/*
 * sppp.c - Solaris STREAMS PPP multiplexing pseudo-driver
 *
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright (c) 2016 by Delphix. All rights reserved.
 * Copyright 2019, Joyent, Inc.
 *
 * Permission to use, copy, modify, and distribute this software and its
 * documentation is hereby granted, provided that the above copyright
 * notice appears in all copies.
 *
 * SUN MAKES NO REPRESENTATION OR WARRANTIES ABOUT THE SUITABILITY OF
 * THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
 * TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
 * PARTICULAR PURPOSE, OR NON-INFRINGEMENT.  SUN SHALL NOT BE LIABLE FOR
 * ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING OR
 * DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES
 *
 * Copyright (c) 1994 The Australian National University.
 * All rights reserved.
 *
 * Permission to use, copy, modify, and distribute this software and its
 * documentation is hereby granted, provided that the above copyright
 * notice appears in all copies.  This software is provided without any
 * warranty, express or implied. The Australian National University
 * makes no representations about the suitability of this software for
 * any purpose.
 *
 * IN NO EVENT SHALL THE AUSTRALIAN NATIONAL UNIVERSITY BE LIABLE TO ANY
 * PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
 * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF
 * THE AUSTRALIAN NATIONAL UNIVERSITY HAS BEEN ADVISED OF THE POSSIBILITY
 * OF SUCH DAMAGE.
 *
 * THE AUSTRALIAN NATIONAL UNIVERSITY SPECIFICALLY DISCLAIMS ANY WARRANTIES,
 * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
 * ON AN "AS IS" BASIS, AND THE AUSTRALIAN NATIONAL UNIVERSITY HAS NO
 * OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS,
 * OR MODIFICATIONS.
 *
 * This driver is derived from the original SVR4 STREAMS PPP driver
 * originally written by Paul Mackerras <paul.mackerras@cs.anu.edu.au>.
 *
 * Adi Masputra <adi.masputra@sun.com> rewrote and restructured the code
 * for improved performance and scalability.
 */

#define RCSID   "$Id: sppp.c,v 1.0 2000/05/08 01:10:12 masputra Exp $"

#include <sys/types.h>
#include <sys/debug.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/sysmacros.h>
#include <sys/errno.h>
#include <sys/time.h>
#include <sys/cmn_err.h>
#include <sys/kmem.h>
#include <sys/conf.h>
#include <sys/dlpi.h>
#include <sys/ddi.h>
#include <sys/kstat.h>
#include <sys/strsun.h>
#include <sys/ethernet.h>
#include <sys/policy.h>
#include <sys/zone.h>
#include <net/ppp_defs.h>
#include <net/pppio.h>
#include "sppp.h"
#include "s_common.h"

/*
 * This is used to tag official Solaris sources.  Please do not define
 * "INTERNAL_BUILD" when building this software outside of Sun Microsystems.
 */
#ifdef INTERNAL_BUILD
/* MODINFO is limited to 32 characters. */
const char sppp_module_description[] = "PPP 4.0 mux";
#else /* INTERNAL_BUILD */
const char sppp_module_description[] = "ANU PPP mux";

/* LINTED */
static const char buildtime[] = "Built " __DATE__ " at " __TIME__
#ifdef DEBUG
" DEBUG"
#endif
"\n";
#endif /* INTERNAL_BUILD */

static void     sppp_inner_ioctl(queue_t *, mblk_t *);
static void     sppp_outer_ioctl(queue_t *, mblk_t *);
static queue_t  *sppp_send(queue_t *, mblk_t **, spppstr_t *);
static queue_t  *sppp_recv(queue_t *, mblk_t **, spppstr_t *);
static void     sppp_recv_nondata(queue_t *, mblk_t *, spppstr_t *);
static queue_t  *sppp_outpkt(queue_t *, mblk_t **, int, spppstr_t *);
static spppstr_t *sppp_inpkt(queue_t *, mblk_t *, spppstr_t *);
static int      sppp_kstat_update(kstat_t *, int);
static void     sppp_release_pkts(sppa_t *, uint16_t);

/*
 * sps_list contains the list of active per-stream instance state structures
 * ordered on the minor device number (see sppp.h for details). All streams
 * opened to this driver are threaded together in this list.
 */
static spppstr_t *sps_list = NULL;
/*
 * ppa_list contains the list of active per-attachment instance state
 * structures ordered on the ppa id number (see sppp.h for details). All of
 * the ppa structures created once per PPPIO_NEWPPA ioctl are threaded together
 * in this list. There is exactly one ppa structure for a given PPP interface,
 * and multiple sps streams (upper streams) may share a ppa by performing
 * an attachment explicitly (PPPIO_ATTACH) or implicitly (DL_ATTACH_REQ).
 */
static sppa_t *ppa_list = NULL;

static const char *kstats_names[] = { SPPP_KSTATS_NAMES };
static const char *kstats64_names[] = { SPPP_KSTATS64_NAMES };

/*
 * map proto (which is an IANA defined ppp network protocol) to
 * a bit position indicated by NP_* in ppa_npflag
 */
static uint32_t
sppp_ppp2np(uint16_t proto)
{
        switch (proto) {
        case PPP_IP:
                return (NP_IP);
        case PPP_IPV6:
                return (NP_IPV6);
        default:
                return (0);
        }
}

/*
 * sppp_open()
 *
 * MT-Perimeters:
 *    exclusive inner, exclusive outer.
 *
 * Description:
 *    Common open procedure for module.
 */
/* ARGSUSED */
int
sppp_open(queue_t *q, dev_t *devp, int oflag, int sflag, cred_t *credp)
{
        spppstr_t       *sps;
        spppstr_t       **nextmn;
        minor_t         mn;

        ASSERT(q != NULL && devp != NULL);
        ASSERT(sflag != MODOPEN);

        if (q->q_ptr != NULL) {
                return (0);             /* already open */
        }
        if (sflag != CLONEOPEN) {
                return (OPENFAIL);
        }
        /*
         * The sps list is sorted using the minor number as the key. The
         * following code walks the list to find the lowest valued minor
         * number available to be used.
         */
        mn = 0;
        for (nextmn = &sps_list; (sps = *nextmn) != NULL;
            nextmn = &sps->sps_nextmn) {
                if (sps->sps_mn_id != mn) {
                        break;
                }
                ++mn;
        }
        sps = (spppstr_t *)kmem_zalloc(sizeof (spppstr_t), KM_SLEEP);
        ASSERT(sps != NULL);            /* KM_SLEEP must never return NULL */
        sps->sps_nextmn = *nextmn;      /* insert stream in global list */
        *nextmn = sps;
        sps->sps_mn_id = mn;            /* save minor id for this stream */
        sps->sps_rq = q;                /* save read queue pointer */
        sps->sps_sap = -1;              /* no sap bound to stream */
        sps->sps_dlstate = DL_UNATTACHED; /* dlpi state is unattached */
        sps->sps_npmode = NPMODE_DROP;  /* drop all packets initially */
        sps->sps_zoneid = crgetzoneid(credp);
        q->q_ptr = WR(q)->q_ptr = (caddr_t)sps;
        /*
         * We explicitly disable the automatic queue scheduling for the
         * write-side to obtain complete control over queuing during transmit.
         * Packets will be queued at the upper write queue and the service
         * routine will not be called until it gets scheduled by having the
         * lower write service routine call the qenable(WR(uq)) for all streams
         * attached to the same ppa instance.
         */
        noenable(WR(q));
        *devp = makedevice(getmajor(*devp), mn);
        qprocson(q);
        return (0);
}

/*
 * Free storage used by a PPA.  This is not called until the last PPA
 * user closes their connection or reattaches to a different PPA.
 */
static void
sppp_free_ppa(sppa_t *ppa)
{
        sppa_t **nextppa;

        ASSERT(ppa->ppa_refcnt == 1);
        if (ppa->ppa_kstats != NULL) {
                kstat_delete(ppa->ppa_kstats);
                ppa->ppa_kstats = NULL;
        }
        mutex_destroy(&ppa->ppa_sta_lock);
        mutex_destroy(&ppa->ppa_npmutex);
        rw_destroy(&ppa->ppa_sib_lock);
        nextppa = &ppa_list;
        while (*nextppa != NULL) {
                if (*nextppa == ppa) {
                        *nextppa = ppa->ppa_nextppa;
                        break;
                }
                nextppa = &(*nextppa)->ppa_nextppa;
        }
        kmem_free(ppa, sizeof (*ppa));
}

/*
 * Create a new PPA.  Caller must be exclusive on outer perimeter.
 */
sppa_t *
sppp_create_ppa(uint32_t ppa_id, zoneid_t zoneid)
{
        sppa_t *ppa;
        sppa_t *curppa;
        sppa_t **availppa;
        char unit[32];          /* Unit name */
        const char **cpp;
        kstat_t *ksp;
        kstat_named_t *knt;

        /*
         * NOTE: unit *must* be named for the driver
         * name plus the ppa number so that netstat
         * can find the statistics.
         */
        (void) sprintf(unit, "%s" "%d", PPP_DRV_NAME, ppa_id);
        /*
         * Make sure we can allocate a buffer to
         * contain the ppa to be sent upstream, as
         * well as the actual ppa structure and its
         * associated kstat structure.
         */
        ppa = (sppa_t *)kmem_zalloc(sizeof (sppa_t),
            KM_NOSLEEP);
        ksp = kstat_create(PPP_DRV_NAME, ppa_id, unit, "net", KSTAT_TYPE_NAMED,
            sizeof (sppp_kstats_t) / sizeof (kstat_named_t), 0);

        if (ppa == NULL || ksp == NULL) {
                if (ppa != NULL) {
                        kmem_free(ppa, sizeof (sppa_t));
                }
                if (ksp != NULL) {
                        kstat_delete(ksp);
                }
                return (NULL);
        }
        ppa->ppa_kstats = ksp;          /* chain kstat structure */
        ppa->ppa_ppa_id = ppa_id;       /* record ppa id */
        ppa->ppa_zoneid = zoneid;       /* zone that owns this PPA */
        ppa->ppa_mtu = PPP_MAXMTU;      /* 65535-(PPP_HDRLEN+PPP_FCSLEN) */
        ppa->ppa_mru = PPP_MAXMRU;      /* 65000 */

        mutex_init(&ppa->ppa_sta_lock, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&ppa->ppa_npmutex, NULL, MUTEX_DRIVER, NULL);
        rw_init(&ppa->ppa_sib_lock, NULL, RW_DRIVER, NULL);

        /*
         * Prepare and install kstat counters.  Note that for netstat
         * -i to work, there needs to be "ipackets", "opackets",
         * "ierrors", and "oerrors" kstat named variables.
         */
        knt = (kstat_named_t *)ksp->ks_data;
        for (cpp = kstats_names; cpp < kstats_names + Dim(kstats_names);
            cpp++) {
                kstat_named_init(knt, *cpp, KSTAT_DATA_UINT32);
                knt++;
        }
        for (cpp = kstats64_names; cpp < kstats64_names + Dim(kstats64_names);
            cpp++) {
                kstat_named_init(knt, *cpp, KSTAT_DATA_UINT64);
                knt++;
        }
        ksp->ks_update = sppp_kstat_update;
        ksp->ks_private = (void *)ppa;
        kstat_install(ksp);

        /* link to the next ppa and insert into global list */
        availppa = &ppa_list;
        while ((curppa = *availppa) != NULL) {
                if (ppa_id < curppa->ppa_ppa_id)
                        break;
                availppa = &curppa->ppa_nextppa;
        }
        ppa->ppa_nextppa = *availppa;
        *availppa = ppa;
        return (ppa);
}

/*
 * sppp_close()
 *
 * MT-Perimeters:
 *    exclusive inner, exclusive outer.
 *
 * Description:
 *    Common close procedure for module.
 */
/* ARGSUSED */
int
sppp_close(queue_t *q, int flags __unused, cred_t *credp __unused)
{
        spppstr_t       *sps;
        spppstr_t       **nextmn;
        spppstr_t       *sib;
        sppa_t          *ppa;
        mblk_t          *mp;

        ASSERT(q != NULL && q->q_ptr != NULL);
        sps = (spppstr_t *)q->q_ptr;
        qprocsoff(q);

        ppa = sps->sps_ppa;
        if (ppa == NULL) {
                ASSERT(!IS_SPS_CONTROL(sps));
                goto close_unattached;
        }
        if (IS_SPS_CONTROL(sps)) {
                uint32_t        cnt = 0;

                ASSERT(ppa != NULL);
                ASSERT(ppa->ppa_ctl == sps);
                ppa->ppa_ctl = NULL;
                /*
                 * STREAMS framework always issues I_UNLINK prior to close,
                 * since we only allow I_LINK under the control stream.
                 * A given ppa structure has at most one lower stream pointed
                 * by the ppa_lower_wq field, because we only allow a single
                 * linkage (I_LINK) to be done on the control stream.
                 */
                ASSERT(ppa->ppa_lower_wq == NULL);
                /*
                 * Walk through all of sibling streams attached to this ppa,
                 * and remove all references to this ppa. We have exclusive
                 * access for the entire driver here, so there's no need
                 * to hold ppa_sib_lock.
                 */
                cnt++;
                sib = ppa->ppa_streams;
                while (sib != NULL) {
                        ASSERT(ppa == sib->sps_ppa);
                        sib->sps_npmode = NPMODE_DROP;
                        sib->sps_flags &= ~(SPS_PIOATTACH | SPS_CACHED);
                        /*
                         * There should be a preallocated hangup
                         * message here.  Fetch it and send it up to
                         * the stream head.  This will cause IP to
                         * mark the interface as "down."
                         */
                        if ((mp = sib->sps_hangup) != NULL) {
                                sib->sps_hangup = NULL;
                                /*
                                 * M_HANGUP works with IP, but snoop
                                 * is lame and requires M_ERROR.  Send
                                 * up a clean error code instead.
                                 *
                                 * XXX if snoop is fixed, fix this, too.
                                 */
                                MTYPE(mp) = M_ERROR;
                                *mp->b_wptr++ = ENXIO;
                                putnext(sib->sps_rq, mp);
                        }
                        qenable(WR(sib->sps_rq));
                        cnt++;
                        sib = sib->sps_nextsib;
                }
                ASSERT(ppa->ppa_refcnt == cnt);
        } else {
                ASSERT(ppa->ppa_streams != NULL);
                ASSERT(ppa->ppa_ctl != sps);
                mp = NULL;
                if (sps->sps_sap == PPP_IP) {
                        ppa->ppa_ip_cache = NULL;
                        mp = create_lsmsg(PPP_LINKSTAT_IPV4_UNBOUND);
                } else if (sps->sps_sap == PPP_IPV6) {
                        ppa->ppa_ip6_cache = NULL;
                        mp = create_lsmsg(PPP_LINKSTAT_IPV6_UNBOUND);
                }
                /* Tell the daemon the bad news. */
                if (mp != NULL && ppa->ppa_ctl != NULL &&
                    (sps->sps_npmode == NPMODE_PASS ||
                    sps->sps_npmode == NPMODE_QUEUE)) {
                        putnext(ppa->ppa_ctl->sps_rq, mp);
                } else {
                        freemsg(mp);
                }
                /*
                 * Walk through all of sibling streams attached to the
                 * same ppa, and remove this stream from the sibling
                 * streams list. We have exclusive access for the
                 * entire driver here, so there's no need to hold
                 * ppa_sib_lock.
                 */
                sib = ppa->ppa_streams;
                if (sib == sps) {
                        ppa->ppa_streams = sps->sps_nextsib;
                } else {
                        while (sib->sps_nextsib != NULL) {
                                if (sib->sps_nextsib == sps) {
                                        sib->sps_nextsib = sps->sps_nextsib;
                                        break;
                                }
                                sib = sib->sps_nextsib;
                        }
                }
                sps->sps_nextsib = NULL;
                freemsg(sps->sps_hangup);
                sps->sps_hangup = NULL;
                /*
                 * Check if this is a promiscous stream. If the SPS_PROMISC bit
                 * is still set, it means that the stream is closed without
                 * ever having issued DL_DETACH_REQ or DL_PROMISCOFF_REQ.
                 * In this case, we simply decrement the promiscous counter,
                 * and it's safe to do it without holding ppa_sib_lock since
                 * we're exclusive (inner and outer) at this point.
                 */
                if (IS_SPS_PROMISC(sps)) {
                        ASSERT(ppa->ppa_promicnt > 0);
                        ppa->ppa_promicnt--;
                }
        }
        /* If we're the only one left, then delete now. */
        if (ppa->ppa_refcnt <= 1)
                sppp_free_ppa(ppa);
        else
                ppa->ppa_refcnt--;
close_unattached:
        q->q_ptr = WR(q)->q_ptr = NULL;
        for (nextmn = &sps_list; *nextmn != NULL;
            nextmn = &(*nextmn)->sps_nextmn) {
                if (*nextmn == sps) {
                        *nextmn = sps->sps_nextmn;
                        break;
                }
        }
        kmem_free(sps, sizeof (spppstr_t));
        return (0);
}

static void
sppp_ioctl(struct queue *q, mblk_t *mp)
{
        spppstr_t       *sps;
        spppstr_t       *nextsib;
        sppa_t          *ppa;
        struct iocblk   *iop;
        mblk_t          *nmp;
        enum NPmode     npmode;
        struct ppp_idle *pip;
        struct ppp_stats64 *psp;
        struct ppp_comp_stats *pcsp;
        hrtime_t        hrtime;
        int             sap;
        int             count = 0;
        int             error = EINVAL;

        sps = (spppstr_t *)q->q_ptr;
        ppa = sps->sps_ppa;

        iop = (struct iocblk *)mp->b_rptr;
        switch (iop->ioc_cmd) {
        case PPPIO_NPMODE:
                if (!IS_SPS_CONTROL(sps)) {
                        break;          /* return EINVAL */
                } else if (iop->ioc_count != 2 * sizeof (uint32_t) ||
                    (mp->b_cont == NULL)) {
                        error = EPROTO;
                        break;
                }
                ASSERT(ppa != NULL);
                ASSERT(mp->b_cont->b_rptr != NULL);
                ASSERT(sps->sps_npmode == NPMODE_PASS);
                sap = ((uint32_t *)mp->b_cont->b_rptr)[0];
                npmode = (enum NPmode)((uint32_t *)mp->b_cont->b_rptr)[1];
                /*
                 * Walk the sibling streams which belong to the same
                 * ppa, and try to find a stream with matching sap
                 * number.
                 */
                rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
                for (nextsib = ppa->ppa_streams; nextsib != NULL;
                    nextsib = nextsib->sps_nextsib) {
                        if (nextsib->sps_sap == sap) {
                                break;  /* found it */
                        }
                }
                if (nextsib == NULL) {
                        rw_exit(&ppa->ppa_sib_lock);
                        break;          /* return EINVAL */
                } else {
                        nextsib->sps_npmode = npmode;
                        if ((nextsib->sps_npmode != NPMODE_QUEUE) &&
                            (WR(nextsib->sps_rq)->q_first != NULL)) {
                                qenable(WR(nextsib->sps_rq));
                        }
                }
                rw_exit(&ppa->ppa_sib_lock);
                error = 0;      /* return success */
                break;
        case PPPIO_GIDLE:
                if (ppa == NULL) {
                        ASSERT(!IS_SPS_CONTROL(sps));
                        error = ENOLINK;
                        break;
                } else if (!IS_PPA_TIMESTAMP(ppa)) {
                        break;          /* return EINVAL */
                }
                if ((nmp = allocb(sizeof (struct ppp_idle),
                    BPRI_MED)) == NULL) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_allocbfail++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        error = ENOSR;
                        break;
                }
                if (mp->b_cont != NULL) {
                        freemsg(mp->b_cont);
                }
                mp->b_cont = nmp;
                pip = (struct ppp_idle *)nmp->b_wptr;
                nmp->b_wptr += sizeof (struct ppp_idle);
                /*
                 * Get current timestamp and subtract the tx and rx
                 * timestamps to get the actual idle time to be
                 * returned.
                 */
                hrtime = gethrtime();
                pip->xmit_idle = (hrtime - ppa->ppa_lasttx) / 1000000000ul;
                pip->recv_idle = (hrtime - ppa->ppa_lastrx) / 1000000000ul;
                count = msgsize(nmp);
                error = 0;
                break;          /* return success (error is 0) */
        case PPPIO_GTYPE:
                nmp = allocb(sizeof (uint32_t), BPRI_MED);
                if (nmp == NULL) {
                        error = ENOSR;
                        break;
                }
                if (mp->b_cont != NULL) {
                        freemsg(mp->b_cont);
                }
                mp->b_cont = nmp;
                /*
                 * Let the requestor know that we are the PPP
                 * multiplexer (PPPTYP_MUX).
                 */
                *(uint32_t *)nmp->b_wptr = PPPTYP_MUX;
                nmp->b_wptr += sizeof (uint32_t);
                count = msgsize(nmp);
                error = 0;              /* return success */
                break;
        case PPPIO_GETSTAT64:
                if (ppa == NULL) {
                        break;          /* return EINVAL */
                } else if ((ppa->ppa_lower_wq != NULL) &&
                    !IS_PPA_LASTMOD(ppa)) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        /*
                         * We match sps_ioc_id on the M_IOC{ACK,NAK},
                         * so if the response hasn't come back yet,
                         * new ioctls must be queued instead.
                         */
                        if (IS_SPS_IOCQ(sps)) {
                                mutex_exit(&ppa->ppa_sta_lock);
                                if (!putq(q, mp)) {
                                        error = EAGAIN;
                                        break;
                                }
                                return;
                        } else {
                                ppa->ppa_ioctlsfwd++;
                                /*
                                 * Record the ioctl CMD & ID - this will be
                                 * used to check the ACK or NAK responses
                                 * coming from below.
                                 */
                                sps->sps_ioc_id = iop->ioc_id;
                                sps->sps_flags |= SPS_IOCQ;
                                mutex_exit(&ppa->ppa_sta_lock);
                        }
                        putnext(ppa->ppa_lower_wq, mp);
                        return; /* don't ack or nak the request */
                }
                nmp = allocb(sizeof (*psp), BPRI_MED);
                if (nmp == NULL) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_allocbfail++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        error = ENOSR;
                        break;
                }
                if (mp->b_cont != NULL) {
                        freemsg(mp->b_cont);
                }
                mp->b_cont = nmp;
                psp = (struct ppp_stats64 *)nmp->b_wptr;
                /*
                 * Copy the contents of ppp_stats64 structure for this
                 * ppa and return them to the caller.
                 */
                mutex_enter(&ppa->ppa_sta_lock);
                bcopy(&ppa->ppa_stats, psp, sizeof (*psp));
                mutex_exit(&ppa->ppa_sta_lock);
                nmp->b_wptr += sizeof (*psp);
                count = sizeof (*psp);
                error = 0;              /* return success */
                break;
        case PPPIO_GETCSTAT:
                if (ppa == NULL) {
                        break;          /* return EINVAL */
                } else if ((ppa->ppa_lower_wq != NULL) &&
                    !IS_PPA_LASTMOD(ppa)) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        /*
                         * See comments in PPPIO_GETSTAT64 case
                         * in sppp_ioctl().
                         */
                        if (IS_SPS_IOCQ(sps)) {
                                mutex_exit(&ppa->ppa_sta_lock);
                                if (!putq(q, mp)) {
                                        error = EAGAIN;
                                        break;
                                }
                                return;
                        } else {
                                ppa->ppa_ioctlsfwd++;
                                /*
                                 * Record the ioctl CMD & ID - this will be
                                 * used to check the ACK or NAK responses
                                 * coming from below.
                                 */
                                sps->sps_ioc_id = iop->ioc_id;
                                sps->sps_flags |= SPS_IOCQ;
                                mutex_exit(&ppa->ppa_sta_lock);
                        }
                        putnext(ppa->ppa_lower_wq, mp);
                        return; /* don't ack or nak the request */
                }
                nmp = allocb(sizeof (struct ppp_comp_stats), BPRI_MED);
                if (nmp == NULL) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_allocbfail++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        error = ENOSR;
                        break;
                }
                if (mp->b_cont != NULL) {
                        freemsg(mp->b_cont);
                }
                mp->b_cont = nmp;
                pcsp = (struct ppp_comp_stats *)nmp->b_wptr;
                nmp->b_wptr += sizeof (struct ppp_comp_stats);
                bzero((caddr_t)pcsp, sizeof (struct ppp_comp_stats));
                count = msgsize(nmp);
                error = 0;              /* return success */
                break;
        }

        if (error == 0) {
                /* Success; tell the user. */
                miocack(q, mp, count, 0);
        } else {
                /* Failure; send error back upstream. */
                miocnak(q, mp, 0, error);
        }
}

/*
 * sppp_uwput()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Upper write-side put procedure. Messages from above arrive here.
 */
int
sppp_uwput(queue_t *q, mblk_t *mp)
{
        queue_t         *nextq;
        spppstr_t       *sps;
        sppa_t          *ppa;
        struct iocblk   *iop;
        int             error;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        sps = (spppstr_t *)q->q_ptr;
        ppa = sps->sps_ppa;

        switch (MTYPE(mp)) {
        case M_PCPROTO:
        case M_PROTO:
                if (IS_SPS_CONTROL(sps)) {
                        ASSERT(ppa != NULL);
                        /*
                         * Intentionally change this to a high priority
                         * message so it doesn't get queued up. M_PROTO is
                         * specifically used for signalling between pppd and its
                         * kernel-level component(s), such as ppptun, so we
                         * make sure that it doesn't get queued up behind
                         * data messages.
                         */
                        MTYPE(mp) = M_PCPROTO;
                        if ((ppa->ppa_lower_wq != NULL) &&
                            canputnext(ppa->ppa_lower_wq)) {
                                mutex_enter(&ppa->ppa_sta_lock);
                                ppa->ppa_mctlsfwd++;
                                mutex_exit(&ppa->ppa_sta_lock);
                                putnext(ppa->ppa_lower_wq, mp);
                        } else {
                                mutex_enter(&ppa->ppa_sta_lock);
                                ppa->ppa_mctlsfwderr++;
                                mutex_exit(&ppa->ppa_sta_lock);
                                freemsg(mp);
                        }
                } else {
                        (void) sppp_mproto(q, mp, sps);
                        return (0);
                }
                break;
        case M_DATA:
                if ((nextq = sppp_send(q, &mp, sps)) != NULL)
                        putnext(nextq, mp);
                break;
        case M_IOCTL:
                error = EINVAL;
                iop = (struct iocblk *)mp->b_rptr;
                switch (iop->ioc_cmd) {
                case DLIOCRAW:
                case DL_IOC_HDR_INFO:
                case PPPIO_ATTACH:
                case PPPIO_DEBUG:
                case PPPIO_DETACH:
                case PPPIO_LASTMOD:
                case PPPIO_MRU:
                case PPPIO_MTU:
                case PPPIO_USETIMESTAMP:
                case PPPIO_BLOCKNP:
                case PPPIO_UNBLOCKNP:
                        qwriter(q, mp, sppp_inner_ioctl, PERIM_INNER);
                        return (0);
                case I_LINK:
                case I_UNLINK:
                case PPPIO_NEWPPA:
                        qwriter(q, mp, sppp_outer_ioctl, PERIM_OUTER);
                        return (0);
                case PPPIO_NPMODE:
                case PPPIO_GIDLE:
                case PPPIO_GTYPE:
                case PPPIO_GETSTAT64:
                case PPPIO_GETCSTAT:
                        /*
                         * These require additional auto variables to
                         * handle, so (for optimization reasons)
                         * they're moved off to a separate function.
                         */
                        sppp_ioctl(q, mp);
                        return (0);
                case PPPIO_GETSTAT:
                        break;                  /* 32 bit interface gone */
                default:
                        if (iop->ioc_cr == NULL ||
                            secpolicy_ppp_config(iop->ioc_cr) != 0) {
                                error = EPERM;
                                break;
                        } else if ((ppa == NULL) ||
                            (ppa->ppa_lower_wq == NULL)) {
                                break;          /* return EINVAL */
                        }
                        mutex_enter(&ppa->ppa_sta_lock);
                        /*
                         * See comments in PPPIO_GETSTAT64 case
                         * in sppp_ioctl().
                         */
                        if (IS_SPS_IOCQ(sps)) {
                                mutex_exit(&ppa->ppa_sta_lock);
                                if (!putq(q, mp)) {
                                        error = EAGAIN;
                                        break;
                                }
                                return (0);
                        } else {
                                ppa->ppa_ioctlsfwd++;
                                /*
                                 * Record the ioctl CMD & ID -
                                 * this will be used to check the
                                 * ACK or NAK responses coming from below.
                                 */
                                sps->sps_ioc_id = iop->ioc_id;
                                sps->sps_flags |= SPS_IOCQ;
                                mutex_exit(&ppa->ppa_sta_lock);
                        }
                        putnext(ppa->ppa_lower_wq, mp);
                        return (0);     /* don't ack or nak the request */
                }
                /* Failure; send error back upstream. */
                miocnak(q, mp, 0, error);
                break;
        case M_FLUSH:
                if (*mp->b_rptr & FLUSHW) {
                        flushq(q, FLUSHDATA);
                }
                if (*mp->b_rptr & FLUSHR) {
                        *mp->b_rptr &= ~FLUSHW;
                        qreply(q, mp);
                } else {
                        freemsg(mp);
                }
                break;
        default:
                freemsg(mp);
                break;
        }
        return (0);
}

/*
 * sppp_uwsrv()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Upper write-side service procedure. Note that this procedure does
 *    not get called when a message is placed on our write-side queue, since
 *    automatic queue scheduling has been turned off by noenable() when
 *    the queue was opened. We do this on purpose, as we explicitly control
 *    the write-side queue. Therefore, this procedure gets called when
 *    the lower write service procedure qenable() the upper write stream queue.
 */
int
sppp_uwsrv(queue_t *q)
{
        spppstr_t       *sps;
        sppa_t          *ppa;
        mblk_t          *mp;
        queue_t         *nextq;
        struct iocblk   *iop;

        ASSERT(q != NULL && q->q_ptr != NULL);
        sps = (spppstr_t *)q->q_ptr;

        while ((mp = getq(q)) != NULL) {
                if (MTYPE(mp) == M_IOCTL) {
                        ppa = sps->sps_ppa;
                        if ((ppa == NULL) || (ppa->ppa_lower_wq == NULL)) {
                                miocnak(q, mp, 0, EINVAL);
                                continue;
                        }

                        iop = (struct iocblk *)mp->b_rptr;
                        mutex_enter(&ppa->ppa_sta_lock);
                        /*
                         * See comments in PPPIO_GETSTAT64 case
                         * in sppp_ioctl().
                         */
                        if (IS_SPS_IOCQ(sps)) {
                                mutex_exit(&ppa->ppa_sta_lock);
                                if (putbq(q, mp) == 0)
                                        miocnak(q, mp, 0, EAGAIN);
                                break;
                        } else {
                                ppa->ppa_ioctlsfwd++;
                                sps->sps_ioc_id = iop->ioc_id;
                                sps->sps_flags |= SPS_IOCQ;
                                mutex_exit(&ppa->ppa_sta_lock);
                                putnext(ppa->ppa_lower_wq, mp);
                        }
                } else if ((nextq =
                    sppp_outpkt(q, &mp, msgdsize(mp), sps)) == NULL) {
                        if (mp != NULL) {
                                if (putbq(q, mp) == 0)
                                        freemsg(mp);
                                break;
                        }
                } else {
                        putnext(nextq, mp);
                }
        }
        return (0);
}

void
sppp_remove_ppa(spppstr_t *sps)
{
        spppstr_t *nextsib;
        sppa_t *ppa = sps->sps_ppa;

        rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
        if (ppa->ppa_refcnt <= 1) {
                rw_exit(&ppa->ppa_sib_lock);
                sppp_free_ppa(ppa);
        } else {
                nextsib = ppa->ppa_streams;
                if (nextsib == sps) {
                        ppa->ppa_streams = sps->sps_nextsib;
                } else {
                        while (nextsib->sps_nextsib != NULL) {
                                if (nextsib->sps_nextsib == sps) {
                                        nextsib->sps_nextsib =
                                            sps->sps_nextsib;
                                        break;
                                }
                                nextsib = nextsib->sps_nextsib;
                        }
                }
                ppa->ppa_refcnt--;
                /*
                 * And if this stream was marked as promiscuous
                 * (SPS_PROMISC), then we need to update the
                 * promiscuous streams count. This should only happen
                 * when DL_DETACH_REQ is issued prior to marking the
                 * stream as non-promiscuous, through
                 * DL_PROMISCOFF_REQ request.
                 */
                if (IS_SPS_PROMISC(sps)) {
                        ASSERT(ppa->ppa_promicnt > 0);
                        ppa->ppa_promicnt--;
                }
                rw_exit(&ppa->ppa_sib_lock);
        }
        sps->sps_nextsib = NULL;
        sps->sps_ppa = NULL;
        freemsg(sps->sps_hangup);
        sps->sps_hangup = NULL;
}

sppa_t *
sppp_find_ppa(uint32_t ppa_id)
{
        sppa_t *ppa;

        for (ppa = ppa_list; ppa != NULL; ppa = ppa->ppa_nextppa) {
                if (ppa->ppa_ppa_id == ppa_id) {
                        break;  /* found the ppa */
                }
        }
        return (ppa);
}

/*
 * sppp_inner_ioctl()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer
 *
 * Description:
 *    Called by sppp_uwput as a result of receiving ioctls which require
 *    an exclusive access at the inner perimeter.
 */
static void
sppp_inner_ioctl(queue_t *q, mblk_t *mp)
{
        spppstr_t       *sps;
        sppa_t          *ppa;
        struct iocblk   *iop;
        mblk_t          *nmp;
        int             error = EINVAL;
        int             count = 0;
        int             dbgcmd;
        int             mru, mtu;
        uint32_t        ppa_id;
        hrtime_t        hrtime;
        uint16_t        proto;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);

        sps = (spppstr_t *)q->q_ptr;
        ppa = sps->sps_ppa;
        iop = (struct iocblk *)mp->b_rptr;
        switch (iop->ioc_cmd) {
        case DLIOCRAW:
                if (IS_SPS_CONTROL(sps)) {
                        break;          /* return EINVAL */
                }
                sps->sps_flags |= SPS_RAWDATA;
                error = 0;              /* return success */
                break;
        case DL_IOC_HDR_INFO:
                if (IS_SPS_CONTROL(sps)) {
                        break;          /* return EINVAL */
                } else if ((mp->b_cont == NULL) ||
                    *((t_uscalar_t *)mp->b_cont->b_rptr) != DL_UNITDATA_REQ ||
                    (MBLKL(mp->b_cont) < (sizeof (dl_unitdata_req_t) +
                    SPPP_ADDRL))) {
                        error = EPROTO;
                        break;
                } else if (ppa == NULL) {
                        error = ENOLINK;
                        break;
                }
                if ((nmp = allocb(PPP_HDRLEN, BPRI_MED)) == NULL) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_allocbfail++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        error = ENOMEM;
                        break;
                }
                *(uchar_t *)nmp->b_wptr++ = PPP_ALLSTATIONS;
                *(uchar_t *)nmp->b_wptr++ = PPP_UI;
                *(uchar_t *)nmp->b_wptr++ = sps->sps_sap >> 8;
                *(uchar_t *)nmp->b_wptr++ = sps->sps_sap & 0xff;
                ASSERT(MBLKL(nmp) == PPP_HDRLEN);

                linkb(mp, nmp);
                sps->sps_flags |= SPS_FASTPATH;
                error = 0;              /* return success */
                count = msgsize(nmp);
                break;
        case PPPIO_ATTACH:
                if (IS_SPS_CONTROL(sps) || IS_SPS_PIOATTACH(sps) ||
                    (sps->sps_dlstate != DL_UNATTACHED) ||
                    (iop->ioc_count != sizeof (uint32_t))) {
                        break;          /* return EINVAL */
                } else if (mp->b_cont == NULL) {
                        error = EPROTO;
                        break;
                }
                ASSERT(mp->b_cont->b_rptr != NULL);
                /* If there's something here, it's detached. */
                if (ppa != NULL) {
                        sppp_remove_ppa(sps);
                }
                ppa_id = *(uint32_t *)mp->b_cont->b_rptr;
                ppa = sppp_find_ppa(ppa_id);
                /*
                 * If we can't find it, then it's either because the requestor
                 * has supplied a wrong ppa_id to be attached to, or because
                 * the control stream for the specified ppa_id has been closed
                 * before we get here.
                 */
                if (ppa == NULL) {
                        error = ENOENT;
                        break;
                }
                if (iop->ioc_cr == NULL ||
                    ppa->ppa_zoneid != crgetzoneid(iop->ioc_cr)) {
                        error = EPERM;
                        break;
                }
                /*
                 * Preallocate the hangup message so that we're always
                 * able to send this upstream in the event of a
                 * catastrophic failure.
                 */
                if ((sps->sps_hangup = allocb(1, BPRI_MED)) == NULL) {
                        error = ENOSR;
                        break;
                }
                /*
                 * There are two ways to attach a stream to a ppa: one is
                 * through DLPI (DL_ATTACH_REQ) and the other is through
                 * PPPIO_ATTACH. This is why we need to distinguish whether or
                 * not a stream was allocated via PPPIO_ATTACH, so that we can
                 * properly detach it when we receive PPPIO_DETACH ioctl
                 * request.
                 */
                sps->sps_flags |= SPS_PIOATTACH;
                sps->sps_ppa = ppa;
                /*
                 * Add this stream to the head of the list of sibling streams
                 * which belong to the same ppa as specified.
                 */
                rw_enter(&ppa->ppa_sib_lock, RW_WRITER);
                ppa->ppa_refcnt++;
                sps->sps_nextsib = ppa->ppa_streams;
                ppa->ppa_streams = sps;
                rw_exit(&ppa->ppa_sib_lock);
                error = 0;              /* return success */
                break;
        case PPPIO_BLOCKNP:
        case PPPIO_UNBLOCKNP:
                if (iop->ioc_cr == NULL ||
                    secpolicy_ppp_config(iop->ioc_cr) != 0) {
                        error = EPERM;
                        break;
                }
                error = miocpullup(mp, sizeof (uint16_t));
                if (error != 0)
                        break;
                ASSERT(mp->b_cont->b_rptr != NULL);
                proto = *(uint16_t *)mp->b_cont->b_rptr;
                if (iop->ioc_cmd == PPPIO_BLOCKNP) {
                        uint32_t npflagpos = sppp_ppp2np(proto);
                        /*
                         * Mark proto as blocked in ppa_npflag until the
                         * corresponding queues for proto have been plumbed.
                         */
                        if (npflagpos != 0) {
                                mutex_enter(&ppa->ppa_npmutex);
                                ppa->ppa_npflag |= (1 << npflagpos);
                                mutex_exit(&ppa->ppa_npmutex);
                        } else {
                                error = EINVAL;
                        }
                } else {
                        /*
                         * reset ppa_npflag and release proto
                         * packets that were being held in control queue.
                         */
                        sppp_release_pkts(ppa, proto);
                }
                break;
        case PPPIO_DEBUG:
                if (iop->ioc_cr == NULL ||
                    secpolicy_ppp_config(iop->ioc_cr) != 0) {
                        error = EPERM;
                        break;
                } else if (iop->ioc_count != sizeof (uint32_t)) {
                        break;          /* return EINVAL */
                } else if (mp->b_cont == NULL) {
                        error = EPROTO;
                        break;
                }
                ASSERT(mp->b_cont->b_rptr != NULL);
                dbgcmd = *(uint32_t *)mp->b_cont->b_rptr;
                /*
                 * We accept PPPDBG_LOG + PPPDBG_DRIVER value as an indication
                 * that SPS_KDEBUG needs to be enabled for this upper stream.
                 */
                if (dbgcmd == PPPDBG_LOG + PPPDBG_DRIVER) {
                        sps->sps_flags |= SPS_KDEBUG;
                        error = 0;      /* return success */
                        break;
                }
                /*
                 * Otherwise, for any other values, we send them down only if
                 * there is an attachment and if the attachment has something
                 * linked underneath it.
                 */
                if ((ppa == NULL) || (ppa->ppa_lower_wq == NULL)) {
                        error = ENOLINK;
                        break;
                }
                mutex_enter(&ppa->ppa_sta_lock);
                /*
                 * See comments in PPPIO_GETSTAT64 case
                 * in sppp_ioctl().
                 */
                if (IS_SPS_IOCQ(sps)) {
                        mutex_exit(&ppa->ppa_sta_lock);
                        if (!putq(q, mp)) {
                                error = EAGAIN;
                                break;
                        }
                        return;
                } else {
                        ppa->ppa_ioctlsfwd++;
                        /*
                         * Record the ioctl CMD & ID -
                         * this will be used to check the
                         * ACK or NAK responses coming from below.
                         */
                        sps->sps_ioc_id = iop->ioc_id;
                        sps->sps_flags |= SPS_IOCQ;
                        mutex_exit(&ppa->ppa_sta_lock);
                }
                putnext(ppa->ppa_lower_wq, mp);
                return;                 /* don't ack or nak the request */
        case PPPIO_DETACH:
                if (!IS_SPS_PIOATTACH(sps)) {
                        break;          /* return EINVAL */
                }
                /*
                 * The SPS_PIOATTACH flag set on the stream tells us that
                 * the ppa field is still valid. In the event that the control
                 * stream be closed prior to this stream's detachment, the
                 * SPS_PIOATTACH flag would have been cleared from this stream
                 * during close; in that case we won't get here.
                 */
                ASSERT(ppa != NULL);
                ASSERT(ppa->ppa_ctl != sps);
                ASSERT(sps->sps_dlstate == DL_UNATTACHED);

                /*
                 * We don't actually detach anything until the stream is
                 * closed or reattached.
                 */

                sps->sps_flags &= ~SPS_PIOATTACH;
                error = 0;              /* return success */
                break;
        case PPPIO_LASTMOD:
                if (!IS_SPS_CONTROL(sps)) {
                        break;          /* return EINVAL */
                }
                ASSERT(ppa != NULL);
                ppa->ppa_flags |= PPA_LASTMOD;
                error = 0;              /* return success */
                break;
        case PPPIO_MRU:
                if (!IS_SPS_CONTROL(sps) ||
                    (iop->ioc_count != sizeof (uint32_t))) {
                        break;          /* return EINVAL */
                } else if (mp->b_cont == NULL) {
                        error = EPROTO;
                        break;
                }
                ASSERT(ppa != NULL);
                ASSERT(mp->b_cont->b_rptr != NULL);
                mru = *(uint32_t *)mp->b_cont->b_rptr;
                if ((mru <= 0) || (mru > PPP_MAXMRU)) {
                        error = EPROTO;
                        break;
                }
                if (mru < PPP_MRU) {
                        mru = PPP_MRU;
                }
                ppa->ppa_mru = (uint16_t)mru;
                /*
                 * If there's something beneath this driver for the ppa, then
                 * inform it (or them) of the MRU size. Only do this is we
                 * are not the last PPP module on the stream.
                 */
                if (!IS_PPA_LASTMOD(ppa) && (ppa->ppa_lower_wq != NULL)) {
                        (void) putctl4(ppa->ppa_lower_wq, M_CTL, PPPCTL_MRU,
                            mru);
                }
                error = 0;              /* return success */
                break;
        case PPPIO_MTU:
                if (!IS_SPS_CONTROL(sps) ||
                    (iop->ioc_count != sizeof (uint32_t))) {
                        break;          /* return EINVAL */
                } else if (mp->b_cont == NULL) {
                        error = EPROTO;
                        break;
                }
                ASSERT(ppa != NULL);
                ASSERT(mp->b_cont->b_rptr != NULL);
                mtu = *(uint32_t *)mp->b_cont->b_rptr;
                if ((mtu <= 0) || (mtu > PPP_MAXMTU)) {
                        error = EPROTO;
                        break;
                }
                ppa->ppa_mtu = (uint16_t)mtu;
                /*
                 * If there's something beneath this driver for the ppa, then
                 * inform it (or them) of the MTU size. Only do this if we
                 * are not the last PPP module on the stream.
                 */
                if (!IS_PPA_LASTMOD(ppa) && (ppa->ppa_lower_wq != NULL)) {
                        (void) putctl4(ppa->ppa_lower_wq, M_CTL, PPPCTL_MTU,
                            mtu);
                }
                error = 0;              /* return success */
                break;
        case PPPIO_USETIMESTAMP:
                if (!IS_SPS_CONTROL(sps)) {
                        break;          /* return EINVAL */
                }
                if (!IS_PPA_TIMESTAMP(ppa)) {
                        hrtime = gethrtime();
                        ppa->ppa_lasttx = ppa->ppa_lastrx = hrtime;
                        ppa->ppa_flags |= PPA_TIMESTAMP;
                }
                error = 0;
                break;
        }

        if (error == 0) {
                /* Success; tell the user */
                miocack(q, mp, count, 0);
        } else {
                /* Failure; send error back upstream */
                miocnak(q, mp, 0, error);
        }
}

/*
 * sppp_outer_ioctl()
 *
 * MT-Perimeters:
 *    exclusive inner, exclusive outer
 *
 * Description:
 *    Called by sppp_uwput as a result of receiving ioctls which require
 *    an exclusive access at the outer perimeter.
 */
static void
sppp_outer_ioctl(queue_t *q, mblk_t *mp)
{
        spppstr_t       *sps = q->q_ptr;
        spppstr_t       *nextsib;
        queue_t         *lwq;
        sppa_t          *ppa;
        struct iocblk   *iop;
        int             error = EINVAL;
        int             count = 0;
        uint32_t        ppa_id;
        mblk_t          *nmp;
        zoneid_t        zoneid;

        sps = (spppstr_t *)q->q_ptr;
        ppa = sps->sps_ppa;
        iop = (struct iocblk *)mp->b_rptr;
        switch (iop->ioc_cmd) {
        case I_LINK:
                if (!IS_SPS_CONTROL(sps)) {
                        break;          /* return EINVAL */
                } else if (ppa->ppa_lower_wq != NULL) {
                        error = EEXIST;
                        break;
                }
                ASSERT(ppa->ppa_ctl != NULL);
                ASSERT(sps->sps_npmode == NPMODE_PASS);
                ASSERT(mp->b_cont != NULL && mp->b_cont->b_rptr != NULL);

                lwq = ((struct linkblk *)mp->b_cont->b_rptr)->l_qbot;
                ASSERT(lwq != NULL);

                ppa->ppa_lower_wq = lwq;
                lwq->q_ptr = RD(lwq)->q_ptr = (caddr_t)ppa;
                /*
                 * Unblock upper network streams which now feed this lower
                 * stream. We don't need to hold ppa_sib_lock here, since we
                 * are writer at the outer perimeter.
                 */
                if (WR(sps->sps_rq)->q_first != NULL)
                        qenable(WR(sps->sps_rq));
                for (nextsib = ppa->ppa_streams; nextsib != NULL;
                    nextsib = nextsib->sps_nextsib) {
                        nextsib->sps_npmode = NPMODE_PASS;
                        if (WR(nextsib->sps_rq)->q_first != NULL) {
                                qenable(WR(nextsib->sps_rq));
                        }
                }

                /*
                 * Also unblock (run once) our lower read-side queue.  This is
                 * where packets received while doing the I_LINK may be
                 * languishing; see sppp_lrsrv.
                 */
                qenable(RD(lwq));

                /*
                 * Send useful information down to the modules which are now
                 * linked below this driver (for this particular ppa). Only
                 * do this if we are not the last PPP module on the stream.
                 */
                if (!IS_PPA_LASTMOD(ppa)) {
                        (void) putctl8(lwq, M_CTL, PPPCTL_UNIT,
                            ppa->ppa_ppa_id);
                        (void) putctl4(lwq, M_CTL, PPPCTL_MRU, ppa->ppa_mru);
                        (void) putctl4(lwq, M_CTL, PPPCTL_MTU, ppa->ppa_mtu);
                }

                if (IS_SPS_KDEBUG(sps)) {
                        SPDEBUG(PPP_DRV_NAME
                            "/%d: I_LINK lwq=0x%p sps=0x%p flags=0x%b ppa=0x%p "
                            "flags=0x%b\n", sps->sps_mn_id,
                            (void *)ppa->ppa_lower_wq, (void *)sps,
                            sps->sps_flags, SPS_FLAGS_STR,
                            (void *)ppa, ppa->ppa_flags,
                            PPA_FLAGS_STR);
                }
                error = 0;              /* return success */
                break;
        case I_UNLINK:
                ASSERT(IS_SPS_CONTROL(sps));
                ASSERT(ppa != NULL);
                lwq = ppa->ppa_lower_wq;
                ASSERT(mp->b_cont != NULL && mp->b_cont->b_rptr != NULL);
                ASSERT(lwq == ((struct linkblk *)mp->b_cont->b_rptr)->l_qbot);

                if (IS_SPS_KDEBUG(sps)) {
                        SPDEBUG(PPP_DRV_NAME
                            "/%d: I_UNLINK lwq=0x%p sps=0x%p flags=0x%b "
                            "ppa=0x%p flags=0x%b\n", sps->sps_mn_id,
                            (void *)lwq, (void *)sps, sps->sps_flags,
                            SPS_FLAGS_STR, (void *)ppa, ppa->ppa_flags,
                            PPA_FLAGS_STR);
                }
                /*
                 * While accessing the outer perimeter exclusively, we
                 * disassociate our ppa's lower_wq from the lower stream linked
                 * beneath us, and we also disassociate our control stream from
                 * the q_ptr of the lower stream.
                 */
                lwq->q_ptr = RD(lwq)->q_ptr = NULL;
                ppa->ppa_lower_wq = NULL;
                /*
                 * Unblock streams which now feed back up the control stream,
                 * and acknowledge the request. We don't need to hold
                 * ppa_sib_lock here, since we are writer at the outer
                 * perimeter.
                 */
                if (WR(sps->sps_rq)->q_first != NULL)
                        qenable(WR(sps->sps_rq));
                for (nextsib = ppa->ppa_streams; nextsib != NULL;
                    nextsib = nextsib->sps_nextsib) {
                        if (WR(nextsib->sps_rq)->q_first != NULL) {
                                qenable(WR(nextsib->sps_rq));
                        }
                }
                error = 0;              /* return success */
                break;
        case PPPIO_NEWPPA:
                /*
                 * Do sanity check to ensure that we don't accept PPPIO_NEWPPA
                 * on a stream which DLPI is used (since certain DLPI messages
                 * will cause state transition reflected in sps_dlstate,
                 * changing it from its default DL_UNATTACHED value). In other
                 * words, we won't allow a network/snoop stream to become
                 * a control stream.
                 */
                if (iop->ioc_cr == NULL ||
                    secpolicy_ppp_config(iop->ioc_cr) != 0) {
                        error = EPERM;
                        break;
                } else if (IS_SPS_CONTROL(sps) || IS_SPS_PIOATTACH(sps) ||
                    (ppa != NULL) || (sps->sps_dlstate != DL_UNATTACHED)) {
                        break;          /* return EINVAL */
                }
                /* Get requested unit number (if any) */
                if (iop->ioc_count == sizeof (uint32_t) && mp->b_cont != NULL)
                        ppa_id = *(uint32_t *)mp->b_cont->b_rptr;
                else
                        ppa_id = 0;
                /* Get mblk to use for response message */
                nmp = allocb(sizeof (uint32_t), BPRI_MED);
                if (nmp == NULL) {
                        error = ENOSR;
                        break;
                }
                if (mp->b_cont != NULL) {
                        freemsg(mp->b_cont);
                }
                mp->b_cont = nmp;               /* chain our response mblk */
                /*
                 * Walk the global ppa list and determine the lowest
                 * available ppa_id number to be used.
                 */
                if (ppa_id == (uint32_t)-1)
                        ppa_id = 0;
                zoneid = crgetzoneid(iop->ioc_cr);
                for (ppa = ppa_list; ppa != NULL; ppa = ppa->ppa_nextppa) {
                        if (ppa_id == (uint32_t)-2) {
                                if (ppa->ppa_ctl == NULL &&
                                    ppa->ppa_zoneid == zoneid)
                                        break;
                        } else {
                                if (ppa_id < ppa->ppa_ppa_id)
                                        break;
                                if (ppa_id == ppa->ppa_ppa_id)
                                        ++ppa_id;
                        }
                }
                if (ppa_id == (uint32_t)-2) {
                        if (ppa == NULL) {
                                error = ENXIO;
                                break;
                        }
                        /* Clear timestamp and lastmod flags */
                        ppa->ppa_flags = 0;
                } else {
                        ppa = sppp_create_ppa(ppa_id, zoneid);
                        if (ppa == NULL) {
                                error = ENOMEM;
                                break;
                        }
                }

                sps->sps_ppa = ppa;             /* chain the ppa structure */
                sps->sps_npmode = NPMODE_PASS;  /* network packets may travel */
                sps->sps_flags |= SPS_CONTROL;  /* this is the control stream */

                ppa->ppa_refcnt++;              /* new PPA reference */
                ppa->ppa_ctl = sps;             /* back ptr to upper stream */
                /*
                 * Return the newly created ppa_id to the requestor and
                 * acnowledge the request.
                 */
                *(uint32_t *)nmp->b_wptr = ppa->ppa_ppa_id;
                nmp->b_wptr += sizeof (uint32_t);

                if (IS_SPS_KDEBUG(sps)) {
                        SPDEBUG(PPP_DRV_NAME
                            "/%d: PPPIO_NEWPPA ppa_id=%d sps=0x%p flags=0x%b "
                            "ppa=0x%p flags=0x%b\n", sps->sps_mn_id, ppa_id,
                            (void *)sps, sps->sps_flags, SPS_FLAGS_STR,
                            (void *)ppa, ppa->ppa_flags,
                            PPA_FLAGS_STR);
                }
                count = msgsize(nmp);
                error = 0;
                break;
        }

        if (error == 0) {
                /* Success; tell the user. */
                miocack(q, mp, count, 0);
        } else {
                /* Failure; send error back upstream. */
                miocnak(q, mp, 0, error);
        }
}

/*
 * sppp_send()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Called by sppp_uwput to handle M_DATA message type.  Returns
 *    queue_t for putnext, or NULL to mean that the packet was
 *    handled internally.
 */
static queue_t *
sppp_send(queue_t *q, mblk_t **mpp, spppstr_t *sps)
{
        mblk_t  *mp;
        sppa_t  *ppa;
        int     is_promisc;
        int     msize;
        int     error = 0;
        queue_t *nextq;

        ASSERT(mpp != NULL);
        mp = *mpp;
        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ASSERT(sps != NULL);
        ASSERT(q->q_ptr == sps);
        /*
         * We only let M_DATA through if the sender is either the control
         * stream (for PPP control packets) or one of the network streams
         * (for IP packets) in IP fastpath mode. If this stream is not attached
         * to any ppas, then discard data coming down through this stream.
         */
        ppa = sps->sps_ppa;
        if (ppa == NULL) {
                ASSERT(!IS_SPS_CONTROL(sps));
                error = ENOLINK;
        } else if (!IS_SPS_CONTROL(sps) && !IS_SPS_FASTPATH(sps)) {
                error = EPROTO;
        }
        if (error != 0) {
                merror(q, mp, error);
                return (NULL);
        }
        msize = msgdsize(mp);
        if (msize > (ppa->ppa_mtu + PPP_HDRLEN)) {
                /* Log, and send it anyway */
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_otoolongs++;
                mutex_exit(&ppa->ppa_sta_lock);
        } else if (msize < PPP_HDRLEN) {
                /*
                 * Log, and send it anyway. We log it because we get things
                 * in M_DATA form here, which tells us that the sender is
                 * either IP in fastpath transmission mode, or pppd. In both
                 * cases, they are currently expected to send the 4-bytes
                 * PPP header in front of any possible payloads.
                 */
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_orunts++;
                mutex_exit(&ppa->ppa_sta_lock);
        }

        if (IS_SPS_KDEBUG(sps)) {
                SPDEBUG(PPP_DRV_NAME
                    "/%d: M_DATA send (%d bytes) sps=0x%p flags=0x%b "
                    "ppa=0x%p flags=0x%b\n", sps->sps_mn_id, msize,
                    (void *)sps, sps->sps_flags, SPS_FLAGS_STR,
                    (void *)ppa, ppa->ppa_flags, PPA_FLAGS_STR);
        }
        /*
         * Should there be any promiscuous stream(s), send the data up
         * for each promiscuous stream that we recognize. Make sure that
         * for fastpath, we skip the PPP header in the M_DATA mblk. We skip
         * the control stream as we obviously never allow the control stream
         * to become promiscous and bind to PPP_ALLSAP.
         */
        rw_enter(&ppa->ppa_sib_lock, RW_READER);
        is_promisc = sps->sps_ppa->ppa_promicnt;
        if (is_promisc) {
                ASSERT(ppa->ppa_streams != NULL);
                sppp_dlprsendup(ppa->ppa_streams, mp, sps->sps_sap, B_TRUE);
        }
        rw_exit(&ppa->ppa_sib_lock);
        /*
         * Only time-stamp the packet with hrtime if the upper stream
         * is configured to do so.  PPP control (negotiation) messages
         * are never considered link activity; only data is activity.
         */
        if (!IS_SPS_CONTROL(sps) && IS_PPA_TIMESTAMP(ppa)) {
                ppa->ppa_lasttx = gethrtime();
        }
        /*
         * If there's already a message in the write-side service queue,
         * then queue this message there as well, otherwise, try to send
         * it down to the module immediately below us.
         */
        if (q->q_first != NULL ||
            (nextq = sppp_outpkt(q, mpp, msize, sps)) == NULL) {
                mp = *mpp;
                if (mp != NULL && putq(q, mp) == 0) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_oqdropped++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        freemsg(mp);
                }
                return (NULL);
        }
        return (nextq);
}

/*
 * sppp_outpkt()
 *
 * MT-Perimeters:
 *    shared inner, shared outer (if called from sppp_wput, sppp_dlunitdatareq).
 *    exclusive inner, shared outer (if called from sppp_wsrv).
 *
 * Description:
 *    Called from 1) sppp_uwput when processing a M_DATA fastpath message,
 *    or 2) sppp_uwsrv when processing the upper write-side service queue.
 *    For both cases, it prepares to send the data to the module below
 *    this driver if there is a lower stream linked underneath. If none, then
 *    the data will be sent upstream via the control channel to pppd.
 *
 * Returns:
 *      Non-NULL queue_t if message should be sent now, otherwise
 *      if *mpp == NULL, then message was freed, otherwise put *mpp
 *      (back) on the queue.  (Does not do putq/putbq, since it's
 *      called both from srv and put procedures.)
 */
static queue_t *
sppp_outpkt(queue_t *q, mblk_t **mpp, int msize, spppstr_t *sps)
{
        mblk_t          *mp;
        sppa_t          *ppa;
        enum NPmode     npmode;
        mblk_t          *mpnew;

        ASSERT(mpp != NULL);
        mp = *mpp;
        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ASSERT(sps != NULL);

        ppa = sps->sps_ppa;
        npmode = sps->sps_npmode;

        if (npmode == NPMODE_QUEUE) {
                ASSERT(!IS_SPS_CONTROL(sps));
                return (NULL);  /* queue it for later */
        } else if (ppa == NULL || ppa->ppa_ctl == NULL ||
            npmode == NPMODE_DROP || npmode == NPMODE_ERROR) {
                /*
                 * This can not be the control stream, as it must always have
                 * a valid ppa, and its npmode must always be NPMODE_PASS.
                 */
                ASSERT(!IS_SPS_CONTROL(sps));
                if (npmode == NPMODE_DROP) {
                        freemsg(mp);
                } else {
                        /*
                         * If we no longer have the control stream, or if the
                         * mode is set to NPMODE_ERROR, then we need to tell IP
                         * that the interface need to be marked as down. In
                         * other words, we tell IP to be quiescent.
                         */
                        merror(q, mp, EPROTO);
                }
                *mpp = NULL;
                return (NULL);  /* don't queue it */
        }
        /*
         * Do we have a driver stream linked underneath ? If not, we need to
         * notify pppd that the link needs to be brought up and configure
         * this upper stream to drop subsequent outgoing packets. This is
         * for demand-dialing, in which case pppd has done the IP plumbing
         * but hasn't linked the driver stream underneath us. Therefore, when
         * a packet is sent down the IP interface, a notification message
         * will be sent up the control stream to pppd in order for it to
         * establish the physical link. The driver stream is then expected
         * to be linked underneath after physical link establishment is done.
         */
        if (ppa->ppa_lower_wq == NULL) {
                ASSERT(ppa->ppa_ctl != NULL);
                ASSERT(ppa->ppa_ctl->sps_rq != NULL);

                *mpp = NULL;
                mpnew = create_lsmsg(PPP_LINKSTAT_NEEDUP);
                if (mpnew == NULL) {
                        freemsg(mp);
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_allocbfail++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        return (NULL);  /* don't queue it */
                }
                /* Include the data in the message for logging. */
                mpnew->b_cont = mp;
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_lsneedup++;
                mutex_exit(&ppa->ppa_sta_lock);
                /*
                 * We need to set the mode to NPMODE_DROP, but should only
                 * do so when this stream is not the control stream.
                 */
                if (!IS_SPS_CONTROL(sps)) {
                        sps->sps_npmode = NPMODE_DROP;
                }
                putnext(ppa->ppa_ctl->sps_rq, mpnew);
                return (NULL);  /* don't queue it */
        }
        /*
         * If so, then try to send it down. The lower queue is only ever
         * detached while holding an exclusive lock on the whole driver,
         * so we can be confident that the lower queue is still there.
         */
        if (bcanputnext(ppa->ppa_lower_wq, mp->b_band)) {
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_stats.p.ppp_opackets++;
                if (IS_SPS_CONTROL(sps)) {
                        ppa->ppa_opkt_ctl++;
                }
                ppa->ppa_stats.p.ppp_obytes += msize;
                mutex_exit(&ppa->ppa_sta_lock);
                return (ppa->ppa_lower_wq);     /* don't queue it */
        }
        return (NULL);  /* queue it for later */
}

/*
 * sppp_lwsrv()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Lower write-side service procedure. No messages are ever placed on
 *    the write queue here, this just back-enables all upper write side
 *    service procedures.
 */
int
sppp_lwsrv(queue_t *q)
{
        sppa_t          *ppa;
        spppstr_t       *nextsib;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ppa = (sppa_t *)q->q_ptr;
        ASSERT(ppa != NULL);

        rw_enter(&ppa->ppa_sib_lock, RW_READER);
        if ((nextsib = ppa->ppa_ctl) != NULL &&
            WR(nextsib->sps_rq)->q_first != NULL)
                qenable(WR(nextsib->sps_rq));
        for (nextsib = ppa->ppa_streams; nextsib != NULL;
            nextsib = nextsib->sps_nextsib) {
                if (WR(nextsib->sps_rq)->q_first != NULL) {
                        qenable(WR(nextsib->sps_rq));
                }
        }
        rw_exit(&ppa->ppa_sib_lock);
        return (0);
}

/*
 * sppp_lrput()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Lower read-side put procedure. Messages from below get here.
 *    Data messages are handled separately to limit stack usage
 *    going into IP.
 *
 *    Note that during I_UNLINK processing, it's possible for a downstream
 *    message to enable upstream data (due to pass_wput() removing the
 *    SQ_BLOCKED flag), and thus we must protect against a NULL sppa pointer.
 *    In this case, the only thing above us is passthru, and we might as well
 *    discard.
 */
int
sppp_lrput(queue_t *q, mblk_t *mp)
{
        sppa_t          *ppa;
        spppstr_t       *sps;

        if ((ppa = q->q_ptr) == NULL) {
                freemsg(mp);
                return (0);
        }

        sps = ppa->ppa_ctl;

        if (MTYPE(mp) != M_DATA) {
                sppp_recv_nondata(q, mp, sps);
        } else if (sps == NULL) {
                freemsg(mp);
        } else if ((q = sppp_recv(q, &mp, sps)) != NULL) {
                putnext(q, mp);
        }
        return (0);
}

/*
 * sppp_lrsrv()
 *
 * MT-Perimeters:
 *    exclusive inner, shared outer.
 *
 * Description:
 *    Lower read-side service procedure.  This is run once after the I_LINK
 *    occurs in order to clean up any packets that came in while we were
 *    transferring in the lower stream.  Otherwise, it's not used.
 */
int
sppp_lrsrv(queue_t *q)
{
        mblk_t *mp;

        while ((mp = getq(q)) != NULL)
                (void) sppp_lrput(q, mp);
        return (0);
}

/*
 * sppp_recv_nondata()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    All received non-data messages come through here.
 */
static void
sppp_recv_nondata(queue_t *q, mblk_t *mp, spppstr_t *ctlsps)
{
        sppa_t          *ppa;
        spppstr_t       *destsps;
        struct iocblk   *iop;

        ppa = (sppa_t *)q->q_ptr;
        ctlsps = ppa->ppa_ctl;

        switch (MTYPE(mp)) {
        case M_CTL:
                mutex_enter(&ppa->ppa_sta_lock);
                if (*mp->b_rptr == PPPCTL_IERROR) {
                        ppa->ppa_stats.p.ppp_ierrors++;
                        ppa->ppa_ierr_low++;
                        ppa->ppa_mctlsknown++;
                } else if (*mp->b_rptr == PPPCTL_OERROR) {
                        ppa->ppa_stats.p.ppp_oerrors++;
                        ppa->ppa_oerr_low++;
                        ppa->ppa_mctlsknown++;
                } else {
                        ppa->ppa_mctlsunknown++;
                }
                mutex_exit(&ppa->ppa_sta_lock);
                freemsg(mp);
                break;
        case M_IOCTL:
                miocnak(q, mp, 0, EINVAL);
                break;
        case M_IOCACK:
        case M_IOCNAK:
                iop = (struct iocblk *)mp->b_rptr;
                ASSERT(iop != NULL);
                /*
                 * Attempt to match up the response with the stream that the
                 * request came from. If ioc_id doesn't match the one that we
                 * recorded, then discard this message.
                 */
                rw_enter(&ppa->ppa_sib_lock, RW_READER);
                if ((destsps = ctlsps) == NULL ||
                    destsps->sps_ioc_id != iop->ioc_id) {
                        destsps = ppa->ppa_streams;
                        while (destsps != NULL) {
                                if (destsps->sps_ioc_id == iop->ioc_id) {
                                        break;  /* found the upper stream */
                                }
                                destsps = destsps->sps_nextsib;
                        }
                }
                rw_exit(&ppa->ppa_sib_lock);
                if (destsps == NULL) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_ioctlsfwderr++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        freemsg(mp);
                        break;
                }
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_ioctlsfwdok++;

                /*
                 * Clear SPS_IOCQ and enable the lower write side queue,
                 * this would allow the upper stream service routine
                 * to start processing the queue for pending messages.
                 * sppp_lwsrv -> sppp_uwsrv.
                 */
                destsps->sps_flags &= ~SPS_IOCQ;
                mutex_exit(&ppa->ppa_sta_lock);
                qenable(WR(destsps->sps_rq));

                putnext(destsps->sps_rq, mp);
                break;
        case M_HANGUP:
                /*
                 * Free the original mblk_t. We don't really want to send
                 * a M_HANGUP message upstream, so we need to translate this
                 * message into something else.
                 */
                freemsg(mp);
                if (ctlsps == NULL)
                        break;
                mp = create_lsmsg(PPP_LINKSTAT_HANGUP);
                if (mp == NULL) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_allocbfail++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        break;
                }
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_lsdown++;
                mutex_exit(&ppa->ppa_sta_lock);
                putnext(ctlsps->sps_rq, mp);
                break;
        case M_FLUSH:
                if (*mp->b_rptr & FLUSHR) {
                        flushq(q, FLUSHDATA);
                }
                if (*mp->b_rptr & FLUSHW) {
                        *mp->b_rptr &= ~FLUSHR;
                        qreply(q, mp);
                } else {
                        freemsg(mp);
                }
                break;
        default:
                if (ctlsps != NULL &&
                    (queclass(mp) == QPCTL) || canputnext(ctlsps->sps_rq)) {
                        putnext(ctlsps->sps_rq, mp);
                } else {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_iqdropped++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        freemsg(mp);
                }
                break;
        }
}

/*
 * sppp_recv()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Receive function called by sppp_lrput.  Finds appropriate
 *    receive stream and does accounting.
 */
static queue_t *
sppp_recv(queue_t *q, mblk_t **mpp, spppstr_t *ctlsps)
{
        mblk_t          *mp;
        int             len;
        sppa_t          *ppa;
        spppstr_t       *destsps;
        mblk_t          *zmp;
        uint32_t        npflagpos;

        ASSERT(mpp != NULL);
        mp = *mpp;
        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ASSERT(ctlsps != NULL);
        ASSERT(IS_SPS_CONTROL(ctlsps));
        ppa = ctlsps->sps_ppa;
        ASSERT(ppa != NULL && ppa->ppa_ctl != NULL);

        len = msgdsize(mp);
        mutex_enter(&ppa->ppa_sta_lock);
        ppa->ppa_stats.p.ppp_ibytes += len;
        mutex_exit(&ppa->ppa_sta_lock);
        /*
         * If the entire data size of the mblk is less than the length of the
         * PPP header, then free it. We can't do much with such message anyway,
         * since we can't really determine what the PPP protocol type is.
         */
        if (len < PPP_HDRLEN) {
                /* Log, and free it */
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_irunts++;
                mutex_exit(&ppa->ppa_sta_lock);
                freemsg(mp);
                return (NULL);
        } else if (len > (ppa->ppa_mru + PPP_HDRLEN)) {
                /* Log, and accept it anyway */
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_itoolongs++;
                mutex_exit(&ppa->ppa_sta_lock);
        }
        /*
         * We need at least be able to read the PPP protocol from the header,
         * so if the first message block is too small, then we concatenate the
         * rest of the following blocks into one message.
         */
        if (MBLKL(mp) < PPP_HDRLEN) {
                zmp = msgpullup(mp, PPP_HDRLEN);
                freemsg(mp);
                mp = zmp;
                if (mp == NULL) {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_allocbfail++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        return (NULL);
                }
                *mpp = mp;
        }
        /*
         * Hold this packet in the control-queue until
         * the matching network-layer upper stream for the PPP protocol (sap)
         * has not been plumbed and configured
         */
        npflagpos = sppp_ppp2np(PPP_PROTOCOL(mp->b_rptr));
        mutex_enter(&ppa->ppa_npmutex);
        if (npflagpos != 0 && (ppa->ppa_npflag & (1 << npflagpos))) {
                /*
                 * proto is currently blocked; Hold up to 4 packets
                 * in the kernel.
                 */
                if (ppa->ppa_holdpkts[npflagpos] > 3 ||
                    putq(ctlsps->sps_rq, mp) == 0)
                        freemsg(mp);
                else
                        ppa->ppa_holdpkts[npflagpos]++;
                mutex_exit(&ppa->ppa_npmutex);
                return (NULL);
        }
        mutex_exit(&ppa->ppa_npmutex);
        /*
         * Try to find a matching network-layer upper stream for the specified
         * PPP protocol (sap), and if none is found, send this frame up the
         * control stream.
         */
        destsps = sppp_inpkt(q, mp, ctlsps);
        if (destsps == NULL) {
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_ipkt_ctl++;
                mutex_exit(&ppa->ppa_sta_lock);
                if (canputnext(ctlsps->sps_rq)) {
                        if (IS_SPS_KDEBUG(ctlsps)) {
                                SPDEBUG(PPP_DRV_NAME
                                    "/%d: M_DATA recv (%d bytes) sps=0x%p "
                                    "flags=0x%b ppa=0x%p flags=0x%b\n",
                                    ctlsps->sps_mn_id, len, (void *)ctlsps,
                                    ctlsps->sps_flags, SPS_FLAGS_STR,
                                    (void *)ppa, ppa->ppa_flags,
                                    PPA_FLAGS_STR);
                        }
                        return (ctlsps->sps_rq);
                } else {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_iqdropped++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        freemsg(mp);
                        return (NULL);
                }
        }
        if (canputnext(destsps->sps_rq)) {
                if (IS_SPS_KDEBUG(destsps)) {
                        SPDEBUG(PPP_DRV_NAME
                            "/%d: M_DATA recv (%d bytes) sps=0x%p flags=0x%b "
                            "ppa=0x%p flags=0x%b\n", destsps->sps_mn_id, len,
                            (void *)destsps, destsps->sps_flags,
                            SPS_FLAGS_STR, (void *)ppa, ppa->ppa_flags,
                            PPA_FLAGS_STR);
                }
                /*
                 * If fastpath is enabled on the network-layer stream, then
                 * make sure we skip over the PPP header, otherwise, we wrap
                 * the message in a DLPI message.
                 */
                if (IS_SPS_FASTPATH(destsps)) {
                        mp->b_rptr += PPP_HDRLEN;
                        return (destsps->sps_rq);
                } else {
                        spppstr_t *uqs = (spppstr_t *)destsps->sps_rq->q_ptr;
                        ASSERT(uqs != NULL);
                        mp->b_rptr += PPP_HDRLEN;
                        mp = sppp_dladdud(uqs, mp, uqs->sps_sap, B_FALSE);
                        if (mp != NULL) {
                                *mpp = mp;
                                return (destsps->sps_rq);
                        } else {
                                mutex_enter(&ppa->ppa_sta_lock);
                                ppa->ppa_allocbfail++;
                                mutex_exit(&ppa->ppa_sta_lock);
                                /* mp already freed by sppp_dladdud */
                                return (NULL);
                        }
                }
        } else {
                mutex_enter(&ppa->ppa_sta_lock);
                ppa->ppa_iqdropped++;
                mutex_exit(&ppa->ppa_sta_lock);
                freemsg(mp);
                return (NULL);
        }
}

/*
 * sppp_inpkt()
 *
 * MT-Perimeters:
 *    shared inner, shared outer.
 *
 * Description:
 *    Find the destination upper stream for the received packet, called
 *    from sppp_recv.
 *
 * Returns:
 *    ptr to destination upper network stream, or NULL for control stream.
 */
/* ARGSUSED */
static spppstr_t *
sppp_inpkt(queue_t *q, mblk_t *mp, spppstr_t *ctlsps)
{
        spppstr_t       *destsps = NULL;
        sppa_t          *ppa;
        uint16_t        proto;
        int             is_promisc;

        ASSERT(q != NULL && q->q_ptr != NULL);
        ASSERT(mp != NULL && mp->b_rptr != NULL);
        ASSERT(IS_SPS_CONTROL(ctlsps));
        ppa = ctlsps->sps_ppa;
        ASSERT(ppa != NULL);
        /*
         * From RFC 1661 (Section 2):
         *
         * The Protocol field is one or two octets, and its value identifies
         * the datagram encapsulated in the Information field of the packet.
         * The field is transmitted and received most significant octet first.
         *
         * The structure of this field is consistent with the ISO 3309
         * extension mechanism for address fields.  All Protocols MUST be odd;
         * the least significant bit of the least significant octet MUST equal
         * "1".  Also, all Protocols MUST be assigned such that the least
         * significant bit of the most significant octet equals "0". Frames
         * received which don't comply with these rules MUST be treated as
         * having an unrecognized Protocol.
         *
         * Protocol field values in the "0***" to "3***" range identify the
         * network-layer protocol of specific packets, and values in the
         * "8***" to "b***" range identify packets belonging to the associated
         * Network Control Protocols (NCPs), if any.
         *
         * Protocol field values in the "4***" to "7***" range are used for
         * protocols with low volume traffic which have no associated NCP.
         * Protocol field values in the "c***" to "f***" range identify packets
         * as link-layer Control Protocols (such as LCP).
         */
        proto = PPP_PROTOCOL(mp->b_rptr);
        mutex_enter(&ppa->ppa_sta_lock);
        ppa->ppa_stats.p.ppp_ipackets++;
        mutex_exit(&ppa->ppa_sta_lock);
        /*
         * We check if this is not a network-layer protocol, and if so,
         * then send this packet up the control stream.
         */
        if (proto > 0x7fff) {
                goto inpkt_done;        /* send it up the control stream */
        }
        /*
         * Try to grab the destination upper stream from the network-layer
         * stream cache for this ppa for PPP_IP (0x0021) or PPP_IPV6 (0x0057)
         * protocol types. Otherwise, if the type is not known to the cache,
         * or if its sap can't be matched with any of the upper streams, then
         * send this packet up the control stream so that it can be rejected.
         */
        if (proto == PPP_IP) {
                destsps = ppa->ppa_ip_cache;
        } else if (proto == PPP_IPV6) {
                destsps = ppa->ppa_ip6_cache;
        }
        /*
         * Toss this one away up the control stream if there's no matching sap;
         * this way the protocol can be rejected (destsps is NULL).
         */

inpkt_done:
        /*
         * Only time-stamp the packet with hrtime if the upper stream
         * is configured to do so.  PPP control (negotiation) messages
         * are never considered link activity; only data is activity.
         */
        if (destsps != NULL && IS_PPA_TIMESTAMP(ppa)) {
                ppa->ppa_lastrx = gethrtime();
        }
        /*
         * Should there be any promiscuous stream(s), send the data up for
         * each promiscuous stream that we recognize. We skip the control
         * stream as we obviously never allow the control stream to become
         * promiscous and bind to PPP_ALLSAP.
         */
        rw_enter(&ppa->ppa_sib_lock, RW_READER);
        is_promisc = ppa->ppa_promicnt;
        if (is_promisc) {
                ASSERT(ppa->ppa_streams != NULL);
                sppp_dlprsendup(ppa->ppa_streams, mp, proto, B_TRUE);
        }
        rw_exit(&ppa->ppa_sib_lock);
        return (destsps);
}

/*
 * sppp_kstat_update()
 *
 * Description:
 *    Update per-ppa kstat interface statistics.
 */
static int
sppp_kstat_update(kstat_t *ksp, int rw)
{
        register sppa_t         *ppa;
        register sppp_kstats_t  *pppkp;
        register struct pppstat64 *sp;

        if (rw == KSTAT_WRITE) {
                return (EACCES);
        }

        ppa = (sppa_t *)ksp->ks_private;
        ASSERT(ppa != NULL);

        pppkp = (sppp_kstats_t *)ksp->ks_data;
        sp = &ppa->ppa_stats.p;

        mutex_enter(&ppa->ppa_sta_lock);
        pppkp->allocbfail.value.ui32    = ppa->ppa_allocbfail;
        pppkp->mctlsfwd.value.ui32      = ppa->ppa_mctlsfwd;
        pppkp->mctlsfwderr.value.ui32   = ppa->ppa_mctlsfwderr;
        pppkp->rbytes.value.ui32        = sp->ppp_ibytes;
        pppkp->rbytes64.value.ui64      = sp->ppp_ibytes;
        pppkp->ierrors.value.ui32       = sp->ppp_ierrors;
        pppkp->ierrors_lower.value.ui32 = ppa->ppa_ierr_low;
        pppkp->ioctlsfwd.value.ui32     = ppa->ppa_ioctlsfwd;
        pppkp->ioctlsfwdok.value.ui32   = ppa->ppa_ioctlsfwdok;
        pppkp->ioctlsfwderr.value.ui32  = ppa->ppa_ioctlsfwderr;
        pppkp->ipackets.value.ui32      = sp->ppp_ipackets;
        pppkp->ipackets64.value.ui64    = sp->ppp_ipackets;
        pppkp->ipackets_ctl.value.ui32  = ppa->ppa_ipkt_ctl;
        pppkp->iqdropped.value.ui32     = ppa->ppa_iqdropped;
        pppkp->irunts.value.ui32        = ppa->ppa_irunts;
        pppkp->itoolongs.value.ui32     = ppa->ppa_itoolongs;
        pppkp->lsneedup.value.ui32      = ppa->ppa_lsneedup;
        pppkp->lsdown.value.ui32        = ppa->ppa_lsdown;
        pppkp->mctlsknown.value.ui32    = ppa->ppa_mctlsknown;
        pppkp->mctlsunknown.value.ui32  = ppa->ppa_mctlsunknown;
        pppkp->obytes.value.ui32        = sp->ppp_obytes;
        pppkp->obytes64.value.ui64      = sp->ppp_obytes;
        pppkp->oerrors.value.ui32       = sp->ppp_oerrors;
        pppkp->oerrors_lower.value.ui32 = ppa->ppa_oerr_low;
        pppkp->opackets.value.ui32      = sp->ppp_opackets;
        pppkp->opackets64.value.ui64    = sp->ppp_opackets;
        pppkp->opackets_ctl.value.ui32  = ppa->ppa_opkt_ctl;
        pppkp->oqdropped.value.ui32     = ppa->ppa_oqdropped;
        pppkp->otoolongs.value.ui32     = ppa->ppa_otoolongs;
        pppkp->orunts.value.ui32        = ppa->ppa_orunts;
        mutex_exit(&ppa->ppa_sta_lock);

        return (0);
}

/*
 * Turn off proto in ppa_npflag to indicate that
 * the corresponding network protocol has been plumbed.
 * Release proto packets that were being held in the control
 * queue in anticipation of this event.
 */
static void
sppp_release_pkts(sppa_t *ppa, uint16_t proto)
{
        uint32_t npflagpos = sppp_ppp2np(proto);
        int count;
        mblk_t *mp;
        uint16_t mp_proto;
        queue_t *q;
        spppstr_t *destsps;

        ASSERT(ppa != NULL);

        if (npflagpos == 0 || (ppa->ppa_npflag & (1 << npflagpos)) == 0)
                return;

        mutex_enter(&ppa->ppa_npmutex);
        ppa->ppa_npflag &= ~(1 << npflagpos);
        count = ppa->ppa_holdpkts[npflagpos];
        ppa->ppa_holdpkts[npflagpos] = 0;
        mutex_exit(&ppa->ppa_npmutex);

        q = ppa->ppa_ctl->sps_rq;

        while (count > 0) {
                mp = getq(q);
                ASSERT(mp != NULL);

                mp_proto = PPP_PROTOCOL(mp->b_rptr);
                if (mp_proto !=  proto) {
                        (void) putq(q, mp);
                        continue;
                }
                count--;
                destsps = NULL;
                if (mp_proto == PPP_IP) {
                        destsps = ppa->ppa_ip_cache;
                } else if (mp_proto == PPP_IPV6) {
                        destsps = ppa->ppa_ip6_cache;
                }
                ASSERT(destsps != NULL);

                if (IS_SPS_FASTPATH(destsps)) {
                        mp->b_rptr += PPP_HDRLEN;
                } else {
                        spppstr_t *uqs = (spppstr_t *)destsps->sps_rq->q_ptr;
                        ASSERT(uqs != NULL);
                        mp->b_rptr += PPP_HDRLEN;
                        mp = sppp_dladdud(uqs, mp, uqs->sps_sap, B_FALSE);
                        if (mp == NULL) {
                                mutex_enter(&ppa->ppa_sta_lock);
                                ppa->ppa_allocbfail++;
                                mutex_exit(&ppa->ppa_sta_lock);
                                /* mp already freed by sppp_dladdud */
                                continue;
                        }
                }

                if (canputnext(destsps->sps_rq)) {
                        putnext(destsps->sps_rq, mp);
                } else {
                        mutex_enter(&ppa->ppa_sta_lock);
                        ppa->ppa_iqdropped++;
                        mutex_exit(&ppa->ppa_sta_lock);
                        freemsg(mp);
                        continue;
                }
        }
}