/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
 */

#include <inet/ip_arp.h>
#include <inet/ip_ndp.h>
#include <net/if_arp.h>
#include <netinet/if_ether.h>
#include <sys/strsubr.h>
#include <inet/ip6.h>
#include <inet/ip.h>
#include <inet/ip_ire.h>
#include <inet/ip_if.h>
#include <sys/dlpi.h>
#include <sys/sunddi.h>
#include <sys/strsun.h>
#include <sys/sdt.h>
#include <inet/mi.h>
#include <inet/arp.h>
#include <inet/ipdrop.h>
#include <sys/sockio.h>
#include <inet/ip_impl.h>
#include <sys/policy.h>

#define ARL_LL_ADDR_OFFSET(arl) (((arl)->arl_sap_length) < 0 ? \
        (sizeof (dl_unitdata_req_t)) : \
        ((sizeof (dl_unitdata_req_t)) + (ABS((arl)->arl_sap_length))))

/*
 * MAC-specific intelligence.  Shouldn't be needed, but the DL_INFO_ACK
 * doesn't quite do it for us.
 */
typedef struct arp_m_s {
        t_uscalar_t     arp_mac_type;
        uint32_t        arp_mac_arp_hw_type;
        t_scalar_t      arp_mac_sap_length;
        uint32_t        arp_mac_hw_addr_length;
} arp_m_t;

static int arp_close(queue_t *, int, cred_t *);
static int arp_rput(queue_t *, mblk_t *);
static int arp_wput(queue_t *, mblk_t *);
static arp_m_t  *arp_m_lookup(t_uscalar_t mac_type);
static void arp_notify(ipaddr_t, mblk_t *, uint32_t, ip_recv_attr_t *,
        ncec_t *);
static int arp_output(ill_t *, uint32_t, const uchar_t *, const uchar_t *,
        const uchar_t *, const uchar_t *, uchar_t *);
static int  arp_modclose(arl_t *);
static void  arp_mod_close_tail(arl_t *);
static mblk_t *arl_unbind(arl_t *);
static void arp_process_packet(ill_t *, mblk_t *);
static void arp_excl(ipsq_t *, queue_t *, mblk_t *, void *);
static void arp_drop_packet(const char *str, mblk_t *, ill_t *);
static int arp_open(queue_t *, dev_t *, int, int, cred_t *);
static int ip_sioctl_ifunitsel_arp(queue_t *, int *);
static int ip_sioctl_slifname_arp(queue_t *, void *);
static void arp_dlpi_send(arl_t *, mblk_t *);
static void arl_defaults_common(arl_t *, mblk_t *);
static int arp_modopen(queue_t *, dev_t *, int, int, cred_t *);
static void arp_ifname_notify(arl_t *);
static void arp_rput_dlpi_writer(ipsq_t *, queue_t *, mblk_t *, void *);
static arl_t *ill_to_arl(ill_t *);

#define DL_PRIM(mp)     (((union DL_primitives *)(mp)->b_rptr)->dl_primitive)
#define IS_DLPI_DATA(mp)                                                \
        ((DB_TYPE(mp) == M_PROTO) &&                                    \
        MBLKL(mp) >= sizeof (dl_unitdata_ind_t) &&                      \
        (DL_PRIM(mp) == DL_UNITDATA_IND))

#define AR_NOTFOUND     1       /* No matching ace found in cache */
#define AR_MERGED       2       /* Matching ace updated (RFC 826 Merge_flag) */
#define AR_LOOPBACK     3       /* Our own arp packet was received */
#define AR_BOGON        4       /* Another host has our IP addr. */
#define AR_FAILED       5       /* Duplicate Address Detection has failed */
#define AR_CHANGED      6       /* Address has changed; tell IP (and merged) */

boolean_t arp_no_defense;

struct module_info arp_mod_info = {
        IP_MOD_ID, "arp", 1, INFPSZ, 65536, 1024
};
static struct qinit rinit_arp = {
        arp_rput, NULL, arp_open, arp_close, NULL, &arp_mod_info
};
static struct qinit winit_arp = {
        arp_wput, NULL, arp_open, arp_close, NULL, &arp_mod_info
};
struct streamtab arpinfo = {
        &rinit_arp, &winit_arp
};
#define ARH_FIXED_LEN   8
#define AR_LL_HDR_SLACK 32

/*
 * pfhooks for ARP.
 */
#define ARP_HOOK_IN(_hook, _event, _ilp, _hdr, _fm, _m, ipst)           \
                                                                        \
        if ((_hook).he_interested) {                                    \
                hook_pkt_event_t info;                                  \
                                                                        \
                info.hpe_protocol = ipst->ips_arp_net_data;             \
                info.hpe_ifp = _ilp;                                    \
                info.hpe_ofp = 0;                                       \
                info.hpe_hdr = _hdr;                                    \
                info.hpe_mp = &(_fm);                                   \
                info.hpe_mb = _m;                                       \
                if (hook_run(ipst->ips_arp_net_data->netd_hooks,        \
                    _event, (hook_data_t)&info) != 0) {                 \
                        if (_fm != NULL) {                              \
                                freemsg(_fm);                           \
                                _fm = NULL;                             \
                        }                                               \
                        _hdr = NULL;                                    \
                        _m = NULL;                                      \
                } else {                                                \
                        _hdr = info.hpe_hdr;                            \
                        _m = info.hpe_mb;                               \
                }                                                       \
        }

#define ARP_HOOK_OUT(_hook, _event, _olp, _hdr, _fm, _m, ipst)          \
                                                                        \
        if ((_hook).he_interested) {                                    \
                hook_pkt_event_t info;                                  \
                                                                        \
                info.hpe_protocol = ipst->ips_arp_net_data;             \
                info.hpe_ifp = 0;                                       \
                info.hpe_ofp = _olp;                                    \
                info.hpe_hdr = _hdr;                                    \
                info.hpe_mp = &(_fm);                                   \
                info.hpe_mb = _m;                                       \
                if (hook_run(ipst->ips_arp_net_data->netd_hooks,        \
                    _event, (hook_data_t)&info) != 0) {                 \
                        if (_fm != NULL) {                              \
                                freemsg(_fm);                           \
                                _fm = NULL;                             \
                        }                                               \
                        _hdr = NULL;                                    \
                        _m = NULL;                                      \
                } else {                                                \
                        _hdr = info.hpe_hdr;                            \
                        _m = info.hpe_mb;                               \
                }                                                       \
        }

static arp_m_t  arp_m_tbl[] = {
        { DL_CSMACD,    ARPHRD_ETHER,   -2,     6},     /* 802.3 */
        { DL_TPB,       ARPHRD_IEEE802, -2,     6},     /* 802.4 */
        { DL_TPR,       ARPHRD_IEEE802, -2,     6},     /* 802.5 */
        { DL_METRO,     ARPHRD_IEEE802, -2,     6},     /* 802.6 */
        { DL_ETHER,     ARPHRD_ETHER,   -2,     6},     /* Ethernet */
        { DL_FDDI,      ARPHRD_ETHER,   -2,     6},     /* FDDI */
        { DL_IB,        ARPHRD_IB,      -2,     20},    /* Infiniband */
        { DL_OTHER,     ARPHRD_ETHER,   -2,     6}      /* unknown */
};

static void
arl_refhold_locked(arl_t *arl)
{
        ASSERT(MUTEX_HELD(&arl->arl_lock));
        arl->arl_refcnt++;
        ASSERT(arl->arl_refcnt != 0);
}

static void
arl_refrele(arl_t *arl)
{
        mutex_enter(&arl->arl_lock);
        ASSERT(arl->arl_refcnt != 0);
        arl->arl_refcnt--;
        if (arl->arl_refcnt > 1) {
                mutex_exit(&arl->arl_lock);
                return;
        }

        /* ill_close or arp_unbind_complete may be waiting */
        cv_broadcast(&arl->arl_cv);
        mutex_exit(&arl->arl_lock);
}

/*
 * wake up any pending ip ioctls.
 */
static void
arp_cmd_done(ill_t *ill, int err, t_uscalar_t lastprim)
{
        if (lastprim == DL_UNBIND_REQ && ill->ill_replumbing)
                arp_replumb_done(ill, 0);
        else
                arp_bringup_done(ill, err);
}

static int
ip_nce_resolve_all(ill_t *ill, uchar_t *src_haddr, uint32_t hlen,
    const in_addr_t *src_paddr, ncec_t **sncec, int op)
{
        int retv;
        ncec_t *ncec;
        boolean_t ll_changed;
        uchar_t *lladdr = NULL;
        int new_state;

        ASSERT(ill != NULL);

        ncec = ncec_lookup_illgrp_v4(ill, src_paddr);
        *sncec = ncec;

        if (ncec == NULL) {
                retv = AR_NOTFOUND;
                goto done;
        }

        mutex_enter(&ncec->ncec_lock);
        /*
         * IP addr and hardware address match what we already
         * have, then this is a broadcast packet emitted by one of our
         * interfaces, reflected by the switch and received on another
         * interface.  We return AR_LOOPBACK.
         */
        lladdr = ncec->ncec_lladdr;
        if (NCE_MYADDR(ncec) && hlen == ncec->ncec_ill->ill_phys_addr_length &&
            bcmp(lladdr, src_haddr, hlen) == 0) {
                mutex_exit(&ncec->ncec_lock);
                retv = AR_LOOPBACK;
                goto done;
        }
        /*
         * If the entry is unverified, then we've just verified that
         * someone else already owns this address, because this is a
         * message with the same protocol address but different
         * hardware address.
         */
        if (ncec->ncec_flags & NCE_F_UNVERIFIED) {
                mutex_exit(&ncec->ncec_lock);
                ncec_delete(ncec);
                ncec_refrele(ncec);
                *sncec = NULL;
                retv = AR_FAILED;
                goto done;
        }

        /*
         * If the IP address matches ours and we're authoritative for
         * this entry, then some other node is using our IP addr, so
         * return AR_BOGON.  Also reset the transmit count to zero so
         * that, if we're currently in initial announcement mode, we
         * switch back to the lazier defense mode.  Knowing that
         * there's at least one duplicate out there, we ought not
         * blindly announce.
         *
         * NCE_F_AUTHORITY is set in one of two ways:
         * 1. /sbin/arp told us so, via the "permanent" flag.
         * 2. This is one of my addresses.
         */
        if (ncec->ncec_flags & NCE_F_AUTHORITY) {
                ncec->ncec_unsolicit_count = 0;
                mutex_exit(&ncec->ncec_lock);
                retv = AR_BOGON;
                goto done;
        }

        /*
         * No address conflict was detected, and we are getting
         * ready to update the ncec's hwaddr. The nce MUST NOT be on an
         * under interface, because all dynamic nce's are created on the
         * native interface (in the non-IPMP case) or on the IPMP
         * meta-interface (in the IPMP case)
         */
        ASSERT(!IS_UNDER_IPMP(ncec->ncec_ill));

        /*
         * update ncec with src_haddr, hlen.
         *
         * We are trying to resolve this ncec_addr/src_paddr and we
         * got a REQUEST/RESPONSE from the ncec_addr/src_paddr.
         * So the new_state is at least "STALE". If, in addition,
         * this a solicited, unicast ARP_RESPONSE, we can transition
         * to REACHABLE.
         */
        new_state = ND_STALE;
        ip1dbg(("got info for ncec %p from addr %x\n",
            (void *)ncec, *src_paddr));
        retv = AR_MERGED;
        if (ncec->ncec_state == ND_INCOMPLETE ||
            ncec->ncec_state == ND_INITIAL) {
                ll_changed = B_TRUE;
        } else {
                ll_changed = nce_cmp_ll_addr(ncec, src_haddr, hlen);
                if (!ll_changed)
                        new_state = ND_UNCHANGED;
                else
                        retv = AR_CHANGED;
        }
        /*
         * We don't have the equivalent of the IPv6 'S' flag indicating
         * a solicited response, so we assume that if we are in
         * INCOMPLETE, or got back an unchanged lladdr in PROBE state,
         * and this is an ARP_RESPONSE, it must be a
         * solicited response allowing us to transtion to REACHABLE.
         */
        if (op == ARP_RESPONSE) {
                switch (ncec->ncec_state) {
                case ND_PROBE:
                        new_state = (ll_changed ? ND_STALE : ND_REACHABLE);
                        break;
                case ND_INCOMPLETE:
                        new_state = ND_REACHABLE;
                        break;
                }
        }
        /*
         * Call nce_update() to refresh fastpath information on any
         * dependent nce_t entries.
         */
        nce_update(ncec, new_state, (ll_changed ? src_haddr : NULL));
        mutex_exit(&ncec->ncec_lock);
        nce_resolv_ok(ncec);
done:
        return (retv);
}

/* Find an entry for a particular MAC type in the arp_m_tbl. */
static arp_m_t  *
arp_m_lookup(t_uscalar_t mac_type)
{
        arp_m_t *arm;

        for (arm = arp_m_tbl; arm < A_END(arp_m_tbl); arm++) {
                if (arm->arp_mac_type == mac_type)
                        return (arm);
        }
        return (NULL);
}

uint32_t
arp_hw_type(t_uscalar_t mactype)
{
        arp_m_t *arm;

        if ((arm = arp_m_lookup(mactype)) == NULL)
                arm = arp_m_lookup(DL_OTHER);
        return (arm->arp_mac_arp_hw_type);
}

/*
 * Called when an DLPI control message has been acked; send down the next
 * queued message (if any).
 * The DLPI messages of interest being bind, attach and unbind since
 * these are the only ones sent by ARP via arp_dlpi_send.
 */
static void
arp_dlpi_done(arl_t *arl, ill_t *ill)
{
        mblk_t *mp;
        int err;
        t_uscalar_t prim;

        mutex_enter(&arl->arl_lock);
        prim = arl->arl_dlpi_pending;

        if ((mp = arl->arl_dlpi_deferred) == NULL) {
                arl->arl_dlpi_pending = DL_PRIM_INVAL;
                if (arl->arl_state_flags & ARL_LL_DOWN)
                        err = ENETDOWN;
                else
                        err = 0;
                mutex_exit(&arl->arl_lock);

                mutex_enter(&ill->ill_lock);
                ill->ill_arl_dlpi_pending = 0;
                mutex_exit(&ill->ill_lock);
                arp_cmd_done(ill, err, prim);
                return;
        }

        arl->arl_dlpi_deferred = mp->b_next;
        mp->b_next = NULL;

        ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);

        arl->arl_dlpi_pending = DL_PRIM(mp);
        mutex_exit(&arl->arl_lock);

        mutex_enter(&ill->ill_lock);
        ill->ill_arl_dlpi_pending = 1;
        mutex_exit(&ill->ill_lock);

        putnext(arl->arl_wq, mp);
}

/*
 * This routine is called during module initialization when the DL_INFO_ACK
 * comes back from the device.  We set up defaults for all the device dependent
 * doo-dads we are going to need.  This will leave us ready to roll if we are
 * attempting auto-configuration.  Alternatively, these defaults can be
 * overridden by initialization procedures possessing higher intelligence.
 *
 * Caller will free the mp.
 */
static void
arp_ll_set_defaults(arl_t *arl, mblk_t *mp)
{
        arp_m_t         *arm;
        dl_info_ack_t   *dlia = (dl_info_ack_t *)mp->b_rptr;

        if ((arm = arp_m_lookup(dlia->dl_mac_type)) == NULL)
                arm = arp_m_lookup(DL_OTHER);
        ASSERT(arm != NULL);

        /*
         * We initialize based on parameters in the (currently) not too
         * exhaustive arp_m_tbl.
         */
        if (dlia->dl_version == DL_VERSION_2) {
                arl->arl_sap_length = dlia->dl_sap_length;
                arl->arl_phys_addr_length = dlia->dl_brdcst_addr_length;
                if (dlia->dl_provider_style == DL_STYLE2)
                        arl->arl_needs_attach = 1;
        } else {
                arl->arl_sap_length = arm->arp_mac_sap_length;
                arl->arl_phys_addr_length = arm->arp_mac_hw_addr_length;
        }
        /*
         * Note: the arp_hw_type in the arp header may be derived from
         * the ill_mac_type and arp_m_lookup().
         */
        arl->arl_sap = ETHERTYPE_ARP;
        arl_defaults_common(arl, mp);
}

static int
arp_wput(queue_t *q, mblk_t *mp)
{
        int err = EINVAL;
        struct iocblk *ioc;
        mblk_t *mp1;

        switch (DB_TYPE(mp)) {
        case M_IOCTL:
                ASSERT(q->q_next != NULL);
                ioc = (struct iocblk *)mp->b_rptr;
                if (ioc->ioc_cmd != SIOCSLIFNAME &&
                    ioc->ioc_cmd != IF_UNITSEL) {
                        DTRACE_PROBE4(arl__dlpi, char *, "arp_wput",
                            char *, "<some ioctl>", char *, "-",
                            arl_t *, (arl_t *)q->q_ptr);
                        putnext(q, mp);
                        break;
                }
                if ((mp1 = mp->b_cont) == 0)
                        err = EINVAL;
                else if (ioc->ioc_cmd == SIOCSLIFNAME)
                        err = ip_sioctl_slifname_arp(q, mp1->b_rptr);
                else if (ioc->ioc_cmd == IF_UNITSEL)
                        err = ip_sioctl_ifunitsel_arp(q, (int *)mp1->b_rptr);
                if (err == 0)
                        miocack(q, mp, 0, 0);
                else
                        miocnak(q, mp, 0, err);
                break;
        default:
                DTRACE_PROBE4(arl__dlpi, char *, "arp_wput default",
                    char *, "default mblk", char *, "-",
                    arl_t *, (arl_t *)q->q_ptr);
                putnext(q, mp);
                break;
        }
        return (0);
}

/*
 * similar to ill_dlpi_pending(): verify that the received DLPI response
 * matches the one that is pending for the arl.
 */
static boolean_t
arl_dlpi_pending(arl_t *arl, t_uscalar_t prim)
{
        t_uscalar_t pending;

        mutex_enter(&arl->arl_lock);
        if (arl->arl_dlpi_pending == prim) {
                mutex_exit(&arl->arl_lock);
                return (B_TRUE);
        }

        if (arl->arl_state_flags & ARL_CONDEMNED) {
                mutex_exit(&arl->arl_lock);
                return (B_FALSE);
        }
        pending = arl->arl_dlpi_pending;
        mutex_exit(&arl->arl_lock);

        if (pending == DL_PRIM_INVAL) {
                ip0dbg(("arl_dlpi_pending unsolicited ack for %s on %s",
                    dl_primstr(prim), arl->arl_name));
        } else {
                ip0dbg(("arl_dlpi_pending ack for %s on %s expect %s",
                    dl_primstr(prim), arl->arl_name, dl_primstr(pending)));
        }
        return (B_FALSE);
}

/* DLPI messages, other than DL_UNITDATA_IND are handled here. */
static void
arp_rput_dlpi(queue_t *q, mblk_t *mp)
{
        arl_t           *arl = (arl_t *)q->q_ptr;
        union DL_primitives *dlp;
        t_uscalar_t     prim;
        t_uscalar_t     reqprim = DL_PRIM_INVAL;
        ill_t           *ill;

        if ((mp->b_wptr - mp->b_rptr) < sizeof (dlp->dl_primitive)) {
                putnext(q, mp);
                return;
        }
        dlp = (union DL_primitives *)mp->b_rptr;
        prim = dlp->dl_primitive;

        /*
         * If we received an ACK but didn't send a request for it, then it
         * can't be part of any pending operation; discard up-front.
         */
        switch (prim) {
        case DL_ERROR_ACK:
                /*
                 * ce is confused about how DLPI works, so we have to interpret
                 * an "error" on DL_NOTIFY_ACK (which we never could have sent)
                 * as really meaning an error on DL_NOTIFY_REQ.
                 *
                 * Note that supporting DL_NOTIFY_REQ is optional, so printing
                 * out an error message on the console isn't warranted except
                 * for debug.
                 */
                if (dlp->error_ack.dl_error_primitive == DL_NOTIFY_ACK ||
                    dlp->error_ack.dl_error_primitive == DL_NOTIFY_REQ) {
                        reqprim = DL_NOTIFY_REQ;
                } else {
                        reqprim = dlp->error_ack.dl_error_primitive;
                }
                break;
        case DL_INFO_ACK:
                reqprim = DL_INFO_REQ;
                break;
        case DL_OK_ACK:
                reqprim = dlp->ok_ack.dl_correct_primitive;
                break;
        case DL_BIND_ACK:
                reqprim = DL_BIND_REQ;
                break;
        default:
                DTRACE_PROBE2(rput_dl_badprim, arl_t *, arl,
                    union DL_primitives *, dlp);
                putnext(q, mp);
                return;
        }
        if (reqprim == DL_PRIM_INVAL || !arl_dlpi_pending(arl, reqprim)) {
                freemsg(mp);
                return;
        }
        DTRACE_PROBE4(arl__dlpi, char *, "arp_rput_dlpi received",
            char *, dl_primstr(prim), char *, dl_primstr(reqprim),
            arl_t *, arl);

        ASSERT(prim != DL_NOTIFY_IND);

        ill = arl_to_ill(arl);

        switch (reqprim) {
        case DL_INFO_REQ:
                /*
                 * ill has not been set up yet for this case. This is the
                 * DL_INFO_ACK for the first DL_INFO_REQ sent from
                 * arp_modopen(). There should be no other arl_dlpi_deferred
                 * messages pending. We initialize the arl here.
                 */
                ASSERT(!arl->arl_dlpi_style_set);
                ASSERT(arl->arl_dlpi_pending == DL_INFO_REQ);
                ASSERT(arl->arl_dlpi_deferred == NULL);
                arl->arl_dlpi_pending = DL_PRIM_INVAL;
                arp_ll_set_defaults(arl, mp);
                freemsg(mp);
                return;
        case DL_UNBIND_REQ:
                mutex_enter(&arl->arl_lock);
                arl->arl_state_flags &= ~ARL_DL_UNBIND_IN_PROGRESS;
                /*
                 * This is not an error, so we don't set ARL_LL_DOWN
                 */
                arl->arl_state_flags &= ~ARL_LL_UP;
                arl->arl_state_flags |= ARL_LL_UNBOUND;
                if (arl->arl_state_flags & ARL_CONDEMNED) {
                        /*
                         * if this is part of the unplumb the arl may
                         * vaporize any moment after we cv_signal the
                         * arl_cv so we reset arl_dlpi_pending here.
                         * All other cases (including replumb) will
                         * have the arl_dlpi_pending reset in
                         * arp_dlpi_done.
                         */
                        arl->arl_dlpi_pending = DL_PRIM_INVAL;
                }
                cv_signal(&arl->arl_cv);
                mutex_exit(&arl->arl_lock);
                break;
        }
        if (ill != NULL) {
                /*
                 * ill ref obtained by arl_to_ill()  will be released
                 * by qwriter_ip()
                 */
                qwriter_ip(ill, ill->ill_wq, mp, arp_rput_dlpi_writer,
                    CUR_OP, B_TRUE);
                return;
        }
        freemsg(mp);
}

/*
 * Handling of DLPI messages that require exclusive access to the ipsq.
 */
/* ARGSUSED */
static void
arp_rput_dlpi_writer(ipsq_t *ipsq, queue_t *q, mblk_t *mp, void *dummy_arg)
{
        union DL_primitives *dlp = (union DL_primitives *)mp->b_rptr;
        ill_t           *ill = (ill_t *)q->q_ptr;
        arl_t           *arl = ill_to_arl(ill);

        if (arl == NULL) {
                /*
                 * happens as a result arp_modclose triggering unbind.
                 * arp_rput_dlpi will cv_signal the arl_cv and the modclose
                 * will complete, but when it does ipsq_exit, the waiting
                 * qwriter_ip gets into the ipsq but will find the arl null.
                 * There should be no deferred messages in this case, so
                 * just complete and exit.
                 */
                arp_cmd_done(ill, 0, DL_UNBIND_REQ);
                freemsg(mp);
                return;
        }
        switch (dlp->dl_primitive) {
        case DL_ERROR_ACK:
                switch (dlp->error_ack.dl_error_primitive) {
                case DL_UNBIND_REQ:
                        mutex_enter(&arl->arl_lock);
                        arl->arl_state_flags &= ~ARL_DL_UNBIND_IN_PROGRESS;
                        arl->arl_state_flags &= ~ARL_LL_UP;
                        arl->arl_state_flags |= ARL_LL_UNBOUND;
                        arl->arl_state_flags |= ARL_LL_DOWN;
                        cv_signal(&arl->arl_cv);
                        mutex_exit(&arl->arl_lock);
                        break;
                case DL_BIND_REQ:
                        mutex_enter(&arl->arl_lock);
                        arl->arl_state_flags &= ~ARL_LL_UP;
                        arl->arl_state_flags |= ARL_LL_DOWN;
                        arl->arl_state_flags |= ARL_LL_UNBOUND;
                        cv_signal(&arl->arl_cv);
                        mutex_exit(&arl->arl_lock);
                        break;
                case DL_ATTACH_REQ:
                        break;
                default:
                        /* If it's anything else, we didn't send it. */
                        arl_refrele(arl);
                        putnext(q, mp);
                        return;
                }
                break;
        case DL_OK_ACK:
                DTRACE_PROBE4(arl__dlpi, char *, "arp_rput_dlpi_writer ok",
                    char *, dl_primstr(dlp->ok_ack.dl_correct_primitive),
                    char *, dl_primstr(dlp->ok_ack.dl_correct_primitive),
                    arl_t *, arl);
                mutex_enter(&arl->arl_lock);
                switch (dlp->ok_ack.dl_correct_primitive) {
                case DL_UNBIND_REQ:
                case DL_ATTACH_REQ:
                        break;
                default:
                        ip0dbg(("Dropping unrecognized DL_OK_ACK for %s",
                            dl_primstr(dlp->ok_ack.dl_correct_primitive)));
                        mutex_exit(&arl->arl_lock);
                        arl_refrele(arl);
                        freemsg(mp);
                        return;
                }
                mutex_exit(&arl->arl_lock);
                break;
        case DL_BIND_ACK:
                DTRACE_PROBE2(rput_dl_bind, arl_t *, arl,
                    dl_bind_ack_t *, &dlp->bind_ack);

                mutex_enter(&arl->arl_lock);
                ASSERT(arl->arl_state_flags & ARL_LL_BIND_PENDING);
                arl->arl_state_flags &=
                    ~(ARL_LL_BIND_PENDING|ARL_LL_DOWN|ARL_LL_UNBOUND);
                arl->arl_state_flags |= ARL_LL_UP;
                mutex_exit(&arl->arl_lock);
                break;
        case DL_UDERROR_IND:
                DTRACE_PROBE2(rput_dl_uderror, arl_t *, arl,
                    dl_uderror_ind_t *, &dlp->uderror_ind);
                arl_refrele(arl);
                putnext(q, mp);
                return;
        default:
                DTRACE_PROBE2(rput_dl_badprim, arl_t *, arl,
                    union DL_primitives *, dlp);
                arl_refrele(arl);
                putnext(q, mp);
                return;
        }
        arp_dlpi_done(arl, ill);
        arl_refrele(arl);
        freemsg(mp);
}

int
arp_rput(queue_t *q, mblk_t *mp)
{
        arl_t           *arl = q->q_ptr;
        boolean_t       need_refrele = B_FALSE;

        mutex_enter(&arl->arl_lock);
        if (((arl->arl_state_flags &
            (ARL_CONDEMNED | ARL_LL_REPLUMBING)) != 0)) {
                /*
                 * Only allow high priority DLPI messages during unplumb or
                 * replumb, and we don't take an arl_refcnt for that case.
                 */
                if (DB_TYPE(mp) != M_PCPROTO) {
                        mutex_exit(&arl->arl_lock);
                        freemsg(mp);
                        return (0);
                }
        } else {
                arl_refhold_locked(arl);
                need_refrele = B_TRUE;
        }
        mutex_exit(&arl->arl_lock);

        switch (DB_TYPE(mp)) {
        case M_PCPROTO:
        case M_PROTO: {
                ill_t *ill;

                /*
                 * could be one of
                 * (i)   real message from the wire, (DLPI_DATA)
                 * (ii)  DLPI message
                 * Take a ref on the ill associated with this arl to
                 * prevent the ill from being unplumbed until this thread
                 * is done.
                 */
                if (IS_DLPI_DATA(mp)) {
                        ill = arl_to_ill(arl);
                        if (ill == NULL) {
                                arp_drop_packet("No ill", mp, ill);
                                break;
                        }
                        arp_process_packet(ill, mp);
                        ill_refrele(ill);
                        break;
                }
                /* Miscellaneous DLPI messages get shuffled off. */
                arp_rput_dlpi(q, mp);
                break;
        }
        case M_ERROR:
        case M_HANGUP:
                if (mp->b_rptr < mp->b_wptr)
                        arl->arl_error = (int)(*mp->b_rptr & 0xFF);
                if (arl->arl_error == 0)
                        arl->arl_error = ENXIO;
                freemsg(mp);
                break;
        default:
                ip1dbg(("arp_rput other db type %x\n", DB_TYPE(mp)));
                putnext(q, mp);
                break;
        }
        if (need_refrele)
                arl_refrele(arl);
        return (0);
}

static void
arp_process_packet(ill_t *ill, mblk_t *mp)
{
        mblk_t          *mp1;
        arh_t           *arh;
        in_addr_t       src_paddr, dst_paddr;
        uint32_t        hlen, plen;
        boolean_t       is_probe;
        int             op;
        ncec_t          *dst_ncec, *src_ncec = NULL;
        uchar_t         *src_haddr, *arhp, *dst_haddr, *dp, *sp;
        int             err;
        ip_stack_t      *ipst;
        boolean_t       need_ill_refrele = B_FALSE;
        nce_t           *nce;
        uchar_t         *src_lladdr;
        dl_unitdata_ind_t *dlui;
        ip_recv_attr_t  iras;

        ASSERT(ill != NULL);
        if (ill->ill_flags & ILLF_NOARP) {
                arp_drop_packet("Interface does not support ARP", mp, ill);
                return;
        }
        ipst = ill->ill_ipst;
        /*
         * What we should have at this point is a DL_UNITDATA_IND message
         * followed by an ARP packet.  We do some initial checks and then
         * get to work.
         */
        dlui = (dl_unitdata_ind_t *)mp->b_rptr;
        if (dlui->dl_group_address == 1) {
                /*
                 * multicast or broadcast  packet. Only accept on the ipmp
                 * nominated interface for multicasts ('cast_ill').
                 * If we have no cast_ill we are liberal and accept everything.
                 */
                if (IS_UNDER_IPMP(ill)) {
                        /* For an under ill_grp can change under lock */
                        rw_enter(&ipst->ips_ill_g_lock, RW_READER);
                        if (!ill->ill_nom_cast && ill->ill_grp != NULL &&
                            ill->ill_grp->ig_cast_ill != NULL) {
                                rw_exit(&ipst->ips_ill_g_lock);
                                arp_drop_packet("Interface is not nominated "
                                    "for multicast sends and receives",
                                    mp, ill);
                                return;
                        }
                        rw_exit(&ipst->ips_ill_g_lock);
                }
        }
        mp1 = mp->b_cont;
        if (mp1 == NULL) {
                arp_drop_packet("Missing ARP packet", mp, ill);
                return;
        }
        if (mp1->b_cont != NULL) {
                /* No fooling around with funny messages. */
                if (!pullupmsg(mp1, -1)) {
                        arp_drop_packet("Funny message: pullup failed",
                            mp, ill);
                        return;
                }
        }
        arh = (arh_t *)mp1->b_rptr;
        hlen = arh->arh_hlen;
        plen = arh->arh_plen;
        if (MBLKL(mp1) < ARH_FIXED_LEN + 2 * hlen + 2 * plen) {
                arp_drop_packet("mblk len too small", mp, ill);
                return;
        }
        /*
         * hlen 0 is used for RFC 1868 UnARP.
         *
         * Note that the rest of the code checks that hlen is what we expect
         * for this hardware address type, so might as well discard packets
         * here that don't match.
         */
        if ((hlen > 0 && hlen != ill->ill_phys_addr_length) || plen == 0) {
                DTRACE_PROBE2(rput_bogus, ill_t *, ill, mblk_t *, mp1);
                arp_drop_packet("Bogus hlen or plen", mp, ill);
                return;
        }
        /*
         * Historically, Solaris has been lenient about hardware type numbers.
         * We should check here, but don't.
         */
        DTRACE_PROBE3(arp__physical__in__start, ill_t *, ill, arh_t *, arh,
            mblk_t *, mp);
        /*
         * If ill is in an ipmp group, it will be the under ill. If we want
         * to report the packet as coming up the IPMP interface, we should
         * convert it to the ipmp ill.
         */
        ARP_HOOK_IN(ipst->ips_arp_physical_in_event, ipst->ips_arp_physical_in,
            ill->ill_phyint->phyint_ifindex, arh, mp, mp1, ipst);
        DTRACE_PROBE1(arp__physical__in__end, mblk_t *, mp);
        if (mp == NULL)
                return;
        arhp = (uchar_t *)arh + ARH_FIXED_LEN;
        src_haddr = arhp;                       /* ar$sha */
        arhp += hlen;
        bcopy(arhp, &src_paddr, IP_ADDR_LEN);   /* ar$spa */
        sp = arhp;
        arhp += IP_ADDR_LEN;
        dst_haddr = arhp;                       /* ar$dha */
        arhp += hlen;
        bcopy(arhp, &dst_paddr, IP_ADDR_LEN);   /* ar$tpa */
        dp = arhp;
        op = BE16_TO_U16(arh->arh_operation);

        DTRACE_PROBE2(ip__arp__input, (in_addr_t), src_paddr,
            (in_addr_t), dst_paddr);

        /* Determine if this is just a probe */
        is_probe = (src_paddr == INADDR_ANY);

        /*
         * The following test for loopback is faster than
         * IP_LOOPBACK_ADDR(), because it avoids any bitwise
         * operations.
         * Note that these addresses are always in network byte order
         */
        if ((*(uint8_t *)&src_paddr) == IN_LOOPBACKNET ||
            (*(uint8_t *)&dst_paddr) == IN_LOOPBACKNET ||
            CLASSD(src_paddr) || CLASSD(dst_paddr)) {
                arp_drop_packet("Martian IP addr", mp, ill);
                return;
        }

        /*
         * ira_ill is the only field used down the arp_notify path.
         */
        bzero(&iras, sizeof (iras));
        iras.ira_ill = iras.ira_rill = ill;
        /*
         * RFC 826: first check if the <protocol, sender protocol address> is
         * in the cache, if there is a sender protocol address.  Note that this
         * step also handles resolutions based on source.
         */
        /* Note: after here we need to freeb(mp) and freemsg(mp1) separately */
        mp->b_cont = NULL;
        if (is_probe) {
                err = AR_NOTFOUND;
        } else {
                if (plen != 4) {
                        arp_drop_packet("bad protocol len", mp, ill);
                        return;
                }
                err = ip_nce_resolve_all(ill, src_haddr, hlen, &src_paddr,
                    &src_ncec, op);
                switch (err) {
                case AR_BOGON:
                        ASSERT(src_ncec != NULL);
                        arp_notify(src_paddr, mp1, AR_CN_BOGON,
                            &iras, src_ncec);
                        break;
                case AR_FAILED:
                        arp_notify(src_paddr, mp1, AR_CN_FAILED, &iras,
                            src_ncec);
                        break;
                case AR_LOOPBACK:
                        DTRACE_PROBE2(rput_loopback, ill_t *, ill, arh_t *,
                            arh);
                        freemsg(mp1);
                        break;
                default:
                        goto update;
                }
                freemsg(mp);
                if (src_ncec != NULL)
                        ncec_refrele(src_ncec);
                return;
        }
update:
        /*
         * Now look up the destination address.  By RFC 826, we ignore the
         * packet at this step if the target isn't one of our addresses (i.e.,
         * one we have been asked to PUBLISH).  This is true even if the
         * target is something we're trying to resolve and the packet
         * is a response.
         */
        dst_ncec = ncec_lookup_illgrp_v4(ill, &dst_paddr);
        if (dst_ncec == NULL || !NCE_PUBLISH(dst_ncec)) {
                /*
                 * Let the client know if the source mapping has changed, even
                 * if the destination provides no useful information for the
                 * client.
                 */
                if (err == AR_CHANGED) {
                        arp_notify(src_paddr, mp1, AR_CN_ANNOUNCE, &iras,
                            NULL);
                        freemsg(mp);
                } else {
                        freemsg(mp);
                        arp_drop_packet("Target is not interesting", mp1, ill);
                }
                if (dst_ncec != NULL)
                        ncec_refrele(dst_ncec);
                if (src_ncec != NULL)
                        ncec_refrele(src_ncec);
                return;
        }

        if (dst_ncec->ncec_flags & NCE_F_UNVERIFIED) {
                /*
                 * Check for a reflection.  Some misbehaving bridges will
                 * reflect our own transmitted packets back to us.
                 */
                ASSERT(NCE_PUBLISH(dst_ncec));
                if (hlen != dst_ncec->ncec_ill->ill_phys_addr_length) {
                        ncec_refrele(dst_ncec);
                        if (src_ncec != NULL)
                                ncec_refrele(src_ncec);
                        freemsg(mp);
                        arp_drop_packet("bad arh_len", mp1, ill);
                        return;
                }
                if (!nce_cmp_ll_addr(dst_ncec, src_haddr, hlen)) {
                        DTRACE_PROBE3(rput_probe_reflected, ill_t *, ill,
                            arh_t *, arh, ncec_t *, dst_ncec);
                        ncec_refrele(dst_ncec);
                        if (src_ncec != NULL)
                                ncec_refrele(src_ncec);
                        freemsg(mp);
                        arp_drop_packet("Reflected probe", mp1, ill);
                        return;
                }
                /*
                 * Responses targeting our HW address that are not responses to
                 * our DAD probe must be ignored as they are related to requests
                 * sent before DAD was restarted.
                 */
                if (op == ARP_RESPONSE &&
                    (nce_cmp_ll_addr(dst_ncec, dst_haddr, hlen) == 0)) {
                        ncec_refrele(dst_ncec);
                        if (src_ncec != NULL)
                                ncec_refrele(src_ncec);
                        freemsg(mp);
                        arp_drop_packet(
                            "Response to request that was sent before DAD",
                            mp1, ill);
                        return;
                }
                /*
                 * Responses targeted to HW addresses which are not ours but
                 * sent to our unverified proto address are also conflicts.
                 * These may be reported by a proxy rather than the interface
                 * with the conflicting address, dst_paddr is in conflict
                 * rather than src_paddr. To ensure IP can locate the correct
                 * ipif to take down, it is necessary to copy dst_paddr to
                 * the src_paddr field before sending it to IP. The same is
                 * required for probes, where src_paddr will be INADDR_ANY.
                 */
                if (is_probe || op == ARP_RESPONSE) {
                        bcopy(dp, sp, plen);
                        arp_notify(src_paddr, mp1, AR_CN_FAILED, &iras,
                            NULL);
                        ncec_delete(dst_ncec);
                } else if (err == AR_CHANGED) {
                        arp_notify(src_paddr, mp1, AR_CN_ANNOUNCE, &iras,
                            NULL);
                } else {
                        DTRACE_PROBE3(rput_request_unverified,
                            ill_t *, ill, arh_t *, arh, ncec_t *, dst_ncec);
                        arp_drop_packet("Unverified request", mp1, ill);
                }
                freemsg(mp);
                ncec_refrele(dst_ncec);
                if (src_ncec != NULL)
                        ncec_refrele(src_ncec);
                return;
        }
        /*
         * If it's a request, then we reply to this, and if we think the
         * sender's unknown, then we create an entry to avoid unnecessary ARPs.
         * The design assumption is that someone ARPing us is likely to send us
         * a packet soon, and that we'll want to reply to it.
         */
        if (op == ARP_REQUEST) {
                const uchar_t *nce_hwaddr;
                struct in_addr nce_paddr;
                clock_t now;
                ill_t *under_ill = ill;
                boolean_t send_unicast = B_TRUE;

                ASSERT(NCE_PUBLISH(dst_ncec));

                if ((dst_ncec->ncec_flags & (NCE_F_BCAST|NCE_F_MCAST)) != 0) {
                        /*
                         * Ignore senders who are deliberately or accidentally
                         * confused.
                         */
                        goto bail;
                }

                if (!is_probe && err == AR_NOTFOUND) {
                        ASSERT(src_ncec == NULL);

                        if (IS_UNDER_IPMP(under_ill)) {
                                /*
                                 * create the ncec for the sender on ipmp_ill.
                                 * We pass in the ipmp_ill itself to avoid
                                 * creating an nce_t on the under_ill.
                                 */
                                ill = ipmp_ill_hold_ipmp_ill(under_ill);
                                if (ill == NULL)
                                        ill = under_ill;
                                else
                                        need_ill_refrele = B_TRUE;
                        }

                        err = nce_lookup_then_add_v4(ill, src_haddr, hlen,
                            &src_paddr, 0, ND_STALE, &nce);

                        switch (err) {
                        case 0:
                        case EEXIST:
                                ip1dbg(("added ncec %p in state %d ill %s\n",
                                    (void *)src_ncec, src_ncec->ncec_state,
                                    ill->ill_name));
                                src_ncec = nce->nce_common;
                                break;
                        default:
                                /*
                                 * Either no memory, or the outgoing interface
                                 * is in the process of down/unplumb. In the
                                 * latter case, we will fail the send anyway,
                                 * and in the former case, we should try to send
                                 * the ARP response.
                                 */
                                src_lladdr = src_haddr;
                                goto send_response;
                        }
                        ncec_refhold(src_ncec);
                        nce_refrele(nce);
                        /* set up cleanup interval on ncec */
                }

                /*
                 * This implements periodic address defense based on a modified
                 * version of the RFC 3927 requirements.  Instead of sending a
                 * broadcasted reply every time, as demanded by the RFC, we
                 * send at most one broadcast reply per arp_broadcast_interval.
                 */
                now = ddi_get_lbolt();
                if ((now - dst_ncec->ncec_last_time_defended) >
                    MSEC_TO_TICK(ipst->ips_ipv4_dad_announce_interval)) {
                        dst_ncec->ncec_last_time_defended = now;
                        /*
                         * If this is one of the long-suffering entries,
                         * pull it out now.  It no longer needs separate
                         * defense, because we're now doing that with this
                         * broadcasted reply.
                         */
                        dst_ncec->ncec_flags &= ~NCE_F_DELAYED;
                        send_unicast = B_FALSE;
                }
                if (src_ncec != NULL && send_unicast) {
                        src_lladdr = src_ncec->ncec_lladdr;
                } else {
                        src_lladdr = under_ill->ill_bcast_mp->b_rptr +
                            NCE_LL_ADDR_OFFSET(under_ill);
                }
send_response:
                nce_hwaddr = dst_ncec->ncec_lladdr;
                IN6_V4MAPPED_TO_INADDR(&dst_ncec->ncec_addr, &nce_paddr);

                (void) arp_output(under_ill, ARP_RESPONSE,
                    nce_hwaddr, (uchar_t *)&nce_paddr, src_haddr,
                    (uchar_t *)&src_paddr, src_lladdr);
        }
bail:
        if (dst_ncec != NULL) {
                ncec_refrele(dst_ncec);
        }
        if (src_ncec != NULL) {
                ncec_refrele(src_ncec);
        }
        if (err == AR_CHANGED) {
                mp->b_cont = NULL;
                arp_notify(src_paddr, mp1, AR_CN_ANNOUNCE, &iras, NULL);
                mp1 = NULL;
        }
        if (need_ill_refrele)
                ill_refrele(ill);

        freemsg(mp);
        freemsg(mp1);
}

/*
 * Basic initialization of the arl_t and the arl_common structure shared with
 * the ill_t that is done after SLIFNAME/IF_UNITSEL.
 */
static int
arl_ill_init(arl_t *arl, char *ill_name)
{
        ill_t *ill;
        arl_ill_common_t *ai;

        ill = ill_lookup_on_name(ill_name, B_FALSE, B_FALSE, B_FALSE,
            arl->arl_ipst);

        if (ill == NULL)
                return (ENXIO);

        /*
         * By the time we set up the arl, we expect the ETHERTYPE_IP
         * stream to be fully bound and attached. So we copy/verify
         * relevant information as possible from/against the ill.
         *
         * The following should have been set up in arp_ll_set_defaults()
         * after the first DL_INFO_ACK was received.
         */
        ASSERT(arl->arl_phys_addr_length == ill->ill_phys_addr_length);
        ASSERT(arl->arl_sap == ETHERTYPE_ARP);
        ASSERT(arl->arl_mactype == ill->ill_mactype);
        ASSERT(arl->arl_sap_length == ill->ill_sap_length);

        ai =  kmem_zalloc(sizeof (*ai), KM_SLEEP);
        mutex_enter(&ill->ill_lock);
        /* First ensure that the ill is not CONDEMNED.  */
        if (ill->ill_state_flags & ILL_CONDEMNED) {
                mutex_exit(&ill->ill_lock);
                ill_refrele(ill);
                kmem_free(ai, sizeof (*ai));
                return (ENXIO);
        }
        if (ill->ill_common != NULL || arl->arl_common != NULL) {
                mutex_exit(&ill->ill_lock);
                ip0dbg(("%s: PPA already exists", ill->ill_name));
                ill_refrele(ill);
                kmem_free(ai, sizeof (*ai));
                return (EEXIST);
        }
        mutex_init(&ai->ai_lock, NULL, MUTEX_DEFAULT, NULL);
        ai->ai_arl = arl;
        ai->ai_ill = ill;
        ill->ill_common = ai;
        arl->arl_common = ai;
        mutex_exit(&ill->ill_lock);
        (void) strlcpy(arl->arl_name, ill->ill_name, LIFNAMSIZ);
        arl->arl_name_length = ill->ill_name_length;
        ill_refrele(ill);
        arp_ifname_notify(arl);
        return (0);
}

/* Allocate and do common initializations for DLPI messages. */
static mblk_t *
ip_ar_dlpi_comm(t_uscalar_t prim, size_t size)
{
        mblk_t  *mp;

        if ((mp = allocb(size, BPRI_HI)) == NULL)
                return (NULL);

        /*
         * DLPIv2 says that DL_INFO_REQ and DL_TOKEN_REQ (the latter
         * of which we don't seem to use) are sent with M_PCPROTO, and
         * that other DLPI are M_PROTO.
         */
        DB_TYPE(mp) = (prim == DL_INFO_REQ) ? M_PCPROTO : M_PROTO;

        mp->b_wptr = mp->b_rptr + size;
        bzero(mp->b_rptr, size);
        DL_PRIM(mp) = prim;
        return (mp);
}


int
ip_sioctl_ifunitsel_arp(queue_t *q, int *ppa)
{
        arl_t *arl;
        char *cp, ill_name[LIFNAMSIZ];

        if (q->q_next == NULL)
                return (EINVAL);

        do {
                q = q->q_next;
        } while (q->q_next != NULL);
        cp = q->q_qinfo->qi_minfo->mi_idname;

        arl = (arl_t *)q->q_ptr;
        (void) snprintf(ill_name, sizeof (ill_name), "%s%d", cp, *ppa);
        arl->arl_ppa = *ppa;
        return (arl_ill_init(arl, ill_name));
}

int
ip_sioctl_slifname_arp(queue_t *q, void *lifreq)
{
        arl_t *arl;
        struct lifreq *lifr = lifreq;

        /* ioctl not valid when IP opened as a device */
        if (q->q_next == NULL)
                return (EINVAL);

        arl = (arl_t *)q->q_ptr;
        arl->arl_ppa = lifr->lifr_ppa;
        return (arl_ill_init(arl, lifr->lifr_name));
}

arl_t *
ill_to_arl(ill_t *ill)
{
        arl_ill_common_t *ai = ill->ill_common;
        arl_t *arl = NULL;

        if (ai == NULL)
                return (NULL);
        /*
         * Find the arl_t that corresponds to this ill_t from the shared
         * ill_common structure. We can safely access the ai here as it
         * will only be freed in arp_modclose() after we have become
         * single-threaded.
         */
        mutex_enter(&ai->ai_lock);
        if ((arl = ai->ai_arl) != NULL) {
                mutex_enter(&arl->arl_lock);
                if (!(arl->arl_state_flags & ARL_CONDEMNED)) {
                        arl_refhold_locked(arl);
                        mutex_exit(&arl->arl_lock);
                } else {
                        mutex_exit(&arl->arl_lock);
                        arl = NULL;
                }
        }
        mutex_exit(&ai->ai_lock);
        return (arl);
}

ill_t *
arl_to_ill(arl_t *arl)
{
        arl_ill_common_t *ai = arl->arl_common;
        ill_t *ill = NULL;

        if (ai == NULL) {
                /*
                 * happens when the arp stream is just being opened, and
                 * arl_ill_init has not been executed yet.
                 */
                return (NULL);
        }
        /*
         * Find the ill_t that corresponds to this arl_t from the shared
         * arl_common structure. We can safely access the ai here as it
         * will only be freed in arp_modclose() after we have become
         * single-threaded.
         */
        mutex_enter(&ai->ai_lock);
        if ((ill = ai->ai_ill) != NULL) {
                mutex_enter(&ill->ill_lock);
                if (!ILL_IS_CONDEMNED(ill)) {
                        ill_refhold_locked(ill);
                        mutex_exit(&ill->ill_lock);
                } else {
                        mutex_exit(&ill->ill_lock);
                        ill = NULL;
                }
        }
        mutex_exit(&ai->ai_lock);
        return (ill);
}

int
arp_ll_up(ill_t *ill)
{
        mblk_t  *attach_mp = NULL;
        mblk_t  *bind_mp = NULL;
        mblk_t  *unbind_mp = NULL;
        arl_t   *arl;

        ASSERT(IAM_WRITER_ILL(ill));
        arl = ill_to_arl(ill);

        DTRACE_PROBE2(ill__downup, char *, "arp_ll_up", ill_t *, ill);
        if (arl == NULL)
                return (ENXIO);
        DTRACE_PROBE2(arl__downup, char *, "arp_ll_up", arl_t *, arl);
        if ((arl->arl_state_flags & ARL_LL_UP) != 0) {
                arl_refrele(arl);
                return (0);
        }
        if (arl->arl_needs_attach) { /* DL_STYLE2 */
                attach_mp =
                    ip_ar_dlpi_comm(DL_ATTACH_REQ, sizeof (dl_attach_req_t));
                if (attach_mp == NULL)
                        goto bad;
                ((dl_attach_req_t *)attach_mp->b_rptr)->dl_ppa = arl->arl_ppa;
        }

        /* Allocate and initialize a bind message. */
        bind_mp = ip_ar_dlpi_comm(DL_BIND_REQ, sizeof (dl_bind_req_t));
        if (bind_mp == NULL)
                goto bad;
        ((dl_bind_req_t *)bind_mp->b_rptr)->dl_sap = ETHERTYPE_ARP;
        ((dl_bind_req_t *)bind_mp->b_rptr)->dl_service_mode = DL_CLDLS;

        unbind_mp = ip_ar_dlpi_comm(DL_UNBIND_REQ, sizeof (dl_unbind_req_t));
        if (unbind_mp == NULL)
                goto bad;
        if (arl->arl_needs_attach) {
                arp_dlpi_send(arl, attach_mp);
        }
        arl->arl_unbind_mp = unbind_mp;

        arl->arl_state_flags |= ARL_LL_BIND_PENDING;
        arp_dlpi_send(arl, bind_mp);
        arl_refrele(arl);
        return (EINPROGRESS);

bad:
        freemsg(attach_mp);
        freemsg(bind_mp);
        freemsg(unbind_mp);
        arl_refrele(arl);
        return (ENOMEM);
}

/*
 * consumes/frees mp
 */
static void
arp_notify(in_addr_t src, mblk_t *mp, uint32_t arcn_code,
    ip_recv_attr_t *ira, ncec_t *ncec)
{
        char            hbuf[MAC_STR_LEN];
        char            sbuf[INET_ADDRSTRLEN];
        ill_t           *ill = ira->ira_ill;
        ip_stack_t      *ipst = ill->ill_ipst;
        arh_t           *arh = (arh_t *)mp->b_rptr;

        switch (arcn_code) {
        case AR_CN_BOGON:
                /*
                 * Someone is sending ARP packets with a source protocol
                 * address that we have published and for which we believe our
                 * entry is authoritative and verified to be unique on
                 * the network.
                 *
                 * arp_process_packet() sends AR_CN_FAILED for the case when
                 * a DAD probe is received and the hardware address of a
                 * non-authoritative entry has changed. Thus, AR_CN_BOGON
                 * indicates a real conflict, and we have to do resolution.
                 *
                 * We back away quickly from the address if it's from DHCP or
                 * otherwise temporary and hasn't been used recently (or at
                 * all).  We'd like to include "deprecated" addresses here as
                 * well (as there's no real reason to defend something we're
                 * discarding), but IPMP "reuses" this flag to mean something
                 * other than the standard meaning.
                 */
                if (ip_nce_conflict(mp, ira, ncec)) {
                        (void) mac_colon_addr((uint8_t *)(arh + 1),
                            arh->arh_hlen, hbuf, sizeof (hbuf));
                        (void) ip_dot_addr(src, sbuf);
                        cmn_err(CE_WARN,
                            "proxy ARP problem?  Node '%s' is using %s on %s",
                            hbuf, sbuf, ill->ill_name);
                        if (!arp_no_defense)
                                (void) arp_announce(ncec);
                        /*
                         * ncec_last_time_defended has been adjusted in
                         * ip_nce_conflict.
                         */
                } else {
                        ncec_delete(ncec);
                }
                freemsg(mp);
                break;
        case AR_CN_ANNOUNCE: {
                nce_hw_map_t hwm;
                /*
                 * ARP gives us a copy of any packet where it thinks
                 * the address has changed, so that we can update our
                 * caches.  We're responsible for caching known answers
                 * in the current design.  We check whether the
                 * hardware address really has changed in all of our
                 * entries that have cached this mapping, and if so, we
                 * blow them away.  This way we will immediately pick
                 * up the rare case of a host changing hardware
                 * address.
                 */
                if (src == 0) {
                        freemsg(mp);
                        break;
                }
                hwm.hwm_addr = src;
                hwm.hwm_hwlen = arh->arh_hlen;
                hwm.hwm_hwaddr = (uchar_t *)(arh + 1);
                hwm.hwm_flags = 0;
                ncec_walk_common(ipst->ips_ndp4, NULL,
                    nce_update_hw_changed, &hwm, B_TRUE);
                freemsg(mp);
                break;
        }
        case AR_CN_FAILED:
                if (arp_no_defense) {
                        (void) mac_colon_addr((uint8_t *)(arh + 1),
                            arh->arh_hlen, hbuf, sizeof (hbuf));
                        (void) ip_dot_addr(src, sbuf);

                        cmn_err(CE_WARN,
                            "node %s is using our IP address %s on %s",
                            hbuf, sbuf, ill->ill_name);
                        freemsg(mp);
                        break;
                }
                /*
                 * mp will be freed by arp_excl.
                 */
                ill_refhold(ill);
                qwriter_ip(ill, ill->ill_rq, mp, arp_excl, NEW_OP, B_FALSE);
                return;
        default:
                ASSERT(0);
                freemsg(mp);
                break;
        }
}

/*
 * arp_output is called to transmit an ARP Request or Response. The mapping
 * to RFC 826 variables is:
 *   haddr1 == ar$sha
 *   paddr1 == ar$spa
 *   haddr2 == ar$tha
 *   paddr2 == ar$tpa
 * The ARP frame is sent to the ether_dst in dst_lladdr.
 */
static int
arp_output(ill_t *ill, uint32_t operation,
    const uchar_t *haddr1, const uchar_t *paddr1, const uchar_t *haddr2,
    const uchar_t *paddr2, uchar_t *dst_lladdr)
{
        arh_t   *arh;
        uint8_t *cp;
        uint_t  hlen;
        uint32_t plen = IPV4_ADDR_LEN; /* ar$pln from RFC 826 */
        uint32_t proto = IP_ARP_PROTO_TYPE;
        mblk_t *mp;
        arl_t *arl;

        ASSERT(dst_lladdr != NULL);
        hlen = ill->ill_phys_addr_length; /* ar$hln from RFC 826 */
        mp = ill_dlur_gen(dst_lladdr, hlen, ETHERTYPE_ARP, ill->ill_sap_length);

        if (mp == NULL)
                return (ENOMEM);

        /* IFF_NOARP flag is set or link down: do not send arp messages */
        if ((ill->ill_flags & ILLF_NOARP) || !ill->ill_dl_up) {
                freemsg(mp);
                return (ENXIO);
        }

        mp->b_cont = allocb(AR_LL_HDR_SLACK + ARH_FIXED_LEN + (hlen * 4) +
            plen + plen, BPRI_MED);
        if (mp->b_cont == NULL) {
                freeb(mp);
                return (ENOMEM);
        }

        /* Fill in the ARP header. */
        cp = mp->b_cont->b_rptr + (AR_LL_HDR_SLACK + hlen + hlen);
        mp->b_cont->b_rptr = cp;
        arh = (arh_t *)cp;
        U16_TO_BE16(arp_hw_type(ill->ill_mactype), arh->arh_hardware);
        U16_TO_BE16(proto, arh->arh_proto);
        arh->arh_hlen = (uint8_t)hlen;
        arh->arh_plen = (uint8_t)plen;
        U16_TO_BE16(operation, arh->arh_operation);
        cp += ARH_FIXED_LEN;
        bcopy(haddr1, cp, hlen);
        cp += hlen;
        if (paddr1 == NULL)
                bzero(cp, plen);
        else
                bcopy(paddr1, cp, plen);
        cp += plen;
        if (haddr2 == NULL)
                bzero(cp, hlen);
        else
                bcopy(haddr2, cp, hlen);
        cp += hlen;
        bcopy(paddr2, cp, plen);
        cp += plen;
        mp->b_cont->b_wptr = cp;

        DTRACE_PROBE3(arp__physical__out__start,
            ill_t *, ill, arh_t *, arh, mblk_t *, mp);
        ARP_HOOK_OUT(ill->ill_ipst->ips_arp_physical_out_event,
            ill->ill_ipst->ips_arp_physical_out,
            ill->ill_phyint->phyint_ifindex, arh, mp, mp->b_cont,
            ill->ill_ipst);
        DTRACE_PROBE1(arp__physical__out__end, mblk_t *, mp);
        if (mp == NULL)
                return (0);

        /* Ship it out. */
        arl = ill_to_arl(ill);
        if (arl == NULL) {
                freemsg(mp);
                return (0);
        }
        if (canputnext(arl->arl_wq))
                putnext(arl->arl_wq, mp);
        else
                freemsg(mp);
        arl_refrele(arl);
        return (0);
}

/*
 * Process resolve requests.
 * If we are not yet reachable then we check and decrease ncec_rcnt; otherwise
 * we leave it alone (the caller will check and manage ncec_pcnt in those
 * cases.)
 */
int
arp_request(ncec_t *ncec, in_addr_t sender, ill_t *ill)
{
        int err;
        const uchar_t *target_hwaddr;
        struct in_addr nce_paddr;
        uchar_t *dst_lladdr;
        boolean_t use_rcnt = !NCE_ISREACHABLE(ncec);

        ASSERT(MUTEX_HELD(&ncec->ncec_lock));
        ASSERT(!IS_IPMP(ill));

        if (use_rcnt && ncec->ncec_rcnt == 0) {
                /* not allowed any more retransmits. */
                return (0);
        }

        if ((ill->ill_flags & ILLF_NOARP) != 0)
                return (0);

        IN6_V4MAPPED_TO_INADDR(&ncec->ncec_addr, &nce_paddr);

        target_hwaddr =
            ill->ill_bcast_mp->b_rptr + NCE_LL_ADDR_OFFSET(ill);

        if (NCE_ISREACHABLE(ncec)) {
                dst_lladdr =  ncec->ncec_lladdr;
        } else {
                dst_lladdr =  ill->ill_bcast_mp->b_rptr +
                    NCE_LL_ADDR_OFFSET(ill);
        }

        mutex_exit(&ncec->ncec_lock);
        err = arp_output(ill, ARP_REQUEST,
            ill->ill_phys_addr, (uchar_t *)&sender, target_hwaddr,
            (uchar_t *)&nce_paddr, dst_lladdr);
        mutex_enter(&ncec->ncec_lock);

        if (err != 0) {
                /*
                 * Some transient error such as ENOMEM or a down link was
                 * encountered. If the link has been taken down permanently,
                 * the ncec will eventually be cleaned up (ipif_down_tail()
                 * will call ipif_nce_down() and flush the ncec), to terminate
                 * recurring attempts to send ARP requests. In all other cases,
                 * allow the caller another chance at success next time.
                 */
                return (ncec->ncec_ill->ill_reachable_retrans_time);
        }

        if (use_rcnt)
                ncec->ncec_rcnt--;

        return (ncec->ncec_ill->ill_reachable_retrans_time);
}

/* return B_TRUE if dropped */
boolean_t
arp_announce(ncec_t *ncec)
{
        ill_t *ill;
        int err;
        uchar_t *sphys_addr, *bcast_addr;
        struct in_addr ncec_addr;
        boolean_t need_refrele = B_FALSE;

        ASSERT((ncec->ncec_flags & NCE_F_BCAST) == 0);
        ASSERT((ncec->ncec_flags & NCE_F_MCAST) == 0);

        if (IS_IPMP(ncec->ncec_ill)) {
                /* sent on the cast_ill */
                ill = ipmp_ill_hold_xmit_ill(ncec->ncec_ill, B_FALSE);
                if (ill == NULL)
                        return (B_TRUE);
                need_refrele = B_TRUE;
        } else {
                ill = ncec->ncec_ill;
        }

        /*
         * broadcast an announce to ill_bcast address.
         */
        IN6_V4MAPPED_TO_INADDR(&ncec->ncec_addr, &ncec_addr);

        sphys_addr = ncec->ncec_lladdr;
        bcast_addr = ill->ill_bcast_mp->b_rptr + NCE_LL_ADDR_OFFSET(ill);

        err = arp_output(ill, ARP_REQUEST,
            sphys_addr, (uchar_t *)&ncec_addr, bcast_addr,
            (uchar_t *)&ncec_addr, bcast_addr);

        if (need_refrele)
                ill_refrele(ill);
        return (err != 0);
}

/* return B_TRUE if dropped */
boolean_t
arp_probe(ncec_t *ncec)
{
        ill_t *ill;
        int err;
        struct in_addr ncec_addr;
        uchar_t *sphys_addr, *dst_lladdr;

        if (IS_IPMP(ncec->ncec_ill)) {
                ill = ipmp_ill_hold_xmit_ill(ncec->ncec_ill, B_FALSE);
                if (ill == NULL)
                        return (B_TRUE);
        } else {
                ill = ncec->ncec_ill;
        }

        IN6_V4MAPPED_TO_INADDR(&ncec->ncec_addr, &ncec_addr);

        sphys_addr = ncec->ncec_lladdr;
        dst_lladdr = ill->ill_bcast_mp->b_rptr + NCE_LL_ADDR_OFFSET(ill);
        err = arp_output(ill, ARP_REQUEST,
            sphys_addr, NULL, NULL, (uchar_t *)&ncec_addr, dst_lladdr);

        if (IS_IPMP(ncec->ncec_ill))
                ill_refrele(ill);
        return (err != 0);
}

static mblk_t *
arl_unbind(arl_t *arl)
{
        mblk_t *mp;

        if ((mp = arl->arl_unbind_mp) != NULL) {
                arl->arl_unbind_mp = NULL;
                arl->arl_state_flags |= ARL_DL_UNBIND_IN_PROGRESS;
        }
        return (mp);
}

int
arp_ll_down(ill_t *ill)
{
        arl_t   *arl;
        mblk_t *unbind_mp;
        int err = 0;
        boolean_t replumb = (ill->ill_replumbing == 1);

        DTRACE_PROBE2(ill__downup, char *, "arp_ll_down", ill_t *, ill);
        if ((arl = ill_to_arl(ill)) == NULL)
                return (ENXIO);
        DTRACE_PROBE2(arl__downup, char *, "arp_ll_down", arl_t *, arl);
        mutex_enter(&arl->arl_lock);
        unbind_mp = arl_unbind(arl);
        if (unbind_mp != NULL) {
                ASSERT(arl->arl_state_flags & ARL_DL_UNBIND_IN_PROGRESS);
                DTRACE_PROBE2(arp__unbinding, mblk_t *, unbind_mp,
                    arl_t *, arl);
                err = EINPROGRESS;
                if (replumb)
                        arl->arl_state_flags |= ARL_LL_REPLUMBING;
        }
        mutex_exit(&arl->arl_lock);
        if (unbind_mp != NULL)
                arp_dlpi_send(arl, unbind_mp);
        arl_refrele(arl);
        return (err);
}

/* ARGSUSED */
int
arp_close(queue_t *q, int flags __unused, cred_t *credp __unused)
{
        if (WR(q)->q_next != NULL) {
                /* This is a module close */
                return (arp_modclose(q->q_ptr));
        }
        qprocsoff(q);
        q->q_ptr = WR(q)->q_ptr = NULL;
        return (0);
}

static int
arp_modclose(arl_t *arl)
{
        arl_ill_common_t *ai = arl->arl_common;
        ill_t           *ill;
        queue_t         *q = arl->arl_rq;
        mblk_t          *mp, *nextmp;
        ipsq_t          *ipsq = NULL;

        ill = arl_to_ill(arl);
        if (ill != NULL) {
                if (!ill_waiter_inc(ill)) {
                        ill_refrele(ill);
                } else {
                        ill_refrele(ill);
                        if (ipsq_enter(ill, B_FALSE, NEW_OP))
                                ipsq = ill->ill_phyint->phyint_ipsq;
                        ill_waiter_dcr(ill);
                }
                if (ipsq == NULL) {
                        /*
                         * could not enter the ipsq because ill is already
                         * marked CONDEMNED.
                         */
                        ill = NULL;
                }
        }
        if (ai != NULL && ipsq == NULL) {
                /*
                 * Either we did not get an ill because it was marked CONDEMNED
                 * or we could not enter the ipsq because it was unplumbing.
                 * In both cases, wait for the ill to complete ip_modclose().
                 *
                 * If the arp_modclose happened even before SLIFNAME, the ai
                 * itself would be NULL, in which case we can complete the close
                 * without waiting.
                 */
                mutex_enter(&ai->ai_lock);
                while (ai->ai_ill != NULL)
                        cv_wait(&ai->ai_ill_unplumb_done, &ai->ai_lock);
                mutex_exit(&ai->ai_lock);
        }
        ASSERT(ill == NULL || IAM_WRITER_ILL(ill));

        mutex_enter(&arl->arl_lock);
        /*
         * If the ill had completed unplumbing before arp_modclose(), there
         * would be no ill (and therefore, no ipsq) to serialize arp_modclose()
         * so that we need to explicitly check for ARL_CONDEMNED and back off
         * if it is set.
         */
        if ((arl->arl_state_flags & ARL_CONDEMNED) != 0) {
                mutex_exit(&arl->arl_lock);
                ASSERT(ipsq == NULL);
                return (0);
        }
        arl->arl_state_flags |= ARL_CONDEMNED;

        /*
         * send out all pending dlpi messages, don't wait for the ack (which
         * will be ignored in arp_rput when CONDEMNED is set)
         *
         * We have to check for pending DL_UNBIND_REQ because, in the case
         * that ip_modclose() executed before arp_modclose(), the call to
         * ill_delete_tail->ipif_arp_down() would have triggered a
         * DL_UNBIND_REQ. When arp_modclose() executes ipsq_enter() will fail
         * (since ip_modclose() is in the ipsq) but the DL_UNBIND_ACK may not
         * have been processed yet. In this scenario, we cannot reset
         * arl_dlpi_pending, because the setting/clearing of arl_state_flags
         * related to unbind, and the associated cv_waits must be allowed to
         * continue.
         */
        if (arl->arl_dlpi_pending != DL_UNBIND_REQ)
                arl->arl_dlpi_pending = DL_PRIM_INVAL;
        mp = arl->arl_dlpi_deferred;
        arl->arl_dlpi_deferred = NULL;
        mutex_exit(&arl->arl_lock);

        for (; mp != NULL; mp = nextmp) {
                nextmp = mp->b_next;
                mp->b_next = NULL;
                putnext(arl->arl_wq, mp);
        }

        /* Wait for data paths to quiesce */
        mutex_enter(&arl->arl_lock);
        while (arl->arl_refcnt != 0)
                cv_wait(&arl->arl_cv, &arl->arl_lock);

        /*
         * unbind, so that nothing else can come up from driver.
         */
        mp = arl_unbind(arl);
        mutex_exit(&arl->arl_lock);
        if (mp != NULL)
                arp_dlpi_send(arl, mp);
        mutex_enter(&arl->arl_lock);

        /* wait for unbind ack  */
        while (arl->arl_state_flags & ARL_DL_UNBIND_IN_PROGRESS)
                cv_wait(&arl->arl_cv, &arl->arl_lock);
        mutex_exit(&arl->arl_lock);

        qprocsoff(q);

        if (ill != NULL) {
                mutex_enter(&ill->ill_lock);
                ill->ill_arl_dlpi_pending = 0;
                mutex_exit(&ill->ill_lock);
        }

        if (ai != NULL) {
                mutex_enter(&ai->ai_lock);
                ai->ai_arl = NULL;
                if (ai->ai_ill == NULL) {
                        mutex_destroy(&ai->ai_lock);
                        kmem_free(ai, sizeof (*ai));
                } else {
                        mutex_exit(&ai->ai_lock);
                }
        }

        /* free up the rest */
        arp_mod_close_tail(arl);

        q->q_ptr = WR(q)->q_ptr = NULL;

        if (ipsq != NULL)
                ipsq_exit(ipsq);

        return (0);
}

static void
arp_mod_close_tail(arl_t *arl)
{
        ip_stack_t      *ipst = arl->arl_ipst;
        mblk_t          **mpp;

        mutex_enter(&ipst->ips_ip_mi_lock);
        mi_close_unlink(&ipst->ips_arp_g_head, (IDP)arl);
        mutex_exit(&ipst->ips_ip_mi_lock);

        /*
         * credp could be null if the open didn't succeed and ip_modopen
         * itself calls ip_close.
         */
        if (arl->arl_credp != NULL)
                crfree(arl->arl_credp);

        /* Free all retained control messages. */
        mpp = &arl->arl_first_mp_to_free;
        do {
                while (mpp[0]) {
                        mblk_t  *mp;
                        mblk_t  *mp1;

                        mp = mpp[0];
                        mpp[0] = mp->b_next;
                        for (mp1 = mp; mp1 != NULL; mp1 = mp1->b_cont) {
                                mp1->b_next = NULL;
                                mp1->b_prev = NULL;
                        }
                        freemsg(mp);
                }
        } while (mpp++ != &arl->arl_last_mp_to_free);

        netstack_rele(ipst->ips_netstack);
        mi_free(arl->arl_name);
        mi_close_free((IDP)arl);
}

/*
 * DAD failed. Tear down ipifs with the specified srce address. Note that
 * tearing down the ipif also meas deleting the ncec through ipif_down,
 * so it is not possible to use nce_timer for recovery. Instead we start
 * a timer on the ipif. Caller has to free the mp.
 */
void
arp_failure(mblk_t *mp, ip_recv_attr_t *ira)
{
        ill_t *ill = ira->ira_ill;

        if ((mp = copymsg(mp)) != NULL) {
                ill_refhold(ill);
                qwriter_ip(ill, ill->ill_rq, mp, arp_excl, NEW_OP, B_FALSE);
        }
}

/*
 * This is for exclusive changes due to ARP.  Tear down an interface due
 * to AR_CN_FAILED and AR_CN_BOGON.
 */
/* ARGSUSED */
static void
arp_excl(ipsq_t *ipsq, queue_t *rq, mblk_t *mp, void *dummy_arg)
{
        ill_t   *ill = rq->q_ptr;
        arh_t *arh;
        ipaddr_t src;
        ipif_t  *ipif;
        ip_stack_t *ipst = ill->ill_ipst;
        uchar_t *haddr;
        uint_t  haddrlen;

        /* first try src = ar$spa */
        arh = (arh_t *)mp->b_rptr;
        bcopy((char *)&arh[1] + arh->arh_hlen, &src, IP_ADDR_LEN);

        haddrlen = arh->arh_hlen;
        haddr = (uint8_t *)(arh + 1);

        if (haddrlen == ill->ill_phys_addr_length) {
                /*
                 * Ignore conflicts generated by misbehaving switches that
                 * just reflect our own messages back to us.  For IPMP, we may
                 * see reflections across any ill in the illgrp.
                 */
                /* For an under ill_grp can change under lock */
                rw_enter(&ipst->ips_ill_g_lock, RW_READER);
                if (bcmp(haddr, ill->ill_phys_addr, haddrlen) == 0 ||
                    IS_UNDER_IPMP(ill) && ill->ill_grp != NULL &&
                    ipmp_illgrp_find_ill(ill->ill_grp, haddr,
                    haddrlen) != NULL) {
                        rw_exit(&ipst->ips_ill_g_lock);
                        goto ignore_conflict;
                }
                rw_exit(&ipst->ips_ill_g_lock);
        }

        /*
         * Look up the appropriate ipif.
         */
        ipif = ipif_lookup_addr(src, ill, ALL_ZONES, ipst);
        if (ipif == NULL)
                goto ignore_conflict;

        /* Reload the ill to match the ipif */
        ill = ipif->ipif_ill;

        /* If it's already duplicate or ineligible, then don't do anything. */
        if (ipif->ipif_flags & (IPIF_POINTOPOINT|IPIF_DUPLICATE)) {
                ipif_refrele(ipif);
                goto ignore_conflict;
        }

        /*
         * If we failed on a recovery probe, then restart the timer to
         * try again later.
         */
        if (!ipif->ipif_was_dup) {
                char hbuf[MAC_STR_LEN];
                char sbuf[INET_ADDRSTRLEN];
                char ibuf[LIFNAMSIZ];

                (void) mac_colon_addr(haddr, haddrlen, hbuf, sizeof (hbuf));
                (void) ip_dot_addr(src, sbuf);
                ipif_get_name(ipif, ibuf, sizeof (ibuf));

                cmn_err(CE_WARN, "%s has duplicate address %s (in use by %s);"
                    " disabled", ibuf, sbuf, hbuf);
        }
        mutex_enter(&ill->ill_lock);
        ASSERT(!(ipif->ipif_flags & IPIF_DUPLICATE));
        ipif->ipif_flags |= IPIF_DUPLICATE;
        ill->ill_ipif_dup_count++;
        mutex_exit(&ill->ill_lock);
        (void) ipif_down(ipif, NULL, NULL);
        (void) ipif_down_tail(ipif);
        mutex_enter(&ill->ill_lock);
        if (!(ipif->ipif_flags & (IPIF_DHCPRUNNING|IPIF_TEMPORARY)) &&
            ill->ill_net_type == IRE_IF_RESOLVER &&
            !(ipif->ipif_state_flags & IPIF_CONDEMNED) &&
            ipst->ips_ip_dup_recovery > 0) {
                ASSERT(ipif->ipif_recovery_id == 0);
                ipif->ipif_recovery_id = timeout(ipif_dup_recovery,
                    ipif, MSEC_TO_TICK(ipst->ips_ip_dup_recovery));
        }
        mutex_exit(&ill->ill_lock);
        ipif_refrele(ipif);

ignore_conflict:
        freemsg(mp);
}

/*
 * This is a place for a dtrace hook.
 * Note that mp can be either the DL_UNITDATA_IND with a b_cont payload,
 * or just the ARP packet payload as an M_DATA.
 */
/* ARGSUSED */
static void
arp_drop_packet(const char *str, mblk_t *mp, ill_t *ill)
{
        freemsg(mp);
}

static boolean_t
arp_over_driver(queue_t *q)
{
        queue_t *qnext = STREAM(q)->sd_wrq->q_next;

        /*
         * check if first module below stream head is IP or UDP.
         */
        ASSERT(qnext != NULL);
        if (strcmp(Q2NAME(qnext), "ip") != 0 &&
            strcmp(Q2NAME(qnext), "udp") != 0) {
                /*
                 * module below is not ip or udp, so arp has been pushed
                 * on the driver.
                 */
                return (B_TRUE);
        }
        return (B_FALSE);
}

static int
arp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
{
        int err;

        ASSERT(sflag & MODOPEN);
        if (!arp_over_driver(q)) {
                q->q_qinfo = dummymodinfo.st_rdinit;
                WR(q)->q_qinfo = dummymodinfo.st_wrinit;
                return ((*dummymodinfo.st_rdinit->qi_qopen)(q, devp, flag,
                    sflag, credp));
        }
        err = arp_modopen(q, devp, flag, sflag, credp);
        return (err);
}

/*
 * In most cases we must be a writer on the IP stream before coming to
 * arp_dlpi_send(), to serialize DLPI sends to the driver. The exceptions
 * when we are not a writer are very early duing initialization (in
 * arl_init, before the arl has done a SLIFNAME, so that we don't yet know
 * the associated ill) or during arp_mod_close, when we could not enter the
 * ipsq because the ill has already unplumbed.
 */
static void
arp_dlpi_send(arl_t *arl, mblk_t *mp)
{
        mblk_t **mpp;
        t_uscalar_t prim;
        arl_ill_common_t *ai;

        ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO);

#ifdef DEBUG
        ai = arl->arl_common;
        if (ai != NULL) {
                mutex_enter(&ai->ai_lock);
                if (ai->ai_ill != NULL)
                        ASSERT(IAM_WRITER_ILL(ai->ai_ill));
                mutex_exit(&ai->ai_lock);
        }
#endif /* DEBUG */

        mutex_enter(&arl->arl_lock);
        if (arl->arl_dlpi_pending != DL_PRIM_INVAL) {
                /* Must queue message. Tail insertion */
                mpp = &arl->arl_dlpi_deferred;
                while (*mpp != NULL)
                        mpp = &((*mpp)->b_next);

                *mpp = mp;
                mutex_exit(&arl->arl_lock);
                return;
        }
        mutex_exit(&arl->arl_lock);
        if ((prim = ((union DL_primitives *)mp->b_rptr)->dl_primitive)
            == DL_BIND_REQ) {
                ASSERT((arl->arl_state_flags & ARL_DL_UNBIND_IN_PROGRESS) == 0);
        }
        /*
         * No need to take the arl_lock to examine ARL_CONDEMNED at this point
         * because the only thread that can see ARL_CONDEMNED here is the
         * closing arp_modclose() thread which sets the flag after becoming a
         * writer on the ipsq. Threads from IP must have finished and
         * cannot be active now.
         */
        if (!(arl->arl_state_flags & ARL_CONDEMNED) ||
            (prim == DL_UNBIND_REQ)) {
                if (prim != DL_NOTIFY_CONF) {
                        ill_t *ill = arl_to_ill(arl);

                        arl->arl_dlpi_pending = prim;
                        if (ill != NULL) {
                                mutex_enter(&ill->ill_lock);
                                ill->ill_arl_dlpi_pending = 1;
                                mutex_exit(&ill->ill_lock);
                                ill_refrele(ill);
                        }
                }
        }
        DTRACE_PROBE4(arl__dlpi, char *, "arp_dlpi_send",
            char *, dl_primstr(prim), char *, "-",  arl_t *, arl);
        putnext(arl->arl_wq, mp);
}

static void
arl_defaults_common(arl_t *arl, mblk_t *mp)
{
        dl_info_ack_t   *dlia = (dl_info_ack_t *)mp->b_rptr;
        /*
         * Till the ill is fully up  the ill is not globally visible.
         * So no need for a lock.
         */
        arl->arl_mactype = dlia->dl_mac_type;
        arl->arl_sap_length = dlia->dl_sap_length;

        if (!arl->arl_dlpi_style_set) {
                if (dlia->dl_provider_style == DL_STYLE2)
                        arl->arl_needs_attach = 1;
                mutex_enter(&arl->arl_lock);
                ASSERT(arl->arl_dlpi_style_set == 0);
                arl->arl_dlpi_style_set = 1;
                arl->arl_state_flags &= ~ARL_LL_SUBNET_PENDING;
                cv_broadcast(&arl->arl_cv);
                mutex_exit(&arl->arl_lock);
        }
}

int
arl_init(queue_t *q, arl_t *arl)
{
        mblk_t *info_mp;
        dl_info_req_t   *dlir;

        /* subset of ill_init */
        mutex_init(&arl->arl_lock, NULL, MUTEX_DEFAULT, 0);

        arl->arl_rq = q;
        arl->arl_wq = WR(q);

        info_mp = allocb(MAX(sizeof (dl_info_req_t), sizeof (dl_info_ack_t)),
            BPRI_HI);
        if (info_mp == NULL)
                return (ENOMEM);
        /*
         * allocate sufficient space to contain device name.
         */
        arl->arl_name = (char *)(mi_zalloc(2 * LIFNAMSIZ));
        arl->arl_ppa = UINT_MAX;
        arl->arl_state_flags |= (ARL_LL_SUBNET_PENDING | ARL_LL_UNBOUND);

        /* Send down the Info Request to the driver. */
        info_mp->b_datap->db_type = M_PCPROTO;
        dlir = (dl_info_req_t *)info_mp->b_rptr;
        info_mp->b_wptr = (uchar_t *)&dlir[1];
        dlir->dl_primitive = DL_INFO_REQ;
        arl->arl_dlpi_pending = DL_PRIM_INVAL;
        qprocson(q);

        arp_dlpi_send(arl, info_mp);
        return (0);
}

int
arl_wait_for_info_ack(arl_t *arl)
{
        int err;

        mutex_enter(&arl->arl_lock);
        while (arl->arl_state_flags & ARL_LL_SUBNET_PENDING) {
                /*
                 * Return value of 0 indicates a pending signal.
                 */
                err = cv_wait_sig(&arl->arl_cv, &arl->arl_lock);
                if (err == 0) {
                        mutex_exit(&arl->arl_lock);
                        return (EINTR);
                }
        }
        mutex_exit(&arl->arl_lock);
        /*
         * ip_rput_other could have set an error  in ill_error on
         * receipt of M_ERROR.
         */
        return (arl->arl_error);
}

void
arl_set_muxid(ill_t *ill, int muxid)
{
        arl_t *arl;

        arl = ill_to_arl(ill);
        if (arl != NULL) {
                arl->arl_muxid = muxid;
                arl_refrele(arl);
        }
}

int
arl_get_muxid(ill_t *ill)
{
        arl_t *arl;
        int muxid = 0;

        arl = ill_to_arl(ill);
        if (arl != NULL) {
                muxid = arl->arl_muxid;
                arl_refrele(arl);
        }
        return (muxid);
}

static int
arp_modopen(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
{
        int     err;
        zoneid_t zoneid;
        netstack_t *ns;
        ip_stack_t *ipst;
        arl_t   *arl = NULL;

        /*
         * Prevent unprivileged processes from pushing IP so that
         * they can't send raw IP.
         */
        if (secpolicy_net_rawaccess(credp) != 0)
                return (EPERM);

        ns = netstack_find_by_cred(credp);
        ASSERT(ns != NULL);
        ipst = ns->netstack_ip;
        ASSERT(ipst != NULL);

        /*
         * For exclusive stacks we set the zoneid to zero
         * to make IP operate as if in the global zone.
         */
        if (ipst->ips_netstack->netstack_stackid != GLOBAL_NETSTACKID)
                zoneid = GLOBAL_ZONEID;
        else
                zoneid = crgetzoneid(credp);

        arl = (arl_t *)mi_open_alloc_sleep(sizeof (arl_t));
        q->q_ptr = WR(q)->q_ptr = arl;
        arl->arl_ipst = ipst;
        arl->arl_zoneid = zoneid;
        err = arl_init(q, arl);

        if (err != 0) {
                mi_free(arl->arl_name);
                mi_free(arl);
                netstack_rele(ipst->ips_netstack);
                q->q_ptr = NULL;
                WR(q)->q_ptr = NULL;
                return (err);
        }

        /*
         * Wait for the DL_INFO_ACK if a DL_INFO_REQ was sent.
         */
        err = arl_wait_for_info_ack(arl);
        if (err == 0)
                arl->arl_credp = credp;
        else
                goto fail;

        crhold(credp);

        mutex_enter(&ipst->ips_ip_mi_lock);
        err = mi_open_link(&ipst->ips_arp_g_head, (IDP)q->q_ptr, devp, flag,
            sflag, credp);
        mutex_exit(&ipst->ips_ip_mi_lock);
fail:
        if (err) {
                (void) arp_close(q, 0, credp);
                return (err);
        }
        return (0);
}

/*
 * Notify any downstream modules (esp softmac and hitbox) of the name
 * of this interface using an M_CTL.
 */
static void
arp_ifname_notify(arl_t *arl)
{
        mblk_t *mp1, *mp2;
        struct iocblk *iocp;
        struct lifreq *lifr;

        if ((mp1 = mkiocb(SIOCSLIFNAME)) == NULL)
                return;
        if ((mp2 = allocb(sizeof (struct lifreq), BPRI_HI)) == NULL) {
                freemsg(mp1);
                return;
        }

        lifr = (struct lifreq *)mp2->b_rptr;
        mp2->b_wptr += sizeof (struct lifreq);
        bzero(lifr, sizeof (struct lifreq));

        (void) strncpy(lifr->lifr_name, arl->arl_name, LIFNAMSIZ);
        lifr->lifr_ppa = arl->arl_ppa;
        lifr->lifr_flags = ILLF_IPV4;

        /* Use M_CTL to avoid confusing anyone else who might be listening. */
        DB_TYPE(mp1) = M_CTL;
        mp1->b_cont = mp2;
        iocp = (struct iocblk *)mp1->b_rptr;
        iocp->ioc_count = msgsize(mp1->b_cont);
        DTRACE_PROBE4(arl__dlpi, char *, "arp_ifname_notify",
            char *, "SIOCSLIFNAME", char *, "-",  arl_t *, arl);
        putnext(arl->arl_wq, mp1);
}

void
arp_send_replumb_conf(ill_t *ill)
{
        mblk_t *mp;
        arl_t *arl = ill_to_arl(ill);

        if (arl == NULL)
                return;
        /*
         * arl_got_replumb and arl_got_unbind to be cleared after we complete
         * arp_cmd_done.
         */
        mp = mexchange(NULL, NULL, sizeof (dl_notify_conf_t), M_PROTO,
            DL_NOTIFY_CONF);
        ((dl_notify_conf_t *)(mp->b_rptr))->dl_notification =
            DL_NOTE_REPLUMB_DONE;
        arp_dlpi_send(arl, mp);
        mutex_enter(&arl->arl_lock);
        arl->arl_state_flags &= ~ARL_LL_REPLUMBING;
        mutex_exit(&arl->arl_lock);
        arl_refrele(arl);
}

/*
 * The unplumb code paths call arp_unbind_complete() to make sure that it is
 * safe to tear down the ill. We wait for DL_UNBIND_ACK to complete, and also
 * for the arl_refcnt to fall to one so that, when we return from
 * arp_unbind_complete(), we know for certain that there are no threads in
 * arp_rput() that might access the arl_ill.
 */
void
arp_unbind_complete(ill_t *ill)
{
        arl_t *arl = ill_to_arl(ill);

        if (arl == NULL)
                return;
        mutex_enter(&arl->arl_lock);
        /*
         * wait for unbind ack and arl_refcnt to drop to 1. Note that the
         * quiescent arl_refcnt for this function is 1 (and not 0) because
         * ill_to_arl() will itself return after taking a ref on the arl_t.
         */
        while (arl->arl_state_flags & ARL_DL_UNBIND_IN_PROGRESS)
                cv_wait(&arl->arl_cv, &arl->arl_lock);
        while (arl->arl_refcnt != 1)
                cv_wait(&arl->arl_cv, &arl->arl_lock);
        mutex_exit(&arl->arl_lock);
        arl_refrele(arl);
}