xref: /illumos-gate/usr/src/uts/common/io/dld/dld_str.c (revision b76c1459)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * Data-Link Driver
28  */
29 
30 #include	<inet/common.h>
31 #include	<sys/strsubr.h>
32 #include	<sys/stropts.h>
33 #include	<sys/strsun.h>
34 #include	<sys/vlan.h>
35 #include	<sys/dld_impl.h>
36 #include	<sys/cpuvar.h>
37 #include	<sys/callb.h>
38 #include	<sys/list.h>
39 #include	<sys/mac_client.h>
40 #include	<sys/mac_client_priv.h>
41 
42 static int	str_constructor(void *, void *, int);
43 static void	str_destructor(void *, void *);
44 static mblk_t	*str_unitdata_ind(dld_str_t *, mblk_t *, boolean_t);
45 static void	str_notify_promisc_on_phys(dld_str_t *);
46 static void	str_notify_promisc_off_phys(dld_str_t *);
47 static void	str_notify_phys_addr(dld_str_t *, const uint8_t *);
48 static void	str_notify_link_up(dld_str_t *);
49 static void	str_notify_link_down(dld_str_t *);
50 static void	str_notify_capab_reneg(dld_str_t *);
51 static void	str_notify_speed(dld_str_t *, uint32_t);
52 
53 static void	ioc_native(dld_str_t *,  mblk_t *);
54 static void	ioc_margin(dld_str_t *, mblk_t *);
55 static void	ioc_raw(dld_str_t *, mblk_t *);
56 static void	ioc_fast(dld_str_t *,  mblk_t *);
57 static void	ioc(dld_str_t *, mblk_t *);
58 static void	dld_ioc(dld_str_t *, mblk_t *);
59 static void	dld_wput_nondata(dld_str_t *, mblk_t *);
60 
61 static void	str_mdata_raw_put(dld_str_t *, mblk_t *);
62 static mblk_t	*i_dld_ether_header_update_tag(mblk_t *, uint_t, uint16_t,
63     link_tagmode_t);
64 static mblk_t	*i_dld_ether_header_strip_tag(mblk_t *);
65 
66 static uint32_t		str_count;
67 static kmem_cache_t	*str_cachep;
68 static mod_hash_t	*str_hashp;
69 
70 #define	STR_HASHSZ		64
71 #define	STR_HASH_KEY(key)	((mod_hash_key_t)(uintptr_t)(key))
72 
73 #define	dld_taskq	system_taskq
74 
75 static kmutex_t		dld_taskq_lock;
76 static kcondvar_t	dld_taskq_cv;
77 static list_t		dld_taskq_list;		/* List of dld_str_t */
78 boolean_t		dld_taskq_quit;
79 boolean_t		dld_taskq_done;
80 
81 static void		dld_taskq_dispatch(void);
82 
83 /*
84  * Some notes on entry points, flow-control, queueing.
85  *
86  * This driver exports the traditional STREAMS put entry point as well as
87  * the non-STREAMS fast-path transmit routine which is provided to IP via
88  * the DL_CAPAB_POLL negotiation.  The put procedure handles all control
89  * and data operations, while the fast-path routine deals only with M_DATA
90  * fast-path packets.  Regardless of the entry point, all outbound packets
91  * will end up in DLD_TX(), where they will be delivered to the MAC layer.
92  *
93  * The transmit logic operates in the following way: All packets coming
94  * into DLD will be sent to the MAC layer through DLD_TX(). Flow-control
95  * happens when the MAC layer indicates the packets couldn't be
96  * transmitted due to 1) lack of resources (e.g. running out of
97  * descriptors),  or 2) reaching the allowed bandwidth limit for this
98  * particular flow. The indication comes in the form of a Tx cookie that
99  * identifies the blocked ring. In such case, DLD will place a
100  * dummy message on its write-side STREAMS queue so that the queue is
101  * marked as "full". Any subsequent packets arriving at the driver will
102  * still be sent to the MAC layer where it either gets queued in the Tx
103  * SRS or discarded it if queue limit is exceeded. The write-side STREAMS
104  * queue gets enabled when MAC layer notifies DLD through MAC_NOTE_TX.
105  * When the write service procedure runs, it will remove the dummy
106  * message from the write-side STREAMS queue; in effect this will trigger
107  * backenabling. The sizes of q_hiwat and q_lowat are set to 1 and 0,
108  * respectively, due to the above reasons.
109  *
110  * All non-data operations, both DLPI and ioctls are single threaded on a per
111  * dld_str_t endpoint. This is done using a taskq so that the control operation
112  * has kernel context and can cv_wait for resources. In addition all set type
113  * operations that involve mac level state modification are serialized on a
114  * per mac end point using the perimeter mechanism provided by the mac layer.
115  * This serializes all mac clients trying to modify a single mac end point over
116  * the entire sequence of mac calls made by that client as an atomic unit. The
117  * mac framework locking is described in mac.c. A critical element is that
118  * DLD/DLS does not hold any locks across the mac perimeter.
119  *
120  * dld_finddevinfo() returns the dev_info_t * corresponding to a particular
121  * dev_t. It searches str_hashp (a table of dld_str_t's) for streams that
122  * match dev_t. If a stream is found and it is attached, its dev_info_t *
123  * is returned. If the mac handle is non-null, it can be safely accessed
124  * below. The mac handle won't be freed until the mac_unregister which
125  * won't happen until the driver detaches. The DDI framework ensures that
126  * the detach won't happen while a getinfo is in progress.
127  */
128 typedef struct i_dld_str_state_s {
129 	major_t		ds_major;
130 	minor_t		ds_minor;
131 	dev_info_t	*ds_dip;
132 } i_dld_str_state_t;
133 
134 /* ARGSUSED */
135 static uint_t
136 i_dld_str_walker(mod_hash_key_t key, mod_hash_val_t *val, void *arg)
137 {
138 	i_dld_str_state_t	*statep = arg;
139 	dld_str_t		*dsp = (dld_str_t *)val;
140 	mac_handle_t		mh;
141 
142 	if (statep->ds_major != dsp->ds_major)
143 		return (MH_WALK_CONTINUE);
144 
145 	ASSERT(statep->ds_minor != 0);
146 	mh = dsp->ds_mh;
147 
148 	if (statep->ds_minor == dsp->ds_minor) {
149 		/*
150 		 * Clone: a clone minor is unique. we can terminate the
151 		 * walk if we find a matching stream -- even if we fail
152 		 * to obtain the devinfo.
153 		 */
154 		if (mh != NULL)
155 			statep->ds_dip = mac_devinfo_get(mh);
156 		return (MH_WALK_TERMINATE);
157 	}
158 	return (MH_WALK_CONTINUE);
159 }
160 
161 static dev_info_t *
162 dld_finddevinfo(dev_t dev)
163 {
164 	dev_info_t		*dip;
165 	i_dld_str_state_t	state;
166 
167 	if (getminor(dev) == 0)
168 		return (NULL);
169 
170 	/*
171 	 * See if it's a minor node of a link
172 	 */
173 	if ((dip = dls_link_devinfo(dev)) != NULL)
174 		return (dip);
175 
176 	state.ds_minor = getminor(dev);
177 	state.ds_major = getmajor(dev);
178 	state.ds_dip = NULL;
179 
180 	mod_hash_walk(str_hashp, i_dld_str_walker, &state);
181 	return (state.ds_dip);
182 }
183 
184 /*
185  * devo_getinfo: getinfo(9e)
186  */
187 /*ARGSUSED*/
188 int
189 dld_getinfo(dev_info_t *dip, ddi_info_cmd_t cmd, void *arg, void **resp)
190 {
191 	dev_info_t	*devinfo;
192 	minor_t		minor = getminor((dev_t)arg);
193 	int		rc = DDI_FAILURE;
194 
195 	switch (cmd) {
196 	case DDI_INFO_DEVT2DEVINFO:
197 		if ((devinfo = dld_finddevinfo((dev_t)arg)) != NULL) {
198 			*(dev_info_t **)resp = devinfo;
199 			rc = DDI_SUCCESS;
200 		}
201 		break;
202 	case DDI_INFO_DEVT2INSTANCE:
203 		if (minor > 0 && minor <= DLS_MAX_MINOR) {
204 			*resp = (void *)(uintptr_t)DLS_MINOR2INST(minor);
205 			rc = DDI_SUCCESS;
206 		} else if (minor > DLS_MAX_MINOR &&
207 		    (devinfo = dld_finddevinfo((dev_t)arg)) != NULL) {
208 			*resp = (void *)(uintptr_t)ddi_get_instance(devinfo);
209 			rc = DDI_SUCCESS;
210 		}
211 		break;
212 	}
213 	return (rc);
214 }
215 
216 void *
217 dld_str_private(queue_t *q)
218 {
219 	return (((dld_str_t *)(q->q_ptr))->ds_private);
220 }
221 
222 int
223 dld_str_open(queue_t *rq, dev_t *devp, void *private)
224 {
225 	dld_str_t	*dsp;
226 	major_t		major;
227 	minor_t		minor;
228 	int		err;
229 
230 	major = getmajor(*devp);
231 	minor = getminor(*devp);
232 
233 	/*
234 	 * Create a new dld_str_t for the stream. This will grab a new minor
235 	 * number that will be handed back in the cloned dev_t.  Creation may
236 	 * fail if we can't allocate the dummy mblk used for flow-control.
237 	 */
238 	dsp = dld_str_create(rq, DLD_DLPI, major,
239 	    ((minor == 0) ? DL_STYLE2 : DL_STYLE1));
240 	if (dsp == NULL)
241 		return (ENOSR);
242 
243 	ASSERT(dsp->ds_dlstate == DL_UNATTACHED);
244 	dsp->ds_private = private;
245 	if (minor != 0) {
246 		/*
247 		 * Style 1 open
248 		 */
249 		if ((err = dld_str_attach(dsp, (t_uscalar_t)minor - 1)) != 0)
250 			goto failed;
251 
252 		ASSERT(dsp->ds_dlstate == DL_UNBOUND);
253 	} else {
254 		(void) qassociate(rq, -1);
255 	}
256 
257 	/*
258 	 * Enable the queue srv(9e) routine.
259 	 */
260 	qprocson(rq);
261 
262 	/*
263 	 * Construct a cloned dev_t to hand back.
264 	 */
265 	*devp = makedevice(getmajor(*devp), dsp->ds_minor);
266 	return (0);
267 
268 failed:
269 	dld_str_destroy(dsp);
270 	return (err);
271 }
272 
273 int
274 dld_str_close(queue_t *rq)
275 {
276 	dld_str_t	*dsp = rq->q_ptr;
277 
278 	/*
279 	 * All modules on top have been popped off. So there can't be any
280 	 * threads from the top.
281 	 */
282 	ASSERT(dsp->ds_datathr_cnt == 0);
283 
284 	/*
285 	 * Wait until pending DLPI requests are processed.
286 	 */
287 	mutex_enter(&dsp->ds_lock);
288 	while (dsp->ds_dlpi_pending)
289 		cv_wait(&dsp->ds_dlpi_pending_cv, &dsp->ds_lock);
290 	mutex_exit(&dsp->ds_lock);
291 
292 
293 	/*
294 	 * This stream was open to a provider node. Check to see
295 	 * if it has been cleanly shut down.
296 	 */
297 	if (dsp->ds_dlstate != DL_UNATTACHED) {
298 		/*
299 		 * The stream is either open to a style 1 provider or
300 		 * this is not clean shutdown. Detach from the PPA.
301 		 * (This is still ok even in the style 1 case).
302 		 */
303 		dld_str_detach(dsp);
304 	}
305 
306 	dld_str_destroy(dsp);
307 	return (0);
308 }
309 
310 /*
311  * qi_qopen: open(9e)
312  */
313 /*ARGSUSED*/
314 int
315 dld_open(queue_t *rq, dev_t *devp, int flag, int sflag, cred_t *credp)
316 {
317 	if (sflag == MODOPEN)
318 		return (ENOTSUP);
319 
320 	/*
321 	 * This is a cloning driver and therefore each queue should only
322 	 * ever get opened once.
323 	 */
324 	if (rq->q_ptr != NULL)
325 		return (EBUSY);
326 
327 	return (dld_str_open(rq, devp, NULL));
328 }
329 
330 /*
331  * qi_qclose: close(9e)
332  */
333 int
334 dld_close(queue_t *rq)
335 {
336 	/*
337 	 * Disable the queue srv(9e) routine.
338 	 */
339 	qprocsoff(rq);
340 
341 	return (dld_str_close(rq));
342 }
343 
344 /*
345  * qi_qputp: put(9e)
346  */
347 void
348 dld_wput(queue_t *wq, mblk_t *mp)
349 {
350 	dld_str_t *dsp = (dld_str_t *)wq->q_ptr;
351 	dld_str_mode_t	mode;
352 
353 	switch (DB_TYPE(mp)) {
354 	case M_DATA:
355 		mutex_enter(&dsp->ds_lock);
356 		mode = dsp->ds_mode;
357 		if ((dsp->ds_dlstate != DL_IDLE) ||
358 		    (mode != DLD_FASTPATH && mode != DLD_RAW)) {
359 			mutex_exit(&dsp->ds_lock);
360 			freemsg(mp);
361 			break;
362 		}
363 
364 		DLD_DATATHR_INC(dsp);
365 		mutex_exit(&dsp->ds_lock);
366 		if (mode == DLD_FASTPATH) {
367 			if (dsp->ds_mip->mi_media == DL_ETHER &&
368 			    (MBLKL(mp) < sizeof (struct ether_header))) {
369 				freemsg(mp);
370 			} else {
371 				(void) str_mdata_fastpath_put(dsp, mp, 0, 0);
372 			}
373 		} else {
374 			str_mdata_raw_put(dsp, mp);
375 		}
376 		DLD_DATATHR_DCR(dsp);
377 		break;
378 	case M_PROTO:
379 	case M_PCPROTO: {
380 		t_uscalar_t	prim;
381 
382 		if (MBLKL(mp) < sizeof (t_uscalar_t))
383 			break;
384 
385 		prim = ((union DL_primitives *)mp->b_rptr)->dl_primitive;
386 
387 		if (prim == DL_UNITDATA_REQ) {
388 			proto_unitdata_req(dsp, mp);
389 		} else {
390 			dld_wput_nondata(dsp, mp);
391 		}
392 		break;
393 	}
394 
395 	case M_IOCTL:
396 		dld_wput_nondata(dsp, mp);
397 		break;
398 
399 	case M_FLUSH:
400 		if (*mp->b_rptr & FLUSHW) {
401 			DLD_CLRQFULL(dsp);
402 			*mp->b_rptr &= ~FLUSHW;
403 		}
404 
405 		if (*mp->b_rptr & FLUSHR) {
406 			qreply(wq, mp);
407 		} else {
408 			freemsg(mp);
409 		}
410 		break;
411 
412 	default:
413 		freemsg(mp);
414 		break;
415 	}
416 }
417 
418 /*
419  * qi_srvp: srv(9e)
420  */
421 void
422 dld_wsrv(queue_t *wq)
423 {
424 	dld_str_t	*dsp = wq->q_ptr;
425 
426 	DLD_CLRQFULL(dsp);
427 }
428 
429 void
430 dld_init_ops(struct dev_ops *ops, const char *name)
431 {
432 	struct streamtab *stream;
433 	struct qinit *rq, *wq;
434 	struct module_info *modinfo;
435 
436 	modinfo = kmem_zalloc(sizeof (struct module_info), KM_SLEEP);
437 	modinfo->mi_idname = kmem_zalloc(FMNAMESZ, KM_SLEEP);
438 	(void) snprintf(modinfo->mi_idname, FMNAMESZ, "%s", name);
439 	modinfo->mi_minpsz = 0;
440 	modinfo->mi_maxpsz = 64*1024;
441 	modinfo->mi_hiwat  = 1;
442 	modinfo->mi_lowat = 0;
443 
444 	rq = kmem_zalloc(sizeof (struct qinit), KM_SLEEP);
445 	rq->qi_qopen = dld_open;
446 	rq->qi_qclose = dld_close;
447 	rq->qi_minfo = modinfo;
448 
449 	wq = kmem_zalloc(sizeof (struct qinit), KM_SLEEP);
450 	wq->qi_putp = (pfi_t)dld_wput;
451 	wq->qi_srvp = (pfi_t)dld_wsrv;
452 	wq->qi_minfo = modinfo;
453 
454 	stream = kmem_zalloc(sizeof (struct streamtab), KM_SLEEP);
455 	stream->st_rdinit = rq;
456 	stream->st_wrinit = wq;
457 	ops->devo_cb_ops->cb_str = stream;
458 
459 	if (ops->devo_getinfo == NULL)
460 		ops->devo_getinfo = &dld_getinfo;
461 }
462 
463 void
464 dld_fini_ops(struct dev_ops *ops)
465 {
466 	struct streamtab *stream;
467 	struct qinit *rq, *wq;
468 	struct module_info *modinfo;
469 
470 	stream = ops->devo_cb_ops->cb_str;
471 	rq = stream->st_rdinit;
472 	wq = stream->st_wrinit;
473 	modinfo = rq->qi_minfo;
474 	ASSERT(wq->qi_minfo == modinfo);
475 
476 	kmem_free(stream, sizeof (struct streamtab));
477 	kmem_free(wq, sizeof (struct qinit));
478 	kmem_free(rq, sizeof (struct qinit));
479 	kmem_free(modinfo->mi_idname, FMNAMESZ);
480 	kmem_free(modinfo, sizeof (struct module_info));
481 }
482 
483 /*
484  * Initialize this module's data structures.
485  */
486 void
487 dld_str_init(void)
488 {
489 	/*
490 	 * Create dld_str_t object cache.
491 	 */
492 	str_cachep = kmem_cache_create("dld_str_cache", sizeof (dld_str_t),
493 	    0, str_constructor, str_destructor, NULL, NULL, NULL, 0);
494 	ASSERT(str_cachep != NULL);
495 
496 	/*
497 	 * Create a hash table for maintaining dld_str_t's.
498 	 * The ds_minor field (the clone minor number) of a dld_str_t
499 	 * is used as a key for this hash table because this number is
500 	 * globally unique (allocated from "dls_minor_arena").
501 	 */
502 	str_hashp = mod_hash_create_idhash("dld_str_hash", STR_HASHSZ,
503 	    mod_hash_null_valdtor);
504 
505 	mutex_init(&dld_taskq_lock, NULL, MUTEX_DRIVER, NULL);
506 	cv_init(&dld_taskq_cv, NULL, CV_DRIVER, NULL);
507 
508 	dld_taskq_quit = B_FALSE;
509 	dld_taskq_done = B_FALSE;
510 	list_create(&dld_taskq_list, sizeof (dld_str_t),
511 	    offsetof(dld_str_t, ds_tqlist));
512 	(void) thread_create(NULL, 0, dld_taskq_dispatch, NULL, 0,
513 	    &p0, TS_RUN, minclsyspri);
514 }
515 
516 /*
517  * Tear down this module's data structures.
518  */
519 int
520 dld_str_fini(void)
521 {
522 	/*
523 	 * Make sure that there are no objects in use.
524 	 */
525 	if (str_count != 0)
526 		return (EBUSY);
527 
528 	/*
529 	 * Ask the dld_taskq thread to quit and wait for it to be done
530 	 */
531 	mutex_enter(&dld_taskq_lock);
532 	dld_taskq_quit = B_TRUE;
533 	cv_signal(&dld_taskq_cv);
534 	while (!dld_taskq_done)
535 		cv_wait(&dld_taskq_cv, &dld_taskq_lock);
536 	mutex_exit(&dld_taskq_lock);
537 	list_destroy(&dld_taskq_list);
538 	/*
539 	 * Destroy object cache.
540 	 */
541 	kmem_cache_destroy(str_cachep);
542 	mod_hash_destroy_idhash(str_hashp);
543 	return (0);
544 }
545 
546 /*
547  * Create a new dld_str_t object.
548  */
549 dld_str_t *
550 dld_str_create(queue_t *rq, uint_t type, major_t major, t_uscalar_t style)
551 {
552 	dld_str_t	*dsp;
553 	int		err;
554 
555 	/*
556 	 * Allocate an object from the cache.
557 	 */
558 	atomic_add_32(&str_count, 1);
559 	dsp = kmem_cache_alloc(str_cachep, KM_SLEEP);
560 
561 	/*
562 	 * Allocate the dummy mblk for flow-control.
563 	 */
564 	dsp->ds_tx_flow_mp = allocb(1, BPRI_HI);
565 	if (dsp->ds_tx_flow_mp == NULL) {
566 		kmem_cache_free(str_cachep, dsp);
567 		atomic_add_32(&str_count, -1);
568 		return (NULL);
569 	}
570 	dsp->ds_type = type;
571 	dsp->ds_major = major;
572 	dsp->ds_style = style;
573 
574 	/*
575 	 * Initialize the queue pointers.
576 	 */
577 	ASSERT(RD(rq) == rq);
578 	dsp->ds_rq = rq;
579 	dsp->ds_wq = WR(rq);
580 	rq->q_ptr = WR(rq)->q_ptr = (void *)dsp;
581 
582 	/*
583 	 * We want explicit control over our write-side STREAMS queue
584 	 * where the dummy mblk gets added/removed for flow-control.
585 	 */
586 	noenable(WR(rq));
587 
588 	err = mod_hash_insert(str_hashp, STR_HASH_KEY(dsp->ds_minor),
589 	    (mod_hash_val_t)dsp);
590 	ASSERT(err == 0);
591 	return (dsp);
592 }
593 
594 /*
595  * Destroy a dld_str_t object.
596  */
597 void
598 dld_str_destroy(dld_str_t *dsp)
599 {
600 	queue_t		*rq;
601 	queue_t		*wq;
602 	mod_hash_val_t	val;
603 
604 	/*
605 	 * Clear the queue pointers.
606 	 */
607 	rq = dsp->ds_rq;
608 	wq = dsp->ds_wq;
609 	ASSERT(wq == WR(rq));
610 	rq->q_ptr = wq->q_ptr = NULL;
611 	dsp->ds_rq = dsp->ds_wq = NULL;
612 
613 	ASSERT(dsp->ds_dlstate == DL_UNATTACHED);
614 	ASSERT(dsp->ds_sap == 0);
615 	ASSERT(dsp->ds_mh == NULL);
616 	ASSERT(dsp->ds_mch == NULL);
617 	ASSERT(dsp->ds_promisc == 0);
618 	ASSERT(dsp->ds_mph == NULL);
619 	ASSERT(dsp->ds_mip == NULL);
620 	ASSERT(dsp->ds_mnh == NULL);
621 
622 	ASSERT(dsp->ds_polling == B_FALSE);
623 	ASSERT(dsp->ds_direct == B_FALSE);
624 	ASSERT(dsp->ds_lso == B_FALSE);
625 	ASSERT(dsp->ds_lso_max == 0);
626 	ASSERT(dsp->ds_passivestate != DLD_ACTIVE);
627 
628 	/*
629 	 * Reinitialize all the flags.
630 	 */
631 	dsp->ds_notifications = 0;
632 	dsp->ds_passivestate = DLD_UNINITIALIZED;
633 	dsp->ds_mode = DLD_UNITDATA;
634 	dsp->ds_native = B_FALSE;
635 
636 	ASSERT(dsp->ds_datathr_cnt == 0);
637 	ASSERT(dsp->ds_pending_head == NULL);
638 	ASSERT(dsp->ds_pending_tail == NULL);
639 	ASSERT(!dsp->ds_dlpi_pending);
640 
641 	ASSERT(dsp->ds_dlp == NULL);
642 	ASSERT(dsp->ds_dmap == NULL);
643 	ASSERT(dsp->ds_rx == NULL);
644 	ASSERT(dsp->ds_rx_arg == NULL);
645 	ASSERT(dsp->ds_next == NULL);
646 	ASSERT(dsp->ds_head == NULL);
647 
648 	/*
649 	 * Free the dummy mblk if exists.
650 	 */
651 	if (dsp->ds_tx_flow_mp != NULL) {
652 		freeb(dsp->ds_tx_flow_mp);
653 		dsp->ds_tx_flow_mp = NULL;
654 	}
655 
656 	(void) mod_hash_remove(str_hashp, STR_HASH_KEY(dsp->ds_minor), &val);
657 	ASSERT(dsp == (dld_str_t *)val);
658 
659 	/*
660 	 * Free the object back to the cache.
661 	 */
662 	kmem_cache_free(str_cachep, dsp);
663 	atomic_add_32(&str_count, -1);
664 }
665 
666 /*
667  * kmem_cache contructor function: see kmem_cache_create(9f).
668  */
669 /*ARGSUSED*/
670 static int
671 str_constructor(void *buf, void *cdrarg, int kmflags)
672 {
673 	dld_str_t	*dsp = buf;
674 
675 	bzero(buf, sizeof (dld_str_t));
676 
677 	/*
678 	 * Allocate a new minor number.
679 	 */
680 	if ((dsp->ds_minor = mac_minor_hold(kmflags == KM_SLEEP)) == 0)
681 		return (-1);
682 
683 	/*
684 	 * Initialize the DLPI state machine.
685 	 */
686 	dsp->ds_dlstate = DL_UNATTACHED;
687 
688 	mutex_init(&dsp->ds_lock, NULL, MUTEX_DRIVER, NULL);
689 	cv_init(&dsp->ds_datathr_cv, NULL, CV_DRIVER, NULL);
690 	cv_init(&dsp->ds_dlpi_pending_cv, NULL, CV_DRIVER, NULL);
691 
692 	return (0);
693 }
694 
695 /*
696  * kmem_cache destructor function.
697  */
698 /*ARGSUSED*/
699 static void
700 str_destructor(void *buf, void *cdrarg)
701 {
702 	dld_str_t	*dsp = buf;
703 
704 	/*
705 	 * Release the minor number.
706 	 */
707 	mac_minor_rele(dsp->ds_minor);
708 
709 	ASSERT(dsp->ds_tx_flow_mp == NULL);
710 
711 	mutex_destroy(&dsp->ds_lock);
712 	cv_destroy(&dsp->ds_datathr_cv);
713 	cv_destroy(&dsp->ds_dlpi_pending_cv);
714 }
715 
716 /*
717  * Update the priority bits and VID (may need to insert tag if mp points
718  * to an untagged packet.
719  * If vid is VLAN_ID_NONE, use the VID encoded in the packet.
720  */
721 static mblk_t *
722 i_dld_ether_header_update_tag(mblk_t *mp, uint_t pri, uint16_t vid,
723     link_tagmode_t tagmode)
724 {
725 	mblk_t *hmp;
726 	struct ether_vlan_header *evhp;
727 	struct ether_header *ehp;
728 	uint16_t old_tci = 0;
729 	size_t len;
730 
731 	ASSERT(pri != 0 || vid != VLAN_ID_NONE);
732 
733 	evhp = (struct ether_vlan_header *)mp->b_rptr;
734 	if (ntohs(evhp->ether_tpid) == ETHERTYPE_VLAN) {
735 		/*
736 		 * Tagged packet, update the priority bits.
737 		 */
738 		len = sizeof (struct ether_vlan_header);
739 
740 		if ((DB_REF(mp) > 1) || (MBLKL(mp) < len)) {
741 			/*
742 			 * In case some drivers only check the db_ref
743 			 * count of the first mblk, we pullup the
744 			 * message into a single mblk.
745 			 */
746 			hmp = msgpullup(mp, -1);
747 			if ((hmp == NULL) || (MBLKL(hmp) < len)) {
748 				freemsg(hmp);
749 				return (NULL);
750 			} else {
751 				freemsg(mp);
752 				mp = hmp;
753 			}
754 		}
755 
756 		evhp = (struct ether_vlan_header *)mp->b_rptr;
757 		old_tci = ntohs(evhp->ether_tci);
758 	} else {
759 		/*
760 		 * Untagged packet.  Two factors will cause us to insert a
761 		 * VLAN header:
762 		 * - This is a VLAN link (vid is specified)
763 		 * - The link supports user priority tagging and the priority
764 		 *   is non-zero.
765 		 */
766 		if (vid == VLAN_ID_NONE && tagmode == LINK_TAGMODE_VLANONLY)
767 			return (mp);
768 
769 		hmp = allocb(sizeof (struct ether_vlan_header), BPRI_MED);
770 		if (hmp == NULL)
771 			return (NULL);
772 
773 		evhp = (struct ether_vlan_header *)hmp->b_rptr;
774 		ehp = (struct ether_header *)mp->b_rptr;
775 
776 		/*
777 		 * Copy the MAC addresses and typelen
778 		 */
779 		bcopy(ehp, evhp, (ETHERADDRL * 2));
780 		evhp->ether_type = ehp->ether_type;
781 		evhp->ether_tpid = htons(ETHERTYPE_VLAN);
782 
783 		hmp->b_wptr += sizeof (struct ether_vlan_header);
784 		mp->b_rptr += sizeof (struct ether_header);
785 
786 		/*
787 		 * Free the original message if it's now empty. Link the
788 		 * rest of the messages to the header message.
789 		 */
790 		if (MBLKL(mp) == 0) {
791 			hmp->b_cont = mp->b_cont;
792 			freeb(mp);
793 		} else {
794 			hmp->b_cont = mp;
795 		}
796 		mp = hmp;
797 	}
798 
799 	if (pri == 0)
800 		pri = VLAN_PRI(old_tci);
801 	if (vid == VLAN_ID_NONE)
802 		vid = VLAN_ID(old_tci);
803 	evhp->ether_tci = htons(VLAN_TCI(pri, VLAN_CFI(old_tci), vid));
804 	return (mp);
805 }
806 
807 /*
808  * M_DATA put (IP fast-path mode)
809  */
810 mac_tx_cookie_t
811 str_mdata_fastpath_put(dld_str_t *dsp, mblk_t *mp, uintptr_t f_hint,
812     uint16_t flag)
813 {
814 	boolean_t is_ethernet = (dsp->ds_mip->mi_media == DL_ETHER);
815 	mblk_t *newmp;
816 	uint_t pri;
817 	mac_tx_cookie_t cookie;
818 
819 	if (is_ethernet) {
820 		/*
821 		 * Update the priority bits to the assigned priority.
822 		 */
823 		pri = (VLAN_MBLKPRI(mp) == 0) ? dsp->ds_pri : VLAN_MBLKPRI(mp);
824 
825 		if (pri != 0) {
826 			newmp = i_dld_ether_header_update_tag(mp, pri,
827 			    VLAN_ID_NONE, dsp->ds_dlp->dl_tagmode);
828 			if (newmp == NULL)
829 				goto discard;
830 			mp = newmp;
831 		}
832 	}
833 
834 	if ((cookie = DLD_TX(dsp, mp, f_hint, flag)) != NULL) {
835 		DLD_SETQFULL(dsp);
836 	}
837 	return (cookie);
838 
839 discard:
840 	/* TODO: bump kstat? */
841 	freemsg(mp);
842 	return (NULL);
843 }
844 
845 /*
846  * M_DATA put (DLIOCRAW mode)
847  */
848 static void
849 str_mdata_raw_put(dld_str_t *dsp, mblk_t *mp)
850 {
851 	boolean_t is_ethernet = (dsp->ds_mip->mi_media == DL_ETHER);
852 	mblk_t *bp, *newmp;
853 	size_t size;
854 	mac_header_info_t mhi;
855 	uint_t pri, vid, dvid;
856 	uint_t max_sdu;
857 
858 	/*
859 	 * Certain MAC type plugins provide an illusion for raw DLPI
860 	 * consumers.  They pretend that the MAC layer is something that
861 	 * it's not for the benefit of observability tools.  For example,
862 	 * mac_wifi pretends that it's Ethernet for such consumers.
863 	 * Here, unless native mode is enabled, we call into the MAC layer so
864 	 * that this illusion can be maintained.  The plugin will optionally
865 	 * transform the MAC header here into something that can be passed
866 	 * down.  The header goes from raw mode to "cooked" mode.
867 	 */
868 	if (!dsp->ds_native) {
869 		if ((newmp = mac_header_cook(dsp->ds_mh, mp)) == NULL)
870 			goto discard;
871 		mp = newmp;
872 	}
873 
874 	size = MBLKL(mp);
875 
876 	/*
877 	 * Check the packet is not too big and that any remaining
878 	 * fragment list is composed entirely of M_DATA messages. (We
879 	 * know the first fragment was M_DATA otherwise we could not
880 	 * have got here).
881 	 */
882 	for (bp = mp->b_cont; bp != NULL; bp = bp->b_cont) {
883 		if (DB_TYPE(bp) != M_DATA)
884 			goto discard;
885 		size += MBLKL(bp);
886 	}
887 
888 	if (dls_link_header_info(dsp->ds_dlp, mp, &mhi) != 0)
889 		goto discard;
890 
891 	mac_sdu_get(dsp->ds_mh, NULL, &max_sdu);
892 	/*
893 	 * If LSO is enabled, check the size against lso_max. Otherwise,
894 	 * compare the packet size with max_sdu.
895 	 */
896 	max_sdu = dsp->ds_lso ? dsp->ds_lso_max : max_sdu;
897 	if (size > max_sdu + mhi.mhi_hdrsize)
898 		goto discard;
899 
900 	if (is_ethernet) {
901 		dvid = mac_client_vid(dsp->ds_mch);
902 
903 		/*
904 		 * Discard the packet if this is a VLAN stream but the VID in
905 		 * the packet is not correct.
906 		 */
907 		vid = VLAN_ID(mhi.mhi_tci);
908 		if ((dvid != VLAN_ID_NONE) && (vid != VLAN_ID_NONE))
909 			goto discard;
910 
911 		/*
912 		 * Discard the packet if this packet is a tagged packet
913 		 * but both pri and VID are 0.
914 		 */
915 		pri = VLAN_PRI(mhi.mhi_tci);
916 		if (mhi.mhi_istagged && (pri == 0) && (vid == VLAN_ID_NONE))
917 			goto discard;
918 
919 		/*
920 		 * Update the priority bits to the per-stream priority if
921 		 * priority is not set in the packet. Update the VID for
922 		 * packets on a VLAN stream.
923 		 */
924 		pri = (pri == 0) ? dsp->ds_pri : 0;
925 		if ((pri != 0) || (dvid != VLAN_ID_NONE)) {
926 			if ((newmp = i_dld_ether_header_update_tag(mp, pri,
927 			    dvid, dsp->ds_dlp->dl_tagmode)) == NULL) {
928 				goto discard;
929 			}
930 			mp = newmp;
931 		}
932 	}
933 
934 	if (DLD_TX(dsp, mp, 0, 0) != NULL) {
935 		/* Turn on flow-control for dld */
936 		DLD_SETQFULL(dsp);
937 	}
938 	return;
939 
940 discard:
941 	/* TODO: bump kstat? */
942 	freemsg(mp);
943 }
944 
945 /*
946  * Process DL_ATTACH_REQ (style 2) or open(2) (style 1).
947  */
948 int
949 dld_str_attach(dld_str_t *dsp, t_uscalar_t ppa)
950 {
951 	dev_t			dev;
952 	int			err;
953 	const char		*drvname;
954 	mac_perim_handle_t	mph = NULL;
955 	boolean_t		qassociated = B_FALSE;
956 	dls_link_t		*dlp = NULL;
957 	dls_dl_handle_t		ddp = NULL;
958 
959 	if ((drvname = ddi_major_to_name(dsp->ds_major)) == NULL)
960 		return (EINVAL);
961 
962 	if (dsp->ds_style == DL_STYLE2 && ppa > DLS_MAX_PPA)
963 		return (ENOTSUP);
964 
965 	/*
966 	 * /dev node access. This will still be supported for backward
967 	 * compatibility reason.
968 	 */
969 	if ((dsp->ds_style == DL_STYLE2) && (strcmp(drvname, "aggr") != 0) &&
970 	    (strcmp(drvname, "vnic") != 0)) {
971 		if (qassociate(dsp->ds_wq, DLS_PPA2INST(ppa)) != 0)
972 			return (EINVAL);
973 		qassociated = B_TRUE;
974 	}
975 
976 	dev = makedevice(dsp->ds_major, (minor_t)ppa + 1);
977 	if ((err = dls_devnet_hold_by_dev(dev, &ddp)) != 0)
978 		goto failed;
979 
980 	if ((err = mac_perim_enter_by_macname(dls_devnet_mac(ddp), &mph)) != 0)
981 		goto failed;
982 
983 	/*
984 	 * Open a channel.
985 	 */
986 	if ((err = dls_link_hold(dls_devnet_mac(ddp), &dlp)) != 0)
987 		goto failed;
988 
989 	if ((err = dls_open(dlp, ddp, dsp)) != 0)
990 		goto failed;
991 
992 	/*
993 	 * Set the default packet priority.
994 	 */
995 	dsp->ds_pri = 0;
996 
997 	/*
998 	 * Add a notify function so that the we get updates from the MAC.
999 	 */
1000 	dsp->ds_mnh = mac_notify_add(dsp->ds_mh, str_notify, dsp);
1001 	dsp->ds_dlstate = DL_UNBOUND;
1002 	mac_perim_exit(mph);
1003 	return (0);
1004 
1005 failed:
1006 	if (dlp != NULL)
1007 		dls_link_rele(dlp);
1008 	if (mph != NULL)
1009 		mac_perim_exit(mph);
1010 	if (ddp != NULL)
1011 		dls_devnet_rele(ddp);
1012 	if (qassociated)
1013 		(void) qassociate(dsp->ds_wq, -1);
1014 
1015 	return (err);
1016 }
1017 
1018 /*
1019  * Process DL_DETACH_REQ (style 2) or close(2) (style 1). Can also be called
1020  * from close(2) for style 2.
1021  */
1022 void
1023 dld_str_detach(dld_str_t *dsp)
1024 {
1025 	mac_perim_handle_t	mph;
1026 	int			err;
1027 
1028 	ASSERT(dsp->ds_datathr_cnt == 0);
1029 
1030 	mac_perim_enter_by_mh(dsp->ds_mh, &mph);
1031 	/*
1032 	 * Remove the notify function.
1033 	 *
1034 	 * Note that we cannot wait for the notification callback to be removed
1035 	 * since it could cause the deadlock with str_notify() since they both
1036 	 * need the mac perimeter. Continue if we cannot remove the
1037 	 * notification callback right now and wait after we leave the
1038 	 * perimeter.
1039 	 */
1040 	err = mac_notify_remove(dsp->ds_mnh, B_FALSE);
1041 	dsp->ds_mnh = NULL;
1042 
1043 	/*
1044 	 * Disable the capabilities
1045 	 */
1046 	dld_capabilities_disable(dsp);
1047 
1048 	/*
1049 	 * Clear LSO flags.
1050 	 */
1051 	dsp->ds_lso = B_FALSE;
1052 	dsp->ds_lso_max = 0;
1053 
1054 	dls_close(dsp);
1055 	mac_perim_exit(mph);
1056 
1057 	/*
1058 	 * Now we leave the mac perimeter. If mac_notify_remove() failed
1059 	 * because the notification callback was in progress, wait for
1060 	 * it to finish before we proceed.
1061 	 */
1062 	if (err != 0)
1063 		mac_notify_remove_wait(dsp->ds_mh);
1064 
1065 	/*
1066 	 * An unreferenced tagged (non-persistent) vlan gets destroyed
1067 	 * automatically in the call to dls_devnet_rele.
1068 	 */
1069 	dls_devnet_rele(dsp->ds_ddh);
1070 
1071 	dsp->ds_sap = 0;
1072 	dsp->ds_mh = NULL;
1073 	dsp->ds_mch = NULL;
1074 	dsp->ds_mip = NULL;
1075 
1076 	if (dsp->ds_style == DL_STYLE2)
1077 		(void) qassociate(dsp->ds_wq, -1);
1078 
1079 	/*
1080 	 * Re-initialize the DLPI state machine.
1081 	 */
1082 	dsp->ds_dlstate = DL_UNATTACHED;
1083 }
1084 
1085 /*
1086  * This function is only called for VLAN streams. In raw mode, we strip VLAN
1087  * tags before sending packets up to the DLS clients, with the exception of
1088  * special priority tagged packets, in that case, we set the VID to 0.
1089  * mp must be a VLAN tagged packet.
1090  */
1091 static mblk_t *
1092 i_dld_ether_header_strip_tag(mblk_t *mp)
1093 {
1094 	mblk_t *newmp;
1095 	struct ether_vlan_header *evhp;
1096 	uint16_t tci, new_tci;
1097 
1098 	ASSERT(MBLKL(mp) >= sizeof (struct ether_vlan_header));
1099 	if (DB_REF(mp) > 1) {
1100 		newmp = copymsg(mp);
1101 		if (newmp == NULL)
1102 			return (NULL);
1103 		freemsg(mp);
1104 		mp = newmp;
1105 	}
1106 	evhp = (struct ether_vlan_header *)mp->b_rptr;
1107 
1108 	tci = ntohs(evhp->ether_tci);
1109 	if (VLAN_PRI(tci) == 0) {
1110 		/*
1111 		 * Priority is 0, strip the tag.
1112 		 */
1113 		ovbcopy(mp->b_rptr, mp->b_rptr + VLAN_TAGSZ, 2 * ETHERADDRL);
1114 		mp->b_rptr += VLAN_TAGSZ;
1115 	} else {
1116 		/*
1117 		 * Priority is not 0, update the VID to 0.
1118 		 */
1119 		new_tci = VLAN_TCI(VLAN_PRI(tci), VLAN_CFI(tci), VLAN_ID_NONE);
1120 		evhp->ether_tci = htons(new_tci);
1121 	}
1122 	return (mp);
1123 }
1124 
1125 /*
1126  * Raw mode receive function.
1127  */
1128 /*ARGSUSED*/
1129 void
1130 dld_str_rx_raw(void *arg, mac_resource_handle_t mrh, mblk_t *mp,
1131     mac_header_info_t *mhip)
1132 {
1133 	dld_str_t *dsp = (dld_str_t *)arg;
1134 	boolean_t is_ethernet = (dsp->ds_mip->mi_media == DL_ETHER);
1135 	mblk_t *next, *newmp;
1136 
1137 	ASSERT(mp != NULL);
1138 	do {
1139 		/*
1140 		 * Get the pointer to the next packet in the chain and then
1141 		 * clear b_next before the packet gets passed on.
1142 		 */
1143 		next = mp->b_next;
1144 		mp->b_next = NULL;
1145 
1146 		/*
1147 		 * Wind back b_rptr to point at the MAC header.
1148 		 */
1149 		ASSERT(mp->b_rptr >= DB_BASE(mp) + mhip->mhi_hdrsize);
1150 		mp->b_rptr -= mhip->mhi_hdrsize;
1151 
1152 		/*
1153 		 * Certain MAC type plugins provide an illusion for raw
1154 		 * DLPI consumers.  They pretend that the MAC layer is
1155 		 * something that it's not for the benefit of observability
1156 		 * tools.  For example, mac_wifi pretends that it's Ethernet
1157 		 * for such consumers.	Here, unless native mode is enabled,
1158 		 * we call into the MAC layer so that this illusion can be
1159 		 * maintained.	The plugin will optionally transform the MAC
1160 		 * header here into something that can be passed up to raw
1161 		 * consumers.  The header goes from "cooked" mode to raw mode.
1162 		 */
1163 		if (!dsp->ds_native) {
1164 			newmp = mac_header_uncook(dsp->ds_mh, mp);
1165 			if (newmp == NULL) {
1166 				freemsg(mp);
1167 				goto next;
1168 			}
1169 			mp = newmp;
1170 		}
1171 
1172 		/*
1173 		 * Strip the VLAN tag for VLAN streams.
1174 		 */
1175 		if (is_ethernet &&
1176 		    mac_client_vid(dsp->ds_mch) != VLAN_ID_NONE) {
1177 			newmp = i_dld_ether_header_strip_tag(mp);
1178 			if (newmp == NULL) {
1179 				freemsg(mp);
1180 				goto next;
1181 			}
1182 			mp = newmp;
1183 		}
1184 
1185 		/*
1186 		 * Pass the packet on.
1187 		 */
1188 		if (canputnext(dsp->ds_rq))
1189 			putnext(dsp->ds_rq, mp);
1190 		else
1191 			freemsg(mp);
1192 
1193 next:
1194 		/*
1195 		 * Move on to the next packet in the chain.
1196 		 */
1197 		mp = next;
1198 	} while (mp != NULL);
1199 }
1200 
1201 /*
1202  * Fast-path receive function.
1203  */
1204 /*ARGSUSED*/
1205 void
1206 dld_str_rx_fastpath(void *arg, mac_resource_handle_t mrh, mblk_t *mp,
1207     mac_header_info_t *mhip)
1208 {
1209 	dld_str_t *dsp = (dld_str_t *)arg;
1210 	mblk_t *next;
1211 	size_t offset = 0;
1212 
1213 	/*
1214 	 * MAC header stripping rules:
1215 	 *    - Tagged packets:
1216 	 *	a. VLAN streams. Strip the whole VLAN header including the tag.
1217 	 *	b. Physical streams
1218 	 *	- VLAN packets (non-zero VID). The stream must be either a
1219 	 *	  DL_PROMISC_SAP listener or a ETHERTYPE_VLAN listener.
1220 	 *	  Strip the Ethernet header but keep the VLAN header.
1221 	 *	- Special tagged packets (zero VID)
1222 	 *	  * The stream is either a DL_PROMISC_SAP listener or a
1223 	 *	    ETHERTYPE_VLAN listener, strip the Ethernet header but
1224 	 *	    keep the VLAN header.
1225 	 *	  * Otherwise, strip the whole VLAN header.
1226 	 *    - Untagged packets. Strip the whole MAC header.
1227 	 */
1228 	if (mhip->mhi_istagged &&
1229 	    (mac_client_vid(dsp->ds_mch) == VLAN_ID_NONE) &&
1230 	    ((dsp->ds_sap == ETHERTYPE_VLAN) ||
1231 	    (dsp->ds_promisc & DLS_PROMISC_SAP))) {
1232 		offset = VLAN_TAGSZ;
1233 	}
1234 
1235 	ASSERT(mp != NULL);
1236 	do {
1237 		/*
1238 		 * Get the pointer to the next packet in the chain and then
1239 		 * clear b_next before the packet gets passed on.
1240 		 */
1241 		next = mp->b_next;
1242 		mp->b_next = NULL;
1243 
1244 		/*
1245 		 * Wind back b_rptr to point at the VLAN header.
1246 		 */
1247 		ASSERT(mp->b_rptr >= DB_BASE(mp) + offset);
1248 		mp->b_rptr -= offset;
1249 
1250 		/*
1251 		 * Pass the packet on.
1252 		 */
1253 		if (canputnext(dsp->ds_rq))
1254 			putnext(dsp->ds_rq, mp);
1255 		else
1256 			freemsg(mp);
1257 		/*
1258 		 * Move on to the next packet in the chain.
1259 		 */
1260 		mp = next;
1261 	} while (mp != NULL);
1262 }
1263 
1264 /*
1265  * Default receive function (send DL_UNITDATA_IND messages).
1266  */
1267 /*ARGSUSED*/
1268 void
1269 dld_str_rx_unitdata(void *arg, mac_resource_handle_t mrh, mblk_t *mp,
1270     mac_header_info_t *mhip)
1271 {
1272 	dld_str_t		*dsp = (dld_str_t *)arg;
1273 	mblk_t			*ud_mp;
1274 	mblk_t			*next;
1275 	size_t			offset = 0;
1276 	boolean_t		strip_vlan = B_TRUE;
1277 
1278 	/*
1279 	 * See MAC header stripping rules in the dld_str_rx_fastpath() function.
1280 	 */
1281 	if (mhip->mhi_istagged &&
1282 	    (mac_client_vid(dsp->ds_mch) == VLAN_ID_NONE) &&
1283 	    ((dsp->ds_sap == ETHERTYPE_VLAN) ||
1284 	    (dsp->ds_promisc & DLS_PROMISC_SAP))) {
1285 		offset = VLAN_TAGSZ;
1286 		strip_vlan = B_FALSE;
1287 	}
1288 
1289 	ASSERT(mp != NULL);
1290 	do {
1291 		/*
1292 		 * Get the pointer to the next packet in the chain and then
1293 		 * clear b_next before the packet gets passed on.
1294 		 */
1295 		next = mp->b_next;
1296 		mp->b_next = NULL;
1297 
1298 		/*
1299 		 * Wind back b_rptr to point at the MAC header.
1300 		 */
1301 		ASSERT(mp->b_rptr >= DB_BASE(mp) + mhip->mhi_hdrsize);
1302 		mp->b_rptr -= mhip->mhi_hdrsize;
1303 
1304 		/*
1305 		 * Create the DL_UNITDATA_IND M_PROTO.
1306 		 */
1307 		if ((ud_mp = str_unitdata_ind(dsp, mp, strip_vlan)) == NULL) {
1308 			freemsgchain(mp);
1309 			return;
1310 		}
1311 
1312 		/*
1313 		 * Advance b_rptr to point at the payload (or the VLAN header).
1314 		 */
1315 		mp->b_rptr += (mhip->mhi_hdrsize - offset);
1316 
1317 		/*
1318 		 * Prepend the DL_UNITDATA_IND.
1319 		 */
1320 		ud_mp->b_cont = mp;
1321 
1322 		/*
1323 		 * Send the message.
1324 		 */
1325 		if (canputnext(dsp->ds_rq))
1326 			putnext(dsp->ds_rq, ud_mp);
1327 		else
1328 			freemsg(ud_mp);
1329 
1330 		/*
1331 		 * Move on to the next packet in the chain.
1332 		 */
1333 		mp = next;
1334 	} while (mp != NULL);
1335 }
1336 
1337 /*
1338  * DL_NOTIFY_IND: DL_NOTE_SDU_SIZE
1339  */
1340 static void
1341 str_notify_sdu_size(dld_str_t *dsp, uint_t max_sdu)
1342 {
1343 	mblk_t		*mp;
1344 	dl_notify_ind_t *dlip;
1345 
1346 	if (!(dsp->ds_notifications & DL_NOTE_SDU_SIZE))
1347 		return;
1348 
1349 	if ((mp = mexchange(dsp->ds_wq, NULL, sizeof (dl_notify_ind_t),
1350 	    M_PROTO, 0)) == NULL)
1351 		return;
1352 
1353 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1354 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1355 	dlip->dl_primitive = DL_NOTIFY_IND;
1356 	dlip->dl_notification = DL_NOTE_SDU_SIZE;
1357 	dlip->dl_data = max_sdu;
1358 
1359 	qreply(dsp->ds_wq, mp);
1360 }
1361 
1362 /*
1363  * Generate DL_NOTIFY_IND messages to notify the DLPI consumer of the
1364  * current state of the interface.
1365  */
1366 void
1367 dld_str_notify_ind(dld_str_t *dsp)
1368 {
1369 	mac_notify_type_t	type;
1370 
1371 	for (type = 0; type < MAC_NNOTE; type++)
1372 		str_notify(dsp, type);
1373 }
1374 
1375 typedef struct dl_unitdata_ind_wrapper {
1376 	dl_unitdata_ind_t	dl_unitdata;
1377 	uint8_t			dl_dest_addr[MAXMACADDRLEN + sizeof (uint16_t)];
1378 	uint8_t			dl_src_addr[MAXMACADDRLEN + sizeof (uint16_t)];
1379 } dl_unitdata_ind_wrapper_t;
1380 
1381 /*
1382  * Create a DL_UNITDATA_IND M_PROTO message.
1383  */
1384 static mblk_t *
1385 str_unitdata_ind(dld_str_t *dsp, mblk_t *mp, boolean_t strip_vlan)
1386 {
1387 	mblk_t				*nmp;
1388 	dl_unitdata_ind_wrapper_t	*dlwp;
1389 	dl_unitdata_ind_t		*dlp;
1390 	mac_header_info_t		mhi;
1391 	uint_t				addr_length;
1392 	uint8_t				*daddr;
1393 	uint8_t				*saddr;
1394 
1395 	/*
1396 	 * Get the packet header information.
1397 	 */
1398 	if (dls_link_header_info(dsp->ds_dlp, mp, &mhi) != 0)
1399 		return (NULL);
1400 
1401 	/*
1402 	 * Allocate a message large enough to contain the wrapper structure
1403 	 * defined above.
1404 	 */
1405 	if ((nmp = mexchange(dsp->ds_wq, NULL,
1406 	    sizeof (dl_unitdata_ind_wrapper_t), M_PROTO,
1407 	    DL_UNITDATA_IND)) == NULL)
1408 		return (NULL);
1409 
1410 	dlwp = (dl_unitdata_ind_wrapper_t *)nmp->b_rptr;
1411 
1412 	dlp = &(dlwp->dl_unitdata);
1413 	ASSERT(dlp == (dl_unitdata_ind_t *)nmp->b_rptr);
1414 	ASSERT(dlp->dl_primitive == DL_UNITDATA_IND);
1415 
1416 	/*
1417 	 * Copy in the destination address.
1418 	 */
1419 	addr_length = dsp->ds_mip->mi_addr_length;
1420 	daddr = dlwp->dl_dest_addr;
1421 	dlp->dl_dest_addr_offset = (uintptr_t)daddr - (uintptr_t)dlp;
1422 	bcopy(mhi.mhi_daddr, daddr, addr_length);
1423 
1424 	/*
1425 	 * Set the destination DLSAP to the SAP value encoded in the packet.
1426 	 */
1427 	if (mhi.mhi_istagged && !strip_vlan)
1428 		*(uint16_t *)(daddr + addr_length) = ETHERTYPE_VLAN;
1429 	else
1430 		*(uint16_t *)(daddr + addr_length) = mhi.mhi_bindsap;
1431 	dlp->dl_dest_addr_length = addr_length + sizeof (uint16_t);
1432 
1433 	/*
1434 	 * If the destination address was multicast or broadcast then the
1435 	 * dl_group_address field should be non-zero.
1436 	 */
1437 	dlp->dl_group_address = (mhi.mhi_dsttype == MAC_ADDRTYPE_MULTICAST) ||
1438 	    (mhi.mhi_dsttype == MAC_ADDRTYPE_BROADCAST);
1439 
1440 	/*
1441 	 * Copy in the source address if one exists.  Some MAC types (DL_IB
1442 	 * for example) may not have access to source information.
1443 	 */
1444 	if (mhi.mhi_saddr == NULL) {
1445 		dlp->dl_src_addr_offset = dlp->dl_src_addr_length = 0;
1446 	} else {
1447 		saddr = dlwp->dl_src_addr;
1448 		dlp->dl_src_addr_offset = (uintptr_t)saddr - (uintptr_t)dlp;
1449 		bcopy(mhi.mhi_saddr, saddr, addr_length);
1450 
1451 		/*
1452 		 * Set the source DLSAP to the packet ethertype.
1453 		 */
1454 		*(uint16_t *)(saddr + addr_length) = mhi.mhi_origsap;
1455 		dlp->dl_src_addr_length = addr_length + sizeof (uint16_t);
1456 	}
1457 
1458 	return (nmp);
1459 }
1460 
1461 /*
1462  * DL_NOTIFY_IND: DL_NOTE_PROMISC_ON_PHYS
1463  */
1464 static void
1465 str_notify_promisc_on_phys(dld_str_t *dsp)
1466 {
1467 	mblk_t		*mp;
1468 	dl_notify_ind_t	*dlip;
1469 
1470 	if (!(dsp->ds_notifications & DL_NOTE_PROMISC_ON_PHYS))
1471 		return;
1472 
1473 	if ((mp = mexchange(dsp->ds_wq, NULL, sizeof (dl_notify_ind_t),
1474 	    M_PROTO, 0)) == NULL)
1475 		return;
1476 
1477 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1478 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1479 	dlip->dl_primitive = DL_NOTIFY_IND;
1480 	dlip->dl_notification = DL_NOTE_PROMISC_ON_PHYS;
1481 
1482 	qreply(dsp->ds_wq, mp);
1483 }
1484 
1485 /*
1486  * DL_NOTIFY_IND: DL_NOTE_PROMISC_OFF_PHYS
1487  */
1488 static void
1489 str_notify_promisc_off_phys(dld_str_t *dsp)
1490 {
1491 	mblk_t		*mp;
1492 	dl_notify_ind_t	*dlip;
1493 
1494 	if (!(dsp->ds_notifications & DL_NOTE_PROMISC_OFF_PHYS))
1495 		return;
1496 
1497 	if ((mp = mexchange(dsp->ds_wq, NULL, sizeof (dl_notify_ind_t),
1498 	    M_PROTO, 0)) == NULL)
1499 		return;
1500 
1501 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1502 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1503 	dlip->dl_primitive = DL_NOTIFY_IND;
1504 	dlip->dl_notification = DL_NOTE_PROMISC_OFF_PHYS;
1505 
1506 	qreply(dsp->ds_wq, mp);
1507 }
1508 
1509 /*
1510  * DL_NOTIFY_IND: DL_NOTE_PHYS_ADDR
1511  */
1512 static void
1513 str_notify_phys_addr(dld_str_t *dsp, const uint8_t *addr)
1514 {
1515 	mblk_t		*mp;
1516 	dl_notify_ind_t	*dlip;
1517 	uint_t		addr_length;
1518 	uint16_t	ethertype;
1519 
1520 	if (!(dsp->ds_notifications & DL_NOTE_PHYS_ADDR))
1521 		return;
1522 
1523 	addr_length = dsp->ds_mip->mi_addr_length;
1524 	if ((mp = mexchange(dsp->ds_wq, NULL,
1525 	    sizeof (dl_notify_ind_t) + addr_length + sizeof (uint16_t),
1526 	    M_PROTO, 0)) == NULL)
1527 		return;
1528 
1529 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1530 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1531 	dlip->dl_primitive = DL_NOTIFY_IND;
1532 	dlip->dl_notification = DL_NOTE_PHYS_ADDR;
1533 	dlip->dl_data = DL_CURR_PHYS_ADDR;
1534 	dlip->dl_addr_offset = sizeof (dl_notify_ind_t);
1535 	dlip->dl_addr_length = addr_length + sizeof (uint16_t);
1536 
1537 	bcopy(addr, &dlip[1], addr_length);
1538 
1539 	ethertype = (dsp->ds_sap < ETHERTYPE_802_MIN) ? 0 : dsp->ds_sap;
1540 	*(uint16_t *)((uchar_t *)(dlip + 1) + addr_length) = ethertype;
1541 
1542 	qreply(dsp->ds_wq, mp);
1543 }
1544 
1545 /*
1546  * DL_NOTIFY_IND: DL_NOTE_LINK_UP
1547  */
1548 static void
1549 str_notify_link_up(dld_str_t *dsp)
1550 {
1551 	mblk_t		*mp;
1552 	dl_notify_ind_t	*dlip;
1553 
1554 	if (!(dsp->ds_notifications & DL_NOTE_LINK_UP))
1555 		return;
1556 
1557 	if ((mp = mexchange(dsp->ds_wq, NULL, sizeof (dl_notify_ind_t),
1558 	    M_PROTO, 0)) == NULL)
1559 		return;
1560 
1561 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1562 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1563 	dlip->dl_primitive = DL_NOTIFY_IND;
1564 	dlip->dl_notification = DL_NOTE_LINK_UP;
1565 
1566 	qreply(dsp->ds_wq, mp);
1567 }
1568 
1569 /*
1570  * DL_NOTIFY_IND: DL_NOTE_LINK_DOWN
1571  */
1572 static void
1573 str_notify_link_down(dld_str_t *dsp)
1574 {
1575 	mblk_t		*mp;
1576 	dl_notify_ind_t	*dlip;
1577 
1578 	if (!(dsp->ds_notifications & DL_NOTE_LINK_DOWN))
1579 		return;
1580 
1581 	if ((mp = mexchange(dsp->ds_wq, NULL, sizeof (dl_notify_ind_t),
1582 	    M_PROTO, 0)) == NULL)
1583 		return;
1584 
1585 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1586 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1587 	dlip->dl_primitive = DL_NOTIFY_IND;
1588 	dlip->dl_notification = DL_NOTE_LINK_DOWN;
1589 
1590 	qreply(dsp->ds_wq, mp);
1591 }
1592 
1593 /*
1594  * DL_NOTIFY_IND: DL_NOTE_SPEED
1595  */
1596 static void
1597 str_notify_speed(dld_str_t *dsp, uint32_t speed)
1598 {
1599 	mblk_t		*mp;
1600 	dl_notify_ind_t	*dlip;
1601 
1602 	if (!(dsp->ds_notifications & DL_NOTE_SPEED))
1603 		return;
1604 
1605 	if ((mp = mexchange(dsp->ds_wq, NULL, sizeof (dl_notify_ind_t),
1606 	    M_PROTO, 0)) == NULL)
1607 		return;
1608 
1609 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1610 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1611 	dlip->dl_primitive = DL_NOTIFY_IND;
1612 	dlip->dl_notification = DL_NOTE_SPEED;
1613 	dlip->dl_data = speed;
1614 
1615 	qreply(dsp->ds_wq, mp);
1616 }
1617 
1618 /*
1619  * DL_NOTIFY_IND: DL_NOTE_CAPAB_RENEG
1620  */
1621 static void
1622 str_notify_capab_reneg(dld_str_t *dsp)
1623 {
1624 	mblk_t		*mp;
1625 	dl_notify_ind_t	*dlip;
1626 
1627 	if (!(dsp->ds_notifications & DL_NOTE_CAPAB_RENEG))
1628 		return;
1629 
1630 	if ((mp = mexchange(dsp->ds_wq, NULL, sizeof (dl_notify_ind_t),
1631 	    M_PROTO, 0)) == NULL)
1632 		return;
1633 
1634 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1635 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1636 	dlip->dl_primitive = DL_NOTIFY_IND;
1637 	dlip->dl_notification = DL_NOTE_CAPAB_RENEG;
1638 
1639 	qreply(dsp->ds_wq, mp);
1640 }
1641 
1642 /*
1643  * DL_NOTIFY_IND: DL_NOTE_FASTPATH_FLUSH
1644  */
1645 static void
1646 str_notify_fastpath_flush(dld_str_t *dsp)
1647 {
1648 	mblk_t		*mp;
1649 	dl_notify_ind_t	*dlip;
1650 
1651 	if (!(dsp->ds_notifications & DL_NOTE_FASTPATH_FLUSH))
1652 		return;
1653 
1654 	if ((mp = mexchange(dsp->ds_wq, NULL, sizeof (dl_notify_ind_t),
1655 	    M_PROTO, 0)) == NULL)
1656 		return;
1657 
1658 	bzero(mp->b_rptr, sizeof (dl_notify_ind_t));
1659 	dlip = (dl_notify_ind_t *)mp->b_rptr;
1660 	dlip->dl_primitive = DL_NOTIFY_IND;
1661 	dlip->dl_notification = DL_NOTE_FASTPATH_FLUSH;
1662 
1663 	qreply(dsp->ds_wq, mp);
1664 }
1665 
1666 /*
1667  * MAC notification callback.
1668  */
1669 void
1670 str_notify(void *arg, mac_notify_type_t type)
1671 {
1672 	dld_str_t		*dsp = (dld_str_t *)arg;
1673 	queue_t			*q = dsp->ds_wq;
1674 	mac_handle_t		mh = dsp->ds_mh;
1675 	mac_client_handle_t	mch = dsp->ds_mch;
1676 	uint8_t			addr[MAXMACADDRLEN];
1677 
1678 	switch (type) {
1679 	case MAC_NOTE_TX:
1680 		qenable(q);
1681 		break;
1682 
1683 	case MAC_NOTE_DEVPROMISC:
1684 		/*
1685 		 * Send the appropriate DL_NOTIFY_IND.
1686 		 */
1687 		if (mac_promisc_get(mh, MAC_DEVPROMISC))
1688 			str_notify_promisc_on_phys(dsp);
1689 		else
1690 			str_notify_promisc_off_phys(dsp);
1691 		break;
1692 
1693 	case MAC_NOTE_UNICST:
1694 		/*
1695 		 * This notification is sent whenever the MAC unicast
1696 		 * address changes.
1697 		 */
1698 		mac_unicast_primary_get(mh, addr);
1699 
1700 		/*
1701 		 * Send the appropriate DL_NOTIFY_IND.
1702 		 */
1703 		str_notify_phys_addr(dsp, addr);
1704 		break;
1705 
1706 	case MAC_NOTE_LINK:
1707 		/*
1708 		 * This notification is sent every time the MAC driver
1709 		 * updates the link state.
1710 		 */
1711 		switch (mac_client_stat_get(mch, MAC_STAT_LINK_STATE)) {
1712 		case LINK_STATE_UP: {
1713 			uint64_t speed;
1714 			/*
1715 			 * The link is up so send the appropriate
1716 			 * DL_NOTIFY_IND.
1717 			 */
1718 			str_notify_link_up(dsp);
1719 
1720 			speed = mac_stat_get(mh, MAC_STAT_IFSPEED);
1721 			str_notify_speed(dsp, (uint32_t)(speed / 1000ull));
1722 			break;
1723 		}
1724 		case LINK_STATE_DOWN:
1725 			/*
1726 			 * The link is down so send the appropriate
1727 			 * DL_NOTIFY_IND.
1728 			 */
1729 			str_notify_link_down(dsp);
1730 			break;
1731 
1732 		default:
1733 			break;
1734 		}
1735 		break;
1736 
1737 	case MAC_NOTE_RESOURCE:
1738 	case MAC_NOTE_CAPAB_CHG:
1739 		/*
1740 		 * This notification is sent whenever the MAC resources
1741 		 * change or capabilities change. We need to renegotiate
1742 		 * the capabilities. Send the appropriate DL_NOTIFY_IND.
1743 		 */
1744 		str_notify_capab_reneg(dsp);
1745 		break;
1746 
1747 	case MAC_NOTE_SDU_SIZE: {
1748 		uint_t  max_sdu;
1749 		mac_sdu_get(dsp->ds_mh, NULL, &max_sdu);
1750 		str_notify_sdu_size(dsp, max_sdu);
1751 		break;
1752 	}
1753 
1754 	case MAC_NOTE_FASTPATH_FLUSH:
1755 		str_notify_fastpath_flush(dsp);
1756 		break;
1757 
1758 	case MAC_NOTE_MARGIN:
1759 		break;
1760 
1761 	case MAC_NOTE_PROMISC:
1762 		break;
1763 
1764 	default:
1765 		ASSERT(B_FALSE);
1766 		break;
1767 	}
1768 }
1769 
1770 /*
1771  * This function is called via a taskq mechansim to process all control
1772  * messages on a per 'dsp' end point.
1773  */
1774 static void
1775 dld_wput_nondata_task(void *arg)
1776 {
1777 	dld_str_t	*dsp = arg;
1778 	mblk_t		*mp;
1779 
1780 	mutex_enter(&dsp->ds_lock);
1781 	while (dsp->ds_pending_head != NULL) {
1782 		mp = dsp->ds_pending_head;
1783 		dsp->ds_pending_head = mp->b_next;
1784 		mp->b_next = NULL;
1785 		if (dsp->ds_pending_head == NULL)
1786 			dsp->ds_pending_tail = NULL;
1787 		mutex_exit(&dsp->ds_lock);
1788 
1789 		switch (DB_TYPE(mp)) {
1790 		case M_PROTO:
1791 		case M_PCPROTO:
1792 			dld_proto(dsp, mp);
1793 			break;
1794 		case M_IOCTL:
1795 			dld_ioc(dsp, mp);
1796 			break;
1797 		default:
1798 			ASSERT(0);
1799 		}
1800 
1801 		mutex_enter(&dsp->ds_lock);
1802 	}
1803 	ASSERT(dsp->ds_pending_tail == NULL);
1804 	dsp->ds_dlpi_pending = 0;
1805 	cv_broadcast(&dsp->ds_dlpi_pending_cv);
1806 	mutex_exit(&dsp->ds_lock);
1807 }
1808 
1809 /*
1810  * Kernel thread to handle taskq dispatch failures in dld_wput_data. This
1811  * thread is started at boot time.
1812  */
1813 static void
1814 dld_taskq_dispatch(void)
1815 {
1816 	callb_cpr_t	cprinfo;
1817 	dld_str_t	*dsp;
1818 
1819 	CALLB_CPR_INIT(&cprinfo, &dld_taskq_lock, callb_generic_cpr,
1820 	    "dld_taskq_dispatch");
1821 	mutex_enter(&dld_taskq_lock);
1822 
1823 	while (!dld_taskq_quit) {
1824 		dsp = list_head(&dld_taskq_list);
1825 		while (dsp != NULL) {
1826 			list_remove(&dld_taskq_list, dsp);
1827 			mutex_exit(&dld_taskq_lock);
1828 			VERIFY(taskq_dispatch(dld_taskq, dld_wput_nondata_task,
1829 			    dsp, TQ_SLEEP) != 0);
1830 			mutex_enter(&dld_taskq_lock);
1831 			dsp = list_head(&dld_taskq_list);
1832 		}
1833 
1834 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
1835 		cv_wait(&dld_taskq_cv, &dld_taskq_lock);
1836 		CALLB_CPR_SAFE_END(&cprinfo, &dld_taskq_lock);
1837 	}
1838 
1839 	dld_taskq_done = B_TRUE;
1840 	cv_signal(&dld_taskq_cv);
1841 	CALLB_CPR_EXIT(&cprinfo);
1842 	thread_exit();
1843 }
1844 
1845 /*
1846  * All control operations are serialized on the 'dsp' and are also funneled
1847  * through a taskq mechanism to ensure that subsequent processing has kernel
1848  * context and can safely use cv_wait.
1849  *
1850  * Mechanisms to handle taskq dispatch failures
1851  *
1852  * The only way to be sure that taskq dispatch does not fail is to either
1853  * specify TQ_SLEEP or to use a static taskq and prepopulate it with
1854  * some number of entries and make sure that the number of outstanding requests
1855  * are less than that number. We can't use TQ_SLEEP since we don't know the
1856  * context. Nor can we bound the total number of 'dsp' end points. So we are
1857  * unable to use either of the above schemes, and are forced to deal with
1858  * taskq dispatch failures. Note that even dynamic taskq could fail in
1859  * dispatch if TQ_NOSLEEP is specified, since this flag is translated
1860  * eventually to KM_NOSLEEP and kmem allocations could fail in the taskq
1861  * framework.
1862  *
1863  * We maintain a queue of 'dsp's that encountered taskq dispatch failure.
1864  * We also have a single global thread to retry the taskq dispatch. This
1865  * thread loops in 'dld_taskq_dispatch' and retries the taskq dispatch, but
1866  * uses TQ_SLEEP to ensure eventual success of the dispatch operation.
1867  */
1868 static void
1869 dld_wput_nondata(dld_str_t *dsp, mblk_t *mp)
1870 {
1871 	ASSERT(mp->b_next == NULL);
1872 	mutex_enter(&dsp->ds_lock);
1873 	if (dsp->ds_pending_head != NULL) {
1874 		ASSERT(dsp->ds_dlpi_pending);
1875 		dsp->ds_pending_tail->b_next = mp;
1876 		dsp->ds_pending_tail = mp;
1877 		mutex_exit(&dsp->ds_lock);
1878 		return;
1879 	}
1880 	ASSERT(dsp->ds_pending_tail == NULL);
1881 	dsp->ds_pending_head = dsp->ds_pending_tail = mp;
1882 	/*
1883 	 * At this point if ds_dlpi_pending is set, it implies that the taskq
1884 	 * thread is still active and is processing the last message, though
1885 	 * the pending queue has been emptied.
1886 	 */
1887 	if (dsp->ds_dlpi_pending) {
1888 		mutex_exit(&dsp->ds_lock);
1889 		return;
1890 	}
1891 
1892 	dsp->ds_dlpi_pending = 1;
1893 	mutex_exit(&dsp->ds_lock);
1894 
1895 	if (taskq_dispatch(dld_taskq, dld_wput_nondata_task, dsp,
1896 	    TQ_NOSLEEP) != 0)
1897 		return;
1898 
1899 	mutex_enter(&dld_taskq_lock);
1900 	list_insert_tail(&dld_taskq_list, dsp);
1901 	cv_signal(&dld_taskq_cv);
1902 	mutex_exit(&dld_taskq_lock);
1903 }
1904 
1905 /*
1906  * Process an M_IOCTL message.
1907  */
1908 static void
1909 dld_ioc(dld_str_t *dsp, mblk_t *mp)
1910 {
1911 	uint_t			cmd;
1912 
1913 	cmd = ((struct iocblk *)mp->b_rptr)->ioc_cmd;
1914 	ASSERT(dsp->ds_type == DLD_DLPI);
1915 
1916 	switch (cmd) {
1917 	case DLIOCNATIVE:
1918 		ioc_native(dsp, mp);
1919 		break;
1920 	case DLIOCMARGININFO:
1921 		ioc_margin(dsp, mp);
1922 		break;
1923 	case DLIOCRAW:
1924 		ioc_raw(dsp, mp);
1925 		break;
1926 	case DLIOCHDRINFO:
1927 		ioc_fast(dsp, mp);
1928 		break;
1929 	default:
1930 		ioc(dsp, mp);
1931 	}
1932 }
1933 
1934 /*
1935  * DLIOCNATIVE
1936  */
1937 static void
1938 ioc_native(dld_str_t *dsp, mblk_t *mp)
1939 {
1940 	queue_t *q = dsp->ds_wq;
1941 	const mac_info_t *mip = dsp->ds_mip;
1942 
1943 	/*
1944 	 * Native mode can be enabled if it's disabled and if the
1945 	 * native media type is different.
1946 	 */
1947 	if (!dsp->ds_native && mip->mi_media != mip->mi_nativemedia)
1948 		dsp->ds_native = B_TRUE;
1949 
1950 	if (dsp->ds_native)
1951 		miocack(q, mp, 0, mip->mi_nativemedia);
1952 	else
1953 		miocnak(q, mp, 0, ENOTSUP);
1954 }
1955 
1956 /*
1957  * DLIOCMARGININFO
1958  */
1959 static void
1960 ioc_margin(dld_str_t *dsp, mblk_t *mp)
1961 {
1962 	queue_t *q = dsp->ds_wq;
1963 	uint32_t margin;
1964 	int err;
1965 
1966 	if (dsp->ds_dlstate == DL_UNATTACHED) {
1967 		err = EINVAL;
1968 		goto failed;
1969 	}
1970 	if ((err = miocpullup(mp, sizeof (uint32_t))) != 0)
1971 		goto failed;
1972 
1973 	mac_margin_get(dsp->ds_mh, &margin);
1974 	*((uint32_t *)mp->b_cont->b_rptr) = margin;
1975 	miocack(q, mp, sizeof (uint32_t), 0);
1976 	return;
1977 
1978 failed:
1979 	miocnak(q, mp, 0, err);
1980 }
1981 
1982 /*
1983  * DLIOCRAW
1984  */
1985 static void
1986 ioc_raw(dld_str_t *dsp, mblk_t *mp)
1987 {
1988 	queue_t *q = dsp->ds_wq;
1989 	mac_perim_handle_t	mph;
1990 
1991 	if (dsp->ds_mh == NULL) {
1992 		dsp->ds_mode = DLD_RAW;
1993 		miocack(q, mp, 0, 0);
1994 		return;
1995 	}
1996 
1997 	mac_perim_enter_by_mh(dsp->ds_mh, &mph);
1998 	if (dsp->ds_polling || dsp->ds_direct) {
1999 		mac_perim_exit(mph);
2000 		miocnak(q, mp, 0, EPROTO);
2001 		return;
2002 	}
2003 
2004 	if (dsp->ds_mode != DLD_RAW && dsp->ds_dlstate == DL_IDLE) {
2005 		/*
2006 		 * Set the receive callback.
2007 		 */
2008 		dls_rx_set(dsp, dld_str_rx_raw, dsp);
2009 	}
2010 
2011 	/*
2012 	 * Note that raw mode is enabled.
2013 	 */
2014 	dsp->ds_mode = DLD_RAW;
2015 	mac_perim_exit(mph);
2016 
2017 	miocack(q, mp, 0, 0);
2018 }
2019 
2020 /*
2021  * DLIOCHDRINFO
2022  */
2023 static void
2024 ioc_fast(dld_str_t *dsp, mblk_t *mp)
2025 {
2026 	dl_unitdata_req_t *dlp;
2027 	off_t		off;
2028 	size_t		len;
2029 	const uint8_t	*addr;
2030 	uint16_t	sap;
2031 	mblk_t		*nmp;
2032 	mblk_t		*hmp;
2033 	uint_t		addr_length;
2034 	queue_t		*q = dsp->ds_wq;
2035 	int		err;
2036 	mac_perim_handle_t	mph;
2037 
2038 	if (dld_opt & DLD_OPT_NO_FASTPATH) {
2039 		err = ENOTSUP;
2040 		goto failed;
2041 	}
2042 
2043 	/*
2044 	 * DLIOCHDRINFO should only come from IP. The one initiated from
2045 	 * user-land should not be allowed.
2046 	 */
2047 	if (((struct iocblk *)mp->b_rptr)->ioc_cr != kcred) {
2048 		err = EINVAL;
2049 		goto failed;
2050 	}
2051 
2052 	nmp = mp->b_cont;
2053 	if (nmp == NULL || MBLKL(nmp) < sizeof (dl_unitdata_req_t) ||
2054 	    (dlp = (dl_unitdata_req_t *)nmp->b_rptr,
2055 	    dlp->dl_primitive != DL_UNITDATA_REQ)) {
2056 		err = EINVAL;
2057 		goto failed;
2058 	}
2059 
2060 	off = dlp->dl_dest_addr_offset;
2061 	len = dlp->dl_dest_addr_length;
2062 
2063 	if (!MBLKIN(nmp, off, len)) {
2064 		err = EINVAL;
2065 		goto failed;
2066 	}
2067 
2068 	if (dsp->ds_dlstate != DL_IDLE) {
2069 		err = ENOTSUP;
2070 		goto failed;
2071 	}
2072 
2073 	addr_length = dsp->ds_mip->mi_addr_length;
2074 	if (len != addr_length + sizeof (uint16_t)) {
2075 		err = EINVAL;
2076 		goto failed;
2077 	}
2078 
2079 	addr = nmp->b_rptr + off;
2080 	sap = *(uint16_t *)(nmp->b_rptr + off + addr_length);
2081 
2082 	if ((hmp = dls_header(dsp, addr, sap, 0, NULL)) == NULL) {
2083 		err = ENOMEM;
2084 		goto failed;
2085 	}
2086 
2087 	/*
2088 	 * This ioctl might happen concurrently with a direct call to dld_capab
2089 	 * that tries to enable direct and/or poll capabilities. Since the
2090 	 * stack does not serialize them, we do so here to avoid mixing
2091 	 * the callbacks.
2092 	 */
2093 	mac_perim_enter_by_mh(dsp->ds_mh, &mph);
2094 	if (dsp->ds_mode != DLD_FASTPATH) {
2095 		/*
2096 		 * Set the receive callback (unless polling is enabled).
2097 		 */
2098 		if (!dsp->ds_polling && !dsp->ds_direct)
2099 			dls_rx_set(dsp, dld_str_rx_fastpath, dsp);
2100 
2101 		/*
2102 		 * Note that fast-path mode is enabled.
2103 		 */
2104 		dsp->ds_mode = DLD_FASTPATH;
2105 	}
2106 	mac_perim_exit(mph);
2107 
2108 	freemsg(nmp->b_cont);
2109 	nmp->b_cont = hmp;
2110 
2111 	miocack(q, mp, MBLKL(nmp) + MBLKL(hmp), 0);
2112 	return;
2113 failed:
2114 	miocnak(q, mp, 0, err);
2115 }
2116 
2117 /*
2118  * Catch-all handler.
2119  */
2120 static void
2121 ioc(dld_str_t *dsp, mblk_t *mp)
2122 {
2123 	queue_t	*q = dsp->ds_wq;
2124 
2125 	if (dsp->ds_dlstate == DL_UNATTACHED) {
2126 		miocnak(q, mp, 0, EINVAL);
2127 		return;
2128 	}
2129 	mac_ioctl(dsp->ds_mh, q, mp);
2130 }
2131