xref: /illumos-gate/usr/src/uts/common/io/ppp/sppp/sppp.c (revision 78a53e20)

/*
 * sppp.c - Solaris STREAMS PPP multiplexing pseudo-driver
 *
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright (c) 2016 by Delphix. All rights reserved.
 * Copyright 2019, Joyent, Inc.
 *
 * Permission to use, copy, modify, and distribute this software and its
 * documentation is hereby granted, provided that the above copyright
 * notice appears in all copies.
 *
 * SUN MAKES NO REPRESENTATION OR WARRANTIES ABOUT THE SUITABILITY OF
 * THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
 * TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
 * PARTICULAR PURPOSE, OR NON-INFRINGEMENT.  SUN SHALL NOT BE LIABLE FOR
 * ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING OR
 * DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES
 *
 * Copyright (c) 1994 The Australian National University.
 * All rights reserved.
 *
 * Permission to use, copy, modify, and distribute this software and its
 * documentation is hereby granted, provided that the above copyright
 * notice appears in all copies.  This software is provided without any
 * warranty, express or implied. The Australian National University
 * makes no representations about the suitability of this software for
 * any purpose.
 *
 * IN NO EVENT SHALL THE AUSTRALIAN NATIONAL UNIVERSITY BE LIABLE TO ANY
 * PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
 * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF
 * THE AUSTRALIAN NATIONAL UNIVERSITY HAS BEEN ADVISED OF THE POSSIBILITY
 * OF SUCH DAMAGE.
 *
 * THE AUSTRALIAN NATIONAL UNIVERSITY SPECIFICALLY DISCLAIMS ANY WARRANTIES,
 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
 * ON AN "AS IS" BASIS, AND THE AUSTRALIAN NATIONAL UNIVERSITY HAS NO
 * OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS,
 * OR MODIFICATIONS.
 *
 * This driver is derived from the original SVR4 STREAMS PPP driver
 * originally written by Paul Mackerras <paul.mackerras@cs.anu.edu.au>.
 *
 * Adi Masputra <adi.masputra@sun.com> rewrote and restructured the code
 * for improved performance and scalability.
 */

#define	RCSID	"$Id: sppp.c,v 1.0 2000/05/08 01:10:12 masputra Exp $"

#include <sys/types.h>
#include <sys/debug.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/sysmacros.h>
#include <sys/errno.h>
#include <sys/time.h>
#include <sys/cmn_err.h>
#include <sys/kmem.h>
#include <sys/conf.h>
#include <sys/dlpi.h>
#include <sys/ddi.h>
#include <sys/kstat.h>
#include <sys/strsun.h>
#include <sys/ethernet.h>
#include <sys/policy.h>
#include <sys/zone.h>
#include <net/ppp_defs.h>
#include <net/pppio.h>
#include "sppp.h"
#include "s_common.h"

/*
 * This is used to tag official Solaris sources.  Please do not define
 * "INTERNAL_BUILD" when building this software outside of Sun Microsystems.
 */
#ifdef INTERNAL_BUILD
/* MODINFO is limited to 32 characters. */
const char sppp_module_description[] = "PPP 4.0 mux";
#else /* INTERNAL_BUILD */
const char sppp_module_description[] = "ANU PPP mux";

/* LINTED */
static const char buildtime[] = "Built " __DATE__ " at " __TIME__
#ifdef DEBUG
" DEBUG"
#endif
"\n";
#endif /* INTERNAL_BUILD */

static void	sppp_inner_ioctl(queue_t *, mblk_t *);
static void	sppp_outer_ioctl(queue_t *, mblk_t *);
static queue_t	*sppp_send(queue_t *, mblk_t **, spppstr_t *);
static queue_t	*sppp_recv(queue_t *, mblk_t **, spppstr_t *);
static void	sppp_recv_nondata(queue_t *, mblk_t *, spppstr_t *);
static queue_t	*sppp_outpkt(queue_t *, mblk_t **, int, spppstr_t *);
static spppstr_t *sppp_inpkt(queue_t *, mblk_t *, spppstr_t *);
static int	sppp_kstat_update(kstat_t *, int);
static void	sppp_release_pkts(sppa_t *, uint16_t);

/*
 * sps_list contains the list of active per-stream instance state structures
 * ordered on the minor device number (see sppp.h for details). All streams
 * opened to this driver are threaded together in this list.
 */
static spppstr_t *sps_list = NULL;
/*
 * ppa_list contains the list of active per-attachment instance state
 * structures ordered on the ppa id number (see sppp.h for details). All of
 * the ppa structures created once per PPPIO_NEWPPA ioctl are threaded together
 * in this list. There is exactly one ppa structure for a given PPP interface,
 * and multiple sps streams (upper streams) may share a ppa by performing
 * an attachment explicitly (PPPIO_ATTACH) or implicitly (DL_ATTACH_REQ).
 */
static sppa_t *ppa_list = NULL;

static const char *kstats_names[] = { SPPP_KSTATS_NAMES };
static const char *kstats64_names[] = { SPPP_KSTATS64_NAMES };

/*
 * map proto (which is an IANA defined ppp network protocol) to
 * a bit position indicated by NP_* in ppa_npflag
 */
static uint32_t
sppp_ppp2np(uint16_t proto)
{
	switch (proto) {
	case PPP_IP:
		return (NP_IP);
	case PPP_IPV6:
		return (NP_IPV6);
	default:
		return (0);
	}
}

/*
 * sppp_open()
 *
 * MT-Perimeters:
 *    exclusive inner, exclusive outer.
 *
 * Description:
 *    Common open procedure for module.
 */
/* ARGSUSED */
int
sppp_open(queue_t *q, dev_t *devp, int oflag, int sflag, cred_t *credp)
{
	spppstr_t	*sps;
	spppstr_t	**nextmn;
	minor_t		mn;

	ASSERT(q != NULL && devp != NULL);
	ASSERT(sflag != MODOPEN);

	if (q->q_ptr != NULL) {
		return (0);		/* already open */
	}
	if (sflag != CLONEOPEN) {
		return (OPENFAIL);
	}
	/*
	 * The sps list is sorted using the minor number as the key. The
	 * following code walks the list to find the lowest valued minor
	 * number available to be used.
	 */
	mn = 0;
	for (nextmn = &sps_list; (sps = *nextmn) != NULL;
	    nextmn = &sps->sps_nextmn) {
		if (sps->sps_mn_id != mn) {
			break;
		}
		++mn;
	}
	sps = (spppstr_t *)kmem_zalloc(sizeof (spppstr_t), KM_SLEEP);
	ASSERT(sps != NULL);		/* KM_SLEEP must never return NULL */
	sps->sps_nextmn = *nextmn;	/* insert stream in global list */
	*nextmn = sps;
	sps->sps_mn_id = mn;		/* save minor id for this stream */
	sps->sps_rq = q;		/* save read queue pointer */
	sps->sps_sap = -1;		/* no sap bound to stream */
	sps->sps_dlstate = DL_UNATTACHED; /* dlpi state is unattached */
	sps->sps_npmode = NPMODE_DROP;	/* drop all packets initially */
	sps->sps_zoneid = crgetzoneid(credp);
	q->q_ptr = WR(q)->q_ptr = (caddr_t)sps;
	/*
	 * We explicitly disable the automatic queue scheduling for the
	 * write-side to obtain complete control over queuing during transmit.
	 * Packets will be queued at the upper write queue and the service
	 * routine will not be called until it gets scheduled by having the
	 * lower write service routine call the qenable(WR(uq)) for all streams
	 * attached to the same ppa instance.
	 */
	noenable(WR(q));
	*devp = makedevice(getmajor(*devp), mn);
	qprocson(q);
	return (0);
}

/*
 * Free storage used by a PPA.  This is not called until the last PPA
 * user closes their connection or reattaches to a different PPA.
 */
static void
sppp_free_ppa(sppa_t *ppa)
{
	sppa_t **nextppa;

	ASSERT(ppa->ppa_refcnt == 1);
	if (ppa->ppa_kstats != NULL) {
		kstat_delete(ppa->ppa_kstats);
		ppa->ppa_kstats = NULL;
	}
	mutex_destroy(&ppa->ppa_sta_lock);
	mutex_destroy(&ppa->ppa_npmutex);
	rw_destroy(&ppa->ppa_sib_lock);
	nextppa = &ppa_list;
	while (*nextppa != NULL) {
		if (*nextppa == ppa) {
			*nextppa = ppa->ppa_nextppa;
			break;
		}
		nextppa = &(*nextppa)->ppa_nextppa;
	}
	kmem_free(ppa, sizeof (*ppa));
}

/*
 * Create a new PPA.  Caller must be exclusive on outer perimeter.
 */
sppa_t *
sppp_create_ppa(uint32_t ppa_id, zoneid_t zoneid)
{
	sppa_t *ppa;
	sppa_t *curppa;
	sppa_t **availppa;
	char unit[32];		/* Unit name */
	const char **cpp;
	kstat_t *ksp;
	kstat_named_t *knt;

	/*
	 * NOTE: unit *must* be named for the driver
	 * name plus the ppa number so that netstat
	 * can find the statistics.
	 */
	(void) sprintf(unit, "%s" "%d", PPP_DRV_NAME, ppa_id);
	/*
	 * Make sure we can allocate a buffer to
	 * contain the ppa to be sent upstream, as
	 * well as the actual ppa structure and its
	 * associated kstat structure.
	 */
	ppa = (sppa_t *)kmem_zalloc(sizeof (sppa_t),
	    KM_NOSLEEP);
	ksp = kstat_create(PPP_DRV_NAME, ppa_id, unit, "net", KSTAT_TYPE_NAMED,
	    sizeof (sppp_kstats_t) / sizeof (kstat_named_t), 0);

	if (ppa == NULL || ksp == NULL) {
		if (ppa != NULL) {
			kmem_free(ppa, sizeof (sppa_t));
		}
		if (ksp != NULL) {
			kstat_delete(ksp);
		}
		return (NULL);
	}
	ppa->ppa_kstats = ksp;		/* chain kstat structure */
	ppa->ppa_ppa_id = ppa_id;	/* record ppa id */
	ppa->ppa_zoneid = zoneid;	/* zone that owns this PPA */
	ppa->ppa_mtu = PPP_MAXMTU;	/* 65535-(PPP_HDRLEN+PPP_FCSLEN) */
	ppa->ppa_mru = PPP_MAXMRU;	/* 65000 */

	mutex_init(&ppa->ppa_sta_lock, NULL, MUTEX_DRIVER, NULL);
	mutex_init(&ppa->ppa_npmutex, NULL, MUTEX_DRIVER, NULL);
	rw_init(&ppa->ppa_sib_lock, NULL, RW_DRIVER, NULL);

	/*
	 * Prepare and install kstat counters.  Note that for netstat
	 * -i to work, there needs to be "ipackets", "opackets",
	 * "ierrors", and "oerrors" kstat named variables.
	 */
	knt = (kstat_named_t *)ksp->ks_data;
	for (cpp = kstats_names; cpp < kstats_names + Dim(kstats_names);
	    cpp++) {
		kstat_named_init(knt, *cpp, KSTAT_DATA_UINT32);
		knt++;
	}
	for (cpp = kstats64_names; cpp < kstats64_names + Dim(kstats64_names);
	    cpp++) {
		kstat_named_init(knt, *cpp, KSTAT_DATA_UINT64);
		knt++;
	}
	ksp->ks_update = sppp_kstat_update;
	ksp->ks_private = (void *)ppa;
	kstat_install(ksp);

	/* link to the next ppa and insert into global list */
	availppa = &ppa_list;
	while ((curppa = *availppa) != NULL) {
		if (ppa_id < curppa->ppa_ppa_id)
			break;
		availppa = &curppa->ppa_nextppa;
	}
	ppa->ppa_nextppa = *availppa;
	*availppa = ppa;
	return (ppa);
}

/*
 * sppp_close()
 *
 * MT-Perimeters:
 *    exclusive inner, exclusive outer.
 *
 * Description:
 *    Common close procedure for module.
 */
/* ARGSUSED */
int
sppp_close(queue_t *q, int flags __unused, cred_t *credp __unused)
{
	spppstr_t	*sps;
	spppstr_t	**nextmn;
	spppstr_t	*sib;
	sppa_t		*ppa;
	mblk_t		*mp;

	ASSERT(q != NULL && q->q_ptr != NULL);
	sps = (spppstr_t *)q->q_ptr;
	qprocsoff(q);

	ppa = sps->sps_ppa;
	if (ppa == NULL) {
		ASSERT(!IS_SPS_CONTROL(sps));
		goto close_unattached;
	}
	if (IS_SPS_CONTROL(sps)) {
		uint32_t	cnt = 0;

		ASSERT(ppa != NULL);
		ASSERT(ppa->ppa_ctl == sps);
		ppa->ppa_ctl = NULL;
		/*
		 * STREAMS framework always issues I_UNLINK prior to close,
		 * since we only allow I_LINK under the control stream.
		 * A given ppa structure has at most one lower stream pointed
		 * by the ppa_lower_wq field, because we only allow a single
		 * linkage (I_LINK) to be done on the control stream.
		 */
		ASSERT(ppa->ppa_lower_wq == NULL);
		/*
		 * Walk through all of sibling streams attached to this ppa,
		 * and remove all references to this ppa. We have exclusive
		 * access for the entire driver here, so there's no need
		 * to hold ppa_sib_lock.
		 */
		cnt++;
		sib = ppa->ppa_streams;
		while (sib != NULL) {
			ASSERT(ppa == sib->sps_ppa);
			sib->sps_npmode = NPMODE_DROP;
			sib->sps_flags &= ~(SPS_PIOATTACH | SPS_CACHED);
			/*
			 * There should be a preallocated hangup
			 * message here.  Fetch it and send it up to
			 * the stream head.  This will cause IP to
			 * mark the interface as "down."
			 */
			if ((mp = sib->sps_hangup) != NULL) {
				sib->sps_hangup = NULL;
				/*
				 * M_HANGUP works with IP, but snoop
				 * is lame and requires M_ERROR.  Send
				 * up a clean error code instead.
				 *
				 * XXX if snoop is fixed, fix this, too.
				 */
				MTYPE(mp) = M_ERROR;
				*mp->b_wptr++ = ENXIO;
				putnext(sib->sps_rq, mp);
			}
			qenable(WR(sib->sps_rq));
			cnt++;
			sib = sib->sps_nextsib;
		}
		ASSERT(ppa->ppa_refcnt == cnt);
	} else {
		ASSERT(ppa->ppa_streams != NULL);
		ASSERT(ppa->ppa_ctl != sps);
		mp = NULL;
		if (sps->sps_sap == PPP_IP) {
			ppa->ppa_ip_cache = NULL;
			mp = create_lsmsg(PPP_LINKSTAT_IPV4_UNBOUND);
		} else if (sps->sps_sap == PPP_IPV6) {
			ppa->ppa_ip6_cache = NULL;
			mp = create_lsmsg(PPP_LINKSTAT_IPV6_UNBOUND);
		}
		/* Tell the daemon the bad news. */
		if (mp != NULL && ppa->ppa_ctl != NULL &&
		    (sps->sps_npmode == NPMODE_PASS ||
		    sps->sps_npmode == NPMODE_QUEUE)) {
			putnext(ppa->ppa_ctl->sps_rq, mp);
		} else {
			freemsg(mp);
		}
		/*
		 * Walk through all of sibling streams attached to the
		 * same ppa, and remove this stream from the sibling
		 * streams list. We have exclusive access for the
		 * entire driver here, so there's no need to hold
		 * ppa_sib_lock.
		 */
		sib = ppa->ppa_streams;
		if (sib == sps) {
			ppa->ppa_streams = sps->sps_nextsib;
		} else {
			while (sib->sps_nextsib != NULL) {
				if (sib->sps_nextsib == sps) {
					sib->sps_nextsib = sps->sps_nextsib;
					break;
				}
				sib = sib->sps_nextsib;
			}
		}
		sps->sps_nextsib = NULL;
		freemsg(sps->sps_hangup);
		sps->sps_hangup = NULL;
		/*
		 * Check if this is a promiscous stream. If the SPS_PROMISC bit
		 * is still set, it means that the stream is closed without
		 * ever having issued DL_DETACH_REQ or DL_PROMISCOFF_REQ.
		 * In this case, we simply decrement the promiscous counter,
		 * and it's safe to do it without holding ppa_sib_lock since
		 * we're exclusive (inner and outer) at this point.
		 */
		if (IS_SPS_PROMISC(sps)) {
			ASSERT(ppa->ppa_promicnt > 0);
			ppa->ppa_promicnt--;
		}
	}
	/* If we're the only one left, then delete now. */
	if (ppa->ppa_refcnt <= 1)
		sppp_free_ppa(ppa);
	else
		ppa->ppa_refcnt--;
close_unattached:
	q->q_ptr = WR(q)->q_ptr = NULL;
	for (nextmn = &sps_list; *nextmn != NULL;
	    nextmn = &(*nextmn)->sps_nextmn) {
		if (*nextmn == sps) {
			*nextmn = sps->sps_nextmn;
			break;
		}
	}
	kmem_free(sps, sizeof (spppstr_t));
	return (0);
}

static void
sppp_ioctl(struct queue *q, mblk_t *mp)
{
	spppstr_t	*sps;
	spppstr_t	*nextsib;
	sppa_t		*ppa;
	struct iocblk	*iop;
	mblk_t		*nmp;
	enum NPmode	npmode;
	struct ppp_idle	*pip;
	struct ppp_stats64 *psp;
	struct ppp_comp_stats *pcsp;
	hrtime_t	hrtime;
	int		sap;
	int		count = 0;
	int		error = EINVAL;

	sps = (spppstr_t *)q->q_ptr;
	ppa = sps->sps_ppa;

	iop = (struct iocblk *)mp->b_rptr;
	switch (iop->ioc_cmd) {
	case PPPIO_NPMODE:
		if (!IS_SPS_CONTROL(sps)) {
			break;		/* return EINVAL */
		} else if (iop->ioc_count != 2 * sizeof (uint32_t) ||
		    (mp->b_cont == NULL)) {
			error = EPROTO;
			break;
		}
		ASSERT(ppa != NULL);
		ASSERT(mp->b_cont->b_rptr != NULL);
		ASSERT(sps->sps_npmode == NPMODE_PASS);
		sap = ((uint32_t *)mp->b_cont->b_rptr)[0];
		npmode = (enum NPmode)((uint32_t *)mp->b_cont->b_rptr)[1];
		/*
		 * Walk the sibling streams which belong to the same
		 * ppa, and try to find a stream with matching sap
		 * number.
		 */
		rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
		for (nextsib = ppa->ppa_streams; nextsib != NULL;
		    nextsib = nextsib->sps_nextsib) {
			if (nextsib->sps_sap == sap) {
				break;	/* found it */
			}
		}
		if (nextsib == NULL) {
			rw_exit(&ppa->ppa_sib_lock);
			break;		/* return EINVAL */
		} else {
			nextsib->sps_npmode = npmode;
			if ((nextsib->sps_npmode != NPMODE_QUEUE) &&
			    (WR(nextsib->sps_rq)->q_first != NULL)) {
				qenable(WR(nextsib->sps_rq));
			}
		}
		rw_exit(&ppa->ppa_sib_lock);
		error = 0;	/* return success */
		break;
	case PPPIO_GIDLE:
		if (ppa == NULL) {
			ASSERT(!IS_SPS_CONTROL(sps));
			error = ENOLINK;
			break;
		} else if (!IS_PPA_TIMESTAMP(ppa)) {
			break;		/* return EINVAL */
		}
		if ((nmp = allocb(sizeof (struct ppp_idle),
		    BPRI_MED)) == NULL) {
			mutex_enter(&ppa->ppa_sta_lock);
			ppa->ppa_allocbfail++;
			mutex_exit(&ppa->ppa_sta_lock);
			error = ENOSR;
			break;
		}
		if (mp->b_cont != NULL) {
			freemsg(mp->b_cont);
		}
		mp->b_cont = nmp;
		pip = (struct ppp_idle *)nmp->b_wptr;
		nmp->b_wptr += sizeof (struct ppp_idle);
		/*
		 * Get current timestamp and subtract the tx and rx
		 * timestamps to get the actual idle time to be
		 * returned.
		 */
		hrtime = gethrtime();
		pip->xmit_idle = (hrtime - ppa->ppa_lasttx) / 1000000000ul;
		pip->recv_idle = (hrtime - ppa->ppa_lastrx) / 1000000000ul;
		count = msgsize(nmp);
		error = 0;
		break;		/* return success (error is 0) */
	case PPPIO_GTYPE:
		nmp = allocb(sizeof (uint32_t), BPRI_MED);
		if (nmp == NULL) {
			error = ENOSR;
			break;
		}
		if (mp->b_cont != NULL) {
			freemsg(mp->b_cont);
		}
		mp->b_cont = nmp;
		/*
		 * Let the requestor know that we are the PPP
		 * multiplexer (PPPTYP_MUX).
		 */
		*(uint32_t *)nmp->b_wptr = PPPTYP_MUX;
		nmp->b_wptr += sizeof (uint32_t);
		count = msgsize(nmp);
		error = 0;		/* return success */
		break;
	case PPPIO_GETSTAT64:
		if (ppa == NULL) {
			break;		/* return EINVAL */
		} else if ((ppa->ppa_lower_wq != NULL) &&
		    !IS_PPA_LASTMOD(ppa)) {
			mutex_enter(&ppa->ppa_sta_lock);
			/*
			 * We match sps_ioc_id on the M_IOC{ACK,NAK},
			 * so if the response hasn't come back yet,
			 * new ioctls must be queued instead.
			 */
			if (IS_SPS_IOCQ(sps)) {
				mutex_exit(&ppa->ppa_sta_lock);
				if (!putq(q, mp)) {
					error = EAGAIN;
					break;
				}
				return;
			} else {
				ppa->ppa_ioctlsfwd++;
				/*
				 * Record the ioctl CMD & ID - this will be
				 * used to check the ACK or NAK responses
				 * coming from below.
				 */
				sps->sps_ioc_id = iop->ioc_id;
				sps->sps_flags |= SPS_IOCQ;
				mutex_exit(&ppa->ppa_sta_lock);
			}
			putnext(ppa->ppa_lower_wq, mp);
			return;	/* don't ack or nak the request */
		}
		nmp = allocb(sizeof (*psp), BPRI_MED);
		if (nmp == NULL) {
			mutex_enter(&ppa->ppa_sta_lock);
			ppa->ppa_allocbfail++;
			mutex_exit(&ppa->ppa_sta_lock);
			error = ENOSR;
			break;
		}
		if (mp->b_cont != NULL) {
			freemsg(mp->b_cont);
		}
		mp->b_cont = nmp;
		psp = (struct ppp_stats64 *)nmp->b_wptr;
		/*
		 * Copy the contents of ppp_stats64 structure for this
		 * ppa and return them to the caller.
		 */
		mutex_enter(&ppa->ppa_sta_lock);
		bcopy(&ppa->ppa_stats, psp, sizeof (*psp));
		mutex_exit(&ppa->ppa_sta_lock);
		nmp->b_wptr += sizeof (*psp);
		count = sizeof (*psp);
		error = 0;		/* return success */
		break;
	case PPPIO_GETCSTAT:
		if (ppa == NULL) {
			break;		/* return EINVAL */
		} else if ((ppa->ppa_lower_wq != NULL) &&
		    !IS_PPA_LASTMOD(ppa)) {
			mutex_enter(&ppa->ppa_sta_lock);
			/*
			 * See comments in PPPIO_GETSTAT64 case
			 * in sppp_ioctl().
			 */
			if (IS_SPS_IOCQ(sps)) {
				mutex_exit(&ppa->ppa_sta_lock);
				if (!putq(q, mp)) {
					error = EAGAIN;
					break;
				}
				return;
			} else {
				ppa->ppa_ioctlsfwd++;
				/*
				 * Record the ioctl CMD & ID - this will be
				 * used to check the ACK or NAK responses
				 * coming from below.
				 */
				sps->sps_ioc_id = iop->ioc_id;
				sps->sps_flags |= SPS_IOCQ;
				mutex_exit(&ppa->ppa_sta_lock);
			}
			putnext(ppa->ppa_lower_wq, mp);
			return;	/* don't ack or nak the request */
		}
		nmp = allocb(sizeof (struct ppp_comp_stats), BPRI_MED);
		if (nmp == NULL) {
			mutex_enter(&ppa->ppa_sta_lock);
			ppa->ppa_allocbfail++;
			mutex_exit(&ppa->ppa_sta_lock);
			error = ENOSR;
			break;
		}
		if (mp->b_cont != NULL) {
			freemsg(mp->b_cont);
		}
		mp->b_cont = nmp;
		pcsp = (struct ppp_comp_stats *)nmp->b_wptr;
		nmp->b_wptr += sizeof (struct ppp_comp_stats);
		bzero((caddr_t)pcsp, sizeof (struct ppp_comp_stats));
		count = msgsize(nmp);
		error = 0;		/* return success */
		break;
	}

	if (error == 0) {
		/* Success; tell the user. */
		miocack(q, mp, count, 0);
	} else {
		/* Failure; send error back upstream. */
		miocnak(q, mp, 0, error);
	}
}

/*
 * sppp_uwput()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Upper write-side put procedure. Messages from above arrive here.
 */
int
sppp_uwput(queue_t *q, mblk_t *mp)
{
	queue_t		*nextq;
	spppstr_t	*sps;
	sppa_t		*ppa;
	struct iocblk	*iop;
	int		error;

	ASSERT(q != NULL && q->q_ptr != NULL);
	ASSERT(mp != NULL && mp->b_rptr != NULL);
	sps = (spppstr_t *)q->q_ptr;
	ppa = sps->sps_ppa;

	switch (MTYPE(mp)) {
	case M_PCPROTO:
	case M_PROTO:
		if (IS_SPS_CONTROL(sps)) {
			ASSERT(ppa != NULL);
			/*
			 * Intentionally change this to a high priority
			 * message so it doesn't get queued up. M_PROTO is
			 * specifically used for signalling between pppd and its
			 * kernel-level component(s), such as ppptun, so we
			 * make sure that it doesn't get queued up behind
			 * data messages.
			 */
			MTYPE(mp) = M_PCPROTO;
			if ((ppa->ppa_lower_wq != NULL) &&
			    canputnext(ppa->ppa_lower_wq)) {
				mutex_enter(&ppa->ppa_sta_lock);
				ppa->ppa_mctlsfwd++;
				mutex_exit(&ppa->ppa_sta_lock);
				putnext(ppa->ppa_lower_wq, mp);
			} else {
				mutex_enter(&ppa->ppa_sta_lock);
				ppa->ppa_mctlsfwderr++;
				mutex_exit(&ppa->ppa_sta_lock);
				freemsg(mp);
			}
		} else {
			(void) sppp_mproto(q, mp, sps);
			return (0);
		}
		break;
	case M_DATA:
		if ((nextq = sppp_send(q, &mp, sps)) != NULL)
			putnext(nextq, mp);
		break;
	case M_IOCTL:
		error = EINVAL;
		iop = (struct iocblk *)mp->b_rptr;
		switch (iop->ioc_cmd) {
		case DLIOCRAW:
		case DL_IOC_HDR_INFO:
		case PPPIO_ATTACH:
		case PPPIO_DEBUG:
		case PPPIO_DETACH:
		case PPPIO_LASTMOD:
		case PPPIO_MRU:
		case PPPIO_MTU:
		case PPPIO_USETIMESTAMP:
		case PPPIO_BLOCKNP:
		case PPPIO_UNBLOCKNP:
			qwriter(q, mp, sppp_inner_ioctl, PERIM_INNER);
			return (0);
		case I_LINK:
		case I_UNLINK:
		case PPPIO_NEWPPA:
			qwriter(q, mp, sppp_outer_ioctl, PERIM_OUTER);
			return (0);
		case PPPIO_NPMODE:
		case PPPIO_GIDLE:
		case PPPIO_GTYPE:
		case PPPIO_GETSTAT64:
		case PPPIO_GETCSTAT:
			/*
			 * These require additional auto variables to
			 * handle, so (for optimization reasons)
			 * they're moved off to a separate function.
			 */
			sppp_ioctl(q, mp);
			return (0);
		case PPPIO_GETSTAT:
			break;			/* 32 bit interface gone */
		default:
			if (iop->ioc_cr == NULL ||
			    secpolicy_ppp_config(iop->ioc_cr) != 0) {
				error = EPERM;
				break;
			} else if ((ppa == NULL) ||
			    (ppa->ppa_lower_wq == NULL)) {
				break;		/* return EINVAL */
			}
			mutex_enter(&ppa->ppa_sta_lock);
			/*
			 * See comments in PPPIO_GETSTAT64 case
			 * in sppp_ioctl().
			 */
			if (IS_SPS_IOCQ(sps)) {
				mutex_exit(&ppa->ppa_sta_lock);
				if (!putq(q, mp)) {
					error = EAGAIN;
					break;
				}
				return (0);
			} else {
				ppa->ppa_ioctlsfwd++;
				/*
				 * Record the ioctl CMD & ID -
				 * this will be used to check the
				 * ACK or NAK responses coming from below.
				 */
				sps->sps_ioc_id = iop->ioc_id;
				sps->sps_flags |= SPS_IOCQ;
				mutex_exit(&ppa->ppa_sta_lock);
			}
			putnext(ppa->ppa_lower_wq, mp);
			return (0);	/* don't ack or nak the request */
		}
		/* Failure; send error back upstream. */
		miocnak(q, mp, 0, error);
		break;
	case M_FLUSH:
		if (*mp->b_rptr & FLUSHW) {
			flushq(q, FLUSHDATA);
		}
		if (*mp->b_rptr & FLUSHR) {
			*mp->b_rptr &= ~FLUSHW;
			qreply(q, mp);
		} else {
			freemsg(mp);
		}
		break;
	default:
		freemsg(mp);
		break;
	}
	return (0);
}

/*
 * sppp_uwsrv()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Upper write-side service procedure. Note that this procedure does
 *    not get called when a message is placed on our write-side queue, since
 *    automatic queue scheduling has been turned off by noenable() when
 *    the queue was opened. We do this on purpose, as we explicitly control
 *    the write-side queue. Therefore, this procedure gets called when
 *    the lower write service procedure qenable() the upper write stream queue.
 */
int
sppp_uwsrv(queue_t *q)
{
	spppstr_t	*sps;
	sppa_t		*ppa;
	mblk_t		*mp;
	queue_t		*nextq;
	struct iocblk	*iop;

	ASSERT(q != NULL && q->q_ptr != NULL);
	sps = (spppstr_t *)q->q_ptr;

	while ((mp = getq(q)) != NULL) {
		if (MTYPE(mp) == M_IOCTL) {
			ppa = sps->sps_ppa;
			if ((ppa == NULL) || (ppa->ppa_lower_wq == NULL)) {
				miocnak(q, mp, 0, EINVAL);
				continue;
			}

			iop = (struct iocblk *)mp->b_rptr;
			mutex_enter(&ppa->ppa_sta_lock);
			/*
			 * See comments in PPPIO_GETSTAT64 case
			 * in sppp_ioctl().
			 */
			if (IS_SPS_IOCQ(sps)) {
				mutex_exit(&ppa->ppa_sta_lock);
				if (putbq(q, mp) == 0)
					miocnak(q, mp, 0, EAGAIN);
				break;
			} else {
				ppa->ppa_ioctlsfwd++;
				sps->sps_ioc_id = iop->ioc_id;
				sps->sps_flags |= SPS_IOCQ;
				mutex_exit(&ppa->ppa_sta_lock);
				putnext(ppa->ppa_lower_wq, mp);
			}
		} else if ((nextq =
		    sppp_outpkt(q, &mp, msgdsize(mp), sps)) == NULL) {
			if (mp != NULL) {
				if (putbq(q, mp) == 0)
					freemsg(mp);
				break;
			}
		} else {
			putnext(nextq, mp);
		}
	}
	return (0);
}

void
sppp_remove_ppa(spppstr_t *sps)
{
	spppstr_t *nextsib;
	sppa_t *ppa = sps->sps_ppa;

	rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
	if (ppa->ppa_refcnt <= 1) {
		rw_exit(&ppa->ppa_sib_lock);
		sppp_free_ppa(ppa);
	} else {
		nextsib = ppa->ppa_streams;
		if (nextsib == sps) {
			ppa->ppa_streams = sps->sps_nextsib;
		} else {
			while (nextsib->sps_nextsib != NULL) {
				if (nextsib->sps_nextsib == sps) {
					nextsib->sps_nextsib =
					    sps->sps_nextsib;
					break;
				}
				nextsib = nextsib->sps_nextsib;
			}
		}
		ppa->ppa_refcnt--;
		/*
		 * And if this stream was marked as promiscuous
		 * (SPS_PROMISC), then we need to update the
		 * promiscuous streams count. This should only happen
		 * when DL_DETACH_REQ is issued prior to marking the
		 * stream as non-promiscuous, through
		 * DL_PROMISCOFF_REQ request.
		 */
		if (IS_SPS_PROMISC(sps)) {
			ASSERT(ppa->ppa_promicnt > 0);
			ppa->ppa_promicnt--;
		}
		rw_exit(&ppa->ppa_sib_lock);
	}
	sps->sps_nextsib = NULL;
	sps->sps_ppa = NULL;
	freemsg(sps->sps_hangup);
	sps->sps_hangup = NULL;
}

sppa_t *
sppp_find_ppa(uint32_t ppa_id)
{
	sppa_t *ppa;

	for (ppa = ppa_list; ppa != NULL; ppa = ppa->ppa_nextppa) {
		if (ppa->ppa_ppa_id == ppa_id) {
			break;	/* found the ppa */
		}
	}
	return (ppa);
}

/*
 * sppp_inner_ioctl()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer
 *
 * Description:
 *    Called by sppp_uwput as a result of receiving ioctls which require
 *    an exclusive access at the inner perimeter.
 */
static void
sppp_inner_ioctl(queue_t *q, mblk_t *mp)
{
	spppstr_t	*sps;
	sppa_t		*ppa;
	struct iocblk	*iop;
	mblk_t		*nmp;
	int		error = EINVAL;
	int		count = 0;
	int		dbgcmd;
	int		mru, mtu;
	uint32_t	ppa_id;
	hrtime_t	hrtime;
	uint16_t	proto;

	ASSERT(q != NULL && q->q_ptr != NULL);
	ASSERT(mp != NULL && mp->b_rptr != NULL);

	sps = (spppstr_t *)q->q_ptr;
	ppa = sps->sps_ppa;
	iop = (struct iocblk *)mp->b_rptr;
	switch (iop->ioc_cmd) {
	case DLIOCRAW:
		if (IS_SPS_CONTROL(sps)) {
			break;		/* return EINVAL */
		}
		sps->sps_flags |= SPS_RAWDATA;
		error = 0;		/* return success */
		break;
	case DL_IOC_HDR_INFO:
		if (IS_SPS_CONTROL(sps)) {
			break;		/* return EINVAL */
		} else if ((mp->b_cont == NULL) ||
		    *((t_uscalar_t *)mp->b_cont->b_rptr) != DL_UNITDATA_REQ ||
		    (MBLKL(mp->b_cont) < (sizeof (dl_unitdata_req_t) +
		    SPPP_ADDRL))) {
			error = EPROTO;
			break;
		} else if (ppa == NULL) {
			error = ENOLINK;
			break;
		}
		if ((nmp = allocb(PPP_HDRLEN, BPRI_MED)) == NULL) {
			mutex_enter(&ppa->ppa_sta_lock);
			ppa->ppa_allocbfail++;
			mutex_exit(&ppa->ppa_sta_lock);
			error = ENOMEM;
			break;
		}
		*(uchar_t *)nmp->b_wptr++ = PPP_ALLSTATIONS;
		*(uchar_t *)nmp->b_wptr++ = PPP_UI;
		*(uchar_t *)nmp->b_wptr++ = sps->sps_sap >> 8;
		*(uchar_t *)nmp->b_wptr++ = sps->sps_sap & 0xff;
		ASSERT(MBLKL(nmp) == PPP_HDRLEN);

		linkb(mp, nmp);
		sps->sps_flags |= SPS_FASTPATH;
		error = 0;		/* return success */
		count = msgsize(nmp);
		break;
	case PPPIO_ATTACH:
		if (IS_SPS_CONTROL(sps) || IS_SPS_PIOATTACH(sps) ||
		    (sps->sps_dlstate != DL_UNATTACHED) ||
		    (iop->ioc_count != sizeof (uint32_t))) {
			break;		/* return EINVAL */
		} else if (mp->b_cont == NULL) {
			error = EPROTO;
			break;
		}
		ASSERT(mp->b_cont->b_rptr != NULL);
		/* If there's something here, it's detached. */
		if (ppa != NULL) {
			sppp_remove_ppa(sps);
		}
		ppa_id = *(uint32_t *)mp->b_cont->b_rptr;
		ppa = sppp_find_ppa(ppa_id);
		/*
		 * If we can't find it, then it's either because the requestor
		 * has supplied a wrong ppa_id to be attached to, or because
		 * the control stream for the specified ppa_id has been closed
		 * before we get here.
		 */
		if (ppa == NULL) {
			error = ENOENT;
			break;
		}
		if (iop->ioc_cr == NULL ||
		    ppa->ppa_zoneid != crgetzoneid(iop->ioc_cr)) {
			error = EPERM;
			break;
		}
		/*
		 * Preallocate the hangup message so that we're always
		 * able to send this upstream in the event of a
		 * catastrophic failure.
		 */
		if ((sps->sps_hangup = allocb(1, BPRI_MED)) == NULL) {
			error = ENOSR;
			break;
		}
		/*
		 * There are two ways to attach a stream to a ppa: one is
		 * through DLPI (DL_ATTACH_REQ) and the other is through
		 * PPPIO_ATTACH. This is why we need to distinguish whether or
		 * not a stream was allocated via PPPIO_ATTACH, so that we can
		 * properly detach it when we receive PPPIO_DETACH ioctl
		 * request.
		 */
		sps->sps_flags |= SPS_PIOATTACH;
		sps->sps_ppa = ppa;
		/*
		 * Add this stream to the head of the list of sibling streams
		 * which belong to the same ppa as specified.
		 */
		rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
		ppa->ppa_refcnt++;
		sps->sps_nextsib = ppa->ppa_streams;
		ppa->ppa_streams = sps;
		rw_exit(&ppa->ppa_sib_lock);
		error = 0;		/* return success */
		break;
	case PPPIO_BLOCKNP:
	case PPPIO_UNBLOCKNP:
		if (iop->ioc_cr == NULL ||
		    secpolicy_ppp_config(iop->ioc_cr) != 0) {
			error = EPERM;
			break;
		}
		error = miocpullup(mp, sizeof (uint16_t));
		if (error != 0)
			break;
		ASSERT(mp->b_cont->b_rptr != NULL);
		proto = *(uint16_t *)mp->b_cont->b_rptr;
		if (iop->ioc_cmd == PPPIO_BLOCKNP) {
			uint32_t npflagpos = sppp_ppp2np(proto);
			/*
			 * Mark proto as blocked in ppa_npflag until the
			 * corresponding queues for proto have been plumbed.
			 */
			if (npflagpos != 0) {
				mutex_enter(&ppa->ppa_npmutex);
				ppa->ppa_npflag |= (1 << npflagpos);
				mutex_exit(&ppa->ppa_npmutex);
			} else {