/*
 * ppp.c - STREAMS multiplexing pseudo-device driver for PPP.
 *
 * Copyright (c) 1994 Paul Mackerras. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. The name(s) of the authors of this software must not be used to
 *    endorse or promote products derived from this software without
 *    prior written permission.
 *
 * 4. Redistributions of any form whatsoever must retain the following
 *    acknowledgment:
 *    "This product includes software developed by Paul Mackerras
 *     <paulus@samba.org>".
 *
 * THE AUTHORS OF THIS SOFTWARE DISCLAIM ALL WARRANTIES WITH REGARD TO
 * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
 * AND FITNESS, IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY
 * SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
 * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
 * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 *
 * $Id: ppp.c,v 1.26 2002/12/06 09:49:15 paulus Exp $
 */

/*
 * This file is used under Solaris 2, SVR4, SunOS 4, and Digital UNIX.
 */

#include <sys/types.h>
#include <sys/param.h>
#include <sys/stat.h>
#include <sys/stream.h>
#include <sys/stropts.h>
#include <sys/errno.h>
#ifdef __osf__
#include <sys/ioctl.h>
#include <sys/cmn_err.h>
#define queclass(mp)	((mp)->b_band & QPCTL)
#else
#include <sys/ioccom.h>
#endif
#include <sys/time.h>
#ifdef SVR4
#include <sys/cmn_err.h>
#include <sys/conf.h>
#include <sys/dlpi.h>
#include <sys/ddi.h>
#ifdef SOL2
#include <sys/ksynch.h>
#include <sys/kstat.h>
#include <sys/sunddi.h>
#include <sys/ethernet.h>
#else
#include <sys/socket.h>
#include <sys/sockio.h>
#include <net/if.h>
#include <netinet/in.h>
#endif /* SOL2 */
#else /* not SVR4 */
#include <sys/user.h>
#endif /* SVR4 */
#include <net/ppp_defs.h>
#include <net/pppio.h>
#include "ppp_mod.h"

/*
 * Modifications marked with #ifdef PRIOQ are for priority queueing of
 * interactive traffic, and are due to Marko Zec <zec@japa.tel.fer.hr>.
 */
#ifdef PRIOQ
#endif	/* PRIOQ */

#include <netinet/in.h>	/* leave this outside of PRIOQ for htons */

#ifdef __STDC__
#define __P(x)	x
#else
#define __P(x)	()
#endif

/*
 * The IP module may use this SAP value for IP packets.
 */
#ifndef ETHERTYPE_IP
#define ETHERTYPE_IP	0x800
#endif

#if !defined(ETHERTYPE_IPV6) 
#define ETHERTYPE_IPV6	0x86dd
#endif /* !defined(ETHERTYPE_IPV6) */

#if !defined(ETHERTYPE_ALLSAP) && defined(SOL2)
#define ETHERTYPE_ALLSAP   0
#endif /* !defined(ETHERTYPE_ALLSAP) && defined(SOL2) */

#if !defined(PPP_ALLSAP) && defined(SOL2)
#define PPP_ALLSAP  PPP_ALLSTATIONS
#endif /* !defined(PPP_ALLSAP) && defined(SOL2) */

extern time_t time;

#ifdef SOL2
/*
 * We use this reader-writer lock to ensure that the lower streams
 * stay connected to the upper streams while the lower-side put and
 * service procedures are running.  Essentially it is an existence
 * lock for the upper stream associated with each lower stream.
 */
krwlock_t ppp_lower_lock;
#define LOCK_LOWER_W	rw_enter(&ppp_lower_lock, RW_WRITER)
#define LOCK_LOWER_R	rw_enter(&ppp_lower_lock, RW_READER)
#define TRYLOCK_LOWER_R	rw_tryenter(&ppp_lower_lock, RW_READER)
#define UNLOCK_LOWER	rw_exit(&ppp_lower_lock)

#define MT_ENTER(x)	mutex_enter(x)
#define MT_EXIT(x)	mutex_exit(x)

/*
 * Notes on multithreaded implementation for Solaris 2:
 *
 * We use an inner perimeter around each queue pair and an outer
 * perimeter around the whole driver.  The inner perimeter is
 * entered exclusively for all entry points (open, close, put,
 * service).  The outer perimeter is entered exclusively for open
 * and close and shared for put and service.  This is all done for
 * us by the streams framework.
 *
 * I used to think that the perimeters were entered for the lower
 * streams' put and service routines as well as for the upper streams'.
 * Because of problems experienced by people, and after reading the
 * documentation more closely, I now don't think that is true.  So we
 * now use ppp_lower_lock to give us an existence guarantee on the
 * upper stream controlling each lower stream.
 *
 * Shared entry to the outer perimeter protects the existence of all
 * the upper streams and their upperstr_t structures, and guarantees
 * that the following fields of any upperstr_t won't change:
 * nextmn, next, nextppa.  It guarantees that the lowerq field of an
 * upperstr_t won't go from non-zero to zero, that the global `ppas'
 * won't change and that the no lower stream will get unlinked.
 *
 * Shared (reader) access to ppa_lower_lock guarantees that no lower
 * stream will be unlinked and that the lowerq field of all upperstr_t
 * structures won't change.
 */

#else /* SOL2 */
#define LOCK_LOWER_W	0
#define LOCK_LOWER_R	0
#define TRYLOCK_LOWER_R	1
#define UNLOCK_LOWER	0
#define MT_ENTER(x)	0
#define MT_EXIT(x)	0

#endif /* SOL2 */

/*
 * Private information; one per upper stream.
 */
typedef struct upperstr {
    minor_t mn;			/* minor device number */
    struct upperstr *nextmn;	/* next minor device */
    queue_t *q;			/* read q associated with this upper stream */
    int flags;			/* flag bits, see below */
    int state;			/* current DLPI state */
    int sap;			/* service access point */
    int req_sap;		/* which SAP the DLPI client requested */
    struct upperstr *ppa;	/* control stream for our ppa */
    struct upperstr *next;	/* next stream for this ppa */
    uint ioc_id;		/* last ioctl ID for this stream */
    enum NPmode npmode;		/* what to do with packets on this SAP */
    unsigned char rblocked;	/* flow control has blocked upper read strm */
	/* N.B. rblocked is only changed by control stream's put/srv procs */
    /*
     * There is exactly one control stream for each PPA.
     * The following fields are only used for control streams.
     */
    int ppa_id;
    queue_t *lowerq;		/* write queue attached below this PPA */
    struct upperstr *nextppa;	/* next control stream */
    int mru;
    int mtu;
    struct pppstat stats;	/* statistics */
    time_t last_sent;		/* time last NP packet sent */
    time_t last_recv;		/* time last NP packet rcvd */
#ifdef SOL2
    kmutex_t stats_lock;	/* lock for stats updates */
    kstat_t *kstats;		/* stats for netstat */
#endif /* SOL2 */
#ifdef LACHTCP
    int ifflags;
    char ifname[IFNAMSIZ];
    struct ifstats ifstats;
#endif /* LACHTCP */
} upperstr_t;

/* Values for flags */
#define US_PRIV		1	/* stream was opened by superuser */
#define US_CONTROL	2	/* stream is a control stream */
#define US_BLOCKED	4	/* flow ctrl has blocked lower write stream */
#define US_LASTMOD	8	/* no PPP modules below us */
#define US_DBGLOG	0x10	/* log various occurrences */
#define US_RBLOCKED	0x20	/* flow ctrl has blocked upper read stream */

#if defined(SOL2)
#if DL_CURRENT_VERSION >= 2
#define US_PROMISC	0x40	/* stream is promiscuous */
#endif /* DL_CURRENT_VERSION >= 2 */
#define US_RAWDATA	0x80	/* raw M_DATA, no DLPI header */
#endif /* defined(SOL2) */

#ifdef PRIOQ
static u_char max_band=0;
static u_char def_band=0;

#define IPPORT_DEFAULT		65535

/*
 * Port priority table
 * Highest priority ports are listed first, lowest are listed last.
 * ICMP & packets using unlisted ports will be treated as "default".
 * If IPPORT_DEFAULT is not listed here, "default" packets will be 
 * assigned lowest priority.
 * Each line should be terminated with "0".
 * Line containing only "0" marks the end of the list.
 */

static u_short prioq_table[]= {
    113, 53, 0,
    22, 23, 513, 517, 518, 0,
    514, 21, 79, 111, 0,
    25, 109, 110, 0,
    IPPORT_DEFAULT, 0,
    20, 70, 80, 8001, 8008, 8080, 0, /* 8001,8008,8080 - common proxy ports */
0 };

#endif	/* PRIOQ */


static upperstr_t *minor_devs = NULL;
static upperstr_t *ppas = NULL;

#ifdef SVR4
static int pppopen __P((queue_t *, dev_t *, int, int, cred_t *));
static int pppclose __P((queue_t *, int, cred_t *));
#else
static int pppopen __P((queue_t *, int, int, int));
static int pppclose __P((queue_t *, int));
#endif /* SVR4 */
static int pppurput __P((queue_t *, mblk_t *));
static int pppuwput __P((queue_t *, mblk_t *));
static int pppursrv __P((queue_t *));
static int pppuwsrv __P((queue_t *));
static int ppplrput __P((queue_t *, mblk_t *));
static int ppplwput __P((queue_t *, mblk_t *));
static int ppplrsrv __P((queue_t *));
static int ppplwsrv __P((queue_t *));
#ifndef NO_DLPI
static void dlpi_request __P((queue_t *, mblk_t *, upperstr_t *));
static void dlpi_error __P((queue_t *, upperstr_t *, int, int, int));
static void dlpi_ok __P((queue_t *, int));
#endif
static int send_data __P((mblk_t *, upperstr_t *));
static void new_ppa __P((queue_t *, mblk_t *));
static void attach_ppa __P((queue_t *, mblk_t *));
static void detach_ppa __P((queue_t *, mblk_t *));
static void detach_lower __P((queue_t *, mblk_t *));
static void debug_dump __P((queue_t *, mblk_t *));
static upperstr_t *find_dest __P((upperstr_t *, int));
#if defined(SOL2)
static upperstr_t *find_promisc __P((upperstr_t *, int));
static mblk_t *prepend_ether __P((upperstr_t *, mblk_t *, int));
static mblk_t *prepend_udind __P((upperstr_t *, mblk_t *, int));
static void promisc_sendup __P((upperstr_t *, mblk_t *, int, int));
#endif /* defined(SOL2) */
static int putctl2 __P((queue_t *, int, int, int));
static int putctl4 __P((queue_t *, int, int, int));
static int pass_packet __P((upperstr_t *ppa, mblk_t *mp, int outbound));
#ifdef FILTER_PACKETS
static int ip_hard_filter __P((upperstr_t *ppa, mblk_t *mp, int outbound));
#endif /* FILTER_PACKETS */

#define PPP_ID 0xb1a6
static struct module_info ppp_info = {
#ifdef PRIOQ
    PPP_ID, "ppp", 0, 512, 512, 384
#else
    PPP_ID, "ppp", 0, 512, 512, 128
#endif	/* PRIOQ */
};

static struct qinit pppurint = {
    pppurput, pppursrv, pppopen, pppclose, NULL, &ppp_info, NULL
};

static struct qinit pppuwint = {
    pppuwput, pppuwsrv, NULL, NULL, NULL, &ppp_info, NULL
};

static struct qinit ppplrint = {
    ppplrput, ppplrsrv, NULL, NULL, NULL, &ppp_info, NULL
};

static struct qinit ppplwint = {
    ppplwput, ppplwsrv, NULL, NULL, NULL, &ppp_info, NULL
};

#ifdef LACHTCP
extern struct ifstats *ifstats;
int pppdevflag = 0;
#endif

struct streamtab pppinfo = {
    &pppurint, &pppuwint,
    &ppplrint, &ppplwint
};

int ppp_count;

/*
 * How we maintain statistics.
 */
#ifdef SOL2
#define INCR_IPACKETS(ppa)				\
	if (ppa->kstats != 0) {				\
	    KSTAT_NAMED_PTR(ppa->kstats)[0].value.ul++;	\
	}
#define INCR_IERRORS(ppa)				\
	if (ppa->kstats != 0) {				\
	    KSTAT_NAMED_PTR(ppa->kstats)[1].value.ul++;	\
	}
#define INCR_OPACKETS(ppa)				\
	if (ppa->kstats != 0) {				\
	    KSTAT_NAMED_PTR(ppa->kstats)[2].value.ul++;	\
	}
#define INCR_OERRORS(ppa)				\
	if (ppa->kstats != 0) {				\
	    KSTAT_NAMED_PTR(ppa->kstats)[3].value.ul++;	\
	}
#endif

#ifdef LACHTCP
#define INCR_IPACKETS(ppa)	ppa->ifstats.ifs_ipackets++;
#define INCR_IERRORS(ppa)	ppa->ifstats.ifs_ierrors++;
#define INCR_OPACKETS(ppa)	ppa->ifstats.ifs_opackets++;
#define INCR_OERRORS(ppa)	ppa->ifstats.ifs_oerrors++;
#endif

/*
 * STREAMS driver entry points.
 */
static int
#ifdef SVR4
pppopen(q, devp, oflag, sflag, credp)
    queue_t *q;
    dev_t *devp;
    int oflag, sflag;
    cred_t *credp;
#else
pppopen(q, dev, oflag, sflag)
    queue_t *q;
    int dev;			/* really dev_t */
    int oflag, sflag;
#endif
{
    upperstr_t *up;
    upperstr_t **prevp;
    minor_t mn;
#ifdef PRIOQ
    u_short *ptr;
    u_char new_band;
#endif	/* PRIOQ */

    if (q->q_ptr)
	DRV_OPEN_OK(dev);	/* device is already open */

#ifdef PRIOQ
    /* Calculate max_bband & def_band from definitions in prioq.h
       This colud be done at some more approtiate time (less often)
       but this way it works well so I'll just leave it here */

    max_band = 1;
    def_band = 0;
    ptr = prioq_table;
    while (*ptr) {
        new_band = 1;
        while (*ptr)
	    if (*ptr++ == IPPORT_DEFAULT) {
		new_band = 0;
		def_band = max_band;
	    }
        max_band += new_band;
        ptr++;
    }
    if (def_band)
        def_band = max_band - def_band;
    --max_band;
#endif	/* PRIOQ */

    if (sflag == CLONEOPEN) {
	mn = 0;
	for (prevp = &minor_devs; (up = *prevp) != 0; prevp = &up->nextmn) {
	    if (up->mn != mn)
		break;
	    ++mn;
	}
    } else {
#ifdef SVR4
	mn = getminor(*devp);
#else
	mn = minor(dev);
#endif
	for (prevp = &minor_devs; (up = *prevp) != 0; prevp = &up->nextmn) {
	    if (up->mn >= mn)
		break;
	}
	if (up->mn == mn) {
	    /* this can't happen */
	    q->q_ptr = WR(q)->q_ptr = (caddr_t) up;
	    DRV_OPEN_OK(dev);
	}
    }

    /*
     * Construct a new minor node.
     */
    up = (upperstr_t *) ALLOC_SLEEP(sizeof(upperstr_t));
    bzero((caddr_t) up, sizeof(upperstr_t));
    if (up == 0) {
	DPRINT("pppopen: out of kernel memory\n");
	OPEN_ERROR(ENXIO);
    }
    up->nextmn = *prevp;
    *prevp = up;
    up->mn = mn;
#ifdef SVR4
    *devp = makedevice(getmajor(*devp), mn);
#endif
    up->q = q;
    if (NOTSUSER() == 0)
	up->flags |= US_PRIV;
#ifndef NO_DLPI
    up->state = DL_UNATTACHED;
#endif
#ifdef LACHTCP
    up->ifflags = IFF_UP | IFF_POINTOPOINT;
#endif
    up->sap = -1;
    up->last_sent = up->last_recv = time;
    up->npmode = NPMODE_DROP;
    q->q_ptr = (caddr_t) up;
    WR(q)->q_ptr = (caddr_t) up;
    noenable(WR(q));
#ifdef SOL2
    mutex_init(&up->stats_lock, NULL, MUTEX_DRIVER, NULL);
#endif
    ++ppp_count;

    qprocson(q);
    DRV_OPEN_OK(makedev(major(dev), mn));
}

static int
#ifdef SVR4
pppclose(q, flag, credp)
    queue_t *q;
    int flag;
    cred_t *credp;
#else
pppclose(q, flag)
    queue_t *q;
    int flag;
#endif
{
    upperstr_t *up, **upp;
    upperstr_t *as, *asnext;
    upperstr_t **prevp;

    qprocsoff(q);

    up = (upperstr_t *) q->q_ptr;
    if (up == 0) {
	DPRINT("pppclose: q_ptr = 0\n");
	return 0;
    }
    if (up->flags & US_DBGLOG)
	DPRINT2("ppp/%d: close, flags=%x\n", up->mn, up->flags);
    if (up->flags & US_CONTROL) {
#ifdef LACHTCP
	struct ifstats *ifp, *pifp;
#endif
	if (up->lowerq != 0) {
	    /* Gack! the lower stream should have be unlinked earlier! */
	    DPRINT1("ppp%d: lower stream still connected on close?\n",
		    up->mn);
	    LOCK_LOWER_W;
	    up->lowerq->q_ptr = 0;
	    RD(up->lowerq)->q_ptr = 0;
	    up->lowerq = 0;
	    UNLOCK_LOWER;
	}

	/*
	 * This stream represents a PPA:
	 * For all streams attached to the PPA, clear their
	 * references to this PPA.
	 * Then remove this PPA from the list of PPAs.
	 */
	for (as = up->next; as != 0; as = asnext) {
	    asnext = as->next;
	    as->next = 0;
	    as->ppa = 0;
	    if (as->flags & US_BLOCKED) {
		as->flags &= ~US_BLOCKED;
		flushq(WR(as->q), FLUSHDATA);
	    }
	}
	for (upp = &ppas; *upp != 0; upp = &(*upp)->nextppa)
	    if (*upp == up) {
		*upp = up->nextppa;
		break;
	    }
#ifdef LACHTCP
	/* Remove the statistics from the active list.  */
	for (ifp = ifstats, pifp = 0; ifp; ifp = ifp->ifs_next) {
	    if (ifp == &up->ifstats) {
		if (pifp)
		    pifp->ifs_next = ifp->ifs_next;
		else
		    ifstats = ifp->ifs_next;
		break;
	    }
	    pifp = ifp;
	}
#endif
    } else {
	/*
	 * If this stream is attached to a PPA,
	 * remove it from the PPA's list.
	 */
	if ((as = up->ppa) != 0) {
	    for (; as->next != 0; as = as->next)
		if (as->next == up) {
		    as->next = up->next;
		    break;
		}
	}
    }

#ifdef SOL2
    if (up->kstats)
	kstat_delete(up->kstats);
    mutex_destroy(&up->stats_lock);
#endif

    q->q_ptr = NULL;
    WR(q)->q_ptr = NULL;

    for (prevp = &minor_devs; *prevp != 0; prevp = &(*prevp)->nextmn) {
	if (*prevp == up) {
	    *prevp = up->nextmn;
	    break;
	}
    }
    FREE(up, sizeof(upperstr_t));
    --ppp_count;

    return 0;
}

/*
 * A message from on high.  We do one of three things:
 *	- qreply()
 *	- put the message on the lower write stream
 *	- queue it for our service routine
 */
static int
pppuwput(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    upperstr_t *us, *ppa, *nps;
    struct iocblk *iop;
    struct linkblk *lb;
#ifdef LACHTCP
    struct ifreq *ifr;
    int i;
#endif
    queue_t *lq;
    int error, n, sap;
    mblk_t *mq;
    struct ppp_idle *pip;
#ifdef PRIOQ
    queue_t *tlq;
#endif	/* PRIOQ */
#ifdef NO_DLPI
    upperstr_t *os;
#endif

    us = (upperstr_t *) q->q_ptr;
    if (us == 0) {
	DPRINT("pppuwput: q_ptr = 0!\n");
	return 0;
    }
    if (mp == 0) {
	DPRINT1("pppuwput/%d: mp = 0!\n", us->mn);
	return 0;
    }
    if (mp->b_datap == 0) {
	DPRINT1("pppuwput/%d: mp->b_datap = 0!\n", us->mn);
	return 0;
    }
    switch (mp->b_datap->db_type) {
#ifndef NO_DLPI
    case M_PCPROTO:
    case M_PROTO:
	dlpi_request(q, mp, us);
	break;
#endif /* NO_DLPI */

    case M_DATA:
	if (us->flags & US_DBGLOG)
	    DPRINT3("ppp/%d: uwput M_DATA len=%d flags=%x\n",
		    us->mn, msgdsize(mp), us->flags);
	if (us->ppa == 0 || msgdsize(mp) > us->ppa->mtu + PPP_HDRLEN
#ifndef NO_DLPI
	    || (us->flags & US_CONTROL) == 0
#endif /* NO_DLPI */
	    ) {
	    DPRINT1("pppuwput: junk data len=%d\n", msgdsize(mp));
	    freemsg(mp);
	    break;
	}
#ifdef NO_DLPI
	if ((us->flags & US_CONTROL) == 0 && !pass_packet(us, mp, 1))
	    break;
#endif
	if (!send_data(mp, us))
	    putq(q, mp);
	break;

    case M_IOCTL:
	iop = (struct iocblk *) mp->b_rptr;
	error = EINVAL;
	if (us->flags & US_DBGLOG)
	    DPRINT3("ppp/%d: ioctl %x count=%d\n",
		    us->mn, iop->ioc_cmd, iop->ioc_count);
	switch (iop->ioc_cmd) {
#if defined(SOL2)
	case DLIOCRAW:	    /* raw M_DATA mode */
	    us->flags |= US_RAWDATA;
	    error = 0;
	    break;
#endif /* defined(SOL2) */
	case I_LINK:
	    if ((us->flags & US_CONTROL) == 0 || us->lowerq != 0)
		break;
	    if (mp->b_cont == 0) {
		DPRINT1("pppuwput/%d: ioctl I_LINK b_cont = 0!\n", us->mn);
		break;
	    }
	    lb = (struct linkblk *) mp->b_cont->b_rptr;
	    lq = lb->l_qbot;
	    if (lq == 0) {
		DPRINT1("pppuwput/%d: ioctl I_LINK l_qbot = 0!\n", us->mn);
		break;
	    }
	    LOCK_LOWER_W;
	    us->lowerq = lq;
	    lq->q_ptr = (caddr_t) q;
	    RD(lq)->q_ptr = (caddr_t) us->q;
	    UNLOCK_LOWER;
	    iop->ioc_count = 0;
	    error = 0;
	    us->flags &= ~US_LASTMOD;
	    /* Unblock upper streams which now feed this lower stream. */
	    qenable(q);
	    /* Send useful information down to the modules which
	       are now linked below us. */
	    putctl2(lq, M_CTL, PPPCTL_UNIT, us->ppa_id);
	    putctl4(lq, M_CTL, PPPCTL_MRU, us->mru);
	    putctl4(lq, M_CTL, PPPCTL_MTU, us->mtu);
#ifdef PRIOQ
            /* Lower tty driver's queue hiwat/lowat from default 4096/128
               to 256/128 since we don't want queueing of data on
               output to physical device */

            freezestr(lq);
            for (tlq = lq; tlq->q_next != NULL; tlq = tlq->q_next)
		;
            strqset(tlq, QHIWAT, 0, 256);
            strqset(tlq, QLOWAT, 0, 128);
            unfreezestr(lq);
#endif	/* PRIOQ */
	    break;

	case I_UNLINK:
	    if (mp->b_cont == 0) {
		DPRINT1("pppuwput/%d: ioctl I_UNLINK b_cont = 0!\n", us->mn);
		break;
	    }
	    lb = (struct linkblk *) mp->b_cont->b_rptr;
#if DEBUG
	    if (us->lowerq != lb->l_qbot) {
		DPRINT2("ppp unlink: lowerq=%x qbot=%x\n",
			us->lowerq, lb->l_qbot);
		break;
	    }
#endif
	    iop->ioc_count = 0;
	    qwriter(q, mp, detach_lower, PERIM_OUTER);
	    error = -1;
	    break;

	case PPPIO_NEWPPA:
	    if (us->flags & US_CONTROL)
		break;
	    if ((us->flags & US_PRIV) == 0) {
		error = EPERM;
		break;
	    }
	    /* Arrange to return an int */
	    if ((mq = mp->b_cont) == 0
		|| mq->b_datap->db_lim - mq->b_rptr < sizeof(int)) {
		mq = allocb(sizeof(int), BPRI_HI);
		if (mq == 0) {
		    error = ENOSR;
		    break;
		}
		if (mp->b_cont != 0)
		    freemsg(mp->b_cont);
		mp->b_cont = mq;
		mq->b_cont = 0;
	    }
	    iop->ioc_count = sizeof(int);
	    mq->b_wptr = mq->b_rptr + sizeof(int);
	    qwriter(q, mp, new_ppa, PERIM_OUTER);
	    error = -1;
	    break;

	case PPPIO_ATTACH:
	    /* like dlpi_attach, for programs which can't write to
	       the stream (like pppstats) */
	    if (iop->ioc_count != sizeof(int) || us->ppa != 0)
		break;
	    if (mp->b_cont == 0) {
		DPRINT1("pppuwput/%d: ioctl PPPIO_ATTACH b_cont = 0!\n", us->mn);
		break;
	    }
	    n = *(int *)mp->b_cont->b_rptr;
	    for (ppa = ppas; ppa != 0; ppa = ppa->nextppa)
		if (ppa->ppa_id == n)
		    break;
	    if (ppa == 0)
		break;
	    us->ppa = ppa;
	    iop->ioc_count = 0;
	    qwriter(q, mp, attach_ppa, PERIM_OUTER);
	    error = -1;
	    break;

#ifdef NO_DLPI
	case PPPIO_BIND:
	    /* Attach to a given SAP. */
	    if (iop->ioc_count != sizeof(int) || us->ppa == 0)
		break;
	    if (mp->b_cont == 0) {
		DPRINT1("pppuwput/%d: ioctl PPPIO_BIND b_cont = 0!\n", us->mn);
		break;
	    }
	    n = *(int *)mp->b_cont->b_rptr;
	    /* n must be a valid PPP network protocol number. */
	    if (n < 0x21 || n > 0x3fff || (n & 0x101) != 1)
		break;
	    /* check that no other stream is bound to this sap already. */
	    for (os = us->ppa; os != 0; os = os->next)
		if (os->sap == n)
		    break;
	    if (os != 0)
		break;
	    us->sap = n;
	    iop->ioc_count = 0;
	    error = 0;
	    break;
#endif /* NO_DLPI */

	case PPPIO_MRU:
	    if (iop->ioc_count != sizeof(int) || (us->flags & US_CONTROL) == 0)
		break;
	    if (mp->b_cont == 0) {
		DPRINT1("pppuwput/%d: ioctl PPPIO_MRU b_cont = 0!\n", us->mn);
		break;
	    }
	    n = *(int *)mp->b_cont->b_rptr;
	    if (n <= 0 || n > PPP_MAXMRU)
		break;
	    if (n < PPP_MRU)
		n = PPP_MRU;
	    us->mru = n;
	    if (us->lowerq)
		putctl4(us->lowerq, M_CTL, PPPCTL_MRU, n);
	    error = 0;
	    iop->ioc_count = 0;
	    break;

	case PPPIO_MTU:
	    if (iop->ioc_count != sizeof(int) || (us->flags & US_CONTROL) == 0)
		break;
	    if (mp->b_cont == 0) {
		DPRINT1("pppuwput/%d: ioctl PPPIO_MTU b_cont = 0!\n", us->mn);
		break;
	    }
	    n = *(int *)mp->b_cont->b_rptr;
	    if (n <= 0 || n > PPP_MAXMTU)
		break;
	    us->mtu = n;
#ifdef LACHTCP
	    /* The MTU reported in netstat, not used as IP max packet size! */
	    us->ifstats.ifs_mtu = n;
#endif
	    if (us->lowerq)
		putctl4(us->lowerq, M_CTL, PPPCTL_MTU, n);
	    error = 0;
	    iop->ioc_count = 0;
	    break;

	case PPPIO_LASTMOD:
	    us->flags |= US_LASTMOD;
	    error = 0;
	    break;

	case PPPIO_DEBUG:
	    if (iop->ioc_count != sizeof(int))
		break;
	    if (mp->b_cont == 0) {
		DPRINT1("pppuwput/%d: ioctl PPPIO_DEBUG b_cont = 0!\n", us->mn);
		break;
	    }
	    n = *(int *)mp->b_cont->b_rptr;
	    if (n == PPPDBG_DUMP + PPPDBG_DRIVER) {
		qwriter(q, NULL, debug_dump, PERIM_OUTER);
		iop->ioc_count = 0;
		error = -1;
	    } else if (n == PPPDBG_LOG + PPPDBG_DRIVER) {
		DPRINT1("ppp/%d: debug log enabled\n", us->mn);
		us->flags |= US_DBGLOG;
		iop->ioc_count = 0;
		error = 0;
	    } else {
		if (us->ppa == 0 || us->ppa->lowerq == 0)
		    break;
		putnext(us->ppa->lowerq, mp);
		error = -1;
	    }
	    break;

	case PPPIO_NPMODE:
	    if (iop->ioc_count != 2 * sizeof(int))
		break;
	    if ((us->flags & US_CONTROL) == 0)
		break;
	    if (mp->b_cont == 0) {
		DPRINT1("pppuwput/%d: ioctl PPPIO_NPMODE b_cont = 0!\n", us->mn);
		break;
	    }
	    sap = ((int *)mp->b_cont->b_rptr)[0];
	    for (nps = us->next; nps != 0; nps = nps->next) {
		if (us->flags & US_DBGLOG)
		    DPRINT2("us = 0x%x, us->next->sap = 0x%x\n", nps, nps->sap);
		if (nps->sap == sap)
		    break;
	    }
	    if (nps == 0) {
		if (us->flags & US_DBGLOG)
		    DPRINT2("ppp/%d: no stream for sap %x\n", us->mn, sap);
		break;
	    }
	    /* XXX possibly should use qwriter here */
	    nps->npmode = (enum NPmode) ((int *)mp->b_cont->b_rptr)[1];
	    if (nps->npmode != NPMODE_QUEUE && (nps->flags & US_BLOCKED) != 0)
		qenable(WR(nps->q));
	    iop->ioc_count = 0;
	    error = 0;
	    break;

	case PPPIO_GIDLE:
	    if ((ppa = us->ppa) == 0)
		break;
	    mq = allocb(sizeof(struct ppp_idle), BPRI_HI);
	    if (mq == 0) {
		error = ENOSR;
		break;
	    }
	    if (mp->b_cont != 0)
		freemsg(mp->b_cont);
	    mp->b_cont = mq;
	    mq->b_cont = 0;
	    pip = (struct ppp_idle *) mq->b_wptr;
	    pip->xmit_idle = time - ppa->last_sent;
	    pip->recv_idle = time - ppa->last_recv;
	    mq->b_wptr += sizeof(struct ppp_idle);
	    iop->ioc_count = sizeof(struct ppp_idle);
	    error = 0;
	    break;

#ifdef LACHTCP
	case SIOCSIFNAME:
	    /* Sent from IP down to us.  Attach the ifstats structure.  */
	    if (iop->ioc_count != sizeof(struct ifreq) || us->ppa == 0)
	        break;
	    ifr = (struct ifreq *)mp->b_cont->b_rptr;
	    /* Find the unit number in the interface name.  */
	    for (i = 0; i < IFNAMSIZ; i++) {
		if (ifr->ifr_name[i] == 0 ||
		    (ifr->ifr_name[i] >= '0' &&
		     ifr->ifr_name[i] <= '9'))
		    break;
		else
		    us->ifname[i] = ifr->ifr_name[i];
	    }
	    us->ifname[i] = 0;

	    /* Convert the unit number to binary.  */
	    for (n = 0; i < IFNAMSIZ; i++) {
		if (ifr->ifr_name[i] == 0) {
		    break;
		}
	        else {
		    n = n * 10 + ifr->ifr_name[i] - '0';
		}
	    }

	    /* Verify the ppa.  */
	    if (us->ppa->ppa_id != n)
		break;
	    ppa = us->ppa;

	    /* Set up the netstat block.  */
	    strncpy (ppa->ifname, us->ifname, IFNAMSIZ);

	    ppa->ifstats.ifs_name = ppa->ifname;
	    ppa->ifstats.ifs_unit = n;
	    ppa->ifstats.ifs_active = us->state != DL_UNBOUND;
	    ppa->ifstats.ifs_mtu = ppa->mtu;

	    /* Link in statistics used by netstat.  */
	    ppa->ifstats.ifs_next = ifstats;
	    ifstats = &ppa->ifstats;

	    iop->ioc_count = 0;
	    error = 0;
	    break;

	case SIOCGIFFLAGS:
	    if (!(us->flags & US_CONTROL)) {
		if (us->ppa)
		    us = us->ppa;
	        else
		    break;
	    }
	    ((struct iocblk_in *)iop)->ioc_ifflags = us->ifflags;
	    error = 0;
	    break;

	case SIOCSIFFLAGS:
	    if (!(us->flags & US_CONTROL)) {
		if (us->ppa)
		    us = us->ppa;
		else
		    break;
	    }
	    us->ifflags = ((struct iocblk_in *)iop)->ioc_ifflags;
	    error = 0;
	    break;

	case SIOCSIFADDR:
	    if (!(us->flags & US_CONTROL)) {
		if (us->ppa)
		    us = us->ppa;
		else
		    break;
	    }
	    us->ifflags |= IFF_RUNNING;
	    ((struct iocblk_in *)iop)->ioc_ifflags |= IFF_RUNNING;
	    error = 0;
	    break;

	case SIOCSIFMTU:
	    /*
	     * Vanilla SVR4 systems don't handle SIOCSIFMTU, rather
	     * they take the MTU from the DL_INFO_ACK we sent in response
	     * to their DL_INFO_REQ.  Fortunately, they will update the
	     * MTU if we send an unsolicited DL_INFO_ACK up.
	     */
	    if ((mq = allocb(sizeof(dl_info_req_t), BPRI_HI)) == 0)
		break;		/* should do bufcall */
	    ((union DL_primitives *)mq->b_rptr)->dl_primitive = DL_INFO_REQ;
	    mq->b_wptr = mq->b_rptr + sizeof(dl_info_req_t);
	    dlpi_request(q, mq, us);
	    error = 0;
	    break;

	case SIOCGIFNETMASK:
	case SIOCSIFNETMASK:
	case SIOCGIFADDR:
	case SIOCGIFDSTADDR:
	case SIOCSIFDSTADDR:
	case SIOCGIFMETRIC:
	    error = 0;
	    break;
#endif /* LACHTCP */

	default:
	    if (us->ppa == 0 || us->ppa->lowerq == 0)
		break;
	    us->ioc_id = iop->ioc_id;
	    error = -1;
	    switch (iop->ioc_cmd) {
	    case PPPIO_GETSTAT:
	    case PPPIO_GETCSTAT:
		if (us->flags & US_LASTMOD) {
		    error = EINVAL;
		    break;
		}
		putnext(us->ppa->lowerq, mp);
		break;
	    default:
		if (us->flags & US_PRIV)
		    putnext(us->ppa->lowerq, mp);
		else {
		    DPRINT1("ppp ioctl %x rejected\n", iop->ioc_cmd);
		    error = EPERM;
		}
		break;
	    }
	    break;
	}

	if (error > 0) {
	    iop->ioc_error = error;
	    mp->b_datap->db_type = M_IOCNAK;
	    qreply(q, mp);
	} else if (error == 0) {
	    mp->b_datap->db_type = M_IOCACK;
	    qreply(q, mp);
	}
	break;

    case M_FLUSH:
	if (us->flags & US_DBGLOG)
	    DPRINT2("ppp/%d: flush %x\n", us->mn, *mp->b_rptr);
	if (*mp->b_rptr & FLUSHW)
	    flushq(q, FLUSHDATA);
	if (*mp->b_rptr & FLUSHR) {
	    *mp->b_rptr &= ~FLUSHW;
	    qreply(q, mp);
	} else
	    freemsg(mp);
	break;

    default:
	freemsg(mp);
	break;
    }
    return 0;
}

#ifndef NO_DLPI
static void
dlpi_request(q, mp, us)
    queue_t *q;
    mblk_t *mp;
    upperstr_t *us;
{
    union DL_primitives *d = (union DL_primitives *) mp->b_rptr;
    int size = mp->b_wptr - mp->b_rptr;
    mblk_t *reply, *np;
    upperstr_t *ppa, *os;
    int sap, len;
    dl_info_ack_t *info;
    dl_bind_ack_t *ackp;
#if DL_CURRENT_VERSION >= 2
    dl_phys_addr_ack_t	*paddrack;
    static struct ether_addr eaddr = {0};
#endif

    if (us->flags & US_DBGLOG)
	DPRINT3("ppp/%d: dlpi prim %x len=%d\n", us->mn,
		d->dl_primitive, size);
    switch (d->dl_primitive) {
    case DL_INFO_REQ:
	if (size < sizeof(dl_info_req_t))
	    goto badprim;
	if ((reply = allocb(sizeof(dl_info_ack_t), BPRI_HI)) == 0)
	    break;		/* should do bufcall */
	reply->b_datap->db_type = M_PCPROTO;
	info = (dl_info_ack_t *) reply->b_wptr;
	reply->b_wptr += sizeof(dl_info_ack_t);
	bzero((caddr_t) info, sizeof(dl_info_ack_t));
	info->dl_primitive = DL_INFO_ACK;
	info->dl_max_sdu = us->ppa? us->ppa->mtu: PPP_MAXMTU;
	info->dl_min_sdu = 1;
	info->dl_addr_length = sizeof(uint);
	info->dl_mac_type = DL_ETHER;	/* a bigger lie */
	info->dl_current_state = us->state;
	info->dl_service_mode = DL_CLDLS;
	info->dl_provider_style = DL_STYLE2;
#if DL_CURRENT_VERSION >= 2
	info->dl_sap_length = sizeof(uint);
	info->dl_version = DL_CURRENT_VERSION;
#endif
	qreply(q, reply);
	break;

    case DL_ATTACH_REQ:
	if (size < sizeof(dl_attach_req_t))
	    goto badprim;
	if (us->state != DL_UNATTACHED || us->ppa != 0) {
	    dlpi_error(q, us, DL_ATTACH_REQ, DL_OUTSTATE, 0);
	    break;
	}
	for (ppa = ppas; ppa != 0; ppa = ppa->nextppa)
	    if (ppa->ppa_id == d->attach_req.dl_ppa)
		break;
	if (ppa == 0) {
	    dlpi_error(q, us, DL_ATTACH_REQ, DL_BADPPA, 0);
	    break;
	}
	us->ppa = ppa;
	qwriter(q, mp, attach_ppa, PERIM_OUTER);
	return;

    case DL_DETACH_REQ:
	if (size < sizeof(dl_detach_req_t))
	    goto badprim;
	if (us->state != DL_UNBOUND || us->ppa == 0) {
	    dlpi_error(q, us, DL_DETACH_REQ, DL_OUTSTATE, 0);
	    break;
	}
	qwriter(q, mp, detach_ppa, PERIM_OUTER);
	return;

    case DL_BIND_REQ:
	if (size < sizeof(dl_bind_req_t))
	    goto badprim;
	if (us->state != DL_UNBOUND || us->ppa == 0) {
	    dlpi_error(q, us, DL_BIND_REQ, DL_OUTSTATE, 0);
	    break;
	}
#if 0
	/* apparently this test fails (unnecessarily?) on some systems */
	if (d->bind_req.dl_service_mode != DL_CLDLS) {
	    dlpi_error(q, us, DL_BIND_REQ, DL_UNSUPPORTED, 0);
	    break;
	}
#endif

	/* saps must be valid PPP network protocol numbers,
	   except that we accept ETHERTYPE_IP in place of PPP_IP. */
	sap = d->bind_req.dl_sap;
	us->req_sap = sap;

#if defined(SOL2)
	if (us->flags & US_DBGLOG)
	    DPRINT2("DL_BIND_REQ: ip gives sap = 0x%x, us = 0x%x", sap, us);

	if (sap == ETHERTYPE_IP)	    /* normal IFF_IPV4 */
	    sap = PPP_IP;
	else if (sap == ETHERTYPE_IPV6)	    /* when IFF_IPV6 is set */
	    sap = PPP_IPV6;
	else if (sap == ETHERTYPE_ALLSAP)   /* snoop gives sap of 0 */
	    sap = PPP_ALLSAP;
	else {
	    DPRINT2("DL_BIND_REQ: unrecognized sap = 0x%x, us = 0x%x", sap, us);
	    dlpi_error(q, us, DL_BIND_REQ, DL_BADADDR, 0);
	    break;
	}
#else
	if (sap == ETHERTYPE_IP)
	    sap = PPP_IP;
	if (sap < 0x21 || sap > 0x3fff || (sap & 0x101) != 1) {
	    dlpi_error(q, us, DL_BIND_REQ, DL_BADADDR, 0);
	    break;
	}
#endif /* defined(SOL2) */

	/* check that no other stream is bound to this sap already. */
	for (os = us->ppa; os != 0; os = os->next)
	    if (os->sap == sap)
		break;
	if (os != 0) {
	    dlpi_error(q, us, DL_BIND_REQ, DL_NOADDR, 0);
	    break;
	}

	us->sap = sap;
	us->state = DL_IDLE;

	if ((reply = allocb(sizeof(dl_bind_ack_t) + sizeof(uint),
			    BPRI_HI)) == 0)
	    break;		/* should do bufcall */
	ackp = (dl_bind_ack_t *) reply->b_wptr;
	reply->b_wptr += sizeof(dl_bind_ack_t) + sizeof(uint);
	reply->b_datap->db_type = M_PCPROTO;
	bzero((caddr_t) ackp, sizeof(dl_bind_ack_t));
	ackp->dl_primitive = DL_BIND_ACK;
	ackp->dl_sap = sap;
	ackp->dl_addr_length = sizeof(uint);
	ackp->dl_addr_offset = sizeof(dl_bind_ack_t);
	*(uint *)(ackp+1) = sap;
	qreply(q, reply);
	break;

    case DL_UNBIND_REQ:
	if (size < sizeof(dl_unbind_req_t))
	    goto badprim;
	if (us->state != DL_IDLE) {
	    dlpi_error(q, us, DL_UNBIND_REQ, DL_OUTSTATE, 0);
	    break;
	}
	us->sap = -1;
	us->state = DL_UNBOUND;
#ifdef LACHTCP
	us->ppa->ifstats.ifs_active = 0;
#endif
	dlpi_ok(q, DL_UNBIND_REQ);
	break;

    case DL_UNITDATA_REQ:
	if (size < sizeof(dl_unitdata_req_t))
	    goto badprim;
	if (us->state != DL_IDLE) {
	    dlpi_error(q, us, DL_UNITDATA_REQ, DL_OUTSTATE, 0);
	    break;
	}
	if ((ppa = us->ppa) == 0) {
	    cmn_err(CE_CONT, "ppp: in state dl_idle but ppa == 0?\n");
	    break;
	}
	len = mp->b_cont == 0? 0: msgdsize(mp->b_cont);
	if (len > ppa->mtu) {
	    DPRINT2("dlpi data too large (%d > %d)\n", len, ppa->mtu);
	    break;
	}

#if defined(SOL2)
	/*
	 * Should there be any promiscuous stream(s), send the data
	 * up for each promiscuous stream that we recognize.
	 */
	if (mp->b_cont)
	    promisc_sendup(ppa, mp->b_cont, us->sap, 0);
#endif /* defined(SOL2) */

	mp->b_band = 0;
#ifdef PRIOQ
        /* Extract s_port & d_port from IP-packet, the code is a bit
           dirty here, but so am I, too... */
        if (mp->b_datap->db_type == M_PROTO && us->sap == PPP_IP
	    && mp->b_cont != 0) {
	    u_char *bb, *tlh;
	    int iphlen, len;
	    u_short *ptr;
	    u_char band_unset, cur_band, syn;
	    u_short s_port, d_port;

            bb = mp->b_cont->b_rptr; /* bb points to IP-header*/
	    len = mp->b_cont->b_wptr - mp->b_cont->b_rptr;
            syn = 0;
	    s_port = IPPORT_DEFAULT;
	    d_port = IPPORT_DEFAULT;
	    if (len >= 20) {	/* 20 = minimum length of IP header */
		iphlen = (bb[0] & 0x0f) * 4;
		tlh = bb + iphlen;
		len -= iphlen;
		switch (bb[9]) {
		case IPPROTO_TCP:
		    if (len >= 20) {	      /* min length of TCP header */
			s_port = (tlh[0] << 8) + tlh[1];
			d_port = (tlh[2] << 8) + tlh[3];
			syn = tlh[13] & 0x02;
		    }
		    break;
		case IPPROTO_UDP:
		    if (len >= 8) {	      /* min length of UDP header */
			s_port = (tlh[0] << 8) + tlh[1];
			d_port = (tlh[2] << 8) + tlh[3];
		    }
		    break;
		}
	    }

            /*
	     * Now calculate b_band for this packet from the
	     * port-priority table.
	     */
            ptr = prioq_table;
            cur_band = max_band;
            band_unset = 1;
            while (*ptr) {
                while (*ptr && band_unset)
                    if (s_port == *ptr || d_port == *ptr++) {
                        mp->b_band = cur_band;
                        band_unset = 0;
                        break;
		    }
                ptr++;
                cur_band--;
	    }
            if (band_unset)
		mp->b_band = def_band;
            /* It may be usable to urge SYN packets a bit */
            if (syn)
		mp->b_band++;
	}
#endif	/* PRIOQ */
	/* this assumes PPP_HDRLEN <= sizeof(dl_unitdata_req_t) */
	if (mp->b_datap->db_ref > 1) {
	    np = allocb(PPP_HDRLEN, BPRI_HI);
	    if (np == 0)
		break;		/* gak! */
	    np->b_cont = mp->b_cont;
	    mp->b_cont = 0;
	    freeb(mp);
	    mp = np;
	} else
	    mp->b_datap->db_type = M_DATA;
	/* XXX should use dl_dest_addr_offset/length here,
	   but we would have to translate ETHERTYPE_IP -> PPP_IP */
	mp->b_wptr = mp->b_rptr + PPP_HDRLEN;
	mp->b_rptr[0] = PPP_ALLSTATIONS;
	mp->b_rptr[1] = PPP_UI;
	mp->b_rptr[2] = us->sap >> 8;
	mp->b_rptr[3] = us->sap;
	if (pass_packet(us, mp, 1)) {
	    if (!send_data(mp, us))
		putq(q, mp);
	}
	return;

#if DL_CURRENT_VERSION >= 2
    case DL_PHYS_ADDR_REQ:
	if (size < sizeof(dl_phys_addr_req_t))
	    goto badprim;

	/*
	 * Don't check state because ifconfig sends this one down too
	 */

	if ((reply = allocb(sizeof(dl_phys_addr_ack_t)+ETHERADDRL, 
			BPRI_HI)) == 0)
	    break;		/* should do bufcall */
	reply->b_datap->db_type = M_PCPROTO;
	paddrack = (dl_phys_addr_ack_t *) reply->b_wptr;
	reply->b_wptr += sizeof(dl_phys_addr_ack_t);
	bzero((caddr_t) paddrack, sizeof(dl_phys_addr_ack_t)+ETHERADDRL);
	paddrack->dl_primitive = DL_PHYS_ADDR_ACK;
	paddrack->dl_addr_length = ETHERADDRL;
	paddrack->dl_addr_offset = sizeof(dl_phys_addr_ack_t);
	bcopy(&eaddr, reply->b_wptr, ETHERADDRL);
	reply->b_wptr += ETHERADDRL;
	qreply(q, reply);
	break;

#if defined(SOL2)
    case DL_PROMISCON_REQ:
	if (size < sizeof(dl_promiscon_req_t))
	    goto badprim;
	us->flags |= US_PROMISC;
	dlpi_ok(q, DL_PROMISCON_REQ);
	break;

    case DL_PROMISCOFF_REQ:
	if (size < sizeof(dl_promiscoff_req_t))
	    goto badprim;
	us->flags &= ~US_PROMISC;
	dlpi_ok(q, DL_PROMISCOFF_REQ);
	break;
#else
    case DL_PROMISCON_REQ:	    /* fall thru */
    case DL_PROMISCOFF_REQ:	    /* fall thru */
#endif /* defined(SOL2) */
#endif /* DL_CURRENT_VERSION >= 2 */

#if DL_CURRENT_VERSION >= 2
    case DL_SET_PHYS_ADDR_REQ:
    case DL_SUBS_BIND_REQ:
    case DL_SUBS_UNBIND_REQ:
    case DL_ENABMULTI_REQ:
    case DL_DISABMULTI_REQ:
    case DL_XID_REQ:
    case DL_TEST_REQ:
    case DL_REPLY_UPDATE_REQ:
    case DL_REPLY_REQ:
    case DL_DATA_ACK_REQ:
#endif
    case DL_CONNECT_REQ:
    case DL_TOKEN_REQ:
	dlpi_error(q, us, d->dl_primitive, DL_NOTSUPPORTED, 0);
	break;

    case DL_CONNECT_RES:
    case DL_DISCONNECT_REQ:
    case DL_RESET_REQ:
    case DL_RESET_RES:
	dlpi_error(q, us, d->dl_primitive, DL_OUTSTATE, 0);
	break;

    case DL_UDQOS_REQ:
	dlpi_error(q, us, d->dl_primitive, DL_BADQOSTYPE, 0);
	break;

#if DL_CURRENT_VERSION >= 2
    case DL_TEST_RES:
    case DL_XID_RES:
	break;
#endif

    default:
	cmn_err(CE_CONT, "ppp: unknown dlpi prim 0x%x\n", d->dl_primitive);
	/* fall through */
    badprim:
	dlpi_error(q, us, d->dl_primitive, DL_BADPRIM, 0);
	break;
    }
    freemsg(mp);
}

static void
dlpi_error(q, us, prim, err, uerr)
    queue_t *q;
    upperstr_t *us;
    int prim, err, uerr;
{
    mblk_t *reply;
    dl_error_ack_t *errp;

    if (us->flags & US_DBGLOG)
        DPRINT3("ppp/%d: dlpi error, prim=%x, err=%x\n", us->mn, prim, err);
    reply = allocb(sizeof(dl_error_ack_t), BPRI_HI);
    if (reply == 0)
	return;			/* XXX should do bufcall */
    reply->b_datap->db_type = M_PCPROTO;
    errp = (dl_error_ack_t *) reply->b_wptr;
    reply->b_wptr += sizeof(dl_error_ack_t);
    errp->dl_primitive = DL_ERROR_ACK;
    errp->dl_error_primitive = prim;
    errp->dl_errno = err;
    errp->dl_unix_errno = uerr;
    qreply(q, reply);
}

static void
dlpi_ok(q, prim)
    queue_t *q;
    int prim;
{
    mblk_t *reply;
    dl_ok_ack_t *okp;

    reply = allocb(sizeof(dl_ok_ack_t), BPRI_HI);
    if (reply == 0)
	return;			/* XXX should do bufcall */
    reply->b_datap->db_type = M_PCPROTO;
    okp = (dl_ok_ack_t *) reply->b_wptr;
    reply->b_wptr += sizeof(dl_ok_ack_t);
    okp->dl_primitive = DL_OK_ACK;
    okp->dl_correct_primitive = prim;
    qreply(q, reply);
}
#endif /* NO_DLPI */

static int
pass_packet(us, mp, outbound)
    upperstr_t *us;
    mblk_t *mp;
    int outbound;
{
    int pass;
    upperstr_t *ppa;

    if ((ppa = us->ppa) == 0) {
	freemsg(mp);
	return 0;
    }

#ifdef FILTER_PACKETS
    pass = ip_hard_filter(us, mp, outbound);
#else
    /*
     * Here is where we might, in future, decide whether to pass
     * or drop the packet, and whether it counts as link activity.
     */
    pass = 1;
#endif /* FILTER_PACKETS */

    if (pass < 0) {
	/* pass only if link already up, and don't update time */
	if (ppa->lowerq == 0) {
	    freemsg(mp);
	    return 0;
	}
	pass = 1;
    } else if (pass) {
	if (outbound)
	    ppa->last_sent = time;
	else
	    ppa->last_recv = time;
    }

    return pass;
}

/*
 * We have some data to send down to the lower stream (or up the
 * control stream, if we don't have a lower stream attached).
 * Returns 1 if the message was dealt with, 0 if it wasn't able
 * to be sent on and should therefore be queued up.
 */
static int
send_data(mp, us)
    mblk_t *mp;
    upperstr_t *us;
{
    upperstr_t *ppa;

    if ((us->flags & US_BLOCKED) || us->npmode == NPMODE_QUEUE)
	return 0;
    ppa = us->ppa;
    if (ppa == 0 || us->npmode == NPMODE_DROP || us->npmode == NPMODE_ERROR) {
	if (us->flags & US_DBGLOG)
	    DPRINT2("ppp/%d: dropping pkt (npmode=%d)\n", us->mn, us->npmode);
	freemsg(mp);
	return 1;
    }
    if (ppa->lowerq == 0) {
	/* try to send it up the control stream */
        if (bcanputnext(ppa->q, mp->b_band)) {
	    /*
	     * The message seems to get corrupted for some reason if
	     * we just send the message up as it is, so we send a copy.
	     */
	    mblk_t *np = copymsg(mp);
	    freemsg(mp);
	    if (np != 0)
		putnext(ppa->q, np);
	    return 1;
	}
    } else {
        if (bcanputnext(ppa->lowerq, mp->b_band)) {
	    MT_ENTER(&ppa->stats_lock);
	    ppa->stats.ppp_opackets++;
	    ppa->stats.ppp_obytes += msgdsize(mp);
#ifdef INCR_OPACKETS
	    INCR_OPACKETS(ppa);
#endif
	    MT_EXIT(&ppa->stats_lock);
	    /*
	     * The lower queue is only ever detached while holding an
	     * exclusive lock on the whole driver.  So we can be confident
	     * that the lower queue is still there.
	     */
	    putnext(ppa->lowerq, mp);
	    return 1;
	}
    }
    us->flags |= US_BLOCKED;
    return 0;
}

/*
 * Allocate a new PPA id and link this stream into the list of PPAs.
 * This procedure is called with an exclusive lock on all queues in
 * this driver.
 */
static void
new_ppa(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    upperstr_t *us, *up, **usp;
    int ppa_id;

    us = (upperstr_t *) q->q_ptr;
    if (us == 0) {
	DPRINT("new_ppa: q_ptr = 0!\n");
	return;
    }

    usp = &ppas;
    ppa_id = 0;
    while ((up = *usp) != 0 && ppa_id == up->ppa_id) {
	++ppa_id;
	usp = &up->nextppa;
    }
    us->ppa_id = ppa_id;
    us->ppa = us;
    us->next = 0;
    us->nextppa = *usp;
    *usp = us;
    us->flags |= US_CONTROL;
    us->npmode = NPMODE_PASS;

    us->mtu = PPP_MTU;
    us->mru = PPP_MRU;

#ifdef SOL2
    /*
     * Create a kstats record for our statistics, so netstat -i works.
     */
    if (us->kstats == 0) {
	char unit[32];

	sprintf(unit, "ppp%d", us->ppa->ppa_id);
	us->kstats = kstat_create("ppp", us->ppa->ppa_id, unit,
				  "net", KSTAT_TYPE_NAMED, 4, 0);
	if (us->kstats != 0) {
	    kstat_named_t *kn = KSTAT_NAMED_PTR(us->kstats);

	    strcpy(kn[0].name, "ipackets");
	    kn[0].data_type = KSTAT_DATA_ULONG;
	    strcpy(kn[1].name, "ierrors");
	    kn[1].data_type = KSTAT_DATA_ULONG;
	    strcpy(kn[2].name, "opackets");
	    kn[2].data_type = KSTAT_DATA_ULONG;
	    strcpy(kn[3].name, "oerrors");
	    kn[3].data_type = KSTAT_DATA_ULONG;
	    kstat_install(us->kstats);
	}
    }
#endif /* SOL2 */

    *(int *)mp->b_cont->b_rptr = ppa_id;
    mp->b_datap->db_type = M_IOCACK;
    qreply(q, mp);
}

static void
attach_ppa(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    upperstr_t *us, *t;

    us = (upperstr_t *) q->q_ptr;
    if (us == 0) {
	DPRINT("attach_ppa: q_ptr = 0!\n");
	return;
    }

#ifndef NO_DLPI
    us->state = DL_UNBOUND;
#endif
    for (t = us->ppa; t->next != 0; t = t->next)
	;
    t->next = us;
    us->next = 0;
    if (mp->b_datap->db_type == M_IOCTL) {
	mp->b_datap->db_type = M_IOCACK;
	qreply(q, mp);
    } else {
#ifndef NO_DLPI
	dlpi_ok(q, DL_ATTACH_REQ);
#endif
    }
}

static void
detach_ppa(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    upperstr_t *us, *t;

    us = (upperstr_t *) q->q_ptr;
    if (us == 0) {
	DPRINT("detach_ppa: q_ptr = 0!\n");
	return;
    }

    for (t = us->ppa; t->next != 0; t = t->next)
	if (t->next == us) {
	    t->next = us->next;
	    break;
	}
    us->next = 0;
    us->ppa = 0;
#ifndef NO_DLPI
    us->state = DL_UNATTACHED;
    dlpi_ok(q, DL_DETACH_REQ);
#endif
}

/*
 * We call this with qwriter in order to give the upper queue procedures
 * the guarantee that the lower queue is not going to go away while
 * they are executing.
 */
static void
detach_lower(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    upperstr_t *us;

    us = (upperstr_t *) q->q_ptr;
    if (us == 0) {
	DPRINT("detach_lower: q_ptr = 0!\n");
	return;
    }

    LOCK_LOWER_W;
    us->lowerq->q_ptr = 0;
    RD(us->lowerq)->q_ptr = 0;
    us->lowerq = 0;
    UNLOCK_LOWER;

    /* Unblock streams which now feed back up the control stream. */
    qenable(us->q);

    mp->b_datap->db_type = M_IOCACK;
    qreply(q, mp);
}

static int
pppuwsrv(q)
    queue_t *q;
{
    upperstr_t *us, *as;
    mblk_t *mp;

    us = (upperstr_t *) q->q_ptr;
    if (us == 0) {
	DPRINT("pppuwsrv: q_ptr = 0!\n");
	return 0;
    }

    /*
     * If this is a control stream, then this service procedure
     * probably got enabled because of flow control in the lower
     * stream being enabled (or because of the lower stream going
     * away).  Therefore we enable the service procedure of all
     * attached upper streams.
     */
    if (us->flags & US_CONTROL) {
	for (as = us->next; as != 0; as = as->next)
	    qenable(WR(as->q));
    }

    /* Try to send on any data queued here. */
    us->flags &= ~US_BLOCKED;
    while ((mp = getq(q)) != 0) {
	if (!send_data(mp, us)) {
	    putbq(q, mp);
	    break;
	}
    }

    return 0;
}

/* should never get called... */
static int
ppplwput(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    putnext(q, mp);
    return 0;
}

static int
ppplwsrv(q)
    queue_t *q;
{
    queue_t *uq;

    /*
     * Flow control has back-enabled this stream:
     * enable the upper write service procedure for
     * the upper control stream for this lower stream.
     */
    LOCK_LOWER_R;
    uq = (queue_t *) q->q_ptr;
    if (uq != 0)
	qenable(uq);
    UNLOCK_LOWER;
    return 0;
}

/*
 * This should only get called for control streams.
 */
static int
pppurput(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    upperstr_t *ppa, *us;
    int proto, len;
    struct iocblk *iop;

    ppa = (upperstr_t *) q->q_ptr;
    if (ppa == 0) {
	DPRINT("pppurput: q_ptr = 0!\n");
	return 0;
    }

    switch (mp->b_datap->db_type) {
    case M_CTL:
	MT_ENTER(&ppa->stats_lock);
	switch (*mp->b_rptr) {
	case PPPCTL_IERROR:
#ifdef INCR_IERRORS
	    INCR_IERRORS(ppa);
#endif
	    ppa->stats.ppp_ierrors++;
	    break;
	case PPPCTL_OERROR:
#ifdef INCR_OERRORS
	    INCR_OERRORS(ppa);
#endif
	    ppa->stats.ppp_oerrors++;
	    break;
	}
	MT_EXIT(&ppa->stats_lock);
	freemsg(mp);
	break;

    case M_IOCACK:
    case M_IOCNAK:
	/*
	 * Attempt to match up the response with the stream
	 * that the request came from.
	 */
	iop = (struct iocblk *) mp->b_rptr;
	for (us = ppa; us != 0; us = us->next)
	    if (us->ioc_id == iop->ioc_id)
		break;
	if (us == 0)
	    freemsg(mp);
	else
	    putnext(us->q, mp);
	break;

    case M_HANGUP:
	/*
	 * The serial device has hung up.  We don't want to send
	 * the M_HANGUP message up to pppd because that will stop
	 * us from using the control stream any more.  Instead we
	 * send a zero-length message as an end-of-file indication.
	 */
	freemsg(mp);
	mp = allocb(1, BPRI_HI);
	if (mp == 0) {
	    DPRINT1("ppp/%d: couldn't allocate eof message!\n", ppa->mn);
	    break;
	}
	putnext(ppa->q, mp);
	break;

    default:
	if (mp->b_datap->db_type == M_DATA) {
	    len = msgdsize(mp);
	    if (mp->b_wptr - mp->b_rptr < PPP_HDRLEN) {
		PULLUP(mp, PPP_HDRLEN);
		if (mp == 0) {
		    DPRINT1("ppp_urput: msgpullup failed (len=%d)\n", len);
		    break;
		}
	    }
	    MT_ENTER(&ppa->stats_lock);
	    ppa->stats.ppp_ipackets++;
	    ppa->stats.ppp_ibytes += len;
#ifdef INCR_IPACKETS
	    INCR_IPACKETS(ppa);
#endif
	    MT_EXIT(&ppa->stats_lock);

	    proto = PPP_PROTOCOL(mp->b_rptr);

#if defined(SOL2)
	    /*
	     * Should there be any promiscuous stream(s), send the data
	     * up for each promiscuous stream that we recognize.
	     */
	    promisc_sendup(ppa, mp, proto, 1);
#endif /* defined(SOL2) */

	    if (proto < 0x8000 && (us = find_dest(ppa, proto)) != 0) {
		/*
		 * A data packet for some network protocol.
		 * Queue it on the upper stream for that protocol.
		 * XXX could we just putnext it?  (would require thought)
		 * The rblocked flag is there to ensure that we keep
		 * messages in order for each network protocol.
		 */
		if (!pass_packet(us, mp, 0))
		    break;
		if (!us->rblocked && !canput(us->q))
		    us->rblocked = 1;
		if (!us->rblocked)
		    putq(us->q, mp);
		else
		    putq(q, mp);
		break;
	    }
	}
	/*
	 * A control frame, a frame for an unknown protocol,
	 * or some other message type.
	 * Send it up to pppd via the control stream.
	 */
	if (queclass(mp) == QPCTL || canputnext(ppa->q))
	    putnext(ppa->q, mp);
	else
	    putq(q, mp);
	break;
    }

    return 0;
}

static int
pppursrv(q)
    queue_t *q;
{
    upperstr_t *us, *as;
    mblk_t *mp, *hdr;
#ifndef NO_DLPI
    dl_unitdata_ind_t *ud;
#endif
    int proto;

    us = (upperstr_t *) q->q_ptr;
    if (us == 0) {
	DPRINT("pppursrv: q_ptr = 0!\n");
	return 0;
    }

    if (us->flags & US_CONTROL) {
	/*
	 * A control stream.
	 * If there is no lower queue attached, run the write service
	 * routines of other upper streams attached to this PPA.
	 */
	if (us->lowerq == 0) {
	    as = us;
	    do {
		if (as->flags & US_BLOCKED)
		    qenable(WR(as->q));
		as = as->next;
	    } while (as != 0);
	}

	/*
	 * Messages get queued on this stream's read queue if they
	 * can't be queued on the read queue of the attached stream
	 * that they are destined for.  This is for flow control -
	 * when this queue fills up, the lower read put procedure will
	 * queue messages there and the flow control will propagate
	 * down from there.
	 */
	while ((mp = getq(q)) != 0) {
	    proto = PPP_PROTOCOL(mp->b_rptr);
	    if (proto < 0x8000 && (as = find_dest(us, proto)) != 0) {
		if (!canput(as->q))
		    break;
		putq(as->q, mp);
	    } else {
		if (!canputnext(q))
		    break;
		putnext(q, mp);
	    }
	}
	if (mp) {
	    putbq(q, mp);
	} else {
	    /* can now put stuff directly on network protocol streams again */
	    for (as = us->next; as != 0; as = as->next)
		as->rblocked = 0;
	}

	/*
	 * If this stream has a lower stream attached,
	 * enable the read queue's service routine.
	 * XXX we should really only do this if the queue length
	 * has dropped below the low-water mark.
	 */
	if (us->lowerq != 0)
	    qenable(RD(us->lowerq));
		
    } else {
	/*
	 * A network protocol stream.  Put a DLPI header on each
	 * packet and send it on.
	 * (Actually, it seems that the IP module will happily
	 * accept M_DATA messages without the DL_UNITDATA_IND header.)
	 */
	while ((mp = getq(q)) != 0) {
	    if (!canputnext(q)) {
		putbq(q, mp);
		break;
	    }
#ifndef NO_DLPI
	    proto = PPP_PROTOCOL(mp->b_rptr);
	    mp->b_rptr += PPP_HDRLEN;
	    hdr = allocb(sizeof(dl_unitdata_ind_t) + 2 * sizeof(uint),
			 BPRI_MED);
	    if (hdr == 0) {
		/* XXX should put it back and use bufcall */
		freemsg(mp);
		continue;
	    }
	    hdr->b_datap->db_type = M_PROTO;
	    ud = (dl_unitdata_ind_t *) hdr->b_wptr;
	    hdr->b_wptr += sizeof(dl_unitdata_ind_t) + 2 * sizeof(uint);
	    hdr->b_cont = mp;
	    ud->dl_primitive = DL_UNITDATA_IND;
	    ud->dl_dest_addr_length = sizeof(uint);
	    ud->dl_dest_addr_offset = sizeof(dl_unitdata_ind_t);
	    ud->dl_src_addr_length = sizeof(uint);
	    ud->dl_src_addr_offset = ud->dl_dest_addr_offset + sizeof(uint);
#if DL_CURRENT_VERSION >= 2
	    ud->dl_group_address = 0;
#endif
	    /* Send the DLPI client the data with the SAP they requested,
	       (e.g. ETHERTYPE_IP) rather than the PPP protocol number
	       (e.g. PPP_IP) */
	    ((uint *)(ud + 1))[0] = us->req_sap;	/* dest SAP */
	    ((uint *)(ud + 1))[1] = us->req_sap;	/* src SAP */
	    putnext(q, hdr);
#else /* NO_DLPI */
	    putnext(q, mp);
#endif /* NO_DLPI */
	}
	/*
	 * Now that we have consumed some packets from this queue,
	 * enable the control stream's read service routine so that we
	 * can process any packets for us that might have got queued
	 * there for flow control reasons.
	 */
	if (us->ppa)
	    qenable(us->ppa->q);
    }

    return 0;
}

static upperstr_t *
find_dest(ppa, proto)
    upperstr_t *ppa;
    int proto;
{
    upperstr_t *us;

    for (us = ppa->next; us != 0; us = us->next)
	if (proto == us->sap)
	    break;
    return us;
}

#if defined (SOL2)
/*
 * Test upstream promiscuous conditions. As of now, only pass IPv4 and
 * Ipv6 packets upstream (let PPP packets be decoded elsewhere).
 */
static upperstr_t *
find_promisc(us, proto)
    upperstr_t *us;
    int proto;
{

    if ((proto != PPP_IP) && (proto != PPP_IPV6))
	return (upperstr_t *)0;

    for ( ; us; us = us->next) {
	if ((us->flags & US_PROMISC) && (us->state == DL_IDLE))
	    return us;
    }

    return (upperstr_t *)0;
}

/*
 * Prepend an empty Ethernet header to msg for snoop, et al.
 */
static mblk_t *
prepend_ether(us, mp, proto)
    upperstr_t *us;
    mblk_t *mp;
    int proto;
{
    mblk_t *eh;
    int type;

    if ((eh = allocb(sizeof(struct ether_header), BPRI_HI)) == 0) {
	freemsg(mp);
	return (mblk_t *)0;
    }

    if (proto == PPP_IP)
	type = ETHERTYPE_IP;
    else if (proto == PPP_IPV6)
	type = ETHERTYPE_IPV6;
    else 
	type = proto;	    /* What else? Let decoder decide */

    eh->b_wptr += sizeof(struct ether_header);
    bzero((caddr_t)eh->b_rptr, sizeof(struct ether_header));
    ((struct ether_header *)eh->b_rptr)->ether_type = htons((short)type);
    eh->b_cont = mp;
    return (eh);
}

/*
 * Prepend DL_UNITDATA_IND mblk to msg
 */
static mblk_t *
prepend_udind(us, mp, proto)
    upperstr_t *us;
    mblk_t *mp;
    int proto;
{
    dl_unitdata_ind_t *dlu;
    mblk_t *dh;
    size_t size;

    size = sizeof(dl_unitdata_ind_t);
    if ((dh = allocb(size, BPRI_MED)) == 0) {
	freemsg(mp);
	return (mblk_t *)0;
    }

    dh->b_datap->db_type = M_PROTO;
    dh->b_wptr = dh->b_datap->db_lim;
    dh->b_rptr = dh->b_wptr - size;

    dlu = (dl_unitdata_ind_t *)dh->b_rptr;
    dlu->dl_primitive = DL_UNITDATA_IND;
    dlu->dl_dest_addr_length = 0;
    dlu->dl_dest_addr_offset = sizeof(dl_unitdata_ind_t);
    dlu->dl_src_addr_length = 0;
    dlu->dl_src_addr_offset = sizeof(dl_unitdata_ind_t);
    dlu->dl_group_address = 0;

    dh->b_cont = mp;
    return (dh);
}

/*
 * For any recognized promiscuous streams, send data upstream
 */
static void
promisc_sendup(ppa, mp, proto, skip)
    upperstr_t *ppa;
    mblk_t *mp;
    int proto, skip;
{
    mblk_t *dup_mp, *dup_dup_mp;
    upperstr_t *prus, *nprus;

    if ((prus = find_promisc(ppa, proto)) != 0) {
	if (dup_mp = dupmsg(mp)) {

	    if (skip)
		dup_mp->b_rptr += PPP_HDRLEN;

	    for ( ; nprus = find_promisc(prus->next, proto); 
		    prus = nprus) {

		if (dup_dup_mp = dupmsg(dup_mp)) {
		    if (canputnext(prus->q)) {
			if (prus->flags & US_RAWDATA) {
			    dup_dup_mp = prepend_ether(prus, dup_dup_mp, proto);
			    putnext(prus->q, dup_dup_mp);
			} else {
			    dup_dup_mp = prepend_udind(prus, dup_dup_mp, proto);
			    putnext(prus->q, dup_dup_mp);
			}
		    } else {
			DPRINT("ppp_urput: data to promisc q dropped\n");
			freemsg(dup_dup_mp);
		    }
		}
	    }

	    if (canputnext(prus->q)) {
		if (prus->flags & US_RAWDATA) {
		    dup_mp = prepend_ether(prus, dup_mp, proto);
		    putnext(prus->q, dup_mp);
		} else {
		    dup_mp = prepend_udind(prus, dup_mp, proto);
		    putnext(prus->q, dup_mp);
		}
	    } else {
		DPRINT("ppp_urput: data to promisc q dropped\n");
		freemsg(dup_mp);
	    }
	}
    }
}
#endif /* defined(SOL2) */

/*
 * We simply put the message on to the associated upper control stream
 * (either here or in ppplrsrv).  That way we enter the perimeters
 * before looking through the list of attached streams to decide which
 * stream it should go up.
 */
static int
ppplrput(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    queue_t *uq;
    struct iocblk *iop;

    switch (mp->b_datap->db_type) {
    case M_IOCTL:
	iop = (struct iocblk *) mp->b_rptr;
	iop->ioc_error = EINVAL;
	mp->b_datap->db_type = M_IOCNAK;
	qreply(q, mp);
	return 0;
    case M_FLUSH:
	if (*mp->b_rptr & FLUSHR)
	    flushq(q, FLUSHDATA);
	if (*mp->b_rptr & FLUSHW) {
	    *mp->b_rptr &= ~FLUSHR;
	    qreply(q, mp);
	} else
	    freemsg(mp);
	return 0;
    }

    /*
     * If we can't get the lower lock straight away, queue this one
     * rather than blocking, to avoid the possibility of deadlock.
     */
    if (!TRYLOCK_LOWER_R) {
	putq(q, mp);
	return 0;
    }

    /*
     * Check that we're still connected to the driver.
     */
    uq = (queue_t *) q->q_ptr;
    if (uq == 0) {
	UNLOCK_LOWER;
	DPRINT1("ppplrput: q = %x, uq = 0??\n", q);
	freemsg(mp);
	return 0;
    }

    /*
     * Try to forward the message to the put routine for the upper
     * control stream for this lower stream.
     * If there are already messages queued here, queue this one so
     * they don't get out of order.
     */
    if (queclass(mp) == QPCTL || (qsize(q) == 0 && canput(uq)))
	put(uq, mp);
    else
	putq(q, mp);

    UNLOCK_LOWER;
    return 0;
}

static int
ppplrsrv(q)
    queue_t *q;
{
    mblk_t *mp;
    queue_t *uq;

    /*
     * Packets get queued here for flow control reasons
     * or if the lrput routine couldn't get the lower lock
     * without blocking.
     */
    LOCK_LOWER_R;
    uq = (queue_t *) q->q_ptr;
    if (uq == 0) {
	UNLOCK_LOWER;
	flushq(q, FLUSHALL);
	DPRINT1("ppplrsrv: q = %x, uq = 0??\n", q);
	return 0;
    }
    while ((mp = getq(q)) != 0) {
	if (queclass(mp) == QPCTL || canput(uq))
	    put(uq, mp);
	else {
	    putbq(q, mp);
	    break;
	}
    }
    UNLOCK_LOWER;
    return 0;
}

static int
putctl2(q, type, code, val)
    queue_t *q;
    int type, code, val;
{
    mblk_t *mp;

    mp = allocb(2, BPRI_HI);
    if (mp == 0)
	return 0;
    mp->b_datap->db_type = type;
    mp->b_wptr[0] = code;
    mp->b_wptr[1] = val;
    mp->b_wptr += 2;
    putnext(q, mp);
    return 1;
}

static int
putctl4(q, type, code, val)
    queue_t *q;
    int type, code, val;
{
    mblk_t *mp;

    mp = allocb(4, BPRI_HI);
    if (mp == 0)
	return 0;
    mp->b_datap->db_type = type;
    mp->b_wptr[0] = code;
    ((short *)mp->b_wptr)[1] = val;
    mp->b_wptr += 4;
    putnext(q, mp);
    return 1;
}

static void
debug_dump(q, mp)
    queue_t *q;
    mblk_t *mp;
{
    upperstr_t *us;
    queue_t *uq, *lq;

    DPRINT("ppp upper streams:\n");
    for (us = minor_devs; us != 0; us = us->nextmn) {
	uq = us->q;
	DPRINT3(" %d: q=%x rlev=%d",
		us->mn, uq, (uq? qsize(uq): 0));
	DPRINT3(" wlev=%d flags=0x%b", (uq? qsize(WR(uq)): 0),
		us->flags, "\020\1priv\2control\3blocked\4last");
	DPRINT3(" state=%x sap=%x req_sap=%x", us->state, us->sap,
		us->req_sap);
	if (us->ppa == 0)
	    DPRINT(" ppa=?\n");
	else
	    DPRINT1(" ppa=%d\n", us->ppa->ppa_id);
	if (us->flags & US_CONTROL) {
	    lq = us->lowerq;
	    DPRINT3("    control for %d lq=%x rlev=%d",
		    us->ppa_id, lq, (lq? qsize(RD(lq)): 0));
	    DPRINT3(" wlev=%d mru=%d mtu=%d\n",
		    (lq? qsize(lq): 0), us->mru, us->mtu);
	}
    }
    mp->b_datap->db_type = M_IOCACK;
    qreply(q, mp);
}

#ifdef FILTER_PACKETS
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/udp.h>
#include <netinet/tcp.h>

#define MAX_IPHDR    128     /* max TCP/IP header size */


/* The following table contains a hard-coded list of protocol/port pairs.
 * Any matching packets are either discarded unconditionally, or, 
 * if ok_if_link_up is non-zero when a connection does not currently exist
 * (i.e., they go through if the connection is present, but never initiate
 * a dial-out).
 * This idea came from a post by dm@garage.uun.org (David Mazieres)
 */
static struct pktfilt_tab { 
	int proto; 
	u_short port; 
	u_short ok_if_link_up; 
} pktfilt_tab[] = {
	{ IPPROTO_UDP,	520,	1 },	/* RIP, ok to pass if link is up */
	{ IPPROTO_UDP,	123,	1 },	/* NTP, don't keep up the link for it */
	{ -1, 		0,	0 }	/* terminator entry has port == -1 */
};


static int
ip_hard_filter(us, mp, outbound)
    upperstr_t *us;
    mblk_t *mp;
    int outbound;
{
    struct ip *ip;
    struct pktfilt_tab *pft;
    mblk_t *temp_mp;
    int proto;
    int len, hlen;


    /* Note, the PPP header has already been pulled up in all cases */
    proto = PPP_PROTOCOL(mp->b_rptr);
    if (us->flags & US_DBGLOG)
        DPRINT3("ppp/%d: filter, proto=0x%x, out=%d\n", us->mn, proto, outbound);

    switch (proto)
    {
    case PPP_IP:
	if ((mp->b_wptr - mp->b_rptr) == PPP_HDRLEN && mp->b_cont != 0) {
	    temp_mp = mp->b_cont;
    	    len = msgdsize(temp_mp);
	    hlen = (len < MAX_IPHDR) ? len : MAX_IPHDR;
	    PULLUP(temp_mp, hlen);
	    if (temp_mp == 0) {
		DPRINT2("ppp/%d: filter, pullup next failed, len=%d\n", 
			us->mn, hlen);
		mp->b_cont = 0;		/* PULLUP() freed the rest */
	        freemsg(mp);
	        return 0;
	    }
	    ip = (struct ip *)mp->b_cont->b_rptr;
	}
	else {
	    len = msgdsize(mp);
	    hlen = (len < (PPP_HDRLEN+MAX_IPHDR)) ? len : (PPP_HDRLEN+MAX_IPHDR);
	    PULLUP(mp, hlen);
	    if (mp == 0) {
		DPRINT2("ppp/%d: filter, pullup failed, len=%d\n", 
			us->mn, hlen);
	        return 0;
	    }
	    ip = (struct ip *)(mp->b_rptr + PPP_HDRLEN);
	}

	/* For IP traffic, certain packets (e.g., RIP) may be either
	 *   1.  ignored - dropped completely
	 *   2.  will not initiate a connection, but
	 *       will be passed if a connection is currently up.
	 */
	for (pft=pktfilt_tab; pft->proto != -1; pft++) {
	    if (ip->ip_p == pft->proto) {
		switch(pft->proto) {
		case IPPROTO_UDP:
		    if (((struct udphdr *) &((int *)ip)[ip->ip_hl])->uh_dport
				== htons(pft->port)) goto endfor;
		    break;
		case IPPROTO_TCP:
		    if (((struct tcphdr *) &((int *)ip)[ip->ip_hl])->th_dport
				== htons(pft->port)) goto endfor;
		    break;
		}	
	    }
	}
	endfor:
	if (pft->proto != -1) {
	    if (us->flags & US_DBGLOG)
		DPRINT3("ppp/%d: found IP pkt, proto=0x%x (%d)\n", 
				us->mn, pft->proto, pft->port);
	    /* Discard if not connected, or if not pass_with_link_up */
	    /* else, if link is up let go by, but don't update time */
	    return pft->ok_if_link_up? -1: 0;
	}
        break;
    } /* end switch (proto) */

    return 1;
}
#endif /* FILTER_PACKETS */