xref: /illumos-gate/usr/src/uts/common/io/ppp/sppptun/sppptun.c (revision b1e2e3fb17324e9ddf43db264a0c64da7756d9e6)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <sys/types.h>
28 #include <sys/debug.h>
29 #include <sys/param.h>
30 #include <sys/stat.h>
31 #include <sys/systm.h>
32 #include <sys/socket.h>
33 #include <sys/stream.h>
34 #include <sys/stropts.h>
35 #include <sys/errno.h>
36 #include <sys/time.h>
37 #include <sys/cmn_err.h>
38 #include <sys/sdt.h>
39 #include <sys/conf.h>
40 #include <sys/dlpi.h>
41 #include <sys/ddi.h>
42 #include <sys/kstat.h>
43 #include <sys/strsun.h>
44 #include <sys/bitmap.h>
45 #include <sys/sysmacros.h>
46 #include <sys/note.h>
47 #include <sys/policy.h>
48 #include <net/ppp_defs.h>
49 #include <net/pppio.h>
50 #include <net/sppptun.h>
51 #include <net/pppoe.h>
52 #include <netinet/in.h>
53 
54 #include "s_common.h"
55 #include "sppptun_mod.h"
56 #include "sppptun_impl.h"
57 
58 #define	NTUN_INITIAL 16			/* Initial number of sppptun slots */
59 #define	NTUN_PERCENT 5			/* Percent of memory to use */
60 
61 /*
62  * This is used to tag official Solaris sources.  Please do not define
63  * "INTERNAL_BUILD" when building this software outside of Sun
64  * Microsystems.
65  */
66 #ifdef INTERNAL_BUILD
67 /* MODINFO is limited to 32 characters. */
68 const char sppptun_driver_description[] = "PPP 4.0 tunnel driver";
69 const char sppptun_module_description[] = "PPP 4.0 tunnel module";
70 #else
71 const char sppptun_driver_description[] = "ANU PPP tundrv";
72 const char sppptun_module_description[] = "ANU PPP tunmod";
73 
74 /* LINTED */
75 static const char buildtime[] = "Built " __DATE__ " at " __TIME__
76 #ifdef DEBUG
77 " DEBUG"
78 #endif
79 "\n";
80 #endif
81 
82 /*
83  * Tunable values; these are similar to the values used in ptms_conf.c.
84  * Override these settings via /etc/system.
85  */
86 uint_t	sppptun_cnt = 0;		/* Minimum number of tunnels */
87 size_t	sppptun_max_pty = 0;		/* Maximum number of tunnels */
88 uint_t	sppptun_init_cnt = NTUN_INITIAL; /* Initial number of tunnel slots */
89 uint_t	sppptun_pctofmem = NTUN_PERCENT; /* Percent of memory to use */
90 
91 typedef struct ether_dest_s {
92 	ether_addr_t addr;
93 	ushort_t type;
94 } ether_dest_t;
95 
96 /* Allows unaligned access. */
97 #define	GETLONG(x)	(((x)[0]<<24)|((x)[1]<<16)|((x)[2]<<8)|(x)[3])
98 
99 static const char *tll_kstats_list[] = { TLL_KSTATS_NAMES };
100 static const char *tcl_kstats_list[] = { TCL_KSTATS_NAMES };
101 
102 #define	KREF(p, m, vn)	p->m.vn.value.ui64
103 #define	KINCR(p, m, vn)	++KREF(p, m, vn)
104 #define	KDECR(p, m, vn)	--KREF(p, m, vn)
105 
106 #define	KLINCR(vn)	KINCR(tll, tll_kstats, vn)
107 #define	KLDECR(vn)	KDECR(tll, tll_kstats, vn)
108 
109 #define	KCINCR(vn)	KINCR(tcl, tcl_kstats, vn)
110 #define	KCDECR(vn)	KDECR(tcl, tcl_kstats, vn)
111 
112 static int	sppptun_open(queue_t *, dev_t *, int, int, cred_t *);
113 static int	sppptun_close(queue_t *, int, cred_t *);
114 static int	sppptun_urput(queue_t *, mblk_t *);
115 static int	sppptun_uwput(queue_t *, mblk_t *);
116 static int	sppptun_ursrv(queue_t *);
117 static int	sppptun_uwsrv(queue_t *);
118 static int	sppptun_lrput(queue_t *, mblk_t *);
119 static int	sppptun_lwput(queue_t *, mblk_t *);
120 
121 /*
122  * This is the hash table of clients.  Clients are the programs that
123  * open /dev/sppptun as a device.  There may be a large number of
124  * these; one per tunneled PPP session.
125  *
126  * Note: slots are offset from minor node value by 1 because
127  * vmem_alloc returns 0 for failure.
128  *
129  * The tcl_slots array entries are modified only when exclusive on
130  * both inner and outer perimeters.  This ensures that threads on
131  * shared perimeters always view this as unchanging memory with no
132  * need to lock around accesses.  (Specifically, the tcl_slots array
133  * is modified by entry to sppptun_open, sppptun_close, and _fini.)
134  */
135 static tuncl_t **tcl_slots = NULL;	/* Slots for tuncl_t */
136 static size_t tcl_nslots = 0;		/* Size of slot array */
137 static size_t tcl_minormax = 0;		/* Maximum number of tunnels */
138 static size_t tcl_inuse = 0;		/* # of tunnels currently allocated */
139 static krwlock_t tcl_rwlock;
140 static struct kmem_cache *tcl_cache = NULL;	/* tunnel cache */
141 static vmem_t *tcl_minor_arena = NULL; /* Arena for device minors */
142 
143 /*
144  * This is the simple list of lower layers.  For PPPoE, there is one
145  * of these per Ethernet interface.  Lower layers are established by
146  * "plumbing" -- using I_PLINK to connect the tunnel multiplexor to
147  * the physical interface.
148  */
149 static struct qelem tunll_list;
150 static int tunll_index;
151 
152 /* Test value; if all zeroes, then address hasn't been set yet. */
153 static const ether_addr_t zero_mac_addr = { 0, 0, 0, 0, 0, 0 };
154 
155 #define	MIN_SET_FASTPATH_UNITDATAREQ_SIZE	\
156 	(sizeof (dl_unitdata_req_t) + 4)
157 
158 #define	TUN_MI_ID	2104	/* officially allocated module ID */
159 #define	TUN_MI_MINPSZ	(0)
160 #define	TUN_MI_MAXPSZ	(PPP_MAXMTU)
161 #define	TUN_MI_HIWAT	(PPP_MTU * 8)
162 #define	TUN_MI_LOWAT	(128)
163 
164 static struct module_info sppptun_modinfo = {
165 	TUN_MI_ID,		/* mi_idnum */
166 	PPP_TUN_NAME,		/* mi_idname */
167 	TUN_MI_MINPSZ,		/* mi_minpsz */
168 	TUN_MI_MAXPSZ,		/* mi_maxpsz */
169 	TUN_MI_HIWAT,		/* mi_hiwat */
170 	TUN_MI_LOWAT		/* mi_lowat */
171 };
172 
173 static struct qinit sppptun_urinit = {
174 	sppptun_urput,		/* qi_putp */
175 	sppptun_ursrv,		/* qi_srvp */
176 	sppptun_open,		/* qi_qopen */
177 	sppptun_close,		/* qi_qclose */
178 	NULL,			/* qi_qadmin */
179 	&sppptun_modinfo,	/* qi_minfo */
180 	NULL			/* qi_mstat */
181 };
182 
183 static struct qinit sppptun_uwinit = {
184 	(int (*)())sppptun_uwput, /* qi_putp */
185 	sppptun_uwsrv,		/* qi_srvp */
186 	NULL,			/* qi_qopen */
187 	NULL,			/* qi_qclose */
188 	NULL,			/* qi_qadmin */
189 	&sppptun_modinfo,	/* qi_minfo */
190 	NULL			/* qi_mstat */
191 };
192 
193 static struct qinit sppptun_lrinit = {
194 	(int (*)())sppptun_lrput, /* qi_putp */
195 	NULL,			/* qi_srvp */
196 	NULL,			/* qi_qopen */
197 	NULL,			/* qi_qclose */
198 	NULL,			/* qi_qadmin */
199 	&sppptun_modinfo,	/* qi_minfo */
200 	NULL			/* qi_mstat */
201 };
202 
203 static struct qinit sppptun_lwinit = {
204 	(int (*)())sppptun_lwput, /* qi_putp */
205 	NULL,			/* qi_srvp */
206 	NULL,			/* qi_qopen */
207 	NULL,			/* qi_qclose */
208 	NULL,			/* qi_qadmin */
209 	&sppptun_modinfo,	/* qi_minfo */
210 	NULL			/* qi_mstat */
211 };
212 
213 /*
214  * This is referenced in sppptun_mod.c.
215  */
216 struct streamtab sppptun_tab = {
217 	&sppptun_urinit,	/* st_rdinit */
218 	&sppptun_uwinit,	/* st_wrinit */
219 	&sppptun_lrinit,	/* st_muxrinit */
220 	&sppptun_lwinit		/* st_muxwrinit */
221 };
222 
223 /*
224  * Allocate another slot table twice as large as the original one
225  * (limited to global maximum).  Migrate all tunnels to the new slot
226  * table and free the original one.  Assumes we're exclusive on both
227  * inner and outer perimeters, and thus there are no other users of
228  * the tcl_slots array.
229  */
230 static minor_t
231 tcl_grow(void)
232 {
233 	minor_t old_size = tcl_nslots;
234 	minor_t new_size = 2 * old_size;
235 	tuncl_t **tcl_old = tcl_slots;
236 	tuncl_t **tcl_new;
237 	void  *vaddr;			/* vmem_add return value */
238 
239 	ASSERT(RW_LOCK_HELD(&tcl_rwlock));
240 
241 	/* Allocate new ptms array */
242 	tcl_new = kmem_zalloc(new_size * sizeof (tuncl_t *), KM_NOSLEEP);
243 	if (tcl_new == NULL)
244 		return ((minor_t)0);
245 
246 	/* Increase clone index space */
247 	vaddr = vmem_add(tcl_minor_arena, (void*)((uintptr_t)old_size + 1),
248 	    new_size - old_size, VM_NOSLEEP);
249 
250 	if (vaddr == NULL) {
251 		kmem_free(tcl_new, new_size * sizeof (tuncl_t *));
252 		return ((minor_t)0);
253 	}
254 
255 	/* Migrate tuncl_t entries to a new location */
256 	tcl_nslots = new_size;
257 	bcopy(tcl_old, tcl_new, old_size * sizeof (tuncl_t *));
258 	tcl_slots = tcl_new;
259 	kmem_free(tcl_old, old_size * sizeof (tuncl_t *));
260 
261 	/* Allocate minor number and return it */
262 	return ((minor_t)(uintptr_t)vmem_alloc(tcl_minor_arena, 1, VM_NOSLEEP));
263 }
264 
265 /*
266  * Allocate new minor number and tunnel client entry.  Returns the new
267  * entry or NULL if no memory or maximum number of entries reached.
268  * Assumes we're exclusive on both inner and outer perimeters, and
269  * thus there are no other users of the tcl_slots array.
270  */
271 static tuncl_t *
272 tuncl_alloc(int wantminor)
273 {
274 	minor_t dminor;
275 	tuncl_t *tcl = NULL;
276 
277 	rw_enter(&tcl_rwlock, RW_WRITER);
278 
279 	ASSERT(tcl_slots != NULL);
280 
281 	/*
282 	 * Always try to allocate new pty when sppptun_cnt minimum
283 	 * limit is not achieved. If it is achieved, the maximum is
284 	 * determined by either user-specified value (if it is
285 	 * non-zero) or our memory estimations - whatever is less.
286 	 */
287 	if (tcl_inuse >= sppptun_cnt) {
288 		/*
289 		 * When system achieved required minimum of tunnels,
290 		 * check for the denial of service limits.
291 		 *
292 		 * Get user-imposed maximum, if configured, or
293 		 * calculated memory constraint.
294 		 */
295 		size_t user_max = (sppptun_max_pty == 0 ? tcl_minormax :
296 		    min(sppptun_max_pty, tcl_minormax));
297 
298 		/* Do not try to allocate more than allowed */
299 		if (tcl_inuse >= user_max) {
300 			rw_exit(&tcl_rwlock);
301 			return (NULL);
302 		}
303 	}
304 	tcl_inuse++;
305 
306 	/*
307 	 * Allocate new minor number. If this fails, all slots are
308 	 * busy and we need to grow the hash.
309 	 */
310 	if (wantminor <= 0) {
311 		dminor = (minor_t)(uintptr_t)vmem_alloc(tcl_minor_arena, 1,
312 		    VM_NOSLEEP);
313 		if (dminor == 0) {
314 			/* Grow the cache and retry allocation */
315 			dminor = tcl_grow();
316 		}
317 	} else {
318 		dminor = (minor_t)(uintptr_t)vmem_xalloc(tcl_minor_arena, 1,
319 		    0, 0, 0, (void *)(uintptr_t)wantminor,
320 		    (void *)((uintptr_t)wantminor+1), VM_NOSLEEP);
321 		if (dminor != 0 && dminor != wantminor) {
322 			vmem_free(tcl_minor_arena, (void *)(uintptr_t)dminor,
323 			    1);
324 			dminor = 0;
325 		}
326 	}
327 
328 	if (dminor == 0) {
329 		/* Not enough memory now */
330 		tcl_inuse--;
331 		rw_exit(&tcl_rwlock);
332 		return (NULL);
333 	}
334 
335 	tcl = kmem_cache_alloc(tcl_cache, KM_NOSLEEP);
336 	if (tcl == NULL) {
337 		/* Not enough memory - this entry can't be used now. */
338 		vmem_free(tcl_minor_arena, (void *)(uintptr_t)dminor, 1);
339 		tcl_inuse--;
340 	} else {
341 		bzero(tcl, sizeof (*tcl));
342 		tcl->tcl_lsessid = dminor;
343 		ASSERT(tcl_slots[dminor - 1] == NULL);
344 		tcl_slots[dminor - 1] = tcl;
345 	}
346 
347 	rw_exit(&tcl_rwlock);
348 	return (tcl);
349 }
350 
351 /*
352  * This routine frees an upper level (client) stream by removing it
353  * from the minor number pool and freeing the state structure storage.
354  * Assumes we're exclusive on both inner and outer perimeters, and
355  * thus there are no other concurrent users of the tcl_slots array or
356  * of any entry in that array.
357  */
358 static void
359 tuncl_free(tuncl_t *tcl)
360 {
361 	rw_enter(&tcl_rwlock, RW_WRITER);
362 	ASSERT(tcl->tcl_lsessid <= tcl_nslots);
363 	ASSERT(tcl_slots[tcl->tcl_lsessid - 1] == tcl);
364 	ASSERT(tcl_inuse > 0);
365 	tcl_inuse--;
366 	tcl_slots[tcl->tcl_lsessid - 1] = NULL;
367 
368 	if (tcl->tcl_ksp != NULL) {
369 		kstat_delete(tcl->tcl_ksp);
370 		tcl->tcl_ksp = NULL;
371 	}
372 
373 	/* Return minor number to the pool of minors */
374 	vmem_free(tcl_minor_arena, (void *)(uintptr_t)tcl->tcl_lsessid, 1);
375 
376 	/* Return tuncl_t to the cache */
377 	kmem_cache_free(tcl_cache, tcl);
378 	rw_exit(&tcl_rwlock);
379 }
380 
381 /*
382  * Get tuncl_t structure by minor number.  Returns NULL when minor is
383  * out of range.  Note that lookup of tcl pointers (and use of those
384  * pointers) is safe because modification is done only when exclusive
385  * on both inner and outer perimeters.
386  */
387 static tuncl_t *
388 tcl_by_minor(minor_t dminor)
389 {
390 	tuncl_t *tcl = NULL;
391 
392 	if ((dminor >= 1) && (dminor <= tcl_nslots) && tcl_slots != NULL) {
393 		tcl = tcl_slots[dminor - 1];
394 	}
395 
396 	return (tcl);
397 }
398 
399 /*
400  * Set up kstats for upper or lower stream.
401  */
402 static kstat_t *
403 kstat_setup(kstat_named_t *knt, const char **names, int nstat,
404     const char *modname, int unitnum)
405 {
406 	kstat_t *ksp;
407 	char unitname[KSTAT_STRLEN];
408 	int i;
409 
410 	for (i = 0; i < nstat; i++) {
411 		kstat_set_string(knt[i].name, names[i]);
412 		knt[i].data_type = KSTAT_DATA_UINT64;
413 	}
414 	(void) sprintf(unitname, "%s" "%d", modname, unitnum);
415 	ksp = kstat_create(modname, unitnum, unitname, "net",
416 	    KSTAT_TYPE_NAMED, nstat, KSTAT_FLAG_VIRTUAL);
417 	if (ksp != NULL) {
418 		ksp->ks_data = (void *)knt;
419 		kstat_install(ksp);
420 	}
421 	return (ksp);
422 }
423 
424 /*
425  * sppptun_open()
426  *
427  * MT-Perimeters:
428  *    exclusive inner, exclusive outer.
429  *
430  * Description:
431  *    Common open procedure for module and driver.
432  */
433 static int
434 sppptun_open(queue_t *q, dev_t *devp, int oflag, int sflag, cred_t *credp)
435 {
436 	_NOTE(ARGUNUSED(oflag))
437 
438 	/* Allow a re-open */
439 	if (q->q_ptr != NULL)
440 		return (0);
441 
442 	/* In the off chance that we're on our way out, just return error */
443 	if (tcl_slots == NULL)
444 		return (EINVAL);
445 
446 	if (sflag & MODOPEN) {
447 		tunll_t *tll;
448 		char *cp;
449 
450 		/* ordinary users have no need to push this module */
451 		if (secpolicy_ppp_config(credp) != 0)
452 			return (EPERM);
453 
454 		tll = kmem_zalloc(sizeof (tunll_t), KM_SLEEP);
455 
456 		tll->tll_index = tunll_index++;
457 
458 		tll->tll_wq = WR(q);
459 		tll->tll_zoneid = crgetzoneid(credp);
460 
461 		/* Insert at end of list */
462 		insque(&tll->tll_next, tunll_list.q_back);
463 		q->q_ptr = WR(q)->q_ptr = tll;
464 
465 		tll->tll_style = PTS_PPPOE;
466 		tll->tll_alen = sizeof (tll->tll_lcladdr.pta_pppoe);
467 
468 		tll->tll_ksp = kstat_setup((kstat_named_t *)&tll->tll_kstats,
469 		    tll_kstats_list, Dim(tll_kstats_list), "tll",
470 		    tll->tll_index);
471 
472 		/*
473 		 * Find the name of the driver somewhere beneath us.
474 		 * Note that we have no driver under us until after
475 		 * qprocson().
476 		 */
477 		qprocson(q);
478 		for (q = WR(q); q->q_next != NULL; q = q->q_next)
479 			;
480 		cp = NULL;
481 		if (q->q_qinfo != NULL && q->q_qinfo->qi_minfo != NULL)
482 			cp = q->q_qinfo->qi_minfo->mi_idname;
483 		if (cp != NULL && *cp == '\0')
484 			cp = NULL;
485 
486 		/* Set initial name; user should overwrite. */
487 		if (cp == NULL)
488 			(void) snprintf(tll->tll_name, sizeof (tll->tll_name),
489 			    PPP_TUN_NAME "%d", tll->tll_index);
490 		else
491 			(void) snprintf(tll->tll_name, sizeof (tll->tll_name),
492 			    "%s:tun%d", cp, tll->tll_index);
493 	} else {
494 		tuncl_t	*tcl;
495 
496 		ASSERT(devp != NULL);
497 		if (sflag & CLONEOPEN) {
498 			tcl = tuncl_alloc(-1);
499 		} else {
500 			minor_t mn;
501 
502 			/*
503 			 * Support of non-clone open (ie, mknod with
504 			 * defined minor number) is supported for
505 			 * testing purposes so that 'arbitrary' minor
506 			 * numbers can be used.
507 			 */
508 			mn = getminor(*devp);
509 			if (mn == 0 || (tcl = tcl_by_minor(mn)) != NULL) {
510 				return (EPERM);
511 			}
512 			tcl = tuncl_alloc(mn);
513 		}
514 		if (tcl == NULL)
515 			return (ENOSR);
516 		tcl->tcl_rq = q;		/* save read queue pointer */
517 		tcl->tcl_flags |= TCLF_ISCLIENT;	/* sanity check */
518 		tcl->tcl_zoneid = crgetzoneid(credp);
519 
520 		q->q_ptr = WR(q)->q_ptr = (caddr_t)tcl;
521 		*devp = makedevice(getmajor(*devp), tcl->tcl_lsessid);
522 
523 		tcl->tcl_ksp = kstat_setup((kstat_named_t *)&tcl->tcl_kstats,
524 		    tcl_kstats_list, Dim(tcl_kstats_list), "tcl",
525 		    tcl->tcl_lsessid);
526 
527 		qprocson(q);
528 	}
529 	return (0);
530 }
531 
532 /*
533  * Create an appropriate control message for this client event.
534  */
535 static mblk_t *
536 make_control(tuncl_t *tclabout, tunll_t *tllabout, int action, tuncl_t *tclto)
537 {
538 	struct ppptun_control *ptc;
539 	mblk_t *mp = allocb(sizeof (*ptc), BPRI_HI);
540 
541 	if (mp != NULL) {
542 		MTYPE(mp) = M_PROTO;
543 		ptc = (struct ppptun_control *)mp->b_wptr;
544 		bzero(ptc, sizeof (*ptc));
545 		mp->b_wptr += sizeof (*ptc);
546 		if (tclabout != NULL) {
547 			ptc->ptc_rsessid = tclabout->tcl_rsessid;
548 			ptc->ptc_address = tclabout->tcl_address;
549 		}
550 		ptc->ptc_discrim = tclto->tcl_ctlval;
551 		ptc->ptc_action = action;
552 		if (tllabout != NULL) {
553 			(void) strncpy(ptc->ptc_name, tllabout->tll_name,
554 			    sizeof (ptc->ptc_name));
555 		}
556 	}
557 	return (mp);
558 }
559 
560 /*
561  * Send an appropriate control message up this client session.
562  */
563 static void
564 send_control(tuncl_t *tclabout, tunll_t *tllabout, int action, tuncl_t *tcl)
565 {
566 	mblk_t *mp;
567 
568 	if (tcl->tcl_rq != NULL) {
569 		mp = make_control(tclabout, tllabout, action, tcl);
570 		if (mp != NULL) {
571 			KCINCR(cks_octrl_spec);
572 			putnext(tcl->tcl_rq, mp);
573 		}
574 	}
575 }
576 
577 /*
578  * If a lower stream is being unplumbed, then the upper streams
579  * connected to this lower stream must be disconnected.  This routine
580  * accomplishes this by sending M_HANGUP to data streams and M_PROTO
581  * messages to control streams.  This is called by vmem_walk, and
582  * handles a span of minor node numbers.
583  *
584  * No need to update lks_clients here; the lower stream is on its way
585  * out.
586  */
587 static void
588 tclvm_remove_tll(void *arg, void *firstv, size_t numv)
589 {
590 	tunll_t *tll = (tunll_t *)arg;
591 	int minorn = (int)(uintptr_t)firstv;
592 	int minormax = minorn + numv;
593 	tuncl_t *tcl;
594 	mblk_t *mp;
595 
596 	while (minorn < minormax) {
597 		tcl = tcl_slots[minorn - 1];
598 		ASSERT(tcl != NULL);
599 		if (tcl->tcl_data_tll == tll && tcl->tcl_rq != NULL) {
600 			tcl->tcl_data_tll = NULL;
601 			mp = allocb(0, BPRI_HI);
602 			if (mp != NULL) {
603 				MTYPE(mp) = M_HANGUP;
604 				putnext(tcl->tcl_rq, mp);
605 				if (tcl->tcl_ctrl_tll == tll)
606 					tcl->tcl_ctrl_tll = NULL;
607 			}
608 		}
609 		if (tcl->tcl_ctrl_tll == tll) {
610 			send_control(tcl, tll, PTCA_UNPLUMB, tcl);
611 			tcl->tcl_ctrl_tll = NULL;
612 		}
613 		minorn++;
614 	}
615 }
616 
617 /*
618  * sppptun_close()
619  *
620  * MT-Perimeters:
621  *    exclusive inner, exclusive outer.
622  *
623  * Description:
624  *    Common close procedure for module and driver.
625  */
626 /* ARGSUSED */
627 static int
628 sppptun_close(queue_t *q, int flags __unused, cred_t *credp __unused)
629 {
630 	int err;
631 	void *qptr;
632 	tunll_t *tll;
633 	tuncl_t *tcl;
634 
635 	qptr = q->q_ptr;
636 
637 	err = 0;
638 	tll = qptr;
639 	if (!(tll->tll_flags & TLLF_NOTLOWER)) {
640 		/* q_next is set on modules */
641 		ASSERT(WR(q)->q_next != NULL);
642 
643 		/* unlink any clients using this lower layer. */
644 		vmem_walk(tcl_minor_arena, VMEM_ALLOC, tclvm_remove_tll, tll);
645 
646 		/* tell daemon that this has been removed. */
647 		if ((tcl = tll->tll_defcl) != NULL)
648 			send_control(NULL, tll, PTCA_UNPLUMB, tcl);
649 
650 		tll->tll_flags |= TLLF_CLOSING;
651 		while (!(tll->tll_flags & TLLF_CLOSE_DONE)) {
652 			qenable(tll->tll_wq);
653 			qwait(tll->tll_wq);
654 		}
655 		tll->tll_error = 0;
656 		while (!(tll->tll_flags & TLLF_SHUTDOWN_DONE)) {
657 			if (!qwait_sig(tll->tll_wq))
658 				break;
659 		}
660 
661 		qprocsoff(q);
662 		q->q_ptr = WR(q)->q_ptr = NULL;
663 		tll->tll_wq = NULL;
664 		remque(&tll->tll_next);
665 		err = tll->tll_error;
666 		if (tll->tll_ksp != NULL)
667 			kstat_delete(tll->tll_ksp);
668 		kmem_free(tll, sizeof (*tll));
669 	} else {
670 		tcl = qptr;
671 
672 		/* devices are end of line; no q_next. */
673 		ASSERT(WR(q)->q_next == NULL);
674 
675 		qprocsoff(q);
676 		DTRACE_PROBE1(sppptun__client__close, tuncl_t *, tcl);
677 		tcl->tcl_rq = NULL;
678 		q->q_ptr = WR(q)->q_ptr = NULL;
679 
680 		tll = TO_TLL(tunll_list.q_forw);
681 		while (tll != TO_TLL(&tunll_list)) {
682 			if (tll->tll_defcl == tcl)
683 				tll->tll_defcl = NULL;
684 			if (tll->tll_lastcl == tcl)
685 				tll->tll_lastcl = NULL;
686 			tll = TO_TLL(tll->tll_next);
687 		}
688 		/*
689 		 * If this was a normal session, then tell the daemon.
690 		 */
691 		if (!(tcl->tcl_flags & TCLF_DAEMON) &&
692 		    (tll = tcl->tcl_ctrl_tll) != NULL &&
693 		    tll->tll_defcl != NULL) {
694 			send_control(tcl, tll, PTCA_DISCONNECT,
695 			    tll->tll_defcl);
696 		}
697 
698 		/* Update statistics for references being dropped. */
699 		if ((tll = tcl->tcl_data_tll) != NULL) {
700 			KLDECR(lks_clients);
701 		}
702 		if ((tll = tcl->tcl_ctrl_tll) != NULL) {
703 			KLDECR(lks_clients);
704 		}
705 
706 		tuncl_free(tcl);
707 	}
708 
709 	return (err);
710 }
711 
712 /*
713  * Allocate and initialize a DLPI or TPI template of the specified
714  * length.
715  */
716 static mblk_t *
717 pi_alloc(size_t len, int prim)
718 {
719 	mblk_t	*mp;
720 
721 	mp = allocb(len, BPRI_MED);
722 	if (mp != NULL) {
723 		MTYPE(mp) = M_PROTO;
724 		mp->b_wptr = mp->b_rptr + len;
725 		bzero(mp->b_rptr, len);
726 		*(int *)mp->b_rptr = prim;
727 	}
728 	return (mp);
729 }
730 
731 #define	dlpi_alloc(l, p)	pi_alloc((l), (p))
732 
733 /*
734  * Prepend some room to an mblk.  Try to reuse the existing buffer, if
735  * at all possible, rather than allocating a new one.  (Fast-path
736  * output should be able to use this.)
737  *
738  * (XXX why isn't this a library function ...?)
739  */
740 static mblk_t *
741 prependb(mblk_t *mp, size_t len, size_t align)
742 {
743 	mblk_t *newmp;
744 
745 
746 	if (align == 0)
747 		align = 8;
748 	if (DB_REF(mp) > 1 || mp->b_datap->db_base+len > mp->b_rptr ||
749 	    ((uint_t)((uintptr_t)mp->b_rptr - len) % align) != 0) {
750 		if ((newmp = allocb(len, BPRI_LO)) == NULL) {
751 			freemsg(mp);
752 			return (NULL);
753 		}
754 		newmp->b_wptr = newmp->b_rptr + len;
755 		newmp->b_cont = mp;
756 		return (newmp);
757 	}
758 	mp->b_rptr -= len;
759 	return (mp);
760 }
761 
762 /*
763  * sppptun_outpkt()
764  *
765  * MT-Perimeters:
766  *	shared inner, shared outer (if called from sppptun_uwput),
767  *	exclusive inner, shared outer (if called from sppptun_uwsrv).
768  *
769  * Description:
770  *    Called from sppptun_uwput or sppptun_uwsrv when processing a
771  *    M_DATA, M_PROTO, or M_PCPROTO message.  For all cases, it tries
772  *    to prepare the data to be sent to the module below this driver
773  *    if there is a lower stream linked underneath.  If no lower
774  *    stream exists, then the data will be discarded and an ENXIO
775  *    error returned.
776  *
777  * Returns:
778  *	pointer to queue if caller should do putnext, otherwise
779  *	*mpp != NULL if message should be enqueued, otherwise
780  *	*mpp == NULL if message is gone.
781  */
782 static queue_t *
783 sppptun_outpkt(queue_t *q, mblk_t **mpp)
784 {
785 	mblk_t *mp;
786 	tuncl_t *tcl;
787 	tunll_t *tll;
788 	mblk_t *encmb;
789 	mblk_t *datamb;
790 	dl_unitdata_req_t *dur;
791 	queue_t *lowerq;
792 	poep_t *poep;
793 	int len;
794 	ether_dest_t *edestp;
795 	enum { luNone, luCopy, luSend } loopup;
796 	boolean_t isdata;
797 	struct ppptun_control *ptc;
798 
799 	mp = *mpp;
800 	tcl = q->q_ptr;
801 
802 	*mpp = NULL;
803 	if (!(tcl->tcl_flags & TCLF_ISCLIENT)) {
804 		/* This should never happen on a lower layer stream */
805 		freemsg(mp);
806 		return (NULL);
807 	}
808 
809 	isdata = (MTYPE(mp) == M_DATA);
810 	if (isdata) {
811 		tll = tcl->tcl_data_tll;
812 		ptc = NULL;
813 	} else {
814 		/*
815 		 * If data are unaligned or otherwise unsuitable, then
816 		 * discard.
817 		 */
818 		if (MBLKL(mp) != sizeof (*ptc) || DB_REF(mp) > 1 ||
819 		    !IS_P2ALIGNED(mp->b_rptr, sizeof (ptc))) {
820 			KCINCR(cks_octrl_drop);
821 			DTRACE_PROBE2(sppptun__bad__control, tuncl_t *, tcl,
822 			    mblk_t *, mp);
823 			send_control(tcl, tcl->tcl_ctrl_tll, PTCA_BADCTRL, tcl);
824 			freemsg(mp);
825 			return (NULL);
826 		}
827 		ptc = (struct ppptun_control *)mp->b_rptr;
828 
829 		/* Set stream discriminator value if not yet set. */
830 		if (tcl->tcl_ctlval == 0)
831 			tcl->tcl_ctlval = ptc->ptc_discrim;
832 
833 		/* If this is a test message, then reply to caller. */
834 		if (ptc->ptc_action == PTCA_TEST) {
835 			DTRACE_PROBE2(sppptun__test, tuncl_t *, tcl,
836 			    struct ppptun_control *, ptc);
837 			if (mp->b_cont != NULL) {
838 				freemsg(mp->b_cont);
839 				mp->b_cont = NULL;
840 			}
841 			ptc->ptc_discrim = tcl->tcl_ctlval;
842 			putnext(RD(q), mp);
843 			return (NULL);
844 		}
845 
846 		/* If this one isn't for us, then discard it */
847 		if (tcl->tcl_ctlval != ptc->ptc_discrim) {
848 			DTRACE_PROBE2(sppptun__bad__discrim, tuncl_t *, tcl,
849 			    struct ppptun_control *, ptc);
850 			freemsg(mp);
851 			return (NULL);
852 		}
853 
854 		/* Don't allow empty control packets. */
855 		tll = tcl->tcl_ctrl_tll;
856 		if (mp->b_cont == NULL) {
857 			KCINCR(cks_octrl_drop);
858 			DTRACE_PROBE2(sppptun__bad__control, tuncl_t *, tcl,
859 			    mblk_t *, mp);
860 			send_control(tcl, tll, PTCA_BADCTRL, tcl);
861 			freemsg(mp);
862 			return (NULL);
863 		}
864 	}
865 
866 	if (tll == NULL || (lowerq = tll->tll_wq) == NULL) {
867 		DTRACE_PROBE3(sppptun__cannot__send, tuncl_t *, tcl,
868 		    tunll_t *, tll, mblk_t *, mp);
869 		send_control(tcl, tll, PTCA_UNPLUMB, tcl);
870 		freemsg(mp);
871 		if (isdata) {
872 			tcl->tcl_stats.ppp_oerrors++;
873 		} else {
874 			KCINCR(cks_octrl_drop);
875 		}
876 		return (NULL);
877 	}
878 
879 	/*
880 	 * If so, then try to send it down.  The lower queue is only
881 	 * ever detached while holding an exclusive lock on the whole
882 	 * driver, so we can be confident that the lower queue is
883 	 * still there.
884 	 */
885 	if (!bcanputnext(lowerq, mp->b_band)) {
886 		DTRACE_PROBE3(sppptun__flow__control, tuncl_t *, tcl,
887 		    tunll_t *, tll, mblk_t *, mp);
888 		*mpp = mp;
889 		return (NULL);
890 	}
891 
892 	/*
893 	 * Note: DLPI and TPI expect that the first buffer contains
894 	 * the control (unitdata-req) header, destination address, and
895 	 * nothing else.  Any protocol headers must go in the next
896 	 * buffer.
897 	 */
898 	loopup = luNone;
899 	encmb = NULL;
900 	if (isdata) {
901 		if (tll->tll_alen != 0 &&
902 		    bcmp(&tcl->tcl_address, &tll->tll_lcladdr,
903 		    tll->tll_alen) == 0)
904 			loopup = luSend;
905 		switch (tll->tll_style) {
906 		case PTS_PPPOE:
907 			/* Strip address and control fields if present. */
908 			if (mp->b_rptr[0] == 0xFF) {
909 				if (MBLKL(mp) < 3) {
910 					encmb = msgpullup(mp, 3);
911 					freemsg(mp);
912 					if ((mp = encmb) == NULL)
913 						break;
914 				}
915 				mp->b_rptr += 2;
916 			}
917 			/* Broadcasting data is probably not a good idea. */
918 			if (tcl->tcl_address.pta_pppoe.ptma_mac[0] & 1)
919 				break;
920 			encmb = dlpi_alloc(sizeof (*dur) + sizeof (*edestp),
921 			    DL_UNITDATA_REQ);
922 			if (encmb == NULL)
923 				break;
924 
925 			dur = (dl_unitdata_req_t *)encmb->b_rptr;
926 			dur->dl_dest_addr_length = sizeof (*edestp);
927 			dur->dl_dest_addr_offset = sizeof (*dur);
928 			edestp = (ether_dest_t *)(dur + 1);
929 			ether_copy(tcl->tcl_address.pta_pppoe.ptma_mac,
930 			    edestp->addr);
931 			/* DLPI SAPs are in host byte order! */
932 			edestp->type = tll->tll_sap;
933 
934 			/* Make sure the protocol field isn't compressed. */
935 			len = (*mp->b_rptr & 1);
936 			mp = prependb(mp, sizeof (*poep) + len, POE_HDR_ALIGN);
937 			if (mp == NULL)
938 				break;
939 			poep = (poep_t *)mp->b_rptr;
940 			poep->poep_version_type = POE_VERSION;
941 			poep->poep_code = POECODE_DATA;
942 			poep->poep_session_id = htons(tcl->tcl_rsessid);
943 			poep->poep_length = htons(msgsize(mp) -
944 			    sizeof (*poep));
945 			if (len > 0)
946 				*(char *)(poep + 1) = '\0';
947 			break;
948 
949 		default:
950 			ASSERT(0);
951 		}
952 	} else {
953 		/*
954 		 * Control side encapsulation.
955 		 */
956 		if (bcmp(&ptc->ptc_address, &tll->tll_lcladdr, tll->tll_alen)
957 		    == 0)
958 			loopup = luSend;
959 		datamb = mp->b_cont;
960 		switch (tll->tll_style) {
961 		case PTS_PPPOE:
962 			/*
963 			 * Don't allow a loopback session to establish
964 			 * itself.  PPPoE is broken; it uses only one
965 			 * session ID for both data directions, so the
966 			 * loopback data path can simply never work.
967 			 */
968 			if (loopup == luSend &&
969 			    ((poep_t *)datamb->b_rptr)->poep_code ==
970 			    POECODE_PADR)
971 				break;
972 			encmb = dlpi_alloc(sizeof (*dur) + sizeof (*edestp),
973 			    DL_UNITDATA_REQ);
974 			if (encmb == NULL)
975 				break;
976 			dur = (dl_unitdata_req_t *)encmb->b_rptr;
977 			dur->dl_dest_addr_length = sizeof (*edestp);
978 			dur->dl_dest_addr_offset = sizeof (*dur);
979 
980 			edestp = (ether_dest_t *)(dur + 1);
981 			/* DLPI SAPs are in host byte order! */
982 			edestp->type = tll->tll_sap;
983 
984 			/*
985 			 * If destination isn't set yet, then we have to
986 			 * allow anything at all.  Otherwise, force use
987 			 * of configured peer address.
988 			 */
989 			if (bcmp(tcl->tcl_address.pta_pppoe.ptma_mac,
990 			    zero_mac_addr, sizeof (zero_mac_addr)) == 0 ||
991 			    (tcl->tcl_flags & TCLF_DAEMON)) {
992 				ether_copy(ptc->ptc_address.pta_pppoe.ptma_mac,
993 				    edestp->addr);
994 			} else {
995 				ether_copy(tcl->tcl_address.pta_pppoe.ptma_mac,
996 				    edestp->addr);
997 			}
998 			/* Reflect multicast/broadcast back up. */
999 			if (edestp->addr[0] & 1)
1000 				loopup = luCopy;
1001 			break;
1002 
1003 		case PTS_PPTP:
1004 			/*
1005 			 * PPTP's control side is actually done over
1006 			 * separate TCP connections.
1007 			 */
1008 		default:
1009 			ASSERT(0);
1010 		}
1011 		freeb(mp);
1012 		mp = datamb;
1013 	}
1014 	if (mp == NULL || encmb == NULL) {
1015 		DTRACE_PROBE1(sppptun__output__failure, tuncl_t *, tcl);
1016 		freemsg(mp);
1017 		freemsg(encmb);
1018 		if (isdata) {
1019 			tcl->tcl_stats.ppp_oerrors++;
1020 		} else {
1021 			KCINCR(cks_octrl_drop);
1022 			KLINCR(lks_octrl_drop);
1023 		}
1024 		lowerq = NULL;
1025 	} else {
1026 		if (isdata) {
1027 			tcl->tcl_stats.ppp_obytes += msgsize(mp);
1028 			tcl->tcl_stats.ppp_opackets++;
1029 		} else {
1030 			KCINCR(cks_octrls);
1031 			KLINCR(lks_octrls);
1032 		}
1033 		if (encmb != mp)
1034 			encmb->b_cont = mp;
1035 		switch (loopup) {
1036 		case luNone:
1037 			*mpp = encmb;
1038 			break;
1039 		case luCopy:
1040 			mp = copymsg(encmb);
1041 			if (mp != NULL)
1042 				(void) sppptun_urput(RD(lowerq), mp);
1043 			*mpp = encmb;
1044 			break;
1045 		case luSend:
1046 			(void) sppptun_urput(RD(lowerq), encmb);
1047 			lowerq = NULL;
1048 			break;
1049 		}
1050 	}
1051 	return (lowerq);
1052 }
1053 
1054 /*
1055  * Enqueue a message to be sent when the lower stream is closed.  This
1056  * is done so that we're guaranteed that we always have the necessary
1057  * resources to properly detach ourselves from the system.  (If we
1058  * waited until the close was done to allocate these messages, then
1059  * the message allocation could fail, and we'd be unable to properly
1060  * detach.)
1061  */
1062 static void
1063 save_for_close(tunll_t *tll, mblk_t *mp)
1064 {
1065 	mblk_t *onc;
1066 
1067 	if ((onc = tll->tll_onclose) == NULL)
1068 		tll->tll_onclose = mp;
1069 	else {
1070 		while (onc->b_next != NULL)
1071 			onc = onc->b_next;
1072 		onc->b_next = mp;
1073 	}
1074 }
1075 
1076 /*
1077  * Given the lower stream name, locate the state structure.  Note that
1078  * lookup of tcl pointers (and use of those pointers) is safe because
1079  * modification is done only when exclusive on both inner and outer
1080  * perimeters.
1081  */
1082 static tunll_t *
1083 tll_lookup_on_name(const char *dname, zoneid_t zoneid)
1084 {
1085 	tunll_t *tll;
1086 
1087 	tll = TO_TLL(tunll_list.q_forw);
1088 	for (; tll != TO_TLL(&tunll_list); tll = TO_TLL(tll->tll_next))
1089 		if (tll->tll_zoneid == zoneid &&
1090 		    strcmp(dname, tll->tll_name) == 0)
1091 			return (tll);
1092 	return (NULL);
1093 }
1094 
1095 /*
1096  * sppptun_inner_ioctl()
1097  *
1098  * MT-Perimeters:
1099  *    exclusive inner, shared outer.
1100  *
1101  * Description:
1102  *    Called by qwriter from sppptun_ioctl as the result of receiving
1103  *    a handled ioctl.
1104  */
1105 static void
1106 sppptun_inner_ioctl(queue_t *q, mblk_t *mp)
1107 {
1108 	struct iocblk *iop;
1109 	int rc = 0;
1110 	int len = 0;
1111 	int i;
1112 	tuncl_t *tcl;
1113 	tunll_t *tll;
1114 	union ppptun_name *ptn;
1115 	struct ppptun_info *pti;
1116 	struct ppptun_peer *ptp;
1117 	mblk_t *mptmp;
1118 	ppptun_atype *pap;
1119 	struct ppp_stats64 *psp;
1120 	zoneid_t zoneid;
1121 
1122 	iop = (struct iocblk *)mp->b_rptr;
1123 	tcl = NULL;
1124 	tll = q->q_ptr;
1125 	if (tll->tll_flags & TLLF_NOTLOWER) {
1126 		tcl = (tuncl_t *)tll;
1127 		tll = NULL;
1128 	}
1129 
1130 	DTRACE_PROBE3(sppptun__ioctl, tuncl_t *, tcl, tunll_t *, tll,
1131 	    struct iocblk *, iop);
1132 
1133 	switch (iop->ioc_cmd) {
1134 	case PPPIO_DEBUG:
1135 		/*
1136 		 * Debug requests are now ignored; use dtrace or wireshark
1137 		 * instead.
1138 		 */
1139 		break;
1140 
1141 	case PPPIO_GETSTAT:
1142 		rc = EINVAL;
1143 		break;
1144 
1145 	case PPPIO_GETSTAT64:
1146 		/* Client (device) side only */
1147 		if (tcl == NULL) {
1148 			rc = EINVAL;
1149 			break;
1150 		}
1151 		mptmp = allocb(sizeof (*psp), BPRI_HI);
1152 		if (mptmp == NULL) {
1153 			rc = ENOSR;
1154 			break;
1155 		}
1156 		freemsg(mp->b_cont);
1157 		mp->b_cont = mptmp;
1158 
1159 		psp = (struct ppp_stats64 *)mptmp->b_wptr;
1160 		bzero((caddr_t)psp, sizeof (*psp));
1161 		psp->p = tcl->tcl_stats;
1162 
1163 		len = sizeof (*psp);
1164 		break;
1165 
1166 	case PPPTUN_SNAME:
1167 		/* This is done on the *module* (lower level) side. */
1168 		if (tll == NULL || mp->b_cont == NULL ||
1169 		    iop->ioc_count != sizeof (*ptn) ||
1170 		    *mp->b_cont->b_rptr == '\0') {
1171 			rc = EINVAL;
1172 			break;
1173 		}
1174 
1175 		ptn = (union ppptun_name *)mp->b_cont->b_rptr;
1176 		ptn->ptn_name[sizeof (ptn->ptn_name) - 1] = '\0';
1177 
1178 		tll = tll_lookup_on_name(ptn->ptn_name, tll->tll_zoneid);
1179 		if (tll != NULL) {
1180 			rc = EEXIST;
1181 			break;
1182 		}
1183 		tll = (tunll_t *)q->q_ptr;
1184 		(void) strcpy(tll->tll_name, ptn->ptn_name);
1185 		break;
1186 
1187 	case PPPTUN_SINFO:
1188 	case PPPTUN_GINFO:
1189 		/* Either side */
1190 		if (mp->b_cont == NULL || iop->ioc_count != sizeof (*pti)) {
1191 			rc = EINVAL;
1192 			break;
1193 		}
1194 		pti = (struct ppptun_info *)mp->b_cont->b_rptr;
1195 		if (pti->pti_name[0] != '\0')
1196 			tll = tll_lookup_on_name(pti->pti_name,
1197 			    tcl == NULL ? tll->tll_zoneid : tcl->tcl_zoneid);
1198 		if (tll == NULL) {
1199 			/* Driver (client) side must have name */
1200 			if (tcl != NULL && pti->pti_name[0] == '\0')
1201 				rc = EINVAL;
1202 			else
1203 				rc = ESRCH;
1204 			break;
1205 		}
1206 		if (iop->ioc_cmd == PPPTUN_GINFO) {
1207 			pti->pti_muxid = tll->tll_muxid;
1208 			pti->pti_style = tll->tll_style;
1209 			len = sizeof (*pti);
1210 			break;
1211 		}
1212 		tll->tll_muxid = pti->pti_muxid;
1213 		tll->tll_style = pti->pti_style;
1214 		switch (tll->tll_style) {
1215 		case PTS_PPPOE:		/* DLPI type */
1216 			tll->tll_alen = sizeof (tll->tll_lcladdr.pta_pppoe);
1217 			mptmp = dlpi_alloc(sizeof (dl_unbind_req_t),
1218 			    DL_UNBIND_REQ);
1219 			if (mptmp == NULL) {
1220 				rc = ENOSR;
1221 				break;
1222 			}
1223 			save_for_close(tll, mptmp);
1224 			mptmp = dlpi_alloc(sizeof (dl_detach_req_t),
1225 			    DL_DETACH_REQ);
1226 			if (mptmp == NULL) {
1227 				rc = ENOSR;
1228 				break;
1229 			}
1230 			save_for_close(tll, mptmp);
1231 			break;
1232 		default:
1233 			tll->tll_style = PTS_NONE;
1234 			tll->tll_alen = 0;
1235 			rc = EINVAL;
1236 			break;
1237 		}
1238 		break;
1239 
1240 	case PPPTUN_GNNAME:
1241 		/* This can be done on either side. */
1242 		if (mp->b_cont == NULL || iop->ioc_count < sizeof (uint32_t)) {
1243 			rc = EINVAL;
1244 			break;
1245 		}
1246 		zoneid = tcl == NULL ? tll->tll_zoneid : tcl->tcl_zoneid;
1247 		ptn = (union ppptun_name *)mp->b_cont->b_rptr;
1248 		i = ptn->ptn_index;
1249 		tll = TO_TLL(tunll_list.q_forw);
1250 		while (tll != TO_TLL(&tunll_list)) {
1251 			if (tll->tll_zoneid == zoneid && --i < 0)
1252 				break;
1253 			tll = TO_TLL(tll->tll_next);
1254 		}
1255 		if (tll != TO_TLL(&tunll_list)) {
1256 			bcopy(tll->tll_name, ptn->ptn_name,
1257 			    sizeof (ptn->ptn_name));
1258 		} else {
1259 			bzero(ptn, sizeof (*ptn));
1260 		}
1261 		len = sizeof (*ptn);
1262 		break;
1263 
1264 	case PPPTUN_LCLADDR:
1265 		/* This is done on the *module* (lower level) side. */
1266 		if (tll == NULL || mp->b_cont == NULL) {
1267 			rc = EINVAL;
1268 			break;
1269 		}
1270 
1271 		pap = &tll->tll_lcladdr;
1272 		len = tll->tll_alen;
1273 		if (len == 0 || len > iop->ioc_count) {
1274 			rc = EINVAL;
1275 			break;
1276 		}
1277 		bcopy(mp->b_cont->b_rptr, pap, len);
1278 		len = 0;
1279 		break;
1280 
1281 	case PPPTUN_SPEER:
1282 		/* Client (device) side only; before SDATA */
1283 		if (tcl == NULL || mp->b_cont == NULL ||
1284 		    iop->ioc_count != sizeof (*ptp)) {
1285 			rc = EINVAL;
1286 			break;
1287 		}
1288 		if (tcl->tcl_data_tll != NULL) {
1289 			rc = EINVAL;
1290 			break;
1291 		}
1292 		ptp = (struct ppptun_peer *)mp->b_cont->b_rptr;
1293 		DTRACE_PROBE2(sppptun__speer, tuncl_t *, tcl,
1294 		    struct ppptun_peer *, ptp);
1295 		/* Once set, the style cannot change. */
1296 		if (tcl->tcl_style != PTS_NONE &&
1297 		    tcl->tcl_style != ptp->ptp_style) {
1298 			rc = EINVAL;
1299 			break;
1300 		}
1301 		if (ptp->ptp_flags & PTPF_DAEMON) {
1302 			/* User requests registration for tunnel 0 */
1303 			if ((tcl->tcl_flags & TCLF_SPEER_DONE) ||
1304 			    ptp->ptp_ltunid != 0 || ptp->ptp_rtunid != 0 ||
1305 			    ptp->ptp_lsessid != 0 || ptp->ptp_rsessid != 0) {
1306 				rc = EINVAL;
1307 				break;
1308 			}
1309 			tcl->tcl_flags |= TCLF_DAEMON;
1310 		} else {
1311 			/* Normal client connection */
1312 			if (tcl->tcl_flags & TCLF_DAEMON) {
1313 				rc = EINVAL;
1314 				break;
1315 			}
1316 			if (ptp->ptp_lsessid != 0 &&
1317 			    ptp->ptp_lsessid != tcl->tcl_lsessid) {
1318 				rc = EINVAL;
1319 				break;
1320 			}
1321 			/*
1322 			 * If we're reassigning the peer data, then
1323 			 * the previous assignment must have been for
1324 			 * a client control connection.  Check that.
1325 			 */
1326 			if ((tcl->tcl_flags & TCLF_SPEER_DONE) &&
1327 			    ((tcl->tcl_ltunid != 0 &&
1328 			    tcl->tcl_ltunid != ptp->ptp_ltunid) ||
1329 			    (tcl->tcl_rtunid != 0 &&
1330 			    tcl->tcl_rtunid != ptp->ptp_rtunid) ||
1331 			    (tcl->tcl_rsessid != 0 &&
1332 			    tcl->tcl_rsessid != ptp->ptp_rsessid))) {
1333 				rc = EINVAL;
1334 				break;
1335 			}
1336 			if ((tcl->tcl_ltunid = ptp->ptp_ltunid) == 0 &&
1337 			    tcl->tcl_style == PTS_L2FTP)
1338 				tcl->tcl_ltunid = ptp->ptp_lsessid;
1339 			tcl->tcl_rtunid = ptp->ptp_rtunid;
1340 			tcl->tcl_rsessid = ptp->ptp_rsessid;
1341 		}
1342 		tcl->tcl_flags |= TCLF_SPEER_DONE;
1343 		tcl->tcl_style = ptp->ptp_style;
1344 		tcl->tcl_address = ptp->ptp_address;
1345 		goto fill_in_peer;
1346 
1347 	case PPPTUN_GPEER:
1348 		/* Client (device) side only */
1349 		if (tcl == NULL) {
1350 			rc = EINVAL;
1351 			break;
1352 		}
1353 		if (mp->b_cont != NULL)
1354 			freemsg(mp->b_cont);
1355 		mp->b_cont = allocb(sizeof (*ptp), BPRI_HI);
1356 		if (mp->b_cont == NULL) {
1357 			rc = ENOSR;
1358 			break;
1359 		}
1360 		ptp = (struct ppptun_peer *)mp->b_cont->b_rptr;
1361 	fill_in_peer:
1362 		ptp->ptp_style = tcl->tcl_style;
1363 		ptp->ptp_flags = (tcl->tcl_flags & TCLF_DAEMON) ? PTPF_DAEMON :
1364 		    0;
1365 		ptp->ptp_ltunid = tcl->tcl_ltunid;
1366 		ptp->ptp_rtunid = tcl->tcl_rtunid;
1367 		ptp->ptp_lsessid = tcl->tcl_lsessid;
1368 		ptp->ptp_rsessid = tcl->tcl_rsessid;
1369 		ptp->ptp_address = tcl->tcl_address;
1370 		len = sizeof (*ptp);
1371 		break;
1372 
1373 	case PPPTUN_SDATA:
1374 	case PPPTUN_SCTL:
1375 		/* Client (device) side only; must do SPEER first */
1376 		if (tcl == NULL || mp->b_cont == NULL ||
1377 		    iop->ioc_count != sizeof (*ptn) ||
1378 		    *mp->b_cont->b_rptr == '\0') {
1379 			rc = EINVAL;
1380 			break;
1381 		}
1382 		if (!(tcl->tcl_flags & TCLF_SPEER_DONE)) {
1383 			rc = EINVAL;
1384 			break;
1385 		}
1386 		ptn = (union ppptun_name *)mp->b_cont->b_rptr;
1387 		ptn->ptn_name[sizeof (ptn->ptn_name) - 1] = '\0';
1388 		tll = tll_lookup_on_name(ptn->ptn_name, tcl->tcl_zoneid);
1389 		if (tll == NULL) {
1390 			rc = ESRCH;
1391 			break;
1392 		}
1393 		if (tll->tll_style != tcl->tcl_style) {
1394 			rc = ENXIO;
1395 			break;
1396 		}
1397 		if (iop->ioc_cmd == PPPTUN_SDATA) {
1398 			if (tcl->tcl_data_tll != NULL) {
1399 				rc = EEXIST;
1400 				break;
1401 			}
1402 			/* server daemons cannot use regular data */
1403 			if (tcl->tcl_flags & TCLF_DAEMON) {
1404 				rc = EINVAL;
1405 				break;
1406 			}
1407 			tcl->tcl_data_tll = tll;
1408 		} else if (tcl->tcl_flags & TCLF_DAEMON) {
1409 			if (tll->tll_defcl != NULL && tll->tll_defcl != tcl) {
1410 				rc = EEXIST;
1411 				break;
1412 			}
1413 			tll->tll_defcl = tcl;
1414 			if (tcl->tcl_ctrl_tll != NULL) {
1415 				KDECR(tcl->tcl_ctrl_tll, tll_kstats,
1416 				    lks_clients);
1417 			}
1418 			tcl->tcl_ctrl_tll = tll;
1419 		} else {
1420 			if (tcl->tcl_ctrl_tll != NULL) {
1421 				rc = EEXIST;
1422 				break;
1423 			}
1424 			tcl->tcl_ctrl_tll = tll;
1425 		}
1426 		KLINCR(lks_clients);
1427 		break;
1428 
1429 	case PPPTUN_GDATA:
1430 	case PPPTUN_GCTL:
1431 		/* Client (device) side only */
1432 		if (tcl == NULL) {
1433 			rc = EINVAL;
1434 			break;
1435 		}
1436 		if (mp->b_cont != NULL)
1437 			freemsg(mp->b_cont);
1438 		mp->b_cont = allocb(sizeof (*ptn), BPRI_HI);
1439 		if (mp->b_cont == NULL) {
1440 			rc = ENOSR;
1441 			break;
1442 		}
1443 		ptn = (union ppptun_name *)mp->b_cont->b_rptr;
1444 		if (iop->ioc_cmd == PPPTUN_GDATA)
1445 			tll = tcl->tcl_data_tll;
1446 		else
1447 			tll = tcl->tcl_ctrl_tll;
1448 		if (tll == NULL)
1449 			bzero(ptn, sizeof (*ptn));
1450 		else
1451 			bcopy(tll->tll_name, ptn->ptn_name,
1452 			    sizeof (ptn->ptn_name));
1453 		len = sizeof (*ptn);
1454 		break;
1455 
1456 	case PPPTUN_DCTL:
1457 		/* Client (device) side daemon mode only */
1458 		if (tcl == NULL || mp->b_cont == NULL ||
1459 		    iop->ioc_count != sizeof (*ptn) ||
1460 		    !(tcl->tcl_flags & TCLF_DAEMON)) {
1461 			rc = EINVAL;
1462 			break;
1463 		}
1464 		ptn = (union ppptun_name *)mp->b_cont->b_rptr;
1465 		ptn->ptn_name[sizeof (ptn->ptn_name) - 1] = '\0';
1466 		tll = tll_lookup_on_name(ptn->ptn_name, tcl->tcl_zoneid);
1467 		if (tll == NULL || tll->tll_defcl != tcl) {
1468 			rc = ESRCH;
1469 			break;
1470 		}
1471 		tll->tll_defcl = NULL;
1472 		break;
1473 
1474 	case PPPTUN_SSAP:
1475 		/* This is done on the *module* (lower level) side. */
1476 		if (tll == NULL || mp->b_cont == NULL ||
1477 		    iop->ioc_count != sizeof (uint_t)) {
1478 			rc = EINVAL;
1479 			break;
1480 		}
1481 
1482 		tll->tll_sap = *(uint_t *)mp->b_cont->b_rptr;
1483 		break;
1484 
1485 	default:
1486 		/* Caller should already have checked command value */
1487 		ASSERT(0);
1488 	}
1489 	if (rc != 0) {
1490 		miocnak(q, mp, 0, rc);
1491 	} else {
1492 		if (len > 0)
1493 			mp->b_cont->b_wptr = mp->b_cont->b_rptr + len;
1494 		miocack(q, mp, len, 0);
1495 	}
1496 }
1497 
1498 /*
1499  * sppptun_ioctl()
1500  *
1501  * MT-Perimeters:
1502  *    shared inner, shared outer.
1503  *
1504  * Description:
1505  *    Called by sppptun_uwput as the result of receiving a M_IOCTL command.
1506  */
1507 static void
1508 sppptun_ioctl(queue_t *q, mblk_t *mp)
1509 {
1510 	struct iocblk *iop;
1511 	int rc = 0;
1512 	int len = 0;
1513 	uint32_t val = 0;
1514 	tunll_t *tll;
1515 
1516 	iop = (struct iocblk *)mp->b_rptr;
1517 
1518 	switch (iop->ioc_cmd) {
1519 	case PPPIO_DEBUG:
1520 	case PPPIO_GETSTAT:
1521 	case PPPIO_GETSTAT64:
1522 	case PPPTUN_SNAME:
1523 	case PPPTUN_SINFO:
1524 	case PPPTUN_GINFO:
1525 	case PPPTUN_GNNAME:
1526 	case PPPTUN_LCLADDR:
1527 	case PPPTUN_SPEER:
1528 	case PPPTUN_GPEER:
1529 	case PPPTUN_SDATA:
1530 	case PPPTUN_GDATA:
1531 	case PPPTUN_SCTL:
1532 	case PPPTUN_GCTL:
1533 	case PPPTUN_DCTL:
1534 	case PPPTUN_SSAP:
1535 		qwriter(q, mp, sppptun_inner_ioctl, PERIM_INNER);
1536 		return;
1537 
1538 	case PPPIO_GCLEAN:	/* always clean */
1539 		val = RCV_B7_1 | RCV_B7_0 | RCV_ODDP | RCV_EVNP;
1540 		len = sizeof (uint32_t);
1541 		break;
1542 
1543 	case PPPIO_GTYPE:	/* we look like an async driver. */
1544 		val = PPPTYP_AHDLC;
1545 		len = sizeof (uint32_t);
1546 		break;
1547 
1548 	case PPPIO_CFLAGS:	/* never compress headers */
1549 		val = 0;
1550 		len = sizeof (uint32_t);
1551 		break;
1552 
1553 		/* quietly ack PPP things we don't need to do. */
1554 	case PPPIO_XFCS:
1555 	case PPPIO_RFCS:
1556 	case PPPIO_XACCM:
1557 	case PPPIO_RACCM:
1558 	case PPPIO_LASTMOD:
1559 	case PPPIO_MUX:
1560 	case I_PLINK:
1561 	case I_PUNLINK:
1562 	case I_LINK:
1563 	case I_UNLINK:
1564 		break;
1565 
1566 	default:
1567 		tll = (tunll_t *)q->q_ptr;
1568 		if (!(tll->tll_flags & TLLF_NOTLOWER)) {
1569 			/* module side; pass this through. */
1570 			putnext(q, mp);
1571 			return;
1572 		}
1573 		rc = EINVAL;
1574 		break;
1575 	}
1576 	if (rc == 0 && len == sizeof (uint32_t)) {
1577 		if (mp->b_cont != NULL)
1578 			freemsg(mp->b_cont);
1579 		mp->b_cont = allocb(sizeof (uint32_t), BPRI_HI);
1580 		if (mp->b_cont == NULL) {
1581 			rc = ENOSR;
1582 		} else {
1583 			*(uint32_t *)mp->b_cont->b_wptr = val;
1584 			mp->b_cont->b_wptr += sizeof (uint32_t);
1585 		}
1586 	}
1587 	if (rc == 0) {
1588 		miocack(q, mp, len, 0);
1589 	} else {
1590 		miocnak(q, mp, 0, rc);
1591 	}
1592 }
1593 
1594 /*
1595  * sppptun_inner_mctl()
1596  *
1597  * MT-Perimeters:
1598  *    exclusive inner, shared outer.
1599  *
1600  * Description:
1601  *    Called by qwriter (via sppptun_uwput) as the result of receiving
1602  *    an M_CTL.  Called only on the client (driver) side.
1603  */
1604 static void
1605 sppptun_inner_mctl(queue_t *q, mblk_t *mp)
1606 {
1607 	int msglen;
1608 	tuncl_t *tcl;
1609 
1610 	tcl = q->q_ptr;
1611 
1612 	if (!(tcl->tcl_flags & TCLF_ISCLIENT)) {
1613 		freemsg(mp);
1614 		return;
1615 	}
1616 
1617 	msglen = MBLKL(mp);
1618 	switch (*mp->b_rptr) {
1619 	case PPPCTL_UNIT:
1620 		if (msglen == 2)
1621 			tcl->tcl_unit = mp->b_rptr[1];
1622 		else if (msglen == 8)
1623 			tcl->tcl_unit = ((uint32_t *)mp->b_rptr)[1];
1624 		break;
1625 	}
1626 	freemsg(mp);
1627 }
1628 
1629 /*
1630  * sppptun_uwput()
1631  *
1632  * MT-Perimeters:
1633  *    shared inner, shared outer.
1634  *
1635  * Description:
1636  *	Regular output data and controls pass through here.
1637  */
1638 static int
1639 sppptun_uwput(queue_t *q, mblk_t *mp)
1640 {
1641 	queue_t *nextq;
1642 	tuncl_t *tcl;
1643 
1644 	ASSERT(q->q_ptr != NULL);
1645 
1646 	switch (MTYPE(mp)) {
1647 	case M_DATA:
1648 	case M_PROTO:
1649 	case M_PCPROTO:
1650 		if (q->q_first == NULL &&
1651 		    (nextq = sppptun_outpkt(q, &mp)) != NULL) {
1652 			putnext(nextq, mp);
1653 		} else if (mp != NULL && !putq(q, mp)) {
1654 			freemsg(mp);
1655 		}
1656 		break;
1657 	case M_IOCTL:
1658 		sppptun_ioctl(q, mp);
1659 		break;
1660 	case M_CTL:
1661 		qwriter(q, mp, sppptun_inner_mctl, PERIM_INNER);
1662 		break;
1663 	default:
1664 		tcl = (tuncl_t *)q->q_ptr;
1665 		/*
1666 		 * If we're the driver, then discard unknown junk.
1667 		 * Otherwise, if we're the module, then forward along.
1668 		 */
1669 		if (tcl->tcl_flags & TCLF_ISCLIENT)
1670 			freemsg(mp);
1671 		else
1672 			putnext(q, mp);
1673 		break;
1674 	}
1675 	return (0);
1676 }
1677 
1678 /*
1679  * Send a DLPI/TPI control message to the driver but make sure there
1680  * is only one outstanding message.  Uses tll_msg_pending to tell when
1681  * it must queue.  sppptun_urput calls message_done() when an ACK or a
1682  * NAK is received to process the next queued message.
1683  */
1684 static void
1685 message_send(tunll_t *tll, mblk_t *mp)
1686 {
1687 	mblk_t **mpp;
1688 
1689 	if (tll->tll_msg_pending) {
1690 		/* Must queue message. Tail insertion */
1691 		mpp = &tll->tll_msg_deferred;
1692 		while (*mpp != NULL)
1693 			mpp = &((*mpp)->b_next);
1694 		*mpp = mp;
1695 		return;
1696 	}
1697 	tll->tll_msg_pending = 1;
1698 	putnext(tll->tll_wq, mp);
1699 }
1700 
1701 /*
1702  * Called when an DLPI/TPI control message has been acked or nacked to
1703  * send down the next queued message (if any).
1704  */
1705 static void
1706 message_done(tunll_t *tll)
1707 {
1708 	mblk_t *mp;
1709 
1710 	ASSERT(tll->tll_msg_pending);
1711 	tll->tll_msg_pending = 0;
1712 	mp = tll->tll_msg_deferred;
1713 	if (mp != NULL) {
1714 		tll->tll_msg_deferred = mp->b_next;
1715 		mp->b_next = NULL;
1716 		tll->tll_msg_pending = 1;
1717 		putnext(tll->tll_wq, mp);
1718 	}
1719 }
1720 
1721 /*
1722  * Send down queued "close" messages to lower stream.  These were
1723  * enqueued right after the stream was originally allocated, when the
1724  * tll_style was set by PPPTUN_SINFO.
1725  */
1726 static int
1727 tll_close_req(tunll_t *tll)
1728 {
1729 	mblk_t *mb, *mbnext;
1730 
1731 	if ((mb = tll->tll_onclose) == NULL)
1732 		tll->tll_flags |= TLLF_SHUTDOWN_DONE;
1733 	else {
1734 		tll->tll_onclose = NULL;
1735 		while (mb != NULL) {
1736 			mbnext = mb->b_next;
1737 			mb->b_next = NULL;
1738 			message_send(tll, mb);
1739 			mb = mbnext;
1740 		}
1741 	}
1742 	return (0);
1743 }
1744 
1745 /*
1746  * This function is called when a backenable occurs on the write side of a
1747  * lower stream.  It walks over the client streams, looking for ones that use
1748  * the given tunll_t lower stream.  Each client is then backenabled.
1749  */
1750 static void
1751 tclvm_backenable(void *arg, void *firstv, size_t numv)
1752 {
1753 	tunll_t *tll = arg;
1754 	int minorn = (int)(uintptr_t)firstv;
1755 	int minormax = minorn + numv;
1756 	tuncl_t *tcl;
1757 	queue_t *q;
1758 
1759 	while (minorn < minormax) {
1760 		tcl = tcl_slots[minorn - 1];
1761 		if ((tcl->tcl_data_tll == tll ||
1762 		    tcl->tcl_ctrl_tll == tll) &&
1763 		    (q = tcl->tcl_rq) != NULL) {
1764 			qenable(OTHERQ(q));
1765 		}
1766 		minorn++;
1767 	}
1768 }
1769 
1770 /*
1771  * sppptun_uwsrv()
1772  *
1773  * MT-Perimeters:
1774  *    exclusive inner, shared outer.
1775  *
1776  * Description:
1777  *    Upper write-side service procedure.  In addition to the usual
1778  *    STREAMS queue service handling, this routine also handles the
1779  *    transmission of the unbind/detach messages to the lower stream
1780  *    driver when a lower stream is being closed.  (See the use of
1781  *    qenable/qwait in sppptun_close().)
1782  */
1783 static int
1784 sppptun_uwsrv(queue_t *q)
1785 {
1786 	tuncl_t	*tcl;
1787 	mblk_t *mp;
1788 	queue_t *nextq;
1789 
1790 	tcl = q->q_ptr;
1791 	if (!(tcl->tcl_flags & TCLF_ISCLIENT)) {
1792 		tunll_t *tll = (tunll_t *)tcl;
1793 
1794 		if ((tll->tll_flags & (TLLF_CLOSING|TLLF_CLOSE_DONE)) ==
1795 		    TLLF_CLOSING) {
1796 			tll->tll_error = tll_close_req(tll);
1797 			tll->tll_flags |= TLLF_CLOSE_DONE;
1798 		} else {
1799 			/*
1800 			 * We've been enabled here because of a backenable on
1801 			 * output flow control.  Backenable clients using this
1802 			 * lower layer.
1803 			 */
1804 			vmem_walk(tcl_minor_arena, VMEM_ALLOC, tclvm_backenable,
1805 			    tll);
1806 		}
1807 		return (0);
1808 	}
1809 
1810 	while ((mp = getq(q)) != NULL) {
1811 		if ((nextq = sppptun_outpkt(q, &mp)) != NULL) {
1812 			putnext(nextq, mp);
1813 		} else if (mp != NULL) {
1814 			(void) putbq(q, mp);
1815 			break;
1816 		}
1817 	}
1818 	return (0);
1819 }
1820 
1821 /*
1822  * sppptun_lwput()
1823  *
1824  * MT-Perimeters:
1825  *    shared inner, shared outer.
1826  *
1827  * Description:
1828  *    Lower write-side put procedure.  Nothing should be sending
1829  *    packets down this stream.
1830  */
1831 static int
1832 sppptun_lwput(queue_t *q, mblk_t *mp)
1833 {
1834 	switch (MTYPE(mp)) {
1835 	case M_PROTO:
1836 		putnext(q, mp);
1837 		break;
1838 	default:
1839 		freemsg(mp);
1840 		break;
1841 	}
1842 	return (0);
1843 }
1844 
1845 /*
1846  * sppptun_lrput()
1847  *
1848  * MT-Perimeters:
1849  *    shared inner, shared outer.
1850  *
1851  * Description:
1852  *    Lower read-side put procedure.  Nothing should arrive here.
1853  */
1854 static int
1855 sppptun_lrput(queue_t *q, mblk_t *mp)
1856 {
1857 	tuncl_t *tcl;
1858 
1859 	switch (MTYPE(mp)) {
1860 	case M_IOCTL:
1861 		miocnak(q, mp, 0, EINVAL);
1862 		return (0);
1863 	case M_FLUSH:
1864 		if (*mp->b_rptr & FLUSHR) {
1865 			flushq(q, FLUSHDATA);
1866 		}
1867 		if (*mp->b_rptr & FLUSHW) {
1868 			*mp->b_rptr &= ~FLUSHR;
1869 			qreply(q, mp);
1870 		} else {
1871 			freemsg(mp);
1872 		}
1873 		return (0);
1874 	}
1875 	/*
1876 	 * Try to forward the message to the put procedure for the upper
1877 	 * control stream for this lower stream. If there are already messages
1878 	 * queued here, queue this one up to preserve message ordering.
1879 	 */
1880 	if ((tcl = (tuncl_t *)q->q_ptr) == NULL || tcl->tcl_rq == NULL) {
1881 		freemsg(mp);
1882 		return (0);
1883 	}
1884 	if (queclass(mp) == QPCTL ||
1885 	    (q->q_first == NULL && canput(tcl->tcl_rq))) {
1886 		put(tcl->tcl_rq, mp);
1887 	} else {
1888 		if (!putq(q, mp))
1889 			freemsg(mp);
1890 	}
1891 	return (0);
1892 }
1893 
1894 /*
1895  * MT-Perimeters:
1896  *    shared inner, shared outer.
1897  *
1898  *    Handle non-data DLPI messages.  Used with PPPoE, which runs over
1899  *    Ethernet only.
1900  */
1901 static void
1902 urput_dlpi(queue_t *q, mblk_t *mp)
1903 {
1904 	int err;
1905 	union DL_primitives *dlp = (union DL_primitives *)mp->b_rptr;
1906 	tunll_t *tll = q->q_ptr;
1907 	size_t mlen = MBLKL(mp);
1908 
1909 	switch (dlp->dl_primitive) {
1910 	case DL_UDERROR_IND:
1911 		break;
1912 
1913 	case DL_ERROR_ACK:
1914 		if (mlen < DL_ERROR_ACK_SIZE)
1915 			break;
1916 		err = dlp->error_ack.dl_unix_errno ?
1917 		    dlp->error_ack.dl_unix_errno : ENXIO;
1918 		switch (dlp->error_ack.dl_error_primitive) {
1919 		case DL_UNBIND_REQ:
1920 			message_done(tll);
1921 			break;
1922 		case DL_DETACH_REQ:
1923 			message_done(tll);
1924 			tll->tll_error = err;
1925 			tll->tll_flags |= TLLF_SHUTDOWN_DONE;
1926 			break;
1927 		case DL_PHYS_ADDR_REQ:
1928 			message_done(tll);
1929 			break;
1930 		case DL_INFO_REQ:
1931 		case DL_ATTACH_REQ:
1932 		case DL_BIND_REQ:
1933 			message_done(tll);
1934 			tll->tll_error = err;
1935 			break;
1936 		}
1937 		break;
1938 
1939 	case DL_INFO_ACK:
1940 		message_done(tll);
1941 		break;
1942 
1943 	case DL_BIND_ACK:
1944 		message_done(tll);
1945 		break;
1946 
1947 	case DL_PHYS_ADDR_ACK:
1948 		break;
1949 
1950 	case DL_OK_ACK:
1951 		if (mlen < DL_OK_ACK_SIZE)
1952 			break;
1953 		switch (dlp->ok_ack.dl_correct_primitive) {
1954 		case DL_UNBIND_REQ:
1955 			message_done(tll);
1956 			break;
1957 		case DL_DETACH_REQ:
1958 			tll->tll_flags |= TLLF_SHUTDOWN_DONE;
1959 			break;
1960 		case DL_ATTACH_REQ:
1961 			message_done(tll);
1962 			break;
1963 		}
1964 		break;
1965 	}
1966 	freemsg(mp);
1967 }
1968 
1969 /* Search structure used with PPPoE only; see tclvm_pppoe_search(). */
1970 struct poedat {
1971 	uint_t sessid;
1972 	tunll_t *tll;
1973 	const void *srcaddr;
1974 	int isdata;
1975 	tuncl_t *tcl;
1976 };
1977 
1978 /*
1979  * This function is called by vmem_walk from within sppptun_recv.  It
1980  * iterates over a span of allocated minor node numbers to search for
1981  * the appropriate lower stream, session ID, and peer MAC address.
1982  *
1983  * (This is necessary due to a design flaw in the PPPoE protocol
1984  * itself.  The protocol assigns session IDs from the server side
1985  * only.  Both server and client use the same number.  Thus, if there
1986  * are multiple clients on a single host, there can be session ID
1987  * conflicts between servers and there's no way to detangle them
1988  * except by looking at the remote MAC address.)
1989  *
1990  * (This could have been handled by linking together sessions that
1991  * differ only in the remote MAC address.  This isn't done because it
1992  * would involve extra per-session storage and it's very unlikely that
1993  * PPPoE would be used this way.)
1994  */
1995 static void
1996 tclvm_pppoe_search(void *arg, void *firstv, size_t numv)
1997 {
1998 	struct poedat *poedat = (struct poedat *)arg;
1999 	int minorn = (int)(uintptr_t)firstv;
2000 	int minormax = minorn + numv;
2001 	tuncl_t *tcl;
2002 
2003 	if (poedat->tcl != NULL)
2004 		return;
2005 	while (minorn < minormax) {
2006 		tcl = tcl_slots[minorn - 1];
2007 		ASSERT(tcl != NULL);
2008 		if (tcl->tcl_rsessid == poedat->sessid &&
2009 		    ((!poedat->isdata && tcl->tcl_ctrl_tll == poedat->tll) ||
2010 		    (poedat->isdata && tcl->tcl_data_tll == poedat->tll)) &&
2011 		    bcmp(tcl->tcl_address.pta_pppoe.ptma_mac,
2012 		    poedat->srcaddr,
2013 		    sizeof (tcl->tcl_address.pta_pppoe.ptma_mac)) == 0) {
2014 			poedat->tcl = tcl;
2015 			break;
2016 		}
2017 		minorn++;
2018 	}
2019 }
2020 
2021 /*
2022  * sppptun_recv()
2023  *
2024  * MT-Perimeters:
2025  *    shared inner, shared outer.
2026  *
2027  * Description:
2028  *    Receive function called by sppptun_urput, which is called when
2029  *    the lower read-side put or service procedure sends a message
2030  *    upstream to the a device user (PPP).  It attempts to find an
2031  *    appropriate queue on the module above us (depending on what the
2032  *    associated upper stream for the protocol would be), and if not
2033  *    possible, it will find an upper control stream for the protocol.
2034  *    Returns a pointer to the upper queue_t, or NULL if the message
2035  *    has been discarded.
2036  *
2037  * About demultiplexing:
2038  *
2039  *	All four protocols (L2F, PPTP, L2TP, and PPPoE) support a
2040  *	locally assigned ID for demultiplexing incoming traffic.  For
2041  *	L2F, this is called the Client ID, for PPTP the Call ID, for
2042  *	L2TP the Session ID, and for PPPoE the SESSION_ID.  This is a
2043  *	16 bit number for all four protocols, and is used to directly
2044  *	index into a list of upper streams.  With the upper stream in
2045  *	hand, we verify that this is the right stream and deliver the
2046  *	data.
2047  *
2048  *	L2TP has a Tunnel ID, which represents a bundle of PPP
2049  *	sessions between the peers.  Because we always assign unique
2050  *	session ID numbers, we merely check that the given ID matches
2051  *	the assigned ID for the upper stream.
2052  *
2053  *	L2F has a Multiplex ID, which is unique per connection.  It
2054  *	does not have L2TP's concept of multiple-connections-within-
2055  *	a-tunnel.  The same checking is done.
2056  *
2057  *	PPPoE is a horribly broken protocol.  Only one ID is assigned
2058  *	per connection.  The client must somehow demultiplex based on
2059  *	an ID number assigned by the server.  It's not necessarily
2060  *	unique.  The search is done based on {ID,peerEthernet} (using
2061  *	tcl_rsessid) for all packet types except PADI and PADS.
2062  *
2063  *	Neither PPPoE nor PPTP supports additional ID numbers.
2064  *
2065  *	Both L2F and L2TP come in over UDP.  They are distinguished by
2066  *	looking at the GRE version field -- 001 for L2F and 010 for
2067  *	L2TP.
2068  */
2069 static queue_t *
2070 sppptun_recv(queue_t *q, mblk_t **mpp, const void *srcaddr)
2071 {
2072 	mblk_t *mp;
2073 	tunll_t *tll;
2074 	tuncl_t *tcl;
2075 	int sessid;
2076 	int remlen;
2077 	int msglen;
2078 	int isdata;
2079 	int i;
2080 	const uchar_t *ucp;
2081 	const poep_t *poep;
2082 	mblk_t *mnew;
2083 	ppptun_atype *pap;
2084 
2085 	mp = *mpp;
2086 
2087 	tll = q->q_ptr;
2088 	ASSERT(!(tll->tll_flags & TLLF_NOTLOWER));
2089 
2090 	tcl = NULL;
2091 	switch (tll->tll_style) {
2092 	case PTS_PPPOE:
2093 		/* Note that poep_t alignment is uint16_t */
2094 		if ((!IS_P2ALIGNED(mp->b_rptr, sizeof (uint16_t)) ||
2095 		    MBLKL(mp) < sizeof (poep_t)) &&
2096 		    !pullupmsg(mp, sizeof (poep_t)))
2097 			break;
2098 		poep = (const poep_t *)mp->b_rptr;
2099 		if (poep->poep_version_type != POE_VERSION)
2100 			break;
2101 		/*
2102 		 * First, extract a session ID number.  All protocols have
2103 		 * this.
2104 		 */
2105 		isdata = (poep->poep_code == POECODE_DATA);
2106 		sessid = ntohs(poep->poep_session_id);
2107 		remlen = sizeof (*poep);
2108 		msglen = ntohs(poep->poep_length);
2109 		i = poep->poep_code;
2110 		if (i == POECODE_PADI || i == POECODE_PADR) {
2111 			/* These go to the server daemon only. */
2112 			tcl = tll->tll_defcl;
2113 		} else if (i == POECODE_PADO || i == POECODE_PADS) {
2114 			/*
2115 			 * These go to a client only, and are demuxed
2116 			 * by the Host-Uniq field (into which we stuff
2117 			 * our local ID number when generating
2118 			 * PADI/PADR).
2119 			 */
2120 			ucp = (const uchar_t *)(poep + 1);
2121 			i = msglen;
2122 			while (i > POET_HDRLEN) {
2123 				if (POET_GET_TYPE(ucp) == POETT_END) {
2124 					i = 0;
2125 					break;
2126 				}
2127 				if (POET_GET_TYPE(ucp) == POETT_UNIQ &&
2128 				    POET_GET_LENG(ucp) >= sizeof (uint32_t))
2129 					break;
2130 				i -= POET_GET_LENG(ucp) + POET_HDRLEN;
2131 				ucp = POET_NEXT(ucp);
2132 			}
2133 			if (i >= POET_HDRLEN + 4)
2134 				sessid = GETLONG(ucp + POET_HDRLEN);
2135 			tcl = tcl_by_minor((minor_t)sessid);
2136 		} else {
2137 			/*
2138 			 * Try minor number as session ID first, since
2139 			 * it's used that way on server side.  It's
2140 			 * not used that way on the client, though, so
2141 			 * this might not work.  If this isn't the
2142 			 * right one, then try the tll cache.  If
2143 			 * neither is right, then search all open
2144 			 * clients.  Did I mention that the PPPoE
2145 			 * protocol is badly designed?
2146 			 */
2147 			tcl = tcl_by_minor((minor_t)sessid);
2148 			if (tcl == NULL ||
2149 			    (!isdata && tcl->tcl_ctrl_tll != tll) ||
2150 			    (isdata && tcl->tcl_data_tll != tll) ||
2151 			    sessid != tcl->tcl_rsessid ||
2152 			    bcmp(srcaddr, tcl->tcl_address.pta_pppoe.ptma_mac,
2153 			    sizeof (tcl->tcl_address.pta_pppoe.ptma_mac)) != 0)
2154 				tcl = tll->tll_lastcl;
2155 			if (tcl == NULL ||
2156 			    (!isdata && tcl->tcl_ctrl_tll != tll) ||
2157 			    (isdata && tcl->tcl_data_tll != tll) ||
2158 			    sessid != tcl->tcl_rsessid ||
2159 			    bcmp(srcaddr, tcl->tcl_address.pta_pppoe.ptma_mac,
2160 			    sizeof (tcl->tcl_address.pta_pppoe.ptma_mac)) != 0)
2161 				tcl = NULL;
2162 			if (tcl == NULL && sessid != 0) {
2163 				struct poedat poedat;
2164 
2165 				/*
2166 				 * Slow mode.  Too bad.  If you don't like it,
2167 				 * you can always choose a better protocol.
2168 				 */
2169 				poedat.sessid = sessid;
2170 				poedat.tll = tll;
2171 				poedat.srcaddr = srcaddr;
2172 				poedat.tcl = NULL;
2173 				poedat.isdata = isdata;
2174 				vmem_walk(tcl_minor_arena, VMEM_ALLOC,
2175 				    tclvm_pppoe_search, &poedat);
2176 				KLINCR(lks_walks);
2177 				if ((tcl = poedat.tcl) != NULL) {
2178 					tll->tll_lastcl = tcl;
2179 					KCINCR(cks_walks);
2180 				}
2181 			}
2182 		}
2183 		break;
2184 	}
2185 
2186 	if (tcl == NULL || tcl->tcl_rq == NULL) {
2187 		DTRACE_PROBE3(sppptun__recv__discard, int, sessid,
2188 		    tuncl_t *, tcl, mblk_t *, mp);
2189 		if (tcl == NULL) {
2190 			KLINCR(lks_in_nomatch);
2191 		}
2192 		if (isdata) {
2193 			KLINCR(lks_indata_drops);
2194 			if (tcl != NULL)
2195 				tcl->tcl_stats.ppp_ierrors++;
2196 		} else {
2197 			KLINCR(lks_inctrl_drops);
2198 			if (tcl != NULL) {
2199 				KCINCR(cks_inctrl_drops);
2200 			}
2201 		}
2202 		freemsg(mp);
2203 		return (NULL);
2204 	}
2205 
2206 	if (tcl->tcl_data_tll == tll && isdata) {
2207 		if (!adjmsg(mp, remlen) ||
2208 		    (i = msgsize(mp)) < msglen ||
2209 		    (i > msglen && !adjmsg(mp, msglen - i))) {
2210 			KLINCR(lks_indata_drops);
2211 			tcl->tcl_stats.ppp_ierrors++;
2212 			freemsg(mp);
2213 			return (NULL);
2214 		}
2215 		/* XXX -- address/control handling in pppd needs help. */
2216 		if (*mp->b_rptr != 0xFF) {
2217 			if ((mp = prependb(mp, 2, 1)) == NULL) {
2218 				KLINCR(lks_indata_drops);
2219 				tcl->tcl_stats.ppp_ierrors++;
2220 				return (NULL);
2221 			}
2222 			mp->b_rptr[0] = 0xFF;
2223 			mp->b_rptr[1] = 0x03;
2224 		}
2225 		MTYPE(mp) = M_DATA;
2226 		tcl->tcl_stats.ppp_ibytes += msgsize(mp);
2227 		tcl->tcl_stats.ppp_ipackets++;
2228 		KLINCR(lks_indata);
2229 	} else {
2230 		if (isdata || tcl->tcl_ctrl_tll != tll ||
2231 		    (mnew = make_control(tcl, tll, PTCA_CONTROL, tcl)) ==
2232 		    NULL) {
2233 			KLINCR(lks_inctrl_drops);
2234 			KCINCR(cks_inctrl_drops);
2235 			freemsg(mp);
2236 			return (NULL);
2237 		}
2238 		/* Fix up source address; peer might not be set yet. */
2239 		pap = &((struct ppptun_control *)mnew->b_rptr)->ptc_address;
2240 		bcopy(srcaddr, pap->pta_pppoe.ptma_mac,
2241 		    sizeof (pap->pta_pppoe.ptma_mac));
2242 		mnew->b_cont = mp;
2243 		mp = mnew;
2244 		KLINCR(lks_inctrls);
2245 		KCINCR(cks_inctrls);
2246 	}
2247 	*mpp = mp;
2248 	return (tcl->tcl_rq);
2249 }
2250 
2251 /*
2252  * sppptun_urput()
2253  *
2254  * MT-Perimeters:
2255  *    shared inner, shared outer.
2256  *
2257  * Description:
2258  *    Upper read-side put procedure.  Messages from the underlying
2259  *    lower stream driver arrive here.  See sppptun_recv for the
2260  *    demultiplexing logic.
2261  */
2262 static int
2263 sppptun_urput(queue_t *q, mblk_t *mp)
2264 {
2265 	union DL_primitives *dlprim;
2266 	mblk_t *mpnext;
2267 	tunll_t *tll;
2268 	queue_t *nextq;
2269 
2270 	tll = q->q_ptr;
2271 	ASSERT(!(tll->tll_flags & TLLF_NOTLOWER));
2272 
2273 	switch (MTYPE(mp)) {
2274 	case M_DATA:
2275 		/*
2276 		 * When we're bound over IP, data arrives here.  The
2277 		 * packet starts with the IP header itself.
2278 		 */
2279 		if ((nextq = sppptun_recv(q, &mp, NULL)) != NULL)
2280 			putnext(nextq, mp);
2281 		break;
2282 
2283 	case M_PROTO:
2284 	case M_PCPROTO:
2285 		/* Data arrives here for UDP or raw Ethernet, not IP. */
2286 		switch (tll->tll_style) {
2287 			/* PPTP control messages are over TCP only. */
2288 		case PTS_PPTP:
2289 		default:
2290 			ASSERT(0);	/* how'd that happen? */
2291 			break;
2292 
2293 		case PTS_PPPOE:		/* DLPI message */
2294 			if (MBLKL(mp) < sizeof (t_uscalar_t))
2295 				break;
2296 			dlprim = (union DL_primitives *)mp->b_rptr;
2297 			switch (dlprim->dl_primitive) {
2298 			case DL_UNITDATA_IND: {
2299 				size_t mlen = MBLKL(mp);
2300 
2301 				if (mlen < DL_UNITDATA_IND_SIZE)
2302 					break;
2303 				if (dlprim->unitdata_ind.dl_src_addr_offset <
2304 				    DL_UNITDATA_IND_SIZE ||
2305 				    dlprim->unitdata_ind.dl_src_addr_offset +
2306 				    dlprim->unitdata_ind.dl_src_addr_length >
2307 				    mlen)
2308 					break;
2309 			}
2310 				/* FALLTHROUGH */
2311 			case DL_UNITDATA_REQ:	/* For loopback support. */
2312 				if (dlprim->dl_primitive == DL_UNITDATA_REQ &&
2313 				    MBLKL(mp) < DL_UNITDATA_REQ_SIZE)
2314 					break;
2315 				if ((mpnext = mp->b_cont) == NULL)
2316 					break;
2317 				MTYPE(mpnext) = M_DATA;
2318 				nextq = sppptun_recv(q, &mpnext,
2319 				    dlprim->dl_primitive == DL_UNITDATA_IND ?
2320 				    mp->b_rptr +
2321 				    dlprim->unitdata_ind.dl_src_addr_offset :
2322 				    tll->tll_lcladdr.pta_pppoe.ptma_mac);
2323 				if (nextq != NULL)
2324 					putnext(nextq, mpnext);
2325 				freeb(mp);
2326 				return (0);
2327 
2328 			default:
2329 				urput_dlpi(q, mp);
2330 				return (0);
2331 			}
2332 			break;
2333 		}
2334 		freemsg(mp);
2335 		break;
2336 
2337 	default:
2338 		freemsg(mp);
2339 		break;
2340 	}
2341 	return (0);
2342 }
2343 
2344 /*
2345  * sppptun_ursrv()
2346  *
2347  * MT-Perimeters:
2348  *    exclusive inner, shared outer.
2349  *
2350  * Description:
2351  *    Upper read-side service procedure.  This procedure services the
2352  *    client streams.  We get here because the client (PPP) asserts
2353  *    flow control down to us.
2354  */
2355 static int
2356 sppptun_ursrv(queue_t *q)
2357 {
2358 	mblk_t		*mp;
2359 
2360 	ASSERT(q->q_ptr != NULL);
2361 
2362 	while ((mp = getq(q)) != NULL) {
2363 		if (canputnext(q)) {
2364 			putnext(q, mp);
2365 		} else {
2366 			(void) putbq(q, mp);
2367 			break;
2368 		}
2369 	}
2370 	return (0);
2371 }
2372 
2373 /*
2374  * Dummy constructor/destructor functions for kmem_cache_create.
2375  * We're just using kmem as an allocator of integers, not real
2376  * storage.
2377  */
2378 
2379 /*ARGSUSED*/
2380 static int
2381 tcl_constructor(void *maddr, void *arg, int kmflags)
2382 {
2383 	return (0);
2384 }
2385 
2386 /*ARGSUSED*/
2387 static void
2388 tcl_destructor(void *maddr, void *arg)
2389 {
2390 }
2391 
2392 /*
2393  * Total size occupied by one tunnel client.  Each tunnel client
2394  * consumes one pointer for tcl_slots array, one tuncl_t structure and
2395  * two messages preallocated for close.
2396  */
2397 #define	TUNCL_SIZE (sizeof (tuncl_t) + sizeof (tuncl_t *) + \
2398 			2 * sizeof (dblk_t))
2399 
2400 /*
2401  * Clear all bits of x except the highest bit
2402  */
2403 #define	truncate(x)	((x) <= 2 ? (x) : (1 << (highbit(x) - 1)))
2404 
2405 /*
2406  * This function initializes some well-known global variables inside
2407  * the module.
2408  *
2409  * Called by sppptun_mod.c:_init() before installing the module.
2410  */
2411 void
2412 sppptun_init(void)
2413 {
2414 	tunll_list.q_forw = tunll_list.q_back = &tunll_list;
2415 }
2416 
2417 /*
2418  * This function allocates the initial internal storage for the
2419  * sppptun driver.
2420  *
2421  * Called by sppptun_mod.c:_init() after installing module.
2422  */
2423 void
2424 sppptun_tcl_init(void)
2425 {
2426 	uint_t i, j;
2427 
2428 	rw_init(&tcl_rwlock, NULL, RW_DRIVER, NULL);
2429 	rw_enter(&tcl_rwlock, RW_WRITER);
2430 	tcl_nslots = sppptun_init_cnt;
2431 	tcl_slots = kmem_zalloc(tcl_nslots * sizeof (tuncl_t *), KM_SLEEP);
2432 
2433 	tcl_cache = kmem_cache_create("sppptun_map", sizeof (tuncl_t), 0,
2434 	    tcl_constructor, tcl_destructor, NULL, NULL, NULL, 0);
2435 
2436 	/* Allocate integer space for minor numbers */
2437 	tcl_minor_arena = vmem_create("sppptun_minor", (void *)1, tcl_nslots,
2438 	    1, NULL, NULL, NULL, 0, VM_SLEEP | VMC_IDENTIFIER);
2439 
2440 	/*
2441 	 * Calculate available number of tunnels - how many tunnels
2442 	 * can we allocate in sppptun_pctofmem % of available
2443 	 * memory.  The value is rounded up to the nearest power of 2.
2444 	 */
2445 	i = (sppptun_pctofmem * kmem_maxavail()) / (100 * TUNCL_SIZE);
2446 	j = truncate(i);	/* i with non-high bits stripped */
2447 	if (i != j)
2448 		j *= 2;
2449 	tcl_minormax = j;
2450 	rw_exit(&tcl_rwlock);
2451 }
2452 
2453 /*
2454  * This function checks that there are no plumbed streams or other users.
2455  *
2456  * Called by sppptun_mod.c:_fini().  Assumes that we're exclusive on
2457  * both perimeters.
2458  */
2459 int
2460 sppptun_tcl_fintest(void)
2461 {
2462 	if (tunll_list.q_forw != &tunll_list || tcl_inuse > 0)
2463 		return (EBUSY);
2464 	else
2465 		return (0);
2466 }
2467 
2468 /*
2469  * If no lower streams are plumbed, then this function deallocates all
2470  * internal storage in preparation for unload.
2471  *
2472  * Called by sppptun_mod.c:_fini().  Assumes that we're exclusive on
2473  * both perimeters.
2474  */
2475 void
2476 sppptun_tcl_fini(void)
2477 {
2478 	if (tcl_minor_arena != NULL) {
2479 		vmem_destroy(tcl_minor_arena);
2480 		tcl_minor_arena = NULL;
2481 	}
2482 	if (tcl_cache != NULL) {
2483 		kmem_cache_destroy(tcl_cache);
2484 		tcl_cache = NULL;
2485 	}
2486 	kmem_free(tcl_slots, tcl_nslots * sizeof (tuncl_t *));
2487 	tcl_slots = NULL;
2488 	rw_destroy(&tcl_rwlock);
2489 	ASSERT(tcl_slots == NULL);
2490 	ASSERT(tcl_cache == NULL);
2491 	ASSERT(tcl_minor_arena == NULL);
2492 }
2493