xref: /titanic_50/usr/src/uts/common/io/rlmod.c (revision 0a1278f26ea4b7c8c0285d4f2d6c5b680904aa01)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * This module implements the services provided by the rlogin daemon
31  * after the connection is set up.  Mainly this means responding to
32  * interrupts and window size changes.  It begins operation in "disabled"
33  * state, and sends a T_DATA_REQ to the daemon to indicate that it is
34  * in place and ready to be enabled.  The daemon can then know when all
35  * data which sneaked passed rlmod (before it was pushed) has been received.
36  * The daemon may process this data, or send data back to be inserted in
37  * the read queue at the head with the RL_IOC_ENABLE ioctl.
38  */
39 
40 #include <sys/types.h>
41 #include <sys/param.h>
42 #include <sys/stream.h>
43 #include <sys/stropts.h>
44 #include <sys/strsun.h>
45 #include <sys/kmem.h>
46 #include <sys/errno.h>
47 #include <sys/ddi.h>
48 #include <sys/sunddi.h>
49 #include <sys/tihdr.h>
50 #include <sys/ptem.h>
51 #include <sys/conf.h>
52 #include <sys/debug.h>
53 #include <sys/modctl.h>
54 #include <sys/vtrace.h>
55 #include <sys/rlioctl.h>
56 #include <sys/termios.h>
57 #include <sys/termio.h>
58 #include <sys/byteorder.h>
59 #include <sys/cmn_err.h>
60 #include <sys/cryptmod.h>
61 
62 extern struct streamtab rloginmodinfo;
63 
64 static struct fmodsw fsw = {
65 	"rlmod",
66 	&rloginmodinfo,
67 	D_MTQPAIR | D_MP
68 };
69 
70 /*
71  * Module linkage information for the kernel.
72  */
73 
74 static struct modlstrmod modlstrmod = {
75 	&mod_strmodops,
76 	"rloginmod module",
77 	&fsw
78 };
79 
80 static struct modlinkage modlinkage = {
81 	MODREV_1, &modlstrmod, NULL
82 };
83 
84 
85 int
86 _init(void)
87 {
88 	return (mod_install(&modlinkage));
89 }
90 
91 int
92 _fini(void)
93 {
94 	return (mod_remove(&modlinkage));
95 }
96 
97 int
98 _info(struct modinfo *modinfop)
99 {
100 	return (mod_info(&modlinkage, modinfop));
101 }
102 
103 struct rlmod_info; /* forward reference for function prototype */
104 
105 static int		rlmodopen(queue_t *, dev_t *, int, int, cred_t *);
106 static int		rlmodclose(queue_t *, int, cred_t *);
107 static int		rlmodrput(queue_t *, mblk_t *);
108 static int		rlmodrsrv(queue_t *);
109 static int		rlmodwput(queue_t *, mblk_t *);
110 static int		rlmodwsrv(queue_t *);
111 static int		rlmodrmsg(queue_t *, mblk_t *);
112 static mblk_t		*make_expmblk(char);
113 static int 		rlwinctl(queue_t *, mblk_t *);
114 static mblk_t		*rlwinsetup(queue_t *, mblk_t *, unsigned char *);
115 
116 static void		rlmod_timer(void *);
117 static void		rlmod_buffer(void *);
118 static boolean_t	tty_flow(queue_t *, struct rlmod_info *, mblk_t *);
119 static boolean_t	rlmodwioctl(queue_t *, mblk_t *);
120 static void		recover(queue_t *, mblk_t *, size_t);
121 static void		recover1(queue_t *, size_t);
122 
123 #define	RLMOD_ID	106
124 #define	SIMWAIT		(1*hz)
125 
126 /*
127  * Stream module data structure definitions.
128  * generally pushed onto tcp by rlogin daemon
129  *
130  */
131 static	struct	module_info	rloginmodiinfo = {
132 	RLMOD_ID,				/* module id number */
133 	"rlmod",				/* module name */
134 	0,					/* minimum packet size */
135 	INFPSZ,					/* maximum packet size */
136 	512,					/* hi-water mark */
137 	256					/* lo-water mark */
138 };
139 
140 static	struct	qinit	rloginmodrinit = {
141 	rlmodrput,
142 	rlmodrsrv,
143 	rlmodopen,
144 	rlmodclose,
145 	nulldev,
146 	&rloginmodiinfo,
147 	NULL
148 };
149 
150 static	struct	qinit	rloginmodwinit = {
151 	rlmodwput,
152 	rlmodwsrv,
153 	NULL,
154 	NULL,
155 	nulldev,
156 	&rloginmodiinfo,
157 	NULL
158 };
159 
160 struct	streamtab	rloginmodinfo = {
161 	&rloginmodrinit,
162 	&rloginmodwinit,
163 	NULL,
164 	NULL
165 };
166 
167 /*
168  * Per-instance state struct for the rloginmod module.
169  */
170 struct rlmod_info
171 {
172 	int		flags;
173 	bufcall_id_t	wbufcid;
174 	bufcall_id_t	rbufcid;
175 	timeout_id_t	wtimoutid;
176 	timeout_id_t	rtimoutid;
177 	int		rl_expdat;
178 	int		stopmode;
179 	mblk_t		*unbind_mp;
180 	char		startc;
181 	char		stopc;
182 	char		oobdata[1];
183 	mblk_t		*wndw_sz_hd_mp;
184 };
185 
186 /*
187  * Flag used in flags
188  */
189 #define	RL_DISABLED	0x1
190 #define	RL_IOCPASSTHRU	0x2
191 
192 /*ARGSUSED*/
193 static void
194 dummy_callback(void *arg)
195 {}
196 
197 /*
198  * rlmodopen - open routine gets called when the
199  *	    module gets pushed onto the stream.
200  */
201 /*ARGSUSED*/
202 static int
203 rlmodopen(queue_t *q, dev_t *devp, int oflag, int sflag, cred_t *cred)
204 {
205 	struct rlmod_info	*rmip;
206 	union T_primitives *tp;
207 	mblk_t *bp;
208 	int	error;
209 
210 	if (sflag != MODOPEN)
211 		return (EINVAL);
212 
213 	if (q->q_ptr != NULL) {
214 		/* It's already attached. */
215 		return (0);
216 	}
217 
218 	/*
219 	 * Allocate state structure.
220 	 */
221 	rmip = kmem_zalloc(sizeof (*rmip), KM_SLEEP);
222 
223 	/*
224 	 * Cross-link.
225 	 */
226 	q->q_ptr = rmip;
227 	WR(q)->q_ptr = rmip;
228 	rmip->rl_expdat = 0;
229 	rmip->stopmode = TIOCPKT_DOSTOP;
230 	rmip->startc = CTRL('q');
231 	rmip->stopc = CTRL('s');
232 	rmip->oobdata[0] = (char)TIOCPKT_WINDOW;
233 	rmip->wndw_sz_hd_mp = NULL;
234 	/*
235 	 * Allow only non-M_DATA blocks to pass up to in.rlogind until
236 	 * it is ready for M_DATA (indicated by RL_IOC_ENABLE).
237 	 */
238 	rmip->flags |= RL_DISABLED;
239 
240 	qprocson(q);
241 
242 	/*
243 	 * Since TCP operates in the TLI-inspired brain-dead fashion,
244 	 * the connection will revert to bound state if the connection
245 	 * is reset by the client.  We must send a T_UNBIND_REQ in
246 	 * that case so the port doesn't get "wedged" (preventing
247 	 * inetd from being able to restart the listener).  Allocate
248 	 * it here, so that we don't need to worry about allocb()
249 	 * failures later.
250 	 */
251 	while ((rmip->unbind_mp = allocb(sizeof (union T_primitives),
252 	    BPRI_HI)) == NULL) {
253 		bufcall_id_t id = qbufcall(q, sizeof (union T_primitives),
254 		    BPRI_HI, dummy_callback, NULL);
255 		if (!qwait_sig(q)) {
256 			qunbufcall(q, id);
257 			error = EINTR;
258 			goto fail;
259 		}
260 		qunbufcall(q, id);
261 	}
262 	rmip->unbind_mp->b_wptr = rmip->unbind_mp->b_rptr +
263 	    sizeof (struct T_unbind_req);
264 	rmip->unbind_mp->b_datap->db_type = M_PROTO;
265 	tp = (union T_primitives *)rmip->unbind_mp->b_rptr;
266 	tp->type = T_UNBIND_REQ;
267 
268 	/*
269 	 * Send a M_PROTO msg of type T_DATA_REQ (this is unique for
270 	 * read queue since only write queue can get T_DATA_REQ).
271 	 * Readstream routine in the daemon will do a getmsg() till
272 	 * it receives this proto message.
273 	 */
274 	while ((bp = allocb(sizeof (union T_primitives), BPRI_HI)) == NULL) {
275 		bufcall_id_t id = qbufcall(q, sizeof (union T_primitives),
276 		    BPRI_HI, dummy_callback, NULL);
277 		if (!qwait_sig(q)) {
278 			qunbufcall(q, id);
279 			error = EINTR;
280 			goto fail;
281 		}
282 		qunbufcall(q, id);
283 	}
284 	bp->b_datap->db_type = M_PROTO;
285 	bp->b_wptr = bp->b_rptr + sizeof (union T_primitives);
286 	tp = (union T_primitives *)bp->b_rptr;
287 	tp->type = T_DATA_REQ;
288 	tp->data_req.MORE_flag = 0;
289 
290 	putnext(q, bp);
291 	return (0);
292 fail:
293 	qprocsoff(q);
294 	if (rmip->unbind_mp != NULL) {
295 		freemsg(rmip->unbind_mp);
296 	}
297 	kmem_free(rmip, sizeof (struct rlmod_info));
298 	q->q_ptr = NULL;
299 	WR(q)->q_ptr = NULL;
300 	return (error);
301 }
302 
303 
304 /*
305  * rlmodclose - This routine gets called when the module
306  *	gets popped off of the stream.
307  */
308 
309 /*ARGSUSED*/
310 static int
311 rlmodclose(queue_t *q, int flag, cred_t *credp)
312 {
313 	struct rlmod_info   *rmip = (struct rlmod_info *)q->q_ptr;
314 	mblk_t  *mp;
315 
316 	/*
317 	 * Flush any write-side data downstream.  Ignoring flow
318 	 * control at this point is known to be safe because the
319 	 * M_HANGUP below poisons the stream such that no modules can
320 	 * be pushed again.
321 	 */
322 	while (mp = getq(WR(q)))
323 		putnext(WR(q), mp);
324 
325 	/* Poison the stream head so that we can't be pushed again. */
326 	(void) putnextctl(q, M_HANGUP);
327 
328 	qprocsoff(q);
329 	if (rmip->wbufcid) {
330 		qunbufcall(q, rmip->wbufcid);
331 		rmip->wbufcid = 0;
332 	}
333 	if (rmip->rbufcid) {
334 		qunbufcall(q, rmip->rbufcid);
335 		rmip->rbufcid = 0;
336 	}
337 	if (rmip->wtimoutid) {
338 		(void) quntimeout(q, rmip->wtimoutid);
339 		rmip->wtimoutid = 0;
340 	}
341 	if (rmip->rtimoutid) {
342 		(void) quntimeout(q, rmip->rtimoutid);
343 		rmip->rtimoutid = 0;
344 	}
345 
346 	if (rmip->unbind_mp != NULL) {
347 		freemsg(rmip->unbind_mp);
348 	}
349 
350 	if (rmip->wndw_sz_hd_mp != NULL) {
351 		freemsg(rmip->wndw_sz_hd_mp);
352 	}
353 
354 	kmem_free(q->q_ptr, sizeof (struct rlmod_info));
355 	q->q_ptr = WR(q)->q_ptr = NULL;
356 	return (0);
357 }
358 
359 /*
360  * rlmodrput - Module read queue put procedure.
361  *	This is called from the module or
362  *	driver downstream.
363  */
364 
365 static int
366 rlmodrput(queue_t *q, mblk_t *mp)
367 {
368 	struct rlmod_info    *rmip = (struct rlmod_info *)q->q_ptr;
369 	union T_primitives *tip;
370 
371 	TRACE_2(TR_FAC_RLOGINP, TR_RLOGINP_RPUT_IN, "rlmodrput start: "
372 	    "q %p, mp %p", q, mp);
373 
374 
375 	/* if low (normal) priority... */
376 	if ((mp->b_datap->db_type < QPCTL) &&
377 	    /* ...and data is already queued... */
378 	    ((q->q_first) ||
379 		/* ...or currently disabled and this is M_DATA... */
380 		((rmip->flags & RL_DISABLED) &&
381 		    (mp->b_datap->db_type == M_DATA)))) {
382 		/* ...delay delivery of the message */
383 		(void) putq(q, mp);
384 		TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_RPUT_OUT,
385 		    "rlmodrput end: q %p, mp %p, %s", q, mp, "flow");
386 		return (0);
387 	}
388 
389 	switch (mp->b_datap->db_type) {
390 
391 	case M_PROTO:
392 	case M_PCPROTO:
393 		tip = (union T_primitives *)mp->b_rptr;
394 		switch (tip->type) {
395 
396 		case T_ORDREL_IND:
397 		case T_DISCON_IND:
398 			/* Make into M_HANGUP and putnext */
399 			mp->b_datap->db_type = M_HANGUP;
400 			mp->b_wptr = mp->b_rptr;
401 			if (mp->b_cont) {
402 				freemsg(mp->b_cont);
403 				mp->b_cont = NULL;
404 			}
405 			/*
406 			 * If we haven't already, send T_UNBIND_REQ to prevent
407 			 * TCP from going into "BOUND" state and locking up the
408 			 * port.
409 			 */
410 			if (tip->type == T_DISCON_IND && rmip->unbind_mp !=
411 			    NULL) {
412 				putnext(q, mp);
413 				qreply(q, rmip->unbind_mp);
414 				rmip->unbind_mp = NULL;
415 			} else {
416 				putnext(q, mp);
417 			}
418 			break;
419 
420 		/*
421 		 * We only get T_OK_ACK when we issue the unbind, and it can
422 		 * be ignored safely.
423 		 */
424 		case T_OK_ACK:
425 			ASSERT(rmip->unbind_mp == NULL);
426 			freemsg(mp);
427 			break;
428 
429 		default:
430 			cmn_err(CE_NOTE,
431 			    "rlmodrput: got 0x%x type M_PROTO/M_PCPROTO msg",
432 			    tip->type);
433 			freemsg(mp);
434 		}
435 		break;
436 
437 	case M_DATA:
438 		if (canputnext(q) && q->q_first == NULL) {
439 			(void) rlmodrmsg(q, mp);
440 		} else {
441 			(void) putq(q, mp);
442 		}
443 		break;
444 
445 	case M_FLUSH:
446 		/*
447 		 * Since M_FLUSH came from TCP, we mark it bound for
448 		 * daemon, not tty.  This only happens when TCP expects
449 		 * to do a connection reset.
450 		 */
451 		mp->b_flag |= MSGMARK;
452 		if (*mp->b_rptr & FLUSHR)
453 			flushq(q, FLUSHALL);
454 
455 		putnext(q, mp);
456 		break;
457 
458 	case M_PCSIG:
459 	case M_ERROR:
460 	case M_IOCACK:
461 	case M_IOCNAK:
462 	case M_SETOPTS:
463 		if (mp->b_datap->db_type <= QPCTL && !canputnext(q))
464 			(void) putq(q, mp);
465 		else
466 			putnext(q, mp);
467 		break;
468 
469 	default:
470 #ifdef DEBUG
471 		cmn_err(CE_NOTE, "rlmodrput: unexpected msg type 0x%x",
472 		    mp->b_datap->db_type);
473 #endif
474 		freemsg(mp);
475 	}
476 	TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_RPUT_OUT, "rlmodrput end: q %p, "
477 		"mp %p, %s", q, mp, "done");
478 	return (0);
479 }
480 
481 /*
482  * rlmodrsrv - module read service procedure
483  */
484 static int
485 rlmodrsrv(queue_t *q)
486 {
487 	mblk_t	*mp;
488 	struct rlmod_info    *rmip = (struct rlmod_info *)q->q_ptr;
489 	union T_primitives *tip;
490 
491 	TRACE_1(TR_FAC_RLOGINP, TR_RLOGINP_RSRV_IN, "rlmodrsrv start: "
492 	    "q %p", q);
493 	while ((mp = getq(q)) != NULL) {
494 
495 		switch (mp->b_datap->db_type) {
496 		case M_DATA:
497 			if (rmip->flags & RL_DISABLED) {
498 				(void) putbq(q, mp);
499 				TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_RSRV_OUT,
500 					"rlmodrsrv end: q %p, mp %p, %s", q, mp,
501 					"disabled");
502 				return (0);
503 			}
504 			if (!canputnext(q)) {
505 				(void) putbq(q, mp);
506 				TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_RSRV_OUT,
507 				    "rlmodrsrv end: q %p, mp %p, %s",
508 				    q, mp, "!canputnext");
509 				return (0);
510 			}
511 			if (!rlmodrmsg(q, mp)) {
512 				TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_RSRV_OUT,
513 				    "rlmodrsrv end: q %p, mp %p, %s",
514 				    q, mp, "!rlmodrmsg");
515 				return (0);
516 			}
517 			break;
518 
519 		case M_PROTO:
520 			tip = (union T_primitives *)mp->b_rptr;
521 			switch (tip->type) {
522 
523 			case T_ORDREL_IND:
524 			case T_DISCON_IND:
525 				/* Make into M_HANGUP and putnext */
526 				mp->b_datap->db_type = M_HANGUP;
527 				mp->b_wptr = mp->b_rptr;
528 				if (mp->b_cont) {
529 					freemsg(mp->b_cont);
530 					mp->b_cont = NULL;
531 				}
532 				/*
533 				 * If we haven't already, send T_UNBIND_REQ
534 				 * to prevent TCP from going into "BOUND"
535 				 * state and locking up the port.
536 				 */
537 				if (tip->type == T_DISCON_IND &&
538 				    rmip->unbind_mp != NULL) {
539 					putnext(q, mp);
540 					qreply(q, rmip->unbind_mp);
541 					rmip->unbind_mp = NULL;
542 				} else {
543 					putnext(q, mp);
544 				}
545 				break;
546 
547 			/*
548 			 * We only get T_OK_ACK when we issue the unbind, and
549 			 * it can be ignored safely.
550 			 */
551 			case T_OK_ACK:
552 				ASSERT(rmip->unbind_mp == NULL);
553 				freemsg(mp);
554 				break;
555 
556 			default:
557 				cmn_err(CE_NOTE,
558 				    "rlmodrsrv: got 0x%x type PROTO msg",
559 				    tip->type);
560 				freemsg(mp);
561 			}
562 			break;
563 
564 		case M_SETOPTS:
565 			if (!canputnext(q)) {
566 				(void) putbq(q, mp);
567 				TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_RSRV_OUT,
568 				    "rlmodrsrv end: q %p, mp %p, %s",
569 				    q, mp, "!canputnext M_SETOPTS");
570 				return (0);
571 			}
572 			putnext(q, mp);
573 			break;
574 
575 		default:
576 #ifdef DEBUG
577 			cmn_err(CE_NOTE,
578 			    "rlmodrsrv: unexpected msg type 0x%x",
579 			    mp->b_datap->db_type);
580 #endif
581 			freemsg(mp);
582 		}
583 	}
584 
585 	TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_RSRV_OUT, "rlmodrsrv end: q %p, "
586 	    "mp %p, %s", q, mp, "empty");
587 
588 	return (0);
589 }
590 
591 /*
592  * rlmodwput - Module write queue put procedure.
593  *	All non-zero messages are send downstream unchanged
594  */
595 static int
596 rlmodwput(queue_t *q, mblk_t *mp)
597 {
598 	char cntl;
599 	struct rlmod_info *rmip = (struct rlmod_info *)q->q_ptr;
600 	mblk_t *tmpmp;
601 	int rw;
602 
603 	TRACE_2(TR_FAC_RLOGINP, TR_RLOGINP_WPUT_IN, "rlmodwput start: "
604 	    "q %p, mp %p", q, mp);
605 
606 	if (rmip->rl_expdat) {
607 		/*
608 		 * call make_expmblk to create an expedited
609 		 * message block.
610 		 */
611 		cntl = rmip->oobdata[0] | TIOCPKT_FLUSHWRITE;
612 
613 		if (!canputnext(q)) {
614 			(void) putq(q, mp);
615 			TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WPUT_OUT,
616 			    "rlmodwput end: q %p, mp %p, %s",
617 			    q, mp, "expdata && !canputnext");
618 			return (0);
619 		}
620 		if ((tmpmp = make_expmblk(cntl))) {
621 			putnext(q, tmpmp);
622 			rmip->rl_expdat = 0;
623 		} else {
624 			recover1(q, sizeof (mblk_t)); /* XXX.sparker */
625 		}
626 	}
627 
628 	if ((q->q_first || rmip->rl_expdat) && mp->b_datap->db_type < QPCTL) {
629 		(void) putq(q, mp);
630 		TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WPUT_OUT, "rlmodwput end: "
631 		    "q %p, mp %p, %s", q, mp, "queued data");
632 		return (0);
633 	}
634 	switch (mp->b_datap->db_type) {
635 
636 	case M_DATA:
637 		if (!canputnext(q))
638 			(void) putq(q, mp);
639 		else
640 			putnext(q, mp);
641 		break;
642 
643 	case M_FLUSH:
644 		/*
645 		 * We must take care to create and forward out-of-band data
646 		 * indicating the flush to the far side.
647 		 */
648 		rw = *mp->b_rptr;
649 		*mp->b_rptr &= ~FLUSHW;
650 		qreply(q, mp);
651 		if (rw & FLUSHW) {
652 			/*
653 			 * Since all rlogin protocol data is sent in this
654 			 * direction as urgent data, and TCP does not flush
655 			 * urgent data, it is okay to actually forward this
656 			 * flush.  (telmod cannot.)
657 			 */
658 			flushq(q, FLUSHDATA);
659 			/*
660 			 * The putnextctl1() call can only fail if we're
661 			 * out of memory.  Ideally, we might set a state
662 			 * bit and reschedule ourselves when memory
663 			 * becomes available, so we make sure not to miss
664 			 * sending the FLUSHW to TCP before the urgent
665 			 * byte.  Not doing this just means in some cases
666 			 * a bit more trash passes before the flush takes
667 			 * hold.
668 			 */
669 			(void) putnextctl1(q, M_FLUSH, FLUSHW);
670 			/*
671 			 * Notify peer of the write flush request.
672 			 */
673 			cntl = rmip->oobdata[0] | TIOCPKT_FLUSHWRITE;
674 			if (!canputnext(q)) {
675 				TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WPUT_OUT,
676 				    "rlmodwput end: q %p, mp %p, %s",
677 				    q, mp, "flushw && !canputnext");
678 				return (0);
679 			}
680 			if ((mp = make_expmblk(cntl)) == NULL) {
681 				rmip->rl_expdat = 1;
682 				recover1(q, sizeof (mblk_t));
683 				TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WPUT_OUT,
684 				    "rlmodwput end: q %p, mp %p, %s",
685 				    q, mp, "!make_expmblk");
686 				return (0);
687 			}
688 			putnext(q, mp);
689 		}
690 		break;
691 
692 	case M_IOCTL:
693 		if (!rlmodwioctl(q, mp))
694 			(void) putq(q, mp);
695 		break;
696 
697 	case M_PROTO:
698 		switch (((union T_primitives *)mp->b_rptr)->type) {
699 		case T_EXDATA_REQ:
700 		case T_ORDREL_REQ:
701 		case T_DISCON_REQ:
702 			putnext(q, mp);
703 			break;
704 
705 		default:
706 #ifdef DEBUG
707 			cmn_err(CE_NOTE,
708 			    "rlmodwput: unexpected TPI primitive 0x%x",
709 			    ((union T_primitives *)mp->b_rptr)->type);
710 #endif
711 			freemsg(mp);
712 		}
713 		break;
714 
715 	case M_PCPROTO:
716 		if (((struct T_exdata_req *)mp->b_rptr)->PRIM_type ==
717 		    T_DISCON_REQ) {
718 			putnext(q, mp);
719 		} else {
720 			/* XXX.sparker Log unexpected message */
721 			freemsg(mp);
722 		}
723 		break;
724 
725 	default:
726 #ifdef DEBUG
727 		cmn_err(CE_NOTE,
728 		    "rlmodwput: unexpected msg type 0x%x",
729 		    mp->b_datap->db_type);
730 #endif
731 		freemsg(mp);
732 		break;
733 	}
734 	TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WPUT_OUT, "rlmodwput end: "
735 	    "q %p, mp %p, %s", q, mp, "done");
736 	return (0);
737 }
738 
739 /*
740  * rlmodwsrv - module write service procedure
741  */
742 static int
743 rlmodwsrv(queue_t *q)
744 {
745 	mblk_t	*mp, *tmpmp;
746 	char cntl;
747 	struct rlmod_info *rmip = (struct rlmod_info *)q->q_ptr;
748 
749 	TRACE_1(TR_FAC_RLOGINP, TR_RLOGINP_WSRV_IN, "rlmodwsrv "
750 	    "start: q %p", q);
751 	if (rmip->rl_expdat) {
752 		/*
753 		 * call make_expmblk to create an expedited
754 		 * message block.
755 		 */
756 		cntl = rmip->oobdata[0] | TIOCPKT_FLUSHWRITE;
757 		if (!canputnext(q)) {
758 			TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WSRV_OUT,
759 			    "rlmodwsrv end: q %p, mp %p, %s",
760 			    q, NULL, "!canputnext && expdat");
761 			return (0);
762 		}
763 		if ((tmpmp = make_expmblk(cntl))) {
764 			putnext(q, tmpmp);
765 			rmip->rl_expdat = 0;
766 		} else {
767 			recover1(q, sizeof (mblk_t));
768 			TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WSRV_OUT,
769 			    "rlmodwsrv end: q %p, mp %p, %s",
770 			    q, NULL, "!make_expmblk");
771 			return (0);
772 		}
773 	}
774 	while ((mp = getq(q)) != NULL) {
775 
776 		if (!canputnext(q) || rmip->rl_expdat) {
777 			(void) putbq(q, mp);
778 			TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WSRV_OUT,
779 			    "rlmodwsrv end: q %p, mp %p, %s",
780 			    q, mp, "!canputnext || expdat");
781 			return (0);
782 		}
783 		if (mp->b_datap->db_type == M_IOCTL) {
784 			if (!rlmodwioctl(q, mp)) {
785 				TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WSRV_OUT,
786 				    "rlmodwsrv end: q %p, mp %p, %s",
787 				    q, mp, "!rlmodwioctl");
788 				(void) putbq(q, mp);
789 				return (0);
790 			}
791 			continue;
792 		}
793 		putnext(q, mp);
794 	}
795 	TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WSRV_OUT, "rlmodwsrv end: q %p, "
796 	    "mp %p, %s", q, mp, "done");
797 	return (0);
798 }
799 
800 /*
801  * This routine returns a message block with an expedited
802  * data request
803  */
804 static mblk_t *
805 make_expmblk(char cntl)
806 {
807 	mblk_t *mp;
808 	mblk_t *bp;
809 	struct T_exdata_req	*data_req;
810 
811 	bp = allocb(sizeof (struct T_exdata_req), BPRI_MED);
812 	if (bp == NULL)
813 		return (NULL);
814 	if ((mp = allocb(sizeof (char), BPRI_MED)) == NULL) {
815 		freeb(bp);
816 		return (NULL);
817 	}
818 	bp->b_datap->db_type = M_PROTO;
819 	data_req = (struct T_exdata_req *)bp->b_rptr;
820 	data_req->PRIM_type = T_EXDATA_REQ;
821 	data_req->MORE_flag = 0;
822 
823 	bp->b_wptr += sizeof (struct T_exdata_req);
824 	/*
825 	 * Send a 1 byte data message block with appropriate
826 	 * control character.
827 	 */
828 	mp->b_datap->db_type = M_DATA;
829 	mp->b_wptr = mp->b_rptr + 1;
830 	(*(char *)(mp->b_rptr)) = cntl;
831 	bp->b_cont = mp;
832 	return (bp);
833 }
834 /*
835  * This routine parses M_DATA messages checking for window size protocol
836  * from a given message block.  It returns TRUE if no resource exhaustion
837  * conditions are found.  This is for use in the service procedure, which
838  * needs to know whether to continue, or stop processing the queue.
839  */
840 static int
841 rlmodrmsg(queue_t *q, mblk_t *mp)
842 {
843 	unsigned char *tmp, *tmp1;
844 	mblk_t	*newmp;
845 	size_t	sz;
846 	ssize_t	count, newcount = 0;
847 	struct	rlmod_info	*rmip = (struct rlmod_info *)q->q_ptr;
848 
849 	/*
850 	 * Eliminate any zero length messages here, so we don't filter EOFs
851 	 * accidentally.
852 	 */
853 	if (msgdsize(mp) == 0) {
854 		ASSERT(rmip->wndw_sz_hd_mp == NULL);
855 		goto out;
856 	}
857 	/*
858 	 * Check if we have stored a previous message block because a window
859 	 * update was split over TCP segments. If so, append the new one to
860 	 * the stored one and process the stored one as if it just arrived.
861 	 */
862 	if (rmip->wndw_sz_hd_mp != NULL) {
863 		linkb(rmip->wndw_sz_hd_mp, mp);
864 		mp = rmip->wndw_sz_hd_mp;
865 		rmip->wndw_sz_hd_mp = NULL;
866 	}
867 	newmp = mp;
868 
869 	while (mp) {
870 		tmp = mp->b_rptr;
871 		/*
872 		 * scan through the entire message block
873 		 */
874 		while (tmp < mp->b_wptr) {
875 			/*
876 			 * check for FF (rlogin magic escape sequence)
877 			 */
878 			if (tmp[0] == RLOGIN_MAGIC) {
879 				/*
880 				 * Update bytes read so far.
881 				 */
882 				count = newcount + tmp - mp->b_rptr;
883 				/*
884 				 * Pull together message chain in case
885 				 * window escape is split across blocks.
886 				 */
887 				if ((pullupmsg(newmp, -1)) == 0) {
888 					sz = msgdsize(newmp);
889 					recover(q, newmp, sz);
890 					return (NULL);
891 				}
892 				/*
893 				 * pullupmsg results in newmp consuming
894 				 * all message blocks in this chain, and
895 				 * therefor mp wants updating.
896 				 */
897 				mp = newmp;
898 
899 				/*
900 				 * adjust tmp to where we
901 				 * stopped - count keeps track
902 				 * of bytes read so far.
903 				 * reset newcount = 0.
904 				 */
905 				tmp = mp->b_rptr + count;
906 				newcount = 0;
907 
908 				/*
909 				 * Use the variable tmp1 to compute where
910 				 * the end of the window escape (currently
911 				 * the only rlogin protocol sequence), then
912 				 * check to see if we got all those bytes.
913 				 */
914 				tmp1 = tmp + 4 + sizeof (struct winsize);
915 
916 				if (tmp1 > mp->b_wptr) {
917 					/*
918 					 * All the window escape bytes aren't
919 					 * in this TCP segment. Store this
920 					 * mblk to one side so we can append
921 					 * the rest of the escape to it when
922 					 * its segment arrives.
923 					 */
924 					rmip->wndw_sz_hd_mp = mp;
925 					return (TRUE);
926 				}
927 				/*
928 				 * check for FF FF s s pattern
929 				 */
930 				if ((tmp[1] == RLOGIN_MAGIC) &&
931 				    (tmp[2] == 's') && (tmp[3] == 's')) {
932 
933 					/*
934 					 * If rlwinsetup returns an error,
935 					 * we do recover with newmp which
936 					 * points to new chain of mblks after
937 					 * doing window control ioctls.
938 					 * rlwinsetup returns newmp which
939 					 * contains only data part.
940 					 * Note that buried inside rlwinsetup
941 					 * is where we do the putnext.
942 					 */
943 					if (rlwinsetup(q, mp, tmp) == NULL) {
944 						sz = msgdsize(mp);
945 						recover(q, mp, sz);
946 						return (NULL);
947 					}
948 					/*
949 					 * We have successfully consumed the
950 					 * window sequence, but rlwinsetup()
951 					 * and its children have moved memory
952 					 * up underneath us.  This means that
953 					 * the byte underneath *tmp has not
954 					 * been scanned now.  We will now need
955 					 * to rescan it.
956 					 */
957 					continue;
958 				}
959 			}
960 			tmp++;
961 		}
962 		/*
963 		 * bump newcount to include size of this particular block.
964 		 */
965 		newcount += (mp->b_wptr - mp->b_rptr);
966 		mp = mp->b_cont;
967 	}
968 	/*
969 	 * If we trimmed the message down to nothing to forward, don't
970 	 * send any M_DATA message.  (Don't want to send EOF!)
971 	 */
972 	if (msgdsize(newmp) == 0) {
973 		freemsg(newmp);
974 		newmp = NULL;
975 	}
976 out:
977 	if (newmp) {
978 		if (!canputnext(q)) {
979 			(void) putbq(q, newmp);
980 			return (NULL);
981 		} else {
982 			putnext(q, newmp);
983 		}
984 	}
985 	return (TRUE);
986 }
987 
988 
989 /*
990  * This routine is called to handle window size changes.
991  * The routine returns 1 on success and 0 on error (allocb failure).
992  */
993 static int
994 rlwinctl(queue_t *q, mblk_t *mp)
995 {
996 	mblk_t	*rl_msgp;
997 	struct	iocblk	*iocbp;
998 	struct	rlmod_info	*rmip = (struct rlmod_info *)q->q_ptr;
999 
1000 	TRACE_2(TR_FAC_RLOGINP, TR_RLOGINP_WINCTL_IN, "rlwinctl start: q %p, "
1001 	    "mp %p", q, mp);
1002 
1003 	rmip->oobdata[0] &= ~TIOCPKT_WINDOW; /* we know he heard */
1004 
1005 	if ((rl_msgp = mkiocb(TIOCSWINSZ)) == NULL) {
1006 		TRACE_2(TR_FAC_RLOGINP, TR_RLOGINP_WINCTL_OUT, "rlwinctl end: "
1007 		    "q %p, mp %p, allocb failed", q, mp);
1008 		return (0);
1009 	}
1010 
1011 	/*
1012 	 * create an M_IOCTL message type.
1013 	 */
1014 	rl_msgp->b_cont = mp;
1015 	iocbp = (struct iocblk *)rl_msgp->b_rptr;
1016 	iocbp->ioc_count = msgdsize(mp);
1017 
1018 	putnext(q, rl_msgp);
1019 	TRACE_2(TR_FAC_RLOGINP, TR_RLOGINP_WINCTL_OUT, "rlwinctl end: "
1020 	    "q %p, mp %p, done", q, mp);
1021 	return (1);
1022 }
1023 
1024 /*
1025  * This routine sets up window size change protocol.
1026  * The routine returns the new mblk after issuing rlwinctl
1027  * for window size changes. New mblk contains only data part
1028  * of the message block. The routine returns 0 on error.
1029  */
1030 static mblk_t *
1031 rlwinsetup(queue_t *q, mblk_t *mp, unsigned char *blk)
1032 {
1033 	mblk_t		*mp1;
1034 	unsigned char	*jmpmp;
1035 	ssize_t		left = 0;
1036 	struct winsize	win;
1037 
1038 	/*
1039 	 * Set jmpmp to where to jump, to get just past the end of the
1040 	 * window size protocol sequence.
1041 	 */
1042 	jmpmp = (blk + 4 + sizeof (struct winsize));
1043 	left = mp->b_wptr - jmpmp;
1044 
1045 	if ((mp1 = allocb(sizeof (struct winsize), BPRI_MED)) == NULL)
1046 		return (0);
1047 	mp1->b_datap->db_type = M_DATA;
1048 	mp1->b_wptr = mp1->b_rptr + sizeof (struct winsize);
1049 	bcopy(blk + 4, &win, sizeof (struct winsize));
1050 	win.ws_row = ntohs(win.ws_row);
1051 	win.ws_col = ntohs(win.ws_col);
1052 	win.ws_xpixel = ntohs(win.ws_xpixel);
1053 	win.ws_ypixel = ntohs(win.ws_ypixel);
1054 	bcopy(&win, mp1->b_rptr, sizeof (struct winsize));
1055 
1056 	if ((rlwinctl(q, mp1)) == NULL) {
1057 		freeb(mp1);
1058 		return (0);
1059 	}
1060 	if (left > 0) {
1061 		/*
1062 		 * Must delete the window size protocol sequence.  We do
1063 		 * this by sliding all the stuff after the sequence (jmpmp)
1064 		 * to where the sequence itself began (blk).
1065 		 */
1066 		bcopy(jmpmp, blk, left);
1067 		mp->b_wptr = blk + left;
1068 	} else
1069 		mp->b_wptr = blk;
1070 	return (mp);
1071 }
1072 
1073 /*
1074  * When an ioctl changes software flow control on the tty, we must notify
1075  * the rlogin client, so it can adjust its behavior appropriately.  This
1076  * routine, called from either the put or service routine, determines if
1077  * the flow handling has changed.  If so, it tries to send the indication
1078  * to the client.  It returns true or false depending upon whether the
1079  * message was fully processed.  If it wasn't fully processed it queues
1080  * the message for retry later when resources
1081  * (allocb/canputnext) are available.
1082  */
1083 static boolean_t
1084 tty_flow(queue_t *q, struct rlmod_info *rmip, mblk_t *mp)
1085 {
1086 	struct iocblk *ioc;
1087 	struct termios *tp;
1088 	struct termio *ti;
1089 	int stop, ixon;
1090 	mblk_t *tmpmp;
1091 	char cntl;
1092 	int error;
1093 
1094 	ioc = (struct iocblk *)mp->b_rptr;
1095 	switch (ioc->ioc_cmd) {
1096 
1097 	/*
1098 	 * If it is a tty ioctl, save the output flow
1099 	 * control flag and the start and stop flow control
1100 	 * characters if they are available.
1101 	 */
1102 	case TCSETS:
1103 	case TCSETSW:
1104 	case TCSETSF:
1105 		error = miocpullup(mp, sizeof (struct termios));
1106 		if (error != 0) {
1107 			miocnak(q, mp, 0, error);
1108 			return (B_TRUE);
1109 		}
1110 		tp = (struct termios *)(mp->b_cont->b_rptr);
1111 		rmip->stopc = tp->c_cc[VSTOP];
1112 		rmip->startc = tp->c_cc[VSTART];
1113 		ixon = tp->c_iflag & IXON;
1114 		break;
1115 
1116 	case TCSETA:
1117 	case TCSETAW:
1118 	case TCSETAF:
1119 		error = miocpullup(mp, sizeof (struct termio));
1120 		if (error != 0) {
1121 			miocnak(q, mp, 0, error);
1122 			return (B_TRUE);
1123 		}
1124 		ti = (struct termio *)(mp->b_cont->b_rptr);
1125 		ixon = ti->c_iflag & IXON;
1126 		break;
1127 
1128 	default:
1129 		/*
1130 		 * This function must never be called for an M_IOCTL
1131 		 * except the listed ones.
1132 		 */
1133 #ifdef DEBUG
1134 		cmn_err(CE_PANIC,
1135 		    "rloginmod: tty_flow: bad ioctl 0x%x", ioc->ioc_cmd);
1136 #else
1137 		miocnak(q, mp, 0, EINVAL);
1138 		return (B_TRUE);
1139 #endif
1140 	}
1141 	/*
1142 	 * If tty ioctl processing is done, check for stopmode
1143 	 */
1144 	stop = (ixon && (rmip->stopc == CTRL('s')) &&
1145 		(rmip->startc == CTRL('q')));
1146 	if (rmip->stopmode == TIOCPKT_NOSTOP) {
1147 		if (stop) {
1148 			cntl = rmip->oobdata[0] | TIOCPKT_DOSTOP;
1149 			if ((tmpmp = make_expmblk(cntl)) == NULL) {
1150 				recover(q, mp, sizeof (mblk_t));
1151 				return (B_FALSE);
1152 			}
1153 			if (!canputnext(q)) {
1154 				freemsg(tmpmp);
1155 				return (B_FALSE);
1156 			}
1157 			putnext(q, tmpmp);
1158 			rmip->stopmode = TIOCPKT_DOSTOP;
1159 		}
1160 	} else {
1161 		if (!stop) {
1162 			cntl = rmip->oobdata[0] | TIOCPKT_NOSTOP;
1163 			if ((tmpmp = make_expmblk(cntl)) == NULL) {
1164 				recover(q, mp, sizeof (mblk_t));
1165 				return (B_FALSE);
1166 			}
1167 			if (!canputnext(q)) {
1168 				freemsg(tmpmp);
1169 				return (B_FALSE);
1170 			}
1171 			putnext(q, tmpmp);
1172 			rmip->stopmode = TIOCPKT_NOSTOP;
1173 		}
1174 	}
1175 
1176 	miocack(q, mp, 0, 0);
1177 	return (B_TRUE);
1178 }
1179 
1180 /* rlmodwioctl - handle M_IOCTL messages on the write queue. */
1181 
1182 static boolean_t
1183 rlmodwioctl(queue_t *q, mblk_t *mp)
1184 {
1185 	struct iocblk *ioc;
1186 	struct rlmod_info *rmip = (struct rlmod_info *)q->q_ptr;
1187 	int error;
1188 
1189 	ioc = (struct iocblk *)mp->b_rptr;
1190 	switch (ioc->ioc_cmd) {
1191 
1192 	/*
1193 	 * This is a special ioctl to reenable the queue.
1194 	 * The initial data read from the stream head is
1195 	 * put back on the queue.
1196 	 */
1197 	case RL_IOC_ENABLE:
1198 		/*
1199 		 * Send negative ack if RL_DISABLED flag is not set
1200 		 */
1201 
1202 		if (!(rmip->flags & RL_DISABLED)) {
1203 			miocnak(q, mp, 0, EINVAL);
1204 			break;
1205 		}
1206 		if (mp->b_cont) {
1207 			(void) putbq(RD(q), mp->b_cont);
1208 			mp->b_cont = NULL;
1209 		}
1210 
1211 		if (rmip->flags & RL_DISABLED)
1212 			rmip->flags &= ~RL_DISABLED;
1213 		qenable(RD(q));
1214 		miocack(q, mp, 0, 0);
1215 		TRACE_3(TR_FAC_RLOGINP, TR_RLOGINP_WPUT_OUT,
1216 		    "rlmodwput end: q %p, mp %p, %s",
1217 		    q, mp, "IOCACK enable");
1218 		return (B_TRUE);
1219 
1220 	/*
1221 	 * If it is a tty ioctl, save the output flow
1222 	 * control flag and the start and stop flow control
1223 	 * characters if they are available.
1224 	 */
1225 	case TCSETS:
1226 	case TCSETSW:
1227 	case TCSETSF:
1228 	case TCSETA:
1229 	case TCSETAW:
1230 	case TCSETAF:
1231 		return (tty_flow(q, rmip, mp));
1232 
1233 #ifdef DEBUG
1234 	case TIOCSWINSZ:
1235 	case TIOCSTI:
1236 	case TCSBRK:
1237 		miocnak(q, mp, 0, EINVAL);
1238 		break;
1239 #endif
1240 	case CRYPTPASSTHRU:
1241 		error = miocpullup(mp, sizeof (uchar_t));
1242 		if (error != 0) {
1243 			miocnak(q, mp, 0, error);
1244 			break;
1245 		}
1246 		if (*(mp->b_cont->b_rptr) == 0x01)
1247 			rmip->flags |= RL_IOCPASSTHRU;
1248 		else
1249 			rmip->flags &= ~RL_IOCPASSTHRU;
1250 
1251 		miocack(q, mp, NULL, 0);
1252 		break;
1253 
1254 	default:
1255 		if (rmip->flags & RL_IOCPASSTHRU) {
1256 			putnext(q, mp);
1257 		} else {
1258 #ifdef DEBUG
1259 			cmn_err(CE_NOTE,
1260 				"rlmodwioctl: unexpected ioctl type 0x%x",
1261 				ioc->ioc_cmd);
1262 #endif
1263 			miocnak(q, mp, 0, EINVAL);
1264 		}
1265 	}
1266 	return (B_TRUE);
1267 }
1268 
1269 static void
1270 rlmod_timer(void *arg)
1271 {
1272 	queue_t *q = arg;
1273 	struct rlmod_info	*rmip = (struct rlmod_info *)q->q_ptr;
1274 
1275 	ASSERT(rmip);
1276 	if (q->q_flag & QREADR) {
1277 		ASSERT(rmip->rtimoutid);
1278 		rmip->rtimoutid = 0;
1279 	} else {
1280 		ASSERT(rmip->wtimoutid);
1281 		rmip->wtimoutid = 0;
1282 	}
1283 	enableok(q);
1284 	qenable(q);
1285 }
1286 
1287 static void
1288 rlmod_buffer(void *arg)
1289 {
1290 	queue_t *q = arg;
1291 	struct rlmod_info	*rmip = (struct rlmod_info *)q->q_ptr;
1292 
1293 	ASSERT(rmip);
1294 	if (q->q_flag & QREADR) {
1295 		ASSERT(rmip->rbufcid);
1296 		rmip->rbufcid = 0;
1297 	} else {
1298 		ASSERT(rmip->wbufcid);
1299 		rmip->wbufcid = 0;
1300 	}
1301 	enableok(q);
1302 	qenable(q);
1303 }
1304 
1305 static void
1306 recover(queue_t *q, mblk_t *mp, size_t size)
1307 {
1308 	/*
1309 	 * Avoid re-enabling the queue.
1310 	 */
1311 	ASSERT(mp->b_datap->db_type < QPCTL);
1312 
1313 	noenable(q);
1314 	(void) putbq(q, mp);
1315 	recover1(q, size);
1316 }
1317 
1318 static void
1319 recover1(queue_t *q, size_t size)
1320 {
1321 	struct rlmod_info	*rmip = (struct rlmod_info *)q->q_ptr;
1322 	timeout_id_t	tid;
1323 	bufcall_id_t	bid;
1324 
1325 	/*
1326 	 * Make sure there is at most one outstanding request per queue.
1327 	 */
1328 	if (q->q_flag & QREADR) {
1329 		if (rmip->rtimoutid || rmip->rbufcid)
1330 			return;
1331 	} else {
1332 		if (rmip->wtimoutid || rmip->wbufcid)
1333 			return;
1334 	}
1335 	if (!(bid = qbufcall(RD(q), size, BPRI_MED, rlmod_buffer, q))) {
1336 		tid = qtimeout(RD(q), rlmod_timer, q, SIMWAIT);
1337 		if (q->q_flag & QREADR)
1338 			rmip->rtimoutid = tid;
1339 		else
1340 			rmip->wtimoutid = tid;
1341 	} else	{
1342 		if (q->q_flag & QREADR)
1343 			rmip->rbufcid = bid;
1344 		else
1345 			rmip->wbufcid = bid;
1346 	}
1347 }
1348