/*
 * sppp_dlpi.c - Solaris STREAMS PPP multiplexing pseudo-driver DLPI handlers
 *
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Permission to use, copy, modify, and distribute this software and its
 * documentation is hereby granted, provided that the above copyright
 * notice appears in all copies.
 *
 * SUN MAKES NO REPRESENTATION OR WARRANTIES ABOUT THE SUITABILITY OF
 * THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
 * TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
 * PARTICULAR PURPOSE, OR NON-INFRINGEMENT.  SUN SHALL NOT BE LIABLE FOR
 * ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING OR
 * DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES
 *
 * Copyright (c) 1994 The Australian National University.
 * All rights reserved.
 *
 * Permission to use, copy, modify, and distribute this software and its
 * documentation is hereby granted, provided that the above copyright
 * notice appears in all copies.  This software is provided without any
 * warranty, express or implied. The Australian National University
 * makes no representations about the suitability of this software for
 * any purpose.
 *
 * IN NO EVENT SHALL THE AUSTRALIAN NATIONAL UNIVERSITY BE LIABLE TO ANY
 * PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
 * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF
 * THE AUSTRALIAN NATIONAL UNIVERSITY HAS BEEN ADVISED OF THE POSSIBILITY
 * OF SUCH DAMAGE.
 *
 * THE AUSTRALIAN NATIONAL UNIVERSITY SPECIFICALLY DISCLAIMS ANY WARRANTIES,
 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
 * ON AN "AS IS" BASIS, AND THE AUSTRALIAN NATIONAL UNIVERSITY HAS NO
 * OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS,
 * OR MODIFICATIONS.
 *
 * This driver is derived from the original SVR4 STREAMS PPP driver
 * originally written by Paul Mackerras <paul.mackerras@cs.anu.edu.au>.
 *
 * Adi Masputra <adi.masputra@sun.com> rewrote and restructured the code
 * for improved performance and scalability.
 */

#define RCSID   "$Id: sppp_dlpi.c,v 1.0 2000/05/08 01:10:12 masputra Exp $"

#include <sys/types.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/errno.h>
#include <sys/time.h>
#include <sys/cmn_err.h>
#include <sys/conf.h>
#include <sys/dlpi.h>
#include <sys/ddi.h>
#include <sys/kstat.h>
#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/ethernet.h>
#include <net/ppp_defs.h>
#include <netinet/in.h>
#include <net/pppio.h>
#include "s_common.h"
#include "sppp.h"

static int      sppp_dlattachreq(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_dldetachreq(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_dlbindreq(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_dlunbindreq(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_dlinforeq(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_dlunitdatareq(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_dlpromisconreq(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_dlpromiscoffreq(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_dlphyreq(queue_t *, mblk_t *, spppstr_t *);
static void     sppp_dl_attach_upper(queue_t *, mblk_t *);
static void     sppp_dl_detach_upper(queue_t *, mblk_t *);
static void     sppp_dl_bind(queue_t *, mblk_t *);
static void     sppp_dl_unbind(queue_t *, mblk_t *);
static void     sppp_dl_promiscon(queue_t *, mblk_t *);
static void     sppp_dl_promiscoff(queue_t *, mblk_t *);
static mblk_t   *sppp_dladdether(spppstr_t *, mblk_t *, t_scalar_t);

static struct sppp_dlpi_pinfo_t dl_pinfo[DL_MAXPRIM + 1];

#if 0
#define DBGERROR(x)     cmn_err x
#else
#define DBGERROR(x)     ((void)0)
#endif

/* #define      DBG_DLPI        1 */

#ifdef DBG_DLPI
struct sppp_dlpi_entry {
        uint32_t sde_val;
        const char *sde_name;
};

static const struct sppp_dlpi_entry sppp_dlpi_list[] = {
        { DL_INFO_REQ, "DL_INFO_REQ" },
        { DL_INFO_ACK, "DL_INFO_ACK" },
        { DL_ATTACH_REQ, "DL_ATTACH_REQ" },
        { DL_DETACH_REQ, "DL_DETACH_REQ" },
        { DL_BIND_REQ, "DL_BIND_REQ" },
        { DL_BIND_ACK, "DL_BIND_ACK" },
        { DL_UNBIND_REQ, "DL_UNBIND_REQ" },
        { DL_OK_ACK, "DL_OK_ACK" },
        { DL_ERROR_ACK, "DL_ERROR_ACK" },
        { DL_SUBS_BIND_REQ, "DL_SUBS_BIND_REQ" },
        { DL_SUBS_BIND_ACK, "DL_SUBS_BIND_ACK" },
        { DL_SUBS_UNBIND_REQ, "DL_SUBS_UNBIND_REQ" },
        { DL_ENABMULTI_REQ, "DL_ENABMULTI_REQ" },
        { DL_DISABMULTI_REQ, "DL_DISABMULTI_REQ" },
        { DL_PROMISCON_REQ, "DL_PROMISCON_REQ" },
        { DL_PROMISCOFF_REQ, "DL_PROMISCOFF_REQ" },
        { DL_UNITDATA_REQ, "DL_UNITDATA_REQ" },
        { DL_UNITDATA_IND, "DL_UNITDATA_IND" },
        { DL_UDERROR_IND, "DL_UDERROR_IND" },
        { DL_UDQOS_REQ, "DL_UDQOS_REQ" },
        { DL_CONNECT_REQ, "DL_CONNECT_REQ" },
        { DL_CONNECT_IND, "DL_CONNECT_IND" },
        { DL_CONNECT_RES, "DL_CONNECT_RES" },
        { DL_CONNECT_CON, "DL_CONNECT_CON" },
        { DL_TOKEN_REQ, "DL_TOKEN_REQ" },
        { DL_TOKEN_ACK, "DL_TOKEN_ACK" },
        { DL_DISCONNECT_REQ, "DL_DISCONNECT_REQ" },
        { DL_DISCONNECT_IND, "DL_DISCONNECT_IND" },
        { DL_RESET_REQ, "DL_RESET_REQ" },
        { DL_RESET_IND, "DL_RESET_IND" },
        { DL_RESET_RES, "DL_RESET_RES" },
        { DL_RESET_CON, "DL_RESET_CON" },
        { DL_DATA_ACK_REQ, "DL_DATA_ACK_REQ" },
        { DL_DATA_ACK_IND, "DL_DATA_ACK_IND" },
        { DL_DATA_ACK_STATUS_IND, "DL_DATA_ACK_STATUS_IND" },
        { DL_REPLY_REQ, "DL_REPLY_REQ" },
        { DL_REPLY_IND, "DL_REPLY_IND" },
        { DL_REPLY_STATUS_IND, "DL_REPLY_STATUS_IND" },
        { DL_REPLY_UPDATE_REQ, "DL_REPLY_UPDATE_REQ" },
        { DL_REPLY_UPDATE_STATUS_IND, "DL_REPLY_UPDATE_STATUS_IND" },
        { DL_XID_REQ, "DL_XID_REQ" },
        { DL_XID_IND, "DL_XID_IND" },
        { DL_XID_RES, "DL_XID_RES" },
        { DL_XID_CON, "DL_XID_CON" },
        { DL_TEST_REQ, "DL_TEST_REQ" },
        { DL_TEST_IND, "DL_TEST_IND" },
        { DL_TEST_RES, "DL_TEST_RES" },
        { DL_TEST_CON, "DL_TEST_CON" },
        { DL_PHYS_ADDR_REQ, "DL_PHYS_ADDR_REQ" },
        { DL_PHYS_ADDR_ACK, "DL_PHYS_ADDR_ACK" },
        { DL_SET_PHYS_ADDR_REQ, "DL_SET_PHYS_ADDR_REQ" },
        { DL_GET_STATISTICS_REQ, "DL_GET_STATISTICS_REQ" },
        { DL_GET_STATISTICS_ACK, "DL_GET_STATISTICS_ACK" },
        { 0, NULL }
};

static const struct sppp_dlpi_entry sppp_state_list[] = {
        { DL_UNBOUND, "DL_UNBOUND" },
        { DL_BIND_PENDING, "DL_BIND_PENDING" },
        { DL_UNBIND_PENDING, "DL_UNBIND_PENDING" },
        { DL_IDLE, "DL_IDLE" },
        { DL_UNATTACHED, "DL_UNATTACHED" },
        { DL_ATTACH_PENDING, "DL_ATTACH_PENDING" },
        { DL_DETACH_PENDING, "DL_DETACH_PENDING" },
        { DL_UDQOS_PENDING, "DL_UDQOS_PENDING" },
        { DL_OUTCON_PENDING, "DL_OUTCON_PENDING" },
        { DL_INCON_PENDING, "DL_INCON_PENDING" },
        { DL_CONN_RES_PENDING, "DL_CONN_RES_PENDING" },
        { DL_DATAXFER, "DL_DATAXFER" },
        { DL_USER_RESET_PENDING, "DL_USER_RESET_PENDING" },
        { DL_PROV_RESET_PENDING, "DL_PROV_RESET_PENDING" },
        { DL_RESET_RES_PENDING, "DL_RESET_RES_PENDING" },
        { DL_DISCON8_PENDING, "DL_DISCON8_PENDING" },
        { DL_DISCON9_PENDING, "DL_DISCON9_PENDING" },
        { DL_DISCON11_PENDING, "DL_DISCON11_PENDING" },
        { DL_DISCON12_PENDING, "DL_DISCON12_PENDING" },
        { DL_DISCON13_PENDING, "DL_DISCON13_PENDING" },
        { DL_SUBS_BIND_PND, "DL_SUBS_BIND_PND" },
        { DL_SUBS_UNBIND_PND, "DL_SUBS_UNBIND_PND" },
        { 0, NULL }
};

static const char *
prim2name(uint32_t prim)
{
        const struct sppp_dlpi_entry *sde;

        for (sde = sppp_dlpi_list; sde->sde_name != NULL; sde++)
                if (sde->sde_val == prim)
                        break;
        return (sde->sde_name);
}

static const char *
state2name(uint32_t state)
{
        const struct sppp_dlpi_entry *sde;

        for (sde = sppp_state_list; sde->sde_name != NULL; sde++)
                if (sde->sde_val == state)
                        break;
        return (sde->sde_name);
}

#define DBGDLPI(x)      cmn_err x
#else
#define DBGDLPI(x)      ((void)0)
#endif /* DBG_DLPI */

/*
 * DL_INFO_ACK template for point-to-point interface.
 */
static dl_info_ack_t    sppp_infoack = {
        DL_INFO_ACK,                    /* dl_primitive */
        PPP_MAXMTU,                     /* dl_max_sdu */
        0,                              /* dl_min_sdu */
        SPPP_ADDRL,                     /* dl_addr_length */
        /*
         * snoop et. al. don't know about DL_OTHER so this entry
         * was changed to DL_ETHER so ethernet tracing/snooping
         * facilities will work with PPP interfaces.
         */
        DL_ETHER,                       /* dl_mac_type */
        0,                              /* dl_reserved */
        0,                              /* dl_current_state */
        SPPP_SAPL,                      /* dl_sap_length */
        DL_CLDLS,                       /* dl_service_mode */
        0,                              /* dl_qos_length */
        0,                              /* dl_qos_offset */
        0,                              /* dl_range_length */
        0,                              /* dl_range_offset */
        DL_STYLE2,                      /* dl_provider_style */
        sizeof (dl_info_ack_t),         /* dl_addr_offset */
        DL_VERSION_2,                   /* dl_version */
        0,                              /* dl_brdcst_addr_length */
        0,                              /* dl_brdcst_addr_offset */
        0                               /* dl_growth */
};

/*
 * sppp_dlpi_pinfoinit()
 *
 * Description:
 *    Initialize dl_pinfo[], called from sppp_attach.
 */
void
sppp_dlpi_pinfoinit(void)
{
        bzero(dl_pinfo, sizeof (dl_pinfo));     /* Just to be safe */

        dl_pinfo[DL_ATTACH_REQ].pi_minlen = sizeof (dl_attach_req_t);
        dl_pinfo[DL_ATTACH_REQ].pi_state = DL_UNATTACHED;
        dl_pinfo[DL_ATTACH_REQ].pi_funcp = sppp_dlattachreq;

        dl_pinfo[DL_DETACH_REQ].pi_minlen = sizeof (dl_detach_req_t);
        dl_pinfo[DL_DETACH_REQ].pi_state = DL_UNBOUND;
        dl_pinfo[DL_DETACH_REQ].pi_funcp = sppp_dldetachreq;

        dl_pinfo[DL_BIND_REQ].pi_minlen = sizeof (dl_bind_req_t);
        dl_pinfo[DL_BIND_REQ].pi_state = DL_UNBOUND;
        dl_pinfo[DL_BIND_REQ].pi_funcp = sppp_dlbindreq;

        dl_pinfo[DL_UNBIND_REQ].pi_minlen = sizeof (dl_unbind_req_t);
        dl_pinfo[DL_UNBIND_REQ].pi_state = DL_IDLE;
        dl_pinfo[DL_UNBIND_REQ].pi_funcp = sppp_dlunbindreq;

        dl_pinfo[DL_INFO_REQ].pi_minlen = sizeof (dl_info_req_t);
        dl_pinfo[DL_INFO_REQ].pi_state = -1;    /* special handling */
        dl_pinfo[DL_INFO_REQ].pi_funcp = sppp_dlinforeq;

        dl_pinfo[DL_UNITDATA_REQ].pi_minlen = sizeof (dl_unitdata_req_t);
        dl_pinfo[DL_UNITDATA_REQ].pi_state = DL_IDLE;
        dl_pinfo[DL_UNITDATA_REQ].pi_funcp = sppp_dlunitdatareq;

        dl_pinfo[DL_PROMISCON_REQ].pi_minlen = sizeof (dl_promiscon_req_t);
        dl_pinfo[DL_PROMISCON_REQ].pi_state = -1; /* special handling */
        dl_pinfo[DL_PROMISCON_REQ].pi_funcp = sppp_dlpromisconreq;

        dl_pinfo[DL_PROMISCOFF_REQ].pi_minlen = sizeof (dl_promiscoff_req_t);
        dl_pinfo[DL_PROMISCOFF_REQ].pi_state = -1; /* special handling */
        dl_pinfo[DL_PROMISCOFF_REQ].pi_funcp = sppp_dlpromiscoffreq;

        dl_pinfo[DL_PHYS_ADDR_REQ].pi_minlen = sizeof (dl_phys_addr_req_t);
        dl_pinfo[DL_PHYS_ADDR_REQ].pi_state = -1; /* special handling */
        dl_pinfo[DL_PHYS_ADDR_REQ].pi_funcp = sppp_dlphyreq;
}

/*
 * sppp_mproto()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Handle M_PCPROTO/M_PROTO messages, called by sppp_uwput.
 */
int
sppp_mproto(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        union DL_primitives *dlp;
        struct sppp_dlpi_pinfo_t *dpi;
        t_uscalar_t     prim;
        int             len;
        int             error = 0;

        ASSERT(!IS_SPS_CONTROL(sps));
        if ((len = MBLKL(mp)) < sizeof (t_uscalar_t)) {
                DBGERROR((CE_CONT, "bad mproto: block length %d\n", len));
                merror(q, mp, EPROTO);
                return (0);
        }
        dlp = (union DL_primitives *)mp->b_rptr;
        prim = dlp->dl_primitive;
        if (prim > DL_MAXPRIM) {
                DBGERROR((CE_CONT, "bad mproto: primitive %d > %d\n", prim,
                    DL_MAXPRIM));
                error = DL_BADPRIM;
        } else {
                dpi = &dl_pinfo[prim];
                if (dpi->pi_funcp == NULL) {
                        DBGERROR((CE_CONT,
                            "bad mproto: primitive %d not supported\n", prim));
                        error = DL_NOTSUPPORTED;
                } else if (len < dpi->pi_minlen) {
                        DBGERROR((CE_CONT,
                            "bad mproto: primitive len %d < %d\n", len,
                            dpi->pi_minlen));
                        error = DL_BADPRIM;
                } else if (dpi->pi_state != -1 &&
                    sps->sps_dlstate != dpi->pi_state) {
                        DBGERROR((CE_CONT,
                            "bad state %d != %d for primitive %d\n",
                            sps->sps_dlstate, dpi->pi_state, prim));
                        error = DL_OUTSTATE;
                }
        }
        if (error != 0) {
                dlerrorack(q, mp, dlp->dl_primitive, error, 0);
                return (0);
        }
#ifdef DBG_DLPI
        {
                const char *cp = prim2name(prim);
                if (cp != NULL)
                        cmn_err(CE_CONT, "/%d: Dispatching %s\n",
                            sps->sps_mn_id, cp);
                else
                        cmn_err(CE_CONT,
                            "/%d: Dispatching unknown primitive %d\n",
                            sps->sps_mn_id, prim);
        }
#endif
        return ((*dpi->pi_funcp)(q, mp, sps));
}

/*
 * sppp_dlattachreq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Perform DL_ATTACH_REQ request, called by sppp_mproto.
 */
static int
sppp_dlattachreq(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        int     error = 0;
        union DL_primitives *dlp;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        dlp = (union DL_primitives *)mp->b_rptr;
        ASSERT(sps != NULL);
        ASSERT(sps->sps_dlstate == DL_UNATTACHED);

        if (IS_SPS_PIOATTACH(sps)) {
                DBGERROR((CE_CONT, "DLPI attach: already attached\n"));
                error = EINVAL;
        }
        if (error != 0) {
                dlerrorack(q, mp, dlp->dl_primitive, DL_OUTSTATE, error);
        } else {
                qwriter(q, mp, sppp_dl_attach_upper, PERIM_OUTER);
        }
        return (0);
}

/*
 * sppp_dl_attach_upper()
 *
 * MT-Perimeters:
 *    exclusive inner, exclusive outer.
 *
 * Description:
 *    Called by qwriter (INNER) from sppp_dlattachreq as the result of
 *    receiving a DL_ATTACH_REQ message.
 */
static void
sppp_dl_attach_upper(queue_t *q, mblk_t *mp)
{
        sppa_t          *ppa;
        spppstr_t       *sps = q->q_ptr;
        union DL_primitives *dlp;
        int             err = ENOMEM;
        cred_t          *cr;
        zoneid_t        zoneid;

        ASSERT(!IS_SPS_PIOATTACH(sps));
        dlp = (union DL_primitives *)mp->b_rptr;

        /* If there's something here, it's detached. */
        if (sps->sps_ppa != NULL) {
                sppp_remove_ppa(sps);
        }

        if ((cr = msg_getcred(mp, NULL)) == NULL)
                zoneid = sps->sps_zoneid;
        else
                zoneid = crgetzoneid(cr);

        ppa = sppp_find_ppa(dlp->attach_req.dl_ppa);
        if (ppa == NULL) {
                ppa = sppp_create_ppa(dlp->attach_req.dl_ppa, zoneid);
        } else if (ppa->ppa_zoneid != zoneid) {
                ppa = NULL;
                err = EPERM;
        }

        /*
         * If we can't find or create it, then it's either because we're out of
         * memory or because the requested PPA is owned by a different zone.
         */
        if (ppa == NULL) {
                DBGERROR((CE_CONT, "DLPI attach: cannot create ppa %u\n",
                    dlp->attach_req.dl_ppa));
                dlerrorack(q, mp, dlp->dl_primitive, DL_SYSERR, err);
                return;
        }
        /*
         * Preallocate the hangup message so that we're always able to
         * send this upstream in the event of a catastrophic failure.
         */
        if ((sps->sps_hangup = allocb(1, BPRI_MED)) == NULL) {
                DBGERROR((CE_CONT, "DLPI attach: cannot allocate hangup\n"));
                dlerrorack(q, mp, dlp->dl_primitive, DL_SYSERR, ENOSR);
                return;
        }
        sps->sps_dlstate = DL_UNBOUND;
        sps->sps_ppa = ppa;
        /*
         * Add this stream to the head of the list of sibling streams
         * which belong to the specified ppa.
         */
        rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
        ppa->ppa_refcnt++;
        sps->sps_nextsib = ppa->ppa_streams;
        ppa->ppa_streams = sps;
        /*
         * And if this stream was marked as promiscuous (SPS_PROMISC), then we
         * need to update the promiscuous streams count. This should only
         * happen when DL_PROMISCON_REQ was issued prior to attachment.
         */
        if (IS_SPS_PROMISC(sps)) {
                ppa->ppa_promicnt++;
        }
        rw_exit(&ppa->ppa_sib_lock);
        DBGDLPI((CE_CONT, "/%d: attached to ppa %d\n", sps->sps_mn_id,
            ppa->ppa_ppa_id));
        dlokack(q, mp, DL_ATTACH_REQ);
}

/*
 * sppp_dldetachreq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Perform DL_DETACH_REQ request, called by sppp_mproto.
 */
/* ARGSUSED */
static int
sppp_dldetachreq(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ASSERT(sps != NULL);
        ASSERT(sps->sps_dlstate == DL_UNBOUND);
        ASSERT(!IS_SPS_PIOATTACH(sps));

        qwriter(q, mp, sppp_dl_detach_upper, PERIM_INNER);
        return (0);
}

/*
 * sppp_dl_detach_upper()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Called by qwriter (INNER) from sppp_dldetachreq as the result of
 *    receiving a DL_DETACH_REQ message.
 */
/* ARGSUSED */
static void
sppp_dl_detach_upper(queue_t *q, mblk_t *mp)
{
        spppstr_t       *sps;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        sps = (spppstr_t *)q->q_ptr;
        /*
         * We don't actually detach from the PPA until closed or
         * reattached.
         */
        sps->sps_flags &= ~SPS_PROMISC; /* clear flag anyway */
        sps->sps_dlstate = DL_UNATTACHED;
        dlokack(q, mp, DL_DETACH_REQ);
}

/*
 * sppp_dlbindreq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Perform DL_BIND_REQ request, called by sppp_mproto.
 */
static int
sppp_dlbindreq(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        sppa_t                  *ppa;
        union DL_primitives     *dlp;
        spppreqsap_t            req_sap;
        int                     error = 0;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        dlp = (union DL_primitives *)mp->b_rptr;
        req_sap = dlp->bind_req.dl_sap;
        ASSERT(sps != NULL);
        ASSERT(!IS_SPS_PIOATTACH(sps));
        ASSERT(sps->sps_dlstate == DL_UNBOUND);

        ppa = sps->sps_ppa;
        if (ppa == NULL) {
                DBGERROR((CE_CONT, "DLPI bind: no attached ppa\n"));
                error = DL_OUTSTATE;
        } else if ((req_sap != ETHERTYPE_IP) && (req_sap != ETHERTYPE_IPV6) &&
            (req_sap != ETHERTYPE_ALLSAP)) {
                DBGERROR((CE_CONT, "DLPI bind: unknown SAP %x\n", req_sap));
                error = DL_BADADDR;
        }
        if (error != 0) {
                dlerrorack(q, mp, dlp->dl_primitive, error, 0);
        } else {
                qwriter(q, mp, sppp_dl_bind, PERIM_INNER);
        }
        return (0);
}

/*
 * sppp_dl_bind()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Called by qwriter (INNER) from sppp_dlbindreq as the result of
 *    receiving a DL_BIND_REQ message.
 */
static void
sppp_dl_bind(queue_t *q, mblk_t *mp)
{
        spppstr_t               *sps;
        sppa_t                  *ppa;
        union DL_primitives     *dlp;
        t_scalar_t              sap;
        spppreqsap_t            req_sap;
        mblk_t                  *lsmp;

        ASSERT(q != NULL && q->q_ptr != NULL);
        sps = (spppstr_t *)q->q_ptr;
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        dlp = (union DL_primitives *)mp->b_rptr;
        ppa = sps->sps_ppa;
        ASSERT(ppa != NULL);
        req_sap = dlp->bind_req.dl_sap;
        ASSERT((req_sap == ETHERTYPE_IP) || (req_sap == ETHERTYPE_IPV6) ||
            (req_sap == ETHERTYPE_ALLSAP));

        if (req_sap == ETHERTYPE_IP) {
                sap = PPP_IP;
        } else if (req_sap == ETHERTYPE_IPV6) {
                sap = PPP_IPV6;
        } else if (req_sap == ETHERTYPE_ALLSAP) {
                sap = PPP_ALLSAP;
        }
        /*
         * If there's another stream with the same sap has already been bound
         * to the same ppa, then return with DL_NOADDR. However, we do make an
         * exception for snoop (req_sap=0x00, sap=0xff) since multiple
         * instances of snoop may execute an a given device.
         */
        lsmp = NULL;
        if (sap != PPP_ALLSAP) {
                if ((sap == PPP_IP) && (ppa->ppa_ip_cache == NULL)) {
                        ppa->ppa_ip_cache = sps;
                        if (ppa->ppa_ctl != NULL) {
                                lsmp = create_lsmsg(PPP_LINKSTAT_IPV4_BOUND);
                        }
                } else if ((sap == PPP_IPV6) && (ppa->ppa_ip6_cache == NULL)) {
                        ppa->ppa_ip6_cache = sps;
                        if (ppa->ppa_ctl != NULL) {
                                lsmp = create_lsmsg(PPP_LINKSTAT_IPV6_BOUND);
                        }
                } else {
                        DBGERROR((CE_CONT, "DLPI bind: bad SAP %x\n", sap));
                        dlerrorack(q, mp, dlp->dl_primitive, DL_NOADDR,
                            EEXIST);
                        return;
                }
                sps->sps_flags |= SPS_CACHED;
        }
        /*
         * Tell the daemon that a DLPI bind has happened on this stream,
         * and we'll only do this for PPP_IP or PPP_IPV6 sap (not snoop).
         */
        if (lsmp != NULL && ppa->ppa_ctl != NULL) {
#ifdef DBG_DLPI
                cmn_err(CE_CONT, "sending up %s\n",
                    ((sap == PPP_IP) ? "PPP_LINKSTAT_IPV4_BOUND" :
                    "PPP_LINKSTAT_IPV6_BOUND"));
#endif
                putnext(ppa->ppa_ctl->sps_rq, lsmp);
        }
        DBGDLPI((CE_CONT, "/%d: bound to sap %X (req %X)\n", sps->sps_mn_id,
            sap, req_sap));
        sps->sps_req_sap = req_sap;
        sps->sps_sap = sap;
        sps->sps_dlstate = DL_IDLE;
        dlbindack(q, mp, req_sap, &sap, sizeof (int32_t), 0, 0);
}

/*
 * sppp_dlunbindreq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Perform DL_UNBIND_REQ request, called by sppp_mproto.
 */
/* ARGSUSED */
static int
sppp_dlunbindreq(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ASSERT(sps != NULL);
        ASSERT(!IS_SPS_PIOATTACH(sps));
        ASSERT(sps->sps_dlstate == DL_IDLE);

        qwriter(q, mp, sppp_dl_unbind, PERIM_INNER);
        return (0);
}

/*
 * sppp_dl_unbind()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Called by qwriter (INNER) from sppp_dlunbindreq as the result of
 *    receiving a DL_UNBIND_REQ message.
 */
static void
sppp_dl_unbind(queue_t *q, mblk_t *mp)
{
        spppstr_t       *sps;
        sppa_t          *ppa;
        t_scalar_t      sap;
        mblk_t          *msg;
        boolean_t       saydown;

        ASSERT(q != NULL && q->q_ptr != NULL);
        sps = (spppstr_t *)q->q_ptr;
        ppa = sps->sps_ppa;
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        sap = sps->sps_sap;
        ASSERT((sap == PPP_IP) || (sap == PPP_IPV6) || (sap == PPP_ALLSAP));

        /* Flush messages on unbind, per DLPI specification. */
        flushq(WR(q), FLUSHALL);
        flushq(RD(q), FLUSHALL);

        if ((ppa != NULL) && IS_SPS_CACHED(sps)) {
                sps->sps_flags &= ~SPS_CACHED;
                msg = NULL;
                saydown = (ppa->ppa_ctl != NULL &&
                    (sps->sps_npmode == NPMODE_PASS ||
                    sps->sps_npmode == NPMODE_QUEUE));
                if (sap == PPP_IP) {
                        ppa->ppa_ip_cache = NULL;
                        if (saydown)
                                msg = create_lsmsg(PPP_LINKSTAT_IPV4_UNBOUND);
                } else if (sap == PPP_IPV6) {
                        ppa->ppa_ip6_cache = NULL;
                        if (saydown)
                                msg = create_lsmsg(PPP_LINKSTAT_IPV6_UNBOUND);
                }
                if (msg != NULL) {
#ifdef DBG_DLPI
                        cmn_err(CE_CONT, "sending up %s\n",
                            ((sap == PPP_IP) ? "PPP_LINKSTAT_IPV4_UNBOUND" :
                            "PPP_LINKSTAT_IPV6_UNBOUND"));
#endif
                        putnext(ppa->ppa_ctl->sps_rq, msg);
                }
        }
        DBGDLPI((CE_CONT, "/%d: unbound from sap %X (req %X)\n", sps->sps_mn_id,
            sps->sps_sap, sps->sps_req_sap));
        sps->sps_req_sap = 0;
        sps->sps_sap = -1;
        sps->sps_dlstate = DL_UNBOUND;

        dlokack(q, mp, DL_UNBIND_REQ);
}

/*
 * sppp_dlinforeq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Perform DL_INFO_REQ request, called by sppp_mproto.
 */
static int
sppp_dlinforeq(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        dl_info_ack_t   *dlip;
        uint32_t        size;
        uint32_t        addr_size;
        sppa_t          *ppa;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ASSERT(sps != NULL);
        ppa = sps->sps_ppa;

        /* Exchange current msg for a DL_INFO_ACK. */
        addr_size = SPPP_ADDRL;
        size = sizeof (dl_info_ack_t) + addr_size;
        if ((mp = mexchange(q, mp, size, M_PCPROTO, DL_INFO_ACK)) == NULL) {
                DBGERROR((CE_CONT, "DLPI info: mexchange failed\n"));
                /* mexchange already sent up an merror ENOSR */
                return (0);
        }
        /* Fill in DL_INFO_ACK fields and reply */
        dlip = (dl_info_ack_t *)mp->b_rptr;
        *dlip = sppp_infoack;
        dlip->dl_current_state = sps->sps_dlstate;
        dlip->dl_max_sdu = ppa != NULL ? ppa->ppa_mtu : PPP_MAXMTU;
#ifdef DBG_DLPI
        {
                const char *cp = state2name(dlip->dl_current_state);
                if (cp != NULL)
                        cmn_err(CE_CONT, "info returns state %s, max sdu %d\n",
                            cp, dlip->dl_max_sdu);
                else
                        cmn_err(CE_CONT, "info returns state %d, max sdu %d\n",
                            dlip->dl_current_state, dlip->dl_max_sdu);
        }
#endif
        qreply(q, mp);
        return (0);
}

/*
 * sppp_dlunitdatareq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Handle DL_UNITDATA_REQ request, called by sppp_mproto. This procedure
 *    gets called for M_PROTO (DLPI) style of transmission. The fact that we
 *    have acknowledged IP's fastpath probing (DL_IOC_HDR_INFO) does not
 *    guarantee that IP will always transmit via M_DATA, and it merely implies
 *    that such situation _may_ happen. In other words, IP may decide to use
 *    M_PROTO (DLPI) for data transmission should it decide to do so.
 *    Therefore, we should never place any restrictions or checks against
 *    streams marked with SPS_FASTPATH, since it is legal for this procedure
 *    to be entered with or without the bit set.
 */
static int
sppp_dlunitdatareq(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        sppa_t          *ppa;
        mblk_t          *hdrmp;
        mblk_t          *pktmp;
        dl_unitdata_req_t *dludp;
        int             dladdroff;
        int             dladdrlen;
        int             msize;
        int             error = 0;
        boolean_t       is_promisc;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ASSERT((MTYPE(mp) == M_PCPROTO) || (MTYPE(mp) == M_PROTO));
        dludp = (dl_unitdata_req_t *)mp->b_rptr;
        dladdroff = dludp->dl_dest_addr_offset;
        dladdrlen = dludp->dl_dest_addr_length;
        ASSERT(sps != NULL);
        ASSERT(!IS_SPS_PIOATTACH(sps));
        ASSERT(sps->sps_dlstate == DL_IDLE);
        ASSERT(q->q_ptr == sps);
        /*
         * If this stream is not attached to any ppas, then discard data
         * coming down through this stream.
         */
        ppa = sps->sps_ppa;
        if (ppa == NULL) {
                DBGERROR((CE_CONT, "DLPI unitdata: no attached ppa\n"));
                error = ENOLINK;
        } else if (mp->b_cont == NULL) {
                DBGERROR((CE_CONT, "DLPI unitdata: missing data\n"));
                error = EPROTO;
        }
        if (error != 0) {
                dluderrorind(q, mp, mp->b_rptr + dladdroff, dladdrlen,
                    DL_BADDATA, error);
                return (0);
        }
        ASSERT(mp->b_cont->b_rptr != NULL);
        /*
         * Check if outgoing packet size is larger than allowed. We use
         * msgdsize to count all of M_DATA blocks in the message.
         */
        msize = msgdsize(mp);
        if (msize > ppa->ppa_mtu) {
                /* Log, and send it anyway */
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_otoolongs++;
                mutex_exit(&ppa->ppa_sta_lock);
        }
        if (IS_SPS_KDEBUG(sps)) {
                SPDEBUG(PPP_DRV_NAME
                    "/%d: DL_UNITDATA_REQ (%d bytes) sps=0x%p flags=0x%b "
                    "ppa=0x%p flags=0x%b\n", sps->sps_mn_id, msize,
                    (void *)sps, sps->sps_flags, SPS_FLAGS_STR,
                    (void *)ppa, ppa->ppa_flags, PPA_FLAGS_STR);
        }
        /* Allocate a message (M_DATA) to contain PPP header bytes. */
        if ((hdrmp = allocb(PPP_HDRLEN, BPRI_MED)) == NULL) {
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_allocbfail++;
                mutex_exit(&ppa->ppa_sta_lock);
                DBGERROR((CE_CONT,
                    "DLPI unitdata: can't allocate header buffer\n"));
                dluderrorind(q, mp, mp->b_rptr + dladdroff, dladdrlen,
                    DL_SYSERR, ENOSR);
                return (0);
        }
        /*
         * Should there be any promiscuous stream(s), send the data up
         * for each promiscuous stream that we recognize.
         */
        rw_enter(&ppa->ppa_sib_lock, RW_READER);
        is_promisc = ppa->ppa_promicnt;
        if (is_promisc) {
                ASSERT(ppa->ppa_streams != NULL);
                sppp_dlprsendup(ppa->ppa_streams, mp->b_cont, sps->sps_sap,
                    B_FALSE);
        }
        rw_exit(&ppa->ppa_sib_lock);
        /* Discard DLPI header and keep only IP payload (mp->b_cont). */
        pktmp = mp->b_cont;
        mp->b_cont = NULL;
        freemsg(mp);
        mp = hdrmp;

        *(uchar_t *)mp->b_wptr++ = PPP_ALLSTATIONS;
        *(uchar_t *)mp->b_wptr++ = PPP_UI;
        *(uchar_t *)mp->b_wptr++ = ((uint16_t)sps->sps_sap >> 8) & 0xff;
        *(uchar_t *)mp->b_wptr++ = ((uint16_t)sps->sps_sap) & 0xff;
        ASSERT(MBLKL(mp) == PPP_HDRLEN);

        linkb(mp, pktmp);
        /*
         * Only time-stamp the packet with hrtime if the upper stream
         * is configured to do so.
         */
        if (IS_PPA_TIMESTAMP(ppa)) {
                ppa->ppa_lasttx = gethrtime();
        }
        /*
         * Just put this back on the queue and allow the write service
         * routine to handle it.  We're nested too deeply here to
         * rewind the stack sufficiently to prevent overflow.  This is
         * the slow path anyway.
         */
        if (putq(q, mp) == 0) {
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_oqdropped++;
                mutex_exit(&ppa->ppa_sta_lock);
                freemsg(mp);
        } else {
                qenable(q);
        }
        return (0);
}

/*
 * sppp_dlpromisconreq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Perform DL_PROMISCON_REQ request, called by sppp_mproto.
 */
static int
sppp_dlpromisconreq(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        t_uscalar_t     level;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        level = ((dl_promiscon_req_t *)mp->b_rptr)->dl_level;
        ASSERT(sps != NULL);

        /* snoop issues DL_PROMISCON_REQ more than once. */
        if (IS_SPS_PROMISC(sps)) {
                dlokack(q, mp, DL_PROMISCON_REQ);
        } else if ((level != DL_PROMISC_PHYS) && (level != DL_PROMISC_SAP) &&
            (level != DL_PROMISC_MULTI)) {
                DBGERROR((CE_CONT, "DLPI promiscon: bad level %d\n", level));
                dlerrorack(q, mp, DL_PROMISCON_REQ, DL_NOTSUPPORTED, 0);
        } else {
                qwriter(q, mp, sppp_dl_promiscon, PERIM_INNER);
        }
        return (0);
}

/*
 * sppp_dl_promiscon()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Called by qwriter (INNER) from sppp_dlpromisconreq as the result of
 *    receiving a DL_PROMISCON_REQ message.
 */
static void
sppp_dl_promiscon(queue_t *q, mblk_t *mp)
{
        spppstr_t       *sps;
        sppa_t          *ppa;

        ASSERT(q != NULL && q->q_ptr != NULL);
        sps = (spppstr_t *)q->q_ptr;
        ASSERT(!IS_SPS_PROMISC(sps));
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ppa = sps->sps_ppa;

        sps->sps_flags |= SPS_PROMISC;
        /*
         * We can't be sure that the sps_ppa field is valid, since the DLPI
         * spec says that DL_PROMISCON_REQ can be issued at any state, i.e.,
         * the request can be issued even before DL_ATTACH_REQ or PPPIO_ATTACH
         * be issued to associate this stream with a ppa.
         */
        if (ppa != NULL) {
                rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
                ppa->ppa_promicnt++;
                rw_exit(&ppa->ppa_sib_lock);
        }
        DBGDLPI((CE_CONT, "/%d: promiscuous mode on\n", sps->sps_mn_id));
        dlokack(q, mp, DL_PROMISCON_REQ);
}

/*
 * sppp_dlpromiscoffreq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Perform DL_PROMISCOFF_REQ request, called by sppp_mproto.
 */
static int
sppp_dlpromiscoffreq(queue_t *q, mblk_t *mp, spppstr_t *sps)
{
        t_uscalar_t     level;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        level = ((dl_promiscoff_req_t *)mp->b_rptr)->dl_level;
        ASSERT(sps != NULL);

        if (!IS_SPS_PROMISC(sps)) {
                DBGERROR((CE_CONT, "DLPI promiscoff: not promiscuous\n"));
                dlerrorack(q, mp, DL_PROMISCOFF_REQ, DL_NOTENAB, 0);
        } else if ((level != DL_PROMISC_PHYS) && (level != DL_PROMISC_SAP) &&
            (level != DL_PROMISC_MULTI)) {
                dlerrorack(q, mp, DL_PROMISCOFF_REQ, DL_NOTSUPPORTED, 0);
                DBGERROR((CE_CONT, "DLPI promiscoff: bad level %d\n", level));
        } else {
                qwriter(q, mp, sppp_dl_promiscoff, PERIM_INNER);
        }
        return (0);

}

/*
 * sppp_dl_promiscoff()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Called by qwriter (INNER) from sppp_dlpromiscoffreq as the result of
 *    receiving a DL_PROMISCOFF_REQ message.
 */
static void
sppp_dl_promiscoff(queue_t *q, mblk_t *mp)
{
        spppstr_t       *sps;
        sppa_t          *ppa;

        ASSERT(q != NULL && q->q_ptr != NULL);
        sps = (spppstr_t *)q->q_ptr;
        ASSERT(IS_SPS_PROMISC(sps));
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ppa = sps->sps_ppa;

        sps->sps_flags &= ~SPS_PROMISC;
        /*
         * We can't be guaranteed that the sps_ppa field is still valid, since
         * the control stream might have been closed earlier, in which case
         * the close procedure would have NULL'd out the sps_ppa.
         */
        if (ppa != NULL) {
                rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
                ASSERT(ppa->ppa_promicnt > 0);
                ppa->ppa_promicnt--;
                rw_exit(&ppa->ppa_sib_lock);
        }
        DBGDLPI((CE_CONT, "/%d: promiscuous mode off\n", sps->sps_mn_id));
        dlokack(q, mp, DL_PROMISCOFF_REQ);
}

/*
 * sppp_dlphyreq()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Perform DL_PHYS_ADDR_REQ request, called by sppp_mproto. This doesn't
 *    return anything useful, but it keeps ifconfig happy.
 */
/* ARGSUSED */
static int
sppp_dlphyreq(queue_t *q, mblk_t *mp, spppstr_t *us)
{
        static struct ether_addr addr = { 0 };

        dlphysaddrack(q, mp, (char *)&addr, ETHERADDRL);
        return (0);
}

/*
 * sppp_dladdether()
 *
 * Description:
 *    Prepend an empty Ethernet header to msg for snoop, et al. Free
 *    the original mblk if alloc fails. Only called for the purpose of sending
 *    packets up the promiscous stream.
 */
/* ARGSUSED */
static mblk_t *
sppp_dladdether(spppstr_t *sps, mblk_t *mp, t_scalar_t proto)
{
        mblk_t          *eh;
        t_scalar_t      type;

        if ((eh = allocb(sizeof (struct ether_header), BPRI_MED)) == NULL) {
                freemsg(mp);
                return (NULL);
        }
        if (proto == PPP_IP) {
                type = ETHERTYPE_IP;
        } else if (proto == PPP_IPV6) {
                type = ETHERTYPE_IPV6;
        } else {
                /*
                 * For all other protocols, end this up as an ETHERTYPE_PPP
                 * type of packet. Since we've skipped the PPP headers in the
                 * caller, make sure that we restore it. We know for sure that
                 * the PPP header still exists in the message (only skipped),
                 * since the sender of this message is pppd and it must have
                 * included the PPP header in front.
                 */
                type = ETHERTYPE_PPP;
                mp->b_rptr -= PPP_HDRLEN;
                ASSERT(mp->b_rptr >= mp->b_datap->db_base);
        }
        eh->b_wptr += sizeof (struct ether_header);
        bzero((caddr_t)eh->b_rptr, sizeof (struct ether_header));
        ((struct ether_header *)eh->b_rptr)->ether_type = htons((int16_t)type);

        linkb(eh, mp);
        return (eh);
}

/*
 * sppp_dladdud()
 *
 * Description:
 *    Prepend DL_UNITDATA_IND mblk to msg, free original alloc fails.
 */
/* ARGSUSED */
mblk_t *
sppp_dladdud(spppstr_t *sps, mblk_t *mp, t_scalar_t proto, boolean_t promisc)
{
        dl_unitdata_ind_t *dlu;
        mblk_t          *dh;
        size_t          size;
        t_scalar_t      type;

        size = sizeof (dl_unitdata_ind_t) + (2 * SPPP_ADDRL);
        if ((dh = allocb(size, BPRI_MED)) == NULL) {
                freemsg(mp);
                return (NULL);
        }

        dh->b_datap->db_type = M_PROTO;
        dh->b_wptr = dh->b_datap->db_lim;
        dh->b_rptr = dh->b_wptr - size;

        dlu = (dl_unitdata_ind_t *)dh->b_rptr;
        dlu->dl_primitive = DL_UNITDATA_IND;
        dlu->dl_dest_addr_length = SPPP_ADDRL;
        dlu->dl_dest_addr_offset = sizeof (dl_unitdata_ind_t);
        dlu->dl_src_addr_length = SPPP_ADDRL;
        dlu->dl_src_addr_offset = sizeof (dl_unitdata_ind_t) + SPPP_ADDRL;
        dlu->dl_group_address = 0;

        if (promisc) {
                if (proto == PPP_IP) {
                        type = ETHERTYPE_IP;
                } else if (proto == PPP_IPV6) {
                        type = ETHERTYPE_IPV6;
                } else {
                        /*
                         * For all other protocols, send this up as an
                         * ETHERTYPE_PPP type of packet. Since we've skipped
                         * the PPP headers in the caller, make sure that we
                         * restore it. We know for sure that the PPP header
                         * still exists in the message (only skipped), since
                         * the sender of this message is pppd and it must
                         * have included the PPP header in front.
                         */
                        type = ETHERTYPE_PPP;
                        mp->b_rptr -= PPP_HDRLEN;
                        ASSERT(mp->b_rptr >= mp->b_datap->db_base);
                }
        } else {
                type = sps->sps_req_sap;
        }
        /*
         * Send the DLPI client the data with the SAP they requested,
         * (e.g. ETHERTYPE_IP) rather than the PPP protocol (e.g. PPP_IP).
         */
        ((spppreqsap_t *)(dlu + 1))[0] = type;
        ((spppreqsap_t *)(dlu + 1))[1] = type;

        linkb(dh, mp);
        return (dh);
}

/*
 * sppp_dlprsendup()
 *
 * Description:
 *    For any valid promiscuous streams (marked with SPS_PROMISC and its
 *    sps_dlstate is DL_IDLE), send data upstream. The caller is expected
 *    to hold ppa_sib_lock when calling this procedure.
 */
void
sppp_dlprsendup(spppstr_t *sps, mblk_t *mp, t_scalar_t proto, boolean_t header)
{
        sppa_t  *ppa;
        mblk_t  *dmp;

        ASSERT(sps != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ppa = sps->sps_ppa;
        ASSERT(ppa != NULL);

        /* NOTE: caller must hold ppa_sib_lock in RW_READER mode */
        ASSERT(RW_READ_HELD(&ppa->ppa_sib_lock));

        for (; sps != NULL; sps = sps->sps_nextsib) {
                /*
                 * We specifically test to ensure that the DLPI state for the
                 * promiscous stream is IDLE (DL_IDLE), since such state tells
                 * us that the promiscous stream has been bound to PPP_ALLSAP.
                 */
                if (IS_SPS_PROMISC(sps) && (sps->sps_dlstate == DL_IDLE) &&
                    canputnext(sps->sps_rq)) {
                        if ((dmp = dupmsg(mp)) == NULL) {
                                mutex_enter(&ppa->ppa_sta_lock);
                                ppa->ppa_allocbfail++;
                                mutex_exit(&ppa->ppa_sta_lock);
                                continue;
                        }
                        if (header) {
                                dmp->b_rptr += PPP_HDRLEN;
                        }
                        if (IS_SPS_RAWDATA(sps)) {
                                /* function frees original message if fails */
                                dmp = sppp_dladdether(sps, dmp, proto);
                        } else {
                                /* function frees original message if fails */
                                dmp = sppp_dladdud(sps, dmp, proto, B_TRUE);
                        }
                        if (dmp != NULL) {
                                putnext(sps->sps_rq, dmp);
                        } else {
                                mutex_enter(&ppa->ppa_sta_lock);
                                ppa->ppa_allocbfail++;
                                mutex_exit(&ppa->ppa_sta_lock);
                        }
                }
        }
}