xref: /freebsd/sys/netinet/sctp_indata.c (revision 25ecdc7d52770caf1c9b44b5ec11f468f6b636f3)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  *
11  * a) Redistributions of source code must retain the above copyright notice,
12  *    this list of conditions and the following disclaimer.
13  *
14  * b) Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in
16  *    the documentation and/or other materials provided with the distribution.
17  *
18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
19  *    contributors may be used to endorse or promote products derived
20  *    from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37 
38 #include <netinet/sctp_os.h>
39 #include <sys/proc.h>
40 #include <netinet/sctp_var.h>
41 #include <netinet/sctp_sysctl.h>
42 #include <netinet/sctp_header.h>
43 #include <netinet/sctp_pcb.h>
44 #include <netinet/sctputil.h>
45 #include <netinet/sctp_output.h>
46 #include <netinet/sctp_uio.h>
47 #include <netinet/sctp_auth.h>
48 #include <netinet/sctp_timer.h>
49 #include <netinet/sctp_asconf.h>
50 #include <netinet/sctp_indata.h>
51 #include <netinet/sctp_bsd_addr.h>
52 #include <netinet/sctp_input.h>
53 #include <netinet/sctp_crc32.h>
54 #include <netinet/sctp_lock_bsd.h>
55 /*
56  * NOTES: On the outbound side of things I need to check the sack timer to
57  * see if I should generate a sack into the chunk queue (if I have data to
58  * send that is and will be sending it .. for bundling.
59  *
60  * The callback in sctp_usrreq.c will get called when the socket is read from.
61  * This will cause sctp_service_queues() to get called on the top entry in
62  * the list.
63  */
64 static uint32_t
65 sctp_add_chk_to_control(struct sctp_queued_to_read *control,
66     struct sctp_stream_in *strm,
67     struct sctp_tcb *stcb,
68     struct sctp_association *asoc,
69     struct sctp_tmit_chunk *chk, int hold_rlock);
70 
71 void
72 sctp_set_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
73 {
74 	asoc->my_rwnd = sctp_calc_rwnd(stcb, asoc);
75 }
76 
77 /* Calculate what the rwnd would be */
78 uint32_t
79 sctp_calc_rwnd(struct sctp_tcb *stcb, struct sctp_association *asoc)
80 {
81 	uint32_t calc = 0;
82 
83 	/*
84 	 * This is really set wrong with respect to a 1-2-m socket. Since
85 	 * the sb_cc is the count that everyone as put up. When we re-write
86 	 * sctp_soreceive then we will fix this so that ONLY this
87 	 * associations data is taken into account.
88 	 */
89 	if (stcb->sctp_socket == NULL) {
90 		return (calc);
91 	}
92 
93 	KASSERT(asoc->cnt_on_reasm_queue > 0 || asoc->size_on_reasm_queue == 0,
94 	    ("size_on_reasm_queue is %u", asoc->size_on_reasm_queue));
95 	KASSERT(asoc->cnt_on_all_streams > 0 || asoc->size_on_all_streams == 0,
96 	    ("size_on_all_streams is %u", asoc->size_on_all_streams));
97 	if (stcb->asoc.sb_cc == 0 &&
98 	    asoc->cnt_on_reasm_queue == 0 &&
99 	    asoc->cnt_on_all_streams == 0) {
100 		/* Full rwnd granted */
101 		calc = max(SCTP_SB_LIMIT_RCV(stcb->sctp_socket), SCTP_MINIMAL_RWND);
102 		return (calc);
103 	}
104 	/* get actual space */
105 	calc = (uint32_t)sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv);
106 	/*
107 	 * take out what has NOT been put on socket queue and we yet hold
108 	 * for putting up.
109 	 */
110 	calc = sctp_sbspace_sub(calc, (uint32_t)(asoc->size_on_reasm_queue +
111 	    asoc->cnt_on_reasm_queue * MSIZE));
112 	calc = sctp_sbspace_sub(calc, (uint32_t)(asoc->size_on_all_streams +
113 	    asoc->cnt_on_all_streams * MSIZE));
114 	if (calc == 0) {
115 		/* out of space */
116 		return (calc);
117 	}
118 
119 	/* what is the overhead of all these rwnd's */
120 	calc = sctp_sbspace_sub(calc, stcb->asoc.my_rwnd_control_len);
121 	/*
122 	 * If the window gets too small due to ctrl-stuff, reduce it to 1,
123 	 * even it is 0. SWS engaged
124 	 */
125 	if (calc < stcb->asoc.my_rwnd_control_len) {
126 		calc = 1;
127 	}
128 	return (calc);
129 }
130 
131 /*
132  * Build out our readq entry based on the incoming packet.
133  */
134 struct sctp_queued_to_read *
135 sctp_build_readq_entry(struct sctp_tcb *stcb,
136     struct sctp_nets *net,
137     uint32_t tsn, uint32_t ppid,
138     uint32_t context, uint16_t sid,
139     uint32_t mid, uint8_t flags,
140     struct mbuf *dm)
141 {
142 	struct sctp_queued_to_read *read_queue_e = NULL;
143 
144 	sctp_alloc_a_readq(stcb, read_queue_e);
145 	if (read_queue_e == NULL) {
146 		goto failed_build;
147 	}
148 	memset(read_queue_e, 0, sizeof(struct sctp_queued_to_read));
149 	read_queue_e->sinfo_stream = sid;
150 	read_queue_e->sinfo_flags = (flags << 8);
151 	read_queue_e->sinfo_ppid = ppid;
152 	read_queue_e->sinfo_context = context;
153 	read_queue_e->sinfo_tsn = tsn;
154 	read_queue_e->sinfo_cumtsn = tsn;
155 	read_queue_e->sinfo_assoc_id = sctp_get_associd(stcb);
156 	read_queue_e->mid = mid;
157 	read_queue_e->top_fsn = read_queue_e->fsn_included = 0xffffffff;
158 	TAILQ_INIT(&read_queue_e->reasm);
159 	read_queue_e->whoFrom = net;
160 	atomic_add_int(&net->ref_count, 1);
161 	read_queue_e->data = dm;
162 	read_queue_e->stcb = stcb;
163 	read_queue_e->port_from = stcb->rport;
164 	if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
165 		read_queue_e->do_not_ref_stcb = 1;
166 	}
167 failed_build:
168 	return (read_queue_e);
169 }
170 
171 struct mbuf *
172 sctp_build_ctl_nchunk(struct sctp_inpcb *inp, struct sctp_sndrcvinfo *sinfo)
173 {
174 	struct sctp_extrcvinfo *seinfo;
175 	struct sctp_sndrcvinfo *outinfo;
176 	struct sctp_rcvinfo *rcvinfo;
177 	struct sctp_nxtinfo *nxtinfo;
178 	struct cmsghdr *cmh;
179 	struct mbuf *ret;
180 	int len;
181 	int use_extended;
182 	int provide_nxt;
183 
184 	if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
185 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
186 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
187 		/* user does not want any ancillary data */
188 		return (NULL);
189 	}
190 
191 	len = 0;
192 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) {
193 		len += CMSG_SPACE(sizeof(struct sctp_rcvinfo));
194 	}
195 	seinfo = (struct sctp_extrcvinfo *)sinfo;
196 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO) &&
197 	    (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_AVAIL)) {
198 		provide_nxt = 1;
199 		len += CMSG_SPACE(sizeof(struct sctp_nxtinfo));
200 	} else {
201 		provide_nxt = 0;
202 	}
203 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
204 		if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
205 			use_extended = 1;
206 			len += CMSG_SPACE(sizeof(struct sctp_extrcvinfo));
207 		} else {
208 			use_extended = 0;
209 			len += CMSG_SPACE(sizeof(struct sctp_sndrcvinfo));
210 		}
211 	} else {
212 		use_extended = 0;
213 	}
214 
215 	ret = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
216 	if (ret == NULL) {
217 		/* No space */
218 		return (ret);
219 	}
220 	SCTP_BUF_LEN(ret) = 0;
221 
222 	/* We need a CMSG header followed by the struct */
223 	cmh = mtod(ret, struct cmsghdr *);
224 	/*
225 	 * Make sure that there is no un-initialized padding between the
226 	 * cmsg header and cmsg data and after the cmsg data.
227 	 */
228 	memset(cmh, 0, len);
229 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVRCVINFO)) {
230 		cmh->cmsg_level = IPPROTO_SCTP;
231 		cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_rcvinfo));
232 		cmh->cmsg_type = SCTP_RCVINFO;
233 		rcvinfo = (struct sctp_rcvinfo *)CMSG_DATA(cmh);
234 		rcvinfo->rcv_sid = sinfo->sinfo_stream;
235 		rcvinfo->rcv_ssn = sinfo->sinfo_ssn;
236 		rcvinfo->rcv_flags = sinfo->sinfo_flags;
237 		rcvinfo->rcv_ppid = sinfo->sinfo_ppid;
238 		rcvinfo->rcv_tsn = sinfo->sinfo_tsn;
239 		rcvinfo->rcv_cumtsn = sinfo->sinfo_cumtsn;
240 		rcvinfo->rcv_context = sinfo->sinfo_context;
241 		rcvinfo->rcv_assoc_id = sinfo->sinfo_assoc_id;
242 		cmh = (struct cmsghdr *)((caddr_t)cmh + CMSG_SPACE(sizeof(struct sctp_rcvinfo)));
243 		SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_rcvinfo));
244 	}
245 	if (provide_nxt) {
246 		cmh->cmsg_level = IPPROTO_SCTP;
247 		cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_nxtinfo));
248 		cmh->cmsg_type = SCTP_NXTINFO;
249 		nxtinfo = (struct sctp_nxtinfo *)CMSG_DATA(cmh);
250 		nxtinfo->nxt_sid = seinfo->serinfo_next_stream;
251 		nxtinfo->nxt_flags = 0;
252 		if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_IS_UNORDERED) {
253 			nxtinfo->nxt_flags |= SCTP_UNORDERED;
254 		}
255 		if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_IS_NOTIFICATION) {
256 			nxtinfo->nxt_flags |= SCTP_NOTIFICATION;
257 		}
258 		if (seinfo->serinfo_next_flags & SCTP_NEXT_MSG_ISCOMPLETE) {
259 			nxtinfo->nxt_flags |= SCTP_COMPLETE;
260 		}
261 		nxtinfo->nxt_ppid = seinfo->serinfo_next_ppid;
262 		nxtinfo->nxt_length = seinfo->serinfo_next_length;
263 		nxtinfo->nxt_assoc_id = seinfo->serinfo_next_aid;
264 		cmh = (struct cmsghdr *)((caddr_t)cmh + CMSG_SPACE(sizeof(struct sctp_nxtinfo)));
265 		SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_nxtinfo));
266 	}
267 	if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT)) {
268 		cmh->cmsg_level = IPPROTO_SCTP;
269 		outinfo = (struct sctp_sndrcvinfo *)CMSG_DATA(cmh);
270 		if (use_extended) {
271 			cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_extrcvinfo));
272 			cmh->cmsg_type = SCTP_EXTRCV;
273 			memcpy(outinfo, sinfo, sizeof(struct sctp_extrcvinfo));
274 			SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_extrcvinfo));
275 		} else {
276 			cmh->cmsg_len = CMSG_LEN(sizeof(struct sctp_sndrcvinfo));
277 			cmh->cmsg_type = SCTP_SNDRCV;
278 			*outinfo = *sinfo;
279 			SCTP_BUF_LEN(ret) += CMSG_SPACE(sizeof(struct sctp_sndrcvinfo));
280 		}
281 	}
282 	return (ret);
283 }
284 
285 static void
286 sctp_mark_non_revokable(struct sctp_association *asoc, uint32_t tsn)
287 {
288 	uint32_t gap, i;
289 	int in_r, in_nr;
290 
291 	if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
292 		return;
293 	}
294 	if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
295 		/*
296 		 * This tsn is behind the cum ack and thus we don't need to
297 		 * worry about it being moved from one to the other.
298 		 */
299 		return;
300 	}
301 	SCTP_CALC_TSN_TO_GAP(gap, tsn, asoc->mapping_array_base_tsn);
302 	in_r = SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap);
303 	in_nr = SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, gap);
304 	KASSERT(in_r || in_nr, ("%s: Things are really messed up now", __func__));
305 	if (!in_nr) {
306 		SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
307 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
308 			asoc->highest_tsn_inside_nr_map = tsn;
309 		}
310 	}
311 	if (in_r) {
312 		SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
313 		if (tsn == asoc->highest_tsn_inside_map) {
314 			/* We must back down to see what the new highest is. */
315 			for (i = tsn - 1; SCTP_TSN_GE(i, asoc->mapping_array_base_tsn); i--) {
316 				SCTP_CALC_TSN_TO_GAP(gap, i, asoc->mapping_array_base_tsn);
317 				if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
318 					asoc->highest_tsn_inside_map = i;
319 					break;
320 				}
321 			}
322 			if (!SCTP_TSN_GE(i, asoc->mapping_array_base_tsn)) {
323 				asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn - 1;
324 			}
325 		}
326 	}
327 }
328 
329 static int
330 sctp_place_control_in_stream(struct sctp_stream_in *strm,
331     struct sctp_association *asoc,
332     struct sctp_queued_to_read *control)
333 {
334 	struct sctp_queued_to_read *at;
335 	struct sctp_readhead *q;
336 	uint8_t flags, unordered;
337 
338 	flags = (control->sinfo_flags >> 8);
339 	unordered = flags & SCTP_DATA_UNORDERED;
340 	if (unordered) {
341 		q = &strm->uno_inqueue;
342 		if (asoc->idata_supported == 0) {
343 			if (!TAILQ_EMPTY(q)) {
344 				/*
345 				 * Only one stream can be here in old style
346 				 * -- abort
347 				 */
348 				return (-1);
349 			}
350 			TAILQ_INSERT_TAIL(q, control, next_instrm);
351 			control->on_strm_q = SCTP_ON_UNORDERED;
352 			return (0);
353 		}
354 	} else {
355 		q = &strm->inqueue;
356 	}
357 	if ((flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
358 		control->end_added = 1;
359 		control->first_frag_seen = 1;
360 		control->last_frag_seen = 1;
361 	}
362 	if (TAILQ_EMPTY(q)) {
363 		/* Empty queue */
364 		TAILQ_INSERT_HEAD(q, control, next_instrm);
365 		if (unordered) {
366 			control->on_strm_q = SCTP_ON_UNORDERED;
367 		} else {
368 			control->on_strm_q = SCTP_ON_ORDERED;
369 		}
370 		return (0);
371 	} else {
372 		TAILQ_FOREACH(at, q, next_instrm) {
373 			if (SCTP_MID_GT(asoc->idata_supported, at->mid, control->mid)) {
374 				/*
375 				 * one in queue is bigger than the new one,
376 				 * insert before this one
377 				 */
378 				TAILQ_INSERT_BEFORE(at, control, next_instrm);
379 				if (unordered) {
380 					control->on_strm_q = SCTP_ON_UNORDERED;
381 				} else {
382 					control->on_strm_q = SCTP_ON_ORDERED;
383 				}
384 				break;
385 			} else if (SCTP_MID_EQ(asoc->idata_supported, at->mid, control->mid)) {
386 				/*
387 				 * Gak, He sent me a duplicate msg id
388 				 * number?? return -1 to abort.
389 				 */
390 				return (-1);
391 			} else {
392 				if (TAILQ_NEXT(at, next_instrm) == NULL) {
393 					/*
394 					 * We are at the end, insert it
395 					 * after this one
396 					 */
397 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
398 						sctp_log_strm_del(control, at,
399 						    SCTP_STR_LOG_FROM_INSERT_TL);
400 					}
401 					TAILQ_INSERT_AFTER(q, at, control, next_instrm);
402 					if (unordered) {
403 						control->on_strm_q = SCTP_ON_UNORDERED;
404 					} else {
405 						control->on_strm_q = SCTP_ON_ORDERED;
406 					}
407 					break;
408 				}
409 			}
410 		}
411 	}
412 	return (0);
413 }
414 
415 static void
416 sctp_abort_in_reasm(struct sctp_tcb *stcb,
417     struct sctp_queued_to_read *control,
418     struct sctp_tmit_chunk *chk,
419     int *abort_flag, int opspot)
420 {
421 	char msg[SCTP_DIAG_INFO_LEN];
422 	struct mbuf *oper;
423 
424 	if (stcb->asoc.idata_supported) {
425 		SCTP_SNPRINTF(msg, sizeof(msg),
426 		    "Reass %x,CF:%x,TSN=%8.8x,SID=%4.4x,FSN=%8.8x,MID:%8.8x",
427 		    opspot,
428 		    control->fsn_included,
429 		    chk->rec.data.tsn,
430 		    chk->rec.data.sid,
431 		    chk->rec.data.fsn, chk->rec.data.mid);
432 	} else {
433 		SCTP_SNPRINTF(msg, sizeof(msg),
434 		    "Reass %x,CI:%x,TSN=%8.8x,SID=%4.4x,FSN=%4.4x,SSN:%4.4x",
435 		    opspot,
436 		    control->fsn_included,
437 		    chk->rec.data.tsn,
438 		    chk->rec.data.sid,
439 		    chk->rec.data.fsn,
440 		    (uint16_t)chk->rec.data.mid);
441 	}
442 	oper = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
443 	sctp_m_freem(chk->data);
444 	chk->data = NULL;
445 	sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
446 	stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_1;
447 	sctp_abort_an_association(stcb->sctp_ep, stcb, oper, SCTP_SO_NOT_LOCKED);
448 	*abort_flag = 1;
449 }
450 
451 static void
452 sctp_clean_up_control(struct sctp_tcb *stcb, struct sctp_queued_to_read *control)
453 {
454 	/*
455 	 * The control could not be placed and must be cleaned.
456 	 */
457 	struct sctp_tmit_chunk *chk, *nchk;
458 
459 	TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
460 		TAILQ_REMOVE(&control->reasm, chk, sctp_next);
461 		if (chk->data)
462 			sctp_m_freem(chk->data);
463 		chk->data = NULL;
464 		sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
465 	}
466 	sctp_free_remote_addr(control->whoFrom);
467 	if (control->data) {
468 		sctp_m_freem(control->data);
469 		control->data = NULL;
470 	}
471 	sctp_free_a_readq(stcb, control);
472 }
473 
474 /*
475  * Queue the chunk either right into the socket buffer if it is the next one
476  * to go OR put it in the correct place in the delivery queue.  If we do
477  * append to the so_buf, keep doing so until we are out of order as
478  * long as the control's entered are non-fragmented.
479  */
480 static void
481 sctp_queue_data_to_stream(struct sctp_tcb *stcb,
482     struct sctp_association *asoc,
483     struct sctp_queued_to_read *control, int *abort_flag, int *need_reasm)
484 {
485 	/*
486 	 * FIX-ME maybe? What happens when the ssn wraps? If we are getting
487 	 * all the data in one stream this could happen quite rapidly. One
488 	 * could use the TSN to keep track of things, but this scheme breaks
489 	 * down in the other type of stream usage that could occur. Send a
490 	 * single msg to stream 0, send 4Billion messages to stream 1, now
491 	 * send a message to stream 0. You have a situation where the TSN
492 	 * has wrapped but not in the stream. Is this worth worrying about
493 	 * or should we just change our queue sort at the bottom to be by
494 	 * TSN.
495 	 *
496 	 * Could it also be legal for a peer to send ssn 1 with TSN 2 and
497 	 * ssn 2 with TSN 1? If the peer is doing some sort of funky TSN/SSN
498 	 * assignment this could happen... and I don't see how this would be
499 	 * a violation. So for now I am undecided an will leave the sort by
500 	 * SSN alone. Maybe a hybred approach is the answer
501 	 *
502 	 */
503 	struct sctp_queued_to_read *at;
504 	int queue_needed;
505 	uint32_t nxt_todel;
506 	struct mbuf *op_err;
507 	struct sctp_stream_in *strm;
508 	char msg[SCTP_DIAG_INFO_LEN];
509 
510 	strm = &asoc->strmin[control->sinfo_stream];
511 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
512 		sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_INTO_STRD);
513 	}
514 	if (SCTP_MID_GT((asoc->idata_supported), strm->last_mid_delivered, control->mid)) {
515 		/* The incoming sseq is behind where we last delivered? */
516 		SCTPDBG(SCTP_DEBUG_INDATA1, "Duplicate S-SEQ: %u delivered: %u from peer, Abort association\n",
517 		    strm->last_mid_delivered, control->mid);
518 		/*
519 		 * throw it in the stream so it gets cleaned up in
520 		 * association destruction
521 		 */
522 		TAILQ_INSERT_HEAD(&strm->inqueue, control, next_instrm);
523 		if (asoc->idata_supported) {
524 			SCTP_SNPRINTF(msg, sizeof(msg), "Delivered MID=%8.8x, got TSN=%8.8x, SID=%4.4x, MID=%8.8x",
525 			    strm->last_mid_delivered, control->sinfo_tsn,
526 			    control->sinfo_stream, control->mid);
527 		} else {
528 			SCTP_SNPRINTF(msg, sizeof(msg), "Delivered SSN=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
529 			    (uint16_t)strm->last_mid_delivered,
530 			    control->sinfo_tsn,
531 			    control->sinfo_stream,
532 			    (uint16_t)control->mid);
533 		}
534 		op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
535 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_2;
536 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
537 		*abort_flag = 1;
538 		return;
539 	}
540 	queue_needed = 1;
541 	asoc->size_on_all_streams += control->length;
542 	sctp_ucount_incr(asoc->cnt_on_all_streams);
543 	nxt_todel = strm->last_mid_delivered + 1;
544 	if (SCTP_MID_EQ(asoc->idata_supported, nxt_todel, control->mid)) {
545 		/* can be delivered right away? */
546 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
547 			sctp_log_strm_del(control, NULL, SCTP_STR_LOG_FROM_IMMED_DEL);
548 		}
549 		/* EY it wont be queued if it could be delivered directly */
550 		queue_needed = 0;
551 		if (asoc->size_on_all_streams >= control->length) {
552 			asoc->size_on_all_streams -= control->length;
553 		} else {
554 #ifdef INVARIANTS
555 			panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
556 #else
557 			asoc->size_on_all_streams = 0;
558 #endif
559 		}
560 		sctp_ucount_decr(asoc->cnt_on_all_streams);
561 		strm->last_mid_delivered++;
562 		sctp_mark_non_revokable(asoc, control->sinfo_tsn);
563 		sctp_add_to_readq(stcb->sctp_ep, stcb,
564 		    control,
565 		    &stcb->sctp_socket->so_rcv, 1,
566 		    SCTP_READ_LOCK_NOT_HELD, SCTP_SO_LOCKED);
567 		TAILQ_FOREACH_SAFE(control, &strm->inqueue, next_instrm, at) {
568 			/* all delivered */
569 			nxt_todel = strm->last_mid_delivered + 1;
570 			if (SCTP_MID_EQ(asoc->idata_supported, nxt_todel, control->mid) &&
571 			    (((control->sinfo_flags >> 8) & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG)) {
572 				if (control->on_strm_q == SCTP_ON_ORDERED) {
573 					TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
574 					if (asoc->size_on_all_streams >= control->length) {
575 						asoc->size_on_all_streams -= control->length;
576 					} else {
577 #ifdef INVARIANTS
578 						panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
579 #else
580 						asoc->size_on_all_streams = 0;
581 #endif
582 					}
583 					sctp_ucount_decr(asoc->cnt_on_all_streams);
584 #ifdef INVARIANTS
585 				} else {
586 					panic("Huh control: %p is on_strm_q: %d",
587 					    control, control->on_strm_q);
588 #endif
589 				}
590 				control->on_strm_q = 0;
591 				strm->last_mid_delivered++;
592 				/*
593 				 * We ignore the return of deliver_data here
594 				 * since we always can hold the chunk on the
595 				 * d-queue. And we have a finite number that
596 				 * can be delivered from the strq.
597 				 */
598 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
599 					sctp_log_strm_del(control, NULL,
600 					    SCTP_STR_LOG_FROM_IMMED_DEL);
601 				}
602 				sctp_mark_non_revokable(asoc, control->sinfo_tsn);
603 				sctp_add_to_readq(stcb->sctp_ep, stcb,
604 				    control,
605 				    &stcb->sctp_socket->so_rcv, 1,
606 				    SCTP_READ_LOCK_NOT_HELD,
607 				    SCTP_SO_LOCKED);
608 				continue;
609 			} else if (SCTP_MID_EQ(asoc->idata_supported, nxt_todel, control->mid)) {
610 				*need_reasm = 1;
611 			}
612 			break;
613 		}
614 	}
615 	if (queue_needed) {
616 		/*
617 		 * Ok, we did not deliver this guy, find the correct place
618 		 * to put it on the queue.
619 		 */
620 		if (sctp_place_control_in_stream(strm, asoc, control)) {
621 			SCTP_SNPRINTF(msg, sizeof(msg),
622 			    "Queue to str MID: %u duplicate", control->mid);
623 			sctp_clean_up_control(stcb, control);
624 			op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
625 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_3;
626 			sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
627 			*abort_flag = 1;
628 		}
629 	}
630 }
631 
632 static void
633 sctp_setup_tail_pointer(struct sctp_queued_to_read *control)
634 {
635 	struct mbuf *m, *prev = NULL;
636 	struct sctp_tcb *stcb;
637 
638 	stcb = control->stcb;
639 	control->held_length = 0;
640 	control->length = 0;
641 	m = control->data;
642 	while (m) {
643 		if (SCTP_BUF_LEN(m) == 0) {
644 			/* Skip mbufs with NO length */
645 			if (prev == NULL) {
646 				/* First one */
647 				control->data = sctp_m_free(m);
648 				m = control->data;
649 			} else {
650 				SCTP_BUF_NEXT(prev) = sctp_m_free(m);
651 				m = SCTP_BUF_NEXT(prev);
652 			}
653 			if (m == NULL) {
654 				control->tail_mbuf = prev;
655 			}
656 			continue;
657 		}
658 		prev = m;
659 		atomic_add_int(&control->length, SCTP_BUF_LEN(m));
660 		if (control->on_read_q) {
661 			/*
662 			 * On read queue so we must increment the SB stuff,
663 			 * we assume caller has done any locks of SB.
664 			 */
665 			sctp_sballoc(stcb, &stcb->sctp_socket->so_rcv, m);
666 		}
667 		m = SCTP_BUF_NEXT(m);
668 	}
669 	if (prev) {
670 		control->tail_mbuf = prev;
671 	}
672 }
673 
674 static void
675 sctp_add_to_tail_pointer(struct sctp_queued_to_read *control, struct mbuf *m, uint32_t *added)
676 {
677 	struct mbuf *prev = NULL;
678 	struct sctp_tcb *stcb;
679 
680 	stcb = control->stcb;
681 	if (stcb == NULL) {
682 #ifdef INVARIANTS
683 		panic("Control broken");
684 #else
685 		return;
686 #endif
687 	}
688 	if (control->tail_mbuf == NULL) {
689 		/* TSNH */
690 		sctp_m_freem(control->data);
691 		control->data = m;
692 		sctp_setup_tail_pointer(control);
693 		return;
694 	}
695 	control->tail_mbuf->m_next = m;
696 	while (m) {
697 		if (SCTP_BUF_LEN(m) == 0) {
698 			/* Skip mbufs with NO length */
699 			if (prev == NULL) {
700 				/* First one */
701 				control->tail_mbuf->m_next = sctp_m_free(m);
702 				m = control->tail_mbuf->m_next;
703 			} else {
704 				SCTP_BUF_NEXT(prev) = sctp_m_free(m);
705 				m = SCTP_BUF_NEXT(prev);
706 			}
707 			if (m == NULL) {
708 				control->tail_mbuf = prev;
709 			}
710 			continue;
711 		}
712 		prev = m;
713 		if (control->on_read_q) {
714 			/*
715 			 * On read queue so we must increment the SB stuff,
716 			 * we assume caller has done any locks of SB.
717 			 */
718 			sctp_sballoc(stcb, &stcb->sctp_socket->so_rcv, m);
719 		}
720 		*added += SCTP_BUF_LEN(m);
721 		atomic_add_int(&control->length, SCTP_BUF_LEN(m));
722 		m = SCTP_BUF_NEXT(m);
723 	}
724 	if (prev) {
725 		control->tail_mbuf = prev;
726 	}
727 }
728 
729 static void
730 sctp_build_readq_entry_from_ctl(struct sctp_queued_to_read *nc, struct sctp_queued_to_read *control)
731 {
732 	memset(nc, 0, sizeof(struct sctp_queued_to_read));
733 	nc->sinfo_stream = control->sinfo_stream;
734 	nc->mid = control->mid;
735 	TAILQ_INIT(&nc->reasm);
736 	nc->top_fsn = control->top_fsn;
737 	nc->mid = control->mid;
738 	nc->sinfo_flags = control->sinfo_flags;
739 	nc->sinfo_ppid = control->sinfo_ppid;
740 	nc->sinfo_context = control->sinfo_context;
741 	nc->fsn_included = 0xffffffff;
742 	nc->sinfo_tsn = control->sinfo_tsn;
743 	nc->sinfo_cumtsn = control->sinfo_cumtsn;
744 	nc->sinfo_assoc_id = control->sinfo_assoc_id;
745 	nc->whoFrom = control->whoFrom;
746 	atomic_add_int(&nc->whoFrom->ref_count, 1);
747 	nc->stcb = control->stcb;
748 	nc->port_from = control->port_from;
749 	nc->do_not_ref_stcb = control->do_not_ref_stcb;
750 }
751 
752 static void
753 sctp_reset_a_control(struct sctp_queued_to_read *control,
754     struct sctp_inpcb *inp, uint32_t tsn)
755 {
756 	control->fsn_included = tsn;
757 	if (control->on_read_q) {
758 		/*
759 		 * We have to purge it from there, hopefully this will work
760 		 * :-)
761 		 */
762 		TAILQ_REMOVE(&inp->read_queue, control, next);
763 		control->on_read_q = 0;
764 	}
765 }
766 
767 static int
768 sctp_handle_old_unordered_data(struct sctp_tcb *stcb,
769     struct sctp_association *asoc,
770     struct sctp_stream_in *strm,
771     struct sctp_queued_to_read *control,
772     uint32_t pd_point,
773     int inp_read_lock_held)
774 {
775 	/*
776 	 * Special handling for the old un-ordered data chunk. All the
777 	 * chunks/TSN's go to mid 0. So we have to do the old style watching
778 	 * to see if we have it all. If you return one, no other control
779 	 * entries on the un-ordered queue will be looked at. In theory
780 	 * there should be no others entries in reality, unless the guy is
781 	 * sending both unordered NDATA and unordered DATA...
782 	 */
783 	struct sctp_tmit_chunk *chk, *lchk, *tchk;
784 	uint32_t fsn;
785 	struct sctp_queued_to_read *nc;
786 	int cnt_added;
787 
788 	if (control->first_frag_seen == 0) {
789 		/* Nothing we can do, we have not seen the first piece yet */
790 		return (1);
791 	}
792 	/* Collapse any we can */
793 	cnt_added = 0;
794 restart:
795 	fsn = control->fsn_included + 1;
796 	/* Now what can we add? */
797 	TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, lchk) {
798 		if (chk->rec.data.fsn == fsn) {
799 			/* Ok lets add it */
800 			sctp_alloc_a_readq(stcb, nc);
801 			if (nc == NULL) {
802 				break;
803 			}
804 			memset(nc, 0, sizeof(struct sctp_queued_to_read));
805 			TAILQ_REMOVE(&control->reasm, chk, sctp_next);
806 			sctp_add_chk_to_control(control, strm, stcb, asoc, chk, inp_read_lock_held);
807 			fsn++;
808 			cnt_added++;
809 			chk = NULL;
810 			if (control->end_added) {
811 				/* We are done */
812 				if (!TAILQ_EMPTY(&control->reasm)) {
813 					/*
814 					 * Ok we have to move anything left
815 					 * on the control queue to a new
816 					 * control.
817 					 */
818 					sctp_build_readq_entry_from_ctl(nc, control);
819 					tchk = TAILQ_FIRST(&control->reasm);
820 					if (tchk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
821 						TAILQ_REMOVE(&control->reasm, tchk, sctp_next);
822 						if (asoc->size_on_reasm_queue >= tchk->send_size) {
823 							asoc->size_on_reasm_queue -= tchk->send_size;
824 						} else {
825 #ifdef INVARIANTS
826 							panic("size_on_reasm_queue = %u smaller than chunk length %u", asoc->size_on_reasm_queue, tchk->send_size);
827 #else
828 							asoc->size_on_reasm_queue = 0;
829 #endif
830 						}
831 						sctp_ucount_decr(asoc->cnt_on_reasm_queue);
832 						nc->first_frag_seen = 1;
833 						nc->fsn_included = tchk->rec.data.fsn;
834 						nc->data = tchk->data;
835 						nc->sinfo_ppid = tchk->rec.data.ppid;
836 						nc->sinfo_tsn = tchk->rec.data.tsn;
837 						sctp_mark_non_revokable(asoc, tchk->rec.data.tsn);
838 						tchk->data = NULL;
839 						sctp_free_a_chunk(stcb, tchk, SCTP_SO_NOT_LOCKED);
840 						sctp_setup_tail_pointer(nc);
841 						tchk = TAILQ_FIRST(&control->reasm);
842 					}
843 					/* Spin the rest onto the queue */
844 					while (tchk) {
845 						TAILQ_REMOVE(&control->reasm, tchk, sctp_next);
846 						TAILQ_INSERT_TAIL(&nc->reasm, tchk, sctp_next);
847 						tchk = TAILQ_FIRST(&control->reasm);
848 					}
849 					/*
850 					 * Now lets add it to the queue
851 					 * after removing control
852 					 */
853 					TAILQ_INSERT_TAIL(&strm->uno_inqueue, nc, next_instrm);
854 					nc->on_strm_q = SCTP_ON_UNORDERED;
855 					if (control->on_strm_q) {
856 						TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
857 						control->on_strm_q = 0;
858 					}
859 				}
860 				if (control->pdapi_started) {
861 					strm->pd_api_started = 0;
862 					control->pdapi_started = 0;
863 				}
864 				if (control->on_strm_q) {
865 					TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
866 					control->on_strm_q = 0;
867 					SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
868 				}
869 				if (control->on_read_q == 0) {
870 					sctp_add_to_readq(stcb->sctp_ep, stcb, control,
871 					    &stcb->sctp_socket->so_rcv, control->end_added,
872 					    inp_read_lock_held, SCTP_SO_NOT_LOCKED);
873 				}
874 				sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
875 				if ((nc->first_frag_seen) && !TAILQ_EMPTY(&nc->reasm)) {
876 					/*
877 					 * Switch to the new guy and
878 					 * continue
879 					 */
880 					control = nc;
881 					goto restart;
882 				} else {
883 					if (nc->on_strm_q == 0) {
884 						sctp_free_a_readq(stcb, nc);
885 					}
886 				}
887 				return (1);
888 			} else {
889 				sctp_free_a_readq(stcb, nc);
890 			}
891 		} else {
892 			/* Can't add more */
893 			break;
894 		}
895 	}
896 	if (cnt_added && strm->pd_api_started) {
897 		sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
898 	}
899 	if ((control->length > pd_point) && (strm->pd_api_started == 0)) {
900 		strm->pd_api_started = 1;
901 		control->pdapi_started = 1;
902 		sctp_add_to_readq(stcb->sctp_ep, stcb, control,
903 		    &stcb->sctp_socket->so_rcv, control->end_added,
904 		    inp_read_lock_held, SCTP_SO_NOT_LOCKED);
905 		sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
906 		return (0);
907 	} else {
908 		return (1);
909 	}
910 }
911 
912 static void
913 sctp_inject_old_unordered_data(struct sctp_tcb *stcb,
914     struct sctp_association *asoc,
915     struct sctp_queued_to_read *control,
916     struct sctp_tmit_chunk *chk,
917     int *abort_flag)
918 {
919 	struct sctp_tmit_chunk *at;
920 	int inserted;
921 
922 	/*
923 	 * Here we need to place the chunk into the control structure sorted
924 	 * in the correct order.
925 	 */
926 	if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
927 		/* Its the very first one. */
928 		SCTPDBG(SCTP_DEBUG_XXX,
929 		    "chunk is a first fsn: %u becomes fsn_included\n",
930 		    chk->rec.data.fsn);
931 		at = TAILQ_FIRST(&control->reasm);
932 		if (at && SCTP_TSN_GT(chk->rec.data.fsn, at->rec.data.fsn)) {
933 			/*
934 			 * The first chunk in the reassembly is a smaller
935 			 * TSN than this one, even though this has a first,
936 			 * it must be from a subsequent msg.
937 			 */
938 			goto place_chunk;
939 		}
940 		if (control->first_frag_seen) {
941 			/*
942 			 * In old un-ordered we can reassembly on one
943 			 * control multiple messages. As long as the next
944 			 * FIRST is greater then the old first (TSN i.e. FSN
945 			 * wise)
946 			 */
947 			struct mbuf *tdata;
948 			uint32_t tmp;
949 
950 			if (SCTP_TSN_GT(chk->rec.data.fsn, control->fsn_included)) {
951 				/*
952 				 * Easy way the start of a new guy beyond
953 				 * the lowest
954 				 */
955 				goto place_chunk;
956 			}
957 			if ((chk->rec.data.fsn == control->fsn_included) ||
958 			    (control->pdapi_started)) {
959 				/*
960 				 * Ok this should not happen, if it does we
961 				 * started the pd-api on the higher TSN
962 				 * (since the equals part is a TSN failure
963 				 * it must be that).
964 				 *
965 				 * We are completly hosed in that case since
966 				 * I have no way to recover. This really
967 				 * will only happen if we can get more TSN's
968 				 * higher before the pd-api-point.
969 				 */
970 				sctp_abort_in_reasm(stcb, control, chk,
971 				    abort_flag,
972 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_4);
973 
974 				return;
975 			}
976 			/*
977 			 * Ok we have two firsts and the one we just got is
978 			 * smaller than the one we previously placed.. yuck!
979 			 * We must swap them out.
980 			 */
981 			/* swap the mbufs */
982 			tdata = control->data;
983 			control->data = chk->data;
984 			chk->data = tdata;
985 			/* Save the lengths */
986 			chk->send_size = control->length;
987 			/* Recompute length of control and tail pointer */
988 			sctp_setup_tail_pointer(control);
989 			/* Fix the FSN included */
990 			tmp = control->fsn_included;
991 			control->fsn_included = chk->rec.data.fsn;
992 			chk->rec.data.fsn = tmp;
993 			/* Fix the TSN included */
994 			tmp = control->sinfo_tsn;
995 			control->sinfo_tsn = chk->rec.data.tsn;
996 			chk->rec.data.tsn = tmp;
997 			/* Fix the PPID included */
998 			tmp = control->sinfo_ppid;
999 			control->sinfo_ppid = chk->rec.data.ppid;
1000 			chk->rec.data.ppid = tmp;
1001 			/* Fix tail pointer */
1002 			goto place_chunk;
1003 		}
1004 		control->first_frag_seen = 1;
1005 		control->fsn_included = chk->rec.data.fsn;
1006 		control->top_fsn = chk->rec.data.fsn;
1007 		control->sinfo_tsn = chk->rec.data.tsn;
1008 		control->sinfo_ppid = chk->rec.data.ppid;
1009 		control->data = chk->data;
1010 		sctp_mark_non_revokable(asoc, chk->rec.data.tsn);
1011 		chk->data = NULL;
1012 		sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
1013 		sctp_setup_tail_pointer(control);
1014 		return;
1015 	}
1016 place_chunk:
1017 	inserted = 0;
1018 	TAILQ_FOREACH(at, &control->reasm, sctp_next) {
1019 		if (SCTP_TSN_GT(at->rec.data.fsn, chk->rec.data.fsn)) {
1020 			/*
1021 			 * This one in queue is bigger than the new one,
1022 			 * insert the new one before at.
1023 			 */
1024 			asoc->size_on_reasm_queue += chk->send_size;
1025 			sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1026 			inserted = 1;
1027 			TAILQ_INSERT_BEFORE(at, chk, sctp_next);
1028 			break;
1029 		} else if (at->rec.data.fsn == chk->rec.data.fsn) {
1030 			/*
1031 			 * They sent a duplicate fsn number. This really
1032 			 * should not happen since the FSN is a TSN and it
1033 			 * should have been dropped earlier.
1034 			 */
1035 			sctp_abort_in_reasm(stcb, control, chk,
1036 			    abort_flag,
1037 			    SCTP_FROM_SCTP_INDATA + SCTP_LOC_5);
1038 			return;
1039 		}
1040 	}
1041 	if (inserted == 0) {
1042 		/* Its at the end */
1043 		asoc->size_on_reasm_queue += chk->send_size;
1044 		sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1045 		control->top_fsn = chk->rec.data.fsn;
1046 		TAILQ_INSERT_TAIL(&control->reasm, chk, sctp_next);
1047 	}
1048 }
1049 
1050 static int
1051 sctp_deliver_reasm_check(struct sctp_tcb *stcb, struct sctp_association *asoc,
1052     struct sctp_stream_in *strm, int inp_read_lock_held)
1053 {
1054 	/*
1055 	 * Given a stream, strm, see if any of the SSN's on it that are
1056 	 * fragmented are ready to deliver. If so go ahead and place them on
1057 	 * the read queue. In so placing if we have hit the end, then we
1058 	 * need to remove them from the stream's queue.
1059 	 */
1060 	struct sctp_queued_to_read *control, *nctl = NULL;
1061 	uint32_t next_to_del;
1062 	uint32_t pd_point;
1063 	int ret = 0;
1064 
1065 	if (stcb->sctp_socket) {
1066 		pd_point = min(SCTP_SB_LIMIT_RCV(stcb->sctp_socket) >> SCTP_PARTIAL_DELIVERY_SHIFT,
1067 		    stcb->sctp_ep->partial_delivery_point);
1068 	} else {
1069 		pd_point = stcb->sctp_ep->partial_delivery_point;
1070 	}
1071 	control = TAILQ_FIRST(&strm->uno_inqueue);
1072 
1073 	if ((control != NULL) &&
1074 	    (asoc->idata_supported == 0)) {
1075 		/* Special handling needed for "old" data format */
1076 		if (sctp_handle_old_unordered_data(stcb, asoc, strm, control, pd_point, inp_read_lock_held)) {
1077 			goto done_un;
1078 		}
1079 	}
1080 	if (strm->pd_api_started) {
1081 		/* Can't add more */
1082 		return (0);
1083 	}
1084 	while (control) {
1085 		SCTPDBG(SCTP_DEBUG_XXX, "Looking at control: %p e(%d) ssn: %u top_fsn: %u inc_fsn: %u -uo\n",
1086 		    control, control->end_added, control->mid, control->top_fsn, control->fsn_included);
1087 		nctl = TAILQ_NEXT(control, next_instrm);
1088 		if (control->end_added) {
1089 			/* We just put the last bit on */
1090 			if (control->on_strm_q) {
1091 #ifdef INVARIANTS
1092 				if (control->on_strm_q != SCTP_ON_UNORDERED) {
1093 					panic("Huh control: %p on_q: %d -- not unordered?",
1094 					    control, control->on_strm_q);
1095 				}
1096 #endif
1097 				SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
1098 				TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
1099 				if (asoc->size_on_all_streams >= control->length) {
1100 					asoc->size_on_all_streams -= control->length;
1101 				} else {
1102 #ifdef INVARIANTS
1103 					panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
1104 #else
1105 					asoc->size_on_all_streams = 0;
1106 #endif
1107 				}
1108 				sctp_ucount_decr(asoc->cnt_on_all_streams);
1109 				control->on_strm_q = 0;
1110 			}
1111 			if (control->on_read_q == 0) {
1112 				sctp_add_to_readq(stcb->sctp_ep, stcb,
1113 				    control,
1114 				    &stcb->sctp_socket->so_rcv, control->end_added,
1115 				    inp_read_lock_held, SCTP_SO_NOT_LOCKED);
1116 			}
1117 		} else {
1118 			/* Can we do a PD-API for this un-ordered guy? */
1119 			if ((control->length >= pd_point) && (strm->pd_api_started == 0)) {
1120 				strm->pd_api_started = 1;
1121 				control->pdapi_started = 1;
1122 				sctp_add_to_readq(stcb->sctp_ep, stcb,
1123 				    control,
1124 				    &stcb->sctp_socket->so_rcv, control->end_added,
1125 				    inp_read_lock_held, SCTP_SO_NOT_LOCKED);
1126 
1127 				break;
1128 			}
1129 		}
1130 		control = nctl;
1131 	}
1132 done_un:
1133 	control = TAILQ_FIRST(&strm->inqueue);
1134 	if (strm->pd_api_started) {
1135 		/* Can't add more */
1136 		return (0);
1137 	}
1138 	if (control == NULL) {
1139 		return (ret);
1140 	}
1141 	if (SCTP_MID_EQ(asoc->idata_supported, strm->last_mid_delivered, control->mid)) {
1142 		/*
1143 		 * Ok the guy at the top was being partially delivered
1144 		 * completed, so we remove it. Note the pd_api flag was
1145 		 * taken off when the chunk was merged on in
1146 		 * sctp_queue_data_for_reasm below.
1147 		 */
1148 		nctl = TAILQ_NEXT(control, next_instrm);
1149 		SCTPDBG(SCTP_DEBUG_XXX,
1150 		    "Looking at control: %p e(%d) ssn: %u top_fsn: %u inc_fsn: %u (lastdel: %u)- o\n",
1151 		    control, control->end_added, control->mid,
1152 		    control->top_fsn, control->fsn_included,
1153 		    strm->last_mid_delivered);
1154 		if (control->end_added) {
1155 			if (control->on_strm_q) {
1156 #ifdef INVARIANTS
1157 				if (control->on_strm_q != SCTP_ON_ORDERED) {
1158 					panic("Huh control: %p on_q: %d -- not ordered?",
1159 					    control, control->on_strm_q);
1160 				}
1161 #endif
1162 				SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
1163 				TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
1164 				if (asoc->size_on_all_streams >= control->length) {
1165 					asoc->size_on_all_streams -= control->length;
1166 				} else {
1167 #ifdef INVARIANTS
1168 					panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
1169 #else
1170 					asoc->size_on_all_streams = 0;
1171 #endif
1172 				}
1173 				sctp_ucount_decr(asoc->cnt_on_all_streams);
1174 				control->on_strm_q = 0;
1175 			}
1176 			if (strm->pd_api_started && control->pdapi_started) {
1177 				control->pdapi_started = 0;
1178 				strm->pd_api_started = 0;
1179 			}
1180 			if (control->on_read_q == 0) {
1181 				sctp_add_to_readq(stcb->sctp_ep, stcb,
1182 				    control,
1183 				    &stcb->sctp_socket->so_rcv, control->end_added,
1184 				    inp_read_lock_held, SCTP_SO_NOT_LOCKED);
1185 			}
1186 			control = nctl;
1187 		}
1188 	}
1189 	if (strm->pd_api_started) {
1190 		/*
1191 		 * Can't add more must have gotten an un-ordered above being
1192 		 * partially delivered.
1193 		 */
1194 		return (0);
1195 	}
1196 deliver_more:
1197 	next_to_del = strm->last_mid_delivered + 1;
1198 	if (control) {
1199 		SCTPDBG(SCTP_DEBUG_XXX,
1200 		    "Looking at control: %p e(%d) ssn: %u top_fsn: %u inc_fsn: %u (nxtdel: %u)- o\n",
1201 		    control, control->end_added, control->mid, control->top_fsn, control->fsn_included,
1202 		    next_to_del);
1203 		nctl = TAILQ_NEXT(control, next_instrm);
1204 		if (SCTP_MID_EQ(asoc->idata_supported, control->mid, next_to_del) &&
1205 		    (control->first_frag_seen)) {
1206 			int done;
1207 
1208 			/* Ok we can deliver it onto the stream. */
1209 			if (control->end_added) {
1210 				/* We are done with it afterwards */
1211 				if (control->on_strm_q) {
1212 #ifdef INVARIANTS
1213 					if (control->on_strm_q != SCTP_ON_ORDERED) {
1214 						panic("Huh control: %p on_q: %d -- not ordered?",
1215 						    control, control->on_strm_q);
1216 					}
1217 #endif
1218 					SCTP_STAT_INCR_COUNTER64(sctps_reasmusrmsgs);
1219 					TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
1220 					if (asoc->size_on_all_streams >= control->length) {
1221 						asoc->size_on_all_streams -= control->length;
1222 					} else {
1223 #ifdef INVARIANTS
1224 						panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
1225 #else
1226 						asoc->size_on_all_streams = 0;
1227 #endif
1228 					}
1229 					sctp_ucount_decr(asoc->cnt_on_all_streams);
1230 					control->on_strm_q = 0;
1231 				}
1232 				ret++;
1233 			}
1234 			if (((control->sinfo_flags >> 8) & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
1235 				/*
1236 				 * A singleton now slipping through - mark
1237 				 * it non-revokable too
1238 				 */
1239 				sctp_mark_non_revokable(asoc, control->sinfo_tsn);
1240 			} else if (control->end_added == 0) {
1241 				/*
1242 				 * Check if we can defer adding until its
1243 				 * all there
1244 				 */
1245 				if ((control->length < pd_point) || (strm->pd_api_started)) {
1246 					/*
1247 					 * Don't need it or cannot add more
1248 					 * (one being delivered that way)
1249 					 */
1250 					goto out;
1251 				}
1252 			}
1253 			done = (control->end_added) && (control->last_frag_seen);
1254 			if (control->on_read_q == 0) {
1255 				if (!done) {
1256 					if (asoc->size_on_all_streams >= control->length) {
1257 						asoc->size_on_all_streams -= control->length;
1258 					} else {
1259 #ifdef INVARIANTS
1260 						panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
1261 #else
1262 						asoc->size_on_all_streams = 0;
1263 #endif
1264 					}
1265 					strm->pd_api_started = 1;
1266 					control->pdapi_started = 1;
1267 				}
1268 				sctp_add_to_readq(stcb->sctp_ep, stcb,
1269 				    control,
1270 				    &stcb->sctp_socket->so_rcv, control->end_added,
1271 				    inp_read_lock_held, SCTP_SO_NOT_LOCKED);
1272 			}
1273 			strm->last_mid_delivered = next_to_del;
1274 			if (done) {
1275 				control = nctl;
1276 				goto deliver_more;
1277 			}
1278 		}
1279 	}
1280 out:
1281 	return (ret);
1282 }
1283 
1284 uint32_t
1285 sctp_add_chk_to_control(struct sctp_queued_to_read *control,
1286     struct sctp_stream_in *strm,
1287     struct sctp_tcb *stcb, struct sctp_association *asoc,
1288     struct sctp_tmit_chunk *chk, int hold_rlock)
1289 {
1290 	/*
1291 	 * Given a control and a chunk, merge the data from the chk onto the
1292 	 * control and free up the chunk resources.
1293 	 */
1294 	uint32_t added = 0;
1295 	int i_locked = 0;
1296 
1297 	if (control->on_read_q && (hold_rlock == 0)) {
1298 		/*
1299 		 * Its being pd-api'd so we must do some locks.
1300 		 */
1301 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
1302 		i_locked = 1;
1303 	}
1304 	if (control->data == NULL) {
1305 		control->data = chk->data;
1306 		sctp_setup_tail_pointer(control);
1307 	} else {
1308 		sctp_add_to_tail_pointer(control, chk->data, &added);
1309 	}
1310 	control->fsn_included = chk->rec.data.fsn;
1311 	asoc->size_on_reasm_queue -= chk->send_size;
1312 	sctp_ucount_decr(asoc->cnt_on_reasm_queue);
1313 	sctp_mark_non_revokable(asoc, chk->rec.data.tsn);
1314 	chk->data = NULL;
1315 	if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1316 		control->first_frag_seen = 1;
1317 		control->sinfo_tsn = chk->rec.data.tsn;
1318 		control->sinfo_ppid = chk->rec.data.ppid;
1319 	}
1320 	if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1321 		/* Its complete */
1322 		if ((control->on_strm_q) && (control->on_read_q)) {
1323 			if (control->pdapi_started) {
1324 				control->pdapi_started = 0;
1325 				strm->pd_api_started = 0;
1326 			}
1327 			if (control->on_strm_q == SCTP_ON_UNORDERED) {
1328 				/* Unordered */
1329 				TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
1330 				control->on_strm_q = 0;
1331 			} else if (control->on_strm_q == SCTP_ON_ORDERED) {
1332 				/* Ordered */
1333 				TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
1334 				/*
1335 				 * Don't need to decrement
1336 				 * size_on_all_streams, since control is on
1337 				 * the read queue.
1338 				 */
1339 				sctp_ucount_decr(asoc->cnt_on_all_streams);
1340 				control->on_strm_q = 0;
1341 #ifdef INVARIANTS
1342 			} else if (control->on_strm_q) {
1343 				panic("Unknown state on ctrl: %p on_strm_q: %d", control,
1344 				    control->on_strm_q);
1345 #endif
1346 			}
1347 		}
1348 		control->end_added = 1;
1349 		control->last_frag_seen = 1;
1350 	}
1351 	if (i_locked) {
1352 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
1353 	}
1354 	sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
1355 	return (added);
1356 }
1357 
1358 /*
1359  * Dump onto the re-assembly queue, in its proper place. After dumping on the
1360  * queue, see if anthing can be delivered. If so pull it off (or as much as
1361  * we can. If we run out of space then we must dump what we can and set the
1362  * appropriate flag to say we queued what we could.
1363  */
1364 static void
1365 sctp_queue_data_for_reasm(struct sctp_tcb *stcb, struct sctp_association *asoc,
1366     struct sctp_queued_to_read *control,
1367     struct sctp_tmit_chunk *chk,
1368     int created_control,
1369     int *abort_flag, uint32_t tsn)
1370 {
1371 	uint32_t next_fsn;
1372 	struct sctp_tmit_chunk *at, *nat;
1373 	struct sctp_stream_in *strm;
1374 	int do_wakeup, unordered;
1375 	uint32_t lenadded;
1376 
1377 	strm = &asoc->strmin[control->sinfo_stream];
1378 	/*
1379 	 * For old un-ordered data chunks.
1380 	 */
1381 	if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
1382 		unordered = 1;
1383 	} else {
1384 		unordered = 0;
1385 	}
1386 	/* Must be added to the stream-in queue */
1387 	if (created_control) {
1388 		if ((unordered == 0) || (asoc->idata_supported)) {
1389 			sctp_ucount_incr(asoc->cnt_on_all_streams);
1390 		}
1391 		if (sctp_place_control_in_stream(strm, asoc, control)) {
1392 			/* Duplicate SSN? */
1393 			sctp_abort_in_reasm(stcb, control, chk,
1394 			    abort_flag,
1395 			    SCTP_FROM_SCTP_INDATA + SCTP_LOC_6);
1396 			sctp_clean_up_control(stcb, control);
1397 			return;
1398 		}
1399 		if ((tsn == (asoc->cumulative_tsn + 1) && (asoc->idata_supported == 0))) {
1400 			/*
1401 			 * Ok we created this control and now lets validate
1402 			 * that its legal i.e. there is a B bit set, if not
1403 			 * and we have up to the cum-ack then its invalid.
1404 			 */
1405 			if ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0) {
1406 				sctp_abort_in_reasm(stcb, control, chk,
1407 				    abort_flag,
1408 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_7);
1409 				return;
1410 			}
1411 		}
1412 	}
1413 	if ((asoc->idata_supported == 0) && (unordered == 1)) {
1414 		sctp_inject_old_unordered_data(stcb, asoc, control, chk, abort_flag);
1415 		return;
1416 	}
1417 	/*
1418 	 * Ok we must queue the chunk into the reasembly portion: o if its
1419 	 * the first it goes to the control mbuf. o if its not first but the
1420 	 * next in sequence it goes to the control, and each succeeding one
1421 	 * in order also goes. o if its not in order we place it on the list
1422 	 * in its place.
1423 	 */
1424 	if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
1425 		/* Its the very first one. */
1426 		SCTPDBG(SCTP_DEBUG_XXX,
1427 		    "chunk is a first fsn: %u becomes fsn_included\n",
1428 		    chk->rec.data.fsn);
1429 		if (control->first_frag_seen) {
1430 			/*
1431 			 * Error on senders part, they either sent us two
1432 			 * data chunks with FIRST, or they sent two
1433 			 * un-ordered chunks that were fragmented at the
1434 			 * same time in the same stream.
1435 			 */
1436 			sctp_abort_in_reasm(stcb, control, chk,
1437 			    abort_flag,
1438 			    SCTP_FROM_SCTP_INDATA + SCTP_LOC_8);
1439 			return;
1440 		}
1441 		control->first_frag_seen = 1;
1442 		control->sinfo_ppid = chk->rec.data.ppid;
1443 		control->sinfo_tsn = chk->rec.data.tsn;
1444 		control->fsn_included = chk->rec.data.fsn;
1445 		control->data = chk->data;
1446 		sctp_mark_non_revokable(asoc, chk->rec.data.tsn);
1447 		chk->data = NULL;
1448 		sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
1449 		sctp_setup_tail_pointer(control);
1450 		asoc->size_on_all_streams += control->length;
1451 	} else {
1452 		/* Place the chunk in our list */
1453 		int inserted = 0;
1454 
1455 		if (control->last_frag_seen == 0) {
1456 			/* Still willing to raise highest FSN seen */
1457 			if (SCTP_TSN_GT(chk->rec.data.fsn, control->top_fsn)) {
1458 				SCTPDBG(SCTP_DEBUG_XXX,
1459 				    "We have a new top_fsn: %u\n",
1460 				    chk->rec.data.fsn);
1461 				control->top_fsn = chk->rec.data.fsn;
1462 			}
1463 			if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1464 				SCTPDBG(SCTP_DEBUG_XXX,
1465 				    "The last fsn is now in place fsn: %u\n",
1466 				    chk->rec.data.fsn);
1467 				control->last_frag_seen = 1;
1468 				if (SCTP_TSN_GT(control->top_fsn, chk->rec.data.fsn)) {
1469 					SCTPDBG(SCTP_DEBUG_XXX,
1470 					    "New fsn: %u is not at top_fsn: %u -- abort\n",
1471 					    chk->rec.data.fsn,
1472 					    control->top_fsn);
1473 					sctp_abort_in_reasm(stcb, control, chk,
1474 					    abort_flag,
1475 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_9);
1476 					return;
1477 				}
1478 			}
1479 			if (asoc->idata_supported || control->first_frag_seen) {
1480 				/*
1481 				 * For IDATA we always check since we know
1482 				 * that the first fragment is 0. For old
1483 				 * DATA we have to receive the first before
1484 				 * we know the first FSN (which is the TSN).
1485 				 */
1486 				if (SCTP_TSN_GE(control->fsn_included, chk->rec.data.fsn)) {
1487 					/*
1488 					 * We have already delivered up to
1489 					 * this so its a dup
1490 					 */
1491 					sctp_abort_in_reasm(stcb, control, chk,
1492 					    abort_flag,
1493 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_10);
1494 					return;
1495 				}
1496 			}
1497 		} else {
1498 			if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1499 				/* Second last? huh? */
1500 				SCTPDBG(SCTP_DEBUG_XXX,
1501 				    "Duplicate last fsn: %u (top: %u) -- abort\n",
1502 				    chk->rec.data.fsn, control->top_fsn);
1503 				sctp_abort_in_reasm(stcb, control,
1504 				    chk, abort_flag,
1505 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_11);
1506 				return;
1507 			}
1508 			if (asoc->idata_supported || control->first_frag_seen) {
1509 				/*
1510 				 * For IDATA we always check since we know
1511 				 * that the first fragment is 0. For old
1512 				 * DATA we have to receive the first before
1513 				 * we know the first FSN (which is the TSN).
1514 				 */
1515 
1516 				if (SCTP_TSN_GE(control->fsn_included, chk->rec.data.fsn)) {
1517 					/*
1518 					 * We have already delivered up to
1519 					 * this so its a dup
1520 					 */
1521 					SCTPDBG(SCTP_DEBUG_XXX,
1522 					    "New fsn: %u is already seen in included_fsn: %u -- abort\n",
1523 					    chk->rec.data.fsn, control->fsn_included);
1524 					sctp_abort_in_reasm(stcb, control, chk,
1525 					    abort_flag,
1526 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_12);
1527 					return;
1528 				}
1529 			}
1530 			/*
1531 			 * validate not beyond top FSN if we have seen last
1532 			 * one
1533 			 */
1534 			if (SCTP_TSN_GT(chk->rec.data.fsn, control->top_fsn)) {
1535 				SCTPDBG(SCTP_DEBUG_XXX,
1536 				    "New fsn: %u is beyond or at top_fsn: %u -- abort\n",
1537 				    chk->rec.data.fsn,
1538 				    control->top_fsn);
1539 				sctp_abort_in_reasm(stcb, control, chk,
1540 				    abort_flag,
1541 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_13);
1542 				return;
1543 			}
1544 		}
1545 		/*
1546 		 * If we reach here, we need to place the new chunk in the
1547 		 * reassembly for this control.
1548 		 */
1549 		SCTPDBG(SCTP_DEBUG_XXX,
1550 		    "chunk is a not first fsn: %u needs to be inserted\n",
1551 		    chk->rec.data.fsn);
1552 		TAILQ_FOREACH(at, &control->reasm, sctp_next) {
1553 			if (SCTP_TSN_GT(at->rec.data.fsn, chk->rec.data.fsn)) {
1554 				if (chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
1555 					/* Last not at the end? huh? */
1556 					SCTPDBG(SCTP_DEBUG_XXX,
1557 					    "Last fragment not last in list: -- abort\n");
1558 					sctp_abort_in_reasm(stcb, control,
1559 					    chk, abort_flag,
1560 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_14);
1561 					return;
1562 				}
1563 				/*
1564 				 * This one in queue is bigger than the new
1565 				 * one, insert the new one before at.
1566 				 */
1567 				SCTPDBG(SCTP_DEBUG_XXX,
1568 				    "Insert it before fsn: %u\n",
1569 				    at->rec.data.fsn);
1570 				asoc->size_on_reasm_queue += chk->send_size;
1571 				sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1572 				TAILQ_INSERT_BEFORE(at, chk, sctp_next);
1573 				inserted = 1;
1574 				break;
1575 			} else if (at->rec.data.fsn == chk->rec.data.fsn) {
1576 				/*
1577 				 * Gak, He sent me a duplicate str seq
1578 				 * number
1579 				 */
1580 				/*
1581 				 * foo bar, I guess I will just free this
1582 				 * new guy, should we abort too? FIX ME
1583 				 * MAYBE? Or it COULD be that the SSN's have
1584 				 * wrapped. Maybe I should compare to TSN
1585 				 * somehow... sigh for now just blow away
1586 				 * the chunk!
1587 				 */
1588 				SCTPDBG(SCTP_DEBUG_XXX,
1589 				    "Duplicate to fsn: %u -- abort\n",
1590 				    at->rec.data.fsn);
1591 				sctp_abort_in_reasm(stcb, control,
1592 				    chk, abort_flag,
1593 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_15);
1594 				return;
1595 			}
1596 		}
1597 		if (inserted == 0) {
1598 			/* Goes on the end */
1599 			SCTPDBG(SCTP_DEBUG_XXX, "Inserting at tail of list fsn: %u\n",
1600 			    chk->rec.data.fsn);
1601 			asoc->size_on_reasm_queue += chk->send_size;
1602 			sctp_ucount_incr(asoc->cnt_on_reasm_queue);
1603 			TAILQ_INSERT_TAIL(&control->reasm, chk, sctp_next);
1604 		}
1605 	}
1606 	/*
1607 	 * Ok lets see if we can suck any up into the control structure that
1608 	 * are in seq if it makes sense.
1609 	 */
1610 	do_wakeup = 0;
1611 	/*
1612 	 * If the first fragment has not been seen there is no sense in
1613 	 * looking.
1614 	 */
1615 	if (control->first_frag_seen) {
1616 		next_fsn = control->fsn_included + 1;
1617 		TAILQ_FOREACH_SAFE(at, &control->reasm, sctp_next, nat) {
1618 			if (at->rec.data.fsn == next_fsn) {
1619 				/* We can add this one now to the control */
1620 				SCTPDBG(SCTP_DEBUG_XXX,
1621 				    "Adding more to control: %p at: %p fsn: %u next_fsn: %u included: %u\n",
1622 				    control, at,
1623 				    at->rec.data.fsn,
1624 				    next_fsn, control->fsn_included);
1625 				TAILQ_REMOVE(&control->reasm, at, sctp_next);
1626 				lenadded = sctp_add_chk_to_control(control, strm, stcb, asoc, at, SCTP_READ_LOCK_NOT_HELD);
1627 				if (control->on_read_q) {
1628 					do_wakeup = 1;
1629 				} else {
1630 					/*
1631 					 * We only add to the
1632 					 * size-on-all-streams if its not on
1633 					 * the read q. The read q flag will
1634 					 * cause a sballoc so its accounted
1635 					 * for there.
1636 					 */
1637 					asoc->size_on_all_streams += lenadded;
1638 				}
1639 				next_fsn++;
1640 				if (control->end_added && control->pdapi_started) {
1641 					if (strm->pd_api_started) {
1642 						strm->pd_api_started = 0;
1643 						control->pdapi_started = 0;
1644 					}
1645 					if (control->on_read_q == 0) {
1646 						sctp_add_to_readq(stcb->sctp_ep, stcb,
1647 						    control,
1648 						    &stcb->sctp_socket->so_rcv, control->end_added,
1649 						    SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
1650 					}
1651 					break;
1652 				}
1653 			} else {
1654 				break;
1655 			}
1656 		}
1657 	}
1658 	if (do_wakeup) {
1659 		/* Need to wakeup the reader */
1660 		sctp_wakeup_the_read_socket(stcb->sctp_ep, stcb, SCTP_SO_NOT_LOCKED);
1661 	}
1662 }
1663 
1664 static struct sctp_queued_to_read *
1665 sctp_find_reasm_entry(struct sctp_stream_in *strm, uint32_t mid, int ordered, int idata_supported)
1666 {
1667 	struct sctp_queued_to_read *control;
1668 
1669 	if (ordered) {
1670 		TAILQ_FOREACH(control, &strm->inqueue, next_instrm) {
1671 			if (SCTP_MID_EQ(idata_supported, control->mid, mid)) {
1672 				break;
1673 			}
1674 		}
1675 	} else {
1676 		if (idata_supported) {
1677 			TAILQ_FOREACH(control, &strm->uno_inqueue, next_instrm) {
1678 				if (SCTP_MID_EQ(idata_supported, control->mid, mid)) {
1679 					break;
1680 				}
1681 			}
1682 		} else {
1683 			control = TAILQ_FIRST(&strm->uno_inqueue);
1684 		}
1685 	}
1686 	return (control);
1687 }
1688 
1689 static int
1690 sctp_process_a_data_chunk(struct sctp_tcb *stcb, struct sctp_association *asoc,
1691     struct mbuf **m, int offset, int chk_length,
1692     struct sctp_nets *net, uint32_t *high_tsn, int *abort_flag,
1693     int *break_flag, int last_chunk, uint8_t chk_type)
1694 {
1695 	struct sctp_tmit_chunk *chk = NULL;	/* make gcc happy */
1696 	struct sctp_stream_in *strm;
1697 	uint32_t tsn, fsn, gap, mid;
1698 	struct mbuf *dmbuf;
1699 	int the_len;
1700 	int need_reasm_check = 0;
1701 	uint16_t sid;
1702 	struct mbuf *op_err;
1703 	char msg[SCTP_DIAG_INFO_LEN];
1704 	struct sctp_queued_to_read *control, *ncontrol;
1705 	uint32_t ppid;
1706 	uint8_t chk_flags;
1707 	struct sctp_stream_reset_list *liste;
1708 	int ordered;
1709 	size_t clen;
1710 	int created_control = 0;
1711 
1712 	if (chk_type == SCTP_IDATA) {
1713 		struct sctp_idata_chunk *chunk, chunk_buf;
1714 
1715 		chunk = (struct sctp_idata_chunk *)sctp_m_getptr(*m, offset,
1716 		    sizeof(struct sctp_idata_chunk), (uint8_t *)&chunk_buf);
1717 		chk_flags = chunk->ch.chunk_flags;
1718 		clen = sizeof(struct sctp_idata_chunk);
1719 		tsn = ntohl(chunk->dp.tsn);
1720 		sid = ntohs(chunk->dp.sid);
1721 		mid = ntohl(chunk->dp.mid);
1722 		if (chk_flags & SCTP_DATA_FIRST_FRAG) {
1723 			fsn = 0;
1724 			ppid = chunk->dp.ppid_fsn.ppid;
1725 		} else {
1726 			fsn = ntohl(chunk->dp.ppid_fsn.fsn);
1727 			ppid = 0xffffffff;	/* Use as an invalid value. */
1728 		}
1729 	} else {
1730 		struct sctp_data_chunk *chunk, chunk_buf;
1731 
1732 		chunk = (struct sctp_data_chunk *)sctp_m_getptr(*m, offset,
1733 		    sizeof(struct sctp_data_chunk), (uint8_t *)&chunk_buf);
1734 		chk_flags = chunk->ch.chunk_flags;
1735 		clen = sizeof(struct sctp_data_chunk);
1736 		tsn = ntohl(chunk->dp.tsn);
1737 		sid = ntohs(chunk->dp.sid);
1738 		mid = (uint32_t)(ntohs(chunk->dp.ssn));
1739 		fsn = tsn;
1740 		ppid = chunk->dp.ppid;
1741 	}
1742 	if ((size_t)chk_length == clen) {
1743 		/*
1744 		 * Need to send an abort since we had a empty data chunk.
1745 		 */
1746 		op_err = sctp_generate_no_user_data_cause(tsn);
1747 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_16;
1748 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1749 		*abort_flag = 1;
1750 		return (0);
1751 	}
1752 	if ((chk_flags & SCTP_DATA_SACK_IMMEDIATELY) == SCTP_DATA_SACK_IMMEDIATELY) {
1753 		asoc->send_sack = 1;
1754 	}
1755 	ordered = ((chk_flags & SCTP_DATA_UNORDERED) == 0);
1756 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
1757 		sctp_log_map(tsn, asoc->cumulative_tsn, asoc->highest_tsn_inside_map, SCTP_MAP_TSN_ENTERS);
1758 	}
1759 	if (stcb == NULL) {
1760 		return (0);
1761 	}
1762 	SCTP_LTRACE_CHK(stcb->sctp_ep, stcb, chk_type, tsn);
1763 	if (SCTP_TSN_GE(asoc->cumulative_tsn, tsn)) {
1764 		/* It is a duplicate */
1765 		SCTP_STAT_INCR(sctps_recvdupdata);
1766 		if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1767 			/* Record a dup for the next outbound sack */
1768 			asoc->dup_tsns[asoc->numduptsns] = tsn;
1769 			asoc->numduptsns++;
1770 		}
1771 		asoc->send_sack = 1;
1772 		return (0);
1773 	}
1774 	/* Calculate the number of TSN's between the base and this TSN */
1775 	SCTP_CALC_TSN_TO_GAP(gap, tsn, asoc->mapping_array_base_tsn);
1776 	if (gap >= (SCTP_MAPPING_ARRAY << 3)) {
1777 		/* Can't hold the bit in the mapping at max array, toss it */
1778 		return (0);
1779 	}
1780 	if (gap >= (uint32_t)(asoc->mapping_array_size << 3)) {
1781 		SCTP_TCB_LOCK_ASSERT(stcb);
1782 		if (sctp_expand_mapping_array(asoc, gap)) {
1783 			/* Can't expand, drop it */
1784 			return (0);
1785 		}
1786 	}
1787 	if (SCTP_TSN_GT(tsn, *high_tsn)) {
1788 		*high_tsn = tsn;
1789 	}
1790 	/* See if we have received this one already */
1791 	if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap) ||
1792 	    SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, gap)) {
1793 		SCTP_STAT_INCR(sctps_recvdupdata);
1794 		if (asoc->numduptsns < SCTP_MAX_DUP_TSNS) {
1795 			/* Record a dup for the next outbound sack */
1796 			asoc->dup_tsns[asoc->numduptsns] = tsn;
1797 			asoc->numduptsns++;
1798 		}
1799 		asoc->send_sack = 1;
1800 		return (0);
1801 	}
1802 	/*
1803 	 * Check to see about the GONE flag, duplicates would cause a sack
1804 	 * to be sent up above
1805 	 */
1806 	if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
1807 	    (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
1808 	    (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET))) {
1809 		/*
1810 		 * wait a minute, this guy is gone, there is no longer a
1811 		 * receiver. Send peer an ABORT!
1812 		 */
1813 		op_err = sctp_generate_cause(SCTP_CAUSE_OUT_OF_RESC, "");
1814 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1815 		*abort_flag = 1;
1816 		return (0);
1817 	}
1818 	/*
1819 	 * Now before going further we see if there is room. If NOT then we
1820 	 * MAY let one through only IF this TSN is the one we are waiting
1821 	 * for on a partial delivery API.
1822 	 */
1823 
1824 	/* Is the stream valid? */
1825 	if (sid >= asoc->streamincnt) {
1826 		struct sctp_error_invalid_stream *cause;
1827 
1828 		op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_error_invalid_stream),
1829 		    0, M_NOWAIT, 1, MT_DATA);
1830 		if (op_err != NULL) {
1831 			/* add some space up front so prepend will work well */
1832 			SCTP_BUF_RESV_UF(op_err, sizeof(struct sctp_chunkhdr));
1833 			cause = mtod(op_err, struct sctp_error_invalid_stream *);
1834 			/*
1835 			 * Error causes are just param's and this one has
1836 			 * two back to back phdr, one with the error type
1837 			 * and size, the other with the streamid and a rsvd
1838 			 */
1839 			SCTP_BUF_LEN(op_err) = sizeof(struct sctp_error_invalid_stream);
1840 			cause->cause.code = htons(SCTP_CAUSE_INVALID_STREAM);
1841 			cause->cause.length = htons(sizeof(struct sctp_error_invalid_stream));
1842 			cause->stream_id = htons(sid);
1843 			cause->reserved = htons(0);
1844 			sctp_queue_op_err(stcb, op_err);
1845 		}
1846 		SCTP_STAT_INCR(sctps_badsid);
1847 		SCTP_TCB_LOCK_ASSERT(stcb);
1848 		SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
1849 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1850 			asoc->highest_tsn_inside_nr_map = tsn;
1851 		}
1852 		if (tsn == (asoc->cumulative_tsn + 1)) {
1853 			/* Update cum-ack */
1854 			asoc->cumulative_tsn = tsn;
1855 		}
1856 		return (0);
1857 	}
1858 	/*
1859 	 * If its a fragmented message, lets see if we can find the control
1860 	 * on the reassembly queues.
1861 	 */
1862 	if ((chk_type == SCTP_IDATA) &&
1863 	    ((chk_flags & SCTP_DATA_FIRST_FRAG) == 0) &&
1864 	    (fsn == 0)) {
1865 		/*
1866 		 * The first *must* be fsn 0, and other (middle/end) pieces
1867 		 * can *not* be fsn 0. XXX: This can happen in case of a
1868 		 * wrap around. Ignore is for now.
1869 		 */
1870 		SCTP_SNPRINTF(msg, sizeof(msg), "FSN zero for MID=%8.8x, but flags=%2.2x", mid, chk_flags);
1871 		goto err_out;
1872 	}
1873 	control = sctp_find_reasm_entry(&asoc->strmin[sid], mid, ordered, asoc->idata_supported);
1874 	SCTPDBG(SCTP_DEBUG_XXX, "chunk_flags:0x%x look for control on queues %p\n",
1875 	    chk_flags, control);
1876 	if ((chk_flags & SCTP_DATA_NOT_FRAG) != SCTP_DATA_NOT_FRAG) {
1877 		/* See if we can find the re-assembly entity */
1878 		if (control != NULL) {
1879 			/* We found something, does it belong? */
1880 			if (ordered && (mid != control->mid)) {
1881 				SCTP_SNPRINTF(msg, sizeof(msg), "Reassembly problem (MID=%8.8x)", mid);
1882 		err_out:
1883 				op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
1884 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_17;
1885 				sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
1886 				*abort_flag = 1;
1887 				return (0);
1888 			}
1889 			if (ordered && ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED)) {
1890 				/*
1891 				 * We can't have a switched order with an
1892 				 * unordered chunk
1893 				 */
1894 				SCTP_SNPRINTF(msg, sizeof(msg),
1895 				    "All fragments of a user message must be ordered or unordered (TSN=%8.8x)",
1896 				    tsn);
1897 				goto err_out;
1898 			}
1899 			if (!ordered && (((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) == 0)) {
1900 				/*
1901 				 * We can't have a switched unordered with a
1902 				 * ordered chunk
1903 				 */
1904 				SCTP_SNPRINTF(msg, sizeof(msg),
1905 				    "All fragments of a user message must be ordered or unordered (TSN=%8.8x)",
1906 				    tsn);
1907 				goto err_out;
1908 			}
1909 		}
1910 	} else {
1911 		/*
1912 		 * Its a complete segment. Lets validate we don't have a
1913 		 * re-assembly going on with the same Stream/Seq (for
1914 		 * ordered) or in the same Stream for unordered.
1915 		 */
1916 		if (control != NULL) {
1917 			if (ordered || asoc->idata_supported) {
1918 				SCTPDBG(SCTP_DEBUG_XXX, "chunk_flags: 0x%x dup detected on MID: %u\n",
1919 				    chk_flags, mid);
1920 				SCTP_SNPRINTF(msg, sizeof(msg), "Duplicate MID=%8.8x detected.", mid);
1921 				goto err_out;
1922 			} else {
1923 				if ((tsn == control->fsn_included + 1) &&
1924 				    (control->end_added == 0)) {
1925 					SCTP_SNPRINTF(msg, sizeof(msg),
1926 					    "Illegal message sequence, missing end for MID: %8.8x",
1927 					    control->fsn_included);
1928 					goto err_out;
1929 				} else {
1930 					control = NULL;
1931 				}
1932 			}
1933 		}
1934 	}
1935 	/* now do the tests */
1936 	if (((asoc->cnt_on_all_streams +
1937 	    asoc->cnt_on_reasm_queue +
1938 	    asoc->cnt_msg_on_sb) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)) ||
1939 	    (((int)asoc->my_rwnd) <= 0)) {
1940 		/*
1941 		 * When we have NO room in the rwnd we check to make sure
1942 		 * the reader is doing its job...
1943 		 */
1944 		if (stcb->sctp_socket->so_rcv.sb_cc) {
1945 			/* some to read, wake-up */
1946 			sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
1947 		}
1948 		/* now is it in the mapping array of what we have accepted? */
1949 		if (chk_type == SCTP_DATA) {
1950 			if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_map) &&
1951 			    SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
1952 				/* Nope not in the valid range dump it */
1953 		dump_packet:
1954 				sctp_set_rwnd(stcb, asoc);
1955 				if ((asoc->cnt_on_all_streams +
1956 				    asoc->cnt_on_reasm_queue +
1957 				    asoc->cnt_msg_on_sb) >= SCTP_BASE_SYSCTL(sctp_max_chunks_on_queue)) {
1958 					SCTP_STAT_INCR(sctps_datadropchklmt);
1959 				} else {
1960 					SCTP_STAT_INCR(sctps_datadroprwnd);
1961 				}
1962 				*break_flag = 1;
1963 				return (0);
1964 			}
1965 		} else {
1966 			if (control == NULL) {
1967 				goto dump_packet;
1968 			}
1969 			if (SCTP_TSN_GT(fsn, control->top_fsn)) {
1970 				goto dump_packet;
1971 			}
1972 		}
1973 	}
1974 #ifdef SCTP_ASOCLOG_OF_TSNS
1975 	SCTP_TCB_LOCK_ASSERT(stcb);
1976 	if (asoc->tsn_in_at >= SCTP_TSN_LOG_SIZE) {
1977 		asoc->tsn_in_at = 0;
1978 		asoc->tsn_in_wrapped = 1;
1979 	}
1980 	asoc->in_tsnlog[asoc->tsn_in_at].tsn = tsn;
1981 	asoc->in_tsnlog[asoc->tsn_in_at].strm = sid;
1982 	asoc->in_tsnlog[asoc->tsn_in_at].seq = mid;
1983 	asoc->in_tsnlog[asoc->tsn_in_at].sz = chk_length;
1984 	asoc->in_tsnlog[asoc->tsn_in_at].flgs = chunk_flags;
1985 	asoc->in_tsnlog[asoc->tsn_in_at].stcb = (void *)stcb;
1986 	asoc->in_tsnlog[asoc->tsn_in_at].in_pos = asoc->tsn_in_at;
1987 	asoc->in_tsnlog[asoc->tsn_in_at].in_out = 1;
1988 	asoc->tsn_in_at++;
1989 #endif
1990 	/*
1991 	 * Before we continue lets validate that we are not being fooled by
1992 	 * an evil attacker. We can only have Nk chunks based on our TSN
1993 	 * spread allowed by the mapping array N * 8 bits, so there is no
1994 	 * way our stream sequence numbers could have wrapped. We of course
1995 	 * only validate the FIRST fragment so the bit must be set.
1996 	 */
1997 	if ((chk_flags & SCTP_DATA_FIRST_FRAG) &&
1998 	    (TAILQ_EMPTY(&asoc->resetHead)) &&
1999 	    (chk_flags & SCTP_DATA_UNORDERED) == 0 &&
2000 	    SCTP_MID_GE(asoc->idata_supported, asoc->strmin[sid].last_mid_delivered, mid)) {
2001 		/* The incoming sseq is behind where we last delivered? */
2002 		SCTPDBG(SCTP_DEBUG_INDATA1, "EVIL/Broken-Dup S-SEQ: %u delivered: %u from peer, Abort!\n",
2003 		    mid, asoc->strmin[sid].last_mid_delivered);
2004 
2005 		if (asoc->idata_supported) {
2006 			SCTP_SNPRINTF(msg, sizeof(msg), "Delivered MID=%8.8x, got TSN=%8.8x, SID=%4.4x, MID=%8.8x",
2007 			    asoc->strmin[sid].last_mid_delivered,
2008 			    tsn,
2009 			    sid,
2010 			    mid);
2011 		} else {
2012 			SCTP_SNPRINTF(msg, sizeof(msg), "Delivered SSN=%4.4x, got TSN=%8.8x, SID=%4.4x, SSN=%4.4x",
2013 			    (uint16_t)asoc->strmin[sid].last_mid_delivered,
2014 			    tsn,
2015 			    sid,
2016 			    (uint16_t)mid);
2017 		}
2018 		op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2019 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_18;
2020 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
2021 		*abort_flag = 1;
2022 		return (0);
2023 	}
2024 	if (chk_type == SCTP_IDATA) {
2025 		the_len = (chk_length - sizeof(struct sctp_idata_chunk));
2026 	} else {
2027 		the_len = (chk_length - sizeof(struct sctp_data_chunk));
2028 	}
2029 	if (last_chunk == 0) {
2030 		if (chk_type == SCTP_IDATA) {
2031 			dmbuf = SCTP_M_COPYM(*m,
2032 			    (offset + sizeof(struct sctp_idata_chunk)),
2033 			    the_len, M_NOWAIT);
2034 		} else {
2035 			dmbuf = SCTP_M_COPYM(*m,
2036 			    (offset + sizeof(struct sctp_data_chunk)),
2037 			    the_len, M_NOWAIT);
2038 		}
2039 #ifdef SCTP_MBUF_LOGGING
2040 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
2041 			sctp_log_mbc(dmbuf, SCTP_MBUF_ICOPY);
2042 		}
2043 #endif
2044 	} else {
2045 		/* We can steal the last chunk */
2046 		int l_len;
2047 
2048 		dmbuf = *m;
2049 		/* lop off the top part */
2050 		if (chk_type == SCTP_IDATA) {
2051 			m_adj(dmbuf, (offset + sizeof(struct sctp_idata_chunk)));
2052 		} else {
2053 			m_adj(dmbuf, (offset + sizeof(struct sctp_data_chunk)));
2054 		}
2055 		if (SCTP_BUF_NEXT(dmbuf) == NULL) {
2056 			l_len = SCTP_BUF_LEN(dmbuf);
2057 		} else {
2058 			/*
2059 			 * need to count up the size hopefully does not hit
2060 			 * this to often :-0
2061 			 */
2062 			struct mbuf *lat;
2063 
2064 			l_len = 0;
2065 			for (lat = dmbuf; lat; lat = SCTP_BUF_NEXT(lat)) {
2066 				l_len += SCTP_BUF_LEN(lat);
2067 			}
2068 		}
2069 		if (l_len > the_len) {
2070 			/* Trim the end round bytes off  too */
2071 			m_adj(dmbuf, -(l_len - the_len));
2072 		}
2073 	}
2074 	if (dmbuf == NULL) {
2075 		SCTP_STAT_INCR(sctps_nomem);
2076 		return (0);
2077 	}
2078 	/*
2079 	 * Now no matter what, we need a control, get one if we don't have
2080 	 * one (we may have gotten it above when we found the message was
2081 	 * fragmented
2082 	 */
2083 	if (control == NULL) {
2084 		sctp_alloc_a_readq(stcb, control);
2085 		sctp_build_readq_entry_mac(control, stcb, asoc->context, net, tsn,
2086 		    ppid,
2087 		    sid,
2088 		    chk_flags,
2089 		    NULL, fsn, mid);
2090 		if (control == NULL) {
2091 			SCTP_STAT_INCR(sctps_nomem);
2092 			return (0);
2093 		}
2094 		if ((chk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
2095 			struct mbuf *mm;
2096 
2097 			control->data = dmbuf;
2098 			control->tail_mbuf = NULL;
2099 			for (mm = control->data; mm; mm = mm->m_next) {
2100 				control->length += SCTP_BUF_LEN(mm);
2101 				if (SCTP_BUF_NEXT(mm) == NULL) {
2102 					control->tail_mbuf = mm;
2103 				}
2104 			}
2105 			control->end_added = 1;
2106 			control->last_frag_seen = 1;
2107 			control->first_frag_seen = 1;
2108 			control->fsn_included = fsn;
2109 			control->top_fsn = fsn;
2110 		}
2111 		created_control = 1;
2112 	}
2113 	SCTPDBG(SCTP_DEBUG_XXX, "chunk_flags: 0x%x ordered: %d MID: %u control: %p\n",
2114 	    chk_flags, ordered, mid, control);
2115 	if ((chk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG &&
2116 	    TAILQ_EMPTY(&asoc->resetHead) &&
2117 	    ((ordered == 0) ||
2118 	    (SCTP_MID_EQ(asoc->idata_supported, asoc->strmin[sid].last_mid_delivered + 1, mid) &&
2119 	    TAILQ_EMPTY(&asoc->strmin[sid].inqueue)))) {
2120 		/* Candidate for express delivery */
2121 		/*
2122 		 * Its not fragmented, No PD-API is up, Nothing in the
2123 		 * delivery queue, Its un-ordered OR ordered and the next to
2124 		 * deliver AND nothing else is stuck on the stream queue,
2125 		 * And there is room for it in the socket buffer. Lets just
2126 		 * stuff it up the buffer....
2127 		 */
2128 		SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
2129 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
2130 			asoc->highest_tsn_inside_nr_map = tsn;
2131 		}
2132 		SCTPDBG(SCTP_DEBUG_XXX, "Injecting control: %p to be read (MID: %u)\n",
2133 		    control, mid);
2134 
2135 		sctp_add_to_readq(stcb->sctp_ep, stcb,
2136 		    control, &stcb->sctp_socket->so_rcv,
2137 		    1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
2138 
2139 		if ((chk_flags & SCTP_DATA_UNORDERED) == 0) {
2140 			/* for ordered, bump what we delivered */
2141 			asoc->strmin[sid].last_mid_delivered++;
2142 		}
2143 		SCTP_STAT_INCR(sctps_recvexpress);
2144 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
2145 			sctp_log_strm_del_alt(stcb, tsn, mid, sid,
2146 			    SCTP_STR_LOG_FROM_EXPRS_DEL);
2147 		}
2148 		control = NULL;
2149 		goto finish_express_del;
2150 	}
2151 
2152 	/* Now will we need a chunk too? */
2153 	if ((chk_flags & SCTP_DATA_NOT_FRAG) != SCTP_DATA_NOT_FRAG) {
2154 		sctp_alloc_a_chunk(stcb, chk);
2155 		if (chk == NULL) {
2156 			/* No memory so we drop the chunk */
2157 			SCTP_STAT_INCR(sctps_nomem);
2158 			if (last_chunk == 0) {
2159 				/* we copied it, free the copy */
2160 				sctp_m_freem(dmbuf);
2161 			}
2162 			return (0);
2163 		}
2164 		chk->rec.data.tsn = tsn;
2165 		chk->no_fr_allowed = 0;
2166 		chk->rec.data.fsn = fsn;
2167 		chk->rec.data.mid = mid;
2168 		chk->rec.data.sid = sid;
2169 		chk->rec.data.ppid = ppid;
2170 		chk->rec.data.context = stcb->asoc.context;
2171 		chk->rec.data.doing_fast_retransmit = 0;
2172 		chk->rec.data.rcv_flags = chk_flags;
2173 		chk->asoc = asoc;
2174 		chk->send_size = the_len;
2175 		chk->whoTo = net;
2176 		SCTPDBG(SCTP_DEBUG_XXX, "Building ck: %p for control: %p to be read (MID: %u)\n",
2177 		    chk,
2178 		    control, mid);
2179 		atomic_add_int(&net->ref_count, 1);
2180 		chk->data = dmbuf;
2181 	}
2182 	/* Set the appropriate TSN mark */
2183 	if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
2184 		SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, gap);
2185 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_nr_map)) {
2186 			asoc->highest_tsn_inside_nr_map = tsn;
2187 		}
2188 	} else {
2189 		SCTP_SET_TSN_PRESENT(asoc->mapping_array, gap);
2190 		if (SCTP_TSN_GT(tsn, asoc->highest_tsn_inside_map)) {
2191 			asoc->highest_tsn_inside_map = tsn;
2192 		}
2193 	}
2194 	/* Now is it complete (i.e. not fragmented)? */
2195 	if ((chk_flags & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
2196 		/*
2197 		 * Special check for when streams are resetting. We could be
2198 		 * more smart about this and check the actual stream to see
2199 		 * if it is not being reset.. that way we would not create a
2200 		 * HOLB when amongst streams being reset and those not being
2201 		 * reset.
2202 		 *
2203 		 */
2204 		if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
2205 		    SCTP_TSN_GT(tsn, liste->tsn)) {
2206 			/*
2207 			 * yep its past where we need to reset... go ahead
2208 			 * and queue it.
2209 			 */
2210 			if (TAILQ_EMPTY(&asoc->pending_reply_queue)) {
2211 				/* first one on */
2212 				TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
2213 			} else {
2214 				struct sctp_queued_to_read *lcontrol, *nlcontrol;
2215 				unsigned char inserted = 0;
2216 
2217 				TAILQ_FOREACH_SAFE(lcontrol, &asoc->pending_reply_queue, next, nlcontrol) {
2218 					if (SCTP_TSN_GT(control->sinfo_tsn, lcontrol->sinfo_tsn)) {
2219 						continue;
2220 					} else {
2221 						/* found it */
2222 						TAILQ_INSERT_BEFORE(lcontrol, control, next);
2223 						inserted = 1;
2224 						break;
2225 					}
2226 				}
2227 				if (inserted == 0) {
2228 					/*
2229 					 * must be put at end, use prevP
2230 					 * (all setup from loop) to setup
2231 					 * nextP.
2232 					 */
2233 					TAILQ_INSERT_TAIL(&asoc->pending_reply_queue, control, next);
2234 				}
2235 			}
2236 			goto finish_express_del;
2237 		}
2238 		if (chk_flags & SCTP_DATA_UNORDERED) {
2239 			/* queue directly into socket buffer */
2240 			SCTPDBG(SCTP_DEBUG_XXX, "Unordered data to be read control: %p MID: %u\n",
2241 			    control, mid);
2242 			sctp_mark_non_revokable(asoc, control->sinfo_tsn);
2243 			sctp_add_to_readq(stcb->sctp_ep, stcb,
2244 			    control,
2245 			    &stcb->sctp_socket->so_rcv, 1,
2246 			    SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
2247 
2248 		} else {
2249 			SCTPDBG(SCTP_DEBUG_XXX, "Queue control: %p for reordering MID: %u\n", control,
2250 			    mid);
2251 			sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
2252 			if (*abort_flag) {
2253 				if (last_chunk) {
2254 					*m = NULL;
2255 				}
2256 				return (0);
2257 			}
2258 		}
2259 		goto finish_express_del;
2260 	}
2261 	/* If we reach here its a reassembly */
2262 	need_reasm_check = 1;
2263 	SCTPDBG(SCTP_DEBUG_XXX,
2264 	    "Queue data to stream for reasm control: %p MID: %u\n",
2265 	    control, mid);
2266 	sctp_queue_data_for_reasm(stcb, asoc, control, chk, created_control, abort_flag, tsn);
2267 	if (*abort_flag) {
2268 		/*
2269 		 * the assoc is now gone and chk was put onto the reasm
2270 		 * queue, which has all been freed.
2271 		 */
2272 		if (last_chunk) {
2273 			*m = NULL;
2274 		}
2275 		return (0);
2276 	}
2277 finish_express_del:
2278 	/* Here we tidy up things */
2279 	if (tsn == (asoc->cumulative_tsn + 1)) {
2280 		/* Update cum-ack */
2281 		asoc->cumulative_tsn = tsn;
2282 	}
2283 	if (last_chunk) {
2284 		*m = NULL;
2285 	}
2286 	if (ordered) {
2287 		SCTP_STAT_INCR_COUNTER64(sctps_inorderchunks);
2288 	} else {
2289 		SCTP_STAT_INCR_COUNTER64(sctps_inunorderchunks);
2290 	}
2291 	SCTP_STAT_INCR(sctps_recvdata);
2292 	/* Set it present please */
2293 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_STR_LOGGING_ENABLE) {
2294 		sctp_log_strm_del_alt(stcb, tsn, mid, sid, SCTP_STR_LOG_FROM_MARK_TSN);
2295 	}
2296 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2297 		sctp_log_map(asoc->mapping_array_base_tsn, asoc->cumulative_tsn,
2298 		    asoc->highest_tsn_inside_map, SCTP_MAP_PREPARE_SLIDE);
2299 	}
2300 	if (need_reasm_check) {
2301 		(void)sctp_deliver_reasm_check(stcb, asoc, &asoc->strmin[sid], SCTP_READ_LOCK_NOT_HELD);
2302 		need_reasm_check = 0;
2303 	}
2304 	/* check the special flag for stream resets */
2305 	if (((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) &&
2306 	    SCTP_TSN_GE(asoc->cumulative_tsn, liste->tsn)) {
2307 		/*
2308 		 * we have finished working through the backlogged TSN's now
2309 		 * time to reset streams. 1: call reset function. 2: free
2310 		 * pending_reply space 3: distribute any chunks in
2311 		 * pending_reply_queue.
2312 		 */
2313 		sctp_reset_in_stream(stcb, liste->number_entries, liste->list_of_streams);
2314 		TAILQ_REMOVE(&asoc->resetHead, liste, next_resp);
2315 		sctp_send_deferred_reset_response(stcb, liste, SCTP_STREAM_RESET_RESULT_PERFORMED);
2316 		SCTP_FREE(liste, SCTP_M_STRESET);
2317 		/* sa_ignore FREED_MEMORY */
2318 		liste = TAILQ_FIRST(&asoc->resetHead);
2319 		if (TAILQ_EMPTY(&asoc->resetHead)) {
2320 			/* All can be removed */
2321 			TAILQ_FOREACH_SAFE(control, &asoc->pending_reply_queue, next, ncontrol) {
2322 				TAILQ_REMOVE(&asoc->pending_reply_queue, control, next);
2323 				strm = &asoc->strmin[control->sinfo_stream];
2324 				sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
2325 				if (*abort_flag) {
2326 					return (0);
2327 				}
2328 				if (need_reasm_check) {
2329 					(void)sctp_deliver_reasm_check(stcb, asoc, strm, SCTP_READ_LOCK_NOT_HELD);
2330 					need_reasm_check = 0;
2331 				}
2332 			}
2333 		} else {
2334 			TAILQ_FOREACH_SAFE(control, &asoc->pending_reply_queue, next, ncontrol) {
2335 				if (SCTP_TSN_GT(control->sinfo_tsn, liste->tsn)) {
2336 					break;
2337 				}
2338 				/*
2339 				 * if control->sinfo_tsn is <= liste->tsn we
2340 				 * can process it which is the NOT of
2341 				 * control->sinfo_tsn > liste->tsn
2342 				 */
2343 				TAILQ_REMOVE(&asoc->pending_reply_queue, control, next);
2344 				strm = &asoc->strmin[control->sinfo_stream];
2345 				sctp_queue_data_to_stream(stcb, asoc, control, abort_flag, &need_reasm_check);
2346 				if (*abort_flag) {
2347 					return (0);
2348 				}
2349 				if (need_reasm_check) {
2350 					(void)sctp_deliver_reasm_check(stcb, asoc, strm, SCTP_READ_LOCK_NOT_HELD);
2351 					need_reasm_check = 0;
2352 				}
2353 			}
2354 		}
2355 	}
2356 	return (1);
2357 }
2358 
2359 static const int8_t sctp_map_lookup_tab[256] = {
2360 	0, 1, 0, 2, 0, 1, 0, 3,
2361 	0, 1, 0, 2, 0, 1, 0, 4,
2362 	0, 1, 0, 2, 0, 1, 0, 3,
2363 	0, 1, 0, 2, 0, 1, 0, 5,
2364 	0, 1, 0, 2, 0, 1, 0, 3,
2365 	0, 1, 0, 2, 0, 1, 0, 4,
2366 	0, 1, 0, 2, 0, 1, 0, 3,
2367 	0, 1, 0, 2, 0, 1, 0, 6,
2368 	0, 1, 0, 2, 0, 1, 0, 3,
2369 	0, 1, 0, 2, 0, 1, 0, 4,
2370 	0, 1, 0, 2, 0, 1, 0, 3,
2371 	0, 1, 0, 2, 0, 1, 0, 5,
2372 	0, 1, 0, 2, 0, 1, 0, 3,
2373 	0, 1, 0, 2, 0, 1, 0, 4,
2374 	0, 1, 0, 2, 0, 1, 0, 3,
2375 	0, 1, 0, 2, 0, 1, 0, 7,
2376 	0, 1, 0, 2, 0, 1, 0, 3,
2377 	0, 1, 0, 2, 0, 1, 0, 4,
2378 	0, 1, 0, 2, 0, 1, 0, 3,
2379 	0, 1, 0, 2, 0, 1, 0, 5,
2380 	0, 1, 0, 2, 0, 1, 0, 3,
2381 	0, 1, 0, 2, 0, 1, 0, 4,
2382 	0, 1, 0, 2, 0, 1, 0, 3,
2383 	0, 1, 0, 2, 0, 1, 0, 6,
2384 	0, 1, 0, 2, 0, 1, 0, 3,
2385 	0, 1, 0, 2, 0, 1, 0, 4,
2386 	0, 1, 0, 2, 0, 1, 0, 3,
2387 	0, 1, 0, 2, 0, 1, 0, 5,
2388 	0, 1, 0, 2, 0, 1, 0, 3,
2389 	0, 1, 0, 2, 0, 1, 0, 4,
2390 	0, 1, 0, 2, 0, 1, 0, 3,
2391 	0, 1, 0, 2, 0, 1, 0, 8
2392 };
2393 
2394 void
2395 sctp_slide_mapping_arrays(struct sctp_tcb *stcb)
2396 {
2397 	/*
2398 	 * Now we also need to check the mapping array in a couple of ways.
2399 	 * 1) Did we move the cum-ack point?
2400 	 *
2401 	 * When you first glance at this you might think that all entries
2402 	 * that make up the position of the cum-ack would be in the
2403 	 * nr-mapping array only.. i.e. things up to the cum-ack are always
2404 	 * deliverable. Thats true with one exception, when its a fragmented
2405 	 * message we may not deliver the data until some threshold (or all
2406 	 * of it) is in place. So we must OR the nr_mapping_array and
2407 	 * mapping_array to get a true picture of the cum-ack.
2408 	 */
2409 	struct sctp_association *asoc;
2410 	int at;
2411 	uint8_t val;
2412 	int slide_from, slide_end, lgap, distance;
2413 	uint32_t old_cumack, old_base, old_highest, highest_tsn;
2414 
2415 	asoc = &stcb->asoc;
2416 
2417 	old_cumack = asoc->cumulative_tsn;
2418 	old_base = asoc->mapping_array_base_tsn;
2419 	old_highest = asoc->highest_tsn_inside_map;
2420 	/*
2421 	 * We could probably improve this a small bit by calculating the
2422 	 * offset of the current cum-ack as the starting point.
2423 	 */
2424 	at = 0;
2425 	for (slide_from = 0; slide_from < stcb->asoc.mapping_array_size; slide_from++) {
2426 		val = asoc->nr_mapping_array[slide_from] | asoc->mapping_array[slide_from];
2427 		if (val == 0xff) {
2428 			at += 8;
2429 		} else {
2430 			/* there is a 0 bit */
2431 			at += sctp_map_lookup_tab[val];
2432 			break;
2433 		}
2434 	}
2435 	asoc->cumulative_tsn = asoc->mapping_array_base_tsn + (at - 1);
2436 
2437 	if (SCTP_TSN_GT(asoc->cumulative_tsn, asoc->highest_tsn_inside_map) &&
2438 	    SCTP_TSN_GT(asoc->cumulative_tsn, asoc->highest_tsn_inside_nr_map)) {
2439 #ifdef INVARIANTS
2440 		panic("huh, cumack 0x%x greater than high-tsn 0x%x in map",
2441 		    asoc->cumulative_tsn, asoc->highest_tsn_inside_map);
2442 #else
2443 		SCTP_PRINTF("huh, cumack 0x%x greater than high-tsn 0x%x in map - should panic?\n",
2444 		    asoc->cumulative_tsn, asoc->highest_tsn_inside_map);
2445 		sctp_print_mapping_array(asoc);
2446 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2447 			sctp_log_map(0, 6, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
2448 		}
2449 		asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
2450 		asoc->highest_tsn_inside_nr_map = asoc->cumulative_tsn;
2451 #endif
2452 	}
2453 	if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2454 		highest_tsn = asoc->highest_tsn_inside_nr_map;
2455 	} else {
2456 		highest_tsn = asoc->highest_tsn_inside_map;
2457 	}
2458 	if ((asoc->cumulative_tsn == highest_tsn) && (at >= 8)) {
2459 		/* The complete array was completed by a single FR */
2460 		/* highest becomes the cum-ack */
2461 		int clr;
2462 #ifdef INVARIANTS
2463 		unsigned int i;
2464 #endif
2465 
2466 		/* clear the array */
2467 		clr = ((at + 7) >> 3);
2468 		if (clr > asoc->mapping_array_size) {
2469 			clr = asoc->mapping_array_size;
2470 		}
2471 		memset(asoc->mapping_array, 0, clr);
2472 		memset(asoc->nr_mapping_array, 0, clr);
2473 #ifdef INVARIANTS
2474 		for (i = 0; i < asoc->mapping_array_size; i++) {
2475 			if ((asoc->mapping_array[i]) || (asoc->nr_mapping_array[i])) {
2476 				SCTP_PRINTF("Error Mapping array's not clean at clear\n");
2477 				sctp_print_mapping_array(asoc);
2478 			}
2479 		}
2480 #endif
2481 		asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
2482 		asoc->highest_tsn_inside_nr_map = asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
2483 	} else if (at >= 8) {
2484 		/* we can slide the mapping array down */
2485 		/* slide_from holds where we hit the first NON 0xff byte */
2486 
2487 		/*
2488 		 * now calculate the ceiling of the move using our highest
2489 		 * TSN value
2490 		 */
2491 		SCTP_CALC_TSN_TO_GAP(lgap, highest_tsn, asoc->mapping_array_base_tsn);
2492 		slide_end = (lgap >> 3);
2493 		if (slide_end < slide_from) {
2494 			sctp_print_mapping_array(asoc);
2495 #ifdef INVARIANTS
2496 			panic("impossible slide");
2497 #else
2498 			SCTP_PRINTF("impossible slide lgap: %x slide_end: %x slide_from: %x? at: %d\n",
2499 			    lgap, slide_end, slide_from, at);
2500 			return;
2501 #endif
2502 		}
2503 		if (slide_end > asoc->mapping_array_size) {
2504 #ifdef INVARIANTS
2505 			panic("would overrun buffer");
2506 #else
2507 			SCTP_PRINTF("Gak, would have overrun map end: %d slide_end: %d\n",
2508 			    asoc->mapping_array_size, slide_end);
2509 			slide_end = asoc->mapping_array_size;
2510 #endif
2511 		}
2512 		distance = (slide_end - slide_from) + 1;
2513 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2514 			sctp_log_map(old_base, old_cumack, old_highest,
2515 			    SCTP_MAP_PREPARE_SLIDE);
2516 			sctp_log_map((uint32_t)slide_from, (uint32_t)slide_end,
2517 			    (uint32_t)lgap, SCTP_MAP_SLIDE_FROM);
2518 		}
2519 		if (distance + slide_from > asoc->mapping_array_size ||
2520 		    distance < 0) {
2521 			/*
2522 			 * Here we do NOT slide forward the array so that
2523 			 * hopefully when more data comes in to fill it up
2524 			 * we will be able to slide it forward. Really I
2525 			 * don't think this should happen :-0
2526 			 */
2527 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2528 				sctp_log_map((uint32_t)distance, (uint32_t)slide_from,
2529 				    (uint32_t)asoc->mapping_array_size,
2530 				    SCTP_MAP_SLIDE_NONE);
2531 			}
2532 		} else {
2533 			int ii;
2534 
2535 			for (ii = 0; ii < distance; ii++) {
2536 				asoc->mapping_array[ii] = asoc->mapping_array[slide_from + ii];
2537 				asoc->nr_mapping_array[ii] = asoc->nr_mapping_array[slide_from + ii];
2538 			}
2539 			for (ii = distance; ii < asoc->mapping_array_size; ii++) {
2540 				asoc->mapping_array[ii] = 0;
2541 				asoc->nr_mapping_array[ii] = 0;
2542 			}
2543 			if (asoc->highest_tsn_inside_map + 1 == asoc->mapping_array_base_tsn) {
2544 				asoc->highest_tsn_inside_map += (slide_from << 3);
2545 			}
2546 			if (asoc->highest_tsn_inside_nr_map + 1 == asoc->mapping_array_base_tsn) {
2547 				asoc->highest_tsn_inside_nr_map += (slide_from << 3);
2548 			}
2549 			asoc->mapping_array_base_tsn += (slide_from << 3);
2550 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
2551 				sctp_log_map(asoc->mapping_array_base_tsn,
2552 				    asoc->cumulative_tsn, asoc->highest_tsn_inside_map,
2553 				    SCTP_MAP_SLIDE_RESULT);
2554 			}
2555 		}
2556 	}
2557 }
2558 
2559 void
2560 sctp_sack_check(struct sctp_tcb *stcb, int was_a_gap)
2561 {
2562 	struct sctp_association *asoc;
2563 	uint32_t highest_tsn;
2564 	int is_a_gap;
2565 
2566 	sctp_slide_mapping_arrays(stcb);
2567 	asoc = &stcb->asoc;
2568 	if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2569 		highest_tsn = asoc->highest_tsn_inside_nr_map;
2570 	} else {
2571 		highest_tsn = asoc->highest_tsn_inside_map;
2572 	}
2573 	/* Is there a gap now? */
2574 	is_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
2575 
2576 	/*
2577 	 * Now we need to see if we need to queue a sack or just start the
2578 	 * timer (if allowed).
2579 	 */
2580 	if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) {
2581 		/*
2582 		 * Ok special case, in SHUTDOWN-SENT case. here we maker
2583 		 * sure SACK timer is off and instead send a SHUTDOWN and a
2584 		 * SACK
2585 		 */
2586 		if (SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2587 			sctp_timer_stop(SCTP_TIMER_TYPE_RECV,
2588 			    stcb->sctp_ep, stcb, NULL,
2589 			    SCTP_FROM_SCTP_INDATA + SCTP_LOC_19);
2590 		}
2591 		sctp_send_shutdown(stcb,
2592 		    ((stcb->asoc.alternate) ? stcb->asoc.alternate : stcb->asoc.primary_destination));
2593 		if (is_a_gap) {
2594 			sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
2595 		}
2596 	} else {
2597 		/*
2598 		 * CMT DAC algorithm: increase number of packets received
2599 		 * since last ack
2600 		 */
2601 		stcb->asoc.cmt_dac_pkts_rcvd++;
2602 
2603 		if ((stcb->asoc.send_sack == 1) ||	/* We need to send a
2604 							 * SACK */
2605 		    ((was_a_gap) && (is_a_gap == 0)) ||	/* was a gap, but no
2606 							 * longer is one */
2607 		    (stcb->asoc.numduptsns) ||	/* we have dup's */
2608 		    (is_a_gap) ||	/* is still a gap */
2609 		    (stcb->asoc.delayed_ack == 0) ||	/* Delayed sack disabled */
2610 		    (stcb->asoc.data_pkts_seen >= stcb->asoc.sack_freq)) {	/* hit limit of pkts */
2611 			if ((stcb->asoc.sctp_cmt_on_off > 0) &&
2612 			    (SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) &&
2613 			    (stcb->asoc.send_sack == 0) &&
2614 			    (stcb->asoc.numduptsns == 0) &&
2615 			    (stcb->asoc.delayed_ack) &&
2616 			    (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer))) {
2617 				/*
2618 				 * CMT DAC algorithm: With CMT, delay acks
2619 				 * even in the face of reordering.
2620 				 * Therefore, if acks that do not have to be
2621 				 * sent because of the above reasons, will
2622 				 * be delayed. That is, acks that would have
2623 				 * been sent due to gap reports will be
2624 				 * delayed with DAC. Start the delayed ack
2625 				 * timer.
2626 				 */
2627 				sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2628 				    stcb->sctp_ep, stcb, NULL);
2629 			} else {
2630 				/*
2631 				 * Ok we must build a SACK since the timer
2632 				 * is pending, we got our first packet OR
2633 				 * there are gaps or duplicates.
2634 				 */
2635 				sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
2636 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_20);
2637 				sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
2638 			}
2639 		} else {
2640 			if (!SCTP_OS_TIMER_PENDING(&stcb->asoc.dack_timer.timer)) {
2641 				sctp_timer_start(SCTP_TIMER_TYPE_RECV,
2642 				    stcb->sctp_ep, stcb, NULL);
2643 			}
2644 		}
2645 	}
2646 }
2647 
2648 int
2649 sctp_process_data(struct mbuf **mm, int iphlen, int *offset, int length,
2650     struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2651     struct sctp_nets *net, uint32_t *high_tsn)
2652 {
2653 	struct sctp_chunkhdr *ch, chunk_buf;
2654 	struct sctp_association *asoc;
2655 	int num_chunks = 0;	/* number of control chunks processed */
2656 	int stop_proc = 0;
2657 	int break_flag, last_chunk;
2658 	int abort_flag = 0, was_a_gap;
2659 	struct mbuf *m;
2660 	uint32_t highest_tsn;
2661 	uint16_t chk_length;
2662 
2663 	/* set the rwnd */
2664 	sctp_set_rwnd(stcb, &stcb->asoc);
2665 
2666 	m = *mm;
2667 	SCTP_TCB_LOCK_ASSERT(stcb);
2668 	asoc = &stcb->asoc;
2669 	if (SCTP_TSN_GT(asoc->highest_tsn_inside_nr_map, asoc->highest_tsn_inside_map)) {
2670 		highest_tsn = asoc->highest_tsn_inside_nr_map;
2671 	} else {
2672 		highest_tsn = asoc->highest_tsn_inside_map;
2673 	}
2674 	was_a_gap = SCTP_TSN_GT(highest_tsn, stcb->asoc.cumulative_tsn);
2675 	/*
2676 	 * setup where we got the last DATA packet from for any SACK that
2677 	 * may need to go out. Don't bump the net. This is done ONLY when a
2678 	 * chunk is assigned.
2679 	 */
2680 	asoc->last_data_chunk_from = net;
2681 
2682 	/*-
2683 	 * Now before we proceed we must figure out if this is a wasted
2684 	 * cluster... i.e. it is a small packet sent in and yet the driver
2685 	 * underneath allocated a full cluster for it. If so we must copy it
2686 	 * to a smaller mbuf and free up the cluster mbuf. This will help
2687 	 * with cluster starvation.
2688 	 */
2689 	if (SCTP_BUF_LEN(m) < (long)MLEN && SCTP_BUF_NEXT(m) == NULL) {
2690 		/* we only handle mbufs that are singletons.. not chains */
2691 		m = sctp_get_mbuf_for_msg(SCTP_BUF_LEN(m), 0, M_NOWAIT, 1, MT_DATA);
2692 		if (m) {
2693 			/* ok lets see if we can copy the data up */
2694 			caddr_t *from, *to;
2695 
2696 			/* get the pointers and copy */
2697 			to = mtod(m, caddr_t *);
2698 			from = mtod((*mm), caddr_t *);
2699 			memcpy(to, from, SCTP_BUF_LEN((*mm)));
2700 			/* copy the length and free up the old */
2701 			SCTP_BUF_LEN(m) = SCTP_BUF_LEN((*mm));
2702 			sctp_m_freem(*mm);
2703 			/* success, back copy */
2704 			*mm = m;
2705 		} else {
2706 			/* We are in trouble in the mbuf world .. yikes */
2707 			m = *mm;
2708 		}
2709 	}
2710 	/* get pointer to the first chunk header */
2711 	ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
2712 	    sizeof(struct sctp_chunkhdr),
2713 	    (uint8_t *)&chunk_buf);
2714 	if (ch == NULL) {
2715 		return (1);
2716 	}
2717 	/*
2718 	 * process all DATA chunks...
2719 	 */
2720 	*high_tsn = asoc->cumulative_tsn;
2721 	break_flag = 0;
2722 	asoc->data_pkts_seen++;
2723 	while (stop_proc == 0) {
2724 		/* validate chunk length */
2725 		chk_length = ntohs(ch->chunk_length);
2726 		if (length - *offset < chk_length) {
2727 			/* all done, mutulated chunk */
2728 			stop_proc = 1;
2729 			continue;
2730 		}
2731 		if ((asoc->idata_supported == 1) &&
2732 		    (ch->chunk_type == SCTP_DATA)) {
2733 			struct mbuf *op_err;
2734 			char msg[SCTP_DIAG_INFO_LEN];
2735 
2736 			SCTP_SNPRINTF(msg, sizeof(msg), "%s", "DATA chunk received when I-DATA was negotiated");
2737 			op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2738 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_21;
2739 			sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2740 			return (2);
2741 		}
2742 		if ((asoc->idata_supported == 0) &&
2743 		    (ch->chunk_type == SCTP_IDATA)) {
2744 			struct mbuf *op_err;
2745 			char msg[SCTP_DIAG_INFO_LEN];
2746 
2747 			SCTP_SNPRINTF(msg, sizeof(msg), "%s", "I-DATA chunk received when DATA was negotiated");
2748 			op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2749 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_22;
2750 			sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2751 			return (2);
2752 		}
2753 		if ((ch->chunk_type == SCTP_DATA) ||
2754 		    (ch->chunk_type == SCTP_IDATA)) {
2755 			uint16_t clen;
2756 
2757 			if (ch->chunk_type == SCTP_DATA) {
2758 				clen = sizeof(struct sctp_data_chunk);
2759 			} else {
2760 				clen = sizeof(struct sctp_idata_chunk);
2761 			}
2762 			if (chk_length < clen) {
2763 				/*
2764 				 * Need to send an abort since we had a
2765 				 * invalid data chunk.
2766 				 */
2767 				struct mbuf *op_err;
2768 				char msg[SCTP_DIAG_INFO_LEN];
2769 
2770 				SCTP_SNPRINTF(msg, sizeof(msg), "%s chunk of length %u",
2771 				    ch->chunk_type == SCTP_DATA ? "DATA" : "I-DATA",
2772 				    chk_length);
2773 				op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2774 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_23;
2775 				sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2776 				return (2);
2777 			}
2778 #ifdef SCTP_AUDITING_ENABLED
2779 			sctp_audit_log(0xB1, 0);
2780 #endif
2781 			if (SCTP_SIZE32(chk_length) == (length - *offset)) {
2782 				last_chunk = 1;
2783 			} else {
2784 				last_chunk = 0;
2785 			}
2786 			if (sctp_process_a_data_chunk(stcb, asoc, mm, *offset,
2787 			    chk_length, net, high_tsn, &abort_flag, &break_flag,
2788 			    last_chunk, ch->chunk_type)) {
2789 				num_chunks++;
2790 			}
2791 			if (abort_flag)
2792 				return (2);
2793 
2794 			if (break_flag) {
2795 				/*
2796 				 * Set because of out of rwnd space and no
2797 				 * drop rep space left.
2798 				 */
2799 				stop_proc = 1;
2800 				continue;
2801 			}
2802 		} else {
2803 			/* not a data chunk in the data region */
2804 			switch (ch->chunk_type) {
2805 			case SCTP_INITIATION:
2806 			case SCTP_INITIATION_ACK:
2807 			case SCTP_SELECTIVE_ACK:
2808 			case SCTP_NR_SELECTIVE_ACK:
2809 			case SCTP_HEARTBEAT_REQUEST:
2810 			case SCTP_HEARTBEAT_ACK:
2811 			case SCTP_ABORT_ASSOCIATION:
2812 			case SCTP_SHUTDOWN:
2813 			case SCTP_SHUTDOWN_ACK:
2814 			case SCTP_OPERATION_ERROR:
2815 			case SCTP_COOKIE_ECHO:
2816 			case SCTP_COOKIE_ACK:
2817 			case SCTP_ECN_ECHO:
2818 			case SCTP_ECN_CWR:
2819 			case SCTP_SHUTDOWN_COMPLETE:
2820 			case SCTP_AUTHENTICATION:
2821 			case SCTP_ASCONF_ACK:
2822 			case SCTP_PACKET_DROPPED:
2823 			case SCTP_STREAM_RESET:
2824 			case SCTP_FORWARD_CUM_TSN:
2825 			case SCTP_ASCONF:
2826 				{
2827 					/*
2828 					 * Now, what do we do with KNOWN
2829 					 * chunks that are NOT in the right
2830 					 * place?
2831 					 *
2832 					 * For now, I do nothing but ignore
2833 					 * them. We may later want to add
2834 					 * sysctl stuff to switch out and do
2835 					 * either an ABORT() or possibly
2836 					 * process them.
2837 					 */
2838 					struct mbuf *op_err;
2839 					char msg[SCTP_DIAG_INFO_LEN];
2840 
2841 					SCTP_SNPRINTF(msg, sizeof(msg), "DATA chunk followed by chunk of type %2.2x",
2842 					    ch->chunk_type);
2843 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2844 					sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2845 					return (2);
2846 				}
2847 			default:
2848 				/*
2849 				 * Unknown chunk type: use bit rules after
2850 				 * checking length
2851 				 */
2852 				if (chk_length < sizeof(struct sctp_chunkhdr)) {
2853 					/*
2854 					 * Need to send an abort since we
2855 					 * had a invalid chunk.
2856 					 */
2857 					struct mbuf *op_err;
2858 					char msg[SCTP_DIAG_INFO_LEN];
2859 
2860 					SCTP_SNPRINTF(msg, sizeof(msg), "Chunk of length %u", chk_length);
2861 					op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
2862 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_24;
2863 					sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
2864 					return (2);
2865 				}
2866 				if (ch->chunk_type & 0x40) {
2867 					/* Add a error report to the queue */
2868 					struct mbuf *op_err;
2869 					struct sctp_gen_error_cause *cause;
2870 
2871 					op_err = sctp_get_mbuf_for_msg(sizeof(struct sctp_gen_error_cause),
2872 					    0, M_NOWAIT, 1, MT_DATA);
2873 					if (op_err != NULL) {
2874 						cause = mtod(op_err, struct sctp_gen_error_cause *);
2875 						cause->code = htons(SCTP_CAUSE_UNRECOG_CHUNK);
2876 						cause->length = htons((uint16_t)(chk_length + sizeof(struct sctp_gen_error_cause)));
2877 						SCTP_BUF_LEN(op_err) = sizeof(struct sctp_gen_error_cause);
2878 						SCTP_BUF_NEXT(op_err) = SCTP_M_COPYM(m, *offset, chk_length, M_NOWAIT);
2879 						if (SCTP_BUF_NEXT(op_err) != NULL) {
2880 							sctp_queue_op_err(stcb, op_err);
2881 						} else {
2882 							sctp_m_freem(op_err);
2883 						}
2884 					}
2885 				}
2886 				if ((ch->chunk_type & 0x80) == 0) {
2887 					/* discard the rest of this packet */
2888 					stop_proc = 1;
2889 				}	/* else skip this bad chunk and
2890 					 * continue... */
2891 				break;
2892 			}	/* switch of chunk type */
2893 		}
2894 		*offset += SCTP_SIZE32(chk_length);
2895 		if ((*offset >= length) || stop_proc) {
2896 			/* no more data left in the mbuf chain */
2897 			stop_proc = 1;
2898 			continue;
2899 		}
2900 		ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, *offset,
2901 		    sizeof(struct sctp_chunkhdr),
2902 		    (uint8_t *)&chunk_buf);
2903 		if (ch == NULL) {
2904 			*offset = length;
2905 			stop_proc = 1;
2906 			continue;
2907 		}
2908 	}
2909 	if (break_flag) {
2910 		/*
2911 		 * we need to report rwnd overrun drops.
2912 		 */
2913 		sctp_send_packet_dropped(stcb, net, *mm, length, iphlen, 0);
2914 	}
2915 	if (num_chunks) {
2916 		/*
2917 		 * Did we get data, if so update the time for auto-close and
2918 		 * give peer credit for being alive.
2919 		 */
2920 		SCTP_STAT_INCR(sctps_recvpktwithdata);
2921 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
2922 			sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
2923 			    stcb->asoc.overall_error_count,
2924 			    0,
2925 			    SCTP_FROM_SCTP_INDATA,
2926 			    __LINE__);
2927 		}
2928 		stcb->asoc.overall_error_count = 0;
2929 		(void)SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_last_rcvd);
2930 	}
2931 	/* now service all of the reassm queue if needed */
2932 	if (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_SENT) {
2933 		/* Assure that we ack right away */
2934 		stcb->asoc.send_sack = 1;
2935 	}
2936 	/* Start a sack timer or QUEUE a SACK for sending */
2937 	sctp_sack_check(stcb, was_a_gap);
2938 	return (0);
2939 }
2940 
2941 static int
2942 sctp_process_segment_range(struct sctp_tcb *stcb, struct sctp_tmit_chunk **p_tp1, uint32_t last_tsn,
2943     uint16_t frag_strt, uint16_t frag_end, int nr_sacking,
2944     int *num_frs,
2945     uint32_t *biggest_newly_acked_tsn,
2946     uint32_t *this_sack_lowest_newack,
2947     int *rto_ok)
2948 {
2949 	struct sctp_tmit_chunk *tp1;
2950 	unsigned int theTSN;
2951 	int j, wake_him = 0, circled = 0;
2952 
2953 	/* Recover the tp1 we last saw */
2954 	tp1 = *p_tp1;
2955 	if (tp1 == NULL) {
2956 		tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
2957 	}
2958 	for (j = frag_strt; j <= frag_end; j++) {
2959 		theTSN = j + last_tsn;
2960 		while (tp1) {
2961 			if (tp1->rec.data.doing_fast_retransmit)
2962 				(*num_frs) += 1;
2963 
2964 			/*-
2965 			 * CMT: CUCv2 algorithm. For each TSN being
2966 			 * processed from the sent queue, track the
2967 			 * next expected pseudo-cumack, or
2968 			 * rtx_pseudo_cumack, if required. Separate
2969 			 * cumack trackers for first transmissions,
2970 			 * and retransmissions.
2971 			 */
2972 			if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
2973 			    (tp1->whoTo->find_pseudo_cumack == 1) &&
2974 			    (tp1->snd_count == 1)) {
2975 				tp1->whoTo->pseudo_cumack = tp1->rec.data.tsn;
2976 				tp1->whoTo->find_pseudo_cumack = 0;
2977 			}
2978 			if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
2979 			    (tp1->whoTo->find_rtx_pseudo_cumack == 1) &&
2980 			    (tp1->snd_count > 1)) {
2981 				tp1->whoTo->rtx_pseudo_cumack = tp1->rec.data.tsn;
2982 				tp1->whoTo->find_rtx_pseudo_cumack = 0;
2983 			}
2984 			if (tp1->rec.data.tsn == theTSN) {
2985 				if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
2986 					/*-
2987 					 * must be held until
2988 					 * cum-ack passes
2989 					 */
2990 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
2991 						/*-
2992 						 * If it is less than RESEND, it is
2993 						 * now no-longer in flight.
2994 						 * Higher values may already be set
2995 						 * via previous Gap Ack Blocks...
2996 						 * i.e. ACKED or RESEND.
2997 						 */
2998 						if (SCTP_TSN_GT(tp1->rec.data.tsn,
2999 						    *biggest_newly_acked_tsn)) {
3000 							*biggest_newly_acked_tsn = tp1->rec.data.tsn;
3001 						}
3002 						/*-
3003 						 * CMT: SFR algo (and HTNA) - set
3004 						 * saw_newack to 1 for dest being
3005 						 * newly acked. update
3006 						 * this_sack_highest_newack if
3007 						 * appropriate.
3008 						 */
3009 						if (tp1->rec.data.chunk_was_revoked == 0)
3010 							tp1->whoTo->saw_newack = 1;
3011 
3012 						if (SCTP_TSN_GT(tp1->rec.data.tsn,
3013 						    tp1->whoTo->this_sack_highest_newack)) {
3014 							tp1->whoTo->this_sack_highest_newack =
3015 							    tp1->rec.data.tsn;
3016 						}
3017 						/*-
3018 						 * CMT DAC algo: also update
3019 						 * this_sack_lowest_newack
3020 						 */
3021 						if (*this_sack_lowest_newack == 0) {
3022 							if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
3023 								sctp_log_sack(*this_sack_lowest_newack,
3024 								    last_tsn,
3025 								    tp1->rec.data.tsn,
3026 								    0,
3027 								    0,
3028 								    SCTP_LOG_TSN_ACKED);
3029 							}
3030 							*this_sack_lowest_newack = tp1->rec.data.tsn;
3031 						}
3032 						/*-
3033 						 * CMT: CUCv2 algorithm. If (rtx-)pseudo-cumack for corresp
3034 						 * dest is being acked, then we have a new (rtx-)pseudo-cumack. Set
3035 						 * new_(rtx_)pseudo_cumack to TRUE so that the cwnd for this dest can be
3036 						 * updated. Also trigger search for the next expected (rtx-)pseudo-cumack.
3037 						 * Separate pseudo_cumack trackers for first transmissions and
3038 						 * retransmissions.
3039 						 */
3040 						if (tp1->rec.data.tsn == tp1->whoTo->pseudo_cumack) {
3041 							if (tp1->rec.data.chunk_was_revoked == 0) {
3042 								tp1->whoTo->new_pseudo_cumack = 1;
3043 							}
3044 							tp1->whoTo->find_pseudo_cumack = 1;
3045 						}
3046 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
3047 							sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.tsn, SCTP_CWND_LOG_FROM_SACK);
3048 						}
3049 						if (tp1->rec.data.tsn == tp1->whoTo->rtx_pseudo_cumack) {
3050 							if (tp1->rec.data.chunk_was_revoked == 0) {
3051 								tp1->whoTo->new_pseudo_cumack = 1;
3052 							}
3053 							tp1->whoTo->find_rtx_pseudo_cumack = 1;
3054 						}
3055 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
3056 							sctp_log_sack(*biggest_newly_acked_tsn,
3057 							    last_tsn,
3058 							    tp1->rec.data.tsn,
3059 							    frag_strt,
3060 							    frag_end,
3061 							    SCTP_LOG_TSN_ACKED);
3062 						}
3063 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3064 							sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_GAP,
3065 							    tp1->whoTo->flight_size,
3066 							    tp1->book_size,
3067 							    (uint32_t)(uintptr_t)tp1->whoTo,
3068 							    tp1->rec.data.tsn);
3069 						}
3070 						sctp_flight_size_decrease(tp1);
3071 						if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3072 							(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3073 							    tp1);
3074 						}
3075 						sctp_total_flight_decrease(stcb, tp1);
3076 
3077 						tp1->whoTo->net_ack += tp1->send_size;
3078 						if (tp1->snd_count < 2) {
3079 							/*-
3080 							 * True non-retransmitted chunk
3081 							 */
3082 							tp1->whoTo->net_ack2 += tp1->send_size;
3083 
3084 							/*-
3085 							 * update RTO too ?
3086 							 */
3087 							if (tp1->do_rtt) {
3088 								if (*rto_ok &&
3089 								    sctp_calculate_rto(stcb,
3090 								    &stcb->asoc,
3091 								    tp1->whoTo,
3092 								    &tp1->sent_rcv_time,
3093 								    SCTP_RTT_FROM_DATA)) {
3094 									*rto_ok = 0;
3095 								}
3096 								if (tp1->whoTo->rto_needed == 0) {
3097 									tp1->whoTo->rto_needed = 1;
3098 								}
3099 								tp1->do_rtt = 0;
3100 							}
3101 						}
3102 					}
3103 					if (tp1->sent <= SCTP_DATAGRAM_RESEND) {
3104 						if (SCTP_TSN_GT(tp1->rec.data.tsn,
3105 						    stcb->asoc.this_sack_highest_gap)) {
3106 							stcb->asoc.this_sack_highest_gap =
3107 							    tp1->rec.data.tsn;
3108 						}
3109 						if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3110 							sctp_ucount_decr(stcb->asoc.sent_queue_retran_cnt);
3111 #ifdef SCTP_AUDITING_ENABLED
3112 							sctp_audit_log(0xB2,
3113 							    (stcb->asoc.sent_queue_retran_cnt & 0x000000ff));
3114 #endif
3115 						}
3116 					}
3117 					/*-
3118 					 * All chunks NOT UNSENT fall through here and are marked
3119 					 * (leave PR-SCTP ones that are to skip alone though)
3120 					 */
3121 					if ((tp1->sent != SCTP_FORWARD_TSN_SKIP) &&
3122 					    (tp1->sent != SCTP_DATAGRAM_NR_ACKED)) {
3123 						tp1->sent = SCTP_DATAGRAM_MARKED;
3124 					}
3125 					if (tp1->rec.data.chunk_was_revoked) {
3126 						/* deflate the cwnd */
3127 						tp1->whoTo->cwnd -= tp1->book_size;
3128 						tp1->rec.data.chunk_was_revoked = 0;
3129 					}
3130 					/* NR Sack code here */
3131 					if (nr_sacking &&
3132 					    (tp1->sent != SCTP_DATAGRAM_NR_ACKED)) {
3133 						if (stcb->asoc.strmout[tp1->rec.data.sid].chunks_on_queues > 0) {
3134 							stcb->asoc.strmout[tp1->rec.data.sid].chunks_on_queues--;
3135 #ifdef INVARIANTS
3136 						} else {
3137 							panic("No chunks on the queues for sid %u.", tp1->rec.data.sid);
3138 #endif
3139 						}
3140 						if ((stcb->asoc.strmout[tp1->rec.data.sid].chunks_on_queues == 0) &&
3141 						    (stcb->asoc.strmout[tp1->rec.data.sid].state == SCTP_STREAM_RESET_PENDING) &&
3142 						    TAILQ_EMPTY(&stcb->asoc.strmout[tp1->rec.data.sid].outqueue)) {
3143 							stcb->asoc.trigger_reset = 1;
3144 						}
3145 						tp1->sent = SCTP_DATAGRAM_NR_ACKED;
3146 						if (tp1->data) {
3147 							/*
3148 							 * sa_ignore
3149 							 * NO_NULL_CHK
3150 							 */
3151 							sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
3152 							sctp_m_freem(tp1->data);
3153 							tp1->data = NULL;
3154 						}
3155 						wake_him++;
3156 					}
3157 				}
3158 				break;
3159 			}	/* if (tp1->tsn == theTSN) */
3160 			if (SCTP_TSN_GT(tp1->rec.data.tsn, theTSN)) {
3161 				break;
3162 			}
3163 			tp1 = TAILQ_NEXT(tp1, sctp_next);
3164 			if ((tp1 == NULL) && (circled == 0)) {
3165 				circled++;
3166 				tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
3167 			}
3168 		}		/* end while (tp1) */
3169 		if (tp1 == NULL) {
3170 			circled = 0;
3171 			tp1 = TAILQ_FIRST(&stcb->asoc.sent_queue);
3172 		}
3173 		/* In case the fragments were not in order we must reset */
3174 	}			/* end for (j = fragStart */
3175 	*p_tp1 = tp1;
3176 	return (wake_him);	/* Return value only used for nr-sack */
3177 }
3178 
3179 static int
3180 sctp_handle_segments(struct mbuf *m, int *offset, struct sctp_tcb *stcb, struct sctp_association *asoc,
3181     uint32_t last_tsn, uint32_t *biggest_tsn_acked,
3182     uint32_t *biggest_newly_acked_tsn, uint32_t *this_sack_lowest_newack,
3183     int num_seg, int num_nr_seg, int *rto_ok)
3184 {
3185 	struct sctp_gap_ack_block *frag, block;
3186 	struct sctp_tmit_chunk *tp1;
3187 	int i;
3188 	int num_frs = 0;
3189 	int chunk_freed;
3190 	int non_revocable;
3191 	uint16_t frag_strt, frag_end, prev_frag_end;
3192 
3193 	tp1 = TAILQ_FIRST(&asoc->sent_queue);
3194 	prev_frag_end = 0;
3195 	chunk_freed = 0;
3196 
3197 	for (i = 0; i < (num_seg + num_nr_seg); i++) {
3198 		if (i == num_seg) {
3199 			prev_frag_end = 0;
3200 			tp1 = TAILQ_FIRST(&asoc->sent_queue);
3201 		}
3202 		frag = (struct sctp_gap_ack_block *)sctp_m_getptr(m, *offset,
3203 		    sizeof(struct sctp_gap_ack_block), (uint8_t *)&block);
3204 		*offset += sizeof(block);
3205 		if (frag == NULL) {
3206 			return (chunk_freed);
3207 		}
3208 		frag_strt = ntohs(frag->start);
3209 		frag_end = ntohs(frag->end);
3210 
3211 		if (frag_strt > frag_end) {
3212 			/* This gap report is malformed, skip it. */
3213 			continue;
3214 		}
3215 		if (frag_strt <= prev_frag_end) {
3216 			/* This gap report is not in order, so restart. */
3217 			tp1 = TAILQ_FIRST(&asoc->sent_queue);
3218 		}
3219 		if (SCTP_TSN_GT((last_tsn + frag_end), *biggest_tsn_acked)) {
3220 			*biggest_tsn_acked = last_tsn + frag_end;
3221 		}
3222 		if (i < num_seg) {
3223 			non_revocable = 0;
3224 		} else {
3225 			non_revocable = 1;
3226 		}
3227 		if (sctp_process_segment_range(stcb, &tp1, last_tsn, frag_strt, frag_end,
3228 		    non_revocable, &num_frs, biggest_newly_acked_tsn,
3229 		    this_sack_lowest_newack, rto_ok)) {
3230 			chunk_freed = 1;
3231 		}
3232 		prev_frag_end = frag_end;
3233 	}
3234 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3235 		if (num_frs)
3236 			sctp_log_fr(*biggest_tsn_acked,
3237 			    *biggest_newly_acked_tsn,
3238 			    last_tsn, SCTP_FR_LOG_BIGGEST_TSNS);
3239 	}
3240 	return (chunk_freed);
3241 }
3242 
3243 static void
3244 sctp_check_for_revoked(struct sctp_tcb *stcb,
3245     struct sctp_association *asoc, uint32_t cumack,
3246     uint32_t biggest_tsn_acked)
3247 {
3248 	struct sctp_tmit_chunk *tp1;
3249 
3250 	TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
3251 		if (SCTP_TSN_GT(tp1->rec.data.tsn, cumack)) {
3252 			/*
3253 			 * ok this guy is either ACK or MARKED. If it is
3254 			 * ACKED it has been previously acked but not this
3255 			 * time i.e. revoked.  If it is MARKED it was ACK'ed
3256 			 * again.
3257 			 */
3258 			if (SCTP_TSN_GT(tp1->rec.data.tsn, biggest_tsn_acked)) {
3259 				break;
3260 			}
3261 			if (tp1->sent == SCTP_DATAGRAM_ACKED) {
3262 				/* it has been revoked */
3263 				tp1->sent = SCTP_DATAGRAM_SENT;
3264 				tp1->rec.data.chunk_was_revoked = 1;
3265 				/*
3266 				 * We must add this stuff back in to assure
3267 				 * timers and such get started.
3268 				 */
3269 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3270 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP_REVOKE,
3271 					    tp1->whoTo->flight_size,
3272 					    tp1->book_size,
3273 					    (uint32_t)(uintptr_t)tp1->whoTo,
3274 					    tp1->rec.data.tsn);
3275 				}
3276 				sctp_flight_size_increase(tp1);
3277 				sctp_total_flight_increase(stcb, tp1);
3278 				/*
3279 				 * We inflate the cwnd to compensate for our
3280 				 * artificial inflation of the flight_size.
3281 				 */
3282 				tp1->whoTo->cwnd += tp1->book_size;
3283 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
3284 					sctp_log_sack(asoc->last_acked_seq,
3285 					    cumack,
3286 					    tp1->rec.data.tsn,
3287 					    0,
3288 					    0,
3289 					    SCTP_LOG_TSN_REVOKED);
3290 				}
3291 			} else if (tp1->sent == SCTP_DATAGRAM_MARKED) {
3292 				/* it has been re-acked in this SACK */
3293 				tp1->sent = SCTP_DATAGRAM_ACKED;
3294 			}
3295 		}
3296 		if (tp1->sent == SCTP_DATAGRAM_UNSENT)
3297 			break;
3298 	}
3299 }
3300 
3301 static void
3302 sctp_strike_gap_ack_chunks(struct sctp_tcb *stcb, struct sctp_association *asoc,
3303     uint32_t biggest_tsn_acked, uint32_t biggest_tsn_newly_acked, uint32_t this_sack_lowest_newack, int accum_moved)
3304 {
3305 	struct sctp_tmit_chunk *tp1;
3306 	int strike_flag = 0;
3307 	struct timeval now;
3308 	int tot_retrans = 0;
3309 	uint32_t sending_seq;
3310 	struct sctp_nets *net;
3311 	int num_dests_sacked = 0;
3312 
3313 	/*
3314 	 * select the sending_seq, this is either the next thing ready to be
3315 	 * sent but not transmitted, OR, the next seq we assign.
3316 	 */
3317 	tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
3318 	if (tp1 == NULL) {
3319 		sending_seq = asoc->sending_seq;
3320 	} else {
3321 		sending_seq = tp1->rec.data.tsn;
3322 	}
3323 
3324 	/* CMT DAC algo: finding out if SACK is a mixed SACK */
3325 	if ((asoc->sctp_cmt_on_off > 0) &&
3326 	    SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3327 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3328 			if (net->saw_newack)
3329 				num_dests_sacked++;
3330 		}
3331 	}
3332 	if (stcb->asoc.prsctp_supported) {
3333 		(void)SCTP_GETTIME_TIMEVAL(&now);
3334 	}
3335 	TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
3336 		strike_flag = 0;
3337 		if (tp1->no_fr_allowed) {
3338 			/* this one had a timeout or something */
3339 			continue;
3340 		}
3341 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3342 			if (tp1->sent < SCTP_DATAGRAM_RESEND)
3343 				sctp_log_fr(biggest_tsn_newly_acked,
3344 				    tp1->rec.data.tsn,
3345 				    tp1->sent,
3346 				    SCTP_FR_LOG_CHECK_STRIKE);
3347 		}
3348 		if (SCTP_TSN_GT(tp1->rec.data.tsn, biggest_tsn_acked) ||
3349 		    tp1->sent == SCTP_DATAGRAM_UNSENT) {
3350 			/* done */
3351 			break;
3352 		}
3353 		if (stcb->asoc.prsctp_supported) {
3354 			if ((PR_SCTP_TTL_ENABLED(tp1->flags)) && tp1->sent < SCTP_DATAGRAM_ACKED) {
3355 				/* Is it expired? */
3356 				if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
3357 					/* Yes so drop it */
3358 					if (tp1->data != NULL) {
3359 						(void)sctp_release_pr_sctp_chunk(stcb, tp1, 1,
3360 						    SCTP_SO_NOT_LOCKED);
3361 					}
3362 					continue;
3363 				}
3364 			}
3365 		}
3366 		if (SCTP_TSN_GT(tp1->rec.data.tsn, asoc->this_sack_highest_gap) &&
3367 		    !(accum_moved && asoc->fast_retran_loss_recovery)) {
3368 			/* we are beyond the tsn in the sack  */
3369 			break;
3370 		}
3371 		if (tp1->sent >= SCTP_DATAGRAM_RESEND) {
3372 			/* either a RESEND, ACKED, or MARKED */
3373 			/* skip */
3374 			if (tp1->sent == SCTP_FORWARD_TSN_SKIP) {
3375 				/* Continue strikin FWD-TSN chunks */
3376 				tp1->rec.data.fwd_tsn_cnt++;
3377 			}
3378 			continue;
3379 		}
3380 		/*
3381 		 * CMT : SFR algo (covers part of DAC and HTNA as well)
3382 		 */
3383 		if (tp1->whoTo && tp1->whoTo->saw_newack == 0) {
3384 			/*
3385 			 * No new acks were receieved for data sent to this
3386 			 * dest. Therefore, according to the SFR algo for
3387 			 * CMT, no data sent to this dest can be marked for
3388 			 * FR using this SACK.
3389 			 */
3390 			continue;
3391 		} else if (tp1->whoTo &&
3392 			    SCTP_TSN_GT(tp1->rec.data.tsn,
3393 			    tp1->whoTo->this_sack_highest_newack) &&
3394 		    !(accum_moved && asoc->fast_retran_loss_recovery)) {
3395 			/*
3396 			 * CMT: New acks were receieved for data sent to
3397 			 * this dest. But no new acks were seen for data
3398 			 * sent after tp1. Therefore, according to the SFR
3399 			 * algo for CMT, tp1 cannot be marked for FR using
3400 			 * this SACK. This step covers part of the DAC algo
3401 			 * and the HTNA algo as well.
3402 			 */
3403 			continue;
3404 		}
3405 		/*
3406 		 * Here we check to see if we were have already done a FR
3407 		 * and if so we see if the biggest TSN we saw in the sack is
3408 		 * smaller than the recovery point. If so we don't strike
3409 		 * the tsn... otherwise we CAN strike the TSN.
3410 		 */
3411 		/*
3412 		 * @@@ JRI: Check for CMT if (accum_moved &&
3413 		 * asoc->fast_retran_loss_recovery && (sctp_cmt_on_off ==
3414 		 * 0)) {
3415 		 */
3416 		if (accum_moved && asoc->fast_retran_loss_recovery) {
3417 			/*
3418 			 * Strike the TSN if in fast-recovery and cum-ack
3419 			 * moved.
3420 			 */
3421 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3422 				sctp_log_fr(biggest_tsn_newly_acked,
3423 				    tp1->rec.data.tsn,
3424 				    tp1->sent,
3425 				    SCTP_FR_LOG_STRIKE_CHUNK);
3426 			}
3427 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3428 				tp1->sent++;
3429 			}
3430 			if ((asoc->sctp_cmt_on_off > 0) &&
3431 			    SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3432 				/*
3433 				 * CMT DAC algorithm: If SACK flag is set to
3434 				 * 0, then lowest_newack test will not pass
3435 				 * because it would have been set to the
3436 				 * cumack earlier. If not already to be
3437 				 * rtx'd, If not a mixed sack and if tp1 is
3438 				 * not between two sacked TSNs, then mark by
3439 				 * one more. NOTE that we are marking by one
3440 				 * additional time since the SACK DAC flag
3441 				 * indicates that two packets have been
3442 				 * received after this missing TSN.
3443 				 */
3444 				if ((tp1->sent < SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3445 				    SCTP_TSN_GT(this_sack_lowest_newack, tp1->rec.data.tsn)) {
3446 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3447 						sctp_log_fr(16 + num_dests_sacked,
3448 						    tp1->rec.data.tsn,
3449 						    tp1->sent,
3450 						    SCTP_FR_LOG_STRIKE_CHUNK);
3451 					}
3452 					tp1->sent++;
3453 				}
3454 			}
3455 		} else if ((tp1->rec.data.doing_fast_retransmit) &&
3456 		    (asoc->sctp_cmt_on_off == 0)) {
3457 			/*
3458 			 * For those that have done a FR we must take
3459 			 * special consideration if we strike. I.e the
3460 			 * biggest_newly_acked must be higher than the
3461 			 * sending_seq at the time we did the FR.
3462 			 */
3463 			if (
3464 #ifdef SCTP_FR_TO_ALTERNATE
3465 			/*
3466 			 * If FR's go to new networks, then we must only do
3467 			 * this for singly homed asoc's. However if the FR's
3468 			 * go to the same network (Armando's work) then its
3469 			 * ok to FR multiple times.
3470 			 */
3471 			    (asoc->numnets < 2)
3472 #else
3473 			    (1)
3474 #endif
3475 			    ) {
3476 				if (SCTP_TSN_GE(biggest_tsn_newly_acked,
3477 				    tp1->rec.data.fast_retran_tsn)) {
3478 					/*
3479 					 * Strike the TSN, since this ack is
3480 					 * beyond where things were when we
3481 					 * did a FR.
3482 					 */
3483 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3484 						sctp_log_fr(biggest_tsn_newly_acked,
3485 						    tp1->rec.data.tsn,
3486 						    tp1->sent,
3487 						    SCTP_FR_LOG_STRIKE_CHUNK);
3488 					}
3489 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3490 						tp1->sent++;
3491 					}
3492 					strike_flag = 1;
3493 					if ((asoc->sctp_cmt_on_off > 0) &&
3494 					    SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3495 						/*
3496 						 * CMT DAC algorithm: If
3497 						 * SACK flag is set to 0,
3498 						 * then lowest_newack test
3499 						 * will not pass because it
3500 						 * would have been set to
3501 						 * the cumack earlier. If
3502 						 * not already to be rtx'd,
3503 						 * If not a mixed sack and
3504 						 * if tp1 is not between two
3505 						 * sacked TSNs, then mark by
3506 						 * one more. NOTE that we
3507 						 * are marking by one
3508 						 * additional time since the
3509 						 * SACK DAC flag indicates
3510 						 * that two packets have
3511 						 * been received after this
3512 						 * missing TSN.
3513 						 */
3514 						if ((tp1->sent < SCTP_DATAGRAM_RESEND) &&
3515 						    (num_dests_sacked == 1) &&
3516 						    SCTP_TSN_GT(this_sack_lowest_newack,
3517 						    tp1->rec.data.tsn)) {
3518 							if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3519 								sctp_log_fr(32 + num_dests_sacked,
3520 								    tp1->rec.data.tsn,
3521 								    tp1->sent,
3522 								    SCTP_FR_LOG_STRIKE_CHUNK);
3523 							}
3524 							if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3525 								tp1->sent++;
3526 							}
3527 						}
3528 					}
3529 				}
3530 			}
3531 			/*
3532 			 * JRI: TODO: remove code for HTNA algo. CMT's SFR
3533 			 * algo covers HTNA.
3534 			 */
3535 		} else if (SCTP_TSN_GT(tp1->rec.data.tsn,
3536 		    biggest_tsn_newly_acked)) {
3537 			/*
3538 			 * We don't strike these: This is the  HTNA
3539 			 * algorithm i.e. we don't strike If our TSN is
3540 			 * larger than the Highest TSN Newly Acked.
3541 			 */
3542 			;
3543 		} else {
3544 			/* Strike the TSN */
3545 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3546 				sctp_log_fr(biggest_tsn_newly_acked,
3547 				    tp1->rec.data.tsn,
3548 				    tp1->sent,
3549 				    SCTP_FR_LOG_STRIKE_CHUNK);
3550 			}
3551 			if (tp1->sent < SCTP_DATAGRAM_RESEND) {
3552 				tp1->sent++;
3553 			}
3554 			if ((asoc->sctp_cmt_on_off > 0) &&
3555 			    SCTP_BASE_SYSCTL(sctp_cmt_use_dac)) {
3556 				/*
3557 				 * CMT DAC algorithm: If SACK flag is set to
3558 				 * 0, then lowest_newack test will not pass
3559 				 * because it would have been set to the
3560 				 * cumack earlier. If not already to be
3561 				 * rtx'd, If not a mixed sack and if tp1 is
3562 				 * not between two sacked TSNs, then mark by
3563 				 * one more. NOTE that we are marking by one
3564 				 * additional time since the SACK DAC flag
3565 				 * indicates that two packets have been
3566 				 * received after this missing TSN.
3567 				 */
3568 				if ((tp1->sent < SCTP_DATAGRAM_RESEND) && (num_dests_sacked == 1) &&
3569 				    SCTP_TSN_GT(this_sack_lowest_newack, tp1->rec.data.tsn)) {
3570 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3571 						sctp_log_fr(48 + num_dests_sacked,
3572 						    tp1->rec.data.tsn,
3573 						    tp1->sent,
3574 						    SCTP_FR_LOG_STRIKE_CHUNK);
3575 					}
3576 					tp1->sent++;
3577 				}
3578 			}
3579 		}
3580 		if (tp1->sent == SCTP_DATAGRAM_RESEND) {
3581 			struct sctp_nets *alt;
3582 
3583 			/* fix counts and things */
3584 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3585 				sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_RSND,
3586 				    (tp1->whoTo ? (tp1->whoTo->flight_size) : 0),
3587 				    tp1->book_size,
3588 				    (uint32_t)(uintptr_t)tp1->whoTo,
3589 				    tp1->rec.data.tsn);
3590 			}
3591 			if (tp1->whoTo) {
3592 				tp1->whoTo->net_ack++;
3593 				sctp_flight_size_decrease(tp1);
3594 				if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3595 					(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3596 					    tp1);
3597 				}
3598 			}
3599 
3600 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
3601 				sctp_log_rwnd(SCTP_INCREASE_PEER_RWND,
3602 				    asoc->peers_rwnd, tp1->send_size, SCTP_BASE_SYSCTL(sctp_peer_chunk_oh));
3603 			}
3604 			/* add back to the rwnd */
3605 			asoc->peers_rwnd += (tp1->send_size + SCTP_BASE_SYSCTL(sctp_peer_chunk_oh));
3606 
3607 			/* remove from the total flight */
3608 			sctp_total_flight_decrease(stcb, tp1);
3609 
3610 			if ((stcb->asoc.prsctp_supported) &&
3611 			    (PR_SCTP_RTX_ENABLED(tp1->flags))) {
3612 				/*
3613 				 * Has it been retransmitted tv_sec times? -
3614 				 * we store the retran count there.
3615 				 */
3616 				if (tp1->snd_count > tp1->rec.data.timetodrop.tv_sec) {
3617 					/* Yes, so drop it */
3618 					if (tp1->data != NULL) {
3619 						(void)sctp_release_pr_sctp_chunk(stcb, tp1, 1,
3620 						    SCTP_SO_NOT_LOCKED);
3621 					}
3622 					/* Make sure to flag we had a FR */
3623 					if (tp1->whoTo != NULL) {
3624 						tp1->whoTo->net_ack++;
3625 					}
3626 					continue;
3627 				}
3628 			}
3629 			/*
3630 			 * SCTP_PRINTF("OK, we are now ready to FR this
3631 			 * guy\n");
3632 			 */
3633 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE) {
3634 				sctp_log_fr(tp1->rec.data.tsn, tp1->snd_count,
3635 				    0, SCTP_FR_MARKED);
3636 			}
3637 			if (strike_flag) {
3638 				/* This is a subsequent FR */
3639 				SCTP_STAT_INCR(sctps_sendmultfastretrans);
3640 			}
3641 			sctp_ucount_incr(stcb->asoc.sent_queue_retran_cnt);
3642 			if (asoc->sctp_cmt_on_off > 0) {
3643 				/*
3644 				 * CMT: Using RTX_SSTHRESH policy for CMT.
3645 				 * If CMT is being used, then pick dest with
3646 				 * largest ssthresh for any retransmission.
3647 				 */
3648 				tp1->no_fr_allowed = 1;
3649 				alt = tp1->whoTo;
3650 				/* sa_ignore NO_NULL_CHK */
3651 				if (asoc->sctp_cmt_pf > 0) {
3652 					/*
3653 					 * JRS 5/18/07 - If CMT PF is on,
3654 					 * use the PF version of
3655 					 * find_alt_net()
3656 					 */
3657 					alt = sctp_find_alternate_net(stcb, alt, 2);
3658 				} else {
3659 					/*
3660 					 * JRS 5/18/07 - If only CMT is on,
3661 					 * use the CMT version of
3662 					 * find_alt_net()
3663 					 */
3664 					/* sa_ignore NO_NULL_CHK */
3665 					alt = sctp_find_alternate_net(stcb, alt, 1);
3666 				}
3667 				if (alt == NULL) {
3668 					alt = tp1->whoTo;
3669 				}
3670 				/*
3671 				 * CUCv2: If a different dest is picked for
3672 				 * the retransmission, then new
3673 				 * (rtx-)pseudo_cumack needs to be tracked
3674 				 * for orig dest. Let CUCv2 track new (rtx-)
3675 				 * pseudo-cumack always.
3676 				 */
3677 				if (tp1->whoTo) {
3678 					tp1->whoTo->find_pseudo_cumack = 1;
3679 					tp1->whoTo->find_rtx_pseudo_cumack = 1;
3680 				}
3681 			} else {	/* CMT is OFF */
3682 #ifdef SCTP_FR_TO_ALTERNATE
3683 				/* Can we find an alternate? */
3684 				alt = sctp_find_alternate_net(stcb, tp1->whoTo, 0);
3685 #else
3686 				/*
3687 				 * default behavior is to NOT retransmit
3688 				 * FR's to an alternate. Armando Caro's
3689 				 * paper details why.
3690 				 */
3691 				alt = tp1->whoTo;
3692 #endif
3693 			}
3694 
3695 			tp1->rec.data.doing_fast_retransmit = 1;
3696 			tot_retrans++;
3697 			/* mark the sending seq for possible subsequent FR's */
3698 			/*
3699 			 * SCTP_PRINTF("Marking TSN for FR new value %x\n",
3700 			 * (uint32_t)tpi->rec.data.tsn);
3701 			 */
3702 			if (TAILQ_EMPTY(&asoc->send_queue)) {
3703 				/*
3704 				 * If the queue of send is empty then its
3705 				 * the next sequence number that will be
3706 				 * assigned so we subtract one from this to
3707 				 * get the one we last sent.
3708 				 */
3709 				tp1->rec.data.fast_retran_tsn = sending_seq;
3710 			} else {
3711 				/*
3712 				 * If there are chunks on the send queue
3713 				 * (unsent data that has made it from the
3714 				 * stream queues but not out the door, we
3715 				 * take the first one (which will have the
3716 				 * lowest TSN) and subtract one to get the
3717 				 * one we last sent.
3718 				 */
3719 				struct sctp_tmit_chunk *ttt;
3720 
3721 				ttt = TAILQ_FIRST(&asoc->send_queue);
3722 				tp1->rec.data.fast_retran_tsn =
3723 				    ttt->rec.data.tsn;
3724 			}
3725 
3726 			if (tp1->do_rtt) {
3727 				/*
3728 				 * this guy had a RTO calculation pending on
3729 				 * it, cancel it
3730 				 */
3731 				if ((tp1->whoTo != NULL) &&
3732 				    (tp1->whoTo->rto_needed == 0)) {
3733 					tp1->whoTo->rto_needed = 1;
3734 				}
3735 				tp1->do_rtt = 0;
3736 			}
3737 			if (alt != tp1->whoTo) {
3738 				/* yes, there is an alternate. */
3739 				sctp_free_remote_addr(tp1->whoTo);
3740 				/* sa_ignore FREED_MEMORY */
3741 				tp1->whoTo = alt;
3742 				atomic_add_int(&alt->ref_count, 1);
3743 			}
3744 		}
3745 	}
3746 }
3747 
3748 struct sctp_tmit_chunk *
3749 sctp_try_advance_peer_ack_point(struct sctp_tcb *stcb,
3750     struct sctp_association *asoc)
3751 {
3752 	struct sctp_tmit_chunk *tp1, *tp2, *a_adv = NULL;
3753 	struct timeval now;
3754 	int now_filled = 0;
3755 
3756 	if (asoc->prsctp_supported == 0) {
3757 		return (NULL);
3758 	}
3759 	TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
3760 		if (tp1->sent != SCTP_FORWARD_TSN_SKIP &&
3761 		    tp1->sent != SCTP_DATAGRAM_RESEND &&
3762 		    tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
3763 			/* no chance to advance, out of here */
3764 			break;
3765 		}
3766 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) {
3767 			if ((tp1->sent == SCTP_FORWARD_TSN_SKIP) ||
3768 			    (tp1->sent == SCTP_DATAGRAM_NR_ACKED)) {
3769 				sctp_misc_ints(SCTP_FWD_TSN_CHECK,
3770 				    asoc->advanced_peer_ack_point,
3771 				    tp1->rec.data.tsn, 0, 0);
3772 			}
3773 		}
3774 		if (!PR_SCTP_ENABLED(tp1->flags)) {
3775 			/*
3776 			 * We can't fwd-tsn past any that are reliable aka
3777 			 * retransmitted until the asoc fails.
3778 			 */
3779 			break;
3780 		}
3781 		if (!now_filled) {
3782 			(void)SCTP_GETTIME_TIMEVAL(&now);
3783 			now_filled = 1;
3784 		}
3785 		/*
3786 		 * now we got a chunk which is marked for another
3787 		 * retransmission to a PR-stream but has run out its chances
3788 		 * already maybe OR has been marked to skip now. Can we skip
3789 		 * it if its a resend?
3790 		 */
3791 		if (tp1->sent == SCTP_DATAGRAM_RESEND &&
3792 		    (PR_SCTP_TTL_ENABLED(tp1->flags))) {
3793 			/*
3794 			 * Now is this one marked for resend and its time is
3795 			 * now up?
3796 			 */
3797 			if (timevalcmp(&now, &tp1->rec.data.timetodrop, >)) {
3798 				/* Yes so drop it */
3799 				if (tp1->data) {
3800 					(void)sctp_release_pr_sctp_chunk(stcb, tp1,
3801 					    1, SCTP_SO_NOT_LOCKED);
3802 				}
3803 			} else {
3804 				/*
3805 				 * No, we are done when hit one for resend
3806 				 * whos time as not expired.
3807 				 */
3808 				break;
3809 			}
3810 		}
3811 		/*
3812 		 * Ok now if this chunk is marked to drop it we can clean up
3813 		 * the chunk, advance our peer ack point and we can check
3814 		 * the next chunk.
3815 		 */
3816 		if ((tp1->sent == SCTP_FORWARD_TSN_SKIP) ||
3817 		    (tp1->sent == SCTP_DATAGRAM_NR_ACKED)) {
3818 			/* advance PeerAckPoint goes forward */
3819 			if (SCTP_TSN_GT(tp1->rec.data.tsn, asoc->advanced_peer_ack_point)) {
3820 				asoc->advanced_peer_ack_point = tp1->rec.data.tsn;
3821 				a_adv = tp1;
3822 			} else if (tp1->rec.data.tsn == asoc->advanced_peer_ack_point) {
3823 				/* No update but we do save the chk */
3824 				a_adv = tp1;
3825 			}
3826 		} else {
3827 			/*
3828 			 * If it is still in RESEND we can advance no
3829 			 * further
3830 			 */
3831 			break;
3832 		}
3833 	}
3834 	return (a_adv);
3835 }
3836 
3837 static int
3838 sctp_fs_audit(struct sctp_association *asoc)
3839 {
3840 	struct sctp_tmit_chunk *chk;
3841 	int inflight = 0, resend = 0, inbetween = 0, acked = 0, above = 0;
3842 	int ret;
3843 #ifndef INVARIANTS
3844 	int entry_flight, entry_cnt;
3845 #endif
3846 
3847 	ret = 0;
3848 #ifndef INVARIANTS
3849 	entry_flight = asoc->total_flight;
3850 	entry_cnt = asoc->total_flight_count;
3851 #endif
3852 	if (asoc->pr_sctp_cnt >= asoc->sent_queue_cnt)
3853 		return (0);
3854 
3855 	TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
3856 		if (chk->sent < SCTP_DATAGRAM_RESEND) {
3857 			SCTP_PRINTF("Chk TSN: %u size: %d inflight cnt: %d\n",
3858 			    chk->rec.data.tsn,
3859 			    chk->send_size,
3860 			    chk->snd_count);
3861 			inflight++;
3862 		} else if (chk->sent == SCTP_DATAGRAM_RESEND) {
3863 			resend++;
3864 		} else if (chk->sent < SCTP_DATAGRAM_ACKED) {
3865 			inbetween++;
3866 		} else if (chk->sent > SCTP_DATAGRAM_ACKED) {
3867 			above++;
3868 		} else {
3869 			acked++;
3870 		}
3871 	}
3872 
3873 	if ((inflight > 0) || (inbetween > 0)) {
3874 #ifdef INVARIANTS
3875 		panic("Flight size-express incorrect? \n");
3876 #else
3877 		SCTP_PRINTF("asoc->total_flight: %d cnt: %d\n",
3878 		    entry_flight, entry_cnt);
3879 
3880 		SCTP_PRINTF("Flight size-express incorrect F: %d I: %d R: %d Ab: %d ACK: %d\n",
3881 		    inflight, inbetween, resend, above, acked);
3882 		ret = 1;
3883 #endif
3884 	}
3885 	return (ret);
3886 }
3887 
3888 static void
3889 sctp_window_probe_recovery(struct sctp_tcb *stcb,
3890     struct sctp_association *asoc,
3891     struct sctp_tmit_chunk *tp1)
3892 {
3893 	tp1->window_probe = 0;
3894 	if ((tp1->sent >= SCTP_DATAGRAM_ACKED) || (tp1->data == NULL)) {
3895 		/* TSN's skipped we do NOT move back. */
3896 		sctp_misc_ints(SCTP_FLIGHT_LOG_DWN_WP_FWD,
3897 		    tp1->whoTo ? tp1->whoTo->flight_size : 0,
3898 		    tp1->book_size,
3899 		    (uint32_t)(uintptr_t)tp1->whoTo,
3900 		    tp1->rec.data.tsn);
3901 		return;
3902 	}
3903 	/* First setup this by shrinking flight */
3904 	if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
3905 		(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
3906 		    tp1);
3907 	}
3908 	sctp_flight_size_decrease(tp1);
3909 	sctp_total_flight_decrease(stcb, tp1);
3910 	/* Now mark for resend */
3911 	tp1->sent = SCTP_DATAGRAM_RESEND;
3912 	sctp_ucount_incr(asoc->sent_queue_retran_cnt);
3913 
3914 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
3915 		sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_WP,
3916 		    tp1->whoTo->flight_size,
3917 		    tp1->book_size,
3918 		    (uint32_t)(uintptr_t)tp1->whoTo,
3919 		    tp1->rec.data.tsn);
3920 	}
3921 }
3922 
3923 void
3924 sctp_express_handle_sack(struct sctp_tcb *stcb, uint32_t cumack,
3925     uint32_t rwnd, int *abort_now, int ecne_seen)
3926 {
3927 	struct sctp_nets *net;
3928 	struct sctp_association *asoc;
3929 	struct sctp_tmit_chunk *tp1, *tp2;
3930 	uint32_t old_rwnd;
3931 	int win_probe_recovery = 0;
3932 	int win_probe_recovered = 0;
3933 	int j, done_once = 0;
3934 	int rto_ok = 1;
3935 	uint32_t send_s;
3936 
3937 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_SACK_ARRIVALS_ENABLE) {
3938 		sctp_misc_ints(SCTP_SACK_LOG_EXPRESS, cumack,
3939 		    rwnd, stcb->asoc.last_acked_seq, stcb->asoc.peers_rwnd);
3940 	}
3941 	SCTP_TCB_LOCK_ASSERT(stcb);
3942 #ifdef SCTP_ASOCLOG_OF_TSNS
3943 	stcb->asoc.cumack_log[stcb->asoc.cumack_log_at] = cumack;
3944 	stcb->asoc.cumack_log_at++;
3945 	if (stcb->asoc.cumack_log_at > SCTP_TSN_LOG_SIZE) {
3946 		stcb->asoc.cumack_log_at = 0;
3947 	}
3948 #endif
3949 	asoc = &stcb->asoc;
3950 	old_rwnd = asoc->peers_rwnd;
3951 	if (SCTP_TSN_GT(asoc->last_acked_seq, cumack)) {
3952 		/* old ack */
3953 		return;
3954 	} else if (asoc->last_acked_seq == cumack) {
3955 		/* Window update sack */
3956 		asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
3957 		    (uint32_t)(asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
3958 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
3959 			/* SWS sender side engages */
3960 			asoc->peers_rwnd = 0;
3961 		}
3962 		if (asoc->peers_rwnd > old_rwnd) {
3963 			goto again;
3964 		}
3965 		return;
3966 	}
3967 
3968 	/* First setup for CC stuff */
3969 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3970 		if (SCTP_TSN_GT(cumack, net->cwr_window_tsn)) {
3971 			/* Drag along the window_tsn for cwr's */
3972 			net->cwr_window_tsn = cumack;
3973 		}
3974 		net->prev_cwnd = net->cwnd;
3975 		net->net_ack = 0;
3976 		net->net_ack2 = 0;
3977 
3978 		/*
3979 		 * CMT: Reset CUC and Fast recovery algo variables before
3980 		 * SACK processing
3981 		 */
3982 		net->new_pseudo_cumack = 0;
3983 		net->will_exit_fast_recovery = 0;
3984 		if (stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) {
3985 			(*stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) (stcb, net);
3986 		}
3987 	}
3988 	if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3989 		tp1 = TAILQ_LAST(&asoc->sent_queue,
3990 		    sctpchunk_listhead);
3991 		send_s = tp1->rec.data.tsn + 1;
3992 	} else {
3993 		send_s = asoc->sending_seq;
3994 	}
3995 	if (SCTP_TSN_GE(cumack, send_s)) {
3996 		struct mbuf *op_err;
3997 		char msg[SCTP_DIAG_INFO_LEN];
3998 
3999 		*abort_now = 1;
4000 		/* XXX */
4001 		SCTP_SNPRINTF(msg, sizeof(msg),
4002 		    "Cum ack %8.8x greater or equal than TSN %8.8x",
4003 		    cumack, send_s);
4004 		op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
4005 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_25;
4006 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4007 		return;
4008 	}
4009 	asoc->this_sack_highest_gap = cumack;
4010 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4011 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4012 		    stcb->asoc.overall_error_count,
4013 		    0,
4014 		    SCTP_FROM_SCTP_INDATA,
4015 		    __LINE__);
4016 	}
4017 	stcb->asoc.overall_error_count = 0;
4018 	if (SCTP_TSN_GT(cumack, asoc->last_acked_seq)) {
4019 		/* process the new consecutive TSN first */
4020 		TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
4021 			if (SCTP_TSN_GE(cumack, tp1->rec.data.tsn)) {
4022 				if (tp1->sent == SCTP_DATAGRAM_UNSENT) {
4023 					SCTP_PRINTF("Warning, an unsent is now acked?\n");
4024 				}
4025 				if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4026 					/*
4027 					 * If it is less than ACKED, it is
4028 					 * now no-longer in flight. Higher
4029 					 * values may occur during marking
4030 					 */
4031 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4032 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
4033 							sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_CA,
4034 							    tp1->whoTo->flight_size,
4035 							    tp1->book_size,
4036 							    (uint32_t)(uintptr_t)tp1->whoTo,
4037 							    tp1->rec.data.tsn);
4038 						}
4039 						sctp_flight_size_decrease(tp1);
4040 						if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
4041 							(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
4042 							    tp1);
4043 						}
4044 						/* sa_ignore NO_NULL_CHK */
4045 						sctp_total_flight_decrease(stcb, tp1);
4046 					}
4047 					tp1->whoTo->net_ack += tp1->send_size;
4048 					if (tp1->snd_count < 2) {
4049 						/*
4050 						 * True non-retransmitted
4051 						 * chunk
4052 						 */
4053 						tp1->whoTo->net_ack2 +=
4054 						    tp1->send_size;
4055 
4056 						/* update RTO too? */
4057 						if (tp1->do_rtt) {
4058 							if (rto_ok &&
4059 							    sctp_calculate_rto(stcb,
4060 							    &stcb->asoc,
4061 							    tp1->whoTo,
4062 							    &tp1->sent_rcv_time,
4063 							    SCTP_RTT_FROM_DATA)) {
4064 								rto_ok = 0;
4065 							}
4066 							if (tp1->whoTo->rto_needed == 0) {
4067 								tp1->whoTo->rto_needed = 1;
4068 							}
4069 							tp1->do_rtt = 0;
4070 						}
4071 					}
4072 					/*
4073 					 * CMT: CUCv2 algorithm. From the
4074 					 * cumack'd TSNs, for each TSN being
4075 					 * acked for the first time, set the
4076 					 * following variables for the
4077 					 * corresp destination.
4078 					 * new_pseudo_cumack will trigger a
4079 					 * cwnd update.
4080 					 * find_(rtx_)pseudo_cumack will
4081 					 * trigger search for the next
4082 					 * expected (rtx-)pseudo-cumack.
4083 					 */
4084 					tp1->whoTo->new_pseudo_cumack = 1;
4085 					tp1->whoTo->find_pseudo_cumack = 1;
4086 					tp1->whoTo->find_rtx_pseudo_cumack = 1;
4087 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
4088 						/* sa_ignore NO_NULL_CHK */
4089 						sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.tsn, SCTP_CWND_LOG_FROM_SACK);
4090 					}
4091 				}
4092 				if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4093 					sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4094 				}
4095 				if (tp1->rec.data.chunk_was_revoked) {
4096 					/* deflate the cwnd */
4097 					tp1->whoTo->cwnd -= tp1->book_size;
4098 					tp1->rec.data.chunk_was_revoked = 0;
4099 				}
4100 				if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
4101 					if (asoc->strmout[tp1->rec.data.sid].chunks_on_queues > 0) {
4102 						asoc->strmout[tp1->rec.data.sid].chunks_on_queues--;
4103 #ifdef INVARIANTS
4104 					} else {
4105 						panic("No chunks on the queues for sid %u.", tp1->rec.data.sid);
4106 #endif
4107 					}
4108 				}
4109 				if ((asoc->strmout[tp1->rec.data.sid].chunks_on_queues == 0) &&
4110 				    (asoc->strmout[tp1->rec.data.sid].state == SCTP_STREAM_RESET_PENDING) &&
4111 				    TAILQ_EMPTY(&asoc->strmout[tp1->rec.data.sid].outqueue)) {
4112 					asoc->trigger_reset = 1;
4113 				}
4114 				TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4115 				if (tp1->data) {
4116 					/* sa_ignore NO_NULL_CHK */
4117 					sctp_free_bufspace(stcb, asoc, tp1, 1);
4118 					sctp_m_freem(tp1->data);
4119 					tp1->data = NULL;
4120 				}
4121 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4122 					sctp_log_sack(asoc->last_acked_seq,
4123 					    cumack,
4124 					    tp1->rec.data.tsn,
4125 					    0,
4126 					    0,
4127 					    SCTP_LOG_FREE_SENT);
4128 				}
4129 				asoc->sent_queue_cnt--;
4130 				sctp_free_a_chunk(stcb, tp1, SCTP_SO_NOT_LOCKED);
4131 			} else {
4132 				break;
4133 			}
4134 		}
4135 	}
4136 	/* sa_ignore NO_NULL_CHK */
4137 	if (stcb->sctp_socket) {
4138 		SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
4139 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4140 			/* sa_ignore NO_NULL_CHK */
4141 			sctp_wakeup_log(stcb, 1, SCTP_WAKESND_FROM_SACK);
4142 		}
4143 		sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
4144 	} else {
4145 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4146 			sctp_wakeup_log(stcb, 1, SCTP_NOWAKE_FROM_SACK);
4147 		}
4148 	}
4149 
4150 	/* JRS - Use the congestion control given in the CC module */
4151 	if ((asoc->last_acked_seq != cumack) && (ecne_seen == 0)) {
4152 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4153 			if (net->net_ack2 > 0) {
4154 				/*
4155 				 * Karn's rule applies to clearing error
4156 				 * count, this is optional.
4157 				 */
4158 				net->error_count = 0;
4159 				if (!(net->dest_state & SCTP_ADDR_REACHABLE)) {
4160 					/* addr came good */
4161 					net->dest_state |= SCTP_ADDR_REACHABLE;
4162 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
4163 					    0, (void *)net, SCTP_SO_NOT_LOCKED);
4164 				}
4165 				if (net == stcb->asoc.primary_destination) {
4166 					if (stcb->asoc.alternate) {
4167 						/*
4168 						 * release the alternate,
4169 						 * primary is good
4170 						 */
4171 						sctp_free_remote_addr(stcb->asoc.alternate);
4172 						stcb->asoc.alternate = NULL;
4173 					}
4174 				}
4175 				if (net->dest_state & SCTP_ADDR_PF) {
4176 					net->dest_state &= ~SCTP_ADDR_PF;
4177 					sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT,
4178 					    stcb->sctp_ep, stcb, net,
4179 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_26);
4180 					sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
4181 					asoc->cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
4182 					/* Done with this net */
4183 					net->net_ack = 0;
4184 				}
4185 				/* restore any doubled timers */
4186 				net->RTO = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
4187 				if (net->RTO < stcb->asoc.minrto) {
4188 					net->RTO = stcb->asoc.minrto;
4189 				}
4190 				if (net->RTO > stcb->asoc.maxrto) {
4191 					net->RTO = stcb->asoc.maxrto;
4192 				}
4193 			}
4194 		}
4195 		asoc->cc_functions.sctp_cwnd_update_after_sack(stcb, asoc, 1, 0, 0);
4196 	}
4197 	asoc->last_acked_seq = cumack;
4198 
4199 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
4200 		/* nothing left in-flight */
4201 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4202 			net->flight_size = 0;
4203 			net->partial_bytes_acked = 0;
4204 		}
4205 		asoc->total_flight = 0;
4206 		asoc->total_flight_count = 0;
4207 	}
4208 
4209 	/* RWND update */
4210 	asoc->peers_rwnd = sctp_sbspace_sub(rwnd,
4211 	    (uint32_t)(asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
4212 	if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4213 		/* SWS sender side engages */
4214 		asoc->peers_rwnd = 0;
4215 	}
4216 	if (asoc->peers_rwnd > old_rwnd) {
4217 		win_probe_recovery = 1;
4218 	}
4219 	/* Now assure a timer where data is queued at */
4220 again:
4221 	j = 0;
4222 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4223 		if (win_probe_recovery && (net->window_probe)) {
4224 			win_probe_recovered = 1;
4225 			/*
4226 			 * Find first chunk that was used with window probe
4227 			 * and clear the sent
4228 			 */
4229 			/* sa_ignore FREED_MEMORY */
4230 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4231 				if (tp1->window_probe) {
4232 					/* move back to data send queue */
4233 					sctp_window_probe_recovery(stcb, asoc, tp1);
4234 					break;
4235 				}
4236 			}
4237 		}
4238 		if (net->flight_size) {
4239 			j++;
4240 			sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net);
4241 			if (net->window_probe) {
4242 				net->window_probe = 0;
4243 			}
4244 		} else {
4245 			if (net->window_probe) {
4246 				/*
4247 				 * In window probes we must assure a timer
4248 				 * is still running there
4249 				 */
4250 				net->window_probe = 0;
4251 				if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4252 					sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, net);
4253 				}
4254 			} else if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
4255 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4256 				    stcb, net,
4257 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_27);
4258 			}
4259 		}
4260 	}
4261 	if ((j == 0) &&
4262 	    (!TAILQ_EMPTY(&asoc->sent_queue)) &&
4263 	    (asoc->sent_queue_retran_cnt == 0) &&
4264 	    (win_probe_recovered == 0) &&
4265 	    (done_once == 0)) {
4266 		/*
4267 		 * huh, this should not happen unless all packets are
4268 		 * PR-SCTP and marked to skip of course.
4269 		 */
4270 		if (sctp_fs_audit(asoc)) {
4271 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4272 				net->flight_size = 0;
4273 			}
4274 			asoc->total_flight = 0;
4275 			asoc->total_flight_count = 0;
4276 			asoc->sent_queue_retran_cnt = 0;
4277 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4278 				if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4279 					sctp_flight_size_increase(tp1);
4280 					sctp_total_flight_increase(stcb, tp1);
4281 				} else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4282 					sctp_ucount_incr(asoc->sent_queue_retran_cnt);
4283 				}
4284 			}
4285 		}
4286 		done_once = 1;
4287 		goto again;
4288 	}
4289 	/**********************************/
4290 	/* Now what about shutdown issues */
4291 	/**********************************/
4292 	if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
4293 		/* nothing left on sendqueue.. consider done */
4294 		/* clean up */
4295 		if ((asoc->stream_queue_cnt == 1) &&
4296 		    ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4297 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4298 		    ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc))) {
4299 			SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT);
4300 		}
4301 		if (((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4302 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4303 		    (asoc->stream_queue_cnt == 1) &&
4304 		    (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
4305 			struct mbuf *op_err;
4306 
4307 			*abort_now = 1;
4308 			/* XXX */
4309 			op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
4310 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_28;
4311 			sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4312 			return;
4313 		}
4314 		if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
4315 		    (asoc->stream_queue_cnt == 0)) {
4316 			struct sctp_nets *netp;
4317 
4318 			if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4319 			    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4320 				SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4321 			}
4322 			SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT);
4323 			sctp_stop_timers_for_shutdown(stcb);
4324 			if (asoc->alternate) {
4325 				netp = asoc->alternate;
4326 			} else {
4327 				netp = asoc->primary_destination;
4328 			}
4329 			sctp_send_shutdown(stcb, netp);
4330 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
4331 			    stcb->sctp_ep, stcb, netp);
4332 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
4333 			    stcb->sctp_ep, stcb, NULL);
4334 		} else if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
4335 		    (asoc->stream_queue_cnt == 0)) {
4336 			struct sctp_nets *netp;
4337 
4338 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4339 			SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_ACK_SENT);
4340 			sctp_stop_timers_for_shutdown(stcb);
4341 			if (asoc->alternate) {
4342 				netp = asoc->alternate;
4343 			} else {
4344 				netp = asoc->primary_destination;
4345 			}
4346 			sctp_send_shutdown_ack(stcb, netp);
4347 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
4348 			    stcb->sctp_ep, stcb, netp);
4349 		}
4350 	}
4351 	/*********************************************/
4352 	/* Here we perform PR-SCTP procedures        */
4353 	/* (section 4.2)                             */
4354 	/*********************************************/
4355 	/* C1. update advancedPeerAckPoint */
4356 	if (SCTP_TSN_GT(cumack, asoc->advanced_peer_ack_point)) {
4357 		asoc->advanced_peer_ack_point = cumack;
4358 	}
4359 	/* PR-Sctp issues need to be addressed too */
4360 	if ((asoc->prsctp_supported) && (asoc->pr_sctp_cnt > 0)) {
4361 		struct sctp_tmit_chunk *lchk;
4362 		uint32_t old_adv_peer_ack_point;
4363 
4364 		old_adv_peer_ack_point = asoc->advanced_peer_ack_point;
4365 		lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
4366 		/* C3. See if we need to send a Fwd-TSN */
4367 		if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, cumack)) {
4368 			/*
4369 			 * ISSUE with ECN, see FWD-TSN processing.
4370 			 */
4371 			if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, old_adv_peer_ack_point)) {
4372 				send_forward_tsn(stcb, asoc);
4373 			} else if (lchk) {
4374 				/* try to FR fwd-tsn's that get lost too */
4375 				if (lchk->rec.data.fwd_tsn_cnt >= 3) {
4376 					send_forward_tsn(stcb, asoc);
4377 				}
4378 			}
4379 		}
4380 		for (; lchk != NULL; lchk = TAILQ_NEXT(lchk, sctp_next)) {
4381 			if (lchk->whoTo != NULL) {
4382 				break;
4383 			}
4384 		}
4385 		if (lchk != NULL) {
4386 			/* Assure a timer is up */
4387 			sctp_timer_start(SCTP_TIMER_TYPE_SEND,
4388 			    stcb->sctp_ep, stcb, lchk->whoTo);
4389 		}
4390 	}
4391 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_RWND_LOGGING_ENABLE) {
4392 		sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
4393 		    rwnd,
4394 		    stcb->asoc.peers_rwnd,
4395 		    stcb->asoc.total_flight,
4396 		    stcb->asoc.total_output_queue_size);
4397 	}
4398 }
4399 
4400 void
4401 sctp_handle_sack(struct mbuf *m, int offset_seg, int offset_dup,
4402     struct sctp_tcb *stcb,
4403     uint16_t num_seg, uint16_t num_nr_seg, uint16_t num_dup,
4404     int *abort_now, uint8_t flags,
4405     uint32_t cum_ack, uint32_t rwnd, int ecne_seen)
4406 {
4407 	struct sctp_association *asoc;
4408 	struct sctp_tmit_chunk *tp1, *tp2;
4409 	uint32_t last_tsn, biggest_tsn_acked, biggest_tsn_newly_acked, this_sack_lowest_newack;
4410 	uint16_t wake_him = 0;
4411 	uint32_t send_s = 0;
4412 	long j;
4413 	int accum_moved = 0;
4414 	int will_exit_fast_recovery = 0;
4415 	uint32_t a_rwnd, old_rwnd;
4416 	int win_probe_recovery = 0;
4417 	int win_probe_recovered = 0;
4418 	struct sctp_nets *net = NULL;
4419 	int done_once;
4420 	int rto_ok = 1;
4421 	uint8_t reneged_all = 0;
4422 	uint8_t cmt_dac_flag;
4423 
4424 	/*
4425 	 * we take any chance we can to service our queues since we cannot
4426 	 * get awoken when the socket is read from :<
4427 	 */
4428 	/*
4429 	 * Now perform the actual SACK handling: 1) Verify that it is not an
4430 	 * old sack, if so discard. 2) If there is nothing left in the send
4431 	 * queue (cum-ack is equal to last acked) then you have a duplicate
4432 	 * too, update any rwnd change and verify no timers are running.
4433 	 * then return. 3) Process any new consequtive data i.e. cum-ack
4434 	 * moved process these first and note that it moved. 4) Process any
4435 	 * sack blocks. 5) Drop any acked from the queue. 6) Check for any
4436 	 * revoked blocks and mark. 7) Update the cwnd. 8) Nothing left,
4437 	 * sync up flightsizes and things, stop all timers and also check
4438 	 * for shutdown_pending state. If so then go ahead and send off the
4439 	 * shutdown. If in shutdown recv, send off the shutdown-ack and
4440 	 * start that timer, Ret. 9) Strike any non-acked things and do FR
4441 	 * procedure if needed being sure to set the FR flag. 10) Do pr-sctp
4442 	 * procedures. 11) Apply any FR penalties. 12) Assure we will SACK
4443 	 * if in shutdown_recv state.
4444 	 */
4445 	SCTP_TCB_LOCK_ASSERT(stcb);
4446 	/* CMT DAC algo */
4447 	this_sack_lowest_newack = 0;
4448 	SCTP_STAT_INCR(sctps_slowpath_sack);
4449 	last_tsn = cum_ack;
4450 	cmt_dac_flag = flags & SCTP_SACK_CMT_DAC;
4451 #ifdef SCTP_ASOCLOG_OF_TSNS
4452 	stcb->asoc.cumack_log[stcb->asoc.cumack_log_at] = cum_ack;
4453 	stcb->asoc.cumack_log_at++;
4454 	if (stcb->asoc.cumack_log_at > SCTP_TSN_LOG_SIZE) {
4455 		stcb->asoc.cumack_log_at = 0;
4456 	}
4457 #endif
4458 	a_rwnd = rwnd;
4459 
4460 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_SACK_ARRIVALS_ENABLE) {
4461 		sctp_misc_ints(SCTP_SACK_LOG_NORMAL, cum_ack,
4462 		    rwnd, stcb->asoc.last_acked_seq, stcb->asoc.peers_rwnd);
4463 	}
4464 
4465 	old_rwnd = stcb->asoc.peers_rwnd;
4466 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_THRESHOLD_LOGGING) {
4467 		sctp_misc_ints(SCTP_THRESHOLD_CLEAR,
4468 		    stcb->asoc.overall_error_count,
4469 		    0,
4470 		    SCTP_FROM_SCTP_INDATA,
4471 		    __LINE__);
4472 	}
4473 	stcb->asoc.overall_error_count = 0;
4474 	asoc = &stcb->asoc;
4475 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4476 		sctp_log_sack(asoc->last_acked_seq,
4477 		    cum_ack,
4478 		    0,
4479 		    num_seg,
4480 		    num_dup,
4481 		    SCTP_LOG_NEW_SACK);
4482 	}
4483 	if ((num_dup) && (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FR_LOGGING_ENABLE)) {
4484 		uint16_t i;
4485 		uint32_t *dupdata, dblock;
4486 
4487 		for (i = 0; i < num_dup; i++) {
4488 			dupdata = (uint32_t *)sctp_m_getptr(m, offset_dup + i * sizeof(uint32_t),
4489 			    sizeof(uint32_t), (uint8_t *)&dblock);
4490 			if (dupdata == NULL) {
4491 				break;
4492 			}
4493 			sctp_log_fr(*dupdata, 0, 0, SCTP_FR_DUPED);
4494 		}
4495 	}
4496 	/* reality check */
4497 	if (!TAILQ_EMPTY(&asoc->sent_queue)) {
4498 		tp1 = TAILQ_LAST(&asoc->sent_queue,
4499 		    sctpchunk_listhead);
4500 		send_s = tp1->rec.data.tsn + 1;
4501 	} else {
4502 		tp1 = NULL;
4503 		send_s = asoc->sending_seq;
4504 	}
4505 	if (SCTP_TSN_GE(cum_ack, send_s)) {
4506 		struct mbuf *op_err;
4507 		char msg[SCTP_DIAG_INFO_LEN];
4508 
4509 		/*
4510 		 * no way, we have not even sent this TSN out yet. Peer is
4511 		 * hopelessly messed up with us.
4512 		 */
4513 		SCTP_PRINTF("NEW cum_ack:%x send_s:%x is smaller or equal\n",
4514 		    cum_ack, send_s);
4515 		if (tp1) {
4516 			SCTP_PRINTF("Got send_s from tsn:%x + 1 of tp1: %p\n",
4517 			    tp1->rec.data.tsn, (void *)tp1);
4518 		}
4519 hopeless_peer:
4520 		*abort_now = 1;
4521 		/* XXX */
4522 		SCTP_SNPRINTF(msg, sizeof(msg),
4523 		    "Cum ack %8.8x greater or equal than TSN %8.8x",
4524 		    cum_ack, send_s);
4525 		op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
4526 		stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_29;
4527 		sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4528 		return;
4529 	}
4530 	/**********************/
4531 	/* 1) check the range */
4532 	/**********************/
4533 	if (SCTP_TSN_GT(asoc->last_acked_seq, last_tsn)) {
4534 		/* acking something behind */
4535 		return;
4536 	}
4537 
4538 	/* update the Rwnd of the peer */
4539 	if (TAILQ_EMPTY(&asoc->sent_queue) &&
4540 	    TAILQ_EMPTY(&asoc->send_queue) &&
4541 	    (asoc->stream_queue_cnt == 0)) {
4542 		/* nothing left on send/sent and strmq */
4543 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
4544 			sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4545 			    asoc->peers_rwnd, 0, 0, a_rwnd);
4546 		}
4547 		asoc->peers_rwnd = a_rwnd;
4548 		if (asoc->sent_queue_retran_cnt) {
4549 			asoc->sent_queue_retran_cnt = 0;
4550 		}
4551 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4552 			/* SWS sender side engages */
4553 			asoc->peers_rwnd = 0;
4554 		}
4555 		/* stop any timers */
4556 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4557 			sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4558 			    stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_30);
4559 			net->partial_bytes_acked = 0;
4560 			net->flight_size = 0;
4561 		}
4562 		asoc->total_flight = 0;
4563 		asoc->total_flight_count = 0;
4564 		return;
4565 	}
4566 	/*
4567 	 * We init netAckSz and netAckSz2 to 0. These are used to track 2
4568 	 * things. The total byte count acked is tracked in netAckSz AND
4569 	 * netAck2 is used to track the total bytes acked that are un-
4570 	 * amibguious and were never retransmitted. We track these on a per
4571 	 * destination address basis.
4572 	 */
4573 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4574 		if (SCTP_TSN_GT(cum_ack, net->cwr_window_tsn)) {
4575 			/* Drag along the window_tsn for cwr's */
4576 			net->cwr_window_tsn = cum_ack;
4577 		}
4578 		net->prev_cwnd = net->cwnd;
4579 		net->net_ack = 0;
4580 		net->net_ack2 = 0;
4581 
4582 		/*
4583 		 * CMT: Reset CUC and Fast recovery algo variables before
4584 		 * SACK processing
4585 		 */
4586 		net->new_pseudo_cumack = 0;
4587 		net->will_exit_fast_recovery = 0;
4588 		if (stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) {
4589 			(*stcb->asoc.cc_functions.sctp_cwnd_prepare_net_for_sack) (stcb, net);
4590 		}
4591 
4592 		/*
4593 		 * CMT: SFR algo (and HTNA) - this_sack_highest_newack has
4594 		 * to be greater than the cumack. Also reset saw_newack to 0
4595 		 * for all dests.
4596 		 */
4597 		net->saw_newack = 0;
4598 		net->this_sack_highest_newack = last_tsn;
4599 	}
4600 	/* process the new consecutive TSN first */
4601 	TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4602 		if (SCTP_TSN_GE(last_tsn, tp1->rec.data.tsn)) {
4603 			if (tp1->sent != SCTP_DATAGRAM_UNSENT) {
4604 				accum_moved = 1;
4605 				if (tp1->sent < SCTP_DATAGRAM_ACKED) {
4606 					/*
4607 					 * If it is less than ACKED, it is
4608 					 * now no-longer in flight. Higher
4609 					 * values may occur during marking
4610 					 */
4611 					if ((tp1->whoTo->dest_state &
4612 					    SCTP_ADDR_UNCONFIRMED) &&
4613 					    (tp1->snd_count < 2)) {
4614 						/*
4615 						 * If there was no retran
4616 						 * and the address is
4617 						 * un-confirmed and we sent
4618 						 * there and are now
4619 						 * sacked.. its confirmed,
4620 						 * mark it so.
4621 						 */
4622 						tp1->whoTo->dest_state &=
4623 						    ~SCTP_ADDR_UNCONFIRMED;
4624 					}
4625 					if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4626 						if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
4627 							sctp_misc_ints(SCTP_FLIGHT_LOG_DOWN_CA,
4628 							    tp1->whoTo->flight_size,
4629 							    tp1->book_size,
4630 							    (uint32_t)(uintptr_t)tp1->whoTo,
4631 							    tp1->rec.data.tsn);
4632 						}
4633 						sctp_flight_size_decrease(tp1);
4634 						sctp_total_flight_decrease(stcb, tp1);
4635 						if (stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) {
4636 							(*stcb->asoc.cc_functions.sctp_cwnd_update_tsn_acknowledged) (tp1->whoTo,
4637 							    tp1);
4638 						}
4639 					}
4640 					tp1->whoTo->net_ack += tp1->send_size;
4641 
4642 					/* CMT SFR and DAC algos */
4643 					this_sack_lowest_newack = tp1->rec.data.tsn;
4644 					tp1->whoTo->saw_newack = 1;
4645 
4646 					if (tp1->snd_count < 2) {
4647 						/*
4648 						 * True non-retransmitted
4649 						 * chunk
4650 						 */
4651 						tp1->whoTo->net_ack2 +=
4652 						    tp1->send_size;
4653 
4654 						/* update RTO too? */
4655 						if (tp1->do_rtt) {
4656 							if (rto_ok &&
4657 							    sctp_calculate_rto(stcb,
4658 							    &stcb->asoc,
4659 							    tp1->whoTo,
4660 							    &tp1->sent_rcv_time,
4661 							    SCTP_RTT_FROM_DATA)) {
4662 								rto_ok = 0;
4663 							}
4664 							if (tp1->whoTo->rto_needed == 0) {
4665 								tp1->whoTo->rto_needed = 1;
4666 							}
4667 							tp1->do_rtt = 0;
4668 						}
4669 					}
4670 					/*
4671 					 * CMT: CUCv2 algorithm. From the
4672 					 * cumack'd TSNs, for each TSN being
4673 					 * acked for the first time, set the
4674 					 * following variables for the
4675 					 * corresp destination.
4676 					 * new_pseudo_cumack will trigger a
4677 					 * cwnd update.
4678 					 * find_(rtx_)pseudo_cumack will
4679 					 * trigger search for the next
4680 					 * expected (rtx-)pseudo-cumack.
4681 					 */
4682 					tp1->whoTo->new_pseudo_cumack = 1;
4683 					tp1->whoTo->find_pseudo_cumack = 1;
4684 					tp1->whoTo->find_rtx_pseudo_cumack = 1;
4685 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4686 						sctp_log_sack(asoc->last_acked_seq,
4687 						    cum_ack,
4688 						    tp1->rec.data.tsn,
4689 						    0,
4690 						    0,
4691 						    SCTP_LOG_TSN_ACKED);
4692 					}
4693 					if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_CWND_LOGGING_ENABLE) {
4694 						sctp_log_cwnd(stcb, tp1->whoTo, tp1->rec.data.tsn, SCTP_CWND_LOG_FROM_SACK);
4695 					}
4696 				}
4697 				if (tp1->sent == SCTP_DATAGRAM_RESEND) {
4698 					sctp_ucount_decr(asoc->sent_queue_retran_cnt);
4699 #ifdef SCTP_AUDITING_ENABLED
4700 					sctp_audit_log(0xB3,
4701 					    (asoc->sent_queue_retran_cnt & 0x000000ff));
4702 #endif
4703 				}
4704 				if (tp1->rec.data.chunk_was_revoked) {
4705 					/* deflate the cwnd */
4706 					tp1->whoTo->cwnd -= tp1->book_size;
4707 					tp1->rec.data.chunk_was_revoked = 0;
4708 				}
4709 				if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
4710 					tp1->sent = SCTP_DATAGRAM_ACKED;
4711 				}
4712 			}
4713 		} else {
4714 			break;
4715 		}
4716 	}
4717 	biggest_tsn_newly_acked = biggest_tsn_acked = last_tsn;
4718 	/* always set this up to cum-ack */
4719 	asoc->this_sack_highest_gap = last_tsn;
4720 
4721 	if ((num_seg > 0) || (num_nr_seg > 0)) {
4722 		/*
4723 		 * thisSackHighestGap will increase while handling NEW
4724 		 * segments this_sack_highest_newack will increase while
4725 		 * handling NEWLY ACKED chunks. this_sack_lowest_newack is
4726 		 * used for CMT DAC algo. saw_newack will also change.
4727 		 */
4728 		if (sctp_handle_segments(m, &offset_seg, stcb, asoc, last_tsn, &biggest_tsn_acked,
4729 		    &biggest_tsn_newly_acked, &this_sack_lowest_newack,
4730 		    num_seg, num_nr_seg, &rto_ok)) {
4731 			wake_him++;
4732 		}
4733 		/*
4734 		 * validate the biggest_tsn_acked in the gap acks if strict
4735 		 * adherence is wanted.
4736 		 */
4737 		if (SCTP_TSN_GE(biggest_tsn_acked, send_s)) {
4738 			/*
4739 			 * peer is either confused or we are under attack.
4740 			 * We must abort.
4741 			 */
4742 			SCTP_PRINTF("Hopeless peer! biggest_tsn_acked:%x largest seq:%x\n",
4743 			    biggest_tsn_acked, send_s);
4744 			goto hopeless_peer;
4745 		}
4746 	}
4747 	/*******************************************/
4748 	/* cancel ALL T3-send timer if accum moved */
4749 	/*******************************************/
4750 	if (asoc->sctp_cmt_on_off > 0) {
4751 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4752 			if (net->new_pseudo_cumack)
4753 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4754 				    stcb, net,
4755 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_31);
4756 		}
4757 	} else {
4758 		if (accum_moved) {
4759 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4760 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4761 				    stcb, net, SCTP_FROM_SCTP_INDATA + SCTP_LOC_32);
4762 			}
4763 		}
4764 	}
4765 	/********************************************/
4766 	/* drop the acked chunks from the sentqueue */
4767 	/********************************************/
4768 	asoc->last_acked_seq = cum_ack;
4769 
4770 	TAILQ_FOREACH_SAFE(tp1, &asoc->sent_queue, sctp_next, tp2) {
4771 		if (SCTP_TSN_GT(tp1->rec.data.tsn, cum_ack)) {
4772 			break;
4773 		}
4774 		if (tp1->sent != SCTP_DATAGRAM_NR_ACKED) {
4775 			if (asoc->strmout[tp1->rec.data.sid].chunks_on_queues > 0) {
4776 				asoc->strmout[tp1->rec.data.sid].chunks_on_queues--;
4777 #ifdef INVARIANTS
4778 			} else {
4779 				panic("No chunks on the queues for sid %u.", tp1->rec.data.sid);
4780 #endif
4781 			}
4782 		}
4783 		if ((asoc->strmout[tp1->rec.data.sid].chunks_on_queues == 0) &&
4784 		    (asoc->strmout[tp1->rec.data.sid].state == SCTP_STREAM_RESET_PENDING) &&
4785 		    TAILQ_EMPTY(&asoc->strmout[tp1->rec.data.sid].outqueue)) {
4786 			asoc->trigger_reset = 1;
4787 		}
4788 		TAILQ_REMOVE(&asoc->sent_queue, tp1, sctp_next);
4789 		if (PR_SCTP_ENABLED(tp1->flags)) {
4790 			if (asoc->pr_sctp_cnt != 0)
4791 				asoc->pr_sctp_cnt--;
4792 		}
4793 		asoc->sent_queue_cnt--;
4794 		if (tp1->data) {
4795 			/* sa_ignore NO_NULL_CHK */
4796 			sctp_free_bufspace(stcb, asoc, tp1, 1);
4797 			sctp_m_freem(tp1->data);
4798 			tp1->data = NULL;
4799 			if (asoc->prsctp_supported && PR_SCTP_BUF_ENABLED(tp1->flags)) {
4800 				asoc->sent_queue_cnt_removeable--;
4801 			}
4802 		}
4803 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_LOGGING_ENABLE) {
4804 			sctp_log_sack(asoc->last_acked_seq,
4805 			    cum_ack,
4806 			    tp1->rec.data.tsn,
4807 			    0,
4808 			    0,
4809 			    SCTP_LOG_FREE_SENT);
4810 		}
4811 		sctp_free_a_chunk(stcb, tp1, SCTP_SO_NOT_LOCKED);
4812 		wake_him++;
4813 	}
4814 	if (TAILQ_EMPTY(&asoc->sent_queue) && (asoc->total_flight > 0)) {
4815 #ifdef INVARIANTS
4816 		panic("Warning flight size is positive and should be 0");
4817 #else
4818 		SCTP_PRINTF("Warning flight size incorrect should be 0 is %d\n",
4819 		    asoc->total_flight);
4820 #endif
4821 		asoc->total_flight = 0;
4822 	}
4823 
4824 	/* sa_ignore NO_NULL_CHK */
4825 	if ((wake_him) && (stcb->sctp_socket)) {
4826 		SOCKBUF_LOCK(&stcb->sctp_socket->so_snd);
4827 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4828 			sctp_wakeup_log(stcb, wake_him, SCTP_WAKESND_FROM_SACK);
4829 		}
4830 		sctp_sowwakeup_locked(stcb->sctp_ep, stcb->sctp_socket);
4831 	} else {
4832 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_WAKE_LOGGING_ENABLE) {
4833 			sctp_wakeup_log(stcb, wake_him, SCTP_NOWAKE_FROM_SACK);
4834 		}
4835 	}
4836 
4837 	if (asoc->fast_retran_loss_recovery && accum_moved) {
4838 		if (SCTP_TSN_GE(asoc->last_acked_seq, asoc->fast_recovery_tsn)) {
4839 			/* Setup so we will exit RFC2582 fast recovery */
4840 			will_exit_fast_recovery = 1;
4841 		}
4842 	}
4843 	/*
4844 	 * Check for revoked fragments:
4845 	 *
4846 	 * if Previous sack - Had no frags then we can't have any revoked if
4847 	 * Previous sack - Had frag's then - If we now have frags aka
4848 	 * num_seg > 0 call sctp_check_for_revoked() to tell if peer revoked
4849 	 * some of them. else - The peer revoked all ACKED fragments, since
4850 	 * we had some before and now we have NONE.
4851 	 */
4852 
4853 	if (num_seg) {
4854 		sctp_check_for_revoked(stcb, asoc, cum_ack, biggest_tsn_acked);
4855 		asoc->saw_sack_with_frags = 1;
4856 	} else if (asoc->saw_sack_with_frags) {
4857 		int cnt_revoked = 0;
4858 
4859 		/* Peer revoked all dg's marked or acked */
4860 		TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
4861 			if (tp1->sent == SCTP_DATAGRAM_ACKED) {
4862 				tp1->sent = SCTP_DATAGRAM_SENT;
4863 				if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_FLIGHT_LOGGING_ENABLE) {
4864 					sctp_misc_ints(SCTP_FLIGHT_LOG_UP_REVOKE,
4865 					    tp1->whoTo->flight_size,
4866 					    tp1->book_size,
4867 					    (uint32_t)(uintptr_t)tp1->whoTo,
4868 					    tp1->rec.data.tsn);
4869 				}
4870 				sctp_flight_size_increase(tp1);
4871 				sctp_total_flight_increase(stcb, tp1);
4872 				tp1->rec.data.chunk_was_revoked = 1;
4873 				/*
4874 				 * To ensure that this increase in
4875 				 * flightsize, which is artificial, does not
4876 				 * throttle the sender, we also increase the
4877 				 * cwnd artificially.
4878 				 */
4879 				tp1->whoTo->cwnd += tp1->book_size;
4880 				cnt_revoked++;
4881 			}
4882 		}
4883 		if (cnt_revoked) {
4884 			reneged_all = 1;
4885 		}
4886 		asoc->saw_sack_with_frags = 0;
4887 	}
4888 	if (num_nr_seg > 0)
4889 		asoc->saw_sack_with_nr_frags = 1;
4890 	else
4891 		asoc->saw_sack_with_nr_frags = 0;
4892 
4893 	/* JRS - Use the congestion control given in the CC module */
4894 	if (ecne_seen == 0) {
4895 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4896 			if (net->net_ack2 > 0) {
4897 				/*
4898 				 * Karn's rule applies to clearing error
4899 				 * count, this is optional.
4900 				 */
4901 				net->error_count = 0;
4902 				if (!(net->dest_state & SCTP_ADDR_REACHABLE)) {
4903 					/* addr came good */
4904 					net->dest_state |= SCTP_ADDR_REACHABLE;
4905 					sctp_ulp_notify(SCTP_NOTIFY_INTERFACE_UP, stcb,
4906 					    0, (void *)net, SCTP_SO_NOT_LOCKED);
4907 				}
4908 
4909 				if (net == stcb->asoc.primary_destination) {
4910 					if (stcb->asoc.alternate) {
4911 						/*
4912 						 * release the alternate,
4913 						 * primary is good
4914 						 */
4915 						sctp_free_remote_addr(stcb->asoc.alternate);
4916 						stcb->asoc.alternate = NULL;
4917 					}
4918 				}
4919 
4920 				if (net->dest_state & SCTP_ADDR_PF) {
4921 					net->dest_state &= ~SCTP_ADDR_PF;
4922 					sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT,
4923 					    stcb->sctp_ep, stcb, net,
4924 					    SCTP_FROM_SCTP_INDATA + SCTP_LOC_33);
4925 					sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep, stcb, net);
4926 					asoc->cc_functions.sctp_cwnd_update_exit_pf(stcb, net);
4927 					/* Done with this net */
4928 					net->net_ack = 0;
4929 				}
4930 				/* restore any doubled timers */
4931 				net->RTO = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
4932 				if (net->RTO < stcb->asoc.minrto) {
4933 					net->RTO = stcb->asoc.minrto;
4934 				}
4935 				if (net->RTO > stcb->asoc.maxrto) {
4936 					net->RTO = stcb->asoc.maxrto;
4937 				}
4938 			}
4939 		}
4940 		asoc->cc_functions.sctp_cwnd_update_after_sack(stcb, asoc, accum_moved, reneged_all, will_exit_fast_recovery);
4941 	}
4942 
4943 	if (TAILQ_EMPTY(&asoc->sent_queue)) {
4944 		/* nothing left in-flight */
4945 		TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
4946 			/* stop all timers */
4947 			sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
4948 			    stcb, net,
4949 			    SCTP_FROM_SCTP_INDATA + SCTP_LOC_34);
4950 			net->flight_size = 0;
4951 			net->partial_bytes_acked = 0;
4952 		}
4953 		asoc->total_flight = 0;
4954 		asoc->total_flight_count = 0;
4955 	}
4956 
4957 	/**********************************/
4958 	/* Now what about shutdown issues */
4959 	/**********************************/
4960 	if (TAILQ_EMPTY(&asoc->send_queue) && TAILQ_EMPTY(&asoc->sent_queue)) {
4961 		/* nothing left on sendqueue.. consider done */
4962 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
4963 			sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
4964 			    asoc->peers_rwnd, 0, 0, a_rwnd);
4965 		}
4966 		asoc->peers_rwnd = a_rwnd;
4967 		if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
4968 			/* SWS sender side engages */
4969 			asoc->peers_rwnd = 0;
4970 		}
4971 		/* clean up */
4972 		if ((asoc->stream_queue_cnt == 1) &&
4973 		    ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4974 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4975 		    ((*asoc->ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, asoc))) {
4976 			SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT);
4977 		}
4978 		if (((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) ||
4979 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) &&
4980 		    (asoc->stream_queue_cnt == 1) &&
4981 		    (asoc->state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
4982 			struct mbuf *op_err;
4983 
4984 			*abort_now = 1;
4985 			/* XXX */
4986 			op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
4987 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_35;
4988 			sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
4989 			return;
4990 		}
4991 		if ((asoc->state & SCTP_STATE_SHUTDOWN_PENDING) &&
4992 		    (asoc->stream_queue_cnt == 0)) {
4993 			struct sctp_nets *netp;
4994 
4995 			if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4996 			    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4997 				SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4998 			}
4999 			SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT);
5000 			sctp_stop_timers_for_shutdown(stcb);
5001 			if (asoc->alternate) {
5002 				netp = asoc->alternate;
5003 			} else {
5004 				netp = asoc->primary_destination;
5005 			}
5006 			sctp_send_shutdown(stcb, netp);
5007 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
5008 			    stcb->sctp_ep, stcb, netp);
5009 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
5010 			    stcb->sctp_ep, stcb, NULL);
5011 			return;
5012 		} else if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED) &&
5013 		    (asoc->stream_queue_cnt == 0)) {
5014 			struct sctp_nets *netp;
5015 
5016 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
5017 			SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_ACK_SENT);
5018 			sctp_stop_timers_for_shutdown(stcb);
5019 			if (asoc->alternate) {
5020 				netp = asoc->alternate;
5021 			} else {
5022 				netp = asoc->primary_destination;
5023 			}
5024 			sctp_send_shutdown_ack(stcb, netp);
5025 			sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNACK,
5026 			    stcb->sctp_ep, stcb, netp);
5027 			return;
5028 		}
5029 	}
5030 	/*
5031 	 * Now here we are going to recycle net_ack for a different use...
5032 	 * HEADS UP.
5033 	 */
5034 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5035 		net->net_ack = 0;
5036 	}
5037 
5038 	/*
5039 	 * CMT DAC algorithm: If SACK DAC flag was 0, then no extra marking
5040 	 * to be done. Setting this_sack_lowest_newack to the cum_ack will
5041 	 * automatically ensure that.
5042 	 */
5043 	if ((asoc->sctp_cmt_on_off > 0) &&
5044 	    SCTP_BASE_SYSCTL(sctp_cmt_use_dac) &&
5045 	    (cmt_dac_flag == 0)) {
5046 		this_sack_lowest_newack = cum_ack;
5047 	}
5048 	if ((num_seg > 0) || (num_nr_seg > 0)) {
5049 		sctp_strike_gap_ack_chunks(stcb, asoc, biggest_tsn_acked,
5050 		    biggest_tsn_newly_acked, this_sack_lowest_newack, accum_moved);
5051 	}
5052 	/* JRS - Use the congestion control given in the CC module */
5053 	asoc->cc_functions.sctp_cwnd_update_after_fr(stcb, asoc);
5054 
5055 	/* Now are we exiting loss recovery ? */
5056 	if (will_exit_fast_recovery) {
5057 		/* Ok, we must exit fast recovery */
5058 		asoc->fast_retran_loss_recovery = 0;
5059 	}
5060 	if ((asoc->sat_t3_loss_recovery) &&
5061 	    SCTP_TSN_GE(asoc->last_acked_seq, asoc->sat_t3_recovery_tsn)) {
5062 		/* end satellite t3 loss recovery */
5063 		asoc->sat_t3_loss_recovery = 0;
5064 	}
5065 	/*
5066 	 * CMT Fast recovery
5067 	 */
5068 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5069 		if (net->will_exit_fast_recovery) {
5070 			/* Ok, we must exit fast recovery */
5071 			net->fast_retran_loss_recovery = 0;
5072 		}
5073 	}
5074 
5075 	/* Adjust and set the new rwnd value */
5076 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_RWND_ENABLE) {
5077 		sctp_log_rwnd_set(SCTP_SET_PEER_RWND_VIA_SACK,
5078 		    asoc->peers_rwnd, asoc->total_flight, (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh)), a_rwnd);
5079 	}
5080 	asoc->peers_rwnd = sctp_sbspace_sub(a_rwnd,
5081 	    (uint32_t)(asoc->total_flight + (asoc->total_flight_count * SCTP_BASE_SYSCTL(sctp_peer_chunk_oh))));
5082 	if (asoc->peers_rwnd < stcb->sctp_ep->sctp_ep.sctp_sws_sender) {
5083 		/* SWS sender side engages */
5084 		asoc->peers_rwnd = 0;
5085 	}
5086 	if (asoc->peers_rwnd > old_rwnd) {
5087 		win_probe_recovery = 1;
5088 	}
5089 
5090 	/*
5091 	 * Now we must setup so we have a timer up for anyone with
5092 	 * outstanding data.
5093 	 */
5094 	done_once = 0;
5095 again:
5096 	j = 0;
5097 	TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5098 		if (win_probe_recovery && (net->window_probe)) {
5099 			win_probe_recovered = 1;
5100 			/*-
5101 			 * Find first chunk that was used with
5102 			 * window probe and clear the event. Put
5103 			 * it back into the send queue as if has
5104 			 * not been sent.
5105 			 */
5106 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
5107 				if (tp1->window_probe) {
5108 					sctp_window_probe_recovery(stcb, asoc, tp1);
5109 					break;
5110 				}
5111 			}
5112 		}
5113 		if (net->flight_size) {
5114 			j++;
5115 			if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
5116 				sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5117 				    stcb->sctp_ep, stcb, net);
5118 			}
5119 			if (net->window_probe) {
5120 				net->window_probe = 0;
5121 			}
5122 		} else {
5123 			if (net->window_probe) {
5124 				/*
5125 				 * In window probes we must assure a timer
5126 				 * is still running there
5127 				 */
5128 				if (!SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
5129 					sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5130 					    stcb->sctp_ep, stcb, net);
5131 				}
5132 			} else if (SCTP_OS_TIMER_PENDING(&net->rxt_timer.timer)) {
5133 				sctp_timer_stop(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep,
5134 				    stcb, net,
5135 				    SCTP_FROM_SCTP_INDATA + SCTP_LOC_36);
5136 			}
5137 		}
5138 	}
5139 	if ((j == 0) &&
5140 	    (!TAILQ_EMPTY(&asoc->sent_queue)) &&
5141 	    (asoc->sent_queue_retran_cnt == 0) &&
5142 	    (win_probe_recovered == 0) &&
5143 	    (done_once == 0)) {
5144 		/*
5145 		 * huh, this should not happen unless all packets are
5146 		 * PR-SCTP and marked to skip of course.
5147 		 */
5148 		if (sctp_fs_audit(asoc)) {
5149 			TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5150 				net->flight_size = 0;
5151 			}
5152 			asoc->total_flight = 0;
5153 			asoc->total_flight_count = 0;
5154 			asoc->sent_queue_retran_cnt = 0;
5155 			TAILQ_FOREACH(tp1, &asoc->sent_queue, sctp_next) {
5156 				if (tp1->sent < SCTP_DATAGRAM_RESEND) {
5157 					sctp_flight_size_increase(tp1);
5158 					sctp_total_flight_increase(stcb, tp1);
5159 				} else if (tp1->sent == SCTP_DATAGRAM_RESEND) {
5160 					sctp_ucount_incr(asoc->sent_queue_retran_cnt);
5161 				}
5162 			}
5163 		}
5164 		done_once = 1;
5165 		goto again;
5166 	}
5167 	/*********************************************/
5168 	/* Here we perform PR-SCTP procedures        */
5169 	/* (section 4.2)                             */
5170 	/*********************************************/
5171 	/* C1. update advancedPeerAckPoint */
5172 	if (SCTP_TSN_GT(cum_ack, asoc->advanced_peer_ack_point)) {
5173 		asoc->advanced_peer_ack_point = cum_ack;
5174 	}
5175 	/* C2. try to further move advancedPeerAckPoint ahead */
5176 	if ((asoc->prsctp_supported) && (asoc->pr_sctp_cnt > 0)) {
5177 		struct sctp_tmit_chunk *lchk;
5178 		uint32_t old_adv_peer_ack_point;
5179 
5180 		old_adv_peer_ack_point = asoc->advanced_peer_ack_point;
5181 		lchk = sctp_try_advance_peer_ack_point(stcb, asoc);
5182 		/* C3. See if we need to send a Fwd-TSN */
5183 		if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, cum_ack)) {
5184 			/*
5185 			 * ISSUE with ECN, see FWD-TSN processing.
5186 			 */
5187 			if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_LOG_TRY_ADVANCE) {
5188 				sctp_misc_ints(SCTP_FWD_TSN_CHECK,
5189 				    0xee, cum_ack, asoc->advanced_peer_ack_point,
5190 				    old_adv_peer_ack_point);
5191 			}
5192 			if (SCTP_TSN_GT(asoc->advanced_peer_ack_point, old_adv_peer_ack_point)) {
5193 				send_forward_tsn(stcb, asoc);
5194 			} else if (lchk) {
5195 				/* try to FR fwd-tsn's that get lost too */
5196 				if (lchk->rec.data.fwd_tsn_cnt >= 3) {
5197 					send_forward_tsn(stcb, asoc);
5198 				}
5199 			}
5200 		}
5201 		for (; lchk != NULL; lchk = TAILQ_NEXT(lchk, sctp_next)) {
5202 			if (lchk->whoTo != NULL) {
5203 				break;
5204 			}
5205 		}
5206 		if (lchk != NULL) {
5207 			/* Assure a timer is up */
5208 			sctp_timer_start(SCTP_TIMER_TYPE_SEND,
5209 			    stcb->sctp_ep, stcb, lchk->whoTo);
5210 		}
5211 	}
5212 	if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SACK_RWND_LOGGING_ENABLE) {
5213 		sctp_misc_ints(SCTP_SACK_RWND_UPDATE,
5214 		    a_rwnd,
5215 		    stcb->asoc.peers_rwnd,
5216 		    stcb->asoc.total_flight,
5217 		    stcb->asoc.total_output_queue_size);
5218 	}
5219 }
5220 
5221 void
5222 sctp_update_acked(struct sctp_tcb *stcb, struct sctp_shutdown_chunk *cp, int *abort_flag)
5223 {
5224 	/* Copy cum-ack */
5225 	uint32_t cum_ack, a_rwnd;
5226 
5227 	cum_ack = ntohl(cp->cumulative_tsn_ack);
5228 	/* Arrange so a_rwnd does NOT change */
5229 	a_rwnd = stcb->asoc.peers_rwnd + stcb->asoc.total_flight;
5230 
5231 	/* Now call the express sack handling */
5232 	sctp_express_handle_sack(stcb, cum_ack, a_rwnd, abort_flag, 0);
5233 }
5234 
5235 static void
5236 sctp_kick_prsctp_reorder_queue(struct sctp_tcb *stcb,
5237     struct sctp_stream_in *strmin)
5238 {
5239 	struct sctp_queued_to_read *control, *ncontrol;
5240 	struct sctp_association *asoc;
5241 	uint32_t mid;
5242 	int need_reasm_check = 0;
5243 
5244 	asoc = &stcb->asoc;
5245 	mid = strmin->last_mid_delivered;
5246 	/*
5247 	 * First deliver anything prior to and including the stream no that
5248 	 * came in.
5249 	 */
5250 	TAILQ_FOREACH_SAFE(control, &strmin->inqueue, next_instrm, ncontrol) {
5251 		if (SCTP_MID_GE(asoc->idata_supported, mid, control->mid)) {
5252 			/* this is deliverable now */
5253 			if (((control->sinfo_flags >> 8) & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
5254 				if (control->on_strm_q) {
5255 					if (control->on_strm_q == SCTP_ON_ORDERED) {
5256 						TAILQ_REMOVE(&strmin->inqueue, control, next_instrm);
5257 					} else if (control->on_strm_q == SCTP_ON_UNORDERED) {
5258 						TAILQ_REMOVE(&strmin->uno_inqueue, control, next_instrm);
5259 #ifdef INVARIANTS
5260 					} else {
5261 						panic("strmin: %p ctl: %p unknown %d",
5262 						    strmin, control, control->on_strm_q);
5263 #endif
5264 					}
5265 					control->on_strm_q = 0;
5266 				}
5267 				/* subtract pending on streams */
5268 				if (asoc->size_on_all_streams >= control->length) {
5269 					asoc->size_on_all_streams -= control->length;
5270 				} else {
5271 #ifdef INVARIANTS
5272 					panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
5273 #else
5274 					asoc->size_on_all_streams = 0;
5275 #endif
5276 				}
5277 				sctp_ucount_decr(asoc->cnt_on_all_streams);
5278 				/* deliver it to at least the delivery-q */
5279 				if (stcb->sctp_socket) {
5280 					sctp_mark_non_revokable(asoc, control->sinfo_tsn);
5281 					sctp_add_to_readq(stcb->sctp_ep, stcb,
5282 					    control,
5283 					    &stcb->sctp_socket->so_rcv,
5284 					    1, SCTP_READ_LOCK_HELD,
5285 					    SCTP_SO_NOT_LOCKED);
5286 				}
5287 			} else {
5288 				/* Its a fragmented message */
5289 				if (control->first_frag_seen) {
5290 					/*
5291 					 * Make it so this is next to
5292 					 * deliver, we restore later
5293 					 */
5294 					strmin->last_mid_delivered = control->mid - 1;
5295 					need_reasm_check = 1;
5296 					break;
5297 				}
5298 			}
5299 		} else {
5300 			/* no more delivery now. */
5301 			break;
5302 		}
5303 	}
5304 	if (need_reasm_check) {
5305 		int ret;
5306 
5307 		ret = sctp_deliver_reasm_check(stcb, &stcb->asoc, strmin, SCTP_READ_LOCK_HELD);
5308 		if (SCTP_MID_GT(asoc->idata_supported, mid, strmin->last_mid_delivered)) {
5309 			/* Restore the next to deliver unless we are ahead */
5310 			strmin->last_mid_delivered = mid;
5311 		}
5312 		if (ret == 0) {
5313 			/* Left the front Partial one on */
5314 			return;
5315 		}
5316 		need_reasm_check = 0;
5317 	}
5318 	/*
5319 	 * now we must deliver things in queue the normal way  if any are
5320 	 * now ready.
5321 	 */
5322 	mid = strmin->last_mid_delivered + 1;
5323 	TAILQ_FOREACH_SAFE(control, &strmin->inqueue, next_instrm, ncontrol) {
5324 		if (SCTP_MID_EQ(asoc->idata_supported, mid, control->mid)) {
5325 			if (((control->sinfo_flags >> 8) & SCTP_DATA_NOT_FRAG) == SCTP_DATA_NOT_FRAG) {
5326 				/* this is deliverable now */
5327 				if (control->on_strm_q) {
5328 					if (control->on_strm_q == SCTP_ON_ORDERED) {
5329 						TAILQ_REMOVE(&strmin->inqueue, control, next_instrm);
5330 					} else if (control->on_strm_q == SCTP_ON_UNORDERED) {
5331 						TAILQ_REMOVE(&strmin->uno_inqueue, control, next_instrm);
5332 #ifdef INVARIANTS
5333 					} else {
5334 						panic("strmin: %p ctl: %p unknown %d",
5335 						    strmin, control, control->on_strm_q);
5336 #endif
5337 					}
5338 					control->on_strm_q = 0;
5339 				}
5340 				/* subtract pending on streams */
5341 				if (asoc->size_on_all_streams >= control->length) {
5342 					asoc->size_on_all_streams -= control->length;
5343 				} else {
5344 #ifdef INVARIANTS
5345 					panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
5346 #else
5347 					asoc->size_on_all_streams = 0;
5348 #endif
5349 				}
5350 				sctp_ucount_decr(asoc->cnt_on_all_streams);
5351 				/* deliver it to at least the delivery-q */
5352 				strmin->last_mid_delivered = control->mid;
5353 				if (stcb->sctp_socket) {
5354 					sctp_mark_non_revokable(asoc, control->sinfo_tsn);
5355 					sctp_add_to_readq(stcb->sctp_ep, stcb,
5356 					    control,
5357 					    &stcb->sctp_socket->so_rcv, 1,
5358 					    SCTP_READ_LOCK_HELD, SCTP_SO_NOT_LOCKED);
5359 				}
5360 				mid = strmin->last_mid_delivered + 1;
5361 			} else {
5362 				/* Its a fragmented message */
5363 				if (control->first_frag_seen) {
5364 					/*
5365 					 * Make it so this is next to
5366 					 * deliver
5367 					 */
5368 					strmin->last_mid_delivered = control->mid - 1;
5369 					need_reasm_check = 1;
5370 					break;
5371 				}
5372 			}
5373 		} else {
5374 			break;
5375 		}
5376 	}
5377 	if (need_reasm_check) {
5378 		(void)sctp_deliver_reasm_check(stcb, &stcb->asoc, strmin, SCTP_READ_LOCK_HELD);
5379 	}
5380 }
5381 
5382 static void
5383 sctp_flush_reassm_for_str_seq(struct sctp_tcb *stcb,
5384     struct sctp_association *asoc, struct sctp_stream_in *strm,
5385     struct sctp_queued_to_read *control, int ordered, uint32_t cumtsn)
5386 {
5387 	struct sctp_tmit_chunk *chk, *nchk;
5388 
5389 	/*
5390 	 * For now large messages held on the stream reasm that are complete
5391 	 * will be tossed too. We could in theory do more work to spin
5392 	 * through and stop after dumping one msg aka seeing the start of a
5393 	 * new msg at the head, and call the delivery function... to see if
5394 	 * it can be delivered... But for now we just dump everything on the
5395 	 * queue.
5396 	 */
5397 	if (!asoc->idata_supported && !ordered &&
5398 	    control->first_frag_seen &&
5399 	    SCTP_TSN_GT(control->fsn_included, cumtsn)) {
5400 		return;
5401 	}
5402 	TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
5403 		/* Purge hanging chunks */
5404 		if (!asoc->idata_supported && !ordered) {
5405 			if (SCTP_TSN_GT(chk->rec.data.tsn, cumtsn)) {
5406 				break;
5407 			}
5408 		}
5409 		TAILQ_REMOVE(&control->reasm, chk, sctp_next);
5410 		if (asoc->size_on_reasm_queue >= chk->send_size) {
5411 			asoc->size_on_reasm_queue -= chk->send_size;
5412 		} else {
5413 #ifdef INVARIANTS
5414 			panic("size_on_reasm_queue = %u smaller than chunk length %u", asoc->size_on_reasm_queue, chk->send_size);
5415 #else
5416 			asoc->size_on_reasm_queue = 0;
5417 #endif
5418 		}
5419 		sctp_ucount_decr(asoc->cnt_on_reasm_queue);
5420 		if (chk->data) {
5421 			sctp_m_freem(chk->data);
5422 			chk->data = NULL;
5423 		}
5424 		sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
5425 	}
5426 	if (!TAILQ_EMPTY(&control->reasm)) {
5427 		/* This has to be old data, unordered */
5428 		if (control->data) {
5429 			sctp_m_freem(control->data);
5430 			control->data = NULL;
5431 		}
5432 		sctp_reset_a_control(control, stcb->sctp_ep, cumtsn);
5433 		chk = TAILQ_FIRST(&control->reasm);
5434 		if (chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
5435 			TAILQ_REMOVE(&control->reasm, chk, sctp_next);
5436 			sctp_add_chk_to_control(control, strm, stcb, asoc,
5437 			    chk, SCTP_READ_LOCK_HELD);
5438 		}
5439 		sctp_deliver_reasm_check(stcb, asoc, strm, SCTP_READ_LOCK_HELD);
5440 		return;
5441 	}
5442 	if (control->on_strm_q == SCTP_ON_ORDERED) {
5443 		TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
5444 		if (asoc->size_on_all_streams >= control->length) {
5445 			asoc->size_on_all_streams -= control->length;
5446 		} else {
5447 #ifdef INVARIANTS
5448 			panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
5449 #else
5450 			asoc->size_on_all_streams = 0;
5451 #endif
5452 		}
5453 		sctp_ucount_decr(asoc->cnt_on_all_streams);
5454 		control->on_strm_q = 0;
5455 	} else if (control->on_strm_q == SCTP_ON_UNORDERED) {
5456 		TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
5457 		control->on_strm_q = 0;
5458 #ifdef INVARIANTS
5459 	} else if (control->on_strm_q) {
5460 		panic("strm: %p ctl: %p unknown %d",
5461 		    strm, control, control->on_strm_q);
5462 #endif
5463 	}
5464 	control->on_strm_q = 0;
5465 	if (control->on_read_q == 0) {
5466 		sctp_free_remote_addr(control->whoFrom);
5467 		if (control->data) {
5468 			sctp_m_freem(control->data);
5469 			control->data = NULL;
5470 		}
5471 		sctp_free_a_readq(stcb, control);
5472 	}
5473 }
5474 
5475 void
5476 sctp_handle_forward_tsn(struct sctp_tcb *stcb,
5477     struct sctp_forward_tsn_chunk *fwd,
5478     int *abort_flag, struct mbuf *m, int offset)
5479 {
5480 	/* The pr-sctp fwd tsn */
5481 	/*
5482 	 * here we will perform all the data receiver side steps for
5483 	 * processing FwdTSN, as required in by pr-sctp draft:
5484 	 *
5485 	 * Assume we get FwdTSN(x):
5486 	 *
5487 	 * 1) update local cumTSN to x 2) try to further advance cumTSN to x
5488 	 * + others we have 3) examine and update re-ordering queue on
5489 	 * pr-in-streams 4) clean up re-assembly queue 5) Send a sack to
5490 	 * report where we are.
5491 	 */
5492 	struct sctp_association *asoc;
5493 	uint32_t new_cum_tsn, gap;
5494 	unsigned int i, fwd_sz, m_size;
5495 	uint32_t str_seq;
5496 	struct sctp_stream_in *strm;
5497 	struct sctp_queued_to_read *control, *ncontrol, *sv;
5498 
5499 	asoc = &stcb->asoc;
5500 	if ((fwd_sz = ntohs(fwd->ch.chunk_length)) < sizeof(struct sctp_forward_tsn_chunk)) {
5501 		SCTPDBG(SCTP_DEBUG_INDATA1,
5502 		    "Bad size too small/big fwd-tsn\n");
5503 		return;
5504 	}
5505 	m_size = (stcb->asoc.mapping_array_size << 3);
5506 	/*************************************************************/
5507 	/* 1. Here we update local cumTSN and shift the bitmap array */
5508 	/*************************************************************/
5509 	new_cum_tsn = ntohl(fwd->new_cumulative_tsn);
5510 
5511 	if (SCTP_TSN_GE(asoc->cumulative_tsn, new_cum_tsn)) {
5512 		/* Already got there ... */
5513 		return;
5514 	}
5515 	/*
5516 	 * now we know the new TSN is more advanced, let's find the actual
5517 	 * gap
5518 	 */
5519 	SCTP_CALC_TSN_TO_GAP(gap, new_cum_tsn, asoc->mapping_array_base_tsn);
5520 	asoc->cumulative_tsn = new_cum_tsn;
5521 	if (gap >= m_size) {
5522 		if ((long)gap > sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv)) {
5523 			struct mbuf *op_err;
5524 			char msg[SCTP_DIAG_INFO_LEN];
5525 
5526 			/*
5527 			 * out of range (of single byte chunks in the rwnd I
5528 			 * give out). This must be an attacker.
5529 			 */
5530 			*abort_flag = 1;
5531 			SCTP_SNPRINTF(msg, sizeof(msg),
5532 			    "New cum ack %8.8x too high, highest TSN %8.8x",
5533 			    new_cum_tsn, asoc->highest_tsn_inside_map);
5534 			op_err = sctp_generate_cause(SCTP_CAUSE_PROTOCOL_VIOLATION, msg);
5535 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_INDATA + SCTP_LOC_37;
5536 			sctp_abort_an_association(stcb->sctp_ep, stcb, op_err, SCTP_SO_NOT_LOCKED);
5537 			return;
5538 		}
5539 		SCTP_STAT_INCR(sctps_fwdtsn_map_over);
5540 
5541 		memset(stcb->asoc.mapping_array, 0, stcb->asoc.mapping_array_size);
5542 		asoc->mapping_array_base_tsn = new_cum_tsn + 1;
5543 		asoc->highest_tsn_inside_map = new_cum_tsn;
5544 
5545 		memset(stcb->asoc.nr_mapping_array, 0, stcb->asoc.mapping_array_size);
5546 		asoc->highest_tsn_inside_nr_map = new_cum_tsn;
5547 
5548 		if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MAP_LOGGING_ENABLE) {
5549 			sctp_log_map(0, 3, asoc->highest_tsn_inside_map, SCTP_MAP_SLIDE_RESULT);
5550 		}
5551 	} else {
5552 		SCTP_TCB_LOCK_ASSERT(stcb);
5553 		for (i = 0; i <= gap; i++) {
5554 			if (!SCTP_IS_TSN_PRESENT(asoc->mapping_array, i) &&
5555 			    !SCTP_IS_TSN_PRESENT(asoc->nr_mapping_array, i)) {
5556 				SCTP_SET_TSN_PRESENT(asoc->nr_mapping_array, i);
5557 				if (SCTP_TSN_GT(asoc->mapping_array_base_tsn + i, asoc->highest_tsn_inside_nr_map)) {
5558 					asoc->highest_tsn_inside_nr_map = asoc->mapping_array_base_tsn + i;
5559 				}
5560 			}
5561 		}
5562 	}
5563 	/*************************************************************/
5564 	/* 2. Clear up re-assembly queue                             */
5565 	/*************************************************************/
5566 
5567 	/* This is now done as part of clearing up the stream/seq */
5568 	if (asoc->idata_supported == 0) {
5569 		uint16_t sid;
5570 
5571 		/* Flush all the un-ordered data based on cum-tsn */
5572 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
5573 		for (sid = 0; sid < asoc->streamincnt; sid++) {
5574 			strm = &asoc->strmin[sid];
5575 			if (!TAILQ_EMPTY(&strm->uno_inqueue)) {
5576 				sctp_flush_reassm_for_str_seq(stcb, asoc, strm, TAILQ_FIRST(&strm->uno_inqueue), 0, new_cum_tsn);
5577 			}
5578 		}
5579 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5580 	}
5581 	/*******************************************************/
5582 	/* 3. Update the PR-stream re-ordering queues and fix  */
5583 	/* delivery issues as needed.                       */
5584 	/*******************************************************/
5585 	fwd_sz -= sizeof(*fwd);
5586 	if (m && fwd_sz) {
5587 		/* New method. */
5588 		unsigned int num_str;
5589 		uint32_t mid;
5590 		uint16_t sid;
5591 		uint16_t ordered, flags;
5592 		struct sctp_strseq *stseq, strseqbuf;
5593 		struct sctp_strseq_mid *stseq_m, strseqbuf_m;
5594 
5595 		offset += sizeof(*fwd);
5596 
5597 		SCTP_INP_READ_LOCK(stcb->sctp_ep);
5598 		if (asoc->idata_supported) {
5599 			num_str = fwd_sz / sizeof(struct sctp_strseq_mid);
5600 		} else {
5601 			num_str = fwd_sz / sizeof(struct sctp_strseq);
5602 		}
5603 		for (i = 0; i < num_str; i++) {
5604 			if (asoc->idata_supported) {
5605 				stseq_m = (struct sctp_strseq_mid *)sctp_m_getptr(m, offset,
5606 				    sizeof(struct sctp_strseq_mid),
5607 				    (uint8_t *)&strseqbuf_m);
5608 				offset += sizeof(struct sctp_strseq_mid);
5609 				if (stseq_m == NULL) {
5610 					break;
5611 				}
5612 				sid = ntohs(stseq_m->sid);
5613 				mid = ntohl(stseq_m->mid);
5614 				flags = ntohs(stseq_m->flags);
5615 				if (flags & PR_SCTP_UNORDERED_FLAG) {
5616 					ordered = 0;
5617 				} else {
5618 					ordered = 1;
5619 				}
5620 			} else {
5621 				stseq = (struct sctp_strseq *)sctp_m_getptr(m, offset,
5622 				    sizeof(struct sctp_strseq),
5623 				    (uint8_t *)&strseqbuf);
5624 				offset += sizeof(struct sctp_strseq);
5625 				if (stseq == NULL) {
5626 					break;
5627 				}
5628 				sid = ntohs(stseq->sid);
5629 				mid = (uint32_t)ntohs(stseq->ssn);
5630 				ordered = 1;
5631 			}
5632 			/* Convert */
5633 
5634 			/* now process */
5635 
5636 			/*
5637 			 * Ok we now look for the stream/seq on the read
5638 			 * queue where its not all delivered. If we find it
5639 			 * we transmute the read entry into a PDI_ABORTED.
5640 			 */
5641 			if (sid >= asoc->streamincnt) {
5642 				/* screwed up streams, stop!  */
5643 				break;
5644 			}
5645 			if ((asoc->str_of_pdapi == sid) &&
5646 			    (asoc->ssn_of_pdapi == mid)) {
5647 				/*
5648 				 * If this is the one we were partially
5649 				 * delivering now then we no longer are.
5650 				 * Note this will change with the reassembly
5651 				 * re-write.
5652 				 */
5653 				asoc->fragmented_delivery_inprogress = 0;
5654 			}
5655 			strm = &asoc->strmin[sid];
5656 			if (ordered) {
5657 				TAILQ_FOREACH_SAFE(control, &strm->inqueue, next_instrm, ncontrol) {
5658 					if (SCTP_MID_GE(asoc->idata_supported, mid, control->mid)) {
5659 						sctp_flush_reassm_for_str_seq(stcb, asoc, strm, control, ordered, new_cum_tsn);
5660 					}
5661 				}
5662 			} else {
5663 				if (asoc->idata_supported) {
5664 					TAILQ_FOREACH_SAFE(control, &strm->uno_inqueue, next_instrm, ncontrol) {
5665 						if (SCTP_MID_GE(asoc->idata_supported, mid, control->mid)) {
5666 							sctp_flush_reassm_for_str_seq(stcb, asoc, strm, control, ordered, new_cum_tsn);
5667 						}
5668 					}
5669 				} else {
5670 					if (!TAILQ_EMPTY(&strm->uno_inqueue)) {
5671 						sctp_flush_reassm_for_str_seq(stcb, asoc, strm, TAILQ_FIRST(&strm->uno_inqueue), ordered, new_cum_tsn);
5672 					}
5673 				}
5674 			}
5675 			TAILQ_FOREACH(control, &stcb->sctp_ep->read_queue, next) {
5676 				if ((control->sinfo_stream == sid) &&
5677 				    (SCTP_MID_EQ(asoc->idata_supported, control->mid, mid))) {
5678 					str_seq = (sid << 16) | (0x0000ffff & mid);
5679 					control->pdapi_aborted = 1;
5680 					sv = stcb->asoc.control_pdapi;
5681 					control->end_added = 1;
5682 					if (control->on_strm_q == SCTP_ON_ORDERED) {
5683 						TAILQ_REMOVE(&strm->inqueue, control, next_instrm);
5684 						if (asoc->size_on_all_streams >= control->length) {
5685 							asoc->size_on_all_streams -= control->length;
5686 						} else {
5687 #ifdef INVARIANTS
5688 							panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
5689 #else
5690 							asoc->size_on_all_streams = 0;
5691 #endif
5692 						}
5693 						sctp_ucount_decr(asoc->cnt_on_all_streams);
5694 					} else if (control->on_strm_q == SCTP_ON_UNORDERED) {
5695 						TAILQ_REMOVE(&strm->uno_inqueue, control, next_instrm);
5696 #ifdef INVARIANTS
5697 					} else if (control->on_strm_q) {
5698 						panic("strm: %p ctl: %p unknown %d",
5699 						    strm, control, control->on_strm_q);
5700 #endif
5701 					}
5702 					control->on_strm_q = 0;
5703 					stcb->asoc.control_pdapi = control;
5704 					sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
5705 					    stcb,
5706 					    SCTP_PARTIAL_DELIVERY_ABORTED,
5707 					    (void *)&str_seq,
5708 					    SCTP_SO_NOT_LOCKED);
5709 					stcb->asoc.control_pdapi = sv;
5710 					break;
5711 				} else if ((control->sinfo_stream == sid) &&
5712 				    SCTP_MID_GT(asoc->idata_supported, control->mid, mid)) {
5713 					/* We are past our victim SSN */
5714 					break;
5715 				}
5716 			}
5717 			if (SCTP_MID_GT(asoc->idata_supported, mid, strm->last_mid_delivered)) {
5718 				/* Update the sequence number */
5719 				strm->last_mid_delivered = mid;
5720 			}
5721 			/* now kick the stream the new way */
5722 			/* sa_ignore NO_NULL_CHK */
5723 			sctp_kick_prsctp_reorder_queue(stcb, strm);
5724 		}
5725 		SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5726 	}
5727 	/*
5728 	 * Now slide thing forward.
5729 	 */
5730 	sctp_slide_mapping_arrays(stcb);
5731 }
5732