Home | History | Annotate | Download | only in spppcomp
      1 /*
      2  * spppcomp.c - STREAMS module for kernel-level compression and CCP support.
      3  *
      4  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
      5  * Use is subject to license terms.
      6  *
      7  * Permission to use, copy, modify, and distribute this software and its
      8  * documentation is hereby granted, provided that the above copyright
      9  * notice appears in all copies.
     10  *
     11  * SUN MAKES NO REPRESENTATION OR WARRANTIES ABOUT THE SUITABILITY OF
     12  * THE SOFTWARE, EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
     13  * TO THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
     14  * PARTICULAR PURPOSE, OR NON-INFRINGEMENT.  SUN SHALL NOT BE LIABLE FOR
     15  * ANY DAMAGES SUFFERED BY LICENSEE AS A RESULT OF USING, MODIFYING OR
     16  * DISTRIBUTING THIS SOFTWARE OR ITS DERIVATIVES
     17  *
     18  * Copyright (c) 1994 The Australian National University.
     19  * All rights reserved.
     20  *
     21  * Permission to use, copy, modify, and distribute this software and its
     22  * documentation is hereby granted, provided that the above copyright
     23  * notice appears in all copies.  This software is provided without any
     24  * warranty, express or implied. The Australian National University
     25  * makes no representations about the suitability of this software for
     26  * any purpose.
     27  *
     28  * IN NO EVENT SHALL THE AUSTRALIAN NATIONAL UNIVERSITY BE LIABLE TO ANY
     29  * PARTY FOR DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
     30  * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN IF
     31  * THE AUSTRALIAN NATIONAL UNIVERSITY HAS BEEN ADVISED OF THE POSSIBILITY
     32  * OF SUCH DAMAGE.
     33  *
     34  * THE AUSTRALIAN NATIONAL UNIVERSITY SPECIFICALLY DISCLAIMS ANY WARRANTIES,
     35  * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
     36  * AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
     37  * ON AN "AS IS" BASIS, AND THE AUSTRALIAN NATIONAL UNIVERSITY HAS NO
     38  * OBLIGATION TO PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS,
     39  * OR MODIFICATIONS.
     40  *
     41  * This module is derived from the original SVR4 STREAMS PPP compression
     42  * module originally written by Paul Mackerras <paul.mackerras (at) cs.anu.edu.au>.
     43  *
     44  * James Carlson <james.d.carlson (at) sun.com> and Adi Masputra
     45  * <adi.masputra (at) sun.com> rewrote and restructured the code for improved
     46  * performance and scalability.
     47  */
     48 
     49 #define	RCSID	"$Id: spppcomp.c,v 1.0 2000/05/08 01:10:12 masputra Exp $"
     50 
     51 #include <sys/types.h>
     52 #include <sys/debug.h>
     53 #include <sys/param.h>
     54 #include <sys/stream.h>
     55 #include <sys/stropts.h>
     56 #include <sys/errno.h>
     57 #include <sys/conf.h>
     58 #include <sys/cpuvar.h>
     59 #include <sys/cmn_err.h>
     60 #include <sys/kmem.h>
     61 #include <sys/ddi.h>
     62 #include <sys/kstat.h>
     63 #include <sys/strsun.h>
     64 #include <sys/sysmacros.h>
     65 #include <netinet/in.h>
     66 #include <netinet/ip.h>
     67 #include <net/ppp_defs.h>
     68 #include <net/pppio.h>
     69 #include <net/vjcompress.h>
     70 
     71 /* Defined for platform-neutral include file */
     72 #define	PACKETPTR	mblk_t *
     73 #include <net/ppp-comp.h>
     74 
     75 #include "s_common.h"
     76 
     77 #ifdef DEBUG
     78 #define	SPC_DEBUG
     79 #endif
     80 #include "spppcomp.h"
     81 
     82 /*
     83  * This is used to tag official Solaris sources.  Please do not define
     84  * "INTERNAL_BUILD" when building this software outside of Sun
     85  * Microsystems.
     86  */
     87 #ifdef INTERNAL_BUILD
     88 /* MODINFO is limited to 32 characters. */
     89 const char spppcomp_module_description[] = "PPP 4.0 compression";
     90 #else /* INTERNAL_BUILD */
     91 const char spppcomp_module_description[] =
     92 	"ANU PPP compression $Revision: 1.16$ ";
     93 
     94 /* LINTED */
     95 static const char buildtime[] = "Built " __DATE__ " at " __TIME__
     96 #ifdef DEBUG
     97 " DEBUG"
     98 #endif
     99 "\n";
    100 #endif /* INTERNAL_BUILD */
    101 
    102 static int	spppcomp_open(queue_t *, dev_t *, int, int, cred_t *);
    103 static int	spppcomp_close(queue_t *, int, cred_t *);
    104 static void	spppcomp_rput(queue_t *, mblk_t *);
    105 static void	spppcomp_rsrv(queue_t *);
    106 static void	spppcomp_wput(queue_t *, mblk_t *);
    107 static void	spppcomp_wsrv(queue_t *);
    108 
    109 #define	PPPCOMP_MI_MINPSZ	(0)
    110 #define	PPPCOMP_MI_MAXPSZ	(INFPSZ)
    111 #define	PPPCOMP_MI_HIWAT	(PPP_MTU * 20)
    112 #define	PPPCOMP_MI_LOWAT	(PPP_MTU * 18)
    113 
    114 static struct module_info spppcomp_modinfo = {
    115 	COMP_MOD_ID,		/* mi_idnum */
    116 	COMP_MOD_NAME,		/* mi_idname */
    117 	PPPCOMP_MI_MINPSZ,	/* mi_minpsz */
    118 	PPPCOMP_MI_MAXPSZ,	/* mi_maxpsz */
    119 	PPPCOMP_MI_HIWAT,	/* mi_hiwat */
    120 	PPPCOMP_MI_LOWAT	/* mi_lowat */
    121 };
    122 
    123 static struct qinit spppcomp_rinit = {
    124 	(int (*)())spppcomp_rput, /* qi_putp */
    125 	(int (*)())spppcomp_rsrv, /* qi_srvp */
    126 	spppcomp_open,		/* qi_qopen */
    127 	spppcomp_close,		/* qi_qclose */
    128 	NULL,			/* qi_qadmin */
    129 	&spppcomp_modinfo,	/* qi_minfo */
    130 	NULL			/* qi_mstat */
    131 };
    132 
    133 static struct qinit spppcomp_winit = {
    134 	(int (*)())spppcomp_wput, /* qi_putp */
    135 	(int (*)())spppcomp_wsrv, /* qi_srvp */
    136 	NULL,			/* qi_qopen */
    137 	NULL,			/* qi_qclose */
    138 	NULL,			/* qi_qadmin */
    139 	&spppcomp_modinfo,	/* qi_minfo */
    140 	NULL			/* qi_mstat */
    141 };
    142 
    143 struct streamtab spppcomp_tab = {
    144 	&spppcomp_rinit,	/* st_rdinit */
    145 	&spppcomp_winit,	/* st_wrinit */
    146 	NULL,			/* st_muxrinit */
    147 	NULL			/* st_muxwinit */
    148 };
    149 
    150 /* Set non-zero to debug algorithm-specific problems alone. */
    151 #define	ALG_DEBUG	0
    152 
    153 #define	MAX_IPHLEN	(0x0f << 2)
    154 #define	MAX_TCPHLEN	(0x0f << 2)
    155 #define	MAX_TCPIPHLEN	(MAX_IPHLEN + MAX_TCPHLEN) /* max TCP/IP header size */
    156 #define	MAX_VJHDR	(20)		/* max VJ compressed header size (?) */
    157 
    158 #if 0
    159 #define	DBGSTART	CE_CONT, COMP_MOD_NAME "%d: "
    160 #define	CKDEBUG(x)	cmn_err x
    161 #else
    162 #define	DBGSTART	COMP_MOD_NAME "%d: "
    163 #define	CKDEBUG(x)	printf x
    164 #endif
    165 #define	CPDEBUG(x)	(IS_CP_KDEBUG(cp) ? CKDEBUG(x) : (void)0)
    166 
    167 /*
    168  * List of compressors we know about.
    169  */
    170 #if DO_BSD_COMPRESS
    171 extern struct compressor ppp_bsd_compress;
    172 #endif
    173 #if DO_DEFLATE
    174 extern struct compressor ppp_deflate;
    175 extern struct compressor ppp_deflate_draft;
    176 #endif
    177 
    178 struct compressor *ppp_compressors[] = {
    179 #if DO_BSD_COMPRESS
    180 	&ppp_bsd_compress,
    181 #endif
    182 #if DO_DEFLATE
    183 	&ppp_deflate,
    184 	&ppp_deflate_draft,
    185 #endif
    186 	NULL
    187 };
    188 
    189 /*
    190  * LCP_USE_DFLT() removed by James Carlson.  RFC 1661 section 6.6 has
    191  * this to say on the topic:
    192  *
    193  *    The Address and Control fields MUST NOT be compressed when sending
    194  *    any LCP packet.  This rule guarantees unambiguous recognition of
    195  *    LCP packets.
    196  */
    197 
    198 static void	spppcomp_ioctl(queue_t *, mblk_t *, sppp_comp_t *);
    199 static int	spppcomp_mctl(queue_t *, mblk_t *);
    200 static mblk_t	*spppcomp_outpkt(queue_t *, mblk_t *);
    201 static mblk_t	*spppcomp_inpkt(queue_t *, mblk_t *);
    202 static int	spppcomp_kstat_update(kstat_t *, int);
    203 static void	comp_ccp(queue_t *, mblk_t *, sppp_comp_t *, boolean_t);
    204 
    205 /*
    206  * Values for checking inter-arrival times on interrupt stacks.  These
    207  * are used to prevent CPU hogging in interrupt context.
    208  */
    209 #define	MIN_ARRIVAL_TIME	5000000	/* interarrival time in nanoseconds */
    210 #define	MAX_FAST_ARRIVALS	10	/* maximum packet count */
    211 hrtime_t spppcomp_min_arrival = MIN_ARRIVAL_TIME;
    212 
    213 static const char *kstats_names[] = {
    214 #ifdef SPCDEBUG_KSTATS_NAMES
    215 	SPPPCOMP_KSTATS_NAMES,
    216 	SPCDEBUG_KSTATS_NAMES
    217 #else
    218 	SPPPCOMP_KSTATS_NAMES
    219 #endif
    220 };
    221 static const char *kstats64_names[] = { SPPPCOMP_KSTATS64_NAMES };
    222 
    223 /*
    224  * spppcomp_open()
    225  *
    226  * MT-Perimeters:
    227  *    exclusive inner.
    228  *
    229  * Description:
    230  *    Common open procedure for module.
    231  */
    232 /* ARGSUSED */
    233 static int
    234 spppcomp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
    235 {
    236 	sppp_comp_t	*cp;
    237 
    238 	if (q->q_ptr != NULL) {
    239 		return (0);
    240 	}
    241 	if (sflag != MODOPEN) {
    242 		return (EINVAL);
    243 	}
    244 	cp = kmem_zalloc(sizeof (sppp_comp_t), KM_SLEEP);
    245 	q->q_ptr = WR(q)->q_ptr = (caddr_t)cp;
    246 
    247 	cp->cp_mru = PPP_MRU;
    248 	cp->cp_mtu = PPP_MTU;
    249 
    250 	mutex_init(&cp->cp_pair_lock, NULL, MUTEX_DRIVER, NULL);
    251 	vj_compress_init(&cp->cp_vj, -1);
    252 	cp->cp_nxslots = -1;
    253 	cp->cp_effort = -1;
    254 
    255 	qprocson(q);
    256 	return (0);
    257 }
    258 
    259 /*
    260  * spppcomp_close()
    261  *
    262  * MT-Perimeters:
    263  *    exclusive inner.
    264  *
    265  * Description:
    266  *    Common close procedure for module.
    267  */
    268 /* ARGSUSED */
    269 static int
    270 spppcomp_close(queue_t *q, int flag, cred_t *credp)
    271 {
    272 	sppp_comp_t	*cp = q->q_ptr;
    273 
    274 	qprocsoff(q);
    275 
    276 	CPDEBUG((DBGSTART "close flags=0x%b\n",
    277 	    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1), cp->cp_flags,
    278 	    CP_FLAGSSTR));
    279 	mutex_destroy(&cp->cp_pair_lock);
    280 	if (cp->cp_kstats) {
    281 		ASSERT(IS_CP_HASUNIT(cp));
    282 		kstat_delete(cp->cp_kstats);
    283 	}
    284 	if (cp->cp_xstate != NULL) {
    285 		(*cp->cp_xcomp->comp_free)(cp->cp_xstate);
    286 	}
    287 	if (cp->cp_rstate != NULL) {
    288 		(*cp->cp_rcomp->decomp_free)(cp->cp_rstate);
    289 	}
    290 	kmem_free(cp, sizeof (sppp_comp_t));
    291 	q->q_ptr = WR(q)->q_ptr = NULL;
    292 
    293 	return (0);
    294 }
    295 
    296 /*
    297  * spppcomp_wput()
    298  *
    299  * MT-Perimeters:
    300  *    exclusive inner.
    301  *
    302  * Description:
    303  *    Write-side put procedure.  Packets from above us arrive here.
    304  *
    305  *	The data handling logic is a little tricky here.  We defer to
    306  *	the service routine if q_first isn't NULL (to preserve message
    307  *	ordering after deferring a previous message), bcanputnext() is
    308  *	FALSE (to handle flow control), or we need a lot of processing
    309  *	and we're in an interrupt context (on the theory that we're
    310  *	already on a very long call stack at that point).  Since many
    311  *	callers will be in a non-interrupt context, this means that
    312  *	most processing will be performed here in-line, and deferral
    313  *	occurs only when necessary.
    314  */
    315 static void
    316 spppcomp_wput(queue_t *q, mblk_t *mp)
    317 {
    318 	sppp_comp_t *cp = q->q_ptr;
    319 	int flag;
    320 
    321 	switch (MTYPE(mp)) {
    322 	case M_DATA:
    323 		if (q->q_first != NULL || !bcanputnext(q, mp->b_band) ||
    324 		    ((cp->cp_flags & (COMP_VJC|CCP_COMP_RUN)) &&
    325 		    servicing_interrupt())) {
    326 #ifdef SPC_DEBUG
    327 			cp->cp_out_queued++;
    328 #endif
    329 			if (!putq(q, mp))
    330 				freemsg(mp);
    331 		} else {
    332 #ifdef SPC_DEBUG
    333 			cp->cp_out_handled++;
    334 #endif
    335 			if ((mp = spppcomp_outpkt(q, mp)) != NULL)
    336 				putnext(q, mp);
    337 		}
    338 		break;
    339 	case M_IOCTL:
    340 		spppcomp_ioctl(q, mp, cp);
    341 		break;
    342 	case M_CTL:
    343 		mutex_enter(&cp->cp_pair_lock);
    344 		flag = spppcomp_mctl(q, mp);
    345 		mutex_exit(&cp->cp_pair_lock);
    346 		if (flag != 0)
    347 			putnext(q, mp);
    348 		else
    349 			freemsg(mp);
    350 		break;
    351 	case M_FLUSH:
    352 		CPDEBUG((DBGSTART "wput M_FLUSH (0x%x) flags=0x%b\n",
    353 		    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
    354 		    *mp->b_rptr, cp->cp_flags,	CP_FLAGSSTR));
    355 		/*
    356 		 * Just discard pending data.  For CCP, any compressor
    357 		 * dictionary sequencing problems caused by this will
    358 		 * have to be handled by the compression protocol in
    359 		 * use.  For VJ, we need to tell the compressor to
    360 		 * start over.
    361 		 */
    362 		if (*mp->b_rptr & FLUSHW) {
    363 			mutex_enter(&cp->cp_pair_lock);
    364 			flushq(q, FLUSHDATA);
    365 			vj_compress_init(&cp->cp_vj, cp->cp_nxslots);
    366 			mutex_exit(&cp->cp_pair_lock);
    367 		}
    368 		putnext(q, mp);
    369 		break;
    370 	default:
    371 		if (bcanputnext(q, mp->b_band))
    372 			putnext(q, mp);
    373 		else if (!putq(q, mp))
    374 			freemsg(mp);
    375 		break;
    376 	}
    377 }
    378 
    379 /*
    380  * spppcomp_wsrv()
    381  *
    382  * MT-Perimeters:
    383  *    exclusive inner
    384  *
    385  * Description:
    386  *    Write-side service procedure.
    387  */
    388 static void
    389 spppcomp_wsrv(queue_t *q)
    390 {
    391 	mblk_t		*mp;
    392 
    393 	while ((mp = getq(q)) != NULL) {
    394 		/*
    395 		 * If the module below us is flow-controlled, then put
    396 		 * this message back on the queue again.
    397 		 */
    398 		if (!bcanputnext(q, mp->b_band)) {
    399 			(void) putbq(q, mp);
    400 			break;
    401 		}
    402 		if (MTYPE(mp) != M_DATA ||
    403 		    (mp = spppcomp_outpkt(q, mp)) != NULL)
    404 			putnext(q, mp);
    405 	}
    406 }
    407 
    408 /*
    409  * spppcomp_outpkt()
    410  *
    411  * MT-Perimeters:
    412  *    exclusive inner
    413  *
    414  * Description:
    415  *    Process outgoing packet.  Returns new mblk_t pointer on success
    416  *    (caller should do putnext through q), NULL on failure (packet has
    417  *    been discarded).
    418  */
    419 static mblk_t *
    420 spppcomp_outpkt(queue_t *q, mblk_t *mp)
    421 {
    422 	mblk_t		*zmp;
    423 	int		len;
    424 	ushort_t	proto;
    425 	sppp_comp_t	*cp = q->q_ptr;
    426 
    427 	/*
    428 	 * If the entire data size of the mblk is less than the length of the
    429 	 * PPP header, then free it. We can't do much with such message anyway,
    430 	 * since we can't determine what the PPP protocol is.
    431 	 */
    432 	len = msgsize(mp);
    433 	if (MBLKL(mp) < PPP_HDRLEN) {
    434 #ifdef SPC_DEBUG
    435 		mutex_enter(&cp->cp_pair_lock);
    436 		cp->cp_omsg_pull++;
    437 		mutex_exit(&cp->cp_pair_lock);
    438 #endif
    439 		zmp = msgpullup(mp, PPP_HDRLEN);
    440 		freemsg(mp);
    441 		if ((mp = zmp) == NULL)
    442 			goto msg_oerror;
    443 	}
    444 
    445 	proto = PPP_PROTOCOL(mp->b_rptr);
    446 
    447 	/*
    448 	 * Do VJ compression if requested.
    449 	 */
    450 	if (proto == PPP_IP && IS_COMP_VJC(cp) &&
    451 	    MSG_BYTE(mp, PPP_HDRLEN+offsetof(struct ip, ip_p)) ==
    452 	    IPPROTO_TCP) {
    453 		uchar_t		*vjhdr;
    454 		int		type;
    455 		uint32_t	indata[(PPP_HDRLEN+MAX_TCPIPHLEN) /
    456 		    sizeof (uint32_t)];
    457 		uchar_t		*dp;
    458 		int		tocopy, copied;
    459 		mblk_t		*fmb;
    460 		void		*srcp;
    461 		int		thislen;
    462 
    463 
    464 		tocopy = copied = MIN(len, sizeof (indata));
    465 		/*
    466 		 * If we can alter this dblk, and there's enough data
    467 		 * here to work with, and it's nicely aligned, then
    468 		 * avoid the data copy.
    469 		 */
    470 		if (DB_REF(mp) == 1 && MBLKL(mp) >= tocopy &&
    471 		    ((uintptr_t)mp->b_rptr & 3) == 0) {
    472 			/* Save off the address/control */
    473 			indata[0] = *(uint32_t *)mp->b_rptr;
    474 			srcp = (void *)(mp->b_rptr + PPP_HDRLEN);
    475 		} else {
    476 			fmb = mp;
    477 			dp = (uchar_t *)indata;
    478 			while (tocopy > 0) {
    479 				thislen = MBLKL(fmb);
    480 				if (tocopy > thislen) {
    481 					bcopy(fmb->b_rptr, dp, thislen);
    482 					dp += thislen;
    483 					tocopy -= thislen;
    484 					fmb = fmb->b_cont;
    485 				} else {
    486 					bcopy(fmb->b_rptr, dp, tocopy);
    487 					break;
    488 				}
    489 			}
    490 			srcp = (void *)(indata + PPP_HDRLEN/sizeof (*indata));
    491 		}
    492 
    493 		type = vj_compress_tcp((struct ip *)srcp, len - PPP_HDRLEN,
    494 		    &cp->cp_vj, IS_COMP_VJCCID(cp), &vjhdr);
    495 
    496 		/*
    497 		 * If we're going to modify this packet, then we can't modify
    498 		 * someone else's data.  Copy instead.
    499 		 *
    500 		 * (It would be nice to be able to avoid this data copy if CCP
    501 		 * is also enabled.  That would require extensive
    502 		 * modifications to the compression code.  Users should be
    503 		 * told to disable VJ compression when using CCP.)
    504 		 */
    505 		if (type != TYPE_IP && DB_REF(mp) > 1) {
    506 #ifdef SPC_DEBUG
    507 			mutex_enter(&cp->cp_pair_lock);
    508 			cp->cp_omsg_dcopy++;
    509 			mutex_exit(&cp->cp_pair_lock);
    510 #endif
    511 			/* Copy just altered portion. */
    512 			zmp = msgpullup(mp, copied);
    513 			freemsg(mp);
    514 			if ((mp = zmp) == NULL)
    515 				goto msg_oerror;
    516 		}
    517 
    518 		switch (type) {
    519 		case TYPE_UNCOMPRESSED_TCP:
    520 			mp->b_rptr[3] = proto = PPP_VJC_UNCOMP;
    521 			/* No need to update if it was done in place. */
    522 			if (srcp ==
    523 			    (void *)(indata + PPP_HDRLEN / sizeof (*indata))) {
    524 				thislen = PPP_HDRLEN +
    525 				    offsetof(struct ip, ip_p);
    526 				zmp = mp;
    527 				while (zmp != NULL) {
    528 					if (MBLKL(zmp) > thislen) {
    529 						zmp->b_rptr[thislen] =
    530 						    ((struct ip *)srcp)->ip_p;
    531 						break;
    532 					}
    533 					thislen -= MBLKL(zmp);
    534 					zmp = zmp->b_cont;
    535 				}
    536 			}
    537 			break;
    538 
    539 		case TYPE_COMPRESSED_TCP:
    540 			/* Calculate amount to remove from front */
    541 			thislen = vjhdr - (uchar_t *)srcp;
    542 			ASSERT(thislen >= 0);
    543 
    544 			/* Try to do a cheap adjmsg by arithmetic first. */
    545 			dp = mp->b_rptr + thislen;
    546 			if (dp > mp->b_wptr) {
    547 				if (!adjmsg(mp, thislen)) {
    548 					freemsg(mp);
    549 					goto msg_oerror;
    550 				}
    551 				dp = mp->b_rptr;
    552 			}
    553 
    554 			/*
    555 			 * Now make sure first block is big enough to
    556 			 * receive modified data.  If we modified in
    557 			 * place, then no need to check or copy.
    558 			 */
    559 			copied -= thislen;
    560 			ASSERT(copied >= PPP_HDRLEN);
    561 			if (srcp !=
    562 			    (void *)(indata + PPP_HDRLEN / sizeof (*indata)))
    563 				copied = 0;
    564 			mp->b_rptr = dp;
    565 			if (MBLKL(mp) < copied) {
    566 				zmp = msgpullup(mp, copied);
    567 				freemsg(mp);
    568 				if ((mp = zmp) == NULL)
    569 					goto msg_oerror;
    570 				dp = mp->b_rptr;
    571 			}
    572 
    573 			*dp++ = ((uchar_t *)indata)[0];	/* address */
    574 			*dp++ = ((uchar_t *)indata)[1];	/* control  */
    575 			*dp++ = 0;			/* protocol */
    576 			*dp++ = proto = PPP_VJC_COMP;	/* protocol */
    577 			copied -= PPP_HDRLEN;
    578 			if (copied > 0) {
    579 				bcopy(vjhdr, dp, copied);
    580 			}
    581 			break;
    582 		}
    583 	}
    584 
    585 	/*
    586 	 * Do packet compression if enabled.
    587 	 */
    588 	if (proto == PPP_CCP) {
    589 		/*
    590 		 * Handle any negotiation packets by changing compressor
    591 		 * state.  Doing this here rather than with an ioctl keeps
    592 		 * the negotiation and the data flow in sync.
    593 		 */
    594 		mutex_enter(&cp->cp_pair_lock);
    595 		comp_ccp(q, mp, cp, B_FALSE);
    596 		mutex_exit(&cp->cp_pair_lock);
    597 	} else if (proto != PPP_LCP && IS_CCP_COMP_RUN(cp) &&
    598 	    IS_CCP_ISUP(cp) && cp->cp_xstate != NULL) {
    599 		mblk_t	*cmp = NULL;
    600 
    601 		len = msgsize(mp);
    602 		len = (*cp->cp_xcomp->compress)(cp->cp_xstate, &cmp, mp, len,
    603 		    cp->cp_mtu + PPP_HDRLEN);
    604 
    605 		if (cmp != NULL) {
    606 			/* Success!  Discard uncompressed version */
    607 			cmp->b_band = mp->b_band;
    608 			freemsg(mp);
    609 			mp = cmp;
    610 		}
    611 		if (len < 0) {
    612 			/*
    613 			 * Compressor failure; must discard this
    614 			 * packet because the compressor dictionary is
    615 			 * now corrupt.
    616 			 */
    617 			freemsg(mp);
    618 			mutex_enter(&cp->cp_pair_lock);
    619 			cp->cp_stats.ppp_oerrors++;
    620 			mutex_exit(&cp->cp_pair_lock);
    621 			(void) putnextctl1(RD(q), M_CTL, PPPCTL_OERROR);
    622 			return (NULL);
    623 		}
    624 	}
    625 
    626 	/*
    627 	 * If either address and control field compression or protocol field
    628 	 * compression is enabled, then we'll need a writable packet.  Copy if
    629 	 * necessary.
    630 	 */
    631 	if ((cp->cp_flags & (COMP_AC|COMP_PROT)) && DB_REF(mp) > 1) {
    632 #ifdef SPC_DEBUG
    633 		mutex_enter(&cp->cp_pair_lock);
    634 		cp->cp_omsg_dcopy++;
    635 		mutex_exit(&cp->cp_pair_lock);
    636 #endif
    637 		zmp = copymsg(mp);
    638 		freemsg(mp);
    639 		if ((mp = zmp) == NULL)
    640 			goto msg_oerror;
    641 	}
    642 
    643 	/*
    644 	 * Do address/control and protocol compression if enabled.
    645 	 */
    646 	if (IS_COMP_AC(cp) && (proto != PPP_LCP)) {
    647 		mp->b_rptr += 2;	/* drop address & ctrl fields */
    648 		/*
    649 		 * Protocol field compression omits the first byte if
    650 		 * it would be 0x00, thus the check for < 0x100.
    651 		 */
    652 		if (proto < 0x100 && IS_COMP_PROT(cp)) {
    653 			++mp->b_rptr;	/* drop high protocol byte */
    654 		}
    655 	} else if ((proto < 0x100) && IS_COMP_PROT(cp)) {
    656 		/*
    657 		 * shuffle up the address & ctrl fields
    658 		 */
    659 		mp->b_rptr[2] = mp->b_rptr[1];
    660 		mp->b_rptr[1] = mp->b_rptr[0];
    661 		++mp->b_rptr;
    662 	}
    663 	mutex_enter(&cp->cp_pair_lock);
    664 	cp->cp_stats.ppp_opackets++;
    665 	cp->cp_stats.ppp_obytes += msgsize(mp);
    666 	mutex_exit(&cp->cp_pair_lock);
    667 
    668 	CPDEBUG((DBGSTART "send (%ld bytes) flags=0x%b\n",
    669 	    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1), msgsize(mp),
    670 	    cp->cp_flags, CP_FLAGSSTR));
    671 	return (mp);
    672 
    673 msg_oerror:
    674 	mutex_enter(&cp->cp_pair_lock);
    675 	cp->cp_stats.ppp_oerrors++;
    676 	mutex_exit(&cp->cp_pair_lock);
    677 	(void) putnextctl1(RD(q), M_CTL, PPPCTL_OERROR);
    678 	return (NULL);
    679 }
    680 
    681 /*
    682  * spppcomp_inner_ioctl()
    683  *
    684  * MT-Perimeters:
    685  *    exclusive inner; queue pair lock held.
    686  *
    687  * Description:
    688  *	Called by spppcomp_ioctl to handle state-affecting ioctls.
    689  *	Returns -1 if caller should do putnext, 0 for miocack, or >0
    690  *	for miocnak.  Must *NOT* do putnext in this routine, since
    691  *	lock is held here.
    692  */
    693 static int
    694 spppcomp_inner_ioctl(queue_t *q, mblk_t *mp)
    695 {
    696 	sppp_comp_t	*cp = q->q_ptr;
    697 	int		flags;
    698 	int		mask;
    699 	int		rc;
    700 	int		len;
    701 	int		cmd;
    702 	int		nxslots;
    703 	int		nrslots;
    704 	int		val;
    705 	uchar_t		*opt_data;
    706 	uint32_t	opt_len;
    707 	struct compressor **comp;
    708 	struct compressor *ccomp;
    709 	struct iocblk	*iop;
    710 	void		*xtemp;
    711 
    712 	iop = (struct iocblk *)mp->b_rptr;
    713 	rc = EINVAL;
    714 	len = 0;
    715 	switch (iop->ioc_cmd) {
    716 	case PPPIO_CFLAGS:
    717 		if (iop->ioc_count != 2 * sizeof (uint32_t) ||
    718 		    mp->b_cont == NULL)
    719 			break;
    720 
    721 		flags = ((uint32_t *)mp->b_cont->b_rptr)[0];
    722 		mask = ((uint32_t *)mp->b_cont->b_rptr)[1];
    723 
    724 		cp->cp_flags = (cp->cp_flags & ~mask) | (flags & mask);
    725 
    726 		if ((mask & CCP_ISOPEN) && !(flags & CCP_ISOPEN)) {
    727 			cp->cp_flags &= ~CCP_ISUP & ~CCP_COMP_RUN &
    728 			    ~CCP_DECOMP_RUN;
    729 			if (cp->cp_xstate != NULL) {
    730 				(*cp->cp_xcomp->comp_free)(cp->cp_xstate);
    731 				cp->cp_xstate = NULL;
    732 			}
    733 			if (cp->cp_rstate != NULL) {
    734 				(*cp->cp_rcomp->decomp_free)(cp->cp_rstate);
    735 				cp->cp_rstate = NULL;
    736 			}
    737 		}
    738 
    739 		CPDEBUG((DBGSTART
    740 		    "PPPIO_CFLAGS xflags=0x%b xmask=0x%b flags=0x%b\n",
    741 		    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
    742 		    flags, CP_FLAGSSTR, mask,
    743 		    CP_FLAGSSTR, cp->cp_flags, CP_FLAGSSTR));
    744 
    745 		/* If we're not the last PPP-speaker, then pass along. */
    746 		if (!IS_CP_LASTMOD(cp)) {
    747 			return (-1);	/* putnext */
    748 		}
    749 
    750 		*(uint32_t *)mp->b_cont->b_rptr = cp->cp_flags;
    751 		len = sizeof (uint32_t);
    752 		rc = 0;
    753 		break;
    754 
    755 	case PPPIO_VJINIT:
    756 		if (iop->ioc_count != 2 || mp->b_cont == NULL)
    757 			break;
    758 		/*
    759 		 * Even though it's not passed along, we have to
    760 		 * validate nrslots so that we don't agree to
    761 		 * decompress anything we cannot.
    762 		 */
    763 		nxslots = mp->b_cont->b_rptr[0] + 1;
    764 		nrslots = mp->b_cont->b_rptr[1] + 1;
    765 		if (nxslots > MAX_STATES || nrslots > MAX_STATES)
    766 			break;
    767 
    768 		/* No need to lock here; just reading a word is atomic */
    769 		/* mutex_enter(&cp->cp_pair_lock); */
    770 		cp->cp_vj_last_ierrors = cp->cp_stats.ppp_ierrors;
    771 		/* mutex_exit(&cp->cp_pair_lock); */
    772 		vj_compress_init(&cp->cp_vj, nxslots);
    773 		cp->cp_nxslots = nxslots;
    774 
    775 		CPDEBUG((DBGSTART
    776 		    "PPPIO_VJINIT txslots=%d rxslots=%d flags=0x%b\n",
    777 		    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1), nxslots,
    778 		    nrslots, cp->cp_flags, CP_FLAGSSTR));
    779 		rc = 0;
    780 		break;
    781 
    782 	case PPPIO_XCOMP:
    783 	case PPPIO_RCOMP:
    784 		if (iop->ioc_count < 2 || mp->b_cont == NULL)
    785 			break;
    786 		/*
    787 		 * The input data here is the raw CCP algorithm option
    788 		 * from negotiation.  The format is always one byte of
    789 		 * algorithm number, one byte of length, and
    790 		 * (length-2) bytes of algorithm-dependent data.  The
    791 		 * alloc routine is expected to parse and validate
    792 		 * this.
    793 		 */
    794 		opt_data = mp->b_cont->b_rptr;
    795 		opt_len = mp->b_cont->b_wptr - opt_data;
    796 		if (opt_len > iop->ioc_count) {
    797 			opt_len = iop->ioc_count;
    798 		}
    799 		len = mp->b_cont->b_rptr[1];
    800 		if (len < 2 || len > opt_len)
    801 			break;
    802 		len = 0;
    803 		for (comp = ppp_compressors; *comp != NULL; ++comp) {
    804 
    805 			if ((*comp)->compress_proto != opt_data[0]) {
    806 				continue;
    807 			}
    808 			rc = 0;
    809 			if (iop->ioc_cmd == PPPIO_XCOMP) {
    810 				/*
    811 				 * A previous call may have fetched
    812 				 * memory for a compressor that's now
    813 				 * being retired or reset.  Free it
    814 				 * using its mechanism for freeing
    815 				 * stuff.
    816 				 */
    817 				if ((xtemp = cp->cp_xstate) != NULL) {
    818 					cp->cp_flags &= ~CCP_ISUP &
    819 					    ~CCP_COMP_RUN;
    820 					cp->cp_xstate = NULL;
    821 					(*cp->cp_xcomp->comp_free)(xtemp);
    822 				}
    823 				cp->cp_xcomp = *comp;
    824 				cp->cp_xstate = (*comp)->comp_alloc(opt_data,
    825 				    opt_len);
    826 
    827 				if (cp->cp_xstate == NULL) {
    828 					rc = ENOSR;
    829 				}
    830 
    831 				CPDEBUG((DBGSTART "PPPIO_XCOMP opt_proto=0x%x "
    832 				    "opt_len=0x%d flags=0x%b\n",
    833 				    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
    834 				    (uchar_t)opt_data[0], opt_len,
    835 				    cp->cp_flags,
    836 				    CP_FLAGSSTR));
    837 			} else {
    838 				if ((xtemp = cp->cp_rstate) != NULL) {
    839 					cp->cp_flags &= ~CCP_ISUP &
    840 					    ~CCP_DECOMP_RUN;
    841 					cp->cp_rstate = NULL;
    842 					(*cp->cp_rcomp->decomp_free)(xtemp);
    843 				}
    844 				cp->cp_rcomp = *comp;
    845 				cp->cp_rstate =
    846 				    (*comp)->decomp_alloc(opt_data, opt_len);
    847 
    848 				if (cp->cp_rstate == NULL) {
    849 					rc = ENOSR;
    850 				}
    851 
    852 				CPDEBUG((DBGSTART "PPPIO_RCOMP opt_proto=0x%x "
    853 				    "opt_len=0x%d flags=0x%b\n",
    854 				    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
    855 				    (uchar_t)opt_data[0], opt_len,
    856 				    cp->cp_flags,
    857 				    CP_FLAGSSTR));
    858 			}
    859 			if (rc == 0 && (*comp)->set_effort != NULL) {
    860 				rc = (*(*comp)->set_effort)(cp->
    861 				    cp_xcomp == *comp ? cp->cp_xstate : NULL,
    862 				    cp->cp_rcomp == *comp ? cp->cp_rstate :
    863 				    NULL, cp->cp_effort);
    864 				if (rc != 0) {
    865 					CKDEBUG((DBGSTART
    866 					    "cannot set effort %d",
    867 					    cp->cp_unit, cp->cp_effort));
    868 					rc = 0;
    869 				}
    870 			}
    871 			break;
    872 		}
    873 		break;
    874 
    875 	case PPPIO_DEBUG:
    876 		if (iop->ioc_count != sizeof (uint32_t) || mp->b_cont == NULL)
    877 			break;
    878 
    879 		cmd = *(uint32_t *)mp->b_cont->b_rptr;
    880 
    881 		/* If it's not for us, then pass along. */
    882 		if (cmd != PPPDBG_LOG + PPPDBG_COMP) {
    883 			return (-1);	/* putnext */
    884 		}
    885 		cp->cp_flags |= CP_KDEBUG;
    886 
    887 		CKDEBUG((DBGSTART "PPPIO_DEBUG log enabled flags=0x%b\n",
    888 		    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
    889 		    cp->cp_flags, CP_FLAGSSTR));
    890 		rc = 0;
    891 		break;
    892 
    893 	case PPPIO_LASTMOD:
    894 		cp->cp_flags |= CP_LASTMOD;
    895 		CPDEBUG((DBGSTART "PPPIO_LASTMOD last module flags=0x%b\n",
    896 		    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
    897 		    cp->cp_flags, CP_FLAGSSTR));
    898 		rc = 0;
    899 		break;
    900 
    901 	case PPPIO_COMPLEV:	/* set compression effort level */
    902 		if (iop->ioc_count != sizeof (uint32_t) || mp->b_cont == NULL)
    903 			break;
    904 		val = *(uint32_t *)mp->b_cont->b_rptr;
    905 		cp->cp_effort = val;
    906 		/* Silently ignore if compressor doesn't understand this. */
    907 		rc = 0;
    908 		if ((ccomp = cp->cp_xcomp) != NULL &&
    909 		    ccomp->set_effort != NULL) {
    910 			rc = (*ccomp->set_effort)(cp->cp_xstate,
    911 			    ccomp == cp->cp_rcomp ? cp->cp_rstate : NULL, val);
    912 			if (rc != 0)
    913 				break;
    914 		}
    915 		if ((ccomp = cp->cp_rcomp) != NULL && ccomp != cp->cp_xcomp &&
    916 		    ccomp->set_effort != NULL)
    917 			rc = (*ccomp->set_effort)(NULL, cp->cp_rstate, val);
    918 		break;
    919 	}
    920 	if (rc == 0 && mp->b_cont != NULL)
    921 		mp->b_cont->b_wptr = mp->b_cont->b_rptr + len;
    922 	return (rc);
    923 }
    924 
    925 /*
    926  * spppcomp_getcstat()
    927  *
    928  * MT-Perimeters:
    929  *    exclusive inner.
    930  *
    931  * Description:
    932  *    Called by spppcomp_ioctl as the result of receiving a PPPIO_GETCSTAT.
    933  */
    934 static void
    935 spppcomp_getcstat(queue_t *q, mblk_t *mp, sppp_comp_t *cp)
    936 {
    937 	mblk_t		*mpnext;
    938 	struct ppp_comp_stats	*csp;
    939 
    940 	ASSERT(cp != NULL);
    941 
    942 	mpnext = allocb(sizeof (struct ppp_comp_stats), BPRI_MED);
    943 	if (mpnext == NULL) {
    944 		miocnak(q, mp, 0, ENOSR);
    945 		return;
    946 	}
    947 	if (mp->b_cont != NULL) {
    948 		freemsg(mp->b_cont);
    949 	}
    950 	mp->b_cont = mpnext;
    951 	csp = (struct ppp_comp_stats *)mpnext->b_wptr;
    952 	mpnext->b_wptr += sizeof (struct ppp_comp_stats);
    953 	bzero((caddr_t)csp, sizeof (struct ppp_comp_stats));
    954 
    955 	if (cp->cp_xstate != NULL) {
    956 		(*cp->cp_xcomp->comp_stat)(cp->cp_xstate, &csp->c);
    957 	}
    958 	if (cp->cp_rstate != NULL) {
    959 		(*cp->cp_rcomp->decomp_stat)(cp->cp_rstate, &csp->d);
    960 	}
    961 
    962 	miocack(q, mp, sizeof (struct ppp_comp_stats), 0);
    963 }
    964 
    965 /*
    966  * spppcomp_ioctl()
    967  *
    968  * MT-Perimeters:
    969  *    exclusive inner.
    970  *
    971  * Description:
    972  *    Called by spppcomp_wput as the result of receiving an M_IOCTL
    973  *    command.
    974  */
    975 static void
    976 spppcomp_ioctl(queue_t *q, mblk_t *mp, sppp_comp_t *cp)
    977 {
    978 	struct iocblk	*iop;
    979 	int flag;
    980 
    981 	ASSERT(cp != NULL);
    982 
    983 	iop = (struct iocblk *)mp->b_rptr;
    984 	switch (iop->ioc_cmd) {
    985 	case PPPIO_CFLAGS:
    986 	case PPPIO_VJINIT:
    987 	case PPPIO_XCOMP:
    988 	case PPPIO_RCOMP:
    989 	case PPPIO_DEBUG:
    990 	case PPPIO_LASTMOD:
    991 	case PPPIO_COMPLEV:
    992 		mutex_enter(&cp->cp_pair_lock);
    993 		flag = spppcomp_inner_ioctl(q, mp);
    994 		mutex_exit(&cp->cp_pair_lock);
    995 		if (flag == -1) {
    996 			putnext(q, mp);
    997 		} else if (flag == 0) {
    998 			miocack(q, mp,
    999 			    mp->b_cont == NULL ? 0 : MBLKL(mp->b_cont), 0);
   1000 		} else {
   1001 			miocnak(q, mp, 0, flag);
   1002 		}
   1003 		break;
   1004 
   1005 	case PPPIO_GETCSTAT:
   1006 		spppcomp_getcstat(q, mp, cp);
   1007 		break;
   1008 
   1009 	case PPPIO_GTYPE:	/* get existing driver type */
   1010 		if (!IS_CP_LASTMOD(cp)) {
   1011 			putnext(q, mp);
   1012 			break;
   1013 		}
   1014 		freemsg(mp->b_next);
   1015 		mp->b_next = allocb(sizeof (uint32_t), BPRI_MED);
   1016 		if (mp->b_next == NULL) {
   1017 			miocnak(q, mp, 0, ENOSR);
   1018 		} else {
   1019 			*(uint32_t *)mp->b_cont->b_wptr = PPPTYP_HC;
   1020 			mp->b_cont->b_wptr += sizeof (uint32_t);
   1021 			miocack(q, mp, sizeof (uint32_t), 0);
   1022 		}
   1023 		break;
   1024 
   1025 	default:
   1026 		putnext(q, mp);
   1027 		break;
   1028 	}
   1029 }
   1030 
   1031 /*
   1032  * spppcomp_mctl()
   1033  *
   1034  * MT-Perimeters:
   1035  *    exclusive inner; queue pair lock held.
   1036  *
   1037  * Description:
   1038  *	Called by spppcomp_wput as the result of receiving an M_CTL
   1039  *	message from another STREAMS module, and returns non-zero if
   1040  *	caller should do putnext or zero for freemsg.  Must *NOT* do
   1041  *	putnext in this routine, since lock is held here.
   1042  */
   1043 static int
   1044 spppcomp_mctl(queue_t *q, mblk_t *mp)
   1045 {
   1046 	sppp_comp_t		*cp = q->q_ptr;
   1047 	kstat_t			*ksp;
   1048 	char			unit[32];
   1049 	const char **cpp;
   1050 	kstat_named_t *knt;
   1051 
   1052 	switch (*mp->b_rptr) {
   1053 	case PPPCTL_MTU:
   1054 		if (MBLKL(mp) < 4) {
   1055 			break;
   1056 		}
   1057 		cp->cp_mtu = ((ushort_t *)mp->b_rptr)[1];
   1058 
   1059 		CPDEBUG((DBGSTART "PPPCTL_MTU (%d) flags=0x%b\n",
   1060 		    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
   1061 		    cp->cp_mtu, cp->cp_flags, CP_FLAGSSTR));
   1062 		break;
   1063 	case PPPCTL_MRU:
   1064 		if (MBLKL(mp) < 4) {
   1065 			break;
   1066 		}
   1067 		cp->cp_mru = ((ushort_t *)mp->b_rptr)[1];
   1068 
   1069 		CPDEBUG((DBGSTART "PPPCTL_MRU (%d) flags=0x%b\n",
   1070 		    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
   1071 		    cp->cp_mru, cp->cp_flags, CP_FLAGSSTR));
   1072 		break;
   1073 	case PPPCTL_UNIT:
   1074 		if (MBLKL(mp) < 8) {
   1075 			break;
   1076 		}
   1077 		/* If PPPCTL_UNIT has already been issued, then ignore. */
   1078 		if (IS_CP_HASUNIT(cp)) {
   1079 			break;
   1080 		}
   1081 		ASSERT(cp->cp_kstats == NULL);
   1082 		cp->cp_unit = ((uint32_t *)mp->b_rptr)[1];
   1083 
   1084 		/* Create kstats for this unit. */
   1085 		(void) sprintf(unit, "%s" "%d", COMP_MOD_NAME, cp->cp_unit);
   1086 		ksp = kstat_create(COMP_MOD_NAME, cp->cp_unit, unit, "net",
   1087 		    KSTAT_TYPE_NAMED, sizeof (spppcomp_kstats_t) /
   1088 		    sizeof (kstat_named_t), 0);
   1089 
   1090 		if (ksp != NULL) {
   1091 			cp->cp_flags |= CP_HASUNIT;
   1092 			cp->cp_kstats = ksp;
   1093 
   1094 			knt = (kstat_named_t *)ksp->ks_data;
   1095 			for (cpp = kstats_names;
   1096 			    cpp < kstats_names + Dim(kstats_names); cpp++) {
   1097 				kstat_named_init(knt, *cpp,
   1098 				    KSTAT_DATA_UINT32);
   1099 				knt++;
   1100 			}
   1101 			for (cpp = kstats64_names;
   1102 			    cpp < kstats64_names + Dim(kstats64_names); cpp++) {
   1103 				kstat_named_init(knt, *cpp,
   1104 				    KSTAT_DATA_UINT64);
   1105 				knt++;
   1106 			}
   1107 			ksp->ks_update = spppcomp_kstat_update;
   1108 			ksp->ks_private = (void *)cp;
   1109 			kstat_install(ksp);
   1110 
   1111 			CPDEBUG((DBGSTART "PPPCTL_UNIT flags=0x%b\n",
   1112 			    cp->cp_unit, cp->cp_flags, CP_FLAGSSTR));
   1113 		}
   1114 		break;
   1115 
   1116 	default:
   1117 		/* Forward unknown M_CTL messages along */
   1118 		return (1);
   1119 	}
   1120 
   1121 	/*
   1122 	 * For known PPP M_CTL messages, forward along only if we're not the
   1123 	 * last PPP-aware module.
   1124 	 */
   1125 	if (IS_CP_LASTMOD(cp))
   1126 		return (0);
   1127 	return (1);
   1128 }
   1129 
   1130 /*
   1131  * spppcomp_rput()
   1132  *
   1133  * MT-Perimeters:
   1134  *    exclusive inner.
   1135  *
   1136  * Description:
   1137  *    Upper read-side put procedure.  Messages get here from below.
   1138  *
   1139  *	The data handling logic is a little more tricky here.  We
   1140  *	defer to the service routine if q_first isn't NULL (to
   1141  *	preserve message ordering after deferring a previous message),
   1142  *	bcanputnext() is FALSE (to handle flow control), or we have
   1143  *	done a lot of processing recently and we're about to do a lot
   1144  *	more and we're in an interrupt context (on the theory that
   1145  *	we're hogging the CPU in this case).
   1146  */
   1147 static void
   1148 spppcomp_rput(queue_t *q, mblk_t *mp)
   1149 {
   1150 	sppp_comp_t		*cp = q->q_ptr;
   1151 	struct iocblk		*iop;
   1152 	struct ppp_stats64	*psp;
   1153 	boolean_t		inter;
   1154 	hrtime_t		curtime;
   1155 
   1156 	switch (MTYPE(mp)) {
   1157 	case M_DATA:
   1158 		inter = servicing_interrupt();
   1159 		if (inter) {
   1160 			curtime = gethrtime();
   1161 
   1162 			/*
   1163 			 * If little time has passed since last
   1164 			 * arrival, then bump the counter.
   1165 			 */
   1166 			if (curtime - cp->cp_lastfinish < spppcomp_min_arrival)
   1167 				cp->cp_fastin++;
   1168 			else
   1169 				cp->cp_fastin >>= 1;	/* a guess */
   1170 		}
   1171 		/*
   1172 		 * If we're not decompressing, then we'll be fast, so
   1173 		 * we don't have to worry about hogging here.  If we
   1174 		 * are decompressing, then we have to check the
   1175 		 * cp_fastin count.
   1176 		 */
   1177 		if ((!(cp->cp_flags & (CCP_DECOMP_RUN | DECOMP_VJC)) ||
   1178 		    cp->cp_fastin < MAX_FAST_ARRIVALS) &&
   1179 		    q->q_first == NULL && bcanputnext(q, mp->b_band)) {
   1180 #ifdef SPC_DEBUG
   1181 			cp->cp_in_handled++;
   1182 #endif
   1183 			if ((mp = spppcomp_inpkt(q, mp)) != NULL)
   1184 				putnext(q, mp);
   1185 			if (inter) {
   1186 				cp->cp_lastfinish = gethrtime();
   1187 			}
   1188 		} else {
   1189 			/* Deferring; give him a clean slate */
   1190 			cp->cp_fastin = 0;
   1191 #ifdef SPC_DEBUG
   1192 			cp->cp_in_queued++;
   1193 #endif
   1194 			if (!putq(q, mp))
   1195 				freemsg(mp);
   1196 		}
   1197 		break;
   1198 	case M_IOCACK:
   1199 		iop = (struct iocblk *)mp->b_rptr;
   1200 		/*
   1201 		 * Bundled with pppstats; no need to handle PPPIO_GETSTAT
   1202 		 * here since we'll never see it.
   1203 		 */
   1204 		if (iop->ioc_cmd == PPPIO_GETSTAT64 &&
   1205 		    iop->ioc_count == sizeof (struct ppp_stats64) &&
   1206 		    mp->b_cont != NULL) {
   1207 			/*
   1208 			 * This crock is to handle a badly-designed
   1209 			 * but well-known ioctl for ANU PPP.  Both
   1210 			 * link statistics and VJ statistics are
   1211 			 * requested together.
   1212 			 *
   1213 			 * Catch this on the way back from the
   1214 			 * spppasyn module so we can fill in the VJ
   1215 			 * stats.  This happens only when we have
   1216 			 * PPP-aware modules beneath us.
   1217 			 */
   1218 			psp = (struct ppp_stats64 *)mp->b_cont->b_rptr;
   1219 			psp->vj = cp->cp_vj.stats;
   1220 			CPDEBUG((DBGSTART
   1221 			    "PPPIO_GETSTAT64 (VJ filled) flags=0x%b\n",
   1222 			    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
   1223 			    cp->cp_flags, CP_FLAGSSTR));
   1224 		}
   1225 		putnext(q, mp);
   1226 		break;
   1227 	case M_CTL:
   1228 		/* Increase our statistics and forward it upstream. */
   1229 		mutex_enter(&cp->cp_pair_lock);
   1230 		if (*mp->b_rptr == PPPCTL_IERROR) {
   1231 			cp->cp_stats.ppp_ierrors++;
   1232 			cp->cp_ierr_low++;
   1233 		} else if (*mp->b_rptr == PPPCTL_OERROR) {
   1234 			cp->cp_stats.ppp_oerrors++;
   1235 			cp->cp_oerr_low++;
   1236 		}
   1237 		mutex_exit(&cp->cp_pair_lock);
   1238 		putnext(q, mp);
   1239 		break;
   1240 
   1241 	case M_FLUSH:
   1242 		CPDEBUG((DBGSTART "rput M_FLUSH (0x%x) flags=0x%b\n",
   1243 		    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1),
   1244 		    *mp->b_rptr, cp->cp_flags,	CP_FLAGSSTR));
   1245 		/*
   1246 		 * Just discard pending data.  For CCP, any
   1247 		 * decompressor dictionary sequencing problems caused
   1248 		 * by this will have to be handled by the compression
   1249 		 * protocol in use.  For VJ, we need to give the
   1250 		 * decompressor a heads-up.
   1251 		 */
   1252 		if (*mp->b_rptr & FLUSHR) {
   1253 			mutex_enter(&cp->cp_pair_lock);
   1254 			flushq(q, FLUSHDATA);
   1255 			cp->cp_vj_last_ierrors = cp->cp_stats.ppp_ierrors;
   1256 			vj_uncompress_err(&cp->cp_vj);
   1257 			mutex_exit(&cp->cp_pair_lock);
   1258 		}
   1259 		putnext(q, mp);
   1260 		break;
   1261 
   1262 	default:
   1263 		if (bcanputnext(q, mp->b_band))
   1264 			putnext(q, mp);
   1265 		else if (!putq(q, mp))
   1266 			freemsg(mp);
   1267 		break;
   1268 	}
   1269 }
   1270 
   1271 /*
   1272  * spppcomp_rsrv()
   1273  *
   1274  * MT-Perimeters:
   1275  *    exclusive inner.
   1276  *
   1277  * Description:
   1278  *    Upper read-side service procedure.  We handle data deferred from
   1279  *    spppcomp_rput here.
   1280  *
   1281  *	The data on the queue are always compressed (unprocessed).
   1282  *	The rput procedure tries to do decompression, but if it can't,
   1283  *	it will put the unprocessed data on the queue for later
   1284  *	handling.
   1285  */
   1286 static void
   1287 spppcomp_rsrv(queue_t *q)
   1288 {
   1289 	mblk_t		*mp;
   1290 
   1291 	while ((mp = getq(q)) != NULL) {
   1292 		/*
   1293 		 * If the module above us is flow-controlled, then put
   1294 		 * this message back on the queue again.
   1295 		 */
   1296 		if (!bcanputnext(q, mp->b_band)) {
   1297 			(void) putbq(q, mp);
   1298 			break;
   1299 		}
   1300 		if (MTYPE(mp) != M_DATA ||
   1301 		    (mp = spppcomp_inpkt(q, mp)) != NULL)
   1302 			putnext(q, mp);
   1303 	}
   1304 }
   1305 
   1306 /*
   1307  * spppcomp_inpkt()
   1308  *
   1309  * MT-Perimeters:
   1310  *    exclusive inner
   1311  *
   1312  * Description:
   1313  *    Process incoming packet.
   1314  */
   1315 static mblk_t *
   1316 spppcomp_inpkt(queue_t *q, mblk_t *mp)
   1317 {
   1318 	ushort_t	proto;
   1319 	int		i;
   1320 	mblk_t		*zmp;
   1321 	mblk_t		*np;
   1322 	uchar_t		*dp;
   1323 	int		len;
   1324 	int		hlen;
   1325 	sppp_comp_t	*cp = q->q_ptr;
   1326 
   1327 	len = msgsize(mp);
   1328 
   1329 	mutex_enter(&cp->cp_pair_lock);
   1330 	cp->cp_stats.ppp_ibytes += len;
   1331 	cp->cp_stats.ppp_ipackets++;
   1332 	mutex_exit(&cp->cp_pair_lock);
   1333 	/*
   1334 	 * First work out the protocol and where the PPP header ends.
   1335 	 */
   1336 	i = 0;
   1337 	proto = MSG_BYTE(mp, 0);
   1338 	if (proto == PPP_ALLSTATIONS) {
   1339 		i = 2;
   1340 		proto = MSG_BYTE(mp, 2);
   1341 	}
   1342 	if ((proto & 1) == 0) {
   1343 		++i;
   1344 		proto = (proto << 8) + MSG_BYTE(mp, i);
   1345 	}
   1346 	hlen = i + 1;
   1347 	/*
   1348 	 * Now reconstruct a complete, contiguous PPP header at the
   1349 	 * start of the packet.
   1350 	 */
   1351 	if (hlen < (IS_DECOMP_AC(cp) ? 0 : 2) + (IS_DECOMP_PROT(cp) ? 1 : 2)) {
   1352 		/* count these? */
   1353 		goto bad;
   1354 	}
   1355 	if (mp->b_rptr + hlen > mp->b_wptr) {
   1356 		/*
   1357 		 * Header is known to be intact here; so adjmsg will do the
   1358 		 * right thing here.
   1359 		 */
   1360 		if (!adjmsg(mp, hlen)) {
   1361 			goto bad;
   1362 		}
   1363 		hlen = 0;
   1364 	}
   1365 	if (hlen != PPP_HDRLEN) {
   1366 		/*
   1367 		 * We need to put some bytes on the front of the packet
   1368 		 * to make a full-length PPP header. If we can put them
   1369 		 * in mp, we do, otherwise we tack another mblk on the
   1370 		 * front.
   1371 		 *
   1372 		 * XXX we really shouldn't need to carry around the address
   1373 		 * and control at this stage.  ACFC and PFC need to be
   1374 		 * reworked.
   1375 		 */
   1376 		dp = mp->b_rptr + hlen - PPP_HDRLEN;
   1377 		if ((dp < mp->b_datap->db_base) || (DB_REF(mp) > 1)) {
   1378 
   1379 			np = allocb(PPP_HDRLEN, BPRI_MED);
   1380 			if (np == 0) {
   1381 				goto bad;
   1382 			}
   1383 			np->b_cont = mp;
   1384 			mp->b_rptr += hlen;
   1385 			mp = np;
   1386 			dp = mp->b_wptr;
   1387 			mp->b_wptr += PPP_HDRLEN;
   1388 		} else {
   1389 			mp->b_rptr = dp;
   1390 		}
   1391 		dp[0] = PPP_ALLSTATIONS;
   1392 		dp[1] = PPP_UI;
   1393 		dp[2] = (proto >> 8) & 0xff;
   1394 		dp[3] = proto & 0xff;
   1395 	}
   1396 	/*
   1397 	 * Now see if we have a compressed packet to decompress, or a
   1398 	 * CCP negotiation packet to take notice of.  It's guaranteed
   1399 	 * that at least PPP_HDRLEN bytes are contiguous in the first
   1400 	 * block now.
   1401 	 */
   1402 	proto = PPP_PROTOCOL(mp->b_rptr);
   1403 	if (proto == PPP_CCP) {
   1404 		len = msgsize(mp);
   1405 		if (mp->b_wptr < mp->b_rptr + len) {
   1406 #ifdef SPC_DEBUG
   1407 			mutex_enter(&cp->cp_pair_lock);
   1408 			cp->cp_imsg_ccp_pull++;
   1409 			mutex_exit(&cp->cp_pair_lock);
   1410 #endif
   1411 			zmp = msgpullup(mp, len);
   1412 			freemsg(mp);
   1413 			mp = zmp;
   1414 			if (mp == 0) {
   1415 				goto bad;
   1416 			}
   1417 		}
   1418 		mutex_enter(&cp->cp_pair_lock);
   1419 		comp_ccp(q, mp, cp, B_TRUE);
   1420 		mutex_exit(&cp->cp_pair_lock);
   1421 	} else if ((cp->cp_flags & (CCP_ISUP | CCP_DECOMP_RUN | CCP_ERR)) ==
   1422 	    (CCP_ISUP | CCP_DECOMP_RUN) && cp->cp_rstate != NULL) {
   1423 		int	rv;
   1424 
   1425 		if ((proto == PPP_COMP) || (proto == PPP_COMPFRAG)) {
   1426 			rv = (*cp->cp_rcomp->decompress)(cp->cp_rstate, &mp);
   1427 			switch (rv) {
   1428 			case DECOMP_OK:
   1429 				break;
   1430 			case DECOMP_ERROR:
   1431 				cp->cp_flags |= CCP_ERROR;
   1432 				mutex_enter(&cp->cp_pair_lock);
   1433 				++cp->cp_stats.ppp_ierrors;
   1434 				mutex_exit(&cp->cp_pair_lock);
   1435 				(void) putnextctl1(q, M_CTL, PPPCTL_IERROR);
   1436 				break;
   1437 			case DECOMP_FATALERROR:
   1438 				cp->cp_flags |= CCP_FATALERROR;
   1439 				mutex_enter(&cp->cp_pair_lock);
   1440 				++cp->cp_stats.ppp_ierrors;
   1441 				mutex_exit(&cp->cp_pair_lock);
   1442 				(void) putnextctl1(q, M_CTL, PPPCTL_IERROR);
   1443 				break;
   1444 			}
   1445 			if (mp == NULL) {
   1446 				/* Decompress failed; data are gone. */
   1447 				return (NULL);
   1448 			}
   1449 		} else {
   1450 			/*
   1451 			 * For RFCs 1977 and 1979 (BSD Compress and Deflate),
   1452 			 * the compressor should send incompressible data
   1453 			 * without encapsulation and the receiver must update
   1454 			 * its decompression dictionary as though this data
   1455 			 * were received and decompressed.  This keeps the
   1456 			 * dictionaries in sync.
   1457 			 */
   1458 			rv = (*cp->cp_rcomp->incomp)(cp->cp_rstate, mp);
   1459 			if (rv < 0) {
   1460 				cp->cp_flags |= CCP_FATALERROR;
   1461 				mutex_enter(&cp->cp_pair_lock);
   1462 				++cp->cp_stats.ppp_ierrors;
   1463 				mutex_exit(&cp->cp_pair_lock);
   1464 				(void) putnextctl1(q, M_CTL, PPPCTL_IERROR);
   1465 			}
   1466 		}
   1467 	}
   1468 	/*
   1469 	 * Now do VJ decompression.
   1470 	 */
   1471 	proto = PPP_PROTOCOL(mp->b_rptr);
   1472 	if ((proto == PPP_VJC_COMP) || (proto == PPP_VJC_UNCOMP)) {
   1473 
   1474 		len = msgsize(mp) - PPP_HDRLEN;
   1475 
   1476 		if (!IS_DECOMP_VJC(cp) || (len <= 0)) {
   1477 			goto bad;
   1478 		}
   1479 		/*
   1480 		 * Advance past the ppp header.  Here we assume that the whole
   1481 		 * PPP header is in the first mblk.  (This should be true
   1482 		 * because the above code does pull-ups as necessary on raw
   1483 		 * data, and the decompressor engines all produce large blocks
   1484 		 * on output.)
   1485 		 */
   1486 		np = mp;
   1487 		dp = np->b_rptr + PPP_HDRLEN;
   1488 		if (dp >= mp->b_wptr) {
   1489 			np = np->b_cont;
   1490 			dp = np->b_rptr;
   1491 		}
   1492 		/*
   1493 		 * Make sure we have sufficient contiguous data at this point,
   1494 		 * which in most cases we will always do.
   1495 		 */
   1496 		hlen = (proto == PPP_VJC_COMP) ? MAX_VJHDR : MAX_TCPIPHLEN;
   1497 		if (hlen > len) {
   1498 			hlen = len;
   1499 		}
   1500 		if ((np->b_wptr < dp + hlen) || DB_REF(np) > 1) {
   1501 #ifdef SPC_DEBUG
   1502 			mutex_enter(&cp->cp_pair_lock);
   1503 			cp->cp_imsg_vj_pull++;
   1504 			mutex_exit(&cp->cp_pair_lock);
   1505 #endif
   1506 			zmp = msgpullup(mp, hlen + PPP_HDRLEN);
   1507 			freemsg(mp);
   1508 			mp = zmp;
   1509 			if (mp == NULL) {
   1510 				goto bad;
   1511 			}
   1512 			np = mp;
   1513 			dp = np->b_rptr + PPP_HDRLEN;
   1514 		}
   1515 
   1516 		if (proto == PPP_VJC_COMP) {
   1517 			uchar_t		*iphdr;
   1518 			int		vjlen;
   1519 			uint_t		iphlen;
   1520 			int		errcnt;
   1521 
   1522 			/*
   1523 			 * Decompress VJ-compressed packet.  First
   1524 			 * reset compressor if an input error has
   1525 			 * occurred.  (No need to lock statistics
   1526 			 * structure for read of a single word.)
   1527 			 */
   1528 			errcnt = cp->cp_stats.ppp_ierrors;
   1529 			if (errcnt != cp->cp_vj_last_ierrors) {
   1530 				cp->cp_vj_last_ierrors = errcnt;
   1531 				vj_uncompress_err(&cp->cp_vj);
   1532 			}
   1533 
   1534 			vjlen = vj_uncompress_tcp(dp, np->b_wptr - dp, len,
   1535 			    &cp->cp_vj, &iphdr, &iphlen);
   1536 
   1537 			if (vjlen < 0 || iphlen == 0) {
   1538 				/*
   1539 				 * so we don't reset next time
   1540 				 */
   1541 				mutex_enter(&cp->cp_pair_lock);
   1542 				++cp->cp_vj_last_ierrors;
   1543 				mutex_exit(&cp->cp_pair_lock);
   1544 				goto bad;
   1545 			}
   1546 			/*
   1547 			 * drop ppp and vj headers off
   1548 			 */
   1549 			if (mp != np) {
   1550 				freeb(mp);
   1551 				mp = np;
   1552 			}
   1553 			mp->b_rptr = dp + vjlen;
   1554 			/*
   1555 			 * allocate a new mblk for the ppp and
   1556 			 * ip headers
   1557 			 */
   1558 			np = allocb(iphlen + PPP_HDRLEN, BPRI_MED);
   1559 			if (np == NULL)
   1560 				goto bad;
   1561 			dp = np->b_rptr;
   1562 			/*
   1563 			 * reconstruct PPP header
   1564 			 */
   1565 			dp[0] = PPP_ALLSTATIONS;
   1566 			dp[1] = PPP_UI;
   1567 			dp[2] = PPP_IP >> 8;
   1568 			dp[3] = PPP_IP;
   1569 			/*
   1570 			 * prepend mblk with reconstructed TCP/IP header.
   1571 			 */
   1572 			bcopy((caddr_t)iphdr, (caddr_t)dp + PPP_HDRLEN, iphlen);
   1573 			np->b_wptr = dp + iphlen + PPP_HDRLEN;
   1574 			np->b_cont = mp;
   1575 			mp = np;
   1576 		} else {
   1577 			/*
   1578 			 * "Decompress" a VJ-uncompressed packet.
   1579 			 */
   1580 			mutex_enter(&cp->cp_pair_lock);
   1581 			cp->cp_vj_last_ierrors = cp->cp_stats.ppp_ierrors;
   1582 			mutex_exit(&cp->cp_pair_lock);
   1583 			if (!vj_uncompress_uncomp(dp, hlen, &cp->cp_vj)) {
   1584 				/*
   1585 				 * don't need to reset next time
   1586 				 */
   1587 				mutex_enter(&cp->cp_pair_lock);
   1588 				++cp->cp_vj_last_ierrors;
   1589 				mutex_exit(&cp->cp_pair_lock);
   1590 				goto bad;
   1591 			}
   1592 			/*
   1593 			 * fix up the PPP protocol field
   1594 			 */
   1595 			mp->b_rptr[3] = PPP_IP;
   1596 		}
   1597 	}
   1598 	CPDEBUG((DBGSTART "recv (%ld bytes) flags=0x%b\n",
   1599 	    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1), msgsize(mp),
   1600 	    cp->cp_flags, CP_FLAGSSTR));
   1601 	return (mp);
   1602 
   1603 bad:
   1604 	if (mp != 0) {
   1605 		freemsg(mp);
   1606 	}
   1607 	mutex_enter(&cp->cp_pair_lock);
   1608 	cp->cp_stats.ppp_ierrors++;
   1609 	mutex_exit(&cp->cp_pair_lock);
   1610 	(void) putnextctl1(q, M_CTL, PPPCTL_IERROR);
   1611 	return (NULL);
   1612 }
   1613 
   1614 /*
   1615  * comp_ccp()
   1616  *
   1617  * Description:
   1618  *    Called by spppcomp_outpkt and spppcomp_inpkt to handle a CCP
   1619  *    negotiation packet being sent or received.  Here all the data in
   1620  *    the packet is in a single mbuf.
   1621  *
   1622  *	Global state is updated.  Must be called with mutex held.
   1623  */
   1624 /* ARGSUSED */
   1625 static void
   1626 comp_ccp(queue_t *q, mblk_t *mp, sppp_comp_t *cp, boolean_t rcvd)
   1627 {
   1628 	int	len;
   1629 	int	clen;
   1630 	uchar_t	*dp;
   1631 
   1632 	len = msgsize(mp);
   1633 	if (len < PPP_HDRLEN + CCP_HDRLEN) {
   1634 		return;
   1635 	}
   1636 	dp = mp->b_rptr + PPP_HDRLEN;
   1637 
   1638 	len -= PPP_HDRLEN;
   1639 	clen = CCP_LENGTH(dp);
   1640 	if (clen > len) {
   1641 		return;
   1642 	}
   1643 
   1644 	CPDEBUG((DBGSTART "CCP code=%d flags=0x%b\n",
   1645 	    (IS_CP_HASUNIT(cp) ? cp->cp_unit : -1), CCP_CODE(dp),
   1646 	    cp->cp_flags, CP_FLAGSSTR));
   1647 	switch (CCP_CODE(dp)) {
   1648 	case CCP_CONFREQ:
   1649 	case CCP_TERMREQ:
   1650 	case CCP_TERMACK:
   1651 		cp->cp_flags &= ~CCP_ISUP;
   1652 		break;
   1653 	case CCP_CONFACK:
   1654 		if ((cp->cp_flags & (CCP_ISOPEN | CCP_ISUP)) == CCP_ISOPEN &&
   1655 		    clen >= CCP_HDRLEN + CCP_OPT_MINLEN &&
   1656 		    clen >= CCP_HDRLEN + CCP_OPT_LENGTH(dp + CCP_HDRLEN)) {
   1657 
   1658 			int	rc;
   1659 
   1660 			if (!rcvd) {
   1661 				rc = (*cp->cp_xcomp->comp_init)(cp->cp_xstate,
   1662 				    dp + CCP_HDRLEN, clen - CCP_HDRLEN,
   1663 				    cp->cp_unit, 0,
   1664 				    IS_CP_KDEBUG(cp) | ALG_DEBUG);
   1665 
   1666 				if (cp->cp_xstate != NULL && rc != 0) {
   1667 					cp->cp_flags |= CCP_COMP_RUN;
   1668 				}
   1669 			} else {
   1670 				rc = (*cp->cp_rcomp->decomp_init)(cp->
   1671 				    cp_rstate, dp + CCP_HDRLEN,
   1672 				    clen - CCP_HDRLEN, cp->cp_unit, 0,
   1673 				    cp->cp_mru,
   1674 				    IS_CP_KDEBUG(cp) | ALG_DEBUG);
   1675 
   1676 				if (cp->cp_rstate != NULL && rc != 0) {
   1677 					cp->cp_flags &= ~CCP_ERR;
   1678 					cp->cp_flags |= CCP_DECOMP_RUN;
   1679 				}
   1680 			}
   1681 		}
   1682 		break;
   1683 	case CCP_RESETACK:
   1684 		if (IS_CCP_ISUP(cp)) {
   1685 			if (!rcvd) {
   1686 				if (cp->cp_xstate != NULL &&
   1687 				    IS_CCP_COMP_RUN(cp)) {
   1688 					(*cp->cp_xcomp->comp_reset)(cp->
   1689 					    cp_xstate);
   1690 				}
   1691 			} else {
   1692 				if (cp->cp_rstate != NULL &&
   1693 				    IS_CCP_DECOMP_RUN(cp)) {
   1694 					(*cp->cp_rcomp->decomp_reset)(cp->
   1695 					    cp_rstate);
   1696 					cp->cp_flags &= ~CCP_ERROR;
   1697 				}
   1698 			}
   1699 		}
   1700 		break;
   1701 	}
   1702 }
   1703 
   1704 /*
   1705  * spppcomp_kstat_update()
   1706  *
   1707  * Description:
   1708  *    Update per-unit kstat statistics.
   1709  */
   1710 static int
   1711 spppcomp_kstat_update(kstat_t *ksp, int rw)
   1712 {
   1713 	sppp_comp_t		*cp = ksp->ks_private;
   1714 	spppcomp_kstats_t	*cpkp;
   1715 	struct vjstat		*sp;
   1716 	struct pppstat64	*psp;
   1717 	struct ppp_comp_stats		csp;
   1718 
   1719 	if (rw == KSTAT_WRITE) {
   1720 		return (EACCES);
   1721 	}
   1722 
   1723 	cpkp = (spppcomp_kstats_t *)ksp->ks_data;
   1724 	bzero((caddr_t)&csp, sizeof (struct ppp_comp_stats));
   1725 
   1726 	mutex_enter(&cp->cp_pair_lock);
   1727 
   1728 	if (cp->cp_xstate != NULL) {
   1729 		(*cp->cp_xcomp->comp_stat)(cp->cp_xstate, &csp.c);
   1730 	}
   1731 	if (cp->cp_rstate != NULL) {
   1732 		(*cp->cp_rcomp->decomp_stat)(cp->cp_rstate, &csp.d);
   1733 	}
   1734 
   1735 	sp = &cp->cp_vj.stats;
   1736 
   1737 	cpkp->vj_out_pkts.value.ui32		= sp->vjs_packets;
   1738 	cpkp->vj_out_pkts_comp.value.ui32	= sp->vjs_compressed;
   1739 	cpkp->vj_cs_searches.value.ui32		= sp->vjs_searches;
   1740 	cpkp->vj_cs_misses.value.ui32		= sp->vjs_misses;
   1741 	cpkp->vj_in_pkts_uncomp.value.ui32	= sp->vjs_uncompressedin;
   1742 	cpkp->vj_in_pkts_comp.value.ui32	= sp->vjs_compressedin;
   1743 	cpkp->vj_in_error.value.ui32		= sp->vjs_errorin;
   1744 	cpkp->vj_in_tossed.value.ui32		= sp->vjs_tossed;
   1745 
   1746 	psp = &cp->cp_stats;
   1747 
   1748 	cpkp->out_bytes.value.ui64		= psp->ppp_obytes;
   1749 	cpkp->out_pkts.value.ui64		= psp->ppp_opackets;
   1750 	cpkp->out_errors.value.ui64		= psp->ppp_oerrors;
   1751 	cpkp->out_errors_low.value.ui32		= cp->cp_oerr_low;
   1752 	cpkp->out_uncomp_bytes.value.ui32	= csp.c.unc_bytes;
   1753 	cpkp->out_uncomp_pkts.value.ui32	= csp.c.unc_packets;
   1754 	cpkp->out_comp_bytes.value.ui32		= csp.c.comp_bytes;
   1755 	cpkp->out_comp_pkts.value.ui32		= csp.c.comp_packets;
   1756 	cpkp->out_incomp_bytes.value.ui32	= csp.c.inc_bytes;
   1757 	cpkp->out_incomp_pkts.value.ui32	= csp.c.inc_packets;
   1758 
   1759 	cpkp->in_bytes.value.ui64		= psp->ppp_ibytes;
   1760 	cpkp->in_pkts.value.ui64		= psp->ppp_ipackets;
   1761 	cpkp->in_errors.value.ui64		= psp->ppp_ierrors;
   1762 	cpkp->in_errors_low.value.ui32		= cp->cp_ierr_low;
   1763 	cpkp->in_uncomp_bytes.value.ui32	= csp.d.unc_bytes;
   1764 	cpkp->in_uncomp_pkts.value.ui32		= csp.d.unc_packets;
   1765 	cpkp->in_comp_bytes.value.ui32		= csp.d.comp_bytes;
   1766 	cpkp->in_comp_pkts.value.ui32		= csp.d.comp_packets;
   1767 	cpkp->in_incomp_bytes.value.ui32	= csp.d.inc_bytes;
   1768 	cpkp->in_incomp_pkts.value.ui32		= csp.d.inc_packets;
   1769 #ifdef SPC_DEBUG
   1770 	cpkp->in_msg_ccp_pulledup.value.ui32	= cp->cp_imsg_ccp_pull;
   1771 	cpkp->in_msg_vj_pulledup.value.ui32	= cp->cp_imsg_vj_pull;
   1772 	cpkp->out_msg_pulledup.value.ui32	= cp->cp_omsg_pull;
   1773 	cpkp->out_msg_copied.value.ui32		= cp->cp_omsg_dcopy;
   1774 	cpkp->out_queued.value.ui32		= cp->cp_out_queued;
   1775 	cpkp->out_handled.value.ui32		= cp->cp_out_handled;
   1776 	cpkp->in_queued.value.ui32		= cp->cp_in_queued;
   1777 	cpkp->in_handled.value.ui32		= cp->cp_in_handled;
   1778 #endif
   1779 	mutex_exit(&cp->cp_pair_lock);
   1780 	return (0);
   1781 }
   1782