->ipif_ill->ill_net_type == IRE_LOOPBACK ||
11887             IAM_WRITER_IPIF(ipif));
11888 
11889         ill = ipif->ipif_ill;
11890         ASSERT(ill != NULL);
11891         ipst = ill->ill_ipst;
11892 
11893         /*
11894          * In the case of lo0:0 we already hold the ill_g_lock.
11895          * ill_lookup_on_name (acquires ill_g_lock) -> ipif_allocate ->
11896          * ipif_insert.
11897          */
11898         if (acquire_g_lock)
11899                 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
11900         mutex_enter(&ill->ill_lock);
11901         id = ipif->ipif_id;
11902         tipifp = &(ill->ill_ipif);
11903         if (id == -1) { /* need to find a real id */
11904                 id = 0;
11905                 while ((tipif = *tipifp) != NULL) {
11906                         ASSERT(tipif->ipif_id >= id);
11907                         if (tipif->ipif_id != id)
11908                                 break; /* non-consecutive id */
11909                         id++;
11910                         tipifp = &(tipif->ipif_next);
11911                 }
11912                 if ((err = is_lifname_valid(ill, id)) != 0) {
11913                         mutex_exit(&ill->ill_lock);
11914                         if (acquire_g_lock)
11915                                 rw_exit(&ipst->ips_ill_g_lock);
11916                         return (err);
11917                 }
11918                 ipif->ipif_id = id; /* assign new id */
11919         } else if ((err = is_lifname_valid(ill, id)) == 0) {
11920                 /* we have a real id; insert ipif in the right place */
11921                 while ((tipif = *tipifp) != NULL) {
11922                         ASSERT(tipif->ipif_id != id);
11923                         if (tipif->ipif_id > id)
11924                                 break; /* found correct location */
11925                         tipifp = &(tipif->ipif_next);
11926                 }
11927         } else {
11928                 mutex_exit(&ill->ill_lock);
11929                 if (acquire_g_lock)
11930                         rw_exit(&ipst->ips_ill_g_lock);
11931                 return (err);
11932         }
11933 
11934         ASSERT(tipifp != &(ill->ill_ipif) || id == 0);
11935 
11936         ipif->ipif_next = tipif;
11937         *tipifp = ipif;
11938         mutex_exit(&ill->ill_lock);
11939         if (acquire_g_lock)
11940                 rw_exit(&ipst->ips_ill_g_lock);
11941 
11942         return (0);
11943 }
11944 
11945 static void
11946 ipif_remove(ipif_t *ipif)
11947 {
11948         ipif_t  **ipifp;
11949         ill_t   *ill = ipif->ipif_ill;
11950 
11951         ASSERT(RW_WRITE_HELD(&ill->ill_ipst->ips_ill_g_lock));
11952 
11953         mutex_enter(&ill->ill_lock);
11954         ipifp = &ill->ill_ipif;
11955         for (; *ipifp != NULL; ipifp = &ipifp[0]->ipif_next) {
11956                 if (*ipifp == ipif) {
11957                         *ipifp = ipif->ipif_next;
11958                         break;
11959                 }
11960         }
11961         mutex_exit(&ill->ill_lock);
11962 }
11963 
11964 /*
11965  * Allocate and initialize a new interface control structure.  (Always
11966  * called as writer.)
11967  * When ipif_allocate() is called from ip_ll_subnet_defaults, the ill
11968  * is not part of the global linked list of ills. ipif_seqid is unique
11969  * in the system and to preserve the uniqueness, it is assigned only
11970  * when ill becomes part of the global list. At that point ill will
11971  * have a name. If it doesn't get assigned here, it will get assigned
11972  * in ipif_set_values() as part of SIOCSLIFNAME processing.
11973  * Aditionally, if we come here from ip_ll_subnet_defaults, we don't set
11974  * the interface flags or any other information from the DL_INFO_ACK for
11975  * DL_STYLE2 drivers (initialize == B_FALSE), since we won't have them at
11976  * this point. The flags etc. will be set in ip_ll_subnet_defaults when the
11977  * second DL_INFO_ACK comes in from the driver.
11978  */
11979 static ipif_t *
11980 ipif_allocate(ill_t *ill, int id, uint_t ire_type, boolean_t initialize,
11981     boolean_t insert, int *errorp)
11982 {
11983         int err;
11984         ipif_t  *ipif;
11985         ip_stack_t *ipst = ill->ill_ipst;
11986 
11987         ip1dbg(("ipif_allocate(%s:%d ill %p)\n",
11988             ill->ill_name, id, (void *)ill));
11989         ASSERT(ire_type == IRE_LOOPBACK || IAM_WRITER_ILL(ill));
11990 
11991         if (errorp != NULL)
11992                 *errorp = 0;
11993 
11994         if ((ipif = mi_alloc(sizeof (ipif_t), BPRI_MED)) == NULL) {
11995                 if (errorp != NULL)
11996                         *errorp = ENOMEM;
11997                 return (NULL);
11998         }
11999         *ipif = ipif_zero;      /* start clean */
12000 
12001         ipif->ipif_ill = ill;
12002         ipif->ipif_id = id;  /* could be -1 */
12003         /*
12004          * Inherit the zoneid from the ill; for the shared stack instance
12005          * this is always the global zone
12006          */
12007         ipif->ipif_zoneid = ill->ill_zoneid;
12008 
12009         ipif->ipif_refcnt = 0;
12010 
12011         if (insert) {
12012                 if ((err = ipif_insert(ipif, ire_type != IRE_LOOPBACK)) != 0) {
12013                         mi_free(ipif);
12014                         if (errorp != NULL)
12015                                 *errorp = err;
12016                         return (NULL);
12017                 }
12018                 /* -1 id should have been replaced by real id */
12019                 id = ipif->ipif_id;
12020                 ASSERT(id >= 0);
12021         }
12022 
12023         if (ill->ill_name[0] != '\0')
12024                 ipif_assign_seqid(ipif);
12025 
12026         /*
12027          * If this is the zeroth ipif on the IPMP ill, create the illgrp
12028          * (which must not exist yet because the zeroth ipif is created once
12029          * per ill).  However, do not not link it to the ipmp_grp_t until
12030          * I_PLINK is called; see ip_sioctl_plink_ipmp() for details.
12031          */
12032         if (id == 0 && IS_IPMP(ill)) {
12033                 if (ipmp_illgrp_create(ill) == NULL) {
12034                         if (insert) {
12035                                 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
12036                                 ipif_remove(ipif);
12037                                 rw_exit(&ipst->ips_ill_g_lock);
12038                         }
12039                         mi_free(ipif);
12040                         if (errorp != NULL)
12041                                 *errorp = ENOMEM;
12042                         return (NULL);
12043                 }
12044         }
12045 
12046         /*
12047          * We grab ill_lock to protect the flag changes.  The ipif is still
12048          * not up and can't be looked up until the ioctl completes and the
12049          * IPIF_CHANGING flag is cleared.
12050          */
12051         mutex_enter(&ill->ill_lock);
12052 
12053         ipif->ipif_ire_type = ire_type;
12054 
12055         if (ipif->ipif_isv6) {
12056                 ill->ill_flags |= ILLF_IPV6;
12057         } else {
12058                 ipaddr_t inaddr_any = INADDR_ANY;
12059 
12060                 ill->ill_flags |= ILLF_IPV4;
12061 
12062                 /* Keep the IN6_IS_ADDR_V4MAPPED assertions happy */
12063                 IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12064                     &ipif->ipif_v6lcl_addr);
12065                 IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12066                     &ipif->ipif_v6subnet);
12067                 IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12068                     &ipif->ipif_v6net_mask);
12069                 IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12070                     &ipif->ipif_v6brd_addr);
12071                 IN6_IPADDR_TO_V4MAPPED(inaddr_any,
12072                     &ipif->ipif_v6pp_dst_addr);
12073         }
12074 
12075         /*
12076          * Don't set the interface flags etc. now, will do it in
12077          * ip_ll_subnet_defaults.
12078          */
12079         if (!initialize)
12080                 goto out;
12081 
12082         /*
12083          * NOTE: The IPMP meta-interface is special-cased because it starts
12084          * with no underlying interfaces (and thus an unknown broadcast
12085          * address length), but all interfaces that can be placed into an IPMP
12086          * group are required to be broadcast-capable.
12087          */
12088         if (ill->ill_bcast_addr_length != 0 || IS_IPMP(ill)) {
12089                 /*
12090                  * Later detect lack of DLPI driver multicast capability by
12091                  * catching DL_ENABMULTI_REQ errors in ip_rput_dlpi().
12092                  */
12093                 ill->ill_flags |= ILLF_MULTICAST;
12094                 if (!ipif->ipif_isv6)
12095                         ipif->ipif_flags |= IPIF_BROADCAST;
12096         } else {
12097                 if (ill->ill_net_type != IRE_LOOPBACK) {
12098                         if (ipif->ipif_isv6)
12099                                 /*
12100                                  * Note: xresolv interfaces will eventually need
12101                                  * NOARP set here as well, but that will require
12102                                  * those external resolvers to have some
12103                                  * knowledge of that flag and act appropriately.
12104                                  * Not to be changed at present.
12105                                  */
12106                                 ill->ill_flags |= ILLF_NONUD;
12107                         else
12108                                 ill->ill_flags |= ILLF_NOARP;
12109                 }
12110                 if (ill->ill_phys_addr_length == 0) {
12111                         if (IS_VNI(ill)) {
12112                                 ipif->ipif_flags |= IPIF_NOXMIT;
12113                         } else {
12114                                 /* pt-pt supports multicast. */
12115                                 ill->ill_flags |= ILLF_MULTICAST;
12116                                 if (ill->ill_net_type != IRE_LOOPBACK)
12117                                         ipif->ipif_flags |= IPIF_POINTOPOINT;
12118                         }
12119                 }
12120         }
12121 out:
12122         mutex_exit(&ill->ill_lock);
12123         return (ipif);
12124 }
12125 
12126 /*
12127  * Remove the neighbor cache entries associated with this logical
12128  * interface.
12129  */
12130 int
12131 ipif_arp_down(ipif_t *ipif)
12132 {
12133         ill_t   *ill = ipif->ipif_ill;
12134         int     err = 0;
12135 
12136         ip1dbg(("ipif_arp_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
12137         ASSERT(IAM_WRITER_IPIF(ipif));
12138 
12139         DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_down",
12140             ill_t *, ill, ipif_t *, ipif);
12141         ipif_nce_down(ipif);
12142 
12143         /*
12144          * If this is the last ipif that is going down and there are no
12145          * duplicate addresses we may yet attempt to re-probe, then we need to
12146          * clean up ARP completely.
12147          */
12148         if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
12149             !ill->ill_logical_down && ill->ill_net_type == IRE_IF_RESOLVER) {
12150                 /*
12151                  * If this was the last ipif on an IPMP interface, purge any
12152                  * static ARP entries associated with it.
12153                  */
12154                 if (IS_IPMP(ill))
12155                         ipmp_illgrp_refresh_arpent(ill->ill_grp);
12156 
12157                 /* UNBIND, DETACH */
12158                 err = arp_ll_down(ill);
12159         }
12160 
12161         return (err);
12162 }
12163 
12164 /*
12165  * Get the resolver set up for a new IP address.  (Always called as writer.)
12166  * Called both for IPv4 and IPv6 interfaces, though it only does some
12167  * basic DAD related initialization for IPv6. Honors ILLF_NOARP.
12168  *
12169  * The enumerated value res_act tunes the behavior:
12170  *      * Res_act_initial: set up all the resolver structures for a new
12171  *        IP address.
12172  *      * Res_act_defend: tell ARP that it needs to send a single gratuitous
12173  *        ARP message in defense of the address.
12174  *      * Res_act_rebind: tell ARP to change the hardware address for an IP
12175  *        address (and issue gratuitous ARPs).  Used by ipmp_ill_bind_ipif().
12176  *
12177  * Returns zero on success, or an errno upon failure.
12178  */
12179 int
12180 ipif_resolver_up(ipif_t *ipif, enum ip_resolver_action res_act)
12181 {
12182         ill_t           *ill = ipif->ipif_ill;
12183         int             err;
12184         boolean_t       was_dup;
12185 
12186         ip1dbg(("ipif_resolver_up(%s:%u) flags 0x%x\n",
12187             ill->ill_name, ipif->ipif_id, (uint_t)ipif->ipif_flags));
12188         ASSERT(IAM_WRITER_IPIF(ipif));
12189 
12190         was_dup = B_FALSE;
12191         if (res_act == Res_act_initial) {
12192                 ipif->ipif_addr_ready = 0;
12193                 /*
12194                  * We're bringing an interface up here.  There's no way that we
12195                  * should need to shut down ARP now.
12196                  */
12197                 mutex_enter(&ill->ill_lock);
12198                 if (ipif->ipif_flags & IPIF_DUPLICATE) {
12199                         ipif->ipif_flags &= ~IPIF_DUPLICATE;
12200                         ill->ill_ipif_dup_count--;
12201                         was_dup = B_TRUE;
12202                 }
12203                 mutex_exit(&ill->ill_lock);
12204         }
12205         if (ipif->ipif_recovery_id != 0)
12206                 (void) untimeout(ipif->ipif_recovery_id);
12207         ipif->ipif_recovery_id = 0;
12208         if (ill->ill_net_type != IRE_IF_RESOLVER) {
12209                 ipif->ipif_addr_ready = 1;
12210                 return (0);
12211         }
12212         /* NDP will set the ipif_addr_ready flag when it's ready */
12213         if (ill->ill_isv6)
12214                 return (0);
12215 
12216         err = ipif_arp_up(ipif, res_act, was_dup);
12217         return (err);
12218 }
12219 
12220 /*
12221  * This routine restarts IPv4/IPv6 duplicate address detection (DAD)
12222  * when a link has just gone back up.
12223  */
12224 static void
12225 ipif_nce_start_dad(ipif_t *ipif)
12226 {
12227         ncec_t *ncec;
12228         ill_t *ill = ipif->ipif_ill;
12229         boolean_t isv6 = ill->ill_isv6;
12230 
12231         if (isv6) {
12232                 ncec = ncec_lookup_illgrp_v6(ipif->ipif_ill,
12233                     &ipif->ipif_v6lcl_addr);
12234         } else {
12235                 ipaddr_t v4addr;
12236 
12237                 if (ill->ill_net_type != IRE_IF_RESOLVER ||
12238                     (ipif->ipif_flags & IPIF_UNNUMBERED) ||
12239                     ipif->ipif_lcl_addr == INADDR_ANY) {
12240                         /*
12241                          * If we can't contact ARP for some reason,
12242                          * that's not really a problem.  Just send
12243                          * out the routing socket notification that
12244                          * DAD completion would have done, and continue.
12245                          */
12246                         ipif_mask_reply(ipif);
12247                         ipif_up_notify(ipif);
12248                         ipif->ipif_addr_ready = 1;
12249                         return;
12250                 }
12251 
12252                 IN6_V4MAPPED_TO_IPADDR(&ipif->ipif_v6lcl_addr, v4addr);
12253                 ncec = ncec_lookup_illgrp_v4(ipif->ipif_ill, &v4addr);
12254         }
12255 
12256         if (ncec == NULL) {
12257                 ip1dbg(("couldn't find ncec for ipif %p leaving !ready\n",
12258                     (void *)ipif));
12259                 return;
12260         }
12261         if (!nce_restart_dad(ncec)) {
12262                 /*
12263                  * If we can't restart DAD for some reason, that's not really a
12264                  * problem.  Just send out the routing socket notification that
12265                  * DAD completion would have done, and continue.
12266                  */
12267                 ipif_up_notify(ipif);
12268                 ipif->ipif_addr_ready = 1;
12269         }
12270         ncec_refrele(ncec);
12271 }
12272 
12273 /*
12274  * Restart duplicate address detection on all interfaces on the given ill.
12275  *
12276  * This is called when an interface transitions from down to up
12277  * (DL_NOTE_LINK_UP) or up to down (DL_NOTE_LINK_DOWN).
12278  *
12279  * Note that since the underlying physical link has transitioned, we must cause
12280  * at least one routing socket message to be sent here, either via DAD
12281  * completion or just by default on the first ipif.  (If we don't do this, then
12282  * in.mpathd will see long delays when doing link-based failure recovery.)
12283  */
12284 void
12285 ill_restart_dad(ill_t *ill, boolean_t went_up)
12286 {
12287         ipif_t *ipif;
12288 
12289         if (ill == NULL)
12290                 return;
12291 
12292         /*
12293          * If layer two doesn't support duplicate address detection, then just
12294          * send the routing socket message now and be done with it.
12295          */
12296         if (!ill->ill_isv6 && arp_no_defense) {
12297                 ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12298                 return;
12299         }
12300 
12301         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12302                 if (went_up) {
12303 
12304                         if (ipif->ipif_flags & IPIF_UP) {
12305                                 ipif_nce_start_dad(ipif);
12306                         } else if (ipif->ipif_flags & IPIF_DUPLICATE) {
12307                                 /*
12308                                  * kick off the bring-up process now.
12309                                  */
12310                                 ipif_do_recovery(ipif);
12311                         } else {
12312                                 /*
12313                                  * Unfortunately, the first ipif is "special"
12314                                  * and represents the underlying ill in the
12315                                  * routing socket messages.  Thus, when this
12316                                  * one ipif is down, we must still notify so
12317                                  * that the user knows the IFF_RUNNING status
12318                                  * change.  (If the first ipif is up, then
12319                                  * we'll handle eventual routing socket
12320                                  * notification via DAD completion.)
12321                                  */
12322                                 if (ipif == ill->ill_ipif) {
12323                                         ip_rts_ifmsg(ill->ill_ipif,
12324                                             RTSQ_DEFAULT);
12325                                 }
12326                         }
12327                 } else {
12328                         /*
12329                          * After link down, we'll need to send a new routing
12330                          * message when the link comes back, so clear
12331                          * ipif_addr_ready.
12332                          */
12333                         ipif->ipif_addr_ready = 0;
12334                 }
12335         }
12336 
12337         /*
12338          * If we've torn down links, then notify the user right away.
12339          */
12340         if (!went_up)
12341                 ip_rts_ifmsg(ill->ill_ipif, RTSQ_DEFAULT);
12342 }
12343 
12344 static void
12345 ipsq_delete(ipsq_t *ipsq)
12346 {
12347         ipxop_t *ipx = ipsq->ipsq_xop;
12348 
12349         ipsq->ipsq_ipst = NULL;
12350         ASSERT(ipsq->ipsq_phyint == NULL);
12351         ASSERT(ipsq->ipsq_xop != NULL);
12352         ASSERT(ipsq->ipsq_xopq_mphead == NULL && ipx->ipx_mphead == NULL);
12353         ASSERT(ipx->ipx_pending_mp == NULL);
12354         kmem_free(ipsq, sizeof (ipsq_t));
12355 }
12356 
12357 static int
12358 ill_up_ipifs_on_ill(ill_t *ill, queue_t *q, mblk_t *mp)
12359 {
12360         int err = 0;
12361         ipif_t *ipif;
12362 
12363         if (ill == NULL)
12364                 return (0);
12365 
12366         ASSERT(IAM_WRITER_ILL(ill));
12367         ill->ill_up_ipifs = B_TRUE;
12368         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12369                 if (ipif->ipif_was_up) {
12370                         if (!(ipif->ipif_flags & IPIF_UP))
12371                                 err = ipif_up(ipif, q, mp);
12372                         ipif->ipif_was_up = B_FALSE;
12373                         if (err != 0) {
12374                                 ASSERT(err == EINPROGRESS);
12375                                 return (err);
12376                         }
12377                 }
12378         }
12379         ill->ill_up_ipifs = B_FALSE;
12380         return (0);
12381 }
12382 
12383 /*
12384  * This function is called to bring up all the ipifs that were up before
12385  * bringing the ill down via ill_down_ipifs().
12386  */
12387 int
12388 ill_up_ipifs(ill_t *ill, queue_t *q, mblk_t *mp)
12389 {
12390         int err;
12391 
12392         ASSERT(IAM_WRITER_ILL(ill));
12393 
12394         if (ill->ill_replumbing) {
12395                 ill->ill_replumbing = 0;
12396                 /*
12397                  * Send down REPLUMB_DONE notification followed by the
12398                  * BIND_REQ on the arp stream.
12399                  */
12400                 if (!ill->ill_isv6)
12401                         arp_send_replumb_conf(ill);
12402         }
12403         err = ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv4, q, mp);
12404         if (err != 0)
12405                 return (err);
12406 
12407         return (ill_up_ipifs_on_ill(ill->ill_phyint->phyint_illv6, q, mp));
12408 }
12409 
12410 /*
12411  * Bring down any IPIF_UP ipifs on ill. If "logical" is B_TRUE, we bring
12412  * down the ipifs without sending DL_UNBIND_REQ to the driver.
12413  */
12414 static void
12415 ill_down_ipifs(ill_t *ill, boolean_t logical)
12416 {
12417         ipif_t *ipif;
12418 
12419         ASSERT(IAM_WRITER_ILL(ill));
12420 
12421         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
12422                 /*
12423                  * We go through the ipif_down logic even if the ipif
12424                  * is already down, since routes can be added based
12425                  * on down ipifs. Going through ipif_down once again
12426                  * will delete any IREs created based on these routes.
12427                  */
12428                 if (ipif->ipif_flags & IPIF_UP)
12429                         ipif->ipif_was_up = B_TRUE;
12430 
12431                 if (logical) {
12432                         (void) ipif_logical_down(ipif, NULL, NULL);
12433                         ipif_non_duplicate(ipif);
12434                         (void) ipif_down_tail(ipif);
12435                 } else {
12436                         (void) ipif_down(ipif, NULL, NULL);
12437                 }
12438         }
12439 }
12440 
12441 /*
12442  * Redo source address selection.  This makes IXAF_VERIFY_SOURCE take
12443  * a look again at valid source addresses.
12444  * This should be called each time after the set of source addresses has been
12445  * changed.
12446  */
12447 void
12448 ip_update_source_selection(ip_stack_t *ipst)
12449 {
12450         /* We skip past SRC_GENERATION_VERIFY */
12451         if (atomic_inc_32_nv(&ipst->ips_src_generation) ==
12452             SRC_GENERATION_VERIFY)
12453                 atomic_inc_32(&ipst->ips_src_generation);
12454 }
12455 
12456 /*
12457  * Finish the group join started in ip_sioctl_groupname().
12458  */
12459 /* ARGSUSED */
12460 static void
12461 ip_join_illgrps(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
12462 {
12463         ill_t           *ill = q->q_ptr;
12464         phyint_t        *phyi = ill->ill_phyint;
12465         ipmp_grp_t      *grp = phyi->phyint_grp;
12466         ip_stack_t      *ipst = ill->ill_ipst;
12467 
12468         /* IS_UNDER_IPMP() won't work until ipmp_ill_join_illgrp() is called */
12469         ASSERT(!IS_IPMP(ill) && grp != NULL);
12470         ASSERT(IAM_WRITER_IPSQ(ipsq));
12471 
12472         if (phyi->phyint_illv4 != NULL) {
12473                 rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12474                 VERIFY(grp->gr_pendv4-- > 0);
12475                 rw_exit(&ipst->ips_ipmp_lock);
12476                 ipmp_ill_join_illgrp(phyi->phyint_illv4, grp->gr_v4);
12477         }
12478         if (phyi->phyint_illv6 != NULL) {
12479                 rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12480                 VERIFY(grp->gr_pendv6-- > 0);
12481                 rw_exit(&ipst->ips_ipmp_lock);
12482                 ipmp_ill_join_illgrp(phyi->phyint_illv6, grp->gr_v6);
12483         }
12484         freemsg(mp);
12485 }
12486 
12487 /*
12488  * Process an SIOCSLIFGROUPNAME request.
12489  */
12490 /* ARGSUSED */
12491 int
12492 ip_sioctl_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12493     ip_ioctl_cmd_t *ipip, void *ifreq)
12494 {
12495         struct lifreq   *lifr = ifreq;
12496         ill_t           *ill = ipif->ipif_ill;
12497         ip_stack_t      *ipst = ill->ill_ipst;
12498         phyint_t        *phyi = ill->ill_phyint;
12499         ipmp_grp_t      *grp = phyi->phyint_grp;
12500         mblk_t          *ipsq_mp;
12501         int             err = 0;
12502 
12503         /*
12504          * Note that phyint_grp can only change here, where we're exclusive.
12505          */
12506         ASSERT(IAM_WRITER_ILL(ill));
12507 
12508         if (ipif->ipif_id != 0 || ill->ill_usesrc_grp_next != NULL ||
12509             (phyi->phyint_flags & PHYI_VIRTUAL))
12510                 return (EINVAL);
12511 
12512         lifr->lifr_groupname[LIFGRNAMSIZ - 1] = '\0';
12513 
12514         rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
12515 
12516         /*
12517          * If the name hasn't changed, there's nothing to do.
12518          */
12519         if (grp != NULL && strcmp(grp->gr_name, lifr->lifr_groupname) == 0)
12520                 goto unlock;
12521 
12522         /*
12523          * Handle requests to rename an IPMP meta-interface.
12524          *
12525          * Note that creation of the IPMP meta-interface is handled in
12526          * userland through the standard plumbing sequence.  As part of the
12527          * plumbing the IPMP meta-interface, its initial groupname is set to
12528          * the name of the interface (see ipif_set_values_tail()).
12529          */
12530         if (IS_IPMP(ill)) {
12531                 err = ipmp_grp_rename(grp, lifr->lifr_groupname);
12532                 goto unlock;
12533         }
12534 
12535         /*
12536          * Handle requests to add or remove an IP interface from a group.
12537          */
12538         if (lifr->lifr_groupname[0] != '\0') {                       /* add */
12539                 /*
12540                  * Moves are handled by first removing the interface from
12541                  * its existing group, and then adding it to another group.
12542                  * So, fail if it's already in a group.
12543                  */
12544                 if (IS_UNDER_IPMP(ill)) {
12545                         err = EALREADY;
12546                         goto unlock;
12547                 }
12548 
12549                 grp = ipmp_grp_lookup(lifr->lifr_groupname, ipst);
12550                 if (grp == NULL) {
12551                         err = ENOENT;
12552                         goto unlock;
12553                 }
12554 
12555                 /*
12556                  * Check if the phyint and its ills are suitable for
12557                  * inclusion into the group.
12558                  */
12559                 if ((err = ipmp_grp_vet_phyint(grp, phyi)) != 0)
12560                         goto unlock;
12561 
12562                 /*
12563                  * Checks pass; join the group, and enqueue the remaining
12564                  * illgrp joins for when we've become part of the group xop
12565                  * and are exclusive across its IPSQs.  Since qwriter_ip()
12566                  * requires an mblk_t to scribble on, and since `mp' will be
12567                  * freed as part of completing the ioctl, allocate another.
12568                  */
12569                 if ((ipsq_mp = allocb(0, BPRI_MED)) == NULL) {
12570                         err = ENOMEM;
12571                         goto unlock;
12572                 }
12573 
12574                 /*
12575                  * Before we drop ipmp_lock, bump gr_pend* to ensure that the
12576                  * IPMP meta-interface ills needed by `phyi' cannot go away
12577                  * before ip_join_illgrps() is called back.  See the comments
12578                  * in ip_sioctl_plink_ipmp() for more.
12579                  */
12580                 if (phyi->phyint_illv4 != NULL)
12581                         grp->gr_pendv4++;
12582                 if (phyi->phyint_illv6 != NULL)
12583                         grp->gr_pendv6++;
12584 
12585                 rw_exit(&ipst->ips_ipmp_lock);
12586 
12587                 ipmp_phyint_join_grp(phyi, grp);
12588                 ill_refhold(ill);
12589                 qwriter_ip(ill, ill->ill_rq, ipsq_mp, ip_join_illgrps,
12590                     SWITCH_OP, B_FALSE);
12591                 return (0);
12592         } else {
12593                 /*
12594                  * Request to remove the interface from a group.  If the
12595                  * interface is not in a group, this trivially succeeds.
12596                  */
12597                 rw_exit(&ipst->ips_ipmp_lock);
12598                 if (IS_UNDER_IPMP(ill))
12599                         ipmp_phyint_leave_grp(phyi);
12600                 return (0);
12601         }
12602 unlock:
12603         rw_exit(&ipst->ips_ipmp_lock);
12604         return (err);
12605 }
12606 
12607 /*
12608  * Process an SIOCGLIFBINDING request.
12609  */
12610 /* ARGSUSED */
12611 int
12612 ip_sioctl_get_binding(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12613     ip_ioctl_cmd_t *ipip, void *ifreq)
12614 {
12615         ill_t           *ill;
12616         struct lifreq   *lifr = ifreq;
12617         ip_stack_t      *ipst = ipif->ipif_ill->ill_ipst;
12618 
12619         if (!IS_IPMP(ipif->ipif_ill))
12620                 return (EINVAL);
12621 
12622         rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12623         if ((ill = ipif->ipif_bound_ill) == NULL)
12624                 lifr->lifr_binding[0] = '\0';
12625         else
12626                 (void) strlcpy(lifr->lifr_binding, ill->ill_name, LIFNAMSIZ);
12627         rw_exit(&ipst->ips_ipmp_lock);
12628         return (0);
12629 }
12630 
12631 /*
12632  * Process an SIOCGLIFGROUPNAME request.
12633  */
12634 /* ARGSUSED */
12635 int
12636 ip_sioctl_get_groupname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12637     ip_ioctl_cmd_t *ipip, void *ifreq)
12638 {
12639         ipmp_grp_t      *grp;
12640         struct lifreq   *lifr = ifreq;
12641         ip_stack_t      *ipst = ipif->ipif_ill->ill_ipst;
12642 
12643         rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12644         if ((grp = ipif->ipif_ill->ill_phyint->phyint_grp) == NULL)
12645                 lifr->lifr_groupname[0] = '\0';
12646         else
12647                 (void) strlcpy(lifr->lifr_groupname, grp->gr_name, LIFGRNAMSIZ);
12648         rw_exit(&ipst->ips_ipmp_lock);
12649         return (0);
12650 }
12651 
12652 /*
12653  * Process an SIOCGLIFGROUPINFO request.
12654  */
12655 /* ARGSUSED */
12656 int
12657 ip_sioctl_groupinfo(ipif_t *dummy_ipif, sin_t *sin, queue_t *q, mblk_t *mp,
12658     ip_ioctl_cmd_t *ipip, void *dummy)
12659 {
12660         ipmp_grp_t      *grp;
12661         lifgroupinfo_t  *lifgr;
12662         ip_stack_t      *ipst = CONNQ_TO_IPST(q);
12663 
12664         /* ip_wput_nondata() verified mp->b_cont->b_cont */
12665         lifgr = (lifgroupinfo_t *)mp->b_cont->b_cont->b_rptr;
12666         lifgr->gi_grname[LIFGRNAMSIZ - 1] = '\0';
12667 
12668         rw_enter(&ipst->ips_ipmp_lock, RW_READER);
12669         if ((grp = ipmp_grp_lookup(lifgr->gi_grname, ipst)) == NULL) {
12670                 rw_exit(&ipst->ips_ipmp_lock);
12671                 return (ENOENT);
12672         }
12673         ipmp_grp_info(grp, lifgr);
12674         rw_exit(&ipst->ips_ipmp_lock);
12675         return (0);
12676 }
12677 
12678 static void
12679 ill_dl_down(ill_t *ill)
12680 {
12681         DTRACE_PROBE2(ill__downup, char *, "ill_dl_down", ill_t *, ill);
12682 
12683         /*
12684          * The ill is down; unbind but stay attached since we're still
12685          * associated with a PPA. If we have negotiated DLPI capabilites
12686          * with the data link service provider (IDS_OK) then reset them.
12687          * The interval between unbinding and rebinding is potentially
12688          * unbounded hence we cannot assume things will be the same.
12689          * The DLPI capabilities will be probed again when the data link
12690          * is brought up.
12691          */
12692         mblk_t  *mp = ill->ill_unbind_mp;
12693 
12694         ip1dbg(("ill_dl_down(%s)\n", ill->ill_name));
12695 
12696         if (!ill->ill_replumbing) {
12697                 /* Free all ilms for this ill */
12698                 update_conn_ill(ill, ill->ill_ipst);
12699         } else {
12700                 ill_leave_multicast(ill);
12701         }
12702 
12703         ill->ill_unbind_mp = NULL;
12704         if (mp != NULL) {
12705                 ip1dbg(("ill_dl_down: %s (%u) for %s\n",
12706                     dl_primstr(*(int *)mp->b_rptr), *(int *)mp->b_rptr,
12707                     ill->ill_name));
12708                 mutex_enter(&ill->ill_lock);
12709                 ill->ill_state_flags |= ILL_DL_UNBIND_IN_PROGRESS;
12710                 mutex_exit(&ill->ill_lock);
12711                 /*
12712                  * ip_rput does not pass up normal (M_PROTO) DLPI messages
12713                  * after ILL_CONDEMNED is set. So in the unplumb case, we call
12714                  * ill_capability_dld_disable disable rightaway. If this is not
12715                  * an unplumb operation then the disable happens on receipt of
12716                  * the capab ack via ip_rput_dlpi_writer ->
12717                  * ill_capability_ack_thr. In both cases the order of
12718                  * the operations seen by DLD is capability disable followed
12719                  * by DL_UNBIND. Also the DLD capability disable needs a
12720                  * cv_wait'able context.
12721                  */
12722                 if (ill->ill_state_flags & ILL_CONDEMNED)
12723                         ill_capability_dld_disable(ill);
12724                 ill_capability_reset(ill, B_FALSE);
12725                 ill_dlpi_send(ill, mp);
12726         }
12727         mutex_enter(&ill->ill_lock);
12728         ill->ill_dl_up = 0;
12729         ill_nic_event_dispatch(ill, 0, NE_DOWN, NULL, 0);
12730         mutex_exit(&ill->ill_lock);
12731 }
12732 
12733 void
12734 ill_dlpi_dispatch(ill_t *ill, mblk_t *mp)
12735 {
12736         union DL_primitives *dlp;
12737         t_uscalar_t prim;
12738         boolean_t waitack = B_FALSE;
12739 
12740         ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12741 
12742         dlp = (union DL_primitives *)mp->b_rptr;
12743         prim = dlp->dl_primitive;
12744 
12745         ip1dbg(("ill_dlpi_dispatch: sending %s (%u) to %s\n",
12746             dl_primstr(prim), prim, ill->ill_name));
12747 
12748         switch (prim) {
12749         case DL_PHYS_ADDR_REQ:
12750         {
12751                 dl_phys_addr_req_t *dlpap = (dl_phys_addr_req_t *)mp->b_rptr;
12752                 ill->ill_phys_addr_pend = dlpap->dl_addr_type;
12753                 break;
12754         }
12755         case DL_BIND_REQ:
12756                 mutex_enter(&ill->ill_lock);
12757                 ill->ill_state_flags &= ~ILL_DL_UNBIND_IN_PROGRESS;
12758                 mutex_exit(&ill->ill_lock);
12759                 break;
12760         }
12761 
12762         /*
12763          * Except for the ACKs for the M_PCPROTO messages, all other ACKs
12764          * are dropped by ip_rput() if ILL_CONDEMNED is set. Therefore
12765          * we only wait for the ACK of the DL_UNBIND_REQ.
12766          */
12767         mutex_enter(&ill->ill_lock);
12768         if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
12769             (prim == DL_UNBIND_REQ)) {
12770                 ill->ill_dlpi_pending = prim;
12771                 waitack = B_TRUE;
12772         }
12773 
12774         mutex_exit(&ill->ill_lock);
12775         DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_dispatch",
12776             char *, dl_primstr(prim), ill_t *, ill);
12777         putnext(ill->ill_wq, mp);
12778 
12779         /*
12780          * There is no ack for DL_NOTIFY_CONF messages
12781          */
12782         if (waitack && prim == DL_NOTIFY_CONF)
12783                 ill_dlpi_done(ill, prim);
12784 }
12785 
12786 /*
12787  * Helper function for ill_dlpi_send().
12788  */
12789 /* ARGSUSED */
12790 static void
12791 ill_dlpi_send_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *arg)
12792 {
12793         ill_dlpi_send(q->q_ptr, mp);
12794 }
12795 
12796 /*
12797  * Send a DLPI control message to the driver but make sure there
12798  * is only one outstanding message. Uses ill_dlpi_pending to tell
12799  * when it must queue. ip_rput_dlpi_writer calls ill_dlpi_done()
12800  * when an ACK or a NAK is received to process the next queued message.
12801  */
12802 void
12803 ill_dlpi_send(ill_t *ill, mblk_t *mp)
12804 {
12805         mblk_t **mpp;
12806 
12807         ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
12808 
12809         /*
12810          * To ensure that any DLPI requests for current exclusive operation
12811          * are always completely sent before any DLPI messages for other
12812          * operations, require writer access before enqueuing.
12813          */
12814         if (!IAM_WRITER_ILL(ill)) {
12815                 ill_refhold(ill);
12816                 /* qwriter_ip() does the ill_refrele() */
12817                 qwriter_ip(ill, ill->ill_wq, mp, ill_dlpi_send_writer,
12818                     NEW_OP, B_TRUE);
12819                 return;
12820         }
12821 
12822         mutex_enter(&ill->ill_lock);
12823         if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
12824                 /* Must queue message. Tail insertion */
12825                 mpp = &ill->ill_dlpi_deferred;
12826                 while (*mpp != NULL)
12827                         mpp = &((*mpp)->b_next);
12828 
12829                 ip1dbg(("ill_dlpi_send: deferring request for %s "
12830                     "while %s pending\n", ill->ill_name,
12831                     dl_primstr(ill->ill_dlpi_pending)));
12832 
12833                 *mpp = mp;
12834                 mutex_exit(&ill->ill_lock);
12835                 return;
12836         }
12837         mutex_exit(&ill->ill_lock);
12838         ill_dlpi_dispatch(ill, mp);
12839 }
12840 
12841 void
12842 ill_capability_send(ill_t *ill, mblk_t *mp)
12843 {
12844         ill->ill_capab_pending_cnt++;
12845         ill_dlpi_send(ill, mp);
12846 }
12847 
12848 void
12849 ill_capability_done(ill_t *ill)
12850 {
12851         ASSERT(ill->ill_capab_pending_cnt != 0);
12852 
12853         ill_dlpi_done(ill, DL_CAPABILITY_REQ);
12854 
12855         ill->ill_capab_pending_cnt--;
12856         if (ill->ill_capab_pending_cnt == 0 &&
12857             ill->ill_dlpi_capab_state == IDCS_OK)
12858                 ill_capability_reset_alloc(ill);
12859 }
12860 
12861 /*
12862  * Send all deferred DLPI messages without waiting for their ACKs.
12863  */
12864 void
12865 ill_dlpi_send_deferred(ill_t *ill)
12866 {
12867         mblk_t *mp, *nextmp;
12868 
12869         /*
12870          * Clear ill_dlpi_pending so that the message is not queued in
12871          * ill_dlpi_send().
12872          */
12873         mutex_enter(&ill->ill_lock);
12874         ill->ill_dlpi_pending = DL_PRIM_INVAL;
12875         mp = ill->ill_dlpi_deferred;
12876         ill->ill_dlpi_deferred = NULL;
12877         mutex_exit(&ill->ill_lock);
12878 
12879         for (; mp != NULL; mp = nextmp) {
12880                 nextmp = mp->b_next;
12881                 mp->b_next = NULL;
12882                 ill_dlpi_send(ill, mp);
12883         }
12884 }
12885 
12886 /*
12887  * Clear all the deferred DLPI messages. Called on receiving an M_ERROR
12888  * or M_HANGUP
12889  */
12890 static void
12891 ill_dlpi_clear_deferred(ill_t *ill)
12892 {
12893         mblk_t  *mp, *nextmp;
12894 
12895         mutex_enter(&ill->ill_lock);
12896         ill->ill_dlpi_pending = DL_PRIM_INVAL;
12897         mp = ill->ill_dlpi_deferred;
12898         ill->ill_dlpi_deferred = NULL;
12899         mutex_exit(&ill->ill_lock);
12900 
12901         for (; mp != NULL; mp = nextmp) {
12902                 nextmp = mp->b_next;
12903                 inet_freemsg(mp);
12904         }
12905 }
12906 
12907 /*
12908  * Check if the DLPI primitive `prim' is pending; print a warning if not.
12909  */
12910 boolean_t
12911 ill_dlpi_pending(ill_t *ill, t_uscalar_t prim)
12912 {
12913         t_uscalar_t pending;
12914 
12915         mutex_enter(&ill->ill_lock);
12916         if (ill->ill_dlpi_pending == prim) {
12917                 mutex_exit(&ill->ill_lock);
12918                 return (B_TRUE);
12919         }
12920 
12921         /*
12922          * During teardown, ill_dlpi_dispatch() will send DLPI requests
12923          * without waiting, so don't print any warnings in that case.
12924          */
12925         if (ill->ill_state_flags & ILL_CONDEMNED) {
12926                 mutex_exit(&ill->ill_lock);
12927                 return (B_FALSE);
12928         }
12929         pending = ill->ill_dlpi_pending;
12930         mutex_exit(&ill->ill_lock);
12931 
12932         if (pending == DL_PRIM_INVAL) {
12933                 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12934                     "received unsolicited ack for %s on %s\n",
12935                     dl_primstr(prim), ill->ill_name);
12936         } else {
12937                 (void) mi_strlog(ill->ill_rq, 1, SL_CONSOLE|SL_ERROR|SL_TRACE,
12938                     "received unexpected ack for %s on %s (expecting %s)\n",
12939                     dl_primstr(prim), ill->ill_name, dl_primstr(pending));
12940         }
12941         return (B_FALSE);
12942 }
12943 
12944 /*
12945  * Complete the current DLPI operation associated with `prim' on `ill' and
12946  * start the next queued DLPI operation (if any).  If there are no queued DLPI
12947  * operations and the ill's current exclusive IPSQ operation has finished
12948  * (i.e., ipsq_current_finish() was called), then clear ipsq_current_ipif to
12949  * allow the next exclusive IPSQ operation to begin upon ipsq_exit().  See
12950  * the comments above ipsq_current_finish() for details.
12951  */
12952 void
12953 ill_dlpi_done(ill_t *ill, t_uscalar_t prim)
12954 {
12955         mblk_t *mp;
12956         ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
12957         ipxop_t *ipx = ipsq->ipsq_xop;
12958 
12959         ASSERT(IAM_WRITER_IPSQ(ipsq));
12960         mutex_enter(&ill->ill_lock);
12961 
12962         ASSERT(prim != DL_PRIM_INVAL);
12963         ASSERT(ill->ill_dlpi_pending == prim);
12964 
12965         ip1dbg(("ill_dlpi_done: %s has completed %s (%u)\n", ill->ill_name,
12966             dl_primstr(ill->ill_dlpi_pending), ill->ill_dlpi_pending));
12967 
12968         if ((mp = ill->ill_dlpi_deferred) == NULL) {
12969                 ill->ill_dlpi_pending = DL_PRIM_INVAL;
12970                 if (ipx->ipx_current_done) {
12971                         mutex_enter(&ipx->ipx_lock);
12972                         ipx->ipx_current_ipif = NULL;
12973                         mutex_exit(&ipx->ipx_lock);
12974                 }
12975                 cv_signal(&ill->ill_cv);
12976                 mutex_exit(&ill->ill_lock);
12977                 return;
12978         }
12979 
12980         ill->ill_dlpi_deferred = mp->b_next;
12981         mp->b_next = NULL;
12982         mutex_exit(&ill->ill_lock);
12983 
12984         ill_dlpi_dispatch(ill, mp);
12985 }
12986 
12987 /*
12988  * Queue a (multicast) DLPI control message to be sent to the driver by
12989  * later calling ill_dlpi_send_queued.
12990  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
12991  * are sent in order i.e., prevent a DL_DISABMULTI_REQ and DL_ENABMULTI_REQ
12992  * for the same group to race.
12993  * We send DLPI control messages in order using ill_lock.
12994  * For IPMP we should be called on the cast_ill.
12995  */
12996 void
12997 ill_dlpi_queue(ill_t *ill, mblk_t *mp)
12998 {
12999         mblk_t **mpp;
13000 
13001         ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);
13002 
13003         mutex_enter(&ill->ill_lock);
13004         /* Must queue message. Tail insertion */
13005         mpp = &ill->ill_dlpi_deferred;
13006         while (*mpp != NULL)
13007                 mpp = &((*mpp)->b_next);
13008 
13009         *mpp = mp;
13010         mutex_exit(&ill->ill_lock);
13011 }
13012 
13013 /*
13014  * Send the messages that were queued. Make sure there is only
13015  * one outstanding message. ip_rput_dlpi_writer calls ill_dlpi_done()
13016  * when an ACK or a NAK is received to process the next queued message.
13017  * For IPMP we are called on the upper ill, but when send what is queued
13018  * on the cast_ill.
13019  */
13020 void
13021 ill_dlpi_send_queued(ill_t *ill)
13022 {
13023         mblk_t  *mp;
13024         union DL_primitives *dlp;
13025         t_uscalar_t prim;
13026         ill_t *release_ill = NULL;
13027 
13028         if (IS_IPMP(ill)) {
13029                 /* On the upper IPMP ill. */
13030                 release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13031                 if (release_ill == NULL) {
13032                         /* Avoid ever sending anything down to the ipmpstub */
13033                         return;
13034                 }
13035                 ill = release_ill;
13036         }
13037         mutex_enter(&ill->ill_lock);
13038         while ((mp = ill->ill_dlpi_deferred) != NULL) {
13039                 if (ill->ill_dlpi_pending != DL_PRIM_INVAL) {
13040                         /* Can't send. Somebody else will send it */
13041                         mutex_exit(&ill->ill_lock);
13042                         goto done;
13043                 }
13044                 ill->ill_dlpi_deferred = mp->b_next;
13045                 mp->b_next = NULL;
13046                 if (!ill->ill_dl_up) {
13047                         /*
13048                          * Nobody there. All multicast addresses will be
13049                          * re-joined when we get the DL_BIND_ACK bringing the
13050                          * interface up.
13051                          */
13052                         freemsg(mp);
13053                         continue;
13054                 }
13055                 dlp = (union DL_primitives *)mp->b_rptr;
13056                 prim = dlp->dl_primitive;
13057 
13058                 if (!(ill->ill_state_flags & ILL_CONDEMNED) ||
13059                     (prim == DL_UNBIND_REQ)) {
13060                         ill->ill_dlpi_pending = prim;
13061                 }
13062                 mutex_exit(&ill->ill_lock);
13063 
13064                 DTRACE_PROBE3(ill__dlpi, char *, "ill_dlpi_send_queued",
13065                     char *, dl_primstr(prim), ill_t *, ill);
13066                 putnext(ill->ill_wq, mp);
13067                 mutex_enter(&ill->ill_lock);
13068         }
13069         mutex_exit(&ill->ill_lock);
13070 done:
13071         if (release_ill != NULL)
13072                 ill_refrele(release_ill);
13073 }
13074 
13075 /*
13076  * Queue an IP (IGMP/MLD) message to be sent by IP from
13077  * ill_mcast_send_queued
13078  * We queue them while holding a lock (ill_mcast_lock) to ensure that they
13079  * are sent in order i.e., prevent a IGMP leave and IGMP join for the same
13080  * group to race.
13081  * We send them in order using ill_lock.
13082  * For IPMP we are called on the upper ill, but we queue on the cast_ill.
13083  */
13084 void
13085 ill_mcast_queue(ill_t *ill, mblk_t *mp)
13086 {
13087         mblk_t **mpp;
13088         ill_t *release_ill = NULL;
13089 
13090         ASSERT(RW_LOCK_HELD(&ill->ill_mcast_lock));
13091 
13092         if (IS_IPMP(ill)) {
13093                 /* On the upper IPMP ill. */
13094                 release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13095                 if (release_ill == NULL) {
13096                         /* Discard instead of queuing for the ipmp interface */
13097                         BUMP_MIB(ill->ill_ip_mib, ipIfStatsOutDiscards);
13098                         ip_drop_output("ipIfStatsOutDiscards - no cast_ill",
13099                             mp, ill);
13100                         freemsg(mp);
13101                         return;
13102                 }
13103                 ill = release_ill;
13104         }
13105 
13106         mutex_enter(&ill->ill_lock);
13107         /* Must queue message. Tail insertion */
13108         mpp = &ill->ill_mcast_deferred;
13109         while (*mpp != NULL)
13110                 mpp = &((*mpp)->b_next);
13111 
13112         *mpp = mp;
13113         mutex_exit(&ill->ill_lock);
13114         if (release_ill != NULL)
13115                 ill_refrele(release_ill);
13116 }
13117 
13118 /*
13119  * Send the IP packets that were queued by ill_mcast_queue.
13120  * These are IGMP/MLD packets.
13121  *
13122  * For IPMP we are called on the upper ill, but when send what is queued
13123  * on the cast_ill.
13124  *
13125  * Request loopback of the report if we are acting as a multicast
13126  * router, so that the process-level routing demon can hear it.
13127  * This will run multiple times for the same group if there are members
13128  * on the same group for multiple ipif's on the same ill. The
13129  * igmp_input/mld_input code will suppress this due to the loopback thus we
13130  * always loopback membership report.
13131  *
13132  * We also need to make sure that this does not get load balanced
13133  * by IPMP. We do this by passing an ill to ip_output_simple.
13134  */
13135 void
13136 ill_mcast_send_queued(ill_t *ill)
13137 {
13138         mblk_t  *mp;
13139         ip_xmit_attr_t ixas;
13140         ill_t *release_ill = NULL;
13141 
13142         if (IS_IPMP(ill)) {
13143                 /* On the upper IPMP ill. */
13144                 release_ill = ipmp_illgrp_hold_cast_ill(ill->ill_grp);
13145                 if (release_ill == NULL) {
13146                         /*
13147                          * We should have no messages on the ipmp interface
13148                          * but no point in trying to send them.
13149                          */
13150                         return;
13151                 }
13152                 ill = release_ill;
13153         }
13154         bzero(&ixas, sizeof (ixas));
13155         ixas.ixa_zoneid = ALL_ZONES;
13156         ixas.ixa_cred = kcred;
13157         ixas.ixa_cpid = NOPID;
13158         ixas.ixa_tsl = NULL;
13159         /*
13160          * Here we set ixa_ifindex. If IPMP it will be the lower ill which
13161          * makes ip_select_route pick the IRE_MULTICAST for the cast_ill.
13162          * That is necessary to handle IGMP/MLD snooping switches.
13163          */
13164         ixas.ixa_ifindex = ill->ill_phyint->phyint_ifindex;
13165         ixas.ixa_ipst = ill->ill_ipst;
13166 
13167         mutex_enter(&ill->ill_lock);
13168         while ((mp = ill->ill_mcast_deferred) != NULL) {
13169                 ill->ill_mcast_deferred = mp->b_next;
13170                 mp->b_next = NULL;
13171                 if (!ill->ill_dl_up) {
13172                         /*
13173                          * Nobody there. Just drop the ip packets.
13174                          * IGMP/MLD will resend later, if this is a replumb.
13175                          */
13176                         freemsg(mp);
13177                         continue;
13178                 }
13179                 mutex_enter(&ill->ill_phyint->phyint_lock);
13180                 if (IS_UNDER_IPMP(ill) && !ipmp_ill_is_active(ill)) {
13181                         /*
13182                          * When the ill is getting deactivated, we only want to
13183                          * send the DLPI messages, so drop IGMP/MLD packets.
13184                          * DLPI messages are handled by ill_dlpi_send_queued()
13185                          */
13186                         mutex_exit(&ill->ill_phyint->phyint_lock);
13187                         freemsg(mp);
13188                         continue;
13189                 }
13190                 mutex_exit(&ill->ill_phyint->phyint_lock);
13191                 mutex_exit(&ill->ill_lock);
13192 
13193                 /* Check whether we are sending IPv4 or IPv6. */
13194                 if (ill->ill_isv6) {
13195                         ip6_t  *ip6h = (ip6_t *)mp->b_rptr;
13196 
13197                         ixas.ixa_multicast_ttl = ip6h->ip6_hops;
13198                         ixas.ixa_flags = IXAF_BASIC_SIMPLE_V6;
13199                 } else {
13200                         ipha_t *ipha = (ipha_t *)mp->b_rptr;
13201 
13202                         ixas.ixa_multicast_ttl = ipha->ipha_ttl;
13203                         ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13204                         ixas.ixa_flags &= ~IXAF_SET_ULP_CKSUM;
13205                 }
13206                 ixas.ixa_flags &= ~IXAF_VERIFY_SOURCE;
13207                 ixas.ixa_flags |= IXAF_MULTICAST_LOOP | IXAF_SET_SOURCE;
13208                 (void) ip_output_simple(mp, &ixas);
13209                 ixa_cleanup(&ixas);
13210 
13211                 mutex_enter(&ill->ill_lock);
13212         }
13213         mutex_exit(&ill->ill_lock);
13214 
13215 done:
13216         if (release_ill != NULL)
13217                 ill_refrele(release_ill);
13218 }
13219 
13220 /*
13221  * Take down a specific interface, but don't lose any information about it.
13222  * (Always called as writer.)
13223  * This function goes through the down sequence even if the interface is
13224  * already down. There are 2 reasons.
13225  * a. Currently we permit interface routes that depend on down interfaces
13226  *    to be added. This behaviour itself is questionable. However it appears
13227  *    that both Solaris and 4.3 BSD have exhibited this behaviour for a long
13228  *    time. We go thru the cleanup in order to remove these routes.
13229  * b. The bringup of the interface could fail in ill_dl_up i.e. we get
13230  *    DL_ERROR_ACK in response to the DL_BIND request. The interface is
13231  *    down, but we need to cleanup i.e. do ill_dl_down and
13232  *    ip_rput_dlpi_writer (DL_ERROR_ACK) -> ipif_down.
13233  *
13234  * IP-MT notes:
13235  *
13236  * Model of reference to interfaces.
13237  *
13238  * The following members in ipif_t track references to the ipif.
13239  *      int     ipif_refcnt;    Active reference count
13240  *
13241  * The following members in ill_t track references to the ill.
13242  *      int             ill_refcnt;     active refcnt
13243  *      uint_t          ill_ire_cnt;    Number of ires referencing ill
13244  *      uint_t          ill_ncec_cnt;   Number of ncecs referencing ill
13245  *      uint_t          ill_nce_cnt;    Number of nces referencing ill
13246  *      uint_t          ill_ilm_cnt;    Number of ilms referencing ill
13247  *
13248  * Reference to an ipif or ill can be obtained in any of the following ways.
13249  *
13250  * Through the lookup functions ipif_lookup_* / ill_lookup_* functions
13251  * Pointers to ipif / ill from other data structures viz ire and conn.
13252  * Implicit reference to the ipif / ill by holding a reference to the ire.
13253  *
13254  * The ipif/ill lookup functions return a reference held ipif / ill.
13255  * ipif_refcnt and ill_refcnt track the reference counts respectively.
13256  * This is a purely dynamic reference count associated with threads holding
13257  * references to the ipif / ill. Pointers from other structures do not
13258  * count towards this reference count.
13259  *
13260  * ill_ire_cnt is the number of ire's associated with the
13261  * ill. This is incremented whenever a new ire is created referencing the
13262  * ill. This is done atomically inside ire_add_v[46] where the ire is
13263  * actually added to the ire hash table. The count is decremented in
13264  * ire_inactive where the ire is destroyed.
13265  *
13266  * ill_ncec_cnt is the number of ncec's referencing the ill thru ncec_ill.
13267  * This is incremented atomically in
13268  * ndp_add_v4()/ndp_add_v6() where the nce is actually added to the
13269  * table. Similarly it is decremented in ncec_inactive() where the ncec
13270  * is destroyed.
13271  *
13272  * ill_nce_cnt is the number of nce's referencing the ill thru nce_ill. This is
13273  * incremented atomically in nce_add() where the nce is actually added to the
13274  * ill_nce. Similarly it is decremented in nce_inactive() where the nce
13275  * is destroyed.
13276  *
13277  * ill_ilm_cnt is the ilm's reference to the ill. It is incremented in
13278  * ilm_add() and decremented before the ilm is freed in ilm_delete().
13279  *
13280  * Flow of ioctls involving interface down/up
13281  *
13282  * The following is the sequence of an attempt to set some critical flags on an
13283  * up interface.
13284  * ip_sioctl_flags
13285  * ipif_down
13286  * wait for ipif to be quiescent
13287  * ipif_down_tail
13288  * ip_sioctl_flags_tail
13289  *
13290  * All set ioctls that involve down/up sequence would have a skeleton similar
13291  * to the above. All the *tail functions are called after the refcounts have
13292  * dropped to the appropriate values.
13293  *
13294  * SIOC ioctls during the IPIF_CHANGING interval.
13295  *
13296  * Threads handling SIOC set ioctls serialize on the squeue, but this
13297  * is not done for SIOC get ioctls. Since a set ioctl can cause several
13298  * steps of internal changes to the state, some of which are visible in
13299  * ipif_flags (such as IFF_UP being cleared and later set), and we want
13300  * the set ioctl to be atomic related to the get ioctls, the SIOC get code
13301  * will wait and restart ioctls if IPIF_CHANGING is set. The mblk is then
13302  * enqueued in the ipsq and the operation is restarted by ipsq_exit() when
13303  * the current exclusive operation completes. The IPIF_CHANGING check
13304  * and enqueue is atomic using the ill_lock and ipsq_lock. The
13305  * lookup is done holding the ill_lock. Hence the ill/ipif state flags can't
13306  * change while the ill_lock is held. Before dropping the ill_lock we acquire
13307  * the ipsq_lock and call ipsq_enq. This ensures that ipsq_exit can't finish
13308  * until we release the ipsq_lock, even though the ill/ipif state flags
13309  * can change after we drop the ill_lock.
13310  */
13311 int
13312 ipif_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13313 {
13314         ill_t           *ill = ipif->ipif_ill;
13315         conn_t          *connp;
13316         boolean_t       success;
13317         boolean_t       ipif_was_up = B_FALSE;
13318         ip_stack_t      *ipst = ill->ill_ipst;
13319 
13320         ASSERT(IAM_WRITER_IPIF(ipif));
13321 
13322         ip1dbg(("ipif_down(%s:%u)\n", ill->ill_name, ipif->ipif_id));
13323 
13324         DTRACE_PROBE3(ipif__downup, char *, "ipif_down",
13325             ill_t *, ill, ipif_t *, ipif);
13326 
13327         if (ipif->ipif_flags & IPIF_UP) {
13328                 mutex_enter(&ill->ill_lock);
13329                 ipif->ipif_flags &= ~IPIF_UP;
13330                 ASSERT(ill->ill_ipif_up_count > 0);
13331                 --ill->ill_ipif_up_count;
13332                 mutex_exit(&ill->ill_lock);
13333                 ipif_was_up = B_TRUE;
13334                 /* Update status in SCTP's list */
13335                 sctp_update_ipif(ipif, SCTP_IPIF_DOWN);
13336                 ill_nic_event_dispatch(ipif->ipif_ill,
13337                     MAP_IPIF_ID(ipif->ipif_id), NE_LIF_DOWN, NULL, 0);
13338         }
13339 
13340         /*
13341          * Removal of the last ipif from an ill may result in a DL_UNBIND
13342          * being sent to the driver, and we must not send any data packets to
13343          * the driver after the DL_UNBIND_REQ. To ensure this, all the
13344          * ire and nce entries used in the data path will be cleaned
13345          * up, and we also set  the ILL_DOWN_IN_PROGRESS bit to make
13346          * sure on new entries will be added until the ill is bound
13347          * again. The ILL_DOWN_IN_PROGRESS bit is turned off upon
13348          * receipt of a DL_BIND_ACK.
13349          */
13350         if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13351             ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13352             ill->ill_dl_up) {
13353                 ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
13354         }
13355 
13356         /*
13357          * Blow away memberships we established in ipif_multicast_up().
13358          */
13359         ipif_multicast_down(ipif);
13360 
13361         /*
13362          * Remove from the mapping for __sin6_src_id. We insert only
13363          * when the address is not INADDR_ANY. As IPv4 addresses are
13364          * stored as mapped addresses, we need to check for mapped
13365          * INADDR_ANY also.
13366          */
13367         if (ipif_was_up && !IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) &&
13368             !IN6_IS_ADDR_V4MAPPED_ANY(&ipif->ipif_v6lcl_addr) &&
13369             !(ipif->ipif_flags & IPIF_NOLOCAL)) {
13370                 int err;
13371 
13372                 err = ip_srcid_remove(&ipif->ipif_v6lcl_addr,
13373                     ipif->ipif_zoneid, ipst);
13374                 if (err != 0) {
13375                         ip0dbg(("ipif_down: srcid_remove %d\n", err));
13376                 }
13377         }
13378 
13379         if (ipif_was_up) {
13380                 /* only delete if we'd added ire's before */
13381                 if (ipif->ipif_isv6)
13382                         ipif_delete_ires_v6(ipif);
13383                 else
13384                         ipif_delete_ires_v4(ipif);
13385         }
13386 
13387         if (ipif_was_up && ill->ill_ipif_up_count == 0) {
13388                 /*
13389                  * Since the interface is now down, it may have just become
13390                  * inactive.  Note that this needs to be done even for a
13391                  * lll_logical_down(), or ARP entries will not get correctly
13392                  * restored when the interface comes back up.
13393                  */
13394                 if (IS_UNDER_IPMP(ill))
13395                         ipmp_ill_refresh_active(ill);
13396         }
13397 
13398         /*
13399          * neighbor-discovery or arp entries for this interface. The ipif
13400          * has to be quiesced, so we walk all the nce's and delete those
13401          * that point at the ipif->ipif_ill. At the same time, we also
13402          * update IPMP so that ipifs for data addresses are unbound. We dont
13403          * call ipif_arp_down to DL_UNBIND the arp stream itself here, but defer
13404          * that for ipif_down_tail()
13405          */
13406         ipif_nce_down(ipif);
13407 
13408         /*
13409          * If this is the last ipif on the ill, we also need to remove
13410          * any IREs with ire_ill set. Otherwise ipif_is_quiescent() will
13411          * never succeed.
13412          */
13413         if (ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0)
13414                 ire_walk_ill(0, 0, ill_downi, ill, ill);
13415 
13416         /*
13417          * Walk all CONNs that can have a reference on an ire for this
13418          * ipif (we actually walk all that now have stale references).
13419          */
13420         ipcl_walk(conn_ixa_cleanup, (void *)B_TRUE, ipst);
13421 
13422         /*
13423          * If mp is NULL the caller will wait for the appropriate refcnt.
13424          * Eg. ip_sioctl_removeif -> ipif_free  -> ipif_down
13425          * and ill_delete -> ipif_free -> ipif_down
13426          */
13427         if (mp == NULL) {
13428                 ASSERT(q == NULL);
13429                 return (0);
13430         }
13431 
13432         if (CONN_Q(q)) {
13433                 connp = Q_TO_CONN(q);
13434                 mutex_enter(&connp->conn_lock);
13435         } else {
13436                 connp = NULL;
13437         }
13438         mutex_enter(&ill->ill_lock);
13439         /*
13440          * Are there any ire's pointing to this ipif that are still active ?
13441          * If this is the last ipif going down, are there any ire's pointing
13442          * to this ill that are still active ?
13443          */
13444         if (ipif_is_quiescent(ipif)) {
13445                 mutex_exit(&ill->ill_lock);
13446                 if (connp != NULL)
13447                         mutex_exit(&connp->conn_lock);
13448                 return (0);
13449         }
13450 
13451         ip1dbg(("ipif_down: need to wait, adding pending mp %s ill %p",
13452             ill->ill_name, (void *)ill));
13453         /*
13454          * Enqueue the mp atomically in ipsq_pending_mp. When the refcount
13455          * drops down, the operation will be restarted by ipif_ill_refrele_tail
13456          * which in turn is called by the last refrele on the ipif/ill/ire.
13457          */
13458         success = ipsq_pending_mp_add(connp, ipif, q, mp, IPIF_DOWN);
13459         if (!success) {
13460                 /* The conn is closing. So just return */
13461                 ASSERT(connp != NULL);
13462                 mutex_exit(&ill->ill_lock);
13463                 mutex_exit(&connp->conn_lock);
13464                 return (EINTR);
13465         }
13466 
13467         mutex_exit(&ill->ill_lock);
13468         if (connp != NULL)
13469                 mutex_exit(&connp->conn_lock);
13470         return (EINPROGRESS);
13471 }
13472 
13473 int
13474 ipif_down_tail(ipif_t *ipif)
13475 {
13476         ill_t   *ill = ipif->ipif_ill;
13477         int     err = 0;
13478 
13479         DTRACE_PROBE3(ipif__downup, char *, "ipif_down_tail",
13480             ill_t *, ill, ipif_t *, ipif);
13481 
13482         /*
13483          * Skip any loopback interface (null wq).
13484          * If this is the last logical interface on the ill
13485          * have ill_dl_down tell the driver we are gone (unbind)
13486          * Note that lun 0 can ipif_down even though
13487          * there are other logical units that are up.
13488          * This occurs e.g. when we change a "significant" IFF_ flag.
13489          */
13490         if (ill->ill_wq != NULL && !ill->ill_logical_down &&
13491             ill->ill_ipif_up_count == 0 && ill->ill_ipif_dup_count == 0 &&
13492             ill->ill_dl_up) {
13493                 ill_dl_down(ill);
13494         }
13495         if (!ipif->ipif_isv6)
13496                 err = ipif_arp_down(ipif);
13497 
13498         ill->ill_logical_down = 0;
13499 
13500         ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
13501         ip_rts_newaddrmsg(RTM_DELETE, 0, ipif, RTSQ_DEFAULT);
13502         return (err);
13503 }
13504 
13505 /*
13506  * Bring interface logically down without bringing the physical interface
13507  * down e.g. when the netmask is changed. This avoids long lasting link
13508  * negotiations between an ethernet interface and a certain switches.
13509  */
13510 static int
13511 ipif_logical_down(ipif_t *ipif, queue_t *q, mblk_t *mp)
13512 {
13513         DTRACE_PROBE3(ipif__downup, char *, "ipif_logical_down",
13514             ill_t *, ipif->ipif_ill, ipif_t *, ipif);
13515 
13516         /*
13517          * The ill_logical_down flag is a transient flag. It is set here
13518          * and is cleared once the down has completed in ipif_down_tail.
13519          * This flag does not indicate whether the ill stream is in the
13520          * DL_BOUND state with the driver. Instead this flag is used by
13521          * ipif_down_tail to determine whether to DL_UNBIND the stream with
13522          * the driver. The state of the ill stream i.e. whether it is
13523          * DL_BOUND with the driver or not is indicated by the ill_dl_up flag.
13524          */
13525         ipif->ipif_ill->ill_logical_down = 1;
13526         return (ipif_down(ipif, q, mp));
13527 }
13528 
13529 /*
13530  * Initiate deallocate of an IPIF. Always called as writer. Called by
13531  * ill_delete or ip_sioctl_removeif.
13532  */
13533 static void
13534 ipif_free(ipif_t *ipif)
13535 {
13536         ip_stack_t      *ipst = ipif->ipif_ill->ill_ipst;
13537 
13538         ASSERT(IAM_WRITER_IPIF(ipif));
13539 
13540         if (ipif->ipif_recovery_id != 0)
13541                 (void) untimeout(ipif->ipif_recovery_id);
13542         ipif->ipif_recovery_id = 0;
13543 
13544         /*
13545          * Take down the interface. We can be called either from ill_delete
13546          * or from ip_sioctl_removeif.
13547          */
13548         (void) ipif_down(ipif, NULL, NULL);
13549 
13550         /*
13551          * Now that the interface is down, there's no chance it can still
13552          * become a duplicate.  Cancel any timer that may have been set while
13553          * tearing down.
13554          */
13555         if (ipif->ipif_recovery_id != 0)
13556                 (void) untimeout(ipif->ipif_recovery_id);
13557         ipif->ipif_recovery_id = 0;
13558 
13559         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13560         /* Remove pointers to this ill in the multicast routing tables */
13561         reset_mrt_vif_ipif(ipif);
13562         /* If necessary, clear the cached source ipif rotor. */
13563         if (ipif->ipif_ill->ill_src_ipif == ipif)
13564                 ipif->ipif_ill->ill_src_ipif = NULL;
13565         rw_exit(&ipst->ips_ill_g_lock);
13566 }
13567 
13568 static void
13569 ipif_free_tail(ipif_t *ipif)
13570 {
13571         ip_stack_t *ipst = ipif->ipif_ill->ill_ipst;
13572 
13573         /*
13574          * Need to hold both ill_g_lock and ill_lock while
13575          * inserting or removing an ipif from the linked list
13576          * of ipifs hanging off the ill.
13577          */
13578         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
13579 
13580 #ifdef DEBUG
13581         ipif_trace_cleanup(ipif);
13582 #endif
13583 
13584         /* Ask SCTP to take it out of it list */
13585         sctp_update_ipif(ipif, SCTP_IPIF_REMOVE);
13586         ip_rts_newaddrmsg(RTM_FREEADDR, 0, ipif, RTSQ_DEFAULT);
13587 
13588         /* Get it out of the ILL interface list. */
13589         ipif_remove(ipif);
13590         rw_exit(&ipst->ips_ill_g_lock);
13591 
13592         ASSERT(!(ipif->ipif_flags & (IPIF_UP | IPIF_DUPLICATE)));
13593         ASSERT(ipif->ipif_recovery_id == 0);
13594         ASSERT(ipif->ipif_ire_local == NULL);
13595         ASSERT(ipif->ipif_ire_if == NULL);
13596 
13597         /* Free the memory. */
13598         mi_free(ipif);
13599 }
13600 
13601 /*
13602  * Sets `buf' to an ipif name of the form "ill_name:id", or "ill_name" if "id"
13603  * is zero.
13604  */
13605 void
13606 ipif_get_name(const ipif_t *ipif, char *buf, int len)
13607 {
13608         char    lbuf[LIFNAMSIZ];
13609         char    *name;
13610         size_t  name_len;
13611 
13612         buf[0] = '\0';
13613         name = ipif->ipif_ill->ill_name;
13614         name_len = ipif->ipif_ill->ill_name_length;
13615         if (ipif->ipif_id != 0) {
13616                 (void) sprintf(lbuf, "%s%c%d", name, IPIF_SEPARATOR_CHAR,
13617                     ipif->ipif_id);
13618                 name = lbuf;
13619                 name_len = mi_strlen(name) + 1;
13620         }
13621         len -= 1;
13622         buf[len] = '\0';
13623         len = MIN(len, name_len);
13624         bcopy(name, buf, len);
13625 }
13626 
13627 /*
13628  * Sets `buf' to an ill name.
13629  */
13630 void
13631 ill_get_name(const ill_t *ill, char *buf, int len)
13632 {
13633         char    *name;
13634         size_t  name_len;
13635 
13636         name = ill->ill_name;
13637         name_len = ill->ill_name_length;
13638         len -= 1;
13639         buf[len] = '\0';
13640         len = MIN(len, name_len);
13641         bcopy(name, buf, len);
13642 }
13643 
13644 /*
13645  * Find an IPIF based on the name passed in.  Names can be of the form <phys>
13646  * (e.g., le0) or <phys>:<#> (e.g., le0:1).  When there is no colon, the
13647  * implied unit id is zero. <phys> must correspond to the name of an ILL.
13648  * (May be called as writer.)
13649  */
13650 static ipif_t *
13651 ipif_lookup_on_name(char *name, size_t namelen, boolean_t do_alloc,
13652     boolean_t *exists, boolean_t isv6, zoneid_t zoneid, ip_stack_t *ipst)
13653 {
13654         char    *cp;
13655         char    *endp;
13656         long    id;
13657         ill_t   *ill;
13658         ipif_t  *ipif;
13659         uint_t  ire_type;
13660         boolean_t did_alloc = B_FALSE;
13661         char    last;
13662 
13663         /*
13664          * If the caller wants to us to create the ipif, make sure we have a
13665          * valid zoneid
13666          */
13667         ASSERT(!do_alloc || zoneid != ALL_ZONES);
13668 
13669         if (namelen == 0) {
13670                 return (NULL);
13671         }
13672 
13673         *exists = B_FALSE;
13674         /* Look for a colon in the name. */
13675         endp = &name[namelen];
13676         for (cp = endp; --cp > name; ) {
13677                 if (*cp == IPIF_SEPARATOR_CHAR)
13678                         break;
13679         }
13680 
13681         if (*cp == IPIF_SEPARATOR_CHAR) {
13682                 /*
13683                  * Reject any non-decimal aliases for logical
13684                  * interfaces. Aliases with leading zeroes
13685                  * are also rejected as they introduce ambiguity
13686                  * in the naming of the interfaces.
13687                  * In order to confirm with existing semantics,
13688                  * and to not break any programs/script relying
13689                  * on that behaviour, if<0>:0 is considered to be
13690                  * a valid interface.
13691                  *
13692                  * If alias has two or more digits and the first
13693                  * is zero, fail.
13694                  */
13695                 if (&cp[2] < endp && cp[1] == '0') {
13696                         return (NULL);
13697                 }
13698         }
13699 
13700         if (cp <= name) {
13701                 cp = endp;
13702         }
13703         last = *cp;
13704         *cp = '\0';
13705 
13706         /*
13707          * Look up the ILL, based on the portion of the name
13708          * before the slash. ill_lookup_on_name returns a held ill.
13709          * Temporary to check whether ill exists already. If so
13710          * ill_lookup_on_name will clear it.
13711          */
13712         ill = ill_lookup_on_name(name, do_alloc, isv6,
13713             &did_alloc, ipst);
13714         *cp = last;
13715         if (ill == NULL)
13716                 return (NULL);
13717 
13718         /* Establish the unit number in the name. */
13719         id = 0;
13720         if (cp < endp && *endp == '\0') {
13721                 /* If there was a colon, the unit number follows. */
13722                 cp++;
13723                 if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13724                         ill_refrele(ill);
13725                         return (NULL);
13726                 }
13727         }
13728 
13729         mutex_enter(&ill->ill_lock);
13730         /* Now see if there is an IPIF with this unit number. */
13731         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13732                 if (ipif->ipif_id == id) {
13733                         if (zoneid != ALL_ZONES &&
13734                             zoneid != ipif->ipif_zoneid &&
13735                             ipif->ipif_zoneid != ALL_ZONES) {
13736                                 mutex_exit(&ill->ill_lock);
13737                                 ill_refrele(ill);
13738                                 return (NULL);
13739                         }
13740                         if (IPIF_CAN_LOOKUP(ipif)) {
13741                                 ipif_refhold_locked(ipif);
13742                                 mutex_exit(&ill->ill_lock);
13743                                 if (!did_alloc)
13744                                         *exists = B_TRUE;
13745                                 /*
13746                                  * Drop locks before calling ill_refrele
13747                                  * since it can potentially call into
13748                                  * ipif_ill_refrele_tail which can end up
13749                                  * in trying to acquire any lock.
13750                                  */
13751                                 ill_refrele(ill);
13752                                 return (ipif);
13753                         }
13754                 }
13755         }
13756 
13757         if (!do_alloc) {
13758                 mutex_exit(&ill->ill_lock);
13759                 ill_refrele(ill);
13760                 return (NULL);
13761         }
13762 
13763         /*
13764          * If none found, atomically allocate and return a new one.
13765          * Historically, we used IRE_LOOPBACK only for lun 0, and IRE_LOCAL
13766          * to support "receive only" use of lo0:1 etc. as is still done
13767          * below as an initial guess.
13768          * However, this is now likely to be overriden later in ipif_up_done()
13769          * when we know for sure what address has been configured on the
13770          * interface, since we might have more than one loopback interface
13771          * with a loopback address, e.g. in the case of zones, and all the
13772          * interfaces with loopback addresses need to be marked IRE_LOOPBACK.
13773          */
13774         if (ill->ill_net_type == IRE_LOOPBACK && id == 0)
13775                 ire_type = IRE_LOOPBACK;
13776         else
13777                 ire_type = IRE_LOCAL;
13778         ipif = ipif_allocate(ill, id, ire_type, B_TRUE, B_TRUE, NULL);
13779         if (ipif != NULL)
13780                 ipif_refhold_locked(ipif);
13781         mutex_exit(&ill->ill_lock);
13782         ill_refrele(ill);
13783         return (ipif);
13784 }
13785 
13786 /*
13787  * Variant of the above that queues the request on the ipsq when
13788  * IPIF_CHANGING is set.
13789  */
13790 static ipif_t *
13791 ipif_lookup_on_name_async(char *name, size_t namelen, boolean_t isv6,
13792     zoneid_t zoneid, queue_t *q, mblk_t *mp, ipsq_func_t func, int *error,
13793     ip_stack_t *ipst)
13794 {
13795         char    *cp;
13796         char    *endp;
13797         long    id;
13798         ill_t   *ill;
13799         ipif_t  *ipif;
13800         boolean_t did_alloc = B_FALSE;
13801         ipsq_t  *ipsq;
13802 
13803         if (error != NULL)
13804                 *error = 0;
13805 
13806         if (namelen == 0) {
13807                 if (error != NULL)
13808                         *error = ENXIO;
13809                 return (NULL);
13810         }
13811 
13812         /* Look for a colon in the name. */
13813         endp = &name[namelen];
13814         for (cp = endp; --cp > name; ) {
13815                 if (*cp == IPIF_SEPARATOR_CHAR)
13816                         break;
13817         }
13818 
13819         if (*cp == IPIF_SEPARATOR_CHAR) {
13820                 /*
13821                  * Reject any non-decimal aliases for logical
13822                  * interfaces. Aliases with leading zeroes
13823                  * are also rejected as they introduce ambiguity
13824                  * in the naming of the interfaces.
13825                  * In order to confirm with existing semantics,
13826                  * and to not break any programs/script relying
13827                  * on that behaviour, if<0>:0 is considered to be
13828                  * a valid interface.
13829                  *
13830                  * If alias has two or more digits and the first
13831                  * is zero, fail.
13832                  */
13833                 if (&cp[2] < endp && cp[1] == '0') {
13834                         if (error != NULL)
13835                                 *error = EINVAL;
13836                         return (NULL);
13837                 }
13838         }
13839 
13840         if (cp <= name) {
13841                 cp = endp;
13842         } else {
13843                 *cp = '\0';
13844         }
13845 
13846         /*
13847          * Look up the ILL, based on the portion of the name
13848          * before the slash. ill_lookup_on_name returns a held ill.
13849          * Temporary to check whether ill exists already. If so
13850          * ill_lookup_on_name will clear it.
13851          */
13852         ill = ill_lookup_on_name(name, B_FALSE, isv6, &did_alloc, ipst);
13853         if (cp != endp)
13854                 *cp = IPIF_SEPARATOR_CHAR;
13855         if (ill == NULL)
13856                 return (NULL);
13857 
13858         /* Establish the unit number in the name. */
13859         id = 0;
13860         if (cp < endp && *endp == '\0') {
13861                 /* If there was a colon, the unit number follows. */
13862                 cp++;
13863                 if (ddi_strtol(cp, NULL, 0, &id) != 0) {
13864                         ill_refrele(ill);
13865                         if (error != NULL)
13866                                 *error = ENXIO;
13867                         return (NULL);
13868                 }
13869         }
13870 
13871         GRAB_CONN_LOCK(q);
13872         mutex_enter(&ill->ill_lock);
13873         /* Now see if there is an IPIF with this unit number. */
13874         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
13875                 if (ipif->ipif_id == id) {
13876                         if (zoneid != ALL_ZONES &&
13877                             zoneid != ipif->ipif_zoneid &&
13878                             ipif->ipif_zoneid != ALL_ZONES) {
13879                                 mutex_exit(&ill->ill_lock);
13880                                 RELEASE_CONN_LOCK(q);
13881                                 ill_refrele(ill);
13882                                 if (error != NULL)
13883                                         *error = ENXIO;
13884                                 return (NULL);
13885                         }
13886 
13887                         if (!(IPIF_IS_CHANGING(ipif) ||
13888                             IPIF_IS_CONDEMNED(ipif)) ||
13889                             IAM_WRITER_IPIF(ipif)) {
13890                                 ipif_refhold_locked(ipif);
13891                                 mutex_exit(&ill->ill_lock);
13892                                 /*
13893                                  * Drop locks before calling ill_refrele
13894                                  * since it can potentially call into
13895                                  * ipif_ill_refrele_tail which can end up
13896                                  * in trying to acquire any lock.
13897                                  */
13898                                 RELEASE_CONN_LOCK(q);
13899                                 ill_refrele(ill);
13900                                 return (ipif);
13901                         } else if (q != NULL && !IPIF_IS_CONDEMNED(ipif)) {
13902                                 ipsq = ill->ill_phyint->phyint_ipsq;
13903                                 mutex_enter(&ipsq->ipsq_lock);
13904                                 mutex_enter(&ipsq->ipsq_xop->ipx_lock);
13905                                 mutex_exit(&ill->ill_lock);
13906                                 ipsq_enq(ipsq, q, mp, func, NEW_OP, ill);
13907                                 mutex_exit(&ipsq->ipsq_xop->ipx_lock);
13908                                 mutex_exit(&ipsq->ipsq_lock);
13909                                 RELEASE_CONN_LOCK(q);
13910                                 ill_refrele(ill);
13911                                 if (error != NULL)
13912                                         *error = EINPROGRESS;
13913                                 return (NULL);
13914                         }
13915                 }
13916         }
13917         RELEASE_CONN_LOCK(q);
13918         mutex_exit(&ill->ill_lock);
13919         ill_refrele(ill);
13920         if (error != NULL)
13921                 *error = ENXIO;
13922         return (NULL);
13923 }
13924 
13925 /*
13926  * This routine is called whenever a new address comes up on an ipif.  If
13927  * we are configured to respond to address mask requests, then we are supposed
13928  * to broadcast an address mask reply at this time.  This routine is also
13929  * called if we are already up, but a netmask change is made.  This is legal
13930  * but might not make the system manager very popular.  (May be called
13931  * as writer.)
13932  */
13933 void
13934 ipif_mask_reply(ipif_t *ipif)
13935 {
13936         icmph_t *icmph;
13937         ipha_t  *ipha;
13938         mblk_t  *mp;
13939         ip_stack_t      *ipst = ipif->ipif_ill->ill_ipst;
13940         ip_xmit_attr_t ixas;
13941 
13942 #define REPLY_LEN       (sizeof (icmp_ipha) + sizeof (icmph_t) + IP_ADDR_LEN)
13943 
13944         if (!ipst->ips_ip_respond_to_address_mask_broadcast)
13945                 return;
13946 
13947         /* ICMP mask reply is IPv4 only */
13948         ASSERT(!ipif->ipif_isv6);
13949         /* ICMP mask reply is not for a loopback interface */
13950         ASSERT(ipif->ipif_ill->ill_wq != NULL);
13951 
13952         if (ipif->ipif_lcl_addr == INADDR_ANY)
13953                 return;
13954 
13955         mp = allocb(REPLY_LEN, BPRI_HI);
13956         if (mp == NULL)
13957                 return;
13958         mp->b_wptr = mp->b_rptr + REPLY_LEN;
13959 
13960         ipha = (ipha_t *)mp->b_rptr;
13961         bzero(ipha, REPLY_LEN);
13962         *ipha = icmp_ipha;
13963         ipha->ipha_ttl = ipst->ips_ip_broadcast_ttl;
13964         ipha->ipha_src = ipif->ipif_lcl_addr;
13965         ipha->ipha_dst = ipif->ipif_brd_addr;
13966         ipha->ipha_length = htons(REPLY_LEN);
13967         ipha->ipha_ident = 0;
13968 
13969         icmph = (icmph_t *)&ipha[1];
13970         icmph->icmph_type = ICMP_ADDRESS_MASK_REPLY;
13971         bcopy(&ipif->ipif_net_mask, &icmph[1], IP_ADDR_LEN);
13972         icmph->icmph_checksum = IP_CSUM(mp, sizeof (ipha_t), 0);
13973 
13974         bzero(&ixas, sizeof (ixas));
13975         ixas.ixa_flags = IXAF_BASIC_SIMPLE_V4;
13976         ixas.ixa_zoneid = ALL_ZONES;
13977         ixas.ixa_ifindex = 0;
13978         ixas.ixa_ipst = ipst;
13979         ixas.ixa_multicast_ttl = IP_DEFAULT_MULTICAST_TTL;
13980         (void) ip_output_simple(mp, &ixas);
13981         ixa_cleanup(&ixas);
13982 #undef  REPLY_LEN
13983 }
13984 
13985 /*
13986  * Join the ipif specific multicast groups.
13987  * Must be called after a mapping has been set up in the resolver.  (Always
13988  * called as writer.)
13989  */
13990 void
13991 ipif_multicast_up(ipif_t *ipif)
13992 {
13993         int err;
13994         ill_t *ill;
13995         ilm_t *ilm;
13996 
13997         ASSERT(IAM_WRITER_IPIF(ipif));
13998 
13999         ill = ipif->ipif_ill;
14000 
14001         ip1dbg(("ipif_multicast_up\n"));
14002         if (!(ill->ill_flags & ILLF_MULTICAST) ||
14003             ipif->ipif_allhosts_ilm != NULL)
14004                 return;
14005 
14006         if (ipif->ipif_isv6) {
14007                 in6_addr_t v6allmc = ipv6_all_hosts_mcast;
14008                 in6_addr_t v6solmc = ipv6_solicited_node_mcast;
14009 
14010                 v6solmc.s6_addr32[3] |= ipif->ipif_v6lcl_addr.s6_addr32[3];
14011 
14012                 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr))
14013                         return;
14014 
14015                 ip1dbg(("ipif_multicast_up - addmulti\n"));
14016 
14017                 /*
14018                  * Join the all hosts multicast address.  We skip this for
14019                  * underlying IPMP interfaces since they should be invisible.
14020                  */
14021                 if (!IS_UNDER_IPMP(ill)) {
14022                         ilm = ip_addmulti(&v6allmc, ill, ipif->ipif_zoneid,
14023                             &err);
14024                         if (ilm == NULL) {
14025                                 ASSERT(err != 0);
14026                                 ip0dbg(("ipif_multicast_up: "
14027                                     "all_hosts_mcast failed %d\n", err));
14028                                 return;
14029                         }
14030                         ipif->ipif_allhosts_ilm = ilm;
14031                 }
14032 
14033                 /*
14034                  * Enable multicast for the solicited node multicast address.
14035                  * If IPMP we need to put the membership on the upper ill.
14036                  */
14037                 if (!(ipif->ipif_flags & IPIF_NOLOCAL)) {
14038                         ill_t *mcast_ill = NULL;
14039                         boolean_t need_refrele;
14040 
14041                         if (IS_UNDER_IPMP(ill) &&
14042                             (mcast_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL) {
14043                                 need_refrele = B_TRUE;
14044                         } else {
14045                                 mcast_ill = ill;
14046                                 need_refrele = B_FALSE;
14047                         }
14048 
14049                         ilm = ip_addmulti(&v6solmc, mcast_ill,
14050                             ipif->ipif_zoneid, &err);
14051                         if (need_refrele)
14052                                 ill_refrele(mcast_ill);
14053 
14054                         if (ilm == NULL) {
14055                                 ASSERT(err != 0);
14056                                 ip0dbg(("ipif_multicast_up: solicited MC"
14057                                     " failed %d\n", err));
14058                                 if ((ilm = ipif->ipif_allhosts_ilm) != NULL) {
14059                                         ipif->ipif_allhosts_ilm = NULL;
14060                                         (void) ip_delmulti(ilm);
14061                                 }
14062                                 return;
14063                         }
14064                         ipif->ipif_solmulti_ilm = ilm;
14065                 }
14066         } else {
14067                 in6_addr_t v6group;
14068 
14069                 if (ipif->ipif_lcl_addr == INADDR_ANY || IS_UNDER_IPMP(ill))
14070                         return;
14071 
14072                 /* Join the all hosts multicast address */
14073                 ip1dbg(("ipif_multicast_up - addmulti\n"));
14074                 IN6_IPADDR_TO_V4MAPPED(htonl(INADDR_ALLHOSTS_GROUP), &v6group);
14075 
14076                 ilm = ip_addmulti(&v6group, ill, ipif->ipif_zoneid, &err);
14077                 if (ilm == NULL) {
14078                         ASSERT(err != 0);
14079                         ip0dbg(("ipif_multicast_up: failed %d\n", err));
14080                         return;
14081                 }
14082                 ipif->ipif_allhosts_ilm = ilm;
14083         }
14084 }
14085 
14086 /*
14087  * Blow away any multicast groups that we joined in ipif_multicast_up().
14088  * (ilms from explicit memberships are handled in conn_update_ill.)
14089  */
14090 void
14091 ipif_multicast_down(ipif_t *ipif)
14092 {
14093         ASSERT(IAM_WRITER_IPIF(ipif));
14094 
14095         ip1dbg(("ipif_multicast_down\n"));
14096 
14097         if (ipif->ipif_allhosts_ilm != NULL) {
14098                 (void) ip_delmulti(ipif->ipif_allhosts_ilm);
14099                 ipif->ipif_allhosts_ilm = NULL;
14100         }
14101         if (ipif->ipif_solmulti_ilm != NULL) {
14102                 (void) ip_delmulti(ipif->ipif_solmulti_ilm);
14103                 ipif->ipif_solmulti_ilm = NULL;
14104         }
14105 }
14106 
14107 /*
14108  * Used when an interface comes up to recreate any extra routes on this
14109  * interface.
14110  */
14111 int
14112 ill_recover_saved_ire(ill_t *ill)
14113 {
14114         mblk_t          *mp;
14115         ip_stack_t      *ipst = ill->ill_ipst;
14116 
14117         ip1dbg(("ill_recover_saved_ire(%s)", ill->ill_name));
14118 
14119         mutex_enter(&ill->ill_saved_ire_lock);
14120         for (mp = ill->ill_saved_ire_mp; mp != NULL; mp = mp->b_cont) {
14121                 ire_t           *ire, *nire;
14122                 ifrt_t          *ifrt;
14123 
14124                 ifrt = (ifrt_t *)mp->b_rptr;
14125                 /*
14126                  * Create a copy of the IRE with the saved address and netmask.
14127                  */
14128                 if (ill->ill_isv6) {
14129                         ire = ire_create_v6(
14130                             &ifrt->ifrt_v6addr,
14131                             &ifrt->ifrt_v6mask,
14132                             &ifrt->ifrt_v6gateway_addr,
14133                             ifrt->ifrt_type,
14134                             ill,
14135                             ifrt->ifrt_zoneid,
14136                             ifrt->ifrt_flags,
14137                             NULL,
14138                             ipst);
14139                 } else {
14140                         ire = ire_create(
14141                             (uint8_t *)&ifrt->ifrt_addr,
14142                             (uint8_t *)&ifrt->ifrt_mask,
14143                             (uint8_t *)&ifrt->ifrt_gateway_addr,
14144                             ifrt->ifrt_type,
14145                             ill,
14146                             ifrt->ifrt_zoneid,
14147                             ifrt->ifrt_flags,
14148                             NULL,
14149                             ipst);
14150                 }
14151                 if (ire == NULL) {
14152                         mutex_exit(&ill->ill_saved_ire_lock);
14153                         return (ENOMEM);
14154                 }
14155 
14156                 if (ifrt->ifrt_flags & RTF_SETSRC) {
14157                         if (ill->ill_isv6) {
14158                                 ire->ire_setsrc_addr_v6 =
14159                                     ifrt->ifrt_v6setsrc_addr;
14160                         } else {
14161                                 ire->ire_setsrc_addr = ifrt->ifrt_setsrc_addr;
14162                         }
14163                 }
14164 
14165                 /*
14166                  * Some software (for example, GateD and Sun Cluster) attempts
14167                  * to create (what amount to) IRE_PREFIX routes with the
14168                  * loopback address as the gateway.  This is primarily done to
14169                  * set up prefixes with the RTF_REJECT flag set (for example,
14170                  * when generating aggregate routes.)
14171                  *
14172                  * If the IRE type (as defined by ill->ill_net_type) is
14173                  * IRE_LOOPBACK, then we map the request into a
14174                  * IRE_IF_NORESOLVER.
14175                  */
14176                 if (ill->ill_net_type == IRE_LOOPBACK)
14177                         ire->ire_type = IRE_IF_NORESOLVER;
14178 
14179                 /*
14180                  * ire held by ire_add, will be refreled' towards the
14181                  * the end of ipif_up_done
14182                  */
14183                 nire = ire_add(ire);
14184                 /*
14185                  * Check if it was a duplicate entry. This handles
14186                  * the case of two racing route adds for the same route
14187                  */
14188                 if (nire == NULL) {
14189                         ip1dbg(("ill_recover_saved_ire: FAILED\n"));
14190                 } else if (nire != ire) {
14191                         ip1dbg(("ill_recover_saved_ire: duplicate ire %p\n",
14192                             (void *)nire));
14193                         ire_delete(nire);
14194                 } else {
14195                         ip1dbg(("ill_recover_saved_ire: added ire %p\n",
14196                             (void *)nire));
14197                 }
14198                 if (nire != NULL)
14199                         ire_refrele(nire);
14200         }
14201         mutex_exit(&ill->ill_saved_ire_lock);
14202         return (0);
14203 }
14204 
14205 /*
14206  * Used to set the netmask and broadcast address to default values when the
14207  * interface is brought up.  (Always called as writer.)
14208  */
14209 static void
14210 ipif_set_default(ipif_t *ipif)
14211 {
14212         ASSERT(MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14213 
14214         if (!ipif->ipif_isv6) {
14215                 /*
14216                  * Interface holds an IPv4 address. Default
14217                  * mask is the natural netmask.
14218                  */
14219                 if (!ipif->ipif_net_mask) {
14220                         ipaddr_t        v4mask;
14221 
14222                         v4mask = ip_net_mask(ipif->ipif_lcl_addr);
14223                         V4MASK_TO_V6(v4mask, ipif->ipif_v6net_mask);
14224                 }
14225                 if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14226                         /* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14227                         ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14228                 } else {
14229                         V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14230                             ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14231                 }
14232                 /*
14233                  * NOTE: SunOS 4.X does this even if the broadcast address
14234                  * has been already set thus we do the same here.
14235                  */
14236                 if (ipif->ipif_flags & IPIF_BROADCAST) {
14237                         ipaddr_t        v4addr;
14238 
14239                         v4addr = ipif->ipif_subnet | ~ipif->ipif_net_mask;
14240                         IN6_IPADDR_TO_V4MAPPED(v4addr, &ipif->ipif_v6brd_addr);
14241                 }
14242         } else {
14243                 /*
14244                  * Interface holds an IPv6-only address.  Default
14245                  * mask is all-ones.
14246                  */
14247                 if (IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6net_mask))
14248                         ipif->ipif_v6net_mask = ipv6_all_ones;
14249                 if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14250                         /* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14251                         ipif->ipif_v6subnet = ipif->ipif_v6pp_dst_addr;
14252                 } else {
14253                         V6_MASK_COPY(ipif->ipif_v6lcl_addr,
14254                             ipif->ipif_v6net_mask, ipif->ipif_v6subnet);
14255                 }
14256         }
14257 }
14258 
14259 /*
14260  * Return 0 if this address can be used as local address without causing
14261  * duplicate address problems. Otherwise, return EADDRNOTAVAIL if the address
14262  * is already up on a different ill, and EADDRINUSE if it's up on the same ill.
14263  * Note that the same IPv6 link-local address is allowed as long as the ills
14264  * are not on the same link.
14265  */
14266 int
14267 ip_addr_availability_check(ipif_t *new_ipif)
14268 {
14269         in6_addr_t our_v6addr;
14270         ill_t *ill;
14271         ipif_t *ipif;
14272         ill_walk_context_t ctx;
14273         ip_stack_t      *ipst = new_ipif->ipif_ill->ill_ipst;
14274 
14275         ASSERT(IAM_WRITER_IPIF(new_ipif));
14276         ASSERT(MUTEX_HELD(&ipst->ips_ip_addr_avail_lock));
14277         ASSERT(RW_READ_HELD(&ipst->ips_ill_g_lock));
14278 
14279         new_ipif->ipif_flags &= ~IPIF_UNNUMBERED;
14280         if (IN6_IS_ADDR_UNSPECIFIED(&new_ipif->ipif_v6lcl_addr) ||
14281             IN6_IS_ADDR_V4MAPPED_ANY(&new_ipif->ipif_v6lcl_addr))
14282                 return (0);
14283 
14284         our_v6addr = new_ipif->ipif_v6lcl_addr;
14285 
14286         if (new_ipif->ipif_isv6)
14287                 ill = ILL_START_WALK_V6(&ctx, ipst);
14288         else
14289                 ill = ILL_START_WALK_V4(&ctx, ipst);
14290 
14291         for (; ill != NULL; ill = ill_next(&ctx, ill)) {
14292                 for (ipif = ill->ill_ipif; ipif != NULL;
14293                     ipif = ipif->ipif_next) {
14294                         if ((ipif == new_ipif) ||
14295                             !(ipif->ipif_flags & IPIF_UP) ||
14296                             (ipif->ipif_flags & IPIF_UNNUMBERED) ||
14297                             !IN6_ARE_ADDR_EQUAL(&ipif->ipif_v6lcl_addr,
14298                             &our_v6addr))
14299                                 continue;
14300 
14301                         if (new_ipif->ipif_flags & IPIF_POINTOPOINT)
14302                                 new_ipif->ipif_flags |= IPIF_UNNUMBERED;
14303                         else if (ipif->ipif_flags & IPIF_POINTOPOINT)
14304                                 ipif->ipif_flags |= IPIF_UNNUMBERED;
14305                         else if ((IN6_IS_ADDR_LINKLOCAL(&our_v6addr) ||
14306                             IN6_IS_ADDR_SITELOCAL(&our_v6addr)) &&
14307                             !IS_ON_SAME_LAN(ill, new_ipif->ipif_ill))
14308                                 continue;
14309                         else if (new_ipif->ipif_zoneid != ipif->ipif_zoneid &&
14310                             ipif->ipif_zoneid != ALL_ZONES && IS_LOOPBACK(ill))
14311                                 continue;
14312                         else if (new_ipif->ipif_ill == ill)
14313                                 return (EADDRINUSE);
14314                         else
14315                                 return (EADDRNOTAVAIL);
14316                 }
14317         }
14318 
14319         return (0);
14320 }
14321 
14322 /*
14323  * Bring up an ipif: bring up arp/ndp, bring up the DLPI stream, and add
14324  * IREs for the ipif.
14325  * When the routine returns EINPROGRESS then mp has been consumed and
14326  * the ioctl will be acked from ip_rput_dlpi.
14327  */
14328 int
14329 ipif_up(ipif_t *ipif, queue_t *q, mblk_t *mp)
14330 {
14331         ill_t           *ill = ipif->ipif_ill;
14332         boolean_t       isv6 = ipif->ipif_isv6;
14333         int             err = 0;
14334         boolean_t       success;
14335         uint_t          ipif_orig_id;
14336         ip_stack_t      *ipst = ill->ill_ipst;
14337 
14338         ASSERT(IAM_WRITER_IPIF(ipif));
14339 
14340         ip1dbg(("ipif_up(%s:%u)\n", ill->ill_name, ipif->ipif_id));
14341         DTRACE_PROBE3(ipif__downup, char *, "ipif_up",
14342             ill_t *, ill, ipif_t *, ipif);
14343 
14344         /* Shouldn't get here if it is already up. */
14345         if (ipif->ipif_flags & IPIF_UP)
14346                 return (EALREADY);
14347 
14348         /*
14349          * If this is a request to bring up a data address on an interface
14350          * under IPMP, then move the address to its IPMP meta-interface and
14351          * try to bring it up.  One complication is that the zeroth ipif for
14352          * an ill is special, in that every ill always has one, and that code
14353          * throughout IP deferences ill->ill_ipif without holding any locks.
14354          */
14355         if (IS_UNDER_IPMP(ill) && ipmp_ipif_is_dataaddr(ipif) &&
14356             (!ipif->ipif_isv6 || !V6_IPIF_LINKLOCAL(ipif))) {
14357                 ipif_t  *stubipif = NULL, *moveipif = NULL;
14358                 ill_t   *ipmp_ill = ipmp_illgrp_ipmp_ill(ill->ill_grp);
14359 
14360                 /*
14361                  * The ipif being brought up should be quiesced.  If it's not,
14362                  * something has gone amiss and we need to bail out.  (If it's
14363                  * quiesced, we know it will remain so via IPIF_CONDEMNED.)
14364                  */
14365                 mutex_enter(&ill->ill_lock);
14366                 if (!ipif_is_quiescent(ipif)) {
14367                         mutex_exit(&ill->ill_lock);
14368                         return (EINVAL);
14369                 }
14370                 mutex_exit(&ill->ill_lock);
14371 
14372                 /*
14373                  * If we're going to need to allocate ipifs, do it prior
14374                  * to starting the move (and grabbing locks).
14375                  */
14376                 if (ipif->ipif_id == 0) {
14377                         if ((moveipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14378                             B_FALSE, &err)) == NULL) {
14379                                 return (err);
14380                         }
14381                         if ((stubipif = ipif_allocate(ill, 0, IRE_LOCAL, B_TRUE,
14382                             B_FALSE, &err)) == NULL) {
14383                                 mi_free(moveipif);
14384                                 return (err);
14385                         }
14386                 }
14387 
14388                 /*
14389                  * Grab or transfer the ipif to move.  During the move, keep
14390                  * ill_g_lock held to prevent any ill walker threads from
14391                  * seeing things in an inconsistent state.
14392                  */
14393                 rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
14394                 if (ipif->ipif_id != 0) {
14395                         ipif_remove(ipif);
14396                 } else {
14397                         ipif_transfer(ipif, moveipif, stubipif);
14398                         ipif = moveipif;
14399                 }
14400 
14401                 /*
14402                  * Place the ipif on the IPMP ill.  If the zeroth ipif on
14403                  * the IPMP ill is a stub (0.0.0.0 down address) then we
14404                  * replace that one.  Otherwise, pick the next available slot.
14405                  */
14406                 ipif->ipif_ill = ipmp_ill;
14407                 ipif_orig_id = ipif->ipif_id;
14408 
14409                 if (ipmp_ipif_is_stubaddr(ipmp_ill->ill_ipif)) {
14410                         ipif_transfer(ipif, ipmp_ill->ill_ipif, NULL);
14411                         ipif = ipmp_ill->ill_ipif;
14412                 } else {
14413                         ipif->ipif_id = -1;
14414                         if ((err = ipif_insert(ipif, B_FALSE)) != 0) {
14415                                 /*
14416                                  * No more available ipif_id's -- put it back
14417                                  * on the original ill and fail the operation.
14418                                  * Since we're writer on the ill, we can be
14419                                  * sure our old slot is still available.
14420                                  */
14421                                 ipif->ipif_id = ipif_orig_id;
14422                                 ipif->ipif_ill = ill;
14423                                 if (ipif_orig_id == 0) {
14424                                         ipif_transfer(ipif, ill->ill_ipif,
14425                                             NULL);
14426                                 } else {
14427                                         VERIFY(ipif_insert(ipif, B_FALSE) == 0);
14428                                 }
14429                                 rw_exit(&ipst->ips_ill_g_lock);
14430                                 return (err);
14431                         }
14432                 }
14433                 rw_exit(&ipst->ips_ill_g_lock);
14434 
14435                 /*
14436                  * Tell SCTP that the ipif has moved.  Note that even if we
14437                  * had to allocate a new ipif, the original sequence id was
14438                  * preserved and therefore SCTP won't know.
14439                  */
14440                 sctp_move_ipif(ipif, ill, ipmp_ill);
14441 
14442                 /*
14443                  * If the ipif being brought up was on slot zero, then we
14444                  * first need to bring up the placeholder we stuck there.  In
14445                  * ip_rput_dlpi_writer(), arp_bringup_done(), or the recursive
14446                  * call to ipif_up() itself, if we successfully bring up the
14447                  * placeholder, we'll check ill_move_ipif and bring it up too.
14448                  */
14449                 if (ipif_orig_id == 0) {
14450                         ASSERT(ill->ill_move_ipif == NULL);
14451                         ill->ill_move_ipif = ipif;
14452                         if ((err = ipif_up(ill->ill_ipif, q, mp)) == 0)
14453                                 ASSERT(ill->ill_move_ipif == NULL);
14454                         if (err != EINPROGRESS)
14455                                 ill->ill_move_ipif = NULL;
14456                         return (err);
14457                 }
14458 
14459                 /*
14460                  * Bring it up on the IPMP ill.
14461                  */
14462                 return (ipif_up(ipif, q, mp));
14463         }
14464 
14465         /* Skip arp/ndp for any loopback interface. */
14466         if (ill->ill_wq != NULL) {
14467                 conn_t *connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14468                 ipsq_t  *ipsq = ill->ill_phyint->phyint_ipsq;
14469 
14470                 if (!ill->ill_dl_up) {
14471                         /*
14472                          * ill_dl_up is not yet set. i.e. we are yet to
14473                          * DL_BIND with the driver and this is the first
14474                          * logical interface on the ill to become "up".
14475                          * Tell the driver to get going (via DL_BIND_REQ).
14476                          * Note that changing "significant" IFF_ flags
14477                          * address/netmask etc cause a down/up dance, but
14478                          * does not cause an unbind (DL_UNBIND) with the driver
14479                          */
14480                         return (ill_dl_up(ill, ipif, mp, q));
14481                 }
14482 
14483                 /*
14484                  * ipif_resolver_up may end up needeing to bind/attach
14485                  * the ARP stream, which in turn necessitates a
14486                  * DLPI message exchange with the driver. ioctls are
14487                  * serialized and so we cannot send more than one
14488                  * interface up message at a time. If ipif_resolver_up
14489                  * does need to wait for the DLPI handshake for the ARP stream,
14490                  * we get EINPROGRESS and we will complete in arp_bringup_done.
14491                  */
14492 
14493                 ASSERT(connp != NULL || !CONN_Q(q));
14494                 if (connp != NULL)
14495                         mutex_enter(&connp->conn_lock);
14496                 mutex_enter(&ill->ill_lock);
14497                 success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14498                 mutex_exit(&ill->ill_lock);
14499                 if (connp != NULL)
14500                         mutex_exit(&connp->conn_lock);
14501                 if (!success)
14502                         return (EINTR);
14503 
14504                 /*
14505                  * Crank up IPv6 neighbor discovery. Unlike ARP, this should
14506                  * complete when ipif_ndp_up returns.
14507                  */
14508                 err = ipif_resolver_up(ipif, Res_act_initial);
14509                 if (err == EINPROGRESS) {
14510                         /* We will complete it in arp_bringup_done() */
14511                         return (err);
14512                 }
14513 
14514                 if (isv6 && err == 0)
14515                         err = ipif_ndp_up(ipif, B_TRUE);
14516 
14517                 ASSERT(err != EINPROGRESS);
14518                 mp = ipsq_pending_mp_get(ipsq, &connp);
14519                 ASSERT(mp != NULL);
14520                 if (err != 0)
14521                         return (err);
14522         } else {
14523                 /*
14524                  * Interfaces without underlying hardware don't do duplicate
14525                  * address detection.
14526                  */
14527                 ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
14528                 ipif->ipif_addr_ready = 1;
14529                 err = ill_add_ires(ill);
14530                 /* allocation failure? */
14531                 if (err != 0)
14532                         return (err);
14533         }
14534 
14535         err = (isv6 ? ipif_up_done_v6(ipif) : ipif_up_done(ipif));
14536         if (err == 0 && ill->ill_move_ipif != NULL) {
14537                 ipif = ill->ill_move_ipif;
14538                 ill->ill_move_ipif = NULL;
14539                 return (ipif_up(ipif, q, mp));
14540         }
14541         return (err);
14542 }
14543 
14544 /*
14545  * Add any IREs tied to the ill. For now this is just an IRE_MULTICAST.
14546  * The identical set of IREs need to be removed in ill_delete_ires().
14547  */
14548 int
14549 ill_add_ires(ill_t *ill)
14550 {
14551         ire_t   *ire;
14552         in6_addr_t dummy6 = {(uint32_t)V6_MCAST, 0, 0, 1};
14553         in_addr_t dummy4 = htonl(INADDR_ALLHOSTS_GROUP);
14554 
14555         if (ill->ill_ire_multicast != NULL)
14556                 return (0);
14557 
14558         /*
14559          * provide some dummy ire_addr for creating the ire.
14560          */
14561         if (ill->ill_isv6) {
14562                 ire = ire_create_v6(&dummy6, 0, 0, IRE_MULTICAST, ill,
14563                     ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14564         } else {
14565                 ire = ire_create((uchar_t *)&dummy4, 0, 0, IRE_MULTICAST, ill,
14566                     ALL_ZONES, RTF_UP, NULL, ill->ill_ipst);
14567         }
14568         if (ire == NULL)
14569                 return (ENOMEM);
14570 
14571         ill->ill_ire_multicast = ire;
14572         return (0);
14573 }
14574 
14575 void
14576 ill_delete_ires(ill_t *ill)
14577 {
14578         if (ill->ill_ire_multicast != NULL) {
14579                 /*
14580                  * BIND/ATTACH completed; Release the ref for ill_ire_multicast
14581                  * which was taken without any th_tracing enabled.
14582                  * We also mark it as condemned (note that it was never added)
14583                  * so that caching conn's can move off of it.
14584                  */
14585                 ire_make_condemned(ill->ill_ire_multicast);
14586                 ire_refrele_notr(ill->ill_ire_multicast);
14587                 ill->ill_ire_multicast = NULL;
14588         }
14589 }
14590 
14591 /*
14592  * Perform a bind for the physical device.
14593  * When the routine returns EINPROGRESS then mp has been consumed and
14594  * the ioctl will be acked from ip_rput_dlpi.
14595  * Allocate an unbind message and save it until ipif_down.
14596  */
14597 static int
14598 ill_dl_up(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
14599 {
14600         mblk_t  *bind_mp = NULL;
14601         mblk_t  *unbind_mp = NULL;
14602         conn_t  *connp;
14603         boolean_t success;
14604         int     err;
14605 
14606         DTRACE_PROBE2(ill__downup, char *, "ill_dl_up", ill_t *, ill);
14607 
14608         ip1dbg(("ill_dl_up(%s)\n", ill->ill_name));
14609         ASSERT(IAM_WRITER_ILL(ill));
14610         ASSERT(mp != NULL);
14611 
14612         /*
14613          * Make sure we have an IRE_MULTICAST in case we immediately
14614          * start receiving packets.
14615          */
14616         err = ill_add_ires(ill);
14617         if (err != 0)
14618                 goto bad;
14619 
14620         bind_mp = ip_dlpi_alloc(sizeof (dl_bind_req_t) + sizeof (long),
14621             DL_BIND_REQ);
14622         if (bind_mp == NULL)
14623                 goto bad;
14624         ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ill->ill_sap;
14625         ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;
14626 
14627         /*
14628          * ill_unbind_mp would be non-null if the following sequence had
14629          * happened:
14630          * - send DL_BIND_REQ to driver, wait for response
14631          * - multiple ioctls that need to bring the ipif up are encountered,
14632          *   but they cannot enter the ipsq due to the outstanding DL_BIND_REQ.
14633          *   These ioctls will then be enqueued on the ipsq
14634          * - a DL_ERROR_ACK is returned for the DL_BIND_REQ
14635          * At this point, the pending ioctls in the ipsq will be drained, and
14636          * since ill->ill_dl_up was not set, ill_dl_up would be invoked with
14637          * a non-null ill->ill_unbind_mp
14638          */
14639         if (ill->ill_unbind_mp == NULL) {
14640                 unbind_mp = ip_dlpi_alloc(sizeof (dl_unbind_req_t),
14641                     DL_UNBIND_REQ);
14642                 if (unbind_mp == NULL)
14643                         goto bad;
14644         }
14645         /*
14646          * Record state needed to complete this operation when the
14647          * DL_BIND_ACK shows up.  Also remember the pre-allocated mblks.
14648          */
14649         connp = CONN_Q(q) ? Q_TO_CONN(q) : NULL;
14650         ASSERT(connp != NULL || !CONN_Q(q));
14651         GRAB_CONN_LOCK(q);
14652         mutex_enter(&ipif->ipif_ill->ill_lock);
14653         success = ipsq_pending_mp_add(connp, ipif, q, mp, 0);
14654         mutex_exit(&ipif->ipif_ill->ill_lock);
14655         RELEASE_CONN_LOCK(q);
14656         if (!success)
14657                 goto bad;
14658 
14659         /*
14660          * Save the unbind message for ill_dl_down(); it will be consumed when
14661          * the interface goes down.
14662          */
14663         if (ill->ill_unbind_mp == NULL)
14664                 ill->ill_unbind_mp = unbind_mp;
14665 
14666         ill_dlpi_send(ill, bind_mp);
14667         /* Send down link-layer capabilities probe if not already done. */
14668         ill_capability_probe(ill);
14669 
14670         /*
14671          * Sysid used to rely on the fact that netboots set domainname
14672          * and the like. Now that miniroot boots aren't strictly netboots
14673          * and miniroot network configuration is driven from userland
14674          * these things still need to be set. This situation can be detected
14675          * by comparing the interface being configured here to the one
14676          * dhcifname was set to reference by the boot loader. Once sysid is
14677          * converted to use dhcp_ipc_getinfo() this call can go away.
14678          */
14679         if ((ipif->ipif_flags & IPIF_DHCPRUNNING) &&
14680             (strcmp(ill->ill_name, dhcifname) == 0) &&
14681             (strlen(srpc_domain) == 0)) {
14682                 if (dhcpinit() != 0)
14683                         cmn_err(CE_WARN, "no cached dhcp response");
14684         }
14685 
14686         /*
14687          * This operation will complete in ip_rput_dlpi with either
14688          * a DL_BIND_ACK or DL_ERROR_ACK.
14689          */
14690         return (EINPROGRESS);
14691 bad:
14692         ip1dbg(("ill_dl_up(%s) FAILED\n", ill->ill_name));
14693 
14694         freemsg(bind_mp);
14695         freemsg(unbind_mp);
14696         return (ENOMEM);
14697 }
14698 
14699 /* Add room for tcp+ip headers */
14700 uint_t ip_loopback_mtuplus = IP_LOOPBACK_MTU + IP_SIMPLE_HDR_LENGTH + 20;
14701 
14702 /*
14703  * DLPI and ARP is up.
14704  * Create all the IREs associated with an interface. Bring up multicast.
14705  * Set the interface flag and finish other initialization
14706  * that potentially had to be deferred to after DL_BIND_ACK.
14707  */
14708 int
14709 ipif_up_done(ipif_t *ipif)
14710 {
14711         ill_t           *ill = ipif->ipif_ill;
14712         int             err = 0;
14713         boolean_t       loopback = B_FALSE;
14714         boolean_t       update_src_selection = B_TRUE;
14715         ipif_t          *tmp_ipif;
14716 
14717         ip1dbg(("ipif_up_done(%s:%u)\n",
14718             ipif->ipif_ill->ill_name, ipif->ipif_id));
14719         DTRACE_PROBE3(ipif__downup, char *, "ipif_up_done",
14720             ill_t *, ill, ipif_t *, ipif);
14721 
14722         /* Check if this is a loopback interface */
14723         if (ipif->ipif_ill->ill_wq == NULL)
14724                 loopback = B_TRUE;
14725 
14726         ASSERT(!MUTEX_HELD(&ipif->ipif_ill->ill_lock));
14727 
14728         /*
14729          * If all other interfaces for this ill are down or DEPRECATED,
14730          * or otherwise unsuitable for source address selection,
14731          * reset the src generation numbers to make sure source
14732          * address selection gets to take this new ipif into account.
14733          * No need to hold ill_lock while traversing the ipif list since
14734          * we are writer
14735          */
14736         for (tmp_ipif = ill->ill_ipif; tmp_ipif;
14737             tmp_ipif = tmp_ipif->ipif_next) {
14738                 if (((tmp_ipif->ipif_flags &
14739                     (IPIF_NOXMIT|IPIF_ANYCAST|IPIF_NOLOCAL|IPIF_DEPRECATED)) ||
14740                     !(tmp_ipif->ipif_flags & IPIF_UP)) ||
14741                     (tmp_ipif == ipif))
14742                         continue;
14743                 /* first useable pre-existing interface */
14744                 update_src_selection = B_FALSE;
14745                 break;
14746         }
14747         if (update_src_selection)
14748                 ip_update_source_selection(ill->ill_ipst);
14749 
14750         if (IS_LOOPBACK(ill) || ill->ill_net_type == IRE_IF_NORESOLVER) {
14751                 nce_t *loop_nce = NULL;
14752                 uint16_t flags = (NCE_F_MYADDR | NCE_F_AUTHORITY | NCE_F_NONUD);
14753 
14754                 /*
14755                  * lo0:1 and subsequent ipifs were marked IRE_LOCAL in
14756                  * ipif_lookup_on_name(), but in the case of zones we can have
14757                  * several loopback addresses on lo0. So all the interfaces with
14758                  * loopback addresses need to be marked IRE_LOOPBACK.
14759                  */
14760                 if (V4_PART_OF_V6(ipif->ipif_v6lcl_addr) ==
14761                     htonl(INADDR_LOOPBACK))
14762                         ipif->ipif_ire_type = IRE_LOOPBACK;
14763                 else
14764                         ipif->ipif_ire_type = IRE_LOCAL;
14765                 if (ill->ill_net_type != IRE_LOOPBACK)
14766                         flags |= NCE_F_PUBLISH;
14767 
14768                 /* add unicast nce for the local addr */
14769                 err = nce_lookup_then_add_v4(ill, NULL,
14770                     ill->ill_phys_addr_length, &ipif->ipif_lcl_addr, flags,
14771                     ND_REACHABLE, &loop_nce);
14772                 /* A shared-IP zone sees EEXIST for lo0:N */
14773                 if (err == 0 || err == EEXIST) {
14774                         ipif->ipif_added_nce = 1;
14775                         loop_nce->nce_ipif_cnt++;
14776                         nce_refrele(loop_nce);
14777                         err = 0;
14778                 } else {
14779                         ASSERT(loop_nce == NULL);
14780                         return (err);
14781                 }
14782         }
14783 
14784         /* Create all the IREs associated with this interface */
14785         err = ipif_add_ires_v4(ipif, loopback);
14786         if (err != 0) {
14787                 /*
14788                  * see comments about return value from
14789                  * ip_addr_availability_check() in ipif_add_ires_v4().
14790                  */
14791                 if (err != EADDRINUSE) {
14792                         (void) ipif_arp_down(ipif);
14793                 } else {
14794                         /*
14795                          * Make IPMP aware of the deleted ipif so that
14796                          * the needed ipmp cleanup (e.g., of ipif_bound_ill)
14797                          * can be completed. Note that we do not want to
14798                          * destroy the nce that was created on the ipmp_ill
14799                          * for the active copy of the duplicate address in
14800                          * use.
14801                          */
14802                         if (IS_IPMP(ill))
14803                                 ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
14804                         err = EADDRNOTAVAIL;
14805                 }
14806                 return (err);
14807         }
14808 
14809         if (ill->ill_ipif_up_count == 1 && !loopback) {
14810                 /* Recover any additional IREs entries for this ill */
14811                 (void) ill_recover_saved_ire(ill);
14812         }
14813 
14814         if (ill->ill_need_recover_multicast) {
14815                 /*
14816                  * Need to recover all multicast memberships in the driver.
14817                  * This had to be deferred until we had attached.  The same
14818                  * code exists in ipif_up_done_v6() to recover IPv6
14819                  * memberships.
14820                  *
14821                  * Note that it would be preferable to unconditionally do the
14822                  * ill_recover_multicast() in ill_dl_up(), but we cannot do
14823                  * that since ill_join_allmulti() depends on ill_dl_up being
14824                  * set, and it is not set until we receive a DL_BIND_ACK after
14825                  * having called ill_dl_up().
14826                  */
14827                 ill_recover_multicast(ill);
14828         }
14829 
14830         if (ill->ill_ipif_up_count == 1) {
14831                 /*
14832                  * Since the interface is now up, it may now be active.
14833                  */
14834                 if (IS_UNDER_IPMP(ill))
14835                         ipmp_ill_refresh_active(ill);
14836 
14837                 /*
14838                  * If this is an IPMP interface, we may now be able to
14839                  * establish ARP entries.
14840                  */
14841                 if (IS_IPMP(ill))
14842                         ipmp_illgrp_refresh_arpent(ill->ill_grp);
14843         }
14844 
14845         /* Join the allhosts multicast address */
14846         ipif_multicast_up(ipif);
14847 
14848         if (!loopback && !update_src_selection &&
14849             !(ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST|IPIF_DEPRECATED)))
14850                 ip_update_source_selection(ill->ill_ipst);
14851 
14852         if (!loopback && ipif->ipif_addr_ready) {
14853                 /* Broadcast an address mask reply. */
14854                 ipif_mask_reply(ipif);
14855         }
14856         /* Perhaps ilgs should use this ill */
14857         update_conn_ill(NULL, ill->ill_ipst);
14858 
14859         /*
14860          * This had to be deferred until we had bound.  Tell routing sockets and
14861          * others that this interface is up if it looks like the address has
14862          * been validated.  Otherwise, if it isn't ready yet, wait for
14863          * duplicate address detection to do its thing.
14864          */
14865         if (ipif->ipif_addr_ready)
14866                 ipif_up_notify(ipif);
14867         return (0);
14868 }
14869 
14870 /*
14871  * Add the IREs associated with the ipif.
14872  * Those MUST be explicitly removed in ipif_delete_ires_v4.
14873  */
14874 static int
14875 ipif_add_ires_v4(ipif_t *ipif, boolean_t loopback)
14876 {
14877         ill_t           *ill = ipif->ipif_ill;
14878         ip_stack_t      *ipst = ill->ill_ipst;
14879         ire_t           *ire_array[20];
14880         ire_t           **irep = ire_array;
14881         ire_t           **irep1;
14882         ipaddr_t        net_mask = 0;
14883         ipaddr_t        subnet_mask, route_mask;
14884         int             err;
14885         ire_t           *ire_local = NULL;      /* LOCAL or LOOPBACK */
14886         ire_t           *ire_if = NULL;
14887         uchar_t         *gw;
14888 
14889         if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14890             !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14891                 /*
14892                  * If we're on a labeled system then make sure that zone-
14893                  * private addresses have proper remote host database entries.
14894                  */
14895                 if (is_system_labeled() &&
14896                     ipif->ipif_ire_type != IRE_LOOPBACK &&
14897                     !tsol_check_interface_address(ipif))
14898                         return (EINVAL);
14899 
14900                 /* Register the source address for __sin6_src_id */
14901                 err = ip_srcid_insert(&ipif->ipif_v6lcl_addr,
14902                     ipif->ipif_zoneid, ipst);
14903                 if (err != 0) {
14904                         ip0dbg(("ipif_add_ires: srcid_insert %d\n", err));
14905                         return (err);
14906                 }
14907 
14908                 if (loopback)
14909                         gw = (uchar_t *)&ipif->ipif_lcl_addr;
14910                 else
14911                         gw = NULL;
14912 
14913                 /* If the interface address is set, create the local IRE. */
14914                 ire_local = ire_create(
14915                     (uchar_t *)&ipif->ipif_lcl_addr,     /* dest address */
14916                     (uchar_t *)&ip_g_all_ones,              /* mask */
14917                     gw,                                 /* gateway */
14918                     ipif->ipif_ire_type,             /* LOCAL or LOOPBACK */
14919                     ipif->ipif_ill,
14920                     ipif->ipif_zoneid,
14921                     ((ipif->ipif_flags & IPIF_PRIVATE) ?
14922                     RTF_PRIVATE : 0) | RTF_KERNEL,
14923                     NULL,
14924                     ipst);
14925                 ip1dbg(("ipif_add_ires: 0x%p creating IRE %p type 0x%x"
14926                     " for 0x%x\n", (void *)ipif, (void *)ire_local,
14927                     ipif->ipif_ire_type,
14928                     ntohl(ipif->ipif_lcl_addr)));
14929                 if (ire_local == NULL) {
14930                         ip1dbg(("ipif_up_done: NULL ire_local\n"));
14931                         err = ENOMEM;
14932                         goto bad;
14933                 }
14934         } else {
14935                 ip1dbg((
14936                     "ipif_add_ires: not creating IRE %d for 0x%x: flags 0x%x\n",
14937                     ipif->ipif_ire_type,
14938                     ntohl(ipif->ipif_lcl_addr),
14939                     (uint_t)ipif->ipif_flags));
14940         }
14941         if ((ipif->ipif_lcl_addr != INADDR_ANY) &&
14942             !(ipif->ipif_flags & IPIF_NOLOCAL)) {
14943                 net_mask = ip_net_mask(ipif->ipif_lcl_addr);
14944         } else {
14945                 net_mask = htonl(IN_CLASSA_NET);        /* fallback */
14946         }
14947 
14948         subnet_mask = ipif->ipif_net_mask;
14949 
14950         /*
14951          * If mask was not specified, use natural netmask of
14952          * interface address. Also, store this mask back into the
14953          * ipif struct.
14954          */
14955         if (subnet_mask == 0) {
14956                 subnet_mask = net_mask;
14957                 V4MASK_TO_V6(subnet_mask, ipif->ipif_v6net_mask);
14958                 V6_MASK_COPY(ipif->ipif_v6lcl_addr, ipif->ipif_v6net_mask,
14959                     ipif->ipif_v6subnet);
14960         }
14961 
14962         /* Set up the IRE_IF_RESOLVER or IRE_IF_NORESOLVER, as appropriate. */
14963         if (!loopback && !(ipif->ipif_flags & IPIF_NOXMIT) &&
14964             ipif->ipif_subnet != INADDR_ANY) {
14965                 /* ipif_subnet is ipif_pp_dst_addr for pt-pt */
14966 
14967                 if (ipif->ipif_flags & IPIF_POINTOPOINT) {
14968                         route_mask = IP_HOST_MASK;
14969                 } else {
14970                         route_mask = subnet_mask;
14971                 }
14972 
14973                 ip1dbg(("ipif_add_ires: ipif 0x%p ill 0x%p "
14974                     "creating if IRE ill_net_type 0x%x for 0x%x\n",
14975                     (void *)ipif, (void *)ill, ill->ill_net_type,
14976                     ntohl(ipif->ipif_subnet)));
14977                 ire_if = ire_create(
14978                     (uchar_t *)&ipif->ipif_subnet,
14979                     (uchar_t *)&route_mask,
14980                     (uchar_t *)&ipif->ipif_lcl_addr,
14981                     ill->ill_net_type,
14982                     ill,
14983                     ipif->ipif_zoneid,
14984                     ((ipif->ipif_flags & IPIF_PRIVATE) ?
14985                     RTF_PRIVATE: 0) | RTF_KERNEL,
14986                     NULL,
14987                     ipst);
14988                 if (ire_if == NULL) {
14989                         ip1dbg(("ipif_up_done: NULL ire_if\n"));
14990                         err = ENOMEM;
14991                         goto bad;
14992                 }
14993         }
14994 
14995         /*
14996          * Create any necessary broadcast IREs.
14997          */
14998         if ((ipif->ipif_flags & IPIF_BROADCAST) &&
14999             !(ipif->ipif_flags & IPIF_NOXMIT))
15000                 irep = ipif_create_bcast_ires(ipif, irep);
15001 
15002         /* If an earlier ire_create failed, get out now */
15003         for (irep1 = irep; irep1 > ire_array; ) {
15004                 irep1--;
15005                 if (*irep1 == NULL) {
15006                         ip1dbg(("ipif_up_done: NULL ire found in ire_array\n"));
15007                         err = ENOMEM;
15008                         goto bad;
15009                 }
15010         }
15011 
15012         /*
15013          * Need to atomically check for IP address availability under
15014          * ip_addr_avail_lock.  ill_g_lock is held as reader to ensure no new
15015          * ills or new ipifs can be added while we are checking availability.
15016          */
15017         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15018         mutex_enter(&ipst->ips_ip_addr_avail_lock);
15019         /* Mark it up, and increment counters. */
15020         ipif->ipif_flags |= IPIF_UP;
15021         ill->ill_ipif_up_count++;
15022         err = ip_addr_availability_check(ipif);
15023         mutex_exit(&ipst->ips_ip_addr_avail_lock);
15024         rw_exit(&ipst->ips_ill_g_lock);
15025 
15026         if (err != 0) {
15027                 /*
15028                  * Our address may already be up on the same ill. In this case,
15029                  * the ARP entry for our ipif replaced the one for the other
15030                  * ipif. So we don't want to delete it (otherwise the other ipif
15031                  * would be unable to send packets).
15032                  * ip_addr_availability_check() identifies this case for us and
15033                  * returns EADDRINUSE; Caller should turn it into EADDRNOTAVAIL
15034                  * which is the expected error code.
15035                  */
15036                 ill->ill_ipif_up_count--;
15037                 ipif->ipif_flags &= ~IPIF_UP;
15038                 goto bad;
15039         }
15040 
15041         /*
15042          * Add in all newly created IREs.  ire_create_bcast() has
15043          * already checked for duplicates of the IRE_BROADCAST type.
15044          * We add the IRE_INTERFACE before the IRE_LOCAL to ensure
15045          * that lookups find the IRE_LOCAL even if the IRE_INTERFACE is
15046          * a /32 route.
15047          */
15048         if (ire_if != NULL) {
15049                 ire_if = ire_add(ire_if);
15050                 if (ire_if == NULL) {
15051                         err = ENOMEM;
15052                         goto bad2;
15053                 }
15054 #ifdef DEBUG
15055                 ire_refhold_notr(ire_if);
15056                 ire_refrele(ire_if);
15057 #endif
15058         }
15059         if (ire_local != NULL) {
15060                 ire_local = ire_add(ire_local);
15061                 if (ire_local == NULL) {
15062                         err = ENOMEM;
15063                         goto bad2;
15064                 }
15065 #ifdef DEBUG
15066                 ire_refhold_notr(ire_local);
15067                 ire_refrele(ire_local);
15068 #endif
15069         }
15070         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15071         if (ire_local != NULL)
15072                 ipif->ipif_ire_local = ire_local;
15073         if (ire_if != NULL)
15074                 ipif->ipif_ire_if = ire_if;
15075         rw_exit(&ipst->ips_ill_g_lock);
15076         ire_local = NULL;
15077         ire_if = NULL;
15078 
15079         /*
15080          * We first add all of them, and if that succeeds we refrele the
15081          * bunch. That enables us to delete all of them should any of the
15082          * ire_adds fail.
15083          */
15084         for (irep1 = irep; irep1 > ire_array; ) {
15085                 irep1--;
15086                 ASSERT(!MUTEX_HELD(&((*irep1)->ire_ill->ill_lock)));
15087                 *irep1 = ire_add(*irep1);
15088                 if (*irep1 == NULL) {
15089                         err = ENOMEM;
15090                         goto bad2;
15091                 }
15092         }
15093 
15094         for (irep1 = irep; irep1 > ire_array; ) {
15095                 irep1--;
15096                 /* refheld by ire_add. */
15097                 if (*irep1 != NULL) {
15098                         ire_refrele(*irep1);
15099                         *irep1 = NULL;
15100                 }
15101         }
15102 
15103         if (!loopback) {
15104                 /*
15105                  * If the broadcast address has been set, make sure it makes
15106                  * sense based on the interface address.
15107                  * Only match on ill since we are sharing broadcast addresses.
15108                  */
15109                 if ((ipif->ipif_brd_addr != INADDR_ANY) &&
15110                     (ipif->ipif_flags & IPIF_BROADCAST)) {
15111                         ire_t   *ire;
15112 
15113                         ire = ire_ftable_lookup_v4(ipif->ipif_brd_addr, 0, 0,
15114                             IRE_BROADCAST, ipif->ipif_ill, ALL_ZONES, NULL,
15115                             (MATCH_IRE_TYPE | MATCH_IRE_ILL), 0, ipst, NULL);
15116 
15117                         if (ire == NULL) {
15118                                 /*
15119                                  * If there isn't a matching broadcast IRE,
15120                                  * revert to the default for this netmask.
15121                                  */
15122                                 ipif->ipif_v6brd_addr = ipv6_all_zeros;
15123                                 mutex_enter(&ipif->ipif_ill->ill_lock);
15124                                 ipif_set_default(ipif);
15125                                 mutex_exit(&ipif->ipif_ill->ill_lock);
15126                         } else {
15127                                 ire_refrele(ire);
15128                         }
15129                 }
15130 
15131         }
15132         return (0);
15133 
15134 bad2:
15135         ill->ill_ipif_up_count--;
15136         ipif->ipif_flags &= ~IPIF_UP;
15137 
15138 bad:
15139         ip1dbg(("ipif_add_ires: FAILED \n"));
15140         if (ire_local != NULL)
15141                 ire_delete(ire_local);
15142         if (ire_if != NULL)
15143                 ire_delete(ire_if);
15144 
15145         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15146         ire_local = ipif->ipif_ire_local;
15147         ipif->ipif_ire_local = NULL;
15148         ire_if = ipif->ipif_ire_if;
15149         ipif->ipif_ire_if = NULL;
15150         rw_exit(&ipst->ips_ill_g_lock);
15151         if (ire_local != NULL) {
15152                 ire_delete(ire_local);
15153                 ire_refrele_notr(ire_local);
15154         }
15155         if (ire_if != NULL) {
15156                 ire_delete(ire_if);
15157                 ire_refrele_notr(ire_if);
15158         }
15159 
15160         while (irep > ire_array) {
15161                 irep--;
15162                 if (*irep != NULL) {
15163                         ire_delete(*irep);
15164                 }
15165         }
15166         (void) ip_srcid_remove(&ipif->ipif_v6lcl_addr, ipif->ipif_zoneid, ipst);
15167 
15168         return (err);
15169 }
15170 
15171 /* Remove all the IREs created by ipif_add_ires_v4 */
15172 void
15173 ipif_delete_ires_v4(ipif_t *ipif)
15174 {
15175         ill_t           *ill = ipif->ipif_ill;
15176         ip_stack_t      *ipst = ill->ill_ipst;
15177         ire_t           *ire;
15178 
15179         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15180         ire = ipif->ipif_ire_local;
15181         ipif->ipif_ire_local = NULL;
15182         rw_exit(&ipst->ips_ill_g_lock);
15183         if (ire != NULL) {
15184                 /*
15185                  * Move count to ipif so we don't loose the count due to
15186                  * a down/up dance.
15187                  */
15188                 atomic_add_32(&ipif->ipif_ib_pkt_count, ire->ire_ib_pkt_count);
15189 
15190                 ire_delete(ire);
15191                 ire_refrele_notr(ire);
15192         }
15193         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15194         ire = ipif->ipif_ire_if;
15195         ipif->ipif_ire_if = NULL;
15196         rw_exit(&ipst->ips_ill_g_lock);
15197         if (ire != NULL) {
15198                 ire_delete(ire);
15199                 ire_refrele_notr(ire);
15200         }
15201 
15202         /*
15203          * Delete the broadcast IREs.
15204          */
15205         if ((ipif->ipif_flags & IPIF_BROADCAST) &&
15206             !(ipif->ipif_flags & IPIF_NOXMIT))
15207                 ipif_delete_bcast_ires(ipif);
15208 }
15209 
15210 /*
15211  * Checks for availbility of a usable source address (if there is one) when the
15212  * destination ILL has the ill_usesrc_ifindex pointing to another ILL. Note
15213  * this selection is done regardless of the destination.
15214  */
15215 boolean_t
15216 ipif_zone_avail(uint_t ifindex, boolean_t isv6, zoneid_t zoneid,
15217     ip_stack_t *ipst)
15218 {
15219         ipif_t          *ipif = NULL;
15220         ill_t           *uill;
15221 
15222         ASSERT(ifindex != 0);
15223 
15224         uill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
15225         if (uill == NULL)
15226                 return (B_FALSE);
15227 
15228         mutex_enter(&uill->ill_lock);
15229         for (ipif = uill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15230                 if (IPIF_IS_CONDEMNED(ipif))
15231                         continue;
15232                 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15233                         continue;
15234                 if (!(ipif->ipif_flags & IPIF_UP))
15235                         continue;
15236                 if (ipif->ipif_zoneid != zoneid)
15237                         continue;
15238                 if (isv6 ? IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15239                     ipif->ipif_lcl_addr == INADDR_ANY)
15240                         continue;
15241                 mutex_exit(&uill->ill_lock);
15242                 ill_refrele(uill);
15243                 return (B_TRUE);
15244         }
15245         mutex_exit(&uill->ill_lock);
15246         ill_refrele(uill);
15247         return (B_FALSE);
15248 }
15249 
15250 /*
15251  * Find an ipif with a good local address on the ill+zoneid.
15252  */
15253 ipif_t *
15254 ipif_good_addr(ill_t *ill, zoneid_t zoneid)
15255 {
15256         ipif_t          *ipif;
15257 
15258         mutex_enter(&ill->ill_lock);
15259         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
15260                 if (IPIF_IS_CONDEMNED(ipif))
15261                         continue;
15262                 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15263                         continue;
15264                 if (!(ipif->ipif_flags & IPIF_UP))
15265                         continue;
15266                 if (ipif->ipif_zoneid != zoneid &&
15267                     ipif->ipif_zoneid != ALL_ZONES && zoneid != ALL_ZONES)
15268                         continue;
15269                 if (ill->ill_isv6 ?
15270                     IN6_IS_ADDR_UNSPECIFIED(&ipif->ipif_v6lcl_addr) :
15271                     ipif->ipif_lcl_addr == INADDR_ANY)
15272                         continue;
15273                 ipif_refhold_locked(ipif);
15274                 mutex_exit(&ill->ill_lock);
15275                 return (ipif);
15276         }
15277         mutex_exit(&ill->ill_lock);
15278         return (NULL);
15279 }
15280 
15281 /*
15282  * IP source address type, sorted from worst to best.  For a given type,
15283  * always prefer IP addresses on the same subnet.  All-zones addresses are
15284  * suboptimal because they pose problems with unlabeled destinations.
15285  */
15286 typedef enum {
15287         IPIF_NONE,
15288         IPIF_DIFFNET_DEPRECATED,        /* deprecated and different subnet */
15289         IPIF_SAMENET_DEPRECATED,        /* deprecated and same subnet */
15290         IPIF_DIFFNET_ALLZONES,          /* allzones and different subnet */
15291         IPIF_SAMENET_ALLZONES,          /* allzones and same subnet */
15292         IPIF_DIFFNET,                   /* normal and different subnet */
15293         IPIF_SAMENET,                   /* normal and same subnet */
15294         IPIF_LOCALADDR                  /* local loopback */
15295 } ipif_type_t;
15296 
15297 /*
15298  * Pick the optimal ipif on `ill' for sending to destination `dst' from zone
15299  * `zoneid'.  We rate usable ipifs from low -> high as per the ipif_type_t
15300  * enumeration, and return the highest-rated ipif.  If there's a tie, we pick
15301  * the first one, unless IPMP is used in which case we round-robin among them;
15302  * see below for more.
15303  *
15304  * Returns NULL if there is no suitable source address for the ill.
15305  * This only occurs when there is no valid source address for the ill.
15306  */
15307 ipif_t *
15308 ipif_select_source_v4(ill_t *ill, ipaddr_t dst, zoneid_t zoneid,
15309     boolean_t allow_usesrc, boolean_t *notreadyp)
15310 {
15311         ill_t   *usill = NULL;
15312         ill_t   *ipmp_ill = NULL;
15313         ipif_t  *start_ipif, *next_ipif, *ipif, *best_ipif;
15314         ipif_type_t type, best_type;
15315         tsol_tpc_t *src_rhtp, *dst_rhtp;
15316         ip_stack_t *ipst = ill->ill_ipst;
15317         boolean_t samenet;
15318 
15319         if (ill->ill_usesrc_ifindex != 0 && allow_usesrc) {
15320                 usill = ill_lookup_on_ifindex(ill->ill_usesrc_ifindex,
15321                     B_FALSE, ipst);
15322                 if (usill != NULL)
15323                         ill = usill;    /* Select source from usesrc ILL */
15324                 else
15325                         return (NULL);
15326         }
15327 
15328         /*
15329          * Test addresses should never be used for source address selection,
15330          * so if we were passed one, switch to the IPMP meta-interface.
15331          */
15332         if (IS_UNDER_IPMP(ill)) {
15333                 if ((ipmp_ill = ipmp_ill_hold_ipmp_ill(ill)) != NULL)
15334                         ill = ipmp_ill; /* Select source from IPMP ill */
15335                 else
15336                         return (NULL);
15337         }
15338 
15339         /*
15340          * If we're dealing with an unlabeled destination on a labeled system,
15341          * make sure that we ignore source addresses that are incompatible with
15342          * the destination's default label.  That destination's default label
15343          * must dominate the minimum label on the source address.
15344          */
15345         dst_rhtp = NULL;
15346         if (is_system_labeled()) {
15347                 dst_rhtp = find_tpc(&dst, IPV4_VERSION, B_FALSE);
15348                 if (dst_rhtp == NULL)
15349                         return (NULL);
15350                 if (dst_rhtp->tpc_tp.host_type != UNLABELED) {
15351                         TPC_RELE(dst_rhtp);
15352                         dst_rhtp = NULL;
15353                 }
15354         }
15355 
15356         /*
15357          * Hold the ill_g_lock as reader. This makes sure that no ipif/ill
15358          * can be deleted. But an ipif/ill can get CONDEMNED any time.
15359          * After selecting the right ipif, under ill_lock make sure ipif is
15360          * not condemned, and increment refcnt. If ipif is CONDEMNED,
15361          * we retry. Inside the loop we still need to check for CONDEMNED,
15362          * but not under a lock.
15363          */
15364         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
15365 retry:
15366         /*
15367          * For source address selection, we treat the ipif list as circular
15368          * and continue until we get back to where we started.  This allows
15369          * IPMP to vary source address selection (which improves inbound load
15370          * spreading) by caching its last ending point and starting from
15371          * there.  NOTE: we don't have to worry about ill_src_ipif changing
15372          * ills since that can't happen on the IPMP ill.
15373          */
15374         start_ipif = ill->ill_ipif;
15375         if (IS_IPMP(ill) && ill->ill_src_ipif != NULL)
15376                 start_ipif = ill->ill_src_ipif;
15377 
15378         ipif = start_ipif;
15379         best_ipif = NULL;
15380         best_type = IPIF_NONE;
15381         do {
15382                 if ((next_ipif = ipif->ipif_next) == NULL)
15383                         next_ipif = ill->ill_ipif;
15384 
15385                 if (IPIF_IS_CONDEMNED(ipif))
15386                         continue;
15387                 /* Always skip NOLOCAL and ANYCAST interfaces */
15388                 if (ipif->ipif_flags & (IPIF_NOLOCAL|IPIF_ANYCAST))
15389                         continue;
15390                 /* Always skip NOACCEPT interfaces */
15391                 if (ipif->ipif_ill->ill_flags & ILLF_NOACCEPT)
15392                         continue;
15393                 if (!(ipif->ipif_flags & IPIF_UP))
15394                         continue;
15395 
15396                 if (!ipif->ipif_addr_ready) {
15397                         if (notreadyp != NULL)
15398                                 *notreadyp = B_TRUE;
15399                         continue;
15400                 }
15401 
15402                 if (zoneid != ALL_ZONES &&
15403                     ipif->ipif_zoneid != zoneid &&
15404                     ipif->ipif_zoneid != ALL_ZONES)
15405                         continue;
15406 
15407                 /*
15408                  * Interfaces with 0.0.0.0 address are allowed to be UP, but
15409                  * are not valid as source addresses.
15410                  */
15411                 if (ipif->ipif_lcl_addr == INADDR_ANY)
15412                         continue;
15413 
15414                 /*
15415                  * Check compatibility of local address for destination's
15416                  * default label if we're on a labeled system.  Incompatible
15417                  * addresses can't be used at all.
15418                  */
15419                 if (dst_rhtp != NULL) {
15420                         boolean_t incompat;
15421 
15422                         src_rhtp = find_tpc(&ipif->ipif_lcl_addr,
15423                             IPV4_VERSION, B_FALSE);
15424                         if (src_rhtp == NULL)
15425                                 continue;
15426                         incompat = src_rhtp->tpc_tp.host_type != SUN_CIPSO ||
15427                             src_rhtp->tpc_tp.tp_doi !=
15428                             dst_rhtp->tpc_tp.tp_doi ||
15429                             (!_blinrange(&dst_rhtp->tpc_tp.tp_def_label,
15430                             &src_rhtp->tpc_tp.tp_sl_range_cipso) &&
15431                             !blinlset(&dst_rhtp->tpc_tp.tp_def_label,
15432                             src_rhtp->tpc_tp.tp_sl_set_cipso));
15433                         TPC_RELE(src_rhtp);
15434                         if (incompat)
15435                                 continue;
15436                 }
15437 
15438                 samenet = ((ipif->ipif_net_mask & dst) == ipif->ipif_subnet);
15439 
15440                 if (ipif->ipif_lcl_addr == dst) {
15441                         type = IPIF_LOCALADDR;
15442                 } else if (ipif->ipif_flags & IPIF_DEPRECATED) {
15443                         type = samenet ? IPIF_SAMENET_DEPRECATED :
15444                             IPIF_DIFFNET_DEPRECATED;
15445                 } else if (ipif->ipif_zoneid == ALL_ZONES) {
15446                         type = samenet ? IPIF_SAMENET_ALLZONES :
15447                             IPIF_DIFFNET_ALLZONES;
15448                 } else {
15449                         type = samenet ? IPIF_SAMENET : IPIF_DIFFNET;
15450                 }
15451 
15452                 if (type > best_type) {
15453                         best_type = type;
15454                         best_ipif = ipif;
15455                         if (best_type == IPIF_LOCALADDR)
15456                                 break; /* can't get better */
15457                 }
15458         } while ((ipif = next_ipif) != start_ipif);
15459 
15460         if ((ipif = best_ipif) != NULL) {
15461                 mutex_enter(&ipif->ipif_ill->ill_lock);
15462                 if (IPIF_IS_CONDEMNED(ipif)) {
15463                         mutex_exit(&ipif->ipif_ill->ill_lock);
15464                         goto retry;
15465                 }
15466                 ipif_refhold_locked(ipif);
15467 
15468                 /*
15469                  * For IPMP, update the source ipif rotor to the next ipif,
15470                  * provided we can look it up.  (We must not use it if it's
15471                  * IPIF_CONDEMNED since we may have grabbed ill_g_lock after
15472                  * ipif_free() checked ill_src_ipif.)
15473                  */
15474                 if (IS_IPMP(ill) && ipif != NULL) {
15475                         next_ipif = ipif->ipif_next;
15476                         if (next_ipif != NULL && !IPIF_IS_CONDEMNED(next_ipif))
15477                                 ill->ill_src_ipif = next_ipif;
15478                         else
15479                                 ill->ill_src_ipif = NULL;
15480                 }
15481                 mutex_exit(&ipif->ipif_ill->ill_lock);
15482         }
15483 
15484         rw_exit(&ipst->ips_ill_g_lock);
15485         if (usill != NULL)
15486                 ill_refrele(usill);
15487         if (ipmp_ill != NULL)
15488                 ill_refrele(ipmp_ill);
15489         if (dst_rhtp != NULL)
15490                 TPC_RELE(dst_rhtp);
15491 
15492 #ifdef DEBUG
15493         if (ipif == NULL) {
15494                 char buf1[INET6_ADDRSTRLEN];
15495 
15496                 ip1dbg(("ipif_select_source_v4(%s, %s) -> NULL\n",
15497                     ill->ill_name,
15498                     inet_ntop(AF_INET, &dst, buf1, sizeof (buf1))));
15499         } else {
15500                 char buf1[INET6_ADDRSTRLEN];
15501                 char buf2[INET6_ADDRSTRLEN];
15502 
15503                 ip1dbg(("ipif_select_source_v4(%s, %s) -> %s\n",
15504                     ipif->ipif_ill->ill_name,
15505                     inet_ntop(AF_INET, &dst, buf1, sizeof (buf1)),
15506                     inet_ntop(AF_INET, &ipif->ipif_lcl_addr,
15507                     buf2, sizeof (buf2))));
15508         }
15509 #endif /* DEBUG */
15510         return (ipif);
15511 }
15512 
15513 /*
15514  * Pick a source address based on the destination ill and an optional setsrc
15515  * address.
15516  * The result is stored in srcp. If generation is set, then put the source
15517  * generation number there before we look for the source address (to avoid
15518  * missing changes in the set of source addresses.
15519  * If flagsp is set, then us it to pass back ipif_flags.
15520  *
15521  * If the caller wants to cache the returned source address and detect when
15522  * that might be stale, the caller should pass in a generation argument,
15523  * which the caller can later compare against ips_src_generation
15524  *
15525  * The precedence order for selecting an IPv4 source address is:
15526  *  - RTF_SETSRC on the offlink ire always wins.
15527  *  - If usrsrc is set, swap the ill to be the usesrc one.
15528  *  - If IPMP is used on the ill, select a random address from the most
15529  *    preferred ones below:
15530  * 1. If onlink destination, same subnet and not deprecated, not ALL_ZONES
15531  * 2. Not deprecated, not ALL_ZONES
15532  * 3. If onlink destination, same subnet and not deprecated, ALL_ZONES
15533  * 4. Not deprecated, ALL_ZONES
15534  * 5. If onlink destination, same subnet and deprecated
15535  * 6. Deprecated.
15536  *
15537  * We have lower preference for ALL_ZONES IP addresses,
15538  * as they pose problems with unlabeled destinations.
15539  *
15540  * Note that when multiple IP addresses match e.g., #1 we pick
15541  * the first one if IPMP is not in use. With IPMP we randomize.
15542  */
15543 int
15544 ip_select_source_v4(ill_t *ill, ipaddr_t setsrc, ipaddr_t dst,
15545     ipaddr_t multicast_ifaddr,
15546     zoneid_t zoneid, ip_stack_t *ipst, ipaddr_t *srcp,
15547     uint32_t *generation, uint64_t *flagsp)
15548 {
15549         ipif_t *ipif;
15550         boolean_t notready = B_FALSE;   /* Set if !ipif_addr_ready found */
15551 
15552         if (flagsp != NULL)
15553                 *flagsp = 0;
15554 
15555         /*
15556          * Need to grab the generation number before we check to
15557          * avoid a race with a change to the set of local addresses.
15558          * No lock needed since the thread which updates the set of local
15559          * addresses use ipif/ill locks and exit those (hence a store memory
15560          * barrier) before doing the atomic increase of ips_src_generation.
15561          */
15562         if (generation != NULL) {
15563                 *generation = ipst->ips_src_generation;
15564         }
15565 
15566         if (CLASSD(dst) && multicast_ifaddr != INADDR_ANY) {
15567                 *srcp = multicast_ifaddr;
15568                 return (0);
15569         }
15570 
15571         /* Was RTF_SETSRC set on the first IRE in the recursive lookup? */
15572         if (setsrc != INADDR_ANY) {
15573                 *srcp = setsrc;
15574                 return (0);
15575         }
15576         ipif = ipif_select_source_v4(ill, dst, zoneid, B_TRUE, &notready);
15577         if (ipif == NULL) {
15578                 if (notready)
15579                         return (ENETDOWN);
15580                 else
15581                         return (EADDRNOTAVAIL);
15582         }
15583         *srcp = ipif->ipif_lcl_addr;
15584         if (flagsp != NULL)
15585                 *flagsp = ipif->ipif_flags;
15586         ipif_refrele(ipif);
15587         return (0);
15588 }
15589 
15590 /* ARGSUSED */
15591 int
15592 if_unitsel_restart(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15593         ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15594 {
15595         /*
15596          * ill_phyint_reinit merged the v4 and v6 into a single
15597          * ipsq.  We might not have been able to complete the
15598          * operation in ipif_set_values, if we could not become
15599          * exclusive.  If so restart it here.
15600          */
15601         return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15602 }
15603 
15604 /*
15605  * Can operate on either a module or a driver queue.
15606  * Returns an error if not a module queue.
15607  */
15608 /* ARGSUSED */
15609 int
15610 if_unitsel(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15611     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15612 {
15613         queue_t         *q1 = q;
15614         char            *cp;
15615         char            interf_name[LIFNAMSIZ];
15616         uint_t          ppa = *(uint_t *)mp->b_cont->b_cont->b_rptr;
15617 
15618         if (q->q_next == NULL) {
15619                 ip1dbg((
15620                     "if_unitsel: IF_UNITSEL: no q_next\n"));
15621                 return (EINVAL);
15622         }
15623 
15624         if (((ill_t *)(q->q_ptr))->ill_name[0] != '\0')
15625                 return (EALREADY);
15626 
15627         do {
15628                 q1 = q1->q_next;
15629         } while (q1->q_next);
15630         cp = q1->q_qinfo->qi_minfo->mi_idname;
15631         (void) sprintf(interf_name, "%s%d", cp, ppa);
15632 
15633         /*
15634          * Here we are not going to delay the ioack until after
15635          * ACKs from DL_ATTACH_REQ/DL_BIND_REQ. So no need to save the
15636          * original ioctl message before sending the requests.
15637          */
15638         return (ipif_set_values(q, mp, interf_name, &ppa));
15639 }
15640 
15641 /* ARGSUSED */
15642 int
15643 ip_sioctl_sifname(ipif_t *dummy_ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
15644     ip_ioctl_cmd_t *ipip, void *dummy_ifreq)
15645 {
15646         return (ENXIO);
15647 }
15648 
15649 /*
15650  * Create any IRE_BROADCAST entries for `ipif', and store those entries in
15651  * `irep'.  Returns a pointer to the next free `irep' entry
15652  * A mirror exists in ipif_delete_bcast_ires().
15653  *
15654  * The management of any "extra" or seemingly duplicate IRE_BROADCASTs is
15655  * done in ire_add.
15656  */
15657 static ire_t **
15658 ipif_create_bcast_ires(ipif_t *ipif, ire_t **irep)
15659 {
15660         ipaddr_t addr;
15661         ipaddr_t netmask = ip_net_mask(ipif->ipif_lcl_addr);
15662         ipaddr_t subnetmask = ipif->ipif_net_mask;
15663         ill_t *ill = ipif->ipif_ill;
15664         zoneid_t zoneid = ipif->ipif_zoneid;
15665 
15666         ip1dbg(("ipif_create_bcast_ires: creating broadcast IREs\n"));
15667 
15668         ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15669         ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15670 
15671         if (ipif->ipif_lcl_addr == INADDR_ANY ||
15672             (ipif->ipif_flags & IPIF_NOLOCAL))
15673                 netmask = htonl(IN_CLASSA_NET);         /* fallback */
15674 
15675         irep = ire_create_bcast(ill, 0, zoneid, irep);
15676         irep = ire_create_bcast(ill, INADDR_BROADCAST, zoneid, irep);
15677 
15678         /*
15679          * For backward compatibility, we create net broadcast IREs based on
15680          * the old "IP address class system", since some old machines only
15681          * respond to these class derived net broadcast.  However, we must not
15682          * create these net broadcast IREs if the subnetmask is shorter than
15683          * the IP address class based derived netmask.  Otherwise, we may
15684          * create a net broadcast address which is the same as an IP address
15685          * on the subnet -- and then TCP will refuse to talk to that address.
15686          */
15687         if (netmask < subnetmask) {
15688                 addr = netmask & ipif->ipif_subnet;
15689                 irep = ire_create_bcast(ill, addr, zoneid, irep);
15690                 irep = ire_create_bcast(ill, ~netmask | addr, zoneid, irep);
15691         }
15692 
15693         /*
15694          * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15695          * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15696          * created.  Creating these broadcast IREs will only create confusion
15697          * as `addr' will be the same as the IP address.
15698          */
15699         if (subnetmask != 0xFFFFFFFF) {
15700                 addr = ipif->ipif_subnet;
15701                 irep = ire_create_bcast(ill, addr, zoneid, irep);
15702                 irep = ire_create_bcast(ill, ~subnetmask | addr, zoneid, irep);
15703         }
15704 
15705         return (irep);
15706 }
15707 
15708 /*
15709  * Mirror of ipif_create_bcast_ires()
15710  */
15711 static void
15712 ipif_delete_bcast_ires(ipif_t *ipif)
15713 {
15714         ipaddr_t        addr;
15715         ipaddr_t        netmask = ip_net_mask(ipif->ipif_lcl_addr);
15716         ipaddr_t        subnetmask = ipif->ipif_net_mask;
15717         ill_t           *ill = ipif->ipif_ill;
15718         zoneid_t        zoneid = ipif->ipif_zoneid;
15719         ire_t           *ire;
15720 
15721         ASSERT(ipif->ipif_flags & IPIF_BROADCAST);
15722         ASSERT(!(ipif->ipif_flags & IPIF_NOXMIT));
15723 
15724         if (ipif->ipif_lcl_addr == INADDR_ANY ||
15725             (ipif->ipif_flags & IPIF_NOLOCAL))
15726                 netmask = htonl(IN_CLASSA_NET);         /* fallback */
15727 
15728         ire = ire_lookup_bcast(ill, 0, zoneid);
15729         ASSERT(ire != NULL);
15730         ire_delete(ire); ire_refrele(ire);
15731         ire = ire_lookup_bcast(ill, INADDR_BROADCAST, zoneid);
15732         ASSERT(ire != NULL);
15733         ire_delete(ire); ire_refrele(ire);
15734 
15735         /*
15736          * For backward compatibility, we create net broadcast IREs based on
15737          * the old "IP address class system", since some old machines only
15738          * respond to these class derived net broadcast.  However, we must not
15739          * create these net broadcast IREs if the subnetmask is shorter than
15740          * the IP address class based derived netmask.  Otherwise, we may
15741          * create a net broadcast address which is the same as an IP address
15742          * on the subnet -- and then TCP will refuse to talk to that address.
15743          */
15744         if (netmask < subnetmask) {
15745                 addr = netmask & ipif->ipif_subnet;
15746                 ire = ire_lookup_bcast(ill, addr, zoneid);
15747                 ASSERT(ire != NULL);
15748                 ire_delete(ire); ire_refrele(ire);
15749                 ire = ire_lookup_bcast(ill, ~netmask | addr, zoneid);
15750                 ASSERT(ire != NULL);
15751                 ire_delete(ire); ire_refrele(ire);
15752         }
15753 
15754         /*
15755          * Don't create IRE_BROADCAST IREs for the interface if the subnetmask
15756          * is 0xFFFFFFFF, as an IRE_LOCAL for that interface is already
15757          * created.  Creating these broadcast IREs will only create confusion
15758          * as `addr' will be the same as the IP address.
15759          */
15760         if (subnetmask != 0xFFFFFFFF) {
15761                 addr = ipif->ipif_subnet;
15762                 ire = ire_lookup_bcast(ill, addr, zoneid);
15763                 ASSERT(ire != NULL);
15764                 ire_delete(ire); ire_refrele(ire);
15765                 ire = ire_lookup_bcast(ill, ~subnetmask | addr, zoneid);
15766                 ASSERT(ire != NULL);
15767                 ire_delete(ire); ire_refrele(ire);
15768         }
15769 }
15770 
15771 /*
15772  * Extract both the flags (including IFF_CANTCHANGE) such as IFF_IPV*
15773  * from lifr_flags and the name from lifr_name.
15774  * Set IFF_IPV* and ill_isv6 prior to doing the lookup
15775  * since ipif_lookup_on_name uses the _isv6 flags when matching.
15776  * Returns EINPROGRESS when mp has been consumed by queueing it on
15777  * ipx_pending_mp and the ioctl will complete in ip_rput.
15778  *
15779  * Can operate on either a module or a driver queue.
15780  * Returns an error if not a module queue.
15781  */
15782 /* ARGSUSED */
15783 int
15784 ip_sioctl_slifname(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15785     ip_ioctl_cmd_t *ipip, void *if_req)
15786 {
15787         ill_t   *ill = q->q_ptr;
15788         phyint_t *phyi;
15789         ip_stack_t *ipst;
15790         struct lifreq *lifr = if_req;
15791         uint64_t new_flags;
15792 
15793         ASSERT(ipif != NULL);
15794         ip1dbg(("ip_sioctl_slifname %s\n", lifr->lifr_name));
15795 
15796         if (q->q_next == NULL) {
15797                 ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: no q_next\n"));
15798                 return (EINVAL);
15799         }
15800 
15801         /*
15802          * If we are not writer on 'q' then this interface exists already
15803          * and previous lookups (ip_extract_lifreq()) found this ipif --
15804          * so return EALREADY.
15805          */
15806         if (ill != ipif->ipif_ill)
15807                 return (EALREADY);
15808 
15809         if (ill->ill_name[0] != '\0')
15810                 return (EALREADY);
15811 
15812         /*
15813          * If there's another ill already with the requested name, ensure
15814          * that it's of the same type.  Otherwise, ill_phyint_reinit() will
15815          * fuse together two unrelated ills, which will cause chaos.
15816          */
15817         ipst = ill->ill_ipst;
15818         phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
15819             lifr->lifr_name, NULL);
15820         if (phyi != NULL) {
15821                 ill_t *ill_mate = phyi->phyint_illv4;
15822 
15823                 if (ill_mate == NULL)
15824                         ill_mate = phyi->phyint_illv6;
15825                 ASSERT(ill_mate != NULL);
15826 
15827                 if (ill_mate->ill_media->ip_m_mac_type !=
15828                     ill->ill_media->ip_m_mac_type) {
15829                         ip1dbg(("if_sioctl_slifname: SIOCSLIFNAME: attempt to "
15830                             "use the same ill name on differing media\n"));
15831                         return (EINVAL);
15832                 }
15833         }
15834 
15835         /*
15836          * We start off as IFF_IPV4 in ipif_allocate and become
15837          * IFF_IPV4 or IFF_IPV6 here depending  on lifr_flags value.
15838          * The only flags that we read from user space are IFF_IPV4,
15839          * IFF_IPV6, and IFF_BROADCAST.
15840          *
15841          * This ill has not been inserted into the global list.
15842          * So we are still single threaded and don't need any lock
15843          *
15844          * Saniy check the flags.
15845          */
15846 
15847         if ((lifr->lifr_flags & IFF_BROADCAST) &&
15848             ((lifr->lifr_flags & IFF_IPV6) ||
15849             (!ill->ill_needs_attach && ill->ill_bcast_addr_length == 0))) {
15850                 ip1dbg(("ip_sioctl_slifname: link not broadcast capable "
15851                     "or IPv6 i.e., no broadcast \n"));
15852                 return (EINVAL);
15853         }
15854 
15855         new_flags =
15856             lifr->lifr_flags & (IFF_IPV6|IFF_IPV4|IFF_BROADCAST);
15857 
15858         if ((new_flags ^ (IFF_IPV6|IFF_IPV4)) == 0) {
15859                 ip1dbg(("ip_sioctl_slifname: flags must be exactly one of "
15860                     "IFF_IPV4 or IFF_IPV6\n"));
15861                 return (EINVAL);
15862         }
15863 
15864         /*
15865          * We always start off as IPv4, so only need to check for IPv6.
15866          */
15867         if ((new_flags & IFF_IPV6) != 0) {
15868                 ill->ill_flags |= ILLF_IPV6;
15869                 ill->ill_flags &= ~ILLF_IPV4;
15870 
15871                 if (lifr->lifr_flags & IFF_NOLINKLOCAL)
15872                         ill->ill_flags |= ILLF_NOLINKLOCAL;
15873         }
15874 
15875         if ((new_flags & IFF_BROADCAST) != 0)
15876                 ipif->ipif_flags |= IPIF_BROADCAST;
15877         else
15878                 ipif->ipif_flags &= ~IPIF_BROADCAST;
15879 
15880         /* We started off as V4. */
15881         if (ill->ill_flags & ILLF_IPV6) {
15882                 ill->ill_phyint->phyint_illv6 = ill;
15883                 ill->ill_phyint->phyint_illv4 = NULL;
15884         }
15885 
15886         return (ipif_set_values(q, mp, lifr->lifr_name, &lifr->lifr_ppa));
15887 }
15888 
15889 /* ARGSUSED */
15890 int
15891 ip_sioctl_slifname_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15892     ip_ioctl_cmd_t *ipip, void *if_req)
15893 {
15894         /*
15895          * ill_phyint_reinit merged the v4 and v6 into a single
15896          * ipsq.  We might not have been able to complete the
15897          * slifname in ipif_set_values, if we could not become
15898          * exclusive.  If so restart it here
15899          */
15900         return (ipif_set_values_tail(ipif->ipif_ill, ipif, mp, q));
15901 }
15902 
15903 /*
15904  * Return a pointer to the ipif which matches the index, IP version type and
15905  * zoneid.
15906  */
15907 ipif_t *
15908 ipif_lookup_on_ifindex(uint_t index, boolean_t isv6, zoneid_t zoneid,
15909     ip_stack_t *ipst)
15910 {
15911         ill_t   *ill;
15912         ipif_t  *ipif = NULL;
15913 
15914         ill = ill_lookup_on_ifindex(index, isv6, ipst);
15915         if (ill != NULL) {
15916                 mutex_enter(&ill->ill_lock);
15917                 for (ipif = ill->ill_ipif; ipif != NULL;
15918                     ipif = ipif->ipif_next) {
15919                         if (!IPIF_IS_CONDEMNED(ipif) && (zoneid == ALL_ZONES ||
15920                             zoneid == ipif->ipif_zoneid ||
15921                             ipif->ipif_zoneid == ALL_ZONES)) {
15922                                 ipif_refhold_locked(ipif);
15923                                 break;
15924                         }
15925                 }
15926                 mutex_exit(&ill->ill_lock);
15927                 ill_refrele(ill);
15928         }
15929         return (ipif);
15930 }
15931 
15932 /*
15933  * Change an existing physical interface's index. If the new index
15934  * is acceptable we update the index and the phyint_list_avl_by_index tree.
15935  * Finally, we update other systems which may have a dependence on the
15936  * index value.
15937  */
15938 /* ARGSUSED */
15939 int
15940 ip_sioctl_slifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
15941     ip_ioctl_cmd_t *ipip, void *ifreq)
15942 {
15943         ill_t           *ill;
15944         phyint_t        *phyi;
15945         struct ifreq    *ifr = (struct ifreq *)ifreq;
15946         struct lifreq   *lifr = (struct lifreq *)ifreq;
15947         uint_t  old_index, index;
15948         ip_stack_t      *ipst = ipif->ipif_ill->ill_ipst;
15949         avl_index_t     where;
15950 
15951         if (ipip->ipi_cmd_type == IF_CMD)
15952                 index = ifr->ifr_index;
15953         else
15954                 index = lifr->lifr_index;
15955 
15956         /*
15957          * Only allow on physical interface. Also, index zero is illegal.
15958          */
15959         ill = ipif->ipif_ill;
15960         phyi = ill->ill_phyint;
15961         if (ipif->ipif_id != 0 || index == 0 || index > IF_INDEX_MAX) {
15962                 return (EINVAL);
15963         }
15964 
15965         /* If the index is not changing, no work to do */
15966         if (phyi->phyint_ifindex == index)
15967                 return (0);
15968 
15969         /*
15970          * Use phyint_exists() to determine if the new interface index
15971          * is already in use. If the index is unused then we need to
15972          * change the phyint's position in the phyint_list_avl_by_index
15973          * tree. If we do not do this, subsequent lookups (using the new
15974          * index value) will not find the phyint.
15975          */
15976         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
15977         if (phyint_exists(index, ipst)) {
15978                 rw_exit(&ipst->ips_ill_g_lock);
15979                 return (EEXIST);
15980         }
15981 
15982         /*
15983          * The new index is unused. Set it in the phyint. However we must not
15984          * forget to trigger NE_IFINDEX_CHANGE event before the ifindex
15985          * changes. The event must be bound to old ifindex value.
15986          */
15987         ill_nic_event_dispatch(ill, 0, NE_IFINDEX_CHANGE,
15988             &index, sizeof (index));
15989 
15990         old_index = phyi->phyint_ifindex;
15991         phyi->phyint_ifindex = index;
15992 
15993         avl_remove(&ipst->ips_phyint_g_list->phyint_list_avl_by_index, phyi);
15994         (void) avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
15995             &index, &where);
15996         avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
15997             phyi, where);
15998         rw_exit(&ipst->ips_ill_g_lock);
15999 
16000         /* Update SCTP's ILL list */
16001         sctp_ill_reindex(ill, old_index);
16002 
16003         /* Send the routing sockets message */
16004         ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
16005         if (ILL_OTHER(ill))
16006                 ip_rts_ifmsg(ILL_OTHER(ill)->ill_ipif, RTSQ_DEFAULT);
16007 
16008         /* Perhaps ilgs should use this ill */
16009         update_conn_ill(NULL, ill->ill_ipst);
16010         return (0);
16011 }
16012 
16013 /* ARGSUSED */
16014 int
16015 ip_sioctl_get_lifindex(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16016     ip_ioctl_cmd_t *ipip, void *ifreq)
16017 {
16018         struct ifreq    *ifr = (struct ifreq *)ifreq;
16019         struct lifreq   *lifr = (struct lifreq *)ifreq;
16020 
16021         ip1dbg(("ip_sioctl_get_lifindex(%s:%u %p)\n",
16022             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16023         /* Get the interface index */
16024         if (ipip->ipi_cmd_type == IF_CMD) {
16025                 ifr->ifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16026         } else {
16027                 lifr->lifr_index = ipif->ipif_ill->ill_phyint->phyint_ifindex;
16028         }
16029         return (0);
16030 }
16031 
16032 /* ARGSUSED */
16033 int
16034 ip_sioctl_get_lifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16035     ip_ioctl_cmd_t *ipip, void *ifreq)
16036 {
16037         struct lifreq   *lifr = (struct lifreq *)ifreq;
16038 
16039         ip1dbg(("ip_sioctl_get_lifzone(%s:%u %p)\n",
16040             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16041         /* Get the interface zone */
16042         ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16043         lifr->lifr_zoneid = ipif->ipif_zoneid;
16044         return (0);
16045 }
16046 
16047 /*
16048  * Set the zoneid of an interface.
16049  */
16050 /* ARGSUSED */
16051 int
16052 ip_sioctl_slifzone(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16053     ip_ioctl_cmd_t *ipip, void *ifreq)
16054 {
16055         struct lifreq   *lifr = (struct lifreq *)ifreq;
16056         int err = 0;
16057         boolean_t need_up = B_FALSE;
16058         zone_t *zptr;
16059         zone_status_t status;
16060         zoneid_t zoneid;
16061 
16062         ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16063         if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES) {
16064                 if (!is_system_labeled())
16065                         return (ENOTSUP);
16066                 zoneid = GLOBAL_ZONEID;
16067         }
16068 
16069         /* cannot assign instance zero to a non-global zone */
16070         if (ipif->ipif_id == 0 && zoneid != GLOBAL_ZONEID)
16071                 return (ENOTSUP);
16072 
16073         /*
16074          * Cannot assign to a zone that doesn't exist or is shutting down.  In
16075          * the event of a race with the zone shutdown processing, since IP
16076          * serializes this ioctl and SIOCGLIFCONF/SIOCLIFREMOVEIF, we know the
16077          * interface will be cleaned up even if the zone is shut down
16078          * immediately after the status check. If the interface can't be brought
16079          * down right away, and the zone is shut down before the restart
16080          * function is called, we resolve the possible races by rechecking the
16081          * zone status in the restart function.
16082          */
16083         if ((zptr = zone_find_by_id(zoneid)) == NULL)
16084                 return (EINVAL);
16085         status = zone_status_get(zptr);
16086         zone_rele(zptr);
16087 
16088         if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING)
16089                 return (EINVAL);
16090 
16091         if (ipif->ipif_flags & IPIF_UP) {
16092                 /*
16093                  * If the interface is already marked up,
16094                  * we call ipif_down which will take care
16095                  * of ditching any IREs that have been set
16096                  * up based on the old interface address.
16097                  */
16098                 err = ipif_logical_down(ipif, q, mp);
16099                 if (err == EINPROGRESS)
16100                         return (err);
16101                 (void) ipif_down_tail(ipif);
16102                 need_up = B_TRUE;
16103         }
16104 
16105         err = ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp, need_up);
16106         return (err);
16107 }
16108 
16109 static int
16110 ip_sioctl_slifzone_tail(ipif_t *ipif, zoneid_t zoneid,
16111     queue_t *q, mblk_t *mp, boolean_t need_up)
16112 {
16113         int     err = 0;
16114         ip_stack_t      *ipst;
16115 
16116         ip1dbg(("ip_sioctl_zoneid_tail(%s:%u %p)\n",
16117             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16118 
16119         if (CONN_Q(q))
16120                 ipst = CONNQ_TO_IPST(q);
16121         else
16122                 ipst = ILLQ_TO_IPST(q);
16123 
16124         /*
16125          * For exclusive stacks we don't allow a different zoneid than
16126          * global.
16127          */
16128         if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID &&
16129             zoneid != GLOBAL_ZONEID)
16130                 return (EINVAL);
16131 
16132         /* Set the new zone id. */
16133         ipif->ipif_zoneid = zoneid;
16134 
16135         /* Update sctp list */
16136         sctp_update_ipif(ipif, SCTP_IPIF_UPDATE);
16137 
16138         /* The default multicast interface might have changed */
16139         ire_increment_multicast_generation(ipst, ipif->ipif_ill->ill_isv6);
16140 
16141         if (need_up) {
16142                 /*
16143                  * Now bring the interface back up.  If this
16144                  * is the only IPIF for the ILL, ipif_up
16145                  * will have to re-bind to the device, so
16146                  * we may get back EINPROGRESS, in which
16147                  * case, this IOCTL will get completed in
16148                  * ip_rput_dlpi when we see the DL_BIND_ACK.
16149                  */
16150                 err = ipif_up(ipif, q, mp);
16151         }
16152         return (err);
16153 }
16154 
16155 /* ARGSUSED */
16156 int
16157 ip_sioctl_slifzone_restart(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16158     ip_ioctl_cmd_t *ipip, void *if_req)
16159 {
16160         struct lifreq *lifr = (struct lifreq *)if_req;
16161         zoneid_t zoneid;
16162         zone_t *zptr;
16163         zone_status_t status;
16164 
16165         ASSERT(ipip->ipi_cmd_type == LIF_CMD);
16166         if ((zoneid = lifr->lifr_zoneid) == ALL_ZONES)
16167                 zoneid = GLOBAL_ZONEID;
16168 
16169         ip1dbg(("ip_sioctl_slifzone_restart(%s:%u %p)\n",
16170             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16171 
16172         /*
16173          * We recheck the zone status to resolve the following race condition:
16174          * 1) process sends SIOCSLIFZONE to put hme0:1 in zone "myzone";
16175          * 2) hme0:1 is up and can't be brought down right away;
16176          * ip_sioctl_slifzone() returns EINPROGRESS and the request is queued;
16177          * 3) zone "myzone" is halted; the zone status switches to
16178          * 'shutting_down' and the zones framework sends SIOCGLIFCONF to list
16179          * the interfaces to remove - hme0:1 is not returned because it's not
16180          * yet in "myzone", so it won't be removed;
16181          * 4) the restart function for SIOCSLIFZONE is called; without the
16182          * status check here, we would have hme0:1 in "myzone" after it's been
16183          * destroyed.
16184          * Note that if the status check fails, we need to bring the interface
16185          * back to its state prior to ip_sioctl_slifzone(), hence the call to
16186          * ipif_up_done[_v6]().
16187          */
16188         status = ZONE_IS_UNINITIALIZED;
16189         if ((zptr = zone_find_by_id(zoneid)) != NULL) {
16190                 status = zone_status_get(zptr);
16191                 zone_rele(zptr);
16192         }
16193         if (status != ZONE_IS_READY && status != ZONE_IS_RUNNING) {
16194                 if (ipif->ipif_isv6) {
16195                         (void) ipif_up_done_v6(ipif);
16196                 } else {
16197                         (void) ipif_up_done(ipif);
16198                 }
16199                 return (EINVAL);
16200         }
16201 
16202         (void) ipif_down_tail(ipif);
16203 
16204         return (ip_sioctl_slifzone_tail(ipif, lifr->lifr_zoneid, q, mp,
16205             B_TRUE));
16206 }
16207 
16208 /*
16209  * Return the number of addresses on `ill' with one or more of the values
16210  * in `set' set and all of the values in `clear' clear.
16211  */
16212 static uint_t
16213 ill_flagaddr_cnt(const ill_t *ill, uint64_t set, uint64_t clear)
16214 {
16215         ipif_t  *ipif;
16216         uint_t  cnt = 0;
16217 
16218         ASSERT(IAM_WRITER_ILL(ill));
16219 
16220         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next)
16221                 if ((ipif->ipif_flags & set) && !(ipif->ipif_flags & clear))
16222                         cnt++;
16223 
16224         return (cnt);
16225 }
16226 
16227 /*
16228  * Return the number of migratable addresses on `ill' that are under
16229  * application control.
16230  */
16231 uint_t
16232 ill_appaddr_cnt(const ill_t *ill)
16233 {
16234         return (ill_flagaddr_cnt(ill, IPIF_DHCPRUNNING | IPIF_ADDRCONF,
16235             IPIF_NOFAILOVER));
16236 }
16237 
16238 /*
16239  * Return the number of point-to-point addresses on `ill'.
16240  */
16241 uint_t
16242 ill_ptpaddr_cnt(const ill_t *ill)
16243 {
16244         return (ill_flagaddr_cnt(ill, IPIF_POINTOPOINT, 0));
16245 }
16246 
16247 /* ARGSUSED */
16248 int
16249 ip_sioctl_get_lifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16250         ip_ioctl_cmd_t *ipip, void *ifreq)
16251 {
16252         struct lifreq   *lifr = ifreq;
16253 
16254         ASSERT(q->q_next == NULL);
16255         ASSERT(CONN_Q(q));
16256 
16257         ip1dbg(("ip_sioctl_get_lifusesrc(%s:%u %p)\n",
16258             ipif->ipif_ill->ill_name, ipif->ipif_id, (void *)ipif));
16259         lifr->lifr_index = ipif->ipif_ill->ill_usesrc_ifindex;
16260         ip1dbg(("ip_sioctl_get_lifusesrc:lifr_index = %d\n", lifr->lifr_index));
16261 
16262         return (0);
16263 }
16264 
16265 /* Find the previous ILL in this usesrc group */
16266 static ill_t *
16267 ill_prev_usesrc(ill_t *uill)
16268 {
16269         ill_t *ill;
16270 
16271         for (ill = uill->ill_usesrc_grp_next;
16272             ASSERT(ill), ill->ill_usesrc_grp_next != uill;
16273             ill = ill->ill_usesrc_grp_next)
16274                 /* do nothing */;
16275         return (ill);
16276 }
16277 
16278 /*
16279  * Release all members of the usesrc group. This routine is called
16280  * from ill_delete when the interface being unplumbed is the
16281  * group head.
16282  *
16283  * This silently clears the usesrc that ifconfig setup.
16284  * An alternative would be to keep that ifindex, and drop packets on the floor
16285  * since no source address can be selected.
16286  * Even if we keep the current semantics, don't need a lock and a linked list.
16287  * Can walk all the ills checking if they have a ill_usesrc_ifindex matching
16288  * the one that is being removed. Issue is how we return the usesrc users
16289  * (SIOCGLIFSRCOF). We want to be able to find the ills which have an
16290  * ill_usesrc_ifindex matching a target ill. We could also do that with an
16291  * ill walk, but the walker would need to insert in the ioctl response.
16292  */
16293 static void
16294 ill_disband_usesrc_group(ill_t *uill)
16295 {
16296         ill_t *next_ill, *tmp_ill;
16297         ip_stack_t      *ipst = uill->ill_ipst;
16298 
16299         ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16300         next_ill = uill->ill_usesrc_grp_next;
16301 
16302         do {
16303                 ASSERT(next_ill != NULL);
16304                 tmp_ill = next_ill->ill_usesrc_grp_next;
16305                 ASSERT(tmp_ill != NULL);
16306                 next_ill->ill_usesrc_grp_next = NULL;
16307                 next_ill->ill_usesrc_ifindex = 0;
16308                 next_ill = tmp_ill;
16309         } while (next_ill->ill_usesrc_ifindex != 0);
16310         uill->ill_usesrc_grp_next = NULL;
16311 }
16312 
16313 /*
16314  * Remove the client usesrc ILL from the list and relink to a new list
16315  */
16316 int
16317 ill_relink_usesrc_ills(ill_t *ucill, ill_t *uill, uint_t ifindex)
16318 {
16319         ill_t *ill, *tmp_ill;
16320         ip_stack_t      *ipst = ucill->ill_ipst;
16321 
16322         ASSERT((ucill != NULL) && (ucill->ill_usesrc_grp_next != NULL) &&
16323             (uill != NULL) && RW_WRITE_HELD(&ipst->ips_ill_g_usesrc_lock));
16324 
16325         /*
16326          * Check if the usesrc client ILL passed in is not already
16327          * in use as a usesrc ILL i.e one whose source address is
16328          * in use OR a usesrc ILL is not already in use as a usesrc
16329          * client ILL
16330          */
16331         if ((ucill->ill_usesrc_ifindex == 0) ||
16332             (uill->ill_usesrc_ifindex != 0)) {
16333                 return (-1);
16334         }
16335 
16336         ill = ill_prev_usesrc(ucill);
16337         ASSERT(ill->ill_usesrc_grp_next != NULL);
16338 
16339         /* Remove from the current list */
16340         if (ill->ill_usesrc_grp_next->ill_usesrc_grp_next == ill) {
16341                 /* Only two elements in the list */
16342                 ASSERT(ill->ill_usesrc_ifindex == 0);
16343                 ill->ill_usesrc_grp_next = NULL;
16344         } else {
16345                 ill->ill_usesrc_grp_next = ucill->ill_usesrc_grp_next;
16346         }
16347 
16348         if (ifindex == 0) {
16349                 ucill->ill_usesrc_ifindex = 0;
16350                 ucill->ill_usesrc_grp_next = NULL;
16351                 return (0);
16352         }
16353 
16354         ucill->ill_usesrc_ifindex = ifindex;
16355         tmp_ill = uill->ill_usesrc_grp_next;
16356         uill->ill_usesrc_grp_next = ucill;
16357         ucill->ill_usesrc_grp_next =
16358             (tmp_ill != NULL) ? tmp_ill : uill;
16359         return (0);
16360 }
16361 
16362 /*
16363  * Set the ill_usesrc and ill_usesrc_head fields. See synchronization notes in
16364  * ip.c for locking details.
16365  */
16366 /* ARGSUSED */
16367 int
16368 ip_sioctl_slifusesrc(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16369     ip_ioctl_cmd_t *ipip, void *ifreq)
16370 {
16371         struct lifreq *lifr = (struct lifreq *)ifreq;
16372         boolean_t isv6 = B_FALSE, reset_flg = B_FALSE;
16373         ill_t *usesrc_ill, *usesrc_cli_ill = ipif->ipif_ill;
16374         int err = 0, ret;
16375         uint_t ifindex;
16376         ipsq_t *ipsq = NULL;
16377         ip_stack_t      *ipst = ipif->ipif_ill->ill_ipst;
16378 
16379         ASSERT(IAM_WRITER_IPIF(ipif));
16380         ASSERT(q->q_next == NULL);
16381         ASSERT(CONN_Q(q));
16382 
16383         isv6 = (Q_TO_CONN(q))->conn_family == AF_INET6;
16384 
16385         ifindex = lifr->lifr_index;
16386         if (ifindex == 0) {
16387                 if (usesrc_cli_ill->ill_usesrc_grp_next == NULL) {
16388                         /* non usesrc group interface, nothing to reset */
16389                         return (0);
16390                 }
16391                 ifindex = usesrc_cli_ill->ill_usesrc_ifindex;
16392                 /* valid reset request */
16393                 reset_flg = B_TRUE;
16394         }
16395 
16396         usesrc_ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
16397         if (usesrc_ill == NULL)
16398                 return (ENXIO);
16399         if (usesrc_ill == ipif->ipif_ill) {
16400                 ill_refrele(usesrc_ill);
16401                 return (EINVAL);
16402         }
16403 
16404         ipsq = ipsq_try_enter(NULL, usesrc_ill, q, mp, ip_process_ioctl,
16405             NEW_OP, B_TRUE);
16406         if (ipsq == NULL) {
16407                 err = EINPROGRESS;
16408                 /* Operation enqueued on the ipsq of the usesrc ILL */
16409                 goto done;
16410         }
16411 
16412         /* USESRC isn't currently supported with IPMP */
16413         if (IS_IPMP(usesrc_ill) || IS_UNDER_IPMP(usesrc_ill)) {
16414                 err = ENOTSUP;
16415                 goto done;
16416         }
16417 
16418         /*
16419          * USESRC isn't compatible with the STANDBY flag.  (STANDBY is only
16420          * used by IPMP underlying interfaces, but someone might think it's
16421          * more general and try to use it independently with VNI.)
16422          */
16423         if (usesrc_ill->ill_phyint->phyint_flags & PHYI_STANDBY) {
16424                 err = ENOTSUP;
16425                 goto done;
16426         }
16427 
16428         /*
16429          * If the client is already in use as a usesrc_ill or a usesrc_ill is
16430          * already a client then return EINVAL
16431          */
16432         if (IS_USESRC_ILL(usesrc_cli_ill) || IS_USESRC_CLI_ILL(usesrc_ill)) {
16433                 err = EINVAL;
16434                 goto done;
16435         }
16436 
16437         /*
16438          * If the ill_usesrc_ifindex field is already set to what it needs to
16439          * be then this is a duplicate operation.
16440          */
16441         if (!reset_flg && usesrc_cli_ill->ill_usesrc_ifindex == ifindex) {
16442                 err = 0;
16443                 goto done;
16444         }
16445 
16446         ip1dbg(("ip_sioctl_slifusesrc: usesrc_cli_ill %s, usesrc_ill %s,"
16447             " v6 = %d", usesrc_cli_ill->ill_name, usesrc_ill->ill_name,
16448             usesrc_ill->ill_isv6));
16449 
16450         /*
16451          * ill_g_usesrc_lock global lock protects the ill_usesrc_grp_next
16452          * and the ill_usesrc_ifindex fields
16453          */
16454         rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
16455 
16456         if (reset_flg) {
16457                 ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill, 0);
16458                 if (ret != 0) {
16459                         err = EINVAL;
16460                 }
16461                 rw_exit(&ipst->ips_ill_g_usesrc_lock);
16462                 goto done;
16463         }
16464 
16465         /*
16466          * Four possibilities to consider:
16467          * 1. Both usesrc_ill and usesrc_cli_ill are not part of any usesrc grp
16468          * 2. usesrc_ill is part of a group but usesrc_cli_ill isn't
16469          * 3. usesrc_cli_ill is part of a group but usesrc_ill isn't
16470          * 4. Both are part of their respective usesrc groups
16471          */
16472         if ((usesrc_ill->ill_usesrc_grp_next == NULL) &&
16473             (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16474                 ASSERT(usesrc_ill->ill_usesrc_ifindex == 0);
16475                 usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16476                 usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16477                 usesrc_cli_ill->ill_usesrc_grp_next = usesrc_ill;
16478         } else if ((usesrc_ill->ill_usesrc_grp_next != NULL) &&
16479             (usesrc_cli_ill->ill_usesrc_grp_next == NULL)) {
16480                 usesrc_cli_ill->ill_usesrc_ifindex = ifindex;
16481                 /* Insert at head of list */
16482                 usesrc_cli_ill->ill_usesrc_grp_next =
16483                     usesrc_ill->ill_usesrc_grp_next;
16484                 usesrc_ill->ill_usesrc_grp_next = usesrc_cli_ill;
16485         } else {
16486                 ret = ill_relink_usesrc_ills(usesrc_cli_ill, usesrc_ill,
16487                     ifindex);
16488                 if (ret != 0)
16489                         err = EINVAL;
16490         }
16491         rw_exit(&ipst->ips_ill_g_usesrc_lock);
16492 
16493 done:
16494         if (ipsq != NULL)
16495                 ipsq_exit(ipsq);
16496         /* The refrele on the lifr_name ipif is done by ip_process_ioctl */
16497         ill_refrele(usesrc_ill);
16498 
16499         /* Let conn_ixa caching know that source address selection changed */
16500         ip_update_source_selection(ipst);
16501 
16502         return (err);
16503 }
16504 
16505 /* ARGSUSED */
16506 int
16507 ip_sioctl_get_dadstate(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
16508     ip_ioctl_cmd_t *ipip, void *if_req)
16509 {
16510         struct lifreq   *lifr = (struct lifreq *)if_req;
16511         ill_t           *ill = ipif->ipif_ill;
16512 
16513         /*
16514          * Need a lock since IFF_UP can be set even when there are
16515          * references to the ipif.
16516          */
16517         mutex_enter(&ill->ill_lock);
16518         if ((ipif->ipif_flags & IPIF_UP) && ipif->ipif_addr_ready == 0)
16519                 lifr->lifr_dadstate = DAD_IN_PROGRESS;
16520         else
16521                 lifr->lifr_dadstate = DAD_DONE;
16522         mutex_exit(&ill->ill_lock);
16523         return (0);
16524 }
16525 
16526 /*
16527  * comparison function used by avl.
16528  */
16529 static int
16530 ill_phyint_compare_index(const void *index_ptr, const void *phyip)
16531 {
16532 
16533         uint_t index;
16534 
16535         ASSERT(phyip != NULL && index_ptr != NULL);
16536 
16537         index = *((uint_t *)index_ptr);
16538         /*
16539          * let the phyint with the lowest index be on top.
16540          */
16541         if (((phyint_t *)phyip)->phyint_ifindex < index)
16542                 return (1);
16543         if (((phyint_t *)phyip)->phyint_ifindex > index)
16544                 return (-1);
16545         return (0);
16546 }
16547 
16548 /*
16549  * comparison function used by avl.
16550  */
16551 static int
16552 ill_phyint_compare_name(const void *name_ptr, const void *phyip)
16553 {
16554         ill_t *ill;
16555         int res = 0;
16556 
16557         ASSERT(phyip != NULL && name_ptr != NULL);
16558 
16559         if (((phyint_t *)phyip)->phyint_illv4)
16560                 ill = ((phyint_t *)phyip)->phyint_illv4;
16561         else
16562                 ill = ((phyint_t *)phyip)->phyint_illv6;
16563         ASSERT(ill != NULL);
16564 
16565         res = strcmp(ill->ill_name, (char *)name_ptr);
16566         if (res > 0)
16567                 return (1);
16568         else if (res < 0)
16569                 return (-1);
16570         return (0);
16571 }
16572 
16573 /*
16574  * This function is called on the unplumb path via ill_glist_delete() when
16575  * there are no ills left on the phyint and thus the phyint can be freed.
16576  */
16577 static void
16578 phyint_free(phyint_t *phyi)
16579 {
16580         ip_stack_t *ipst = PHYINT_TO_IPST(phyi);
16581 
16582         ASSERT(phyi->phyint_illv4 == NULL && phyi->phyint_illv6 == NULL);
16583 
16584         /*
16585          * If this phyint was an IPMP meta-interface, blow away the group.
16586          * This is safe to do because all of the illgrps have already been
16587          * removed by I_PUNLINK, and thus SIOCSLIFGROUPNAME cannot find us.
16588          * If we're cleaning up as a result of failed initialization,
16589          * phyint_grp may be NULL.
16590          */
16591         if ((phyi->phyint_flags & PHYI_IPMP) && (phyi->phyint_grp != NULL)) {
16592                 rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16593                 ipmp_grp_destroy(phyi->phyint_grp);
16594                 phyi->phyint_grp = NULL;
16595                 rw_exit(&ipst->ips_ipmp_lock);
16596         }
16597 
16598         /*
16599          * If this interface was under IPMP, take it out of the group.
16600          */
16601         if (phyi->phyint_grp != NULL)
16602                 ipmp_phyint_leave_grp(phyi);
16603 
16604         /*
16605          * Delete the phyint and disassociate its ipsq.  The ipsq itself
16606          * will be freed in ipsq_exit().
16607          */
16608         phyi->phyint_ipsq->ipsq_phyint = NULL;
16609         phyi->phyint_name[0] = '\0';
16610 
16611         mi_free(phyi);
16612 }
16613 
16614 /*
16615  * Attach the ill to the phyint structure which can be shared by both
16616  * IPv4 and IPv6 ill. ill_init allocates a phyint to just hold flags. This
16617  * function is called from ipif_set_values and ill_lookup_on_name (for
16618  * loopback) where we know the name of the ill. We lookup the ill and if
16619  * there is one present already with the name use that phyint. Otherwise
16620  * reuse the one allocated by ill_init.
16621  */
16622 static void
16623 ill_phyint_reinit(ill_t *ill)
16624 {
16625         boolean_t isv6 = ill->ill_isv6;
16626         phyint_t *phyi_old;
16627         phyint_t *phyi;
16628         avl_index_t where = 0;
16629         ill_t   *ill_other = NULL;
16630         ip_stack_t      *ipst = ill->ill_ipst;
16631 
16632         ASSERT(RW_WRITE_HELD(&ipst->ips_ill_g_lock));
16633 
16634         phyi_old = ill->ill_phyint;
16635         ASSERT(isv6 || (phyi_old->phyint_illv4 == ill &&
16636             phyi_old->phyint_illv6 == NULL));
16637         ASSERT(!isv6 || (phyi_old->phyint_illv6 == ill &&
16638             phyi_old->phyint_illv4 == NULL));
16639         ASSERT(phyi_old->phyint_ifindex == 0);
16640 
16641         /*
16642          * Now that our ill has a name, set it in the phyint.
16643          */
16644         (void) strlcpy(ill->ill_phyint->phyint_name, ill->ill_name, LIFNAMSIZ);
16645 
16646         phyi = avl_find(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16647             ill->ill_name, &where);
16648 
16649         /*
16650          * 1. We grabbed the ill_g_lock before inserting this ill into
16651          *    the global list of ills. So no other thread could have located
16652          *    this ill and hence the ipsq of this ill is guaranteed to be empty.
16653          * 2. Now locate the other protocol instance of this ill.
16654          * 3. Now grab both ill locks in the right order, and the phyint lock of
16655          *    the new ipsq. Holding ill locks + ill_g_lock ensures that the ipsq
16656          *    of neither ill can change.
16657          * 4. Merge the phyint and thus the ipsq as well of this ill onto the
16658          *    other ill.
16659          * 5. Release all locks.
16660          */
16661 
16662         /*
16663          * Look for IPv4 if we are initializing IPv6 or look for IPv6 if
16664          * we are initializing IPv4.
16665          */
16666         if (phyi != NULL) {
16667                 ill_other = (isv6) ? phyi->phyint_illv4 : phyi->phyint_illv6;
16668                 ASSERT(ill_other->ill_phyint != NULL);
16669                 ASSERT((isv6 && !ill_other->ill_isv6) ||
16670                     (!isv6 && ill_other->ill_isv6));
16671                 GRAB_ILL_LOCKS(ill, ill_other);
16672                 /*
16673                  * We are potentially throwing away phyint_flags which
16674                  * could be different from the one that we obtain from
16675                  * ill_other->ill_phyint. But it is okay as we are assuming
16676                  * that the state maintained within IP is correct.
16677                  */
16678                 mutex_enter(&phyi->phyint_lock);
16679                 if (isv6) {
16680                         ASSERT(phyi->phyint_illv6 == NULL);
16681                         phyi->phyint_illv6 = ill;
16682                 } else {
16683                         ASSERT(phyi->phyint_illv4 == NULL);
16684                         phyi->phyint_illv4 = ill;
16685                 }
16686 
16687                 /*
16688                  * Delete the old phyint and make its ipsq eligible
16689                  * to be freed in ipsq_exit().
16690                  */
16691                 phyi_old->phyint_illv4 = NULL;
16692                 phyi_old->phyint_illv6 = NULL;
16693                 phyi_old->phyint_ipsq->ipsq_phyint = NULL;
16694                 phyi_old->phyint_name[0] = '\0';
16695                 mi_free(phyi_old);
16696         } else {
16697                 mutex_enter(&ill->ill_lock);
16698                 /*
16699                  * We don't need to acquire any lock, since
16700                  * the ill is not yet visible globally  and we
16701                  * have not yet released the ill_g_lock.
16702                  */
16703                 phyi = phyi_old;
16704                 mutex_enter(&phyi->phyint_lock);
16705                 /* XXX We need a recovery strategy here. */
16706                 if (!phyint_assign_ifindex(phyi, ipst))
16707                         cmn_err(CE_PANIC, "phyint_assign_ifindex() failed");
16708 
16709                 avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
16710                     (void *)phyi, where);
16711 
16712                 (void) avl_find(&ipst->ips_phyint_g_list->
16713                     phyint_list_avl_by_index,
16714                     &phyi->phyint_ifindex, &where);
16715                 avl_insert(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
16716                     (void *)phyi, where);
16717         }
16718 
16719         /*
16720          * Reassigning ill_phyint automatically reassigns the ipsq also.
16721          * pending mp is not affected because that is per ill basis.
16722          */
16723         ill->ill_phyint = phyi;
16724 
16725         /*
16726          * Now that the phyint's ifindex has been assigned, complete the
16727          * remaining
16728          */
16729         ill->ill_ip_mib->ipIfStatsIfIndex = ill->ill_phyint->phyint_ifindex;
16730         if (ill->ill_isv6) {
16731                 ill->ill_icmp6_mib->ipv6IfIcmpIfIndex =
16732                     ill->ill_phyint->phyint_ifindex;
16733                 ill->ill_mcast_type = ipst->ips_mld_max_version;
16734         } else {
16735                 ill->ill_mcast_type = ipst->ips_igmp_max_version;
16736         }
16737 
16738         /*
16739          * Generate an event within the hooks framework to indicate that
16740          * a new interface has just been added to IP.  For this event to
16741          * be generated, the network interface must, at least, have an
16742          * ifindex assigned to it.  (We don't generate the event for
16743          * loopback since ill_lookup_on_name() has its own NE_PLUMB event.)
16744          *
16745          * This needs to be run inside the ill_g_lock perimeter to ensure
16746          * that the ordering of delivered events to listeners matches the
16747          * order of them in the kernel.
16748          */
16749         if (!IS_LOOPBACK(ill)) {
16750                 ill_nic_event_dispatch(ill, 0, NE_PLUMB, ill->ill_name,
16751                     ill->ill_name_length);
16752         }
16753         RELEASE_ILL_LOCKS(ill, ill_other);
16754         mutex_exit(&phyi->phyint_lock);
16755 }
16756 
16757 /*
16758  * Notify any downstream modules of the name of this interface.
16759  * An M_IOCTL is used even though we don't expect a successful reply.
16760  * Any reply message from the driver (presumably an M_IOCNAK) will
16761  * eventually get discarded somewhere upstream.  The message format is
16762  * simply an SIOCSLIFNAME ioctl just as might be sent from ifconfig
16763  * to IP.
16764  */
16765 static void
16766 ip_ifname_notify(ill_t *ill, queue_t *q)
16767 {
16768         mblk_t *mp1, *mp2;
16769         struct iocblk *iocp;
16770         struct lifreq *lifr;
16771 
16772         mp1 = mkiocb(SIOCSLIFNAME);
16773         if (mp1 == NULL)
16774                 return;
16775         mp2 = allocb(sizeof (struct lifreq), BPRI_HI);
16776         if (mp2 == NULL) {
16777                 freeb(mp1);
16778                 return;
16779         }
16780 
16781         mp1->b_cont = mp2;
16782         iocp = (struct iocblk *)mp1->b_rptr;
16783         iocp->ioc_count = sizeof (struct lifreq);
16784 
16785         lifr = (struct lifreq *)mp2->b_rptr;
16786         mp2->b_wptr += sizeof (struct lifreq);
16787         bzero(lifr, sizeof (struct lifreq));
16788 
16789         (void) strncpy(lifr->lifr_name, ill->ill_name, LIFNAMSIZ);
16790         lifr->lifr_ppa = ill->ill_ppa;
16791         lifr->lifr_flags = (ill->ill_flags & (ILLF_IPV4|ILLF_IPV6));
16792 
16793         DTRACE_PROBE3(ill__dlpi, char *, "ip_ifname_notify",
16794             char *, "SIOCSLIFNAME", ill_t *, ill);
16795         putnext(q, mp1);
16796 }
16797 
16798 static int
16799 ipif_set_values_tail(ill_t *ill, ipif_t *ipif, mblk_t *mp, queue_t *q)
16800 {
16801         int             err;
16802         ip_stack_t      *ipst = ill->ill_ipst;
16803         phyint_t        *phyi = ill->ill_phyint;
16804 
16805         /*
16806          * Now that ill_name is set, the configuration for the IPMP
16807          * meta-interface can be performed.
16808          */
16809         if (IS_IPMP(ill)) {
16810                 rw_enter(&ipst->ips_ipmp_lock, RW_WRITER);
16811                 /*
16812                  * If phyi->phyint_grp is NULL, then this is the first IPMP
16813                  * meta-interface and we need to create the IPMP group.
16814                  */
16815                 if (phyi->phyint_grp == NULL) {
16816                         /*
16817                          * If someone has renamed another IPMP group to have
16818                          * the same name as our interface, bail.
16819                          */
16820                         if (ipmp_grp_lookup(ill->ill_name, ipst) != NULL) {
16821                                 rw_exit(&ipst->ips_ipmp_lock);
16822                                 return (EEXIST);
16823                         }
16824                         phyi->phyint_grp = ipmp_grp_create(ill->ill_name, phyi);
16825                         if (phyi->phyint_grp == NULL) {
16826                                 rw_exit(&ipst->ips_ipmp_lock);
16827                                 return (ENOMEM);
16828                         }
16829                 }
16830                 rw_exit(&ipst->ips_ipmp_lock);
16831         }
16832 
16833         /* Tell downstream modules where they are. */
16834         ip_ifname_notify(ill, q);
16835 
16836         /*
16837          * ill_dl_phys returns EINPROGRESS in the usual case.
16838          * Error cases are ENOMEM ...
16839          */
16840         err = ill_dl_phys(ill, ipif, mp, q);
16841 
16842         if (ill->ill_isv6) {
16843                 mutex_enter(&ipst->ips_mld_slowtimeout_lock);
16844                 if (ipst->ips_mld_slowtimeout_id == 0) {
16845                         ipst->ips_mld_slowtimeout_id = timeout(mld_slowtimo,
16846                             (void *)ipst,
16847                             MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16848                 }
16849                 mutex_exit(&ipst->ips_mld_slowtimeout_lock);
16850         } else {
16851                 mutex_enter(&ipst->ips_igmp_slowtimeout_lock);
16852                 if (ipst->ips_igmp_slowtimeout_id == 0) {
16853                         ipst->ips_igmp_slowtimeout_id = timeout(igmp_slowtimo,
16854                             (void *)ipst,
16855                             MSEC_TO_TICK(MCAST_SLOWTIMO_INTERVAL));
16856                 }
16857                 mutex_exit(&ipst->ips_igmp_slowtimeout_lock);
16858         }
16859 
16860         return (err);
16861 }
16862 
16863 /*
16864  * Common routine for ppa and ifname setting. Should be called exclusive.
16865  *
16866  * Returns EINPROGRESS when mp has been consumed by queueing it on
16867  * ipx_pending_mp and the ioctl will complete in ip_rput.
16868  *
16869  * NOTE : If ppa is UNIT_MAX, we assign the next valid ppa and return
16870  * the new name and new ppa in lifr_name and lifr_ppa respectively.
16871  * For SLIFNAME, we pass these values back to the userland.
16872  */
16873 static int
16874 ipif_set_values(queue_t *q, mblk_t *mp, char *interf_name, uint_t *new_ppa_ptr)
16875 {
16876         ill_t   *ill;
16877         ipif_t  *ipif;
16878         ipsq_t  *ipsq;
16879         char    *ppa_ptr;
16880         char    *old_ptr;
16881         char    old_char;
16882         int     error;
16883         ip_stack_t      *ipst;
16884 
16885         ip1dbg(("ipif_set_values: interface %s\n", interf_name));
16886         ASSERT(q->q_next != NULL);
16887         ASSERT(interf_name != NULL);
16888 
16889         ill = (ill_t *)q->q_ptr;
16890         ipst = ill->ill_ipst;
16891 
16892         ASSERT(ill->ill_ipst != NULL);
16893         ASSERT(ill->ill_name[0] == '\0');
16894         ASSERT(IAM_WRITER_ILL(ill));
16895         ASSERT((mi_strlen(interf_name) + 1) <= LIFNAMSIZ);
16896         ASSERT(ill->ill_ppa == UINT_MAX);
16897 
16898         ill->ill_defend_start = ill->ill_defend_count = 0;
16899         /* The ppa is sent down by ifconfig or is chosen */
16900         if ((ppa_ptr = ill_get_ppa_ptr(interf_name)) == NULL) {
16901                 return (EINVAL);
16902         }
16903 
16904         /*
16905          * make sure ppa passed in is same as ppa in the name.
16906          * This check is not made when ppa == UINT_MAX in that case ppa
16907          * in the name could be anything. System will choose a ppa and
16908          * update new_ppa_ptr and inter_name to contain the choosen ppa.
16909          */
16910         if (*new_ppa_ptr != UINT_MAX) {
16911                 /* stoi changes the pointer */
16912                 old_ptr = ppa_ptr;
16913                 /*
16914                  * ifconfig passed in 0 for the ppa for DLPI 1 style devices
16915                  * (they don't have an externally visible ppa).  We assign one
16916                  * here so that we can manage the interface.  Note that in
16917                  * the past this value was always 0 for DLPI 1 drivers.
16918                  */
16919                 if (*new_ppa_ptr == 0)
16920                         *new_ppa_ptr = stoi(&old_ptr);
16921                 else if (*new_ppa_ptr != (uint_t)stoi(&old_ptr))
16922                         return (EINVAL);
16923         }
16924         /*
16925          * terminate string before ppa
16926          * save char at that location.
16927          */
16928         old_char = ppa_ptr[0];
16929         ppa_ptr[0] = '\0';
16930 
16931         ill->ill_ppa = *new_ppa_ptr;
16932         /*
16933          * Finish as much work now as possible before calling ill_glist_insert
16934          * which makes the ill globally visible and also merges it with the
16935          * other protocol instance of this phyint. The remaining work is
16936          * done after entering the ipsq which may happen sometime later.
16937          */
16938         ipif = ill->ill_ipif;
16939 
16940         /* We didn't do this when we allocated ipif in ip_ll_subnet_defaults */
16941         ipif_assign_seqid(ipif);
16942 
16943         if (!(ill->ill_flags & (ILLF_IPV4|ILLF_IPV6)))
16944                 ill->ill_flags |= ILLF_IPV4;
16945 
16946         ASSERT(ipif->ipif_next == NULL);     /* Only one ipif on ill */
16947         ASSERT((ipif->ipif_flags & IPIF_UP) == 0);
16948 
16949         if (ill->ill_flags & ILLF_IPV6) {
16950 
16951                 ill->ill_isv6 = B_TRUE;
16952                 ill_set_inputfn(ill);
16953                 if (ill->ill_rq != NULL) {
16954                         ill->ill_rq->q_qinfo = &iprinitv6;
16955                 }
16956 
16957                 /* Keep the !IN6_IS_ADDR_V4MAPPED assertions happy */
16958                 ipif->ipif_v6lcl_addr = ipv6_all_zeros;
16959                 ipif->ipif_v6subnet = ipv6_all_zeros;
16960                 ipif->ipif_v6net_mask = ipv6_all_zeros;
16961                 ipif->ipif_v6brd_addr = ipv6_all_zeros;
16962                 ipif->ipif_v6pp_dst_addr = ipv6_all_zeros;
16963                 ill->ill_reachable_retrans_time = ND_RETRANS_TIMER;
16964                 /*
16965                  * point-to-point or Non-mulicast capable
16966                  * interfaces won't do NUD unless explicitly
16967                  * configured to do so.
16968                  */
16969                 if (ipif->ipif_flags & IPIF_POINTOPOINT ||
16970                     !(ill->ill_flags & ILLF_MULTICAST)) {
16971                         ill->ill_flags |= ILLF_NONUD;
16972                 }
16973                 /* Make sure IPv4 specific flag is not set on IPv6 if */
16974                 if (ill->ill_flags & ILLF_NOARP) {
16975                         /*
16976                          * Note: xresolv interfaces will eventually need
16977                          * NOARP set here as well, but that will require
16978                          * those external resolvers to have some
16979                          * knowledge of that flag and act appropriately.
16980                          * Not to be changed at present.
16981                          */
16982                         ill->ill_flags &= ~ILLF_NOARP;
16983                 }
16984                 /*
16985                  * Set the ILLF_ROUTER flag according to the global
16986                  * IPv6 forwarding policy.
16987                  */
16988                 if (ipst->ips_ipv6_forwarding != 0)
16989                         ill->ill_flags |= ILLF_ROUTER;
16990         } else if (ill->ill_flags & ILLF_IPV4) {
16991                 ill->ill_isv6 = B_FALSE;
16992                 ill_set_inputfn(ill);
16993                 ill->ill_reachable_retrans_time = ARP_RETRANS_TIMER;
16994                 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6lcl_addr);
16995                 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6subnet);
16996                 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6net_mask);
16997                 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6brd_addr);
16998                 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &ipif->ipif_v6pp_dst_addr);
16999                 /*
17000                  * Set the ILLF_ROUTER flag according to the global
17001                  * IPv4 forwarding policy.
17002                  */
17003                 if (ipst->ips_ip_forwarding != 0)
17004                         ill->ill_flags |= ILLF_ROUTER;
17005         }
17006 
17007         ASSERT(ill->ill_phyint != NULL);
17008 
17009         /*
17010          * The ipIfStatsIfindex and ipv6IfIcmpIfIndex assignments will
17011          * be completed in ill_glist_insert -> ill_phyint_reinit
17012          */
17013         if (!ill_allocate_mibs(ill))
17014                 return (ENOMEM);
17015 
17016         /*
17017          * Pick a default sap until we get the DL_INFO_ACK back from
17018          * the driver.
17019          */
17020         ill->ill_sap = (ill->ill_isv6) ? ill->ill_media->ip_m_ipv6sap :
17021             ill->ill_media->ip_m_ipv4sap;
17022 
17023         ill->ill_ifname_pending = 1;
17024         ill->ill_ifname_pending_err = 0;
17025 
17026         /*
17027          * When the first ipif comes up in ipif_up_done(), multicast groups
17028          * that were joined while this ill was not bound to the DLPI link need
17029          * to be recovered by ill_recover_multicast().
17030          */
17031         ill->ill_need_recover_multicast = 1;
17032 
17033         ill_refhold(ill);
17034         rw_enter(&ipst->ips_ill_g_lock, RW_WRITER);
17035         if ((error = ill_glist_insert(ill, interf_name,
17036             (ill->ill_flags & ILLF_IPV6) == ILLF_IPV6)) > 0) {
17037                 ill->ill_ppa = UINT_MAX;
17038                 ill->ill_name[0] = '\0';
17039                 /*
17040                  * undo null termination done above.
17041                  */
17042                 ppa_ptr[0] = old_char;
17043                 rw_exit(&ipst->ips_ill_g_lock);
17044                 ill_refrele(ill);
17045                 return (error);
17046         }
17047 
17048         ASSERT(ill->ill_name_length <= LIFNAMSIZ);
17049 
17050         /*
17051          * When we return the buffer pointed to by interf_name should contain
17052          * the same name as in ill_name.
17053          * If a ppa was choosen by the system (ppa passed in was UINT_MAX)
17054          * the buffer pointed to by new_ppa_ptr would not contain the right ppa
17055          * so copy full name and update the ppa ptr.
17056          * When ppa passed in != UINT_MAX all values are correct just undo
17057          * null termination, this saves a bcopy.
17058          */
17059         if (*new_ppa_ptr == UINT_MAX) {
17060                 bcopy(ill->ill_name, interf_name, ill->ill_name_length);
17061                 *new_ppa_ptr = ill->ill_ppa;
17062         } else {
17063                 /*
17064                  * undo null termination done above.
17065                  */
17066                 ppa_ptr[0] = old_char;
17067         }
17068 
17069         /* Let SCTP know about this ILL */
17070         sctp_update_ill(ill, SCTP_ILL_INSERT);
17071 
17072         /*
17073          * ill_glist_insert has made the ill visible globally, and
17074          * ill_phyint_reinit could have changed the ipsq. At this point,
17075          * we need to hold the ips_ill_g_lock across the call to enter the
17076          * ipsq to enforce atomicity and prevent reordering. In the event
17077          * the ipsq has changed, and if the new ipsq is currently busy,
17078          * we need to make sure that this half-completed ioctl is ahead of
17079          * any subsequent ioctl. We achieve this by not dropping the
17080          * ips_ill_g_lock which prevents any ill lookup itself thereby
17081          * ensuring that new ioctls can't start.
17082          */
17083         ipsq = ipsq_try_enter_internal(ill, q, mp, ip_reprocess_ioctl, NEW_OP,
17084             B_TRUE);
17085 
17086         rw_exit(&ipst->ips_ill_g_lock);
17087         ill_refrele(ill);
17088         if (ipsq == NULL)
17089                 return (EINPROGRESS);
17090 
17091         /*
17092          * If ill_phyint_reinit() changed our ipsq, then start on the new ipsq.
17093          */
17094         if (ipsq->ipsq_xop->ipx_current_ipif == NULL)
17095                 ipsq_current_start(ipsq, ipif, SIOCSLIFNAME);
17096         else
17097                 ASSERT(ipsq->ipsq_xop->ipx_current_ipif == ipif);
17098 
17099         error = ipif_set_values_tail(ill, ipif, mp, q);
17100         ipsq_exit(ipsq);
17101         if (error != 0 && error != EINPROGRESS) {
17102                 /*
17103                  * restore previous values
17104                  */
17105                 ill->ill_isv6 = B_FALSE;
17106                 ill_set_inputfn(ill);
17107         }
17108         return (error);
17109 }
17110 
17111 void
17112 ipif_init(ip_stack_t *ipst)
17113 {
17114         int i;
17115 
17116         for (i = 0; i < MAX_G_HEADS; i++) {
17117                 ipst->ips_ill_g_heads[i].ill_g_list_head =
17118                     (ill_if_t *)&ipst->ips_ill_g_heads[i];
17119                 ipst->ips_ill_g_heads[i].ill_g_list_tail =
17120                     (ill_if_t *)&ipst->ips_ill_g_heads[i];
17121         }
17122 
17123         avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_index,
17124             ill_phyint_compare_index,
17125             sizeof (phyint_t),
17126             offsetof(struct phyint, phyint_avl_by_index));
17127         avl_create(&ipst->ips_phyint_g_list->phyint_list_avl_by_name,
17128             ill_phyint_compare_name,
17129             sizeof (phyint_t),
17130             offsetof(struct phyint, phyint_avl_by_name));
17131 }
17132 
17133 /*
17134  * Save enough information so that we can recreate the IRE if
17135  * the interface goes down and then up.
17136  */
17137 void
17138 ill_save_ire(ill_t *ill, ire_t *ire)
17139 {
17140         mblk_t  *save_mp;
17141 
17142         save_mp = allocb(sizeof (ifrt_t), BPRI_MED);
17143         if (save_mp != NULL) {
17144                 ifrt_t  *ifrt;
17145 
17146                 save_mp->b_wptr += sizeof (ifrt_t);
17147                 ifrt = (ifrt_t *)save_mp->b_rptr;
17148                 bzero(ifrt, sizeof (ifrt_t));
17149                 ifrt->ifrt_type = ire->ire_type;
17150                 if (ire->ire_ipversion == IPV4_VERSION) {
17151                         ASSERT(!ill->ill_isv6);
17152                         ifrt->ifrt_addr = ire->ire_addr;
17153                         ifrt->ifrt_gateway_addr = ire->ire_gateway_addr;
17154                         ifrt->ifrt_setsrc_addr = ire->ire_setsrc_addr;
17155                         ifrt->ifrt_mask = ire->ire_mask;
17156                 } else {
17157                         ASSERT(ill->ill_isv6);
17158                         ifrt->ifrt_v6addr = ire->ire_addr_v6;
17159                         /* ire_gateway_addr_v6 can change due to RTM_CHANGE */
17160                         mutex_enter(&ire->ire_lock);
17161                         ifrt->ifrt_v6gateway_addr = ire->ire_gateway_addr_v6;
17162                         mutex_exit(&ire->ire_lock);
17163                         ifrt->ifrt_v6setsrc_addr = ire->ire_setsrc_addr_v6;
17164                         ifrt->ifrt_v6mask = ire->ire_mask_v6;
17165                 }
17166                 ifrt->ifrt_flags = ire->ire_flags;
17167                 ifrt->ifrt_zoneid = ire->ire_zoneid;
17168                 mutex_enter(&ill->ill_saved_ire_lock);
17169                 save_mp->b_cont = ill->ill_saved_ire_mp;
17170                 ill->ill_saved_ire_mp = save_mp;
17171                 ill->ill_saved_ire_cnt++;
17172                 mutex_exit(&ill->ill_saved_ire_lock);
17173         }
17174 }
17175 
17176 /*
17177  * Remove one entry from ill_saved_ire_mp.
17178  */
17179 void
17180 ill_remove_saved_ire(ill_t *ill, ire_t *ire)
17181 {
17182         mblk_t  **mpp;
17183         mblk_t  *mp;
17184         ifrt_t  *ifrt;
17185 
17186         /* Remove from ill_saved_ire_mp list if it is there */
17187         mutex_enter(&ill->ill_saved_ire_lock);
17188         for (mpp = &ill->ill_saved_ire_mp; *mpp != NULL;
17189             mpp = &(*mpp)->b_cont) {
17190                 in6_addr_t      gw_addr_v6;
17191 
17192                 /*
17193                  * On a given ill, the tuple of address, gateway, mask,
17194                  * ire_type, and zoneid is unique for each saved IRE.
17195                  */
17196                 mp = *mpp;
17197                 ifrt = (ifrt_t *)mp->b_rptr;
17198                 /* ire_gateway_addr_v6 can change - need lock */
17199                 mutex_enter(&ire->ire_lock);
17200                 gw_addr_v6 = ire->ire_gateway_addr_v6;
17201                 mutex_exit(&ire->ire_lock);
17202 
17203                 if (ifrt->ifrt_zoneid != ire->ire_zoneid ||
17204                     ifrt->ifrt_type != ire->ire_type)
17205                         continue;
17206 
17207                 if (ill->ill_isv6 ?
17208                     (IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6addr,
17209                     &ire->ire_addr_v6) &&
17210                     IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6gateway_addr,
17211                     &gw_addr_v6) &&
17212                     IN6_ARE_ADDR_EQUAL(&ifrt->ifrt_v6mask,
17213                     &ire->ire_mask_v6)) :
17214                     (ifrt->ifrt_addr == ire->ire_addr &&
17215                     ifrt->ifrt_gateway_addr == ire->ire_gateway_addr &&
17216                     ifrt->ifrt_mask == ire->ire_mask)) {
17217                         *mpp = mp->b_cont;
17218                         ill->ill_saved_ire_cnt--;
17219                         freeb(mp);
17220                         break;
17221                 }
17222         }
17223         mutex_exit(&ill->ill_saved_ire_lock);
17224 }
17225 
17226 /*
17227  * IP multirouting broadcast routes handling
17228  * Append CGTP broadcast IREs to regular ones created
17229  * at ifconfig time.
17230  * The usage is a route add <cgtp_bc> <nic_bc> -multirt i.e., both
17231  * the destination and the gateway are broadcast addresses.
17232  * The caller has verified that the destination is an IRE_BROADCAST and that
17233  * RTF_MULTIRT was set. Here if the gateway is a broadcast address, then
17234  * we create a MULTIRT IRE_BROADCAST.
17235  * Note that the IRE_HOST created by ire_rt_add doesn't get found by anything
17236  * since the IRE_BROADCAST takes precedence; ire_add_v4 does head insertion.
17237  */
17238 static void
17239 ip_cgtp_bcast_add(ire_t *ire, ip_stack_t *ipst)
17240 {
17241         ire_t *ire_prim;
17242 
17243         ASSERT(ire != NULL);
17244 
17245         ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17246             IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0, ipst,
17247             NULL);
17248         if (ire_prim != NULL) {
17249                 /*
17250                  * We are in the special case of broadcasts for
17251                  * CGTP. We add an IRE_BROADCAST that holds
17252                  * the RTF_MULTIRT flag, the destination
17253                  * address and the low level
17254                  * info of ire_prim. In other words, CGTP
17255                  * broadcast is added to the redundant ipif.
17256                  */
17257                 ill_t *ill_prim;
17258                 ire_t  *bcast_ire;
17259 
17260                 ill_prim = ire_prim->ire_ill;
17261 
17262                 ip2dbg(("ip_cgtp_filter_bcast_add: ire_prim %p, ill_prim %p\n",
17263                     (void *)ire_prim, (void *)ill_prim));
17264 
17265                 bcast_ire = ire_create(
17266                     (uchar_t *)&ire->ire_addr,
17267                     (uchar_t *)&ip_g_all_ones,
17268                     (uchar_t *)&ire->ire_gateway_addr,
17269                     IRE_BROADCAST,
17270                     ill_prim,
17271                     GLOBAL_ZONEID,      /* CGTP is only for the global zone */
17272                     ire->ire_flags | RTF_KERNEL,
17273                     NULL,
17274                     ipst);
17275 
17276                 /*
17277                  * Here we assume that ire_add does head insertion so that
17278                  * the added IRE_BROADCAST comes before the existing IRE_HOST.
17279                  */
17280                 if (bcast_ire != NULL) {
17281                         if (ire->ire_flags & RTF_SETSRC) {
17282                                 bcast_ire->ire_setsrc_addr =
17283                                     ire->ire_setsrc_addr;
17284                         }
17285                         bcast_ire = ire_add(bcast_ire);
17286                         if (bcast_ire != NULL) {
17287                                 ip2dbg(("ip_cgtp_filter_bcast_add: "
17288                                     "added bcast_ire %p\n",
17289                                     (void *)bcast_ire));
17290 
17291                                 ill_save_ire(ill_prim, bcast_ire);
17292                                 ire_refrele(bcast_ire);
17293                         }
17294                 }
17295                 ire_refrele(ire_prim);
17296         }
17297 }
17298 
17299 /*
17300  * IP multirouting broadcast routes handling
17301  * Remove the broadcast ire.
17302  * The usage is a route delete <cgtp_bc> <nic_bc> -multirt i.e., both
17303  * the destination and the gateway are broadcast addresses.
17304  * The caller has only verified that RTF_MULTIRT was set. We check
17305  * that the destination is broadcast and that the gateway is a broadcast
17306  * address, and if so delete the IRE added by ip_cgtp_bcast_add().
17307  */
17308 static void
17309 ip_cgtp_bcast_delete(ire_t *ire, ip_stack_t *ipst)
17310 {
17311         ASSERT(ire != NULL);
17312 
17313         if (ip_type_v4(ire->ire_addr, ipst) == IRE_BROADCAST) {
17314                 ire_t *ire_prim;
17315 
17316                 ire_prim = ire_ftable_lookup_v4(ire->ire_gateway_addr, 0, 0,
17317                     IRE_BROADCAST, NULL, ALL_ZONES, NULL, MATCH_IRE_TYPE, 0,
17318                     ipst, NULL);
17319                 if (ire_prim != NULL) {
17320                         ill_t *ill_prim;
17321                         ire_t  *bcast_ire;
17322 
17323                         ill_prim = ire_prim->ire_ill;
17324 
17325                         ip2dbg(("ip_cgtp_filter_bcast_delete: "
17326                             "ire_prim %p, ill_prim %p\n",
17327                             (void *)ire_prim, (void *)ill_prim));
17328 
17329                         bcast_ire = ire_ftable_lookup_v4(ire->ire_addr, 0,
17330                             ire->ire_gateway_addr, IRE_BROADCAST,
17331                             ill_prim, ALL_ZONES, NULL,
17332                             MATCH_IRE_TYPE | MATCH_IRE_GW | MATCH_IRE_ILL |
17333                             MATCH_IRE_MASK, 0, ipst, NULL);
17334 
17335                         if (bcast_ire != NULL) {
17336                                 ip2dbg(("ip_cgtp_filter_bcast_delete: "
17337                                     "looked up bcast_ire %p\n",
17338                                     (void *)bcast_ire));
17339                                 ill_remove_saved_ire(bcast_ire->ire_ill,
17340                                     bcast_ire);
17341                                 ire_delete(bcast_ire);
17342                                 ire_refrele(bcast_ire);
17343                         }
17344                         ire_refrele(ire_prim);
17345                 }
17346         }
17347 }
17348 
17349 /*
17350  * Derive an interface id from the link layer address.
17351  * Knows about IEEE 802 and IEEE EUI-64 mappings.
17352  */
17353 static void
17354 ip_ether_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17355 {
17356         char            *addr;
17357 
17358         /*
17359          * Note that some IPv6 interfaces get plumbed over links that claim to
17360          * be DL_ETHER, but don't actually have Ethernet MAC addresses (e.g.
17361          * PPP links).  The ETHERADDRL check here ensures that we only set the
17362          * interface ID on IPv6 interfaces above links that actually have real
17363          * Ethernet addresses.
17364          */
17365         if (ill->ill_phys_addr_length == ETHERADDRL) {
17366                 /* Form EUI-64 like address */
17367                 addr = (char *)&v6addr->s6_addr32[2];
17368                 bcopy(ill->ill_phys_addr, addr, 3);
17369                 addr[0] ^= 0x2;         /* Toggle Universal/Local bit */
17370                 addr[3] = (char)0xff;
17371                 addr[4] = (char)0xfe;
17372                 bcopy(ill->ill_phys_addr + 3, addr + 5, 3);
17373         }
17374 }
17375 
17376 /* ARGSUSED */
17377 static void
17378 ip_nodef_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17379 {
17380 }
17381 
17382 typedef struct ipmp_ifcookie {
17383         uint32_t        ic_hostid;
17384         char            ic_ifname[LIFNAMSIZ];
17385         char            ic_zonename[ZONENAME_MAX];
17386 } ipmp_ifcookie_t;
17387 
17388 /*
17389  * Construct a pseudo-random interface ID for the IPMP interface that's both
17390  * predictable and (almost) guaranteed to be unique.
17391  */
17392 static void
17393 ip_ipmp_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17394 {
17395         zone_t          *zp;
17396         uint8_t         *addr;
17397         uchar_t         hash[16];
17398         ulong_t         hostid;
17399         MD5_CTX         ctx;
17400         ipmp_ifcookie_t ic = { 0 };
17401 
17402         ASSERT(IS_IPMP(ill));
17403 
17404         (void) ddi_strtoul(hw_serial, NULL, 10, &hostid);
17405         ic.ic_hostid = htonl((uint32_t)hostid);
17406 
17407         (void) strlcpy(ic.ic_ifname, ill->ill_name, LIFNAMSIZ);
17408 
17409         if ((zp = zone_find_by_id(ill->ill_zoneid)) != NULL) {
17410                 (void) strlcpy(ic.ic_zonename, zp->zone_name, ZONENAME_MAX);
17411                 zone_rele(zp);
17412         }
17413 
17414         MD5Init(&ctx);
17415         MD5Update(&ctx, &ic, sizeof (ic));
17416         MD5Final(hash, &ctx);
17417 
17418         /*
17419          * Map the hash to an interface ID per the basic approach in RFC3041.
17420          */
17421         addr = &v6addr->s6_addr8[8];
17422         bcopy(hash + 8, addr, sizeof (uint64_t));
17423         addr[0] &= ~0x2;                            /* set local bit */
17424 }
17425 
17426 /*
17427  * Map the multicast in6_addr_t in m_ip6addr to the physaddr for ethernet.
17428  */
17429 static void
17430 ip_ether_v6_mapping(ill_t *ill, uchar_t *m_ip6addr, uchar_t *m_physaddr)
17431 {
17432         phyint_t *phyi = ill->ill_phyint;
17433 
17434         /*
17435          * Check PHYI_MULTI_BCAST and length of physical
17436          * address to determine if we use the mapping or the
17437          * broadcast address.
17438          */
17439         if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17440             ill->ill_phys_addr_length != ETHERADDRL) {
17441                 ip_mbcast_mapping(ill, m_ip6addr, m_physaddr);
17442                 return;
17443         }
17444         m_physaddr[0] = 0x33;
17445         m_physaddr[1] = 0x33;
17446         m_physaddr[2] = m_ip6addr[12];
17447         m_physaddr[3] = m_ip6addr[13];
17448         m_physaddr[4] = m_ip6addr[14];
17449         m_physaddr[5] = m_ip6addr[15];
17450 }
17451 
17452 /*
17453  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for ethernet.
17454  */
17455 static void
17456 ip_ether_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17457 {
17458         phyint_t *phyi = ill->ill_phyint;
17459 
17460         /*
17461          * Check PHYI_MULTI_BCAST and length of physical
17462          * address to determine if we use the mapping or the
17463          * broadcast address.
17464          */
17465         if ((phyi->phyint_flags & PHYI_MULTI_BCAST) != 0 ||
17466             ill->ill_phys_addr_length != ETHERADDRL) {
17467                 ip_mbcast_mapping(ill, m_ipaddr, m_physaddr);
17468                 return;
17469         }
17470         m_physaddr[0] = 0x01;
17471         m_physaddr[1] = 0x00;
17472         m_physaddr[2] = 0x5e;
17473         m_physaddr[3] = m_ipaddr[1] & 0x7f;
17474         m_physaddr[4] = m_ipaddr[2];
17475         m_physaddr[5] = m_ipaddr[3];
17476 }
17477 
17478 /* ARGSUSED */
17479 static void
17480 ip_mbcast_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17481 {
17482         /*
17483          * for the MULTI_BCAST case and other cases when we want to
17484          * use the link-layer broadcast address for multicast.
17485          */
17486         uint8_t *bphys_addr;
17487         dl_unitdata_req_t *dlur;
17488 
17489         dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17490         if (ill->ill_sap_length < 0) {
17491                 bphys_addr = (uchar_t *)dlur +
17492                     dlur->dl_dest_addr_offset;
17493         } else  {
17494                 bphys_addr = (uchar_t *)dlur +
17495                     dlur->dl_dest_addr_offset + ill->ill_sap_length;
17496         }
17497 
17498         bcopy(bphys_addr, m_physaddr, ill->ill_phys_addr_length);
17499 }
17500 
17501 /*
17502  * Derive IPoIB interface id from the link layer address.
17503  */
17504 static void
17505 ip_ib_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17506 {
17507         char            *addr;
17508 
17509         ASSERT(ill->ill_phys_addr_length == 20);
17510         addr = (char *)&v6addr->s6_addr32[2];
17511         bcopy(ill->ill_phys_addr + 12, addr, 8);
17512         /*
17513          * In IBA 1.1 timeframe, some vendors erroneously set the u/l bit
17514          * in the globally assigned EUI-64 GUID to 1, in violation of IEEE
17515          * rules. In these cases, the IBA considers these GUIDs to be in
17516          * "Modified EUI-64" format, and thus toggling the u/l bit is not
17517          * required; vendors are required not to assign global EUI-64's
17518          * that differ only in u/l bit values, thus guaranteeing uniqueness
17519          * of the interface identifier. Whether the GUID is in modified
17520          * or proper EUI-64 format, the ipv6 identifier must have the u/l
17521          * bit set to 1.
17522          */
17523         addr[0] |= 2;                   /* Set Universal/Local bit to 1 */
17524 }
17525 
17526 /*
17527  * Map the multicast ipaddr_t in m_ipaddr to the physaddr for InfiniBand.
17528  * Note on mapping from multicast IP addresses to IPoIB multicast link
17529  * addresses. IPoIB multicast link addresses are based on IBA link addresses.
17530  * The format of an IPoIB multicast address is:
17531  *
17532  *  4 byte QPN      Scope Sign.  Pkey
17533  * +--------------------------------------------+
17534  * | 00FFFFFF | FF | 1X | X01B | Pkey | GroupID |
17535  * +--------------------------------------------+
17536  *
17537  * The Scope and Pkey components are properties of the IBA port and
17538  * network interface. They can be ascertained from the broadcast address.
17539  * The Sign. part is the signature, and is 401B for IPv4 and 601B for IPv6.
17540  */
17541 static void
17542 ip_ib_v4_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17543 {
17544         static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17545             0xff, 0x10, 0x40, 0x1b, 0x00, 0x00, 0x00, 0x00,
17546             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17547         uint8_t *bphys_addr;
17548         dl_unitdata_req_t *dlur;
17549 
17550         bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17551 
17552         /*
17553          * RFC 4391: IPv4 MGID is 28-bit long.
17554          */
17555         m_physaddr[16] = m_ipaddr[0] & 0x0f;
17556         m_physaddr[17] = m_ipaddr[1];
17557         m_physaddr[18] = m_ipaddr[2];
17558         m_physaddr[19] = m_ipaddr[3];
17559 
17560 
17561         dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17562         if (ill->ill_sap_length < 0) {
17563                 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17564         } else  {
17565                 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17566                     ill->ill_sap_length;
17567         }
17568         /*
17569          * Now fill in the IBA scope/Pkey values from the broadcast address.
17570          */
17571         m_physaddr[5] = bphys_addr[5];
17572         m_physaddr[8] = bphys_addr[8];
17573         m_physaddr[9] = bphys_addr[9];
17574 }
17575 
17576 static void
17577 ip_ib_v6_mapping(ill_t *ill, uchar_t *m_ipaddr, uchar_t *m_physaddr)
17578 {
17579         static uint8_t ipv4_g_phys_ibmulti_addr[] = { 0x00, 0xff, 0xff, 0xff,
17580             0xff, 0x10, 0x60, 0x1b, 0x00, 0x00, 0x00, 0x00,
17581             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
17582         uint8_t *bphys_addr;
17583         dl_unitdata_req_t *dlur;
17584 
17585         bcopy(ipv4_g_phys_ibmulti_addr, m_physaddr, ill->ill_phys_addr_length);
17586 
17587         /*
17588          * RFC 4391: IPv4 MGID is 80-bit long.
17589          */
17590         bcopy(&m_ipaddr[6], &m_physaddr[10], 10);
17591 
17592         dlur = (dl_unitdata_req_t *)ill->ill_bcast_mp->b_rptr;
17593         if (ill->ill_sap_length < 0) {
17594                 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset;
17595         } else  {
17596                 bphys_addr = (uchar_t *)dlur + dlur->dl_dest_addr_offset +
17597                     ill->ill_sap_length;
17598         }
17599         /*
17600          * Now fill in the IBA scope/Pkey values from the broadcast address.
17601          */
17602         m_physaddr[5] = bphys_addr[5];
17603         m_physaddr[8] = bphys_addr[8];
17604         m_physaddr[9] = bphys_addr[9];
17605 }
17606 
17607 /*
17608  * Derive IPv6 interface id from an IPv4 link-layer address (e.g. from an IPv4
17609  * tunnel).  The IPv4 address simply get placed in the lower 4 bytes of the
17610  * IPv6 interface id.  This is a suggested mechanism described in section 3.7
17611  * of RFC4213.
17612  */
17613 static void
17614 ip_ipv4_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17615 {
17616         ASSERT(ill->ill_phys_addr_length == sizeof (ipaddr_t));
17617         v6addr->s6_addr32[2] = 0;
17618         bcopy(physaddr, &v6addr->s6_addr32[3], sizeof (ipaddr_t));
17619 }
17620 
17621 /*
17622  * Derive IPv6 interface id from an IPv6 link-layer address (e.g. from an IPv6
17623  * tunnel).  The lower 8 bytes of the IPv6 address simply become the interface
17624  * id.
17625  */
17626 static void
17627 ip_ipv6_genv6intfid(ill_t *ill, uint8_t *physaddr, in6_addr_t *v6addr)
17628 {
17629         in6_addr_t *v6lladdr = (in6_addr_t *)physaddr;
17630 
17631         ASSERT(ill->ill_phys_addr_length == sizeof (in6_addr_t));
17632         bcopy(&v6lladdr->s6_addr32[2], &v6addr->s6_addr32[2], 8);
17633 }
17634 
17635 static void
17636 ip_ipv6_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17637 {
17638         ip_ipv6_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17639 }
17640 
17641 static void
17642 ip_ipv6_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17643 {
17644         ip_ipv6_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17645 }
17646 
17647 static void
17648 ip_ipv4_v6intfid(ill_t *ill, in6_addr_t *v6addr)
17649 {
17650         ip_ipv4_genv6intfid(ill, ill->ill_phys_addr, v6addr);
17651 }
17652 
17653 static void
17654 ip_ipv4_v6destintfid(ill_t *ill, in6_addr_t *v6addr)
17655 {
17656         ip_ipv4_genv6intfid(ill, ill->ill_dest_addr, v6addr);
17657 }
17658 
17659 /*
17660  * Lookup an ill and verify that the zoneid has an ipif on that ill.
17661  * Returns an held ill, or NULL.
17662  */
17663 ill_t *
17664 ill_lookup_on_ifindex_zoneid(uint_t index, zoneid_t zoneid, boolean_t isv6,
17665     ip_stack_t *ipst)
17666 {
17667         ill_t   *ill;
17668         ipif_t  *ipif;
17669 
17670         ill = ill_lookup_on_ifindex(index, isv6, ipst);
17671         if (ill == NULL)
17672                 return (NULL);
17673 
17674         mutex_enter(&ill->ill_lock);
17675         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17676                 if (IPIF_IS_CONDEMNED(ipif))
17677                         continue;
17678                 if (zoneid != ALL_ZONES && ipif->ipif_zoneid != zoneid &&
17679                     ipif->ipif_zoneid != ALL_ZONES)
17680                         continue;
17681 
17682                 mutex_exit(&ill->ill_lock);
17683                 return (ill);
17684         }
17685         mutex_exit(&ill->ill_lock);
17686         ill_refrele(ill);
17687         return (NULL);
17688 }
17689 
17690 /*
17691  * Return a pointer to an ipif_t given a combination of (ill_idx,ipif_id)
17692  * If a pointer to an ipif_t is returned then the caller will need to do
17693  * an ill_refrele().
17694  */
17695 ipif_t *
17696 ipif_getby_indexes(uint_t ifindex, uint_t lifidx, boolean_t isv6,
17697     ip_stack_t *ipst)
17698 {
17699         ipif_t *ipif;
17700         ill_t *ill;
17701 
17702         ill = ill_lookup_on_ifindex(ifindex, isv6, ipst);
17703         if (ill == NULL)
17704                 return (NULL);
17705 
17706         mutex_enter(&ill->ill_lock);
17707         if (ill->ill_state_flags & ILL_CONDEMNED) {
17708                 mutex_exit(&ill->ill_lock);
17709                 ill_refrele(ill);
17710                 return (NULL);
17711         }
17712 
17713         for (ipif = ill->ill_ipif; ipif != NULL; ipif = ipif->ipif_next) {
17714                 if (!IPIF_CAN_LOOKUP(ipif))
17715                         continue;
17716                 if (lifidx == ipif->ipif_id) {
17717                         ipif_refhold_locked(ipif);
17718                         break;
17719                 }
17720         }
17721 
17722         mutex_exit(&ill->ill_lock);
17723         ill_refrele(ill);
17724         return (ipif);
17725 }
17726 
17727 /*
17728  * Set ill_inputfn based on the current know state.
17729  * This needs to be called when any of the factors taken into
17730  * account changes.
17731  */
17732 void
17733 ill_set_inputfn(ill_t *ill)
17734 {
17735         ip_stack_t      *ipst = ill->ill_ipst;
17736 
17737         if (ill->ill_isv6) {
17738                 if (is_system_labeled())
17739                         ill->ill_inputfn = ill_input_full_v6;
17740                 else
17741                         ill->ill_inputfn = ill_input_short_v6;
17742         } else {
17743                 if (is_system_labeled())
17744                         ill->ill_inputfn = ill_input_full_v4;
17745                 else if (ill->ill_dhcpinit != 0)
17746                         ill->ill_inputfn = ill_input_full_v4;
17747                 else if (ipst->ips_ipcl_proto_fanout_v4[IPPROTO_RSVP].connf_head
17748                     != NULL)
17749                         ill->ill_inputfn = ill_input_full_v4;
17750                 else if (ipst->ips_ip_cgtp_filter &&
17751                     ipst->ips_ip_cgtp_filter_ops != NULL)
17752                         ill->ill_inputfn = ill_input_full_v4;
17753                 else
17754                         ill->ill_inputfn = ill_input_short_v4;
17755         }
17756 }
17757 
17758 /*
17759  * Re-evaluate ill_inputfn for all the IPv4 ills.
17760  * Used when RSVP and CGTP comes and goes.
17761  */
17762 void
17763 ill_set_inputfn_all(ip_stack_t *ipst)
17764 {
17765         ill_walk_context_t      ctx;
17766         ill_t                   *ill;
17767 
17768         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
17769         ill = ILL_START_WALK_V4(&ctx, ipst);
17770         for (; ill != NULL; ill = ill_next(&ctx, ill))
17771                 ill_set_inputfn(ill);
17772 
17773         rw_exit(&ipst->ips_ill_g_lock);
17774 }
17775 
17776 /*
17777  * Set the physical address information for `ill' to the contents of the
17778  * dl_notify_ind_t pointed to by `mp'.  Must be called as writer, and will be
17779  * asynchronous if `ill' cannot immediately be quiesced -- in which case
17780  * EINPROGRESS will be returned.
17781  */
17782 int
17783 ill_set_phys_addr(ill_t *ill, mblk_t *mp)
17784 {
17785         ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17786         dl_notify_ind_t *dlindp = (dl_notify_ind_t *)mp->b_rptr;
17787 
17788         ASSERT(IAM_WRITER_IPSQ(ipsq));
17789 
17790         if (dlindp->dl_data != DL_IPV6_LINK_LAYER_ADDR &&
17791             dlindp->dl_data != DL_CURR_DEST_ADDR &&
17792             dlindp->dl_data != DL_CURR_PHYS_ADDR) {
17793                 /* Changing DL_IPV6_TOKEN is not yet supported */
17794                 return (0);
17795         }
17796 
17797         /*
17798          * We need to store up to two copies of `mp' in `ill'.  Due to the
17799          * design of ipsq_pending_mp_add(), we can't pass them as separate
17800          * arguments to ill_set_phys_addr_tail().  Instead, chain them
17801          * together here, then pull 'em apart in ill_set_phys_addr_tail().
17802          */
17803         if ((mp = copyb(mp)) == NULL || (mp->b_cont = copyb(mp)) == NULL) {
17804                 freemsg(mp);
17805                 return (ENOMEM);
17806         }
17807 
17808         ipsq_current_start(ipsq, ill->ill_ipif, 0);
17809 
17810         /*
17811          * Since we'll only do a logical down, we can't rely on ipif_down
17812          * to turn on ILL_DOWN_IN_PROGRESS, or for the DL_BIND_ACK to reset
17813          * ILL_DOWN_IN_PROGRESS. We instead manage this separately for this
17814          * case, to quiesce ire's and nce's for ill_is_quiescent.
17815          */
17816         mutex_enter(&ill->ill_lock);
17817         ill->ill_state_flags |= ILL_DOWN_IN_PROGRESS;
17818         /* no more ire/nce addition allowed */
17819         mutex_exit(&ill->ill_lock);
17820 
17821         /*
17822          * If we can quiesce the ill, then set the address.  If not, then
17823          * ill_set_phys_addr_tail() will be called from ipif_ill_refrele_tail().
17824          */
17825         ill_down_ipifs(ill, B_TRUE);
17826         mutex_enter(&ill->ill_lock);
17827         if (!ill_is_quiescent(ill)) {
17828                 /* call cannot fail since `conn_t *' argument is NULL */
17829                 (void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
17830                     mp, ILL_DOWN);
17831                 mutex_exit(&ill->ill_lock);
17832                 return (EINPROGRESS);
17833         }
17834         mutex_exit(&ill->ill_lock);
17835 
17836         ill_set_phys_addr_tail(ipsq, ill->ill_rq, mp, NULL);
17837         return (0);
17838 }
17839 
17840 /*
17841  * When the allowed-ips link property is set on the datalink, IP receives a
17842  * DL_NOTE_ALLOWED_IPS notification that is processed in ill_set_allowed_ips()
17843  * to initialize the ill_allowed_ips[] array in the ill_t. This array is then
17844  * used to vet addresses passed to ip_sioctl_addr() and to ensure that the
17845  * only IP addresses configured on the ill_t are those in the ill_allowed_ips[]
17846  * array.
17847  */
17848 void
17849 ill_set_allowed_ips(ill_t *ill, mblk_t *mp)
17850 {
17851         ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17852         dl_notify_ind_t *dlip = (dl_notify_ind_t *)mp->b_rptr;
17853         mac_protect_t *mrp;
17854         int i;
17855 
17856         ASSERT(IAM_WRITER_IPSQ(ipsq));
17857         mrp = (mac_protect_t *)&dlip[1];
17858 
17859         if (mrp->mp_ipaddrcnt == 0) { /* reset allowed-ips */
17860                 kmem_free(ill->ill_allowed_ips,
17861                     ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17862                 ill->ill_allowed_ips_cnt = 0;
17863                 ill->ill_allowed_ips = NULL;
17864                 mutex_enter(&ill->ill_phyint->phyint_lock);
17865                 ill->ill_phyint->phyint_flags &= ~PHYI_L3PROTECT;
17866                 mutex_exit(&ill->ill_phyint->phyint_lock);
17867                 return;
17868         }
17869 
17870         if (ill->ill_allowed_ips != NULL) {
17871                 kmem_free(ill->ill_allowed_ips,
17872                     ill->ill_allowed_ips_cnt * sizeof (in6_addr_t));
17873         }
17874         ill->ill_allowed_ips_cnt = mrp->mp_ipaddrcnt;
17875         ill->ill_allowed_ips = kmem_alloc(
17876             ill->ill_allowed_ips_cnt * sizeof (in6_addr_t), KM_SLEEP);
17877         for (i = 0; i < mrp->mp_ipaddrcnt;  i++)
17878                 ill->ill_allowed_ips[i] = mrp->mp_ipaddrs[i].ip_addr;
17879 
17880         mutex_enter(&ill->ill_phyint->phyint_lock);
17881         ill->ill_phyint->phyint_flags |= PHYI_L3PROTECT;
17882         mutex_exit(&ill->ill_phyint->phyint_lock);
17883 }
17884 
17885 /*
17886  * Once the ill associated with `q' has quiesced, set its physical address
17887  * information to the values in `addrmp'.  Note that two copies of `addrmp'
17888  * are passed (linked by b_cont), since we sometimes need to save two distinct
17889  * copies in the ill_t, and our context doesn't permit sleeping or allocation
17890  * failure (we'll free the other copy if it's not needed).  Since the ill_t
17891  * is quiesced, we know any stale nce's with the old address information have
17892  * already been removed, so we don't need to call nce_flush().
17893  */
17894 /* ARGSUSED */
17895 static void
17896 ill_set_phys_addr_tail(ipsq_t *ipsq, queue_t *q, mblk_t *addrmp, void *dummy)
17897 {
17898         ill_t           *ill = q->q_ptr;
17899         mblk_t          *addrmp2 = unlinkb(addrmp);
17900         dl_notify_ind_t *dlindp = (dl_notify_ind_t *)addrmp->b_rptr;
17901         uint_t          addrlen, addroff;
17902         int             status;
17903 
17904         ASSERT(IAM_WRITER_IPSQ(ipsq));
17905 
17906         addroff = dlindp->dl_addr_offset;
17907         addrlen = dlindp->dl_addr_length - ABS(ill->ill_sap_length);
17908 
17909         switch (dlindp->dl_data) {
17910         case DL_IPV6_LINK_LAYER_ADDR:
17911                 ill_set_ndmp(ill, addrmp, addroff, addrlen);
17912                 freemsg(addrmp2);
17913                 break;
17914 
17915         case DL_CURR_DEST_ADDR:
17916                 freemsg(ill->ill_dest_addr_mp);
17917                 ill->ill_dest_addr = addrmp->b_rptr + addroff;
17918                 ill->ill_dest_addr_mp = addrmp;
17919                 if (ill->ill_isv6) {
17920                         ill_setdesttoken(ill);
17921                         ipif_setdestlinklocal(ill->ill_ipif);
17922                 }
17923                 freemsg(addrmp2);
17924                 break;
17925 
17926         case DL_CURR_PHYS_ADDR:
17927                 freemsg(ill->ill_phys_addr_mp);
17928                 ill->ill_phys_addr = addrmp->b_rptr + addroff;
17929                 ill->ill_phys_addr_mp = addrmp;
17930                 ill->ill_phys_addr_length = addrlen;
17931                 if (ill->ill_isv6)
17932                         ill_set_ndmp(ill, addrmp2, addroff, addrlen);
17933                 else
17934                         freemsg(addrmp2);
17935                 if (ill->ill_isv6) {
17936                         ill_setdefaulttoken(ill);
17937                         ipif_setlinklocal(ill->ill_ipif);
17938                 }
17939                 break;
17940         default:
17941                 ASSERT(0);
17942         }
17943 
17944         /*
17945          * reset ILL_DOWN_IN_PROGRESS so that we can successfully add ires
17946          * as we bring the ipifs up again.
17947          */
17948         mutex_enter(&ill->ill_lock);
17949         ill->ill_state_flags &= ~ILL_DOWN_IN_PROGRESS;
17950         mutex_exit(&ill->ill_lock);
17951         /*
17952          * If there are ipifs to bring up, ill_up_ipifs() will return
17953          * EINPROGRESS, and ipsq_current_finish() will be called by
17954          * ip_rput_dlpi_writer() or arp_bringup_done() when the last ipif is
17955          * brought up.
17956          */
17957         status = ill_up_ipifs(ill, q, addrmp);
17958         if (status != EINPROGRESS)
17959                 ipsq_current_finish(ipsq);
17960 }
17961 
17962 /*
17963  * Helper routine for setting the ill_nd_lla fields.
17964  */
17965 void
17966 ill_set_ndmp(ill_t *ill, mblk_t *ndmp, uint_t addroff, uint_t addrlen)
17967 {
17968         freemsg(ill->ill_nd_lla_mp);
17969         ill->ill_nd_lla = ndmp->b_rptr + addroff;
17970         ill->ill_nd_lla_mp = ndmp;
17971         ill->ill_nd_lla_len = addrlen;
17972 }
17973 
17974 /*
17975  * Replumb the ill.
17976  */
17977 int
17978 ill_replumb(ill_t *ill, mblk_t *mp)
17979 {
17980         ipsq_t *ipsq = ill->ill_phyint->phyint_ipsq;
17981 
17982         ASSERT(IAM_WRITER_IPSQ(ipsq));
17983 
17984         ipsq_current_start(ipsq, ill->ill_ipif, 0);
17985 
17986         /*
17987          * If we can quiesce the ill, then continue.  If not, then
17988          * ill_replumb_tail() will be called from ipif_ill_refrele_tail().
17989          */
17990         ill_down_ipifs(ill, B_FALSE);
17991 
17992         mutex_enter(&ill->ill_lock);
17993         if (!ill_is_quiescent(ill)) {
17994                 /* call cannot fail since `conn_t *' argument is NULL */
17995                 (void) ipsq_pending_mp_add(NULL, ill->ill_ipif, ill->ill_rq,
17996                     mp, ILL_DOWN);
17997                 mutex_exit(&ill->ill_lock);
17998                 return (EINPROGRESS);
17999         }
18000         mutex_exit(&ill->ill_lock);
18001 
18002         ill_replumb_tail(ipsq, ill->ill_rq, mp, NULL);
18003         return (0);
18004 }
18005 
18006 /* ARGSUSED */
18007 static void
18008 ill_replumb_tail(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy)
18009 {
18010         ill_t *ill = q->q_ptr;
18011         int err;
18012         conn_t *connp = NULL;
18013 
18014         ASSERT(IAM_WRITER_IPSQ(ipsq));
18015         freemsg(ill->ill_replumb_mp);
18016         ill->ill_replumb_mp = copyb(mp);
18017 
18018         if (ill->ill_replumb_mp == NULL) {
18019                 /* out of memory */
18020                 ipsq_current_finish(ipsq);
18021                 return;
18022         }
18023 
18024         mutex_enter(&ill->ill_lock);
18025         ill->ill_up_ipifs = ipsq_pending_mp_add(NULL, ill->ill_ipif,
18026             ill->ill_rq, ill->ill_replumb_mp, 0);
18027         mutex_exit(&ill->ill_lock);
18028 
18029         if (!ill->ill_up_ipifs) {
18030                 /* already closing */
18031                 ipsq_current_finish(ipsq);
18032                 return;
18033         }
18034         ill->ill_replumbing = 1;
18035         err = ill_down_ipifs_tail(ill);
18036 
18037         /*
18038          * Successfully quiesced and brought down the interface, now we send
18039          * the DL_NOTE_REPLUMB_DONE message down to the driver. Reuse the
18040          * DL_NOTE_REPLUMB message.
18041          */
18042         mp = mexchange(NULL, mp, sizeof (dl_notify_conf_t), M_PROTO,
18043             DL_NOTIFY_CONF);
18044         ASSERT(mp != NULL);
18045         ((dl_notify_conf_t *)mp->b_rptr)->dl_notification =
18046             DL_NOTE_REPLUMB_DONE;
18047         ill_dlpi_send(ill, mp);
18048 
18049         /*
18050          * For IPv4, we would usually get EINPROGRESS because the ETHERTYPE_ARP
18051          * streams have to be unbound. When all the DLPI exchanges are done,
18052          * ipsq_current_finish() will be called by arp_bringup_done(). The
18053          * remainder of ipif bringup via ill_up_ipifs() will also be done in
18054          * arp_bringup_done().
18055          */
18056         ASSERT(ill->ill_replumb_mp != NULL);
18057         if (err == EINPROGRESS)
18058                 return;
18059         else
18060                 ill->ill_replumb_mp = ipsq_pending_mp_get(ipsq, &connp);
18061         ASSERT(connp == NULL);
18062         if (err == 0 && ill->ill_replumb_mp != NULL &&
18063             ill_up_ipifs(ill, q, ill->ill_replumb_mp) == EINPROGRESS) {
18064                 return;
18065         }
18066         ipsq_current_finish(ipsq);
18067 }
18068 
18069 /*
18070  * Issue ioctl `cmd' on `lh'; caller provides the initial payload in `buf'
18071  * which is `bufsize' bytes.  On success, zero is returned and `buf' updated
18072  * as per the ioctl.  On failure, an errno is returned.
18073  */
18074 static int
18075 ip_ioctl(ldi_handle_t lh, int cmd, void *buf, uint_t bufsize, cred_t *cr)
18076 {
18077         int rval;
18078         struct strioctl iocb;
18079 
18080         iocb.ic_cmd = cmd;
18081         iocb.ic_timout = 15;
18082         iocb.ic_len = bufsize;
18083         iocb.ic_dp = buf;
18084 
18085         return (ldi_ioctl(lh, I_STR, (intptr_t)&iocb, FKIOCTL, cr, &rval));
18086 }
18087 
18088 /*
18089  * Issue an SIOCGLIFCONF for address family `af' and store the result into a
18090  * dynamically-allocated `lifcp' that will be `bufsizep' bytes on success.
18091  */
18092 static int
18093 ip_lifconf_ioctl(ldi_handle_t lh, int af, struct lifconf *lifcp,
18094     uint_t *bufsizep, cred_t *cr)
18095 {
18096         int err;
18097         struct lifnum lifn;
18098 
18099         bzero(&lifn, sizeof (lifn));
18100         lifn.lifn_family = af;
18101         lifn.lifn_flags = LIFC_UNDER_IPMP;
18102 
18103         if ((err = ip_ioctl(lh, SIOCGLIFNUM, &lifn, sizeof (lifn), cr)) != 0)
18104                 return (err);
18105 
18106         /*
18107          * Pad the interface count to account for additional interfaces that
18108          * may have been configured between the SIOCGLIFNUM and SIOCGLIFCONF.
18109          */
18110         lifn.lifn_count += 4;
18111         bzero(lifcp, sizeof (*lifcp));
18112         lifcp->lifc_flags = LIFC_UNDER_IPMP;
18113         lifcp->lifc_family = af;
18114         lifcp->lifc_len = *bufsizep = lifn.lifn_count * sizeof (struct lifreq);
18115         lifcp->lifc_buf = kmem_zalloc(*bufsizep, KM_SLEEP);
18116 
18117         err = ip_ioctl(lh, SIOCGLIFCONF, lifcp, sizeof (*lifcp), cr);
18118         if (err != 0) {
18119                 kmem_free(lifcp->lifc_buf, *bufsizep);
18120                 return (err);
18121         }
18122 
18123         return (0);
18124 }
18125 
18126 /*
18127  * Helper for ip_interface_cleanup() that removes the loopback interface.
18128  */
18129 static void
18130 ip_loopback_removeif(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18131 {
18132         int err;
18133         struct lifreq lifr;
18134 
18135         bzero(&lifr, sizeof (lifr));
18136         (void) strcpy(lifr.lifr_name, ipif_loopback_name);
18137 
18138         /*
18139          * Attempt to remove the interface.  It may legitimately not exist
18140          * (e.g. the zone administrator unplumbed it), so ignore ENXIO.
18141          */
18142         err = ip_ioctl(lh, SIOCLIFREMOVEIF, &lifr, sizeof (lifr), cr);
18143         if (err != 0 && err != ENXIO) {
18144                 ip0dbg(("ip_loopback_removeif: IP%s SIOCLIFREMOVEIF failed: "
18145                     "error %d\n", isv6 ? "v6" : "v4", err));
18146         }
18147 }
18148 
18149 /*
18150  * Helper for ip_interface_cleanup() that ensures no IP interfaces are in IPMP
18151  * groups and that IPMP data addresses are down.  These conditions must be met
18152  * so that IPMP interfaces can be I_PUNLINK'd, as per ip_sioctl_plink_ipmp().
18153  */
18154 static void
18155 ip_ipmp_cleanup(ldi_handle_t lh, boolean_t isv6, cred_t *cr)
18156 {
18157         int af = isv6 ? AF_INET6 : AF_INET;
18158         int i, nifs;
18159         int err;
18160         uint_t bufsize;
18161         uint_t lifrsize = sizeof (struct lifreq);
18162         struct lifconf lifc;
18163         struct lifreq *lifrp;
18164 
18165         if ((err = ip_lifconf_ioctl(lh, af, &lifc, &bufsize, cr)) != 0) {
18166                 cmn_err(CE_WARN, "ip_ipmp_cleanup: cannot get interface list "
18167                     "(error %d); any IPMP interfaces cannot be shutdown", err);
18168                 return;
18169         }
18170 
18171         nifs = lifc.lifc_len / lifrsize;
18172         for (lifrp = lifc.lifc_req, i = 0; i < nifs; i++, lifrp++) {
18173                 err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18174                 if (err != 0) {
18175                         cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot get "
18176                             "flags: error %d", lifrp->lifr_name, err);
18177                         continue;
18178                 }
18179 
18180                 if (lifrp->lifr_flags & IFF_IPMP) {
18181                         if ((lifrp->lifr_flags & (IFF_UP|IFF_DUPLICATE)) == 0)
18182                                 continue;
18183 
18184                         lifrp->lifr_flags &= ~IFF_UP;
18185                         err = ip_ioctl(lh, SIOCSLIFFLAGS, lifrp, lifrsize, cr);
18186                         if (err != 0) {
18187                                 cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18188                                     "bring down (error %d); IPMP interface may "
18189                                     "not be shutdown", lifrp->lifr_name, err);
18190                         }
18191 
18192                         /*
18193                          * Check if IFF_DUPLICATE is still set -- and if so,
18194                          * reset the address to clear it.
18195                          */
18196                         err = ip_ioctl(lh, SIOCGLIFFLAGS, lifrp, lifrsize, cr);
18197                         if (err != 0 || !(lifrp->lifr_flags & IFF_DUPLICATE))
18198                                 continue;
18199 
18200                         err = ip_ioctl(lh, SIOCGLIFADDR, lifrp, lifrsize, cr);
18201                         if (err != 0 || (err = ip_ioctl(lh, SIOCGLIFADDR,
18202                             lifrp, lifrsize, cr)) != 0) {
18203                                 cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18204                                     "reset DAD (error %d); IPMP interface may "
18205                                     "not be shutdown", lifrp->lifr_name, err);
18206                         }
18207                         continue;
18208                 }
18209 
18210                 if (strchr(lifrp->lifr_name, IPIF_SEPARATOR_CHAR) == 0) {
18211                         lifrp->lifr_groupname[0] = '\0';
18212                         if ((err = ip_ioctl(lh, SIOCSLIFGROUPNAME, lifrp,
18213                             lifrsize, cr)) != 0) {
18214                                 cmn_err(CE_WARN, "ip_ipmp_cleanup: %s: cannot "
18215                                     "leave IPMP group (error %d); associated "
18216                                     "IPMP interface may not be shutdown",
18217                                     lifrp->lifr_name, err);
18218                                 continue;
18219                         }
18220                 }
18221         }
18222 
18223         kmem_free(lifc.lifc_buf, bufsize);
18224 }
18225 
18226 #define UDPDEV          "/devices/pseudo/udp@0:udp"
18227 #define UDP6DEV         "/devices/pseudo/udp6@0:udp6"
18228 
18229 /*
18230  * Remove the loopback interfaces and prep the IPMP interfaces to be torn down.
18231  * Non-loopback interfaces are either I_LINK'd or I_PLINK'd; the former go away
18232  * when the user-level processes in the zone are killed and the latter are
18233  * cleaned up by str_stack_shutdown().
18234  */
18235 void
18236 ip_interface_cleanup(ip_stack_t *ipst)
18237 {
18238         ldi_handle_t    lh;
18239         ldi_ident_t     li;
18240         cred_t          *cr;
18241         int             err;
18242         int             i;
18243         char            *devs[] = { UDP6DEV, UDPDEV };
18244         netstackid_t    stackid = ipst->ips_netstack->netstack_stackid;
18245 
18246         if ((err = ldi_ident_from_major(ddi_name_to_major("ip"), &li)) != 0) {
18247                 cmn_err(CE_WARN, "ip_interface_cleanup: cannot get ldi ident:"
18248                     " error %d", err);
18249                 return;
18250         }
18251 
18252         cr = zone_get_kcred(netstackid_to_zoneid(stackid));
18253         ASSERT(cr != NULL);
18254 
18255         /*
18256          * NOTE: loop executes exactly twice and is hardcoded to know that the
18257          * first iteration is IPv6.  (Unrolling yields repetitious code, hence
18258          * the loop.)
18259          */
18260         for (i = 0; i < 2; i++) {
18261                 err = ldi_open_by_name(devs[i], FREAD|FWRITE, cr, &lh, li);
18262                 if (err != 0) {
18263                         cmn_err(CE_WARN, "ip_interface_cleanup: cannot open %s:"
18264                             " error %d", devs[i], err);
18265                         continue;
18266                 }
18267 
18268                 ip_loopback_removeif(lh, i == 0, cr);
18269                 ip_ipmp_cleanup(lh, i == 0, cr);
18270 
18271                 (void) ldi_close(lh, FREAD|FWRITE, cr);
18272         }
18273 
18274         ldi_ident_release(li);
18275         crfree(cr);
18276 }
18277 
18278 /*
18279  * This needs to be in-sync with nic_event_t definition
18280  */
18281 static const char *
18282 ill_hook_event2str(nic_event_t event)
18283 {
18284         switch (event) {
18285         case NE_PLUMB:
18286                 return ("PLUMB");
18287         case NE_UNPLUMB:
18288                 return ("UNPLUMB");
18289         case NE_UP:
18290                 return ("UP");
18291         case NE_DOWN:
18292                 return ("DOWN");
18293         case NE_ADDRESS_CHANGE:
18294                 return ("ADDRESS_CHANGE");
18295         case NE_LIF_UP:
18296                 return ("LIF_UP");
18297         case NE_LIF_DOWN:
18298                 return ("LIF_DOWN");
18299         case NE_IFINDEX_CHANGE:
18300                 return ("IFINDEX_CHANGE");
18301         default:
18302                 return ("UNKNOWN");
18303         }
18304 }
18305 
18306 void
18307 ill_nic_event_dispatch(ill_t *ill, lif_if_t lif, nic_event_t event,
18308     nic_event_data_t data, size_t datalen)
18309 {
18310         ip_stack_t              *ipst = ill->ill_ipst;
18311         hook_nic_event_int_t    *info;
18312         const char              *str = NULL;
18313 
18314         /* create a new nic event info */
18315         if ((info = kmem_alloc(sizeof (*info), KM_NOSLEEP)) == NULL)
18316                 goto fail;
18317 
18318         info->hnei_event.hne_nic = ill->ill_phyint->phyint_ifindex;
18319         info->hnei_event.hne_lif = lif;
18320         info->hnei_event.hne_event = event;
18321         info->hnei_event.hne_protocol = ill->ill_isv6 ?
18322             ipst->ips_ipv6_net_data : ipst->ips_ipv4_net_data;
18323         info->hnei_event.hne_data = NULL;
18324         info->hnei_event.hne_datalen = 0;
18325         info->hnei_stackid = ipst->ips_netstack->netstack_stackid;
18326 
18327         if (data != NULL && datalen != 0) {
18328                 info->hnei_event.hne_data = kmem_alloc(datalen, KM_NOSLEEP);
18329                 if (info->hnei_event.hne_data == NULL)
18330                         goto fail;
18331                 bcopy(data, info->hnei_event.hne_data, datalen);
18332                 info->hnei_event.hne_datalen = datalen;
18333         }
18334 
18335         if (ddi_taskq_dispatch(eventq_queue_nic, ip_ne_queue_func, info,
18336             DDI_NOSLEEP) == DDI_SUCCESS)
18337                 return;
18338 
18339 fail:
18340         if (info != NULL) {
18341                 if (info->hnei_event.hne_data != NULL) {
18342                         kmem_free(info->hnei_event.hne_data,
18343                             info->hnei_event.hne_datalen);
18344                 }
18345                 kmem_free(info, sizeof (hook_nic_event_t));
18346         }
18347         str = ill_hook_event2str(event);
18348         ip2dbg(("ill_nic_event_dispatch: could not dispatch %s nic event "
18349             "information for %s (ENOMEM)\n", str, ill->ill_name));
18350 }
18351 
18352 static int
18353 ipif_arp_up_done_tail(ipif_t *ipif, enum ip_resolver_action res_act)
18354 {
18355         int             err = 0;
18356         const in_addr_t *addr = NULL;
18357         nce_t           *nce = NULL;
18358         ill_t           *ill = ipif->ipif_ill;
18359         ill_t           *bound_ill;
18360         boolean_t       added_ipif = B_FALSE;
18361         uint16_t        state;
18362         uint16_t        flags;
18363 
18364         DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up_done_tail",
18365             ill_t *, ill, ipif_t *, ipif);
18366         if (ipif->ipif_lcl_addr != INADDR_ANY) {
18367                 addr = &ipif->ipif_lcl_addr;
18368         }
18369 
18370         if ((ipif->ipif_flags & IPIF_UNNUMBERED) || addr == NULL) {
18371                 if (res_act != Res_act_initial)
18372                         return (EINVAL);
18373         }
18374 
18375         if (addr != NULL) {
18376                 ipmp_illgrp_t   *illg = ill->ill_grp;
18377 
18378                 /* add unicast nce for the local addr */
18379 
18380                 if (IS_IPMP(ill)) {
18381                         /*
18382                          * If we're here via ipif_up(), then the ipif
18383                          * won't be bound yet -- add it to the group,
18384                          * which will bind it if possible. (We would
18385                          * add it in ipif_up(), but deleting on failure
18386                          * there is gruesome.)  If we're here via
18387                          * ipmp_ill_bind_ipif(), then the ipif has
18388                          * already been added to the group and we
18389                          * just need to use the binding.
18390                          */
18391                         if ((bound_ill = ipmp_ipif_bound_ill(ipif)) == NULL) {
18392                                 bound_ill  = ipmp_illgrp_add_ipif(illg, ipif);
18393                                 if (bound_ill == NULL) {
18394                                         /*
18395                                          * We couldn't bind the ipif to an ill
18396                                          * yet, so we have nothing to publish.
18397                                          * Mark the address as ready and return.
18398                                          */
18399                                         ipif->ipif_addr_ready = 1;
18400                                         return (0);
18401                                 }
18402                                 added_ipif = B_TRUE;
18403                         }
18404                 } else {
18405                         bound_ill = ill;
18406                 }
18407 
18408                 flags = (NCE_F_MYADDR | NCE_F_PUBLISH | NCE_F_AUTHORITY |
18409                     NCE_F_NONUD);
18410                 /*
18411                  * If this is an initial bring-up (or the ipif was never
18412                  * completely brought up), do DAD.  Otherwise, we're here
18413                  * because IPMP has rebound an address to this ill: send
18414                  * unsolicited advertisements (ARP announcements) to
18415                  * inform others.
18416                  */
18417                 if (res_act == Res_act_initial || !ipif->ipif_addr_ready) {
18418                         state = ND_UNCHANGED; /* compute in nce_add_common() */
18419                 } else {
18420                         state = ND_REACHABLE;
18421                         flags |= NCE_F_UNSOL_ADV;
18422                 }
18423 
18424 retry:
18425                 err = nce_lookup_then_add_v4(ill,
18426                     bound_ill->ill_phys_addr, bound_ill->ill_phys_addr_length,
18427                     addr, flags, state, &nce);
18428 
18429                 /*
18430                  * note that we may encounter EEXIST if we are moving
18431                  * the nce as a result of a rebind operation.
18432                  */
18433                 switch (err) {
18434                 case 0:
18435                         ipif->ipif_added_nce = 1;
18436                         nce->nce_ipif_cnt++;
18437                         break;
18438                 case EEXIST:
18439                         ip1dbg(("ipif_arp_up: NCE already exists for %s\n",
18440                             ill->ill_name));
18441                         if (!NCE_MYADDR(nce->nce_common)) {
18442                                 /*
18443                                  * A leftover nce from before this address
18444                                  * existed
18445                                  */
18446                                 ncec_delete(nce->nce_common);
18447                                 nce_refrele(nce);
18448                                 nce = NULL;
18449                                 goto retry;
18450                         }
18451                         if ((ipif->ipif_flags & IPIF_POINTOPOINT) == 0) {
18452                                 nce_refrele(nce);
18453                                 nce = NULL;
18454                                 ip1dbg(("ipif_arp_up: NCE already exists "
18455                                     "for %s:%u\n", ill->ill_name,
18456                                     ipif->ipif_id));
18457                                 goto arp_up_done;
18458                         }
18459                         /*
18460                          * Duplicate local addresses are permissible for
18461                          * IPIF_POINTOPOINT interfaces which will get marked
18462                          * IPIF_UNNUMBERED later in
18463                          * ip_addr_availability_check().
18464                          *
18465                          * The nce_ipif_cnt field tracks the number of
18466                          * ipifs that have nce_addr as their local address.
18467                          */
18468                         ipif->ipif_addr_ready = 1;
18469                         ipif->ipif_added_nce = 1;
18470                         nce->nce_ipif_cnt++;
18471                         err = 0;
18472                         break;
18473                 default:
18474                         ASSERT(nce == NULL);
18475                         goto arp_up_done;
18476                 }
18477                 if (arp_no_defense) {
18478                         if ((ipif->ipif_flags & IPIF_UP) &&
18479                             !ipif->ipif_addr_ready)
18480                                 ipif_up_notify(ipif);
18481                         ipif->ipif_addr_ready = 1;
18482                 }
18483         } else {
18484                 /* zero address. nothing to publish */
18485                 ipif->ipif_addr_ready = 1;
18486         }
18487         if (nce != NULL)
18488                 nce_refrele(nce);
18489 arp_up_done:
18490         if (added_ipif && err != 0)
18491                 ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18492         return (err);
18493 }
18494 
18495 int
18496 ipif_arp_up(ipif_t *ipif, enum ip_resolver_action res_act, boolean_t was_dup)
18497 {
18498         int             err = 0;
18499         ill_t           *ill = ipif->ipif_ill;
18500         boolean_t       first_interface, wait_for_dlpi = B_FALSE;
18501 
18502         DTRACE_PROBE3(ipif__downup, char *, "ipif_arp_up",
18503             ill_t *, ill, ipif_t *, ipif);
18504 
18505         /*
18506          * need to bring up ARP or setup mcast mapping only
18507          * when the first interface is coming UP.
18508          */
18509         first_interface = (ill->ill_ipif_up_count == 0 &&
18510             ill->ill_ipif_dup_count == 0 && !was_dup);
18511 
18512         if (res_act == Res_act_initial && first_interface) {
18513                 /*
18514                  * Send ATTACH + BIND
18515                  */
18516                 err = arp_ll_up(ill);
18517                 if (err != EINPROGRESS && err != 0)
18518                         return (err);
18519 
18520                 /*
18521                  * Add NCE for local address. Start DAD.
18522                  * we'll wait to hear that DAD has finished
18523                  * before using the interface.
18524                  */
18525                 if (err == EINPROGRESS)
18526                         wait_for_dlpi = B_TRUE;
18527         }
18528 
18529         if (!wait_for_dlpi)
18530                 (void) ipif_arp_up_done_tail(ipif, res_act);
18531 
18532         return (!wait_for_dlpi ? 0 : EINPROGRESS);
18533 }
18534 
18535 /*
18536  * Finish processing of "arp_up" after all the DLPI message
18537  * exchanges have completed between arp and the driver.
18538  */
18539 void
18540 arp_bringup_done(ill_t *ill, int err)
18541 {
18542         mblk_t  *mp1;
18543         ipif_t  *ipif;
18544         conn_t *connp = NULL;
18545         ipsq_t  *ipsq;
18546         queue_t *q;
18547 
18548         ip1dbg(("arp_bringup_done(%s)\n", ill->ill_name));
18549 
18550         ASSERT(IAM_WRITER_ILL(ill));
18551 
18552         ipsq = ill->ill_phyint->phyint_ipsq;
18553         ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18554         mp1 = ipsq_pending_mp_get(ipsq, &connp);
18555         ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18556         if (mp1 == NULL) /* bringup was aborted by the user */
18557                 return;
18558 
18559         /*
18560          * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18561          * must have an associated conn_t.  Otherwise, we're bringing this
18562          * interface back up as part of handling an asynchronous event (e.g.,
18563          * physical address change).
18564          */
18565         if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18566                 ASSERT(connp != NULL);
18567                 q = CONNP_TO_WQ(connp);
18568         } else {
18569                 ASSERT(connp == NULL);
18570                 q = ill->ill_rq;
18571         }
18572         if (err == 0) {
18573                 if (ipif->ipif_isv6) {
18574                         if ((err = ipif_up_done_v6(ipif)) != 0)
18575                                 ip0dbg(("arp_bringup_done: init failed\n"));
18576                 } else {
18577                         err = ipif_arp_up_done_tail(ipif, Res_act_initial);
18578                         if (err != 0 ||
18579                             (err = ipif_up_done(ipif)) != 0) {
18580                                 ip0dbg(("arp_bringup_done: "
18581                                     "init failed err %x\n", err));
18582                                 (void) ipif_arp_down(ipif);
18583                         }
18584 
18585                 }
18586         } else {
18587                 ip0dbg(("arp_bringup_done: DL_BIND_REQ failed\n"));
18588         }
18589 
18590         if ((err == 0) && (ill->ill_up_ipifs)) {
18591                 err = ill_up_ipifs(ill, q, mp1);
18592                 if (err == EINPROGRESS)
18593                         return;
18594         }
18595 
18596         /*
18597          * If we have a moved ipif to bring up, and everything has succeeded
18598          * to this point, bring it up on the IPMP ill.  Otherwise, leave it
18599          * down -- the admin can try to bring it up by hand if need be.
18600          */
18601         if (ill->ill_move_ipif != NULL) {
18602                 ipif = ill->ill_move_ipif;
18603                 ip1dbg(("bringing up ipif %p on ill %s\n", (void *)ipif,
18604                     ipif->ipif_ill->ill_name));
18605                 ill->ill_move_ipif = NULL;
18606                 if (err == 0) {
18607                         err = ipif_up(ipif, q, mp1);
18608                         if (err == EINPROGRESS)
18609                                 return;
18610                 }
18611         }
18612 
18613         /*
18614          * The operation must complete without EINPROGRESS since
18615          * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18616          * Otherwise, the operation will be stuck forever in the ipsq.
18617          */
18618         ASSERT(err != EINPROGRESS);
18619         if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18620                 DTRACE_PROBE4(ipif__ioctl, char *, "arp_bringup_done finish",
18621                     int, ipsq->ipsq_xop->ipx_current_ioctl,
18622                     ill_t *, ill, ipif_t *, ipif);
18623                 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18624         } else {
18625                 ipsq_current_finish(ipsq);
18626         }
18627 }
18628 
18629 /*
18630  * Finish processing of arp replumb after all the DLPI message
18631  * exchanges have completed between arp and the driver.
18632  */
18633 void
18634 arp_replumb_done(ill_t *ill, int err)
18635 {
18636         mblk_t  *mp1;
18637         ipif_t  *ipif;
18638         conn_t *connp = NULL;
18639         ipsq_t  *ipsq;
18640         queue_t *q;
18641 
18642         ASSERT(IAM_WRITER_ILL(ill));
18643 
18644         ipsq = ill->ill_phyint->phyint_ipsq;
18645         ipif = ipsq->ipsq_xop->ipx_pending_ipif;
18646         mp1 = ipsq_pending_mp_get(ipsq, &connp);
18647         ASSERT(!((mp1 != NULL) ^ (ipif != NULL)));
18648         if (mp1 == NULL) {
18649                 ip0dbg(("arp_replumb_done: bringup aborted ioctl %x\n",
18650                     ipsq->ipsq_xop->ipx_current_ioctl));
18651                 /* bringup was aborted by the user */
18652                 return;
18653         }
18654         /*
18655          * If an IOCTL is waiting on this (ipsq_current_ioctl != 0), then we
18656          * must have an associated conn_t.  Otherwise, we're bringing this
18657          * interface back up as part of handling an asynchronous event (e.g.,
18658          * physical address change).
18659          */
18660         if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18661                 ASSERT(connp != NULL);
18662                 q = CONNP_TO_WQ(connp);
18663         } else {
18664                 ASSERT(connp == NULL);
18665                 q = ill->ill_rq;
18666         }
18667         if ((err == 0) && (ill->ill_up_ipifs)) {
18668                 err = ill_up_ipifs(ill, q, mp1);
18669                 if (err == EINPROGRESS)
18670                         return;
18671         }
18672         /*
18673          * The operation must complete without EINPROGRESS since
18674          * ipsq_pending_mp_get() has removed the mblk from ipsq_pending_mp.
18675          * Otherwise, the operation will be stuck forever in the ipsq.
18676          */
18677         ASSERT(err != EINPROGRESS);
18678         if (ipsq->ipsq_xop->ipx_current_ioctl != 0) {
18679                 DTRACE_PROBE4(ipif__ioctl, char *,
18680                     "arp_replumb_done finish",
18681                     int, ipsq->ipsq_xop->ipx_current_ioctl,
18682                     ill_t *, ill, ipif_t *, ipif);
18683                 ip_ioctl_finish(q, mp1, err, NO_COPYOUT, ipsq);
18684         } else {
18685                 ipsq_current_finish(ipsq);
18686         }
18687 }
18688 
18689 void
18690 ipif_up_notify(ipif_t *ipif)
18691 {
18692         ip_rts_ifmsg(ipif, RTSQ_DEFAULT);
18693         ip_rts_newaddrmsg(RTM_ADD, 0, ipif, RTSQ_DEFAULT);
18694         sctp_update_ipif(ipif, SCTP_IPIF_UP);
18695         ill_nic_event_dispatch(ipif->ipif_ill, MAP_IPIF_ID(ipif->ipif_id),
18696             NE_LIF_UP, NULL, 0);
18697 }
18698 
18699 /*
18700  * ILB ioctl uses cv_wait (such as deleting a rule or adding a server) and
18701  * this assumes the context is cv_wait'able.  Hence it shouldnt' be used on
18702  * TPI end points with STREAMS modules pushed above.  This is assured by not
18703  * having the IPI_MODOK flag for the ioctl.  And IP ensures the ILB ioctl
18704  * never ends up on an ipsq, otherwise we may end up processing the ioctl
18705  * while unwinding from the ispq and that could be a thread from the bottom.
18706  */
18707 /* ARGSUSED */
18708 int
18709 ip_sioctl_ilb_cmd(ipif_t *ipif, sin_t *sin, queue_t *q, mblk_t *mp,
18710     ip_ioctl_cmd_t *ipip, void *arg)
18711 {
18712         mblk_t *cmd_mp = mp->b_cont->b_cont;
18713         ilb_cmd_t command = *((ilb_cmd_t *)cmd_mp->b_rptr);
18714         int ret = 0;
18715         int i;
18716         size_t size;
18717         ip_stack_t *ipst;
18718         zoneid_t zoneid;
18719         ilb_stack_t *ilbs;
18720 
18721         ipst = CONNQ_TO_IPST(q);
18722         ilbs = ipst->ips_netstack->netstack_ilb;
18723         zoneid = Q_TO_CONN(q)->conn_zoneid;
18724 
18725         switch (command) {
18726         case ILB_CREATE_RULE: {
18727                 ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18728 
18729                 if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18730                         ret = EINVAL;
18731                         break;
18732                 }
18733 
18734                 ret = ilb_rule_add(ilbs, zoneid, cmd);
18735                 break;
18736         }
18737         case ILB_DESTROY_RULE:
18738         case ILB_ENABLE_RULE:
18739         case ILB_DISABLE_RULE: {
18740                 ilb_name_cmd_t *cmd = (ilb_name_cmd_t *)cmd_mp->b_rptr;
18741 
18742                 if (MBLKL(cmd_mp) != sizeof (ilb_name_cmd_t)) {
18743                         ret = EINVAL;
18744                         break;
18745                 }
18746 
18747                 if (cmd->flags & ILB_RULE_ALLRULES) {
18748                         if (command == ILB_DESTROY_RULE) {
18749                                 ilb_rule_del_all(ilbs, zoneid);
18750                                 break;
18751                         } else if (command == ILB_ENABLE_RULE) {
18752                                 ilb_rule_enable_all(ilbs, zoneid);
18753                                 break;
18754                         } else if (command == ILB_DISABLE_RULE) {
18755                                 ilb_rule_disable_all(ilbs, zoneid);
18756                                 break;
18757                         }
18758                 } else {
18759                         if (command == ILB_DESTROY_RULE) {
18760                                 ret = ilb_rule_del(ilbs, zoneid, cmd->name);
18761                         } else if (command == ILB_ENABLE_RULE) {
18762                                 ret = ilb_rule_enable(ilbs, zoneid, cmd->name,
18763                                     NULL);
18764                         } else if (command == ILB_DISABLE_RULE) {
18765                                 ret = ilb_rule_disable(ilbs, zoneid, cmd->name,
18766                                     NULL);
18767                         }
18768                 }
18769                 break;
18770         }
18771         case ILB_NUM_RULES: {
18772                 ilb_num_rules_cmd_t *cmd;
18773 
18774                 if (MBLKL(cmd_mp) != sizeof (ilb_num_rules_cmd_t)) {
18775                         ret = EINVAL;
18776                         break;
18777                 }
18778                 cmd = (ilb_num_rules_cmd_t *)cmd_mp->b_rptr;
18779                 ilb_get_num_rules(ilbs, zoneid, &(cmd->num));
18780                 break;
18781         }
18782         case ILB_RULE_NAMES: {
18783                 ilb_rule_names_cmd_t *cmd;
18784 
18785                 cmd = (ilb_rule_names_cmd_t *)cmd_mp->b_rptr;
18786                 if (MBLKL(cmd_mp) < sizeof (ilb_rule_names_cmd_t) ||
18787                     cmd->num_names == 0) {
18788                         ret = EINVAL;
18789                         break;
18790                 }
18791                 size = cmd->num_names * ILB_RULE_NAMESZ;
18792                 if (cmd_mp->b_rptr + offsetof(ilb_rule_names_cmd_t, buf) +
18793                     size != cmd_mp->b_wptr) {
18794                         ret = EINVAL;
18795                         break;
18796                 }
18797                 ilb_get_rulenames(ilbs, zoneid, &cmd->num_names, cmd->buf);
18798                 break;
18799         }
18800         case ILB_NUM_SERVERS: {
18801                 ilb_num_servers_cmd_t *cmd;
18802 
18803                 if (MBLKL(cmd_mp) != sizeof (ilb_num_servers_cmd_t)) {
18804                         ret = EINVAL;
18805                         break;
18806                 }
18807                 cmd = (ilb_num_servers_cmd_t *)cmd_mp->b_rptr;
18808                 ret = ilb_get_num_servers(ilbs, zoneid, cmd->name,
18809                     &(cmd->num));
18810                 break;
18811         }
18812         case ILB_LIST_RULE: {
18813                 ilb_rule_cmd_t *cmd = (ilb_rule_cmd_t *)cmd_mp->b_rptr;
18814 
18815                 if (MBLKL(cmd_mp) != sizeof (ilb_rule_cmd_t)) {
18816                         ret = EINVAL;
18817                         break;
18818                 }
18819                 ret = ilb_rule_list(ilbs, zoneid, cmd);
18820                 break;
18821         }
18822         case ILB_LIST_SERVERS: {
18823                 ilb_servers_info_cmd_t *cmd;
18824 
18825                 cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18826                 if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t) ||
18827                     cmd->num_servers == 0) {
18828                         ret = EINVAL;
18829                         break;
18830                 }
18831                 size = cmd->num_servers * sizeof (ilb_server_info_t);
18832                 if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18833                     size != cmd_mp->b_wptr) {
18834                         ret = EINVAL;
18835                         break;
18836                 }
18837 
18838                 ret = ilb_get_servers(ilbs, zoneid, cmd->name, cmd->servers,
18839                     &cmd->num_servers);
18840                 break;
18841         }
18842         case ILB_ADD_SERVERS: {
18843                 ilb_servers_info_cmd_t *cmd;
18844                 ilb_rule_t *rule;
18845 
18846                 cmd = (ilb_servers_info_cmd_t *)cmd_mp->b_rptr;
18847                 if (MBLKL(cmd_mp) < sizeof (ilb_servers_info_cmd_t)) {
18848                         ret = EINVAL;
18849                         break;
18850                 }
18851                 size = cmd->num_servers * sizeof (ilb_server_info_t);
18852                 if (cmd_mp->b_rptr + offsetof(ilb_servers_info_cmd_t, servers) +
18853                     size != cmd_mp->b_wptr) {
18854                         ret = EINVAL;
18855                         break;
18856                 }
18857                 rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18858                 if (rule == NULL) {
18859                         ASSERT(ret != 0);
18860                         break;
18861                 }
18862                 for (i = 0; i < cmd->num_servers; i++) {
18863                         ilb_server_info_t *s;
18864 
18865                         s = &cmd->servers[i];
18866                         s->err = ilb_server_add(ilbs, rule, s);
18867                 }
18868                 ILB_RULE_REFRELE(rule);
18869                 break;
18870         }
18871         case ILB_DEL_SERVERS:
18872         case ILB_ENABLE_SERVERS:
18873         case ILB_DISABLE_SERVERS: {
18874                 ilb_servers_cmd_t *cmd;
18875                 ilb_rule_t *rule;
18876                 int (*f)();
18877 
18878                 cmd = (ilb_servers_cmd_t *)cmd_mp->b_rptr;
18879                 if (MBLKL(cmd_mp) < sizeof (ilb_servers_cmd_t)) {
18880                         ret = EINVAL;
18881                         break;
18882                 }
18883                 size = cmd->num_servers * sizeof (ilb_server_arg_t);
18884                 if (cmd_mp->b_rptr + offsetof(ilb_servers_cmd_t, servers) +
18885                     size != cmd_mp->b_wptr) {
18886                         ret = EINVAL;
18887                         break;
18888                 }
18889 
18890                 if (command == ILB_DEL_SERVERS)
18891                         f = ilb_server_del;
18892                 else if (command == ILB_ENABLE_SERVERS)
18893                         f = ilb_server_enable;
18894                 else if (command == ILB_DISABLE_SERVERS)
18895                         f = ilb_server_disable;
18896 
18897                 rule = ilb_find_rule(ilbs, zoneid, cmd->name, &ret);
18898                 if (rule == NULL) {
18899                         ASSERT(ret != 0);
18900                         break;
18901                 }
18902 
18903                 for (i = 0; i < cmd->num_servers; i++) {
18904                         ilb_server_arg_t *s;
18905 
18906                         s = &cmd->servers[i];
18907                         s->err = f(ilbs, zoneid, NULL, rule, &s->addr);
18908                 }
18909                 ILB_RULE_REFRELE(rule);
18910                 break;
18911         }
18912         case ILB_LIST_NAT_TABLE: {
18913                 ilb_list_nat_cmd_t *cmd;
18914 
18915                 cmd = (ilb_list_nat_cmd_t *)cmd_mp->b_rptr;
18916                 if (MBLKL(cmd_mp) < sizeof (ilb_list_nat_cmd_t)) {
18917                         ret = EINVAL;
18918                         break;
18919                 }
18920                 size = cmd->num_nat * sizeof (ilb_nat_entry_t);
18921                 if (cmd_mp->b_rptr + offsetof(ilb_list_nat_cmd_t, entries) +
18922                     size != cmd_mp->b_wptr) {
18923                         ret = EINVAL;
18924                         break;
18925                 }
18926 
18927                 ret = ilb_list_nat(ilbs, zoneid, cmd->entries, &cmd->num_nat,
18928                     &cmd->flags);
18929                 break;
18930         }
18931         case ILB_LIST_STICKY_TABLE: {
18932                 ilb_list_sticky_cmd_t *cmd;
18933 
18934                 cmd = (ilb_list_sticky_cmd_t *)cmd_mp->b_rptr;
18935                 if (MBLKL(cmd_mp) < sizeof (ilb_list_sticky_cmd_t)) {
18936                         ret = EINVAL;
18937                         break;
18938                 }
18939                 size = cmd->num_sticky * sizeof (ilb_sticky_entry_t);
18940                 if (cmd_mp->b_rptr + offsetof(ilb_list_sticky_cmd_t, entries) +
18941                     size != cmd_mp->b_wptr) {
18942                         ret = EINVAL;
18943                         break;
18944                 }
18945 
18946                 ret = ilb_list_sticky(ilbs, zoneid, cmd->entries,
18947                     &cmd->num_sticky, &cmd->flags);
18948                 break;
18949         }
18950         default:
18951                 ret = EINVAL;
18952                 break;
18953         }
18954 done:
18955         return (ret);
18956 }
18957 
18958 /* Remove all cache entries for this logical interface */
18959 void
18960 ipif_nce_down(ipif_t *ipif)
18961 {
18962         ill_t *ill = ipif->ipif_ill;
18963         nce_t *nce;
18964 
18965         DTRACE_PROBE3(ipif__downup, char *, "ipif_nce_down",
18966             ill_t *, ill, ipif_t *, ipif);
18967         if (ipif->ipif_added_nce) {
18968                 if (ipif->ipif_isv6)
18969                         nce = nce_lookup_v6(ill, &ipif->ipif_v6lcl_addr);
18970                 else
18971                         nce = nce_lookup_v4(ill, &ipif->ipif_lcl_addr);
18972                 if (nce != NULL) {
18973                         if (--nce->nce_ipif_cnt == 0)
18974                                 ncec_delete(nce->nce_common);
18975                         ipif->ipif_added_nce = 0;
18976                         nce_refrele(nce);
18977                 } else {
18978                         /*
18979                          * nce may already be NULL because it was already
18980                          * flushed, e.g., due to a call to nce_flush
18981                          */
18982                         ipif->ipif_added_nce = 0;
18983                 }
18984         }
18985         /*
18986          * Make IPMP aware of the deleted data address.
18987          */
18988         if (IS_IPMP(ill))
18989                 ipmp_illgrp_del_ipif(ill->ill_grp, ipif);
18990 
18991         /*
18992          * Remove all other nces dependent on this ill when the last ipif
18993          * is going away.
18994          */
18995         if (ill->ill_ipif_up_count == 0) {
18996                 ncec_walk(ill, (pfi_t)ncec_delete_per_ill,
18997                     (uchar_t *)ill, ill->ill_ipst);
18998                 if (IS_UNDER_IPMP(ill))
18999                         nce_flush(ill, B_TRUE);
19000         }
19001 }
19002 
19003 /*
19004  * find the first interface that uses usill for its source address.
19005  */
19006 ill_t *
19007 ill_lookup_usesrc(ill_t *usill)
19008 {
19009         ip_stack_t *ipst = usill->ill_ipst;
19010         ill_t *ill;
19011 
19012         ASSERT(usill != NULL);
19013 
19014         /* ill_g_usesrc_lock protects ill_usesrc_grp_next */
19015         rw_enter(&ipst->ips_ill_g_usesrc_lock, RW_WRITER);
19016         rw_enter(&ipst->ips_ill_g_lock, RW_READER);
19017         for (ill = usill->ill_usesrc_grp_next; ill != NULL && ill != usill;
19018             ill = ill->ill_usesrc_grp_next) {
19019                 if (!IS_UNDER_IPMP(ill) && (ill->ill_flags & ILLF_MULTICAST) &&
19020                     !ILL_IS_CONDEMNED(ill)) {
19021                         ill_refhold(ill);
19022                         break;
19023                 }
19024         }
19025         rw_exit(&ipst->ips_ill_g_lock);
19026         rw_exit(&ipst->ips_ill_g_usesrc_lock);
19027         return (ill);
19028 }
19029 
19030 /*
19031  * This comment applies to both ip_sioctl_get_ifhwaddr and
19032  * ip_sioctl_get_lifhwaddr as the basic function of these two functions
19033  * is the same.
19034  *
19035  * The goal here is to find an IP interface that corresponds to the name
19036  * provided by the caller in the ifreq/lifreq structure held in the mblk_t
19037  * chain and to fill out a sockaddr/sockaddr_storage structure with the
19038  * mac address.
19039  *
19040  * The SIOCGIFHWADDR/SIOCGLIFHWADDR ioctl may return an error for a number
19041  * of different reasons:
19042  * ENXIO - the device name is not known to IP.
19043  * EADDRNOTAVAIL - the device has no hardware address. This is indicated
19044  * by ill_phys_addr not pointing to an actual address.
19045  * EPFNOSUPPORT - this will indicate that a request is being made for a
19046  * mac address that will not fit in the data structure supplier (struct
19047  * sockaddr).
19048  *
19049  */
19050 /* ARGSUSED */
19051 int
19052 ip_sioctl_get_ifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19053     ip_ioctl_cmd_t *ipip, void *if_req)
19054 {
19055         struct sockaddr *sock;
19056         struct ifreq *ifr;
19057         mblk_t *mp1;
19058         ill_t *ill;
19059 
19060         ASSERT(ipif != NULL);
19061         ill = ipif->ipif_ill;
19062 
19063         if (ill->ill_phys_addr == NULL) {
19064                 return (EADDRNOTAVAIL);
19065         }
19066         if (ill->ill_phys_addr_length > sizeof (sock->sa_data)) {
19067                 return (EPFNOSUPPORT);
19068         }
19069 
19070         ip1dbg(("ip_sioctl_get_hwaddr(%s)\n", ill->ill_name));
19071 
19072         /* Existence of mp1 has been checked in ip_wput_nondata */
19073         mp1 = mp->b_cont->b_cont;
19074         ifr = (struct ifreq *)mp1->b_rptr;
19075 
19076         sock = &ifr->ifr_addr;
19077         /*
19078          * The "family" field in the returned structure is set to a value
19079          * that represents the type of device to which the address belongs.
19080          * The value returned may differ to that on Linux but it will still
19081          * represent the correct symbol on Solaris.
19082          */
19083         sock->sa_family = arp_hw_type(ill->ill_mactype);
19084         bcopy(ill->ill_phys_addr, &sock->sa_data, ill->ill_phys_addr_length);
19085 
19086         return (0);
19087 }
19088 
19089 /*
19090  * The expection of applications using SIOCGIFHWADDR is that data will
19091  * be returned in the sa_data field of the sockaddr structure. With
19092  * SIOCGLIFHWADDR, we're breaking new ground as there is no Linux
19093  * equivalent. In light of this, struct sockaddr_dl is used as it
19094  * offers more space for address storage in sll_data.
19095  */
19096 /* ARGSUSED */
19097 int
19098 ip_sioctl_get_lifhwaddr(ipif_t *ipif, sin_t *dummy_sin, queue_t *q, mblk_t *mp,
19099     ip_ioctl_cmd_t *ipip, void *if_req)
19100 {
19101         struct sockaddr_dl *sock;
19102         struct lifreq *lifr;
19103         mblk_t *mp1;
19104         ill_t *ill;
19105 
19106         ASSERT(ipif != NULL);
19107         ill = ipif->ipif_ill;
19108 
19109         if (ill->ill_phys_addr == NULL) {
19110                 return (EADDRNOTAVAIL);
19111         }
19112         if (ill->ill_phys_addr_length > sizeof (sock->sdl_data)) {
19113                 return (EPFNOSUPPORT);
19114         }
19115 
19116         ip1dbg(("ip_sioctl_get_lifhwaddr(%s)\n", ill->ill_name));
19117 
19118         /* Existence of mp1 has been checked in ip_wput_nondata */
19119         mp1 = mp->b_cont->b_cont;
19120         lifr = (struct lifreq *)mp1->b_rptr;
19121 
19122         /*
19123          * sockaddr_ll is used here because it is also the structure used in
19124          * responding to the same ioctl in sockpfp. The only other choice is
19125          * sockaddr_dl which contains fields that are not required here
19126          * because its purpose is different.
19127          */
19128         lifr->lifr_type = ill->ill_type;
19129         sock = (struct sockaddr_dl *)&lifr->lifr_addr;
19130         sock->sdl_family = AF_LINK;
19131         sock->sdl_index = ill->ill_phyint->phyint_ifindex;
19132         sock->sdl_type = ill->ill_mactype;
19133         sock->sdl_nlen = 0;
19134         sock->sdl_slen = 0;
19135         sock->sdl_alen = ill->ill_phys_addr_length;
19136         bcopy(ill->ill_phys_addr, sock->sdl_data, ill->ill_phys_addr_length);
19137 
19138         return (0);
19139 }