xref: /netbsd-src/sys/net/if_ppp.c (revision 2c6fc41c810f5088457889d00eba558e8bc74d9e)
1 /*	$NetBSD: if_ppp.c,v 1.143 2014/05/17 14:51:09 rmind Exp $	*/
2 /*	Id: if_ppp.c,v 1.6 1997/03/04 03:33:00 paulus Exp 	*/
3 
4 /*
5  * if_ppp.c - Point-to-Point Protocol (PPP) Asynchronous driver.
6  *
7  * Copyright (c) 1984-2000 Carnegie Mellon University. All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  *
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  *
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in
18  *    the documentation and/or other materials provided with the
19  *    distribution.
20  *
21  * 3. The name "Carnegie Mellon University" must not be used to
22  *    endorse or promote products derived from this software without
23  *    prior written permission. For permission or any legal
24  *    details, please contact
25  *      Office of Technology Transfer
26  *      Carnegie Mellon University
27  *      5000 Forbes Avenue
28  *      Pittsburgh, PA  15213-3890
29  *      (412) 268-4387, fax: (412) 268-7395
30  *      tech-transfer@andrew.cmu.edu
31  *
32  * 4. Redistributions of any form whatsoever must retain the following
33  *    acknowledgment:
34  *    "This product includes software developed by Computing Services
35  *     at Carnegie Mellon University (http://www.cmu.edu/computing/)."
36  *
37  * CARNEGIE MELLON UNIVERSITY DISCLAIMS ALL WARRANTIES WITH REGARD TO
38  * THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
39  * AND FITNESS, IN NO EVENT SHALL CARNEGIE MELLON UNIVERSITY BE LIABLE
40  * FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
41  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN
42  * AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING
43  * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
44  *
45  * Based on:
46  *	@(#)if_sl.c	7.6.1.2 (Berkeley) 2/15/89
47  *
48  * Copyright (c) 1987 Regents of the University of California.
49  * All rights reserved.
50  *
51  * Redistribution and use in source and binary forms are permitted
52  * provided that the above copyright notice and this paragraph are
53  * duplicated in all such forms and that any documentation,
54  * advertising materials, and other materials related to such
55  * distribution and use acknowledge that the software was developed
56  * by the University of California, Berkeley.  The name of the
57  * University may not be used to endorse or promote products derived
58  * from this software without specific prior written permission.
59  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
60  * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
61  * WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.
62  *
63  * Serial Line interface
64  *
65  * Rick Adams
66  * Center for Seismic Studies
67  * 1300 N 17th Street, Suite 1450
68  * Arlington, Virginia 22209
69  * (703)276-7900
70  * rick@seismo.ARPA
71  * seismo!rick
72  *
73  * Pounded on heavily by Chris Torek (chris@mimsy.umd.edu, umcp-cs!chris).
74  * Converted to 4.3BSD Beta by Chris Torek.
75  * Other changes made at Berkeley, based in part on code by Kirk Smith.
76  *
77  * Converted to 4.3BSD+ 386BSD by Brad Parker (brad@cayman.com)
78  * Added VJ tcp header compression; more unified ioctls
79  *
80  * Extensively modified by Paul Mackerras (paulus@cs.anu.edu.au).
81  * Cleaned up a lot of the mbuf-related code to fix bugs that
82  * caused system crashes and packet corruption.  Changed pppstart
83  * so that it doesn't just give up with a collision if the whole
84  * packet doesn't fit in the output ring buffer.
85  *
86  * Added priority queueing for interactive IP packets, following
87  * the model of if_sl.c, plus hooks for bpf.
88  * Paul Mackerras (paulus@cs.anu.edu.au).
89  */
90 
91 /* from if_sl.c,v 1.11 84/10/04 12:54:47 rick Exp */
92 /* from NetBSD: if_ppp.c,v 1.15.2.2 1994/07/28 05:17:58 cgd Exp */
93 
94 /*
95  * XXX IMP ME HARDER
96  *
97  * This is an explanation of that comment.  This code used to use
98  * splimp() to block both network and tty interrupts.  However,
99  * that call is deprecated.  So, we have replaced the uses of
100  * splimp() with splhigh() in order to applomplish what it needs
101  * to accomplish, and added that happy little comment.
102  */
103 
104 #include <sys/cdefs.h>
105 __KERNEL_RCSID(0, "$NetBSD: if_ppp.c,v 1.143 2014/05/17 14:51:09 rmind Exp $");
106 
107 #include "ppp.h"
108 
109 #include "opt_inet.h"
110 #include "opt_gateway.h"
111 #include "opt_ppp.h"
112 
113 #ifdef INET
114 #define VJC
115 #endif
116 #define PPP_COMPRESS
117 
118 #include <sys/param.h>
119 #include <sys/proc.h>
120 #include <sys/mbuf.h>
121 #include <sys/socket.h>
122 #include <sys/ioctl.h>
123 #include <sys/kernel.h>
124 #include <sys/systm.h>
125 #include <sys/time.h>
126 #include <sys/malloc.h>
127 #include <sys/module.h>
128 #include <sys/mutex.h>
129 #include <sys/once.h>
130 #include <sys/conf.h>
131 #include <sys/kauth.h>
132 #include <sys/intr.h>
133 #include <sys/socketvar.h>
134 
135 #include <net/if.h>
136 #include <net/if_types.h>
137 #include <net/netisr.h>
138 #include <net/route.h>
139 #ifdef PPP_FILTER
140 #include <net/bpf.h>
141 #endif
142 
143 #include <netinet/in.h>
144 #include <netinet/in_systm.h>
145 #include <netinet/in_var.h>
146 #ifdef INET
147 #include <netinet/ip.h>
148 #endif
149 
150 #include <net/bpf.h>
151 
152 #include <net/slip.h>
153 
154 #ifdef VJC
155 #include <net/slcompress.h>
156 #endif
157 
158 #include <net/ppp_defs.h>
159 #include <net/if_ppp.h>
160 #include <net/if_pppvar.h>
161 #include <sys/cpu.h>
162 
163 #ifdef PPP_COMPRESS
164 #define PACKETPTR	struct mbuf *
165 #include <net/ppp-comp.h>
166 #endif
167 
168 static int	pppsioctl(struct ifnet *, u_long, void *);
169 static void	ppp_requeue(struct ppp_softc *);
170 static void	ppp_ccp(struct ppp_softc *, struct mbuf *m, int rcvd);
171 static void	ppp_ccp_closed(struct ppp_softc *);
172 static void	ppp_inproc(struct ppp_softc *, struct mbuf *);
173 static void	pppdumpm(struct mbuf *m0);
174 #ifdef ALTQ
175 static void	ppp_ifstart(struct ifnet *ifp);
176 #endif
177 
178 static void	pppintr(void *);
179 
180 /*
181  * Some useful mbuf macros not in mbuf.h.
182  */
183 #define M_IS_CLUSTER(m)	((m)->m_flags & M_EXT)
184 
185 #define M_DATASTART(m)	\
186 	(M_IS_CLUSTER(m) ? (m)->m_ext.ext_buf : \
187 	    (m)->m_flags & M_PKTHDR ? (m)->m_pktdat : (m)->m_dat)
188 
189 #define M_DATASIZE(m)	\
190 	(M_IS_CLUSTER(m) ? (m)->m_ext.ext_size : \
191 	    (m)->m_flags & M_PKTHDR ? MHLEN: MLEN)
192 
193 /*
194  * We define two link layer specific mbuf flags, to mark high-priority
195  * packets for output, and received packets following lost/corrupted
196  * packets.
197  */
198 #define	M_HIGHPRI	M_LINK0	/* output packet for sc_fastq */
199 #define	M_ERRMARK	M_LINK1	/* rx packet following lost/corrupted pkt */
200 
201 static int		ppp_clone_create(struct if_clone *, int);
202 static int		ppp_clone_destroy(struct ifnet *);
203 
204 static struct ppp_softc *ppp_create(const char *, int);
205 
206 static LIST_HEAD(, ppp_softc) ppp_softc_list;
207 static kmutex_t ppp_list_lock;
208 
209 struct if_clone ppp_cloner =
210     IF_CLONE_INITIALIZER("ppp", ppp_clone_create, ppp_clone_destroy);
211 
212 #ifdef PPP_COMPRESS
213 ONCE_DECL(ppp_compressor_mtx_init);
214 static LIST_HEAD(, compressor) ppp_compressors = { NULL };
215 static kmutex_t ppp_compressors_mtx;
216 
217 static int ppp_compressor_init(void);
218 static struct compressor *ppp_get_compressor(uint8_t);
219 static void ppp_compressor_rele(struct compressor *);
220 #endif /* PPP_COMPRESS */
221 
222 
223 /*
224  * Called from boot code to establish ppp interfaces.
225  */
226 void
227 pppattach(void)
228 {
229     extern struct linesw ppp_disc;
230 
231     if (ttyldisc_attach(&ppp_disc) != 0)
232     	panic("pppattach");
233 
234     mutex_init(&ppp_list_lock, MUTEX_DEFAULT, IPL_NONE);
235     LIST_INIT(&ppp_softc_list);
236     if_clone_attach(&ppp_cloner);
237     RUN_ONCE(&ppp_compressor_mtx_init, ppp_compressor_init);
238 }
239 
240 static struct ppp_softc *
241 ppp_create(const char *name, int unit)
242 {
243     struct ppp_softc *sc, *sci, *scl = NULL;
244 
245     sc = malloc(sizeof(*sc), M_DEVBUF, M_WAIT|M_ZERO);
246 
247     mutex_enter(&ppp_list_lock);
248     if (unit == -1) {
249 	int i = 0;
250 	LIST_FOREACH(sci, &ppp_softc_list, sc_iflist) {
251 	    scl = sci;
252 	    if (i < sci->sc_unit) {
253 		unit = i;
254 		break;
255 	    } else {
256 #ifdef DIAGNOSTIC
257 		KASSERT(i == sci->sc_unit);
258 #endif
259 		i++;
260 	    }
261 	}
262 	if (unit == -1)
263 	    unit = i;
264     } else {
265 	LIST_FOREACH(sci, &ppp_softc_list, sc_iflist) {
266 	    scl = sci;
267 	    if (unit < sci->sc_unit)
268 		break;
269 	    else if (unit == sci->sc_unit) {
270 		free(sc, M_DEVBUF);
271 		return NULL;
272 	    }
273 	}
274     }
275 
276     if (sci != NULL)
277 	LIST_INSERT_BEFORE(sci, sc, sc_iflist);
278     else if (scl != NULL)
279 	LIST_INSERT_AFTER(scl, sc, sc_iflist);
280     else
281 	LIST_INSERT_HEAD(&ppp_softc_list, sc, sc_iflist);
282 
283     mutex_exit(&ppp_list_lock);
284 
285     if_initname(&sc->sc_if, name, sc->sc_unit = unit);
286     callout_init(&sc->sc_timo_ch, 0);
287     sc->sc_if.if_softc = sc;
288     sc->sc_if.if_mtu = PPP_MTU;
289     sc->sc_if.if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
290     sc->sc_if.if_type = IFT_PPP;
291     sc->sc_if.if_hdrlen = PPP_HDRLEN;
292     sc->sc_if.if_dlt = DLT_NULL;
293     sc->sc_if.if_ioctl = pppsioctl;
294     sc->sc_if.if_output = pppoutput;
295 #ifdef ALTQ
296     sc->sc_if.if_start = ppp_ifstart;
297 #endif
298     IFQ_SET_MAXLEN(&sc->sc_if.if_snd, IFQ_MAXLEN);
299     sc->sc_inq.ifq_maxlen = IFQ_MAXLEN;
300     sc->sc_fastq.ifq_maxlen = IFQ_MAXLEN;
301     sc->sc_rawq.ifq_maxlen = IFQ_MAXLEN;
302     /* Ratio of 1:2 packets between the regular and the fast queue */
303     sc->sc_maxfastq = 2;
304     IFQ_SET_READY(&sc->sc_if.if_snd);
305     if_attach(&sc->sc_if);
306     if_alloc_sadl(&sc->sc_if);
307     bpf_attach(&sc->sc_if, DLT_NULL, 0);
308     return sc;
309 }
310 
311 static int
312 ppp_clone_create(struct if_clone *ifc, int unit)
313 {
314     return ppp_create(ifc->ifc_name, unit) == NULL ? EEXIST : 0;
315 }
316 
317 static int
318 ppp_clone_destroy(struct ifnet *ifp)
319 {
320     struct ppp_softc *sc = (struct ppp_softc *)ifp->if_softc;
321 
322     if (sc->sc_devp != NULL)
323 	return EBUSY; /* Not removing it */
324 
325     mutex_enter(&ppp_list_lock);
326     LIST_REMOVE(sc, sc_iflist);
327     mutex_exit(&ppp_list_lock);
328 
329     bpf_detach(ifp);
330     if_detach(ifp);
331 
332     free(sc, M_DEVBUF);
333     return 0;
334 }
335 
336 /*
337  * Allocate a ppp interface unit and initialize it.
338  */
339 struct ppp_softc *
340 pppalloc(pid_t pid)
341 {
342     struct ppp_softc *sc = NULL, *scf;
343     int i;
344 
345     mutex_enter(&ppp_list_lock);
346     LIST_FOREACH(scf, &ppp_softc_list, sc_iflist) {
347 	if (scf->sc_xfer == pid) {
348 	    scf->sc_xfer = 0;
349 	    mutex_exit(&ppp_list_lock);
350 	    return scf;
351 	}
352 	if (scf->sc_devp == NULL && sc == NULL)
353 	    sc = scf;
354     }
355     mutex_exit(&ppp_list_lock);
356 
357     if (sc == NULL)
358 	sc = ppp_create(ppp_cloner.ifc_name, -1);
359 
360     sc->sc_si = softint_establish(SOFTINT_NET, pppintr, sc);
361     if (sc->sc_si == NULL) {
362 	printf("%s: unable to establish softintr\n", sc->sc_if.if_xname);
363 	return (NULL);
364     }
365     sc->sc_flags = 0;
366     sc->sc_mru = PPP_MRU;
367     sc->sc_relinq = NULL;
368     (void)memset(&sc->sc_stats, 0, sizeof(sc->sc_stats));
369 #ifdef VJC
370     sc->sc_comp = malloc(sizeof(struct slcompress), M_DEVBUF, M_NOWAIT);
371     if (sc->sc_comp)
372 	sl_compress_init(sc->sc_comp);
373 #endif
374 #ifdef PPP_COMPRESS
375     sc->sc_xc_state = NULL;
376     sc->sc_rc_state = NULL;
377 #endif /* PPP_COMPRESS */
378     for (i = 0; i < NUM_NP; ++i)
379 	sc->sc_npmode[i] = NPMODE_ERROR;
380     sc->sc_npqueue = NULL;
381     sc->sc_npqtail = &sc->sc_npqueue;
382     sc->sc_last_sent = sc->sc_last_recv = time_second;
383 
384     return sc;
385 }
386 
387 /*
388  * Deallocate a ppp unit.  Must be called at splsoftnet or higher.
389  */
390 void
391 pppdealloc(struct ppp_softc *sc)
392 {
393     struct mbuf *m;
394 
395     softint_disestablish(sc->sc_si);
396     if_down(&sc->sc_if);
397     sc->sc_if.if_flags &= ~(IFF_UP|IFF_RUNNING);
398     sc->sc_devp = NULL;
399     sc->sc_xfer = 0;
400     for (;;) {
401 	IF_DEQUEUE(&sc->sc_rawq, m);
402 	if (m == NULL)
403 	    break;
404 	m_freem(m);
405     }
406     for (;;) {
407 	IF_DEQUEUE(&sc->sc_inq, m);
408 	if (m == NULL)
409 	    break;
410 	m_freem(m);
411     }
412     for (;;) {
413 	IF_DEQUEUE(&sc->sc_fastq, m);
414 	if (m == NULL)
415 	    break;
416 	m_freem(m);
417     }
418     while ((m = sc->sc_npqueue) != NULL) {
419 	sc->sc_npqueue = m->m_nextpkt;
420 	m_freem(m);
421     }
422     if (sc->sc_togo != NULL) {
423 	m_freem(sc->sc_togo);
424 	sc->sc_togo = NULL;
425     }
426 #ifdef PPP_COMPRESS
427     ppp_ccp_closed(sc);
428     sc->sc_xc_state = NULL;
429     sc->sc_rc_state = NULL;
430 #endif /* PPP_COMPRESS */
431 #ifdef PPP_FILTER
432     if (sc->sc_pass_filt_in.bf_insns != 0) {
433 	free(sc->sc_pass_filt_in.bf_insns, M_DEVBUF);
434 	sc->sc_pass_filt_in.bf_insns = 0;
435 	sc->sc_pass_filt_in.bf_len = 0;
436     }
437     if (sc->sc_pass_filt_out.bf_insns != 0) {
438 	free(sc->sc_pass_filt_out.bf_insns, M_DEVBUF);
439 	sc->sc_pass_filt_out.bf_insns = 0;
440 	sc->sc_pass_filt_out.bf_len = 0;
441     }
442     if (sc->sc_active_filt_in.bf_insns != 0) {
443 	free(sc->sc_active_filt_in.bf_insns, M_DEVBUF);
444 	sc->sc_active_filt_in.bf_insns = 0;
445 	sc->sc_active_filt_in.bf_len = 0;
446     }
447     if (sc->sc_active_filt_out.bf_insns != 0) {
448 	free(sc->sc_active_filt_out.bf_insns, M_DEVBUF);
449 	sc->sc_active_filt_out.bf_insns = 0;
450 	sc->sc_active_filt_out.bf_len = 0;
451     }
452 #endif /* PPP_FILTER */
453 #ifdef VJC
454     if (sc->sc_comp != 0) {
455 	free(sc->sc_comp, M_DEVBUF);
456 	sc->sc_comp = 0;
457     }
458 #endif
459     (void)ppp_clone_destroy(&sc->sc_if);
460 }
461 
462 /*
463  * Ioctl routine for generic ppp devices.
464  */
465 int
466 pppioctl(struct ppp_softc *sc, u_long cmd, void *data, int flag,
467     struct lwp *l)
468 {
469     int s, error, flags, mru, npx;
470     u_int nb;
471     struct ppp_option_data *odp;
472     struct compressor *cp;
473     struct npioctl *npi;
474     time_t t;
475 #ifdef PPP_FILTER
476     struct bpf_program *bp, *nbp;
477     struct bpf_insn *newcode, *oldcode;
478     int newcodelen;
479 #endif /* PPP_FILTER */
480 #ifdef	PPP_COMPRESS
481     u_char ccp_option[CCP_MAX_OPTION_LENGTH];
482 #endif
483 
484     switch (cmd) {
485     case PPPIOCSFLAGS:
486     case PPPIOCSMRU:
487     case PPPIOCSMAXCID:
488     case PPPIOCSCOMPRESS:
489     case PPPIOCSNPMODE:
490 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_INTERFACE,
491 	    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, &sc->sc_if, KAUTH_ARG(cmd),
492 	    NULL) != 0)
493 		return (EPERM);
494 	break;
495     case PPPIOCXFERUNIT:
496 	/* XXX: Why is this privileged?! */
497 	if (kauth_authorize_network(l->l_cred, KAUTH_NETWORK_INTERFACE,
498 	    KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, &sc->sc_if, KAUTH_ARG(cmd),
499 	    NULL) != 0)
500 		return (EPERM);
501 	break;
502     default:
503 	break;
504     }
505 
506     switch (cmd) {
507     case FIONREAD:
508 	*(int *)data = sc->sc_inq.ifq_len;
509 	break;
510 
511     case PPPIOCGUNIT:
512 	*(int *)data = sc->sc_unit;
513 	break;
514 
515     case PPPIOCGFLAGS:
516 	*(u_int *)data = sc->sc_flags;
517 	break;
518 
519     case PPPIOCGRAWIN:
520 	{
521 	    struct ppp_rawin *rwin = (struct ppp_rawin *)data;
522 	    u_char c, q = 0;
523 
524 	    for (c = sc->sc_rawin_start; c < sizeof(sc->sc_rawin.buf);)
525 		rwin->buf[q++] = sc->sc_rawin.buf[c++];
526 
527 	    for (c = 0; c < sc->sc_rawin_start;)
528 		rwin->buf[q++] = sc->sc_rawin.buf[c++];
529 
530 	    rwin->count = sc->sc_rawin.count;
531 	}
532 	break;
533 
534     case PPPIOCSFLAGS:
535 	flags = *(int *)data & SC_MASK;
536 	s = splsoftnet();
537 #ifdef PPP_COMPRESS
538 	if (sc->sc_flags & SC_CCP_OPEN && !(flags & SC_CCP_OPEN))
539 	    ppp_ccp_closed(sc);
540 #endif
541 	splhigh();	/* XXX IMP ME HARDER */
542 	sc->sc_flags = (sc->sc_flags & ~SC_MASK) | flags;
543 	splx(s);
544 	break;
545 
546     case PPPIOCSMRU:
547 	mru = *(int *)data;
548 	if (mru >= PPP_MINMRU && mru <= PPP_MAXMRU)
549 	    sc->sc_mru = mru;
550 	break;
551 
552     case PPPIOCGMRU:
553 	*(int *)data = sc->sc_mru;
554 	break;
555 
556 #ifdef VJC
557     case PPPIOCSMAXCID:
558 	if (sc->sc_comp) {
559 	    s = splsoftnet();
560 	    sl_compress_setup(sc->sc_comp, *(int *)data);
561 	    splx(s);
562 	}
563 	break;
564 #endif
565 
566     case PPPIOCXFERUNIT:
567 	sc->sc_xfer = l->l_proc->p_pid;
568 	break;
569 
570 #ifdef PPP_COMPRESS
571     case PPPIOCSCOMPRESS:
572 	odp = (struct ppp_option_data *) data;
573 	nb = odp->length;
574 	if (nb > sizeof(ccp_option))
575 	    nb = sizeof(ccp_option);
576 	if ((error = copyin(odp->ptr, ccp_option, nb)) != 0)
577 	    return (error);
578 	if (ccp_option[1] < 2)	/* preliminary check on the length byte */
579 	    return (EINVAL);
580 	cp = ppp_get_compressor(ccp_option[0]);
581 	if (cp == NULL) {
582 		if (sc->sc_flags & SC_DEBUG)
583 		    printf("%s: no compressor for [%x %x %x], %x\n",
584 			sc->sc_if.if_xname, ccp_option[0], ccp_option[1],
585 			ccp_option[2], nb);
586 		return (EINVAL);	/* no handler found */
587 	}
588 	/*
589 	 * Found a handler for the protocol - try to allocate
590 	 * a compressor or decompressor.
591 	 */
592 	error = 0;
593 	if (odp->transmit) {
594 	    s = splsoftnet();
595 	    if (sc->sc_xc_state != NULL) {
596 		(*sc->sc_xcomp->comp_free)(sc->sc_xc_state);
597 		ppp_compressor_rele(sc->sc_xcomp);
598 	    }
599 	    sc->sc_xcomp = cp;
600 	    sc->sc_xc_state = cp->comp_alloc(ccp_option, nb);
601 	    if (sc->sc_xc_state == NULL) {
602 		if (sc->sc_flags & SC_DEBUG)
603 		    printf("%s: comp_alloc failed\n",
604 			sc->sc_if.if_xname);
605 		error = ENOBUFS;
606 	    }
607 	    splhigh();	/* XXX IMP ME HARDER */
608 	    sc->sc_flags &= ~SC_COMP_RUN;
609 	    splx(s);
610 	} else {
611 	    s = splsoftnet();
612 	    if (sc->sc_rc_state != NULL) {
613 		(*sc->sc_rcomp->decomp_free)(sc->sc_rc_state);
614 		ppp_compressor_rele(sc->sc_rcomp);
615 	    }
616 	    sc->sc_rcomp = cp;
617 	    sc->sc_rc_state = cp->decomp_alloc(ccp_option, nb);
618 	    if (sc->sc_rc_state == NULL) {
619 		if (sc->sc_flags & SC_DEBUG)
620 		    printf("%s: decomp_alloc failed\n",
621 			sc->sc_if.if_xname);
622 		error = ENOBUFS;
623 	    }
624 	    splhigh();	/* XXX IMP ME HARDER */
625 	    sc->sc_flags &= ~SC_DECOMP_RUN;
626 	    splx(s);
627 	}
628 	return (error);
629 #endif /* PPP_COMPRESS */
630 
631     case PPPIOCGNPMODE:
632     case PPPIOCSNPMODE:
633 	npi = (struct npioctl *) data;
634 	switch (npi->protocol) {
635 	case PPP_IP:
636 	    npx = NP_IP;
637 	    break;
638 	case PPP_IPV6:
639 	    npx = NP_IPV6;
640 	    break;
641 	default:
642 	    return EINVAL;
643 	}
644 	if (cmd == PPPIOCGNPMODE) {
645 	    npi->mode = sc->sc_npmode[npx];
646 	} else {
647 	    if (npi->mode != sc->sc_npmode[npx]) {
648 		s = splnet();
649 		sc->sc_npmode[npx] = npi->mode;
650 		if (npi->mode != NPMODE_QUEUE) {
651 		    ppp_requeue(sc);
652 		    ppp_restart(sc);
653 		}
654 		splx(s);
655 	    }
656 	}
657 	break;
658 
659     case PPPIOCGIDLE:
660 	s = splsoftnet();
661 	t = time_second;
662 	((struct ppp_idle *)data)->xmit_idle = t - sc->sc_last_sent;
663 	((struct ppp_idle *)data)->recv_idle = t - sc->sc_last_recv;
664 	splx(s);
665 	break;
666 
667 #ifdef PPP_FILTER
668     case PPPIOCSPASS:
669     case PPPIOCSACTIVE:
670 	/* These are no longer supported. */
671 	return EOPNOTSUPP;
672 
673     case PPPIOCSIPASS:
674     case PPPIOCSOPASS:
675     case PPPIOCSIACTIVE:
676     case PPPIOCSOACTIVE:
677 	nbp = (struct bpf_program *) data;
678 	if ((unsigned) nbp->bf_len > BPF_MAXINSNS)
679 	    return EINVAL;
680 	newcodelen = nbp->bf_len * sizeof(struct bpf_insn);
681 	if (newcodelen != 0) {
682 	    newcode = malloc(newcodelen, M_DEVBUF, M_WAITOK);
683 	    /* WAITOK -- malloc() never fails. */
684 	    if ((error = copyin((void *)nbp->bf_insns, (void *)newcode,
685 			       newcodelen)) != 0) {
686 		free(newcode, M_DEVBUF);
687 		return error;
688 	    }
689 	    if (!bpf_validate(newcode, nbp->bf_len)) {
690 		free(newcode, M_DEVBUF);
691 		return EINVAL;
692 	    }
693 	} else
694 	    newcode = 0;
695 	switch (cmd) {
696 	case PPPIOCSIPASS:
697 	    bp = &sc->sc_pass_filt_in;
698 	    break;
699 
700 	case PPPIOCSOPASS:
701 	    bp = &sc->sc_pass_filt_out;
702 	    break;
703 
704 	case PPPIOCSIACTIVE:
705 	    bp = &sc->sc_active_filt_in;
706 	    break;
707 
708 	case PPPIOCSOACTIVE:
709 	    bp = &sc->sc_active_filt_out;
710 	    break;
711 	default:
712 	    free(newcode, M_DEVBUF);
713 	    return (EPASSTHROUGH);
714 	}
715 	oldcode = bp->bf_insns;
716 	s = splnet();
717 	bp->bf_len = nbp->bf_len;
718 	bp->bf_insns = newcode;
719 	splx(s);
720 	if (oldcode != 0)
721 	    free(oldcode, M_DEVBUF);
722 	break;
723 #endif /* PPP_FILTER */
724 
725     default:
726 	return (EPASSTHROUGH);
727     }
728     return (0);
729 }
730 
731 /*
732  * Process an ioctl request to the ppp network interface.
733  */
734 static int
735 pppsioctl(struct ifnet *ifp, u_long cmd, void *data)
736 {
737     struct ppp_softc *sc = ifp->if_softc;
738     struct ifaddr *ifa = (struct ifaddr *)data;
739     struct ifreq *ifr = (struct ifreq *)data;
740     struct ppp_stats *psp;
741 #ifdef	PPP_COMPRESS
742     struct ppp_comp_stats *pcp;
743 #endif
744     int s = splnet(), error = 0;
745 
746     switch (cmd) {
747     case SIOCSIFFLAGS:
748 	if ((error = ifioctl_common(ifp, cmd, data)) != 0)
749 		break;
750 	if ((ifp->if_flags & IFF_RUNNING) == 0)
751 	    ifp->if_flags &= ~IFF_UP;
752 	break;
753 
754     case SIOCINITIFADDR:
755 	switch (ifa->ifa_addr->sa_family) {
756 #ifdef INET
757 	case AF_INET:
758 	    break;
759 #endif
760 #ifdef INET6
761 	case AF_INET6:
762 	    break;
763 #endif
764 	default:
765 	    error = EAFNOSUPPORT;
766 	    break;
767 	}
768 	break;
769 
770     case SIOCADDMULTI:
771     case SIOCDELMULTI:
772 	if (ifr == NULL) {
773 	    error = EAFNOSUPPORT;
774 	    break;
775 	}
776 	switch (ifreq_getaddr(cmd, ifr)->sa_family) {
777 #ifdef INET
778 	case AF_INET:
779 	    break;
780 #endif
781 #ifdef INET6
782 	case AF_INET6:
783 	    break;
784 #endif
785 	default:
786 	    error = EAFNOSUPPORT;
787 	    break;
788 	}
789 	break;
790 
791     case SIOCGPPPSTATS:
792 	psp = &((struct ifpppstatsreq *) data)->stats;
793 	memset(psp, 0, sizeof(*psp));
794 	psp->p = sc->sc_stats;
795 #if defined(VJC) && !defined(SL_NO_STATS)
796 	if (sc->sc_comp) {
797 	    psp->vj.vjs_packets = sc->sc_comp->sls_packets;
798 	    psp->vj.vjs_compressed = sc->sc_comp->sls_compressed;
799 	    psp->vj.vjs_searches = sc->sc_comp->sls_searches;
800 	    psp->vj.vjs_misses = sc->sc_comp->sls_misses;
801 	    psp->vj.vjs_uncompressedin = sc->sc_comp->sls_uncompressedin;
802 	    psp->vj.vjs_compressedin = sc->sc_comp->sls_compressedin;
803 	    psp->vj.vjs_errorin = sc->sc_comp->sls_errorin;
804 	    psp->vj.vjs_tossed = sc->sc_comp->sls_tossed;
805 	}
806 #endif /* VJC */
807 	break;
808 
809 #ifdef PPP_COMPRESS
810     case SIOCGPPPCSTATS:
811 	pcp = &((struct ifpppcstatsreq *) data)->stats;
812 	memset(pcp, 0, sizeof(*pcp));
813 	if (sc->sc_xc_state != NULL)
814 	    (*sc->sc_xcomp->comp_stat)(sc->sc_xc_state, &pcp->c);
815 	if (sc->sc_rc_state != NULL)
816 	    (*sc->sc_rcomp->decomp_stat)(sc->sc_rc_state, &pcp->d);
817 	break;
818 #endif /* PPP_COMPRESS */
819 
820     default:
821 	if ((error = ifioctl_common(&sc->sc_if, cmd, data)) == ENETRESET)
822 		error = 0;
823 	break;
824     }
825     splx(s);
826     return (error);
827 }
828 
829 /*
830  * Queue a packet.  Start transmission if not active.
831  * Packet is placed in Information field of PPP frame.
832  */
833 int
834 pppoutput(struct ifnet *ifp, struct mbuf *m0, const struct sockaddr *dst,
835     struct rtentry *rtp)
836 {
837     struct ppp_softc *sc = ifp->if_softc;
838     int protocol, address, control;
839     u_char *cp;
840     int s, error;
841 #ifdef INET
842     struct ip *ip;
843 #endif
844     struct ifqueue *ifq;
845     enum NPmode mode;
846     int len;
847     ALTQ_DECL(struct altq_pktattr pktattr;)
848 
849     if (sc->sc_devp == NULL || (ifp->if_flags & IFF_RUNNING) == 0
850 	|| ((ifp->if_flags & IFF_UP) == 0 && dst->sa_family != AF_UNSPEC)) {
851 	error = ENETDOWN;	/* sort of */
852 	goto bad;
853     }
854 
855     IFQ_CLASSIFY(&ifp->if_snd, m0, dst->sa_family, &pktattr);
856 
857     /*
858      * Compute PPP header.
859      */
860     m0->m_flags &= ~M_HIGHPRI;
861     switch (dst->sa_family) {
862 #ifdef INET
863     case AF_INET:
864 	address = PPP_ALLSTATIONS;
865 	control = PPP_UI;
866 	protocol = PPP_IP;
867 	mode = sc->sc_npmode[NP_IP];
868 
869 	/*
870 	 * If this packet has the "low delay" bit set in the IP header,
871 	 * put it on the fastq instead.
872 	 */
873 	ip = mtod(m0, struct ip *);
874 	if (ip->ip_tos & IPTOS_LOWDELAY)
875 	    m0->m_flags |= M_HIGHPRI;
876 	break;
877 #endif
878 #ifdef INET6
879     case AF_INET6:
880 	address = PPP_ALLSTATIONS;	/*XXX*/
881 	control = PPP_UI;		/*XXX*/
882 	protocol = PPP_IPV6;
883 	mode = sc->sc_npmode[NP_IPV6];
884 
885 #if 0	/* XXX flowinfo/traffic class, maybe? */
886 	/*
887 	 * If this packet has the "low delay" bit set in the IP header,
888 	 * put it on the fastq instead.
889 	 */
890 	ip = mtod(m0, struct ip *);
891 	if (ip->ip_tos & IPTOS_LOWDELAY)
892 	    m0->m_flags |= M_HIGHPRI;
893 #endif
894 	break;
895 #endif
896     case AF_UNSPEC:
897 	address = PPP_ADDRESS(dst->sa_data);
898 	control = PPP_CONTROL(dst->sa_data);
899 	protocol = PPP_PROTOCOL(dst->sa_data);
900 	mode = NPMODE_PASS;
901 	break;
902     default:
903 	printf("%s: af%d not supported\n", ifp->if_xname, dst->sa_family);
904 	error = EAFNOSUPPORT;
905 	goto bad;
906     }
907 
908     /*
909      * Drop this packet, or return an error, if necessary.
910      */
911     if (mode == NPMODE_ERROR) {
912 	error = ENETDOWN;
913 	goto bad;
914     }
915     if (mode == NPMODE_DROP) {
916 	error = 0;
917 	goto bad;
918     }
919 
920     /*
921      * Add PPP header.
922      */
923     M_PREPEND(m0, PPP_HDRLEN, M_DONTWAIT);
924     if (m0 == NULL) {
925 	error = ENOBUFS;
926 	goto bad;
927     }
928 
929     cp = mtod(m0, u_char *);
930     *cp++ = address;
931     *cp++ = control;
932     *cp++ = protocol >> 8;
933     *cp++ = protocol & 0xff;
934 
935     len = m_length(m0);
936 
937     if (sc->sc_flags & SC_LOG_OUTPKT) {
938 	printf("%s output: ", ifp->if_xname);
939 	pppdumpm(m0);
940     }
941 
942     if ((protocol & 0x8000) == 0) {
943 #ifdef PPP_FILTER
944 	/*
945 	 * Apply the pass and active filters to the packet,
946 	 * but only if it is a data packet.
947 	 */
948 	if (sc->sc_pass_filt_out.bf_insns != 0
949 	    && bpf_filter(sc->sc_pass_filt_out.bf_insns,
950 			  (u_char *)m0, len, 0) == 0) {
951 	    error = 0;		/* drop this packet */
952 	    goto bad;
953 	}
954 
955 	/*
956 	 * Update the time we sent the most recent packet.
957 	 */
958 	if (sc->sc_active_filt_out.bf_insns == 0
959 	    || bpf_filter(sc->sc_active_filt_out.bf_insns,
960 			  (u_char *)m0, len, 0))
961 	    sc->sc_last_sent = time_second;
962 #else
963 	/*
964 	 * Update the time we sent the most recent packet.
965 	 */
966 	sc->sc_last_sent = time_second;
967 #endif /* PPP_FILTER */
968     }
969 
970     /*
971      * See if bpf wants to look at the packet.
972      */
973     bpf_mtap(&sc->sc_if, m0);
974 
975     /*
976      * Put the packet on the appropriate queue.
977      */
978     s = splnet();
979     if (mode == NPMODE_QUEUE) {
980 	/* XXX we should limit the number of packets on this queue */
981 	*sc->sc_npqtail = m0;
982 	m0->m_nextpkt = NULL;
983 	sc->sc_npqtail = &m0->m_nextpkt;
984     } else {
985 	ifq = (m0->m_flags & M_HIGHPRI) ? &sc->sc_fastq : NULL;
986 	if ((error = ifq_enqueue2(&sc->sc_if, ifq, m0
987 		ALTQ_COMMA ALTQ_DECL(&pktattr))) != 0) {
988 	    splx(s);
989 	    sc->sc_if.if_oerrors++;
990 	    sc->sc_stats.ppp_oerrors++;
991 	    return (error);
992 	}
993 	ppp_restart(sc);
994     }
995     ifp->if_opackets++;
996     ifp->if_obytes += len;
997 
998     splx(s);
999     return (0);
1000 
1001 bad:
1002     m_freem(m0);
1003     return (error);
1004 }
1005 
1006 /*
1007  * After a change in the NPmode for some NP, move packets from the
1008  * npqueue to the send queue or the fast queue as appropriate.
1009  * Should be called at splnet, since we muck with the queues.
1010  */
1011 static void
1012 ppp_requeue(struct ppp_softc *sc)
1013 {
1014     struct mbuf *m, **mpp;
1015     struct ifqueue *ifq;
1016     enum NPmode mode;
1017     int error;
1018 
1019     for (mpp = &sc->sc_npqueue; (m = *mpp) != NULL; ) {
1020 	switch (PPP_PROTOCOL(mtod(m, u_char *))) {
1021 	case PPP_IP:
1022 	    mode = sc->sc_npmode[NP_IP];
1023 	    break;
1024 	case PPP_IPV6:
1025 	    mode = sc->sc_npmode[NP_IPV6];
1026 	    break;
1027 	default:
1028 	    mode = NPMODE_PASS;
1029 	}
1030 
1031 	switch (mode) {
1032 	case NPMODE_PASS:
1033 	    /*
1034 	     * This packet can now go on one of the queues to be sent.
1035 	     */
1036 	    *mpp = m->m_nextpkt;
1037 	    m->m_nextpkt = NULL;
1038 	    ifq = (m->m_flags & M_HIGHPRI) ? &sc->sc_fastq : NULL;
1039 	    if ((error = ifq_enqueue2(&sc->sc_if, ifq, m ALTQ_COMMA
1040 		ALTQ_DECL(NULL))) != 0) {
1041 		sc->sc_if.if_oerrors++;
1042 		sc->sc_stats.ppp_oerrors++;
1043 	    }
1044 	    break;
1045 
1046 	case NPMODE_DROP:
1047 	case NPMODE_ERROR:
1048 	    *mpp = m->m_nextpkt;
1049 	    m_freem(m);
1050 	    break;
1051 
1052 	case NPMODE_QUEUE:
1053 	    mpp = &m->m_nextpkt;
1054 	    break;
1055 	}
1056     }
1057     sc->sc_npqtail = mpp;
1058 }
1059 
1060 /*
1061  * Transmitter has finished outputting some stuff;
1062  * remember to call sc->sc_start later at splsoftnet.
1063  */
1064 void
1065 ppp_restart(struct ppp_softc *sc)
1066 {
1067     int s = splhigh();	/* XXX IMP ME HARDER */
1068 
1069     sc->sc_flags &= ~SC_TBUSY;
1070     softint_schedule(sc->sc_si);
1071     splx(s);
1072 }
1073 
1074 /*
1075  * Get a packet to send.  This procedure is intended to be called at
1076  * splsoftnet, since it may involve time-consuming operations such as
1077  * applying VJ compression, packet compression, address/control and/or
1078  * protocol field compression to the packet.
1079  */
1080 struct mbuf *
1081 ppp_dequeue(struct ppp_softc *sc)
1082 {
1083     struct mbuf *m, *mp;
1084     u_char *cp;
1085     int address, control, protocol;
1086     int s;
1087 
1088     /*
1089      * Grab a packet to send: first try the fast queue, then the
1090      * normal queue.
1091      */
1092     s = splnet();
1093     if (sc->sc_nfastq < sc->sc_maxfastq) {
1094 	IF_DEQUEUE(&sc->sc_fastq, m);
1095 	if (m != NULL)
1096 	    sc->sc_nfastq++;
1097 	else
1098 	    IFQ_DEQUEUE(&sc->sc_if.if_snd, m);
1099     } else {
1100 	sc->sc_nfastq = 0;
1101 	IFQ_DEQUEUE(&sc->sc_if.if_snd, m);
1102 	if (m == NULL) {
1103 	    IF_DEQUEUE(&sc->sc_fastq, m);
1104 	    if (m != NULL)
1105 		sc->sc_nfastq++;
1106 	}
1107     }
1108     splx(s);
1109 
1110     if (m == NULL)
1111 	return NULL;
1112 
1113     ++sc->sc_stats.ppp_opackets;
1114 
1115     /*
1116      * Extract the ppp header of the new packet.
1117      * The ppp header will be in one mbuf.
1118      */
1119     cp = mtod(m, u_char *);
1120     address = PPP_ADDRESS(cp);
1121     control = PPP_CONTROL(cp);
1122     protocol = PPP_PROTOCOL(cp);
1123 
1124     switch (protocol) {
1125     case PPP_IP:
1126 #ifdef VJC
1127 	/*
1128 	 * If the packet is a TCP/IP packet, see if we can compress it.
1129 	 */
1130 	if ((sc->sc_flags & SC_COMP_TCP) && sc->sc_comp != NULL) {
1131 	    struct ip *ip;
1132 	    int type;
1133 
1134 	    mp = m;
1135 	    ip = (struct ip *) (cp + PPP_HDRLEN);
1136 	    if (mp->m_len <= PPP_HDRLEN) {
1137 		mp = mp->m_next;
1138 		if (mp == NULL)
1139 		    break;
1140 		ip = mtod(mp, struct ip *);
1141 	    }
1142 	    /* this code assumes the IP/TCP header is in one non-shared mbuf */
1143 	    if (ip->ip_p == IPPROTO_TCP) {
1144 		type = sl_compress_tcp(mp, ip, sc->sc_comp,
1145 				       !(sc->sc_flags & SC_NO_TCP_CCID));
1146 		switch (type) {
1147 		case TYPE_UNCOMPRESSED_TCP:
1148 		    protocol = PPP_VJC_UNCOMP;
1149 		    break;
1150 		case TYPE_COMPRESSED_TCP:
1151 		    protocol = PPP_VJC_COMP;
1152 		    cp = mtod(m, u_char *);
1153 		    cp[0] = address;	/* header has moved */
1154 		    cp[1] = control;
1155 		    cp[2] = 0;
1156 		    break;
1157 		}
1158 		cp[3] = protocol;	/* update protocol in PPP header */
1159 	    }
1160 	}
1161 #endif	/* VJC */
1162 	break;
1163 
1164 #ifdef PPP_COMPRESS
1165     case PPP_CCP:
1166 	ppp_ccp(sc, m, 0);
1167 	break;
1168 #endif	/* PPP_COMPRESS */
1169     }
1170 
1171 #ifdef PPP_COMPRESS
1172     if (protocol != PPP_LCP && protocol != PPP_CCP
1173 	&& sc->sc_xc_state && (sc->sc_flags & SC_COMP_RUN)) {
1174 	struct mbuf *mcomp = NULL;
1175 	int slen;
1176 
1177 	slen = 0;
1178 	for (mp = m; mp != NULL; mp = mp->m_next)
1179 	    slen += mp->m_len;
1180 	(*sc->sc_xcomp->compress)
1181 	    (sc->sc_xc_state, &mcomp, m, slen, sc->sc_if.if_mtu + PPP_HDRLEN);
1182 	if (mcomp != NULL) {
1183 	    if (sc->sc_flags & SC_CCP_UP) {
1184 		/* Send the compressed packet instead of the original. */
1185 		m_freem(m);
1186 		m = mcomp;
1187 		cp = mtod(m, u_char *);
1188 		protocol = cp[3];
1189 	    } else {
1190 		/* Can't transmit compressed packets until CCP is up. */
1191 		m_freem(mcomp);
1192 	    }
1193 	}
1194     }
1195 #endif	/* PPP_COMPRESS */
1196 
1197     /*
1198      * Compress the address/control and protocol, if possible.
1199      */
1200     if (sc->sc_flags & SC_COMP_AC && address == PPP_ALLSTATIONS &&
1201 	control == PPP_UI && protocol != PPP_ALLSTATIONS &&
1202 	protocol != PPP_LCP) {
1203 	/* can compress address/control */
1204 	m->m_data += 2;
1205 	m->m_len -= 2;
1206     }
1207     if (sc->sc_flags & SC_COMP_PROT && protocol < 0xFF) {
1208 	/* can compress protocol */
1209 	if (mtod(m, u_char *) == cp) {
1210 	    cp[2] = cp[1];	/* move address/control up */
1211 	    cp[1] = cp[0];
1212 	}
1213 	++m->m_data;
1214 	--m->m_len;
1215     }
1216 
1217     return m;
1218 }
1219 
1220 /*
1221  * Software interrupt routine, called at splsoftnet.
1222  */
1223 static void
1224 pppintr(void *arg)
1225 {
1226 	struct ppp_softc *sc = arg;
1227 	struct mbuf *m;
1228 	int s;
1229 
1230 	mutex_enter(softnet_lock);
1231 	if (!(sc->sc_flags & SC_TBUSY)
1232 	    && (IFQ_IS_EMPTY(&sc->sc_if.if_snd) == 0 || sc->sc_fastq.ifq_head
1233 		|| sc->sc_outm)) {
1234 		s = splhigh();	/* XXX IMP ME HARDER */
1235 		sc->sc_flags |= SC_TBUSY;
1236 		splx(s);
1237 		(*sc->sc_start)(sc);
1238 	}
1239 	for (;;) {
1240 		s = splnet();
1241 		IF_DEQUEUE(&sc->sc_rawq, m);
1242 		splx(s);
1243 		if (m == NULL)
1244 			break;
1245 		ppp_inproc(sc, m);
1246 	}
1247 	mutex_exit(softnet_lock);
1248 }
1249 
1250 #ifdef PPP_COMPRESS
1251 /*
1252  * Handle a CCP packet.  `rcvd' is 1 if the packet was received,
1253  * 0 if it is about to be transmitted.
1254  */
1255 static void
1256 ppp_ccp(struct ppp_softc *sc, struct mbuf *m, int rcvd)
1257 {
1258     u_char *dp, *ep;
1259     struct mbuf *mp;
1260     int slen, s;
1261 
1262     /*
1263      * Get a pointer to the data after the PPP header.
1264      */
1265     if (m->m_len <= PPP_HDRLEN) {
1266 	mp = m->m_next;
1267 	if (mp == NULL)
1268 	    return;
1269 	dp = mtod(mp, u_char *);
1270     } else {
1271 	mp = m;
1272 	dp = mtod(mp, u_char *) + PPP_HDRLEN;
1273     }
1274 
1275     ep = mtod(mp, u_char *) + mp->m_len;
1276     if (dp + CCP_HDRLEN > ep)
1277 	return;
1278     slen = CCP_LENGTH(dp);
1279     if (dp + slen > ep) {
1280 	if (sc->sc_flags & SC_DEBUG)
1281 	    printf("if_ppp/ccp: not enough data in mbuf (%p+%x > %p+%x)\n",
1282 		dp, slen, mtod(mp, u_char *), mp->m_len);
1283 	return;
1284     }
1285 
1286     switch (CCP_CODE(dp)) {
1287     case CCP_CONFREQ:
1288     case CCP_TERMREQ:
1289     case CCP_TERMACK:
1290 	/* CCP must be going down - disable compression */
1291 	if (sc->sc_flags & SC_CCP_UP) {
1292 	    s = splhigh();	/* XXX IMP ME HARDER */
1293 	    sc->sc_flags &= ~(SC_CCP_UP | SC_COMP_RUN | SC_DECOMP_RUN);
1294 	    splx(s);
1295 	}
1296 	break;
1297 
1298     case CCP_CONFACK:
1299 	if (sc->sc_flags & SC_CCP_OPEN && !(sc->sc_flags & SC_CCP_UP)
1300 	    && slen >= CCP_HDRLEN + CCP_OPT_MINLEN
1301 	    && slen >= CCP_OPT_LENGTH(dp + CCP_HDRLEN) + CCP_HDRLEN) {
1302 	    if (!rcvd) {
1303 		/* we're agreeing to send compressed packets. */
1304 		if (sc->sc_xc_state != NULL
1305 		    && (*sc->sc_xcomp->comp_init)
1306 			(sc->sc_xc_state, dp + CCP_HDRLEN, slen - CCP_HDRLEN,
1307 			 sc->sc_unit, 0, sc->sc_flags & SC_DEBUG)) {
1308 		    s = splhigh();	/* XXX IMP ME HARDER */
1309 		    sc->sc_flags |= SC_COMP_RUN;
1310 		    splx(s);
1311 		}
1312 	    } else {
1313 		/* peer is agreeing to send compressed packets. */
1314 		if (sc->sc_rc_state != NULL
1315 		    && (*sc->sc_rcomp->decomp_init)
1316 			(sc->sc_rc_state, dp + CCP_HDRLEN, slen - CCP_HDRLEN,
1317 			 sc->sc_unit, 0, sc->sc_mru,
1318 			 sc->sc_flags & SC_DEBUG)) {
1319 		    s = splhigh();	/* XXX IMP ME HARDER */
1320 		    sc->sc_flags |= SC_DECOMP_RUN;
1321 		    sc->sc_flags &= ~(SC_DC_ERROR | SC_DC_FERROR);
1322 		    splx(s);
1323 		}
1324 	    }
1325 	}
1326 	break;
1327 
1328     case CCP_RESETACK:
1329 	if (sc->sc_flags & SC_CCP_UP) {
1330 	    if (!rcvd) {
1331 		if (sc->sc_xc_state && (sc->sc_flags & SC_COMP_RUN))
1332 		    (*sc->sc_xcomp->comp_reset)(sc->sc_xc_state);
1333 	    } else {
1334 		if (sc->sc_rc_state && (sc->sc_flags & SC_DECOMP_RUN)) {
1335 		    (*sc->sc_rcomp->decomp_reset)(sc->sc_rc_state);
1336 		    s = splhigh();	/* XXX IMP ME HARDER */
1337 		    sc->sc_flags &= ~SC_DC_ERROR;
1338 		    splx(s);
1339 		}
1340 	    }
1341 	}
1342 	break;
1343     }
1344 }
1345 
1346 /*
1347  * CCP is down; free (de)compressor state if necessary.
1348  */
1349 static void
1350 ppp_ccp_closed(struct ppp_softc *sc)
1351 {
1352     if (sc->sc_xc_state) {
1353 	(*sc->sc_xcomp->comp_free)(sc->sc_xc_state);
1354 	ppp_compressor_rele(sc->sc_xcomp);
1355 	sc->sc_xc_state = NULL;
1356     }
1357     if (sc->sc_rc_state) {
1358 	(*sc->sc_rcomp->decomp_free)(sc->sc_rc_state);
1359 	ppp_compressor_rele(sc->sc_rcomp);
1360 	sc->sc_rc_state = NULL;
1361     }
1362 }
1363 #endif /* PPP_COMPRESS */
1364 
1365 /*
1366  * PPP packet input routine.
1367  * The caller has checked and removed the FCS and has inserted
1368  * the address/control bytes and the protocol high byte if they
1369  * were omitted.
1370  */
1371 void
1372 ppppktin(struct ppp_softc *sc, struct mbuf *m, int lost)
1373 {
1374     int s = splhigh();	/* XXX IMP ME HARDER */
1375 
1376     if (lost)
1377 	m->m_flags |= M_ERRMARK;
1378     IF_ENQUEUE(&sc->sc_rawq, m);
1379     softint_schedule(sc->sc_si);
1380     splx(s);
1381 }
1382 
1383 /*
1384  * Process a received PPP packet, doing decompression as necessary.
1385  * Should be called at splsoftnet.
1386  */
1387 #define COMPTYPE(proto)	((proto) == PPP_VJC_COMP? TYPE_COMPRESSED_TCP: \
1388 			 TYPE_UNCOMPRESSED_TCP)
1389 
1390 static void
1391 ppp_inproc(struct ppp_softc *sc, struct mbuf *m)
1392 {
1393     struct ifnet *ifp = &sc->sc_if;
1394     struct ifqueue *inq;
1395     int s, ilen, proto, rv;
1396     u_char *cp, adrs, ctrl;
1397     struct mbuf *mp, *dmp = NULL;
1398     int isr = 0;
1399 #ifdef VJC
1400     int xlen;
1401     u_char *iphdr;
1402     u_int hlen;
1403 #endif
1404 
1405     sc->sc_stats.ppp_ipackets++;
1406 
1407     if (sc->sc_flags & SC_LOG_INPKT) {
1408 	ilen = 0;
1409 	for (mp = m; mp != NULL; mp = mp->m_next)
1410 	    ilen += mp->m_len;
1411 	printf("%s: got %d bytes\n", ifp->if_xname, ilen);
1412 	pppdumpm(m);
1413     }
1414 
1415     cp = mtod(m, u_char *);
1416     adrs = PPP_ADDRESS(cp);
1417     ctrl = PPP_CONTROL(cp);
1418     proto = PPP_PROTOCOL(cp);
1419 
1420     if (m->m_flags & M_ERRMARK) {
1421 	m->m_flags &= ~M_ERRMARK;
1422 	s = splhigh();	/* XXX IMP ME HARDER */
1423 	sc->sc_flags |= SC_VJ_RESET;
1424 	splx(s);
1425     }
1426 
1427 #ifdef PPP_COMPRESS
1428     /*
1429      * Decompress this packet if necessary, update the receiver's
1430      * dictionary, or take appropriate action on a CCP packet.
1431      */
1432     if (proto == PPP_COMP && sc->sc_rc_state && (sc->sc_flags & SC_DECOMP_RUN)
1433 	&& !(sc->sc_flags & SC_DC_ERROR) && !(sc->sc_flags & SC_DC_FERROR)) {
1434 	/* decompress this packet */
1435 	rv = (*sc->sc_rcomp->decompress)(sc->sc_rc_state, m, &dmp);
1436 	if (rv == DECOMP_OK) {
1437 	    m_freem(m);
1438 	    if (dmp == NULL) {
1439 		/* no error, but no decompressed packet produced */
1440 		return;
1441 	    }
1442 	    m = dmp;
1443 	    cp = mtod(m, u_char *);
1444 	    proto = PPP_PROTOCOL(cp);
1445 
1446 	} else {
1447 	    /*
1448 	     * An error has occurred in decompression.
1449 	     * Pass the compressed packet up to pppd, which may take
1450 	     * CCP down or issue a Reset-Req.
1451 	     */
1452 	    if (sc->sc_flags & SC_DEBUG)
1453 		printf("%s: decompress failed %d\n", ifp->if_xname, rv);
1454 	    s = splhigh();	/* XXX IMP ME HARDER */
1455 	    sc->sc_flags |= SC_VJ_RESET;
1456 	    if (rv == DECOMP_ERROR)
1457 		sc->sc_flags |= SC_DC_ERROR;
1458 	    else
1459 		sc->sc_flags |= SC_DC_FERROR;
1460 	    splx(s);
1461 	}
1462 
1463     } else {
1464 	if (sc->sc_rc_state && (sc->sc_flags & SC_DECOMP_RUN)) {
1465 	    (*sc->sc_rcomp->incomp)(sc->sc_rc_state, m);
1466 	}
1467 	if (proto == PPP_CCP) {
1468 	    ppp_ccp(sc, m, 1);
1469 	}
1470     }
1471 #endif
1472 
1473     ilen = 0;
1474     for (mp = m; mp != NULL; mp = mp->m_next)
1475 	ilen += mp->m_len;
1476 
1477 #ifdef VJC
1478     if (sc->sc_flags & SC_VJ_RESET) {
1479 	/*
1480 	 * If we've missed a packet, we must toss subsequent compressed
1481 	 * packets which don't have an explicit connection ID.
1482 	 */
1483 	if (sc->sc_comp)
1484 	    sl_uncompress_tcp(NULL, 0, TYPE_ERROR, sc->sc_comp);
1485 	s = splhigh();	/* XXX IMP ME HARDER */
1486 	sc->sc_flags &= ~SC_VJ_RESET;
1487 	splx(s);
1488     }
1489 
1490     /*
1491      * See if we have a VJ-compressed packet to uncompress.
1492      */
1493     if (proto == PPP_VJC_COMP) {
1494 	if ((sc->sc_flags & SC_REJ_COMP_TCP) || sc->sc_comp == 0)
1495 	    goto bad;
1496 
1497 	xlen = sl_uncompress_tcp_core(cp + PPP_HDRLEN, m->m_len - PPP_HDRLEN,
1498 				      ilen - PPP_HDRLEN, TYPE_COMPRESSED_TCP,
1499 				      sc->sc_comp, &iphdr, &hlen);
1500 
1501 	if (xlen <= 0) {
1502 	    if (sc->sc_flags & SC_DEBUG)
1503 		printf("%s: VJ uncompress failed on type comp\n",
1504 		    ifp->if_xname);
1505 	    goto bad;
1506 	}
1507 
1508 	/* Copy the PPP and IP headers into a new mbuf. */
1509 	MGETHDR(mp, M_DONTWAIT, MT_DATA);
1510 	if (mp == NULL)
1511 	    goto bad;
1512 	mp->m_len = 0;
1513 	mp->m_next = NULL;
1514 	if (hlen + PPP_HDRLEN > MHLEN) {
1515 	    MCLGET(mp, M_DONTWAIT);
1516 	    if (M_TRAILINGSPACE(mp) < hlen + PPP_HDRLEN) {
1517 		m_freem(mp);
1518 		goto bad;	/* lose if big headers and no clusters */
1519 	    }
1520 	}
1521 	cp = mtod(mp, u_char *);
1522 	cp[0] = adrs;
1523 	cp[1] = ctrl;
1524 	cp[2] = 0;
1525 	cp[3] = PPP_IP;
1526 	proto = PPP_IP;
1527 	bcopy(iphdr, cp + PPP_HDRLEN, hlen);
1528 	mp->m_len = hlen + PPP_HDRLEN;
1529 
1530 	/*
1531 	 * Trim the PPP and VJ headers off the old mbuf
1532 	 * and stick the new and old mbufs together.
1533 	 */
1534 	m->m_data += PPP_HDRLEN + xlen;
1535 	m->m_len -= PPP_HDRLEN + xlen;
1536 	if (m->m_len <= M_TRAILINGSPACE(mp)) {
1537 	    bcopy(mtod(m, u_char *), mtod(mp, u_char *) + mp->m_len, m->m_len);
1538 	    mp->m_len += m->m_len;
1539 	    MFREE(m, mp->m_next);
1540 	} else
1541 	    mp->m_next = m;
1542 	m = mp;
1543 	ilen += hlen - xlen;
1544 
1545     } else if (proto == PPP_VJC_UNCOMP) {
1546 	if ((sc->sc_flags & SC_REJ_COMP_TCP) || sc->sc_comp == 0)
1547 	    goto bad;
1548 
1549 	xlen = sl_uncompress_tcp_core(cp + PPP_HDRLEN, m->m_len - PPP_HDRLEN,
1550 				      ilen - PPP_HDRLEN, TYPE_UNCOMPRESSED_TCP,
1551 				      sc->sc_comp, &iphdr, &hlen);
1552 
1553 	if (xlen < 0) {
1554 	    if (sc->sc_flags & SC_DEBUG)
1555 		printf("%s: VJ uncompress failed on type uncomp\n",
1556 		    ifp->if_xname);
1557 	    goto bad;
1558 	}
1559 
1560 	proto = PPP_IP;
1561 	cp[3] = PPP_IP;
1562     }
1563 #endif /* VJC */
1564 
1565     /*
1566      * If the packet will fit in a header mbuf, don't waste a
1567      * whole cluster on it.
1568      */
1569     if (ilen <= MHLEN && M_IS_CLUSTER(m)) {
1570 	MGETHDR(mp, M_DONTWAIT, MT_DATA);
1571 	if (mp != NULL) {
1572 	    m_copydata(m, 0, ilen, mtod(mp, void *));
1573 	    m_freem(m);
1574 	    m = mp;
1575 	    m->m_len = ilen;
1576 	}
1577     }
1578     m->m_pkthdr.len = ilen;
1579     m->m_pkthdr.rcvif = ifp;
1580 
1581     if ((proto & 0x8000) == 0) {
1582 #ifdef PPP_FILTER
1583 	/*
1584 	 * See whether we want to pass this packet, and
1585 	 * if it counts as link activity.
1586 	 */
1587 	if (sc->sc_pass_filt_in.bf_insns != 0
1588 	    && bpf_filter(sc->sc_pass_filt_in.bf_insns,
1589 			  (u_char *)m, ilen, 0) == 0) {
1590 	    /* drop this packet */
1591 	    m_freem(m);
1592 	    return;
1593 	}
1594 	if (sc->sc_active_filt_in.bf_insns == 0
1595 	    || bpf_filter(sc->sc_active_filt_in.bf_insns,
1596 			  (u_char *)m, ilen, 0))
1597 	    sc->sc_last_recv = time_second;
1598 #else
1599 	/*
1600 	 * Record the time that we received this packet.
1601 	 */
1602 	sc->sc_last_recv = time_second;
1603 #endif /* PPP_FILTER */
1604     }
1605 
1606     /* See if bpf wants to look at the packet. */
1607     bpf_mtap(&sc->sc_if, m);
1608 
1609     rv = 0;
1610     switch (proto) {
1611 #ifdef INET
1612     case PPP_IP:
1613 	/*
1614 	 * IP packet - take off the ppp header and pass it up to IP.
1615 	 */
1616 	if ((ifp->if_flags & IFF_UP) == 0
1617 	    || sc->sc_npmode[NP_IP] != NPMODE_PASS) {
1618 	    /* interface is down - drop the packet. */
1619 	    m_freem(m);
1620 	    return;
1621 	}
1622 	m->m_pkthdr.len -= PPP_HDRLEN;
1623 	m->m_data += PPP_HDRLEN;
1624 	m->m_len -= PPP_HDRLEN;
1625 #ifdef GATEWAY
1626 	if (ipflow_fastforward(m))
1627 		return;
1628 #endif
1629 	isr = NETISR_IP;
1630 	inq = &ipintrq;
1631 	break;
1632 #endif
1633 
1634 #ifdef INET6
1635     case PPP_IPV6:
1636 	/*
1637 	 * IPv6 packet - take off the ppp header and pass it up to IPv6.
1638 	 */
1639 	if ((ifp->if_flags & IFF_UP) == 0
1640 	    || sc->sc_npmode[NP_IPV6] != NPMODE_PASS) {
1641 	    /* interface is down - drop the packet. */
1642 	    m_freem(m);
1643 	    return;
1644 	}
1645 	m->m_pkthdr.len -= PPP_HDRLEN;
1646 	m->m_data += PPP_HDRLEN;
1647 	m->m_len -= PPP_HDRLEN;
1648 #ifdef GATEWAY
1649 	if (ip6flow_fastforward(&m))
1650 		return;
1651 #endif
1652 	isr = NETISR_IPV6;
1653 	inq = &ip6intrq;
1654 	break;
1655 #endif
1656 
1657     default:
1658 	/*
1659 	 * Some other protocol - place on input queue for read().
1660 	 */
1661 	inq = &sc->sc_inq;
1662 	rv = 1;
1663 	break;
1664     }
1665 
1666     /*
1667      * Put the packet on the appropriate input queue.
1668      */
1669     s = splnet();
1670     if (IF_QFULL(inq)) {
1671 	IF_DROP(inq);
1672 	splx(s);
1673 	if (sc->sc_flags & SC_DEBUG)
1674 	    printf("%s: input queue full\n", ifp->if_xname);
1675 	ifp->if_iqdrops++;
1676 	goto bad;
1677     }
1678     IF_ENQUEUE(inq, m);
1679     if (__predict_true(isr)) {
1680         schednetisr(isr);
1681     }
1682     splx(s);
1683     ifp->if_ipackets++;
1684     ifp->if_ibytes += ilen;
1685 
1686     if (rv)
1687 	(*sc->sc_ctlp)(sc);
1688 
1689     return;
1690 
1691  bad:
1692     m_freem(m);
1693     sc->sc_if.if_ierrors++;
1694     sc->sc_stats.ppp_ierrors++;
1695 }
1696 
1697 #define MAX_DUMP_BYTES	128
1698 
1699 static void
1700 pppdumpm(struct mbuf *m0)
1701 {
1702     char buf[3*MAX_DUMP_BYTES+4];
1703     char *bp = buf;
1704     struct mbuf *m;
1705 
1706     for (m = m0; m; m = m->m_next) {
1707 	int l = m->m_len;
1708 	u_char *rptr = (u_char *)m->m_data;
1709 
1710 	while (l--) {
1711 	    if (bp > buf + sizeof(buf) - 4)
1712 		goto done;
1713 	    *bp++ = hexdigits[*rptr >> 4]; /* convert byte to ascii hex */
1714 	    *bp++ = hexdigits[*rptr++ & 0xf];
1715 	}
1716 
1717 	if (m->m_next) {
1718 	    if (bp > buf + sizeof(buf) - 3)
1719 		goto done;
1720 	    *bp++ = '|';
1721 	} else
1722 	    *bp++ = ' ';
1723     }
1724 done:
1725     if (m)
1726 	*bp++ = '>';
1727     *bp = 0;
1728     printf("%s\n", buf);
1729 }
1730 
1731 #ifdef ALTQ
1732 /*
1733  * a wrapper to transmit a packet from if_start since ALTQ uses
1734  * if_start to send a packet.
1735  */
1736 static void
1737 ppp_ifstart(struct ifnet *ifp)
1738 {
1739 	struct ppp_softc *sc;
1740 
1741 	sc = ifp->if_softc;
1742 	(*sc->sc_start)(sc);
1743 }
1744 #endif
1745 
1746 static const struct ppp_known_compressor {
1747 	uint8_t code;
1748 	const char *module;
1749 } ppp_known_compressors[] = {
1750 	{ CI_DEFLATE, "ppp_deflate" },
1751 	{ CI_DEFLATE_DRAFT, "ppp_deflate" },
1752 	{ CI_BSD_COMPRESS, "ppp_bsdcomp" },
1753 	{ CI_MPPE, "ppp_mppe" },
1754 	{ 0, NULL }
1755 };
1756 
1757 static int
1758 ppp_compressor_init(void)
1759 {
1760 
1761 	mutex_init(&ppp_compressors_mtx, MUTEX_DEFAULT, IPL_NONE);
1762 	return 0;
1763 }
1764 
1765 static void
1766 ppp_compressor_rele(struct compressor *cp)
1767 {
1768 
1769 	mutex_enter(&ppp_compressors_mtx);
1770 	--cp->comp_refcnt;
1771 	mutex_exit(&ppp_compressors_mtx);
1772 }
1773 
1774 static struct compressor *
1775 ppp_get_compressor_noload(uint8_t ci, bool hold)
1776 {
1777 	struct compressor *cp;
1778 
1779 	KASSERT(mutex_owned(&ppp_compressors_mtx));
1780 	LIST_FOREACH(cp, &ppp_compressors, comp_list) {
1781 		if (cp->compress_proto == ci) {
1782 			if (hold)
1783 				++cp->comp_refcnt;
1784 			return cp;
1785 		}
1786 	}
1787 
1788 	return NULL;
1789 }
1790 
1791 static struct compressor *
1792 ppp_get_compressor(uint8_t ci)
1793 {
1794 	struct compressor *cp = NULL;
1795 	const struct ppp_known_compressor *pkc;
1796 
1797 	mutex_enter(&ppp_compressors_mtx);
1798 	cp = ppp_get_compressor_noload(ci, true);
1799 	mutex_exit(&ppp_compressors_mtx);
1800 	if (cp != NULL)
1801 		return cp;
1802 
1803 	kernconfig_lock();
1804 	mutex_enter(&ppp_compressors_mtx);
1805 	cp = ppp_get_compressor_noload(ci, true);
1806 	mutex_exit(&ppp_compressors_mtx);
1807 	if (cp == NULL) {
1808 		/* Not found, so try to autoload a module */
1809 		for (pkc = ppp_known_compressors; pkc->module != NULL; pkc++) {
1810 			if (pkc->code == ci) {
1811 				if (module_autoload(pkc->module,
1812 				    MODULE_CLASS_MISC) != 0)
1813 					break;
1814 				mutex_enter(&ppp_compressors_mtx);
1815 				cp = ppp_get_compressor_noload(ci, true);
1816 				mutex_exit(&ppp_compressors_mtx);
1817 				break;
1818 			}
1819 		}
1820 	}
1821 	kernconfig_unlock();
1822 
1823 	return cp;
1824 }
1825 
1826 int
1827 ppp_register_compressor(struct compressor *pc, size_t ncomp)
1828 {
1829 	int error = 0;
1830 	size_t i;
1831 
1832 	RUN_ONCE(&ppp_compressor_mtx_init, ppp_compressor_init);
1833 
1834 	mutex_enter(&ppp_compressors_mtx);
1835 	for (i = 0; i < ncomp; i++) {
1836 		if (ppp_get_compressor_noload(pc[i].compress_proto,
1837 		    false) != NULL)
1838 			error = EEXIST;
1839 	}
1840 	if (!error) {
1841 		for (i = 0; i < ncomp; i++) {
1842 			pc[i].comp_refcnt = 0;
1843 			LIST_INSERT_HEAD(&ppp_compressors, &pc[i], comp_list);
1844 		}
1845 	}
1846 	mutex_exit(&ppp_compressors_mtx);
1847 
1848 	return error;
1849 }
1850 
1851 int
1852 ppp_unregister_compressor(struct compressor *pc, size_t ncomp)
1853 {
1854 	int error = 0;
1855 	size_t i;
1856 
1857 	mutex_enter(&ppp_compressors_mtx);
1858 	for (i = 0; i < ncomp; i++) {
1859 		if (ppp_get_compressor_noload(pc[i].compress_proto,
1860 		    false) != &pc[i])
1861 			error = ENOENT;
1862 		else if (pc[i].comp_refcnt != 0)
1863 			error = EBUSY;
1864 	}
1865 	if (!error) {
1866 		for (i = 0; i < ncomp; i++) {
1867 			LIST_REMOVE(&pc[i], comp_list);
1868 		}
1869 	}
1870 	mutex_exit(&ppp_compressors_mtx);
1871 
1872 	return error;
1873 }
1874