xref: /illumos-gate/usr/src/stand/lib/tcp/tcp.c (revision 6f1fa39e3cf1b335f342bbca41590e9d76ab29b7)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright (c) 2016 by Delphix. All rights reserved.
 *
 * tcp.c, Code implementing the TCP protocol.
 */

#include <sys/types.h>
#include <socket_impl.h>
#include <socket_inet.h>
#include <sys/sysmacros.h>
#include <sys/promif.h>
#include <sys/socket.h>
#include <netinet/in_systm.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <net/if_types.h>
#include <sys/salib.h>

#include "ipv4.h"
#include "ipv4_impl.h"
#include "mac.h"
#include "mac_impl.h"
#include "v4_sum_impl.h"
#include <sys/bootdebug.h>
#include "tcp_inet.h"
#include "tcp_sack.h"
#include <inet/common.h>
#include <inet/mib2.h>

/*
 * We need to redefine BUMP_MIB/UPDATE_MIB to not have DTrace probes.
 */
#undef BUMP_MIB
#define	BUMP_MIB(x) (x)++

#undef UPDATE_MIB
#define	UPDATE_MIB(x, y) x += y

/*
 * MIB-2 stuff for SNMP
 */
mib2_tcp_t	tcp_mib;	/* SNMP fixed size info */

/* The TCP mib does not include the following errors. */
static uint_t tcp_cksum_errors;
static uint_t tcp_drops;

/* Macros for timestamp comparisons */
#define	TSTMP_GEQ(a, b)	((int32_t)((a)-(b)) >= 0)
#define	TSTMP_LT(a, b)	((int32_t)((a)-(b)) < 0)

/*
 * Parameters for TCP Initial Send Sequence number (ISS) generation.
 * The ISS is calculated by adding three components: a time component
 * which grows by 1 every 4096 nanoseconds (versus every 4 microseconds
 * suggested by RFC 793, page 27);
 * a per-connection component which grows by 125000 for every new connection;
 * and an "extra" component that grows by a random amount centered
 * approximately on 64000.  This causes the the ISS generator to cycle every
 * 4.89 hours if no TCP connections are made, and faster if connections are
 * made.
 */
#define	ISS_INCR	250000
#define	ISS_NSEC_SHT	0

static uint32_t tcp_iss_incr_extra;	/* Incremented for each connection */

#define	TCP_XMIT_LOWATER	4096
#define	TCP_XMIT_HIWATER	49152
#define	TCP_RECV_LOWATER	2048
#define	TCP_RECV_HIWATER	49152

/*
 *  PAWS needs a timer for 24 days.  This is the number of ms in 24 days
 */
#define	PAWS_TIMEOUT	((uint32_t)(24*24*60*60*1000))

/*
 * TCP options struct returned from tcp_parse_options.
 */
typedef struct tcp_opt_s {
	uint32_t	tcp_opt_mss;
	uint32_t	tcp_opt_wscale;
	uint32_t	tcp_opt_ts_val;
	uint32_t	tcp_opt_ts_ecr;
	tcp_t		*tcp;
} tcp_opt_t;

/*
 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing
 */

#ifdef _BIG_ENDIAN
#define	TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
	(TCPOPT_TSTAMP << 8) | 10)
#else
#define	TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
	(TCPOPT_NOP << 8) | TCPOPT_NOP)
#endif

/*
 * Flags returned from tcp_parse_options.
 */
#define	TCP_OPT_MSS_PRESENT	1
#define	TCP_OPT_WSCALE_PRESENT	2
#define	TCP_OPT_TSTAMP_PRESENT	4
#define	TCP_OPT_SACK_OK_PRESENT	8
#define	TCP_OPT_SACK_PRESENT	16

/* TCP option length */
#define	TCPOPT_NOP_LEN		1
#define	TCPOPT_MAXSEG_LEN	4
#define	TCPOPT_WS_LEN		3
#define	TCPOPT_REAL_WS_LEN	(TCPOPT_WS_LEN+1)
#define	TCPOPT_TSTAMP_LEN	10
#define	TCPOPT_REAL_TS_LEN	(TCPOPT_TSTAMP_LEN+2)
#define	TCPOPT_SACK_OK_LEN	2
#define	TCPOPT_REAL_SACK_OK_LEN	(TCPOPT_SACK_OK_LEN+2)
#define	TCPOPT_REAL_SACK_LEN	4
#define	TCPOPT_MAX_SACK_LEN	36
#define	TCPOPT_HEADER_LEN	2

/* TCP cwnd burst factor. */
#define	TCP_CWND_INFINITE	65535
#define	TCP_CWND_SS		3
#define	TCP_CWND_NORMAL		5

/* Named Dispatch Parameter Management Structure */
typedef struct tcpparam_s {
	uint32_t	tcp_param_min;
	uint32_t	tcp_param_max;
	uint32_t	tcp_param_val;
	char		*tcp_param_name;
} tcpparam_t;

/* Max size IP datagram is 64k - 1 */
#define	TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (struct ip) + \
	sizeof (tcph_t)))

/* Max of the above */
#define	TCP_MSS_MAX	TCP_MSS_MAX_IPV4

/* Largest TCP port number */
#define	TCP_MAX_PORT	(64 * 1024 - 1)

/* Round up the value to the nearest mss. */
#define	MSS_ROUNDUP(value, mss)		((((value) - 1) / (mss) + 1) * (mss))

#define	MS	1L
#define	SECONDS	(1000 * MS)
#define	MINUTES	(60 * SECONDS)
#define	HOURS	(60 * MINUTES)
#define	DAYS	(24 * HOURS)

/* All NDD params in the core TCP became static variables. */
static int	tcp_time_wait_interval = 1 * MINUTES;
static int	tcp_conn_req_max_q = 128;
static int	tcp_conn_req_max_q0 = 1024;
static int	tcp_conn_req_min = 1;
static int	tcp_conn_grace_period = 0 * SECONDS;
static int	tcp_cwnd_max_ = 1024 * 1024;
static int	tcp_smallest_nonpriv_port = 1024;
static int	tcp_ip_abort_cinterval = 3 * MINUTES;
static int	tcp_ip_abort_linterval = 3 * MINUTES;
static int	tcp_ip_abort_interval = 8 * MINUTES;
static int	tcp_ip_notify_cinterval = 10 * SECONDS;
static int	tcp_ip_notify_interval = 10 * SECONDS;
static int	tcp_ipv4_ttl = 64;
static int	tcp_mss_def_ipv4 = 536;
static int	tcp_mss_max_ipv4 = TCP_MSS_MAX_IPV4;
static int	tcp_mss_min = 108;
static int	tcp_naglim_def = (4*1024)-1;
static int	tcp_rexmit_interval_initial = 3 * SECONDS;
static int	tcp_rexmit_interval_max = 60 * SECONDS;
static int	tcp_rexmit_interval_min = 400 * MS;
static int	tcp_dupack_fast_retransmit = 3;
static int	tcp_smallest_anon_port = 32 * 1024;
static int	tcp_largest_anon_port = TCP_MAX_PORT;
static int	tcp_xmit_lowat = TCP_XMIT_LOWATER;
static int	tcp_recv_hiwat_minmss = 4;
static int	tcp_fin_wait_2_flush_interval = 1 * MINUTES;
static int	tcp_max_buf = 1024 * 1024;
static int	tcp_wscale_always = 1;
static int	tcp_tstamp_always = 1;
static int	tcp_tstamp_if_wscale = 1;
static int	tcp_rexmit_interval_extra = 0;
static int	tcp_slow_start_after_idle = 2;
static int	tcp_slow_start_initial = 2;
static int	tcp_sack_permitted = 2;
static int	tcp_ecn_permitted = 2;

/* Extra room to fit in headers. */
static uint_t	tcp_wroff_xtra;

/* Hint for next port to try. */
static in_port_t	tcp_next_port_to_try = 32*1024;

/*
 * Figure out the value of window scale opton.  Note that the rwnd is
 * ASSUMED to be rounded up to the nearest MSS before the calculation.
 * We cannot find the scale value and then do a round up of tcp_rwnd
 * because the scale value may not be correct after that.
 */
#define	SET_WS_VALUE(tcp) \
{ \
	int i; \
	uint32_t rwnd = (tcp)->tcp_rwnd; \
	for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; \
	    i++, rwnd >>= 1) \
		; \
	(tcp)->tcp_rcv_ws = i; \
}

/*
 * Set ECN capable transport (ECT) code point in IP header.
 *
 * Note that there are 2 ECT code points '01' and '10', which are called
 * ECT(1) and ECT(0) respectively.  Here we follow the original ECT code
 * point ECT(0) for TCP as described in RFC 2481.
 */
#define	SET_ECT(tcp, iph) \
	if ((tcp)->tcp_ipversion == IPV4_VERSION) { \
		/* We need to clear the code point first. */ \
		((struct ip *)(iph))->ip_tos &= 0xFC; \
		((struct ip *)(iph))->ip_tos |= IPH_ECN_ECT0; \
	}

/*
 * The format argument to pass to tcp_display().
 * DISP_PORT_ONLY means that the returned string has only port info.
 * DISP_ADDR_AND_PORT means that the returned string also contains the
 * remote and local IP address.
 */
#define	DISP_PORT_ONLY		1
#define	DISP_ADDR_AND_PORT	2

/*
 * TCP reassembly macros.  We hide starting and ending sequence numbers in
 * b_next and b_prev of messages on the reassembly queue.  The messages are
 * chained using b_cont.  These macros are used in tcp_reass() so we don't
 * have to see the ugly casts and assignments.
 * Note. use uintptr_t to suppress the gcc warning.
 */
#define	TCP_REASS_SEQ(mp)		((uint32_t)(uintptr_t)((mp)->b_next))
#define	TCP_REASS_SET_SEQ(mp, u)	((mp)->b_next = \
					    (mblk_t *)((uintptr_t)(u)))
#define	TCP_REASS_END(mp)		((uint32_t)(uintptr_t)((mp)->b_prev))
#define	TCP_REASS_SET_END(mp, u)	((mp)->b_prev = \
					    (mblk_t *)((uintptr_t)(u)))

#define	TCP_TIMER_RESTART(tcp, intvl) \
	(tcp)->tcp_rto_timeout = prom_gettime() + intvl; \
	(tcp)->tcp_timer_running = B_TRUE;

static int tcp_accept_comm(tcp_t *, tcp_t *, mblk_t *, uint_t);
static mblk_t *tcp_ack_mp(tcp_t *);
static in_port_t tcp_bindi(in_port_t, in_addr_t *, boolean_t, boolean_t);
static uint16_t tcp_cksum(uint16_t *, uint32_t);
static void tcp_clean_death(int, tcp_t *, int err);
static tcp_t *tcp_conn_request(tcp_t *, mblk_t *mp, uint_t, uint_t);
static char *tcp_display(tcp_t *, char *, char);
static int tcp_drain_input(tcp_t *, int, int);
static void tcp_drain_needed(int, tcp_t *);
static boolean_t tcp_drop_q0(tcp_t *);
static mblk_t *tcp_get_seg_mp(tcp_t *, uint32_t, int32_t *);
static int tcp_header_len(struct inetgram *);
static in_port_t tcp_report_ports(uint16_t *, enum Ports);
static int tcp_input(int);
static void tcp_iss_init(tcp_t *);
static tcp_t *tcp_lookup_ipv4(struct ip *, tcpha_t *, int, int *);
static tcp_t *tcp_lookup_listener_ipv4(in_addr_t, in_port_t, int *);
static int tcp_conn_check(tcp_t *);
static int tcp_close(int);
static void tcp_close_detached(tcp_t *);
static void tcp_eager_cleanup(tcp_t *, boolean_t, int);
static void tcp_eager_unlink(tcp_t *);
static void tcp_free(tcp_t *);
static int tcp_header_init_ipv4(tcp_t *);
static void tcp_mss_set(tcp_t *, uint32_t);
static int tcp_parse_options(tcph_t *, tcp_opt_t *);
static boolean_t tcp_paws_check(tcp_t *, tcph_t *, tcp_opt_t *);
static void tcp_process_options(tcp_t *, tcph_t *);
static int tcp_random(void);
static void tcp_random_init(void);
static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t);
static void tcp_reass_elim_overlap(tcp_t *, mblk_t *);
static void tcp_rcv_drain(int sock_id, tcp_t *);
static void tcp_rcv_enqueue(tcp_t *, mblk_t *, uint_t);
static void tcp_rput_data(tcp_t *, mblk_t *, int);
static int tcp_rwnd_set(tcp_t *, uint32_t);
static int32_t tcp_sack_rxmit(tcp_t *, int);
static void tcp_set_cksum(mblk_t *);
static void tcp_set_rto(tcp_t *, int32_t);
static void tcp_ss_rexmit(tcp_t *, int);
static int tcp_state_wait(int, tcp_t *, int);
static void tcp_timer(tcp_t *, int);
static void tcp_time_wait_append(tcp_t *);
static void tcp_time_wait_collector(void);
static void tcp_time_wait_processing(tcp_t *, mblk_t *, uint32_t,
    uint32_t, int, tcph_t *, int sock_id);
static void tcp_time_wait_remove(tcp_t *);
static in_port_t tcp_update_next_port(in_port_t);
static int tcp_verify_cksum(mblk_t *);
static void tcp_wput_data(tcp_t *, mblk_t *, int);
static void tcp_xmit_ctl(char *, tcp_t *, mblk_t *, uint32_t, uint32_t,
    int, uint_t, int);
static void tcp_xmit_early_reset(char *, int, mblk_t *, uint32_t, uint32_t,
    int, uint_t);
static int tcp_xmit_end(tcp_t *, int);
static void tcp_xmit_listeners_reset(int, mblk_t *, uint_t);
static mblk_t *tcp_xmit_mp(tcp_t *, mblk_t *, int32_t, int32_t *,
    mblk_t **, uint32_t, boolean_t, uint32_t *, boolean_t);
static int tcp_init_values(tcp_t *, struct inetboot_socket *);

#if DEBUG > 1
#define	TCP_DUMP_PACKET(str, mp) \
{ \
	int len = (mp)->b_wptr - (mp)->b_rptr; \
\
	printf("%s: dump TCP(%d): \n", (str), len); \
	hexdump((char *)(mp)->b_rptr, len); \
}
#else
#define	TCP_DUMP_PACKET(str, mp)
#endif

#ifdef DEBUG
#define	DEBUG_1(str, arg)		printf(str, (arg))
#define	DEBUG_2(str, arg1, arg2)	printf(str, (arg1), (arg2))
#define	DEBUG_3(str, arg1, arg2, arg3)	printf(str, (arg1), (arg2), (arg3))
#else
#define	DEBUG_1(str, arg)
#define	DEBUG_2(str, arg1, arg2)
#define	DEBUG_3(str, arg1, arg2, arg3)
#endif

/* Whether it is the first time TCP is used. */
static boolean_t tcp_initialized = B_FALSE;

/* TCP time wait list. */
static tcp_t *tcp_time_wait_head;
static tcp_t *tcp_time_wait_tail;
static uint32_t tcp_cum_timewait;
/* When the tcp_time_wait_collector is run. */
static uint32_t tcp_time_wait_runtime;

#define	TCP_RUN_TIME_WAIT_COLLECTOR() \
	if (prom_gettime() > tcp_time_wait_runtime) \
		tcp_time_wait_collector();

/*
 * Accept will return with an error if there is no connection coming in
 * after this (in ms).
 */
static int tcp_accept_timeout = 60000;

/*
 * Initialize the TCP-specific parts of a socket.
 */
void
tcp_socket_init(struct inetboot_socket *isp)
{
	/* Do some initializations. */
	if (!tcp_initialized) {
		tcp_random_init();
		/* Extra head room for the MAC layer address. */
		if ((tcp_wroff_xtra = mac_get_hdr_len()) & 0x3) {
			tcp_wroff_xtra = (tcp_wroff_xtra & ~0x3) + 0x4;
		}
		/* Schedule the first time wait cleanup time */
		tcp_time_wait_runtime = prom_gettime() + tcp_time_wait_interval;
		tcp_initialized = B_TRUE;
	}
	TCP_RUN_TIME_WAIT_COLLECTOR();

	isp->proto = IPPROTO_TCP;
	isp->input[TRANSPORT_LVL] = tcp_input;
	/* Socket layer should call tcp_send() directly. */
	isp->output[TRANSPORT_LVL] = NULL;
	isp->close[TRANSPORT_LVL] = tcp_close;
	isp->headerlen[TRANSPORT_LVL] = tcp_header_len;
	isp->ports = tcp_report_ports;
	if ((isp->pcb = bkmem_alloc(sizeof (tcp_t))) == NULL) {
		errno = ENOBUFS;
		return;
	}
	if ((errno = tcp_init_values((tcp_t *)isp->pcb, isp)) != 0) {
		bkmem_free(isp->pcb, sizeof (tcp_t));
		return;
	}
	/*
	 * This is set last because this field is used to determine if
	 * a socket is in use or not.
	 */
	isp->type = INETBOOT_STREAM;
}

/*
 * Return the size of a TCP header including TCP option.
 */
static int
tcp_header_len(struct inetgram *igm)
{
	mblk_t *pkt;
	int ipvers;

	/* Just returns the standard TCP header without option */
	if (igm == NULL)
		return (sizeof (tcph_t));

	if ((pkt = igm->igm_mp) == NULL)
		return (0);

	ipvers = ((struct ip *)pkt->b_rptr)->ip_v;
	if (ipvers == IPV4_VERSION) {
		return (TCP_HDR_LENGTH((tcph_t *)(pkt + IPH_HDR_LENGTH(pkt))));
	} else {
		dprintf("tcp_header_len: non-IPv4 packet.\n");
		return (0);
	}
}

/*
 * Return the requested port number in network order.
 */
static in_port_t
tcp_report_ports(uint16_t *tcphp, enum Ports request)
{
	if (request == SOURCE)
		return (*(uint16_t *)(((tcph_t *)tcphp)->th_lport));
	return (*(uint16_t *)(((tcph_t *)tcphp)->th_fport));
}

/*
 * Because inetboot is not interrupt driven, TCP can only poll.  This
 * means that there can be packets stuck in the NIC buffer waiting to
 * be processed.  Thus we need to drain them before, for example, sending
 * anything because an ACK may actually be stuck there.
 *
 * The timeout arguments determine how long we should wait for draining.
 */
static int
tcp_drain_input(tcp_t *tcp, int sock_id, int timeout)
{
	struct inetgram *in_gram;
	struct inetgram *old_in_gram;
	int old_timeout;
	mblk_t *mp;
	int i;

	dprintf("tcp_drain_input(%d): %s\n", sock_id,
	    tcp_display(tcp, NULL, DISP_ADDR_AND_PORT));

	/*
	 * Since the driver uses the in_timeout value in the socket
	 * structure to determine the timeout value, we need to save
	 * the original one so that we can restore that after draining.
	 */
	old_timeout = sockets[sock_id].in_timeout;
	sockets[sock_id].in_timeout = timeout;

	/*
	 * We do this because the input queue may have some user
	 * data already.
	 */
	old_in_gram = sockets[sock_id].inq;
	sockets[sock_id].inq = NULL;

	/* Go out and check the wire */
	for (i = MEDIA_LVL; i < TRANSPORT_LVL; i++) {
		if (sockets[sock_id].input[i] != NULL) {
			if (sockets[sock_id].input[i](sock_id) < 0) {
				sockets[sock_id].in_timeout = old_timeout;
				if (sockets[sock_id].inq != NULL)
					nuke_grams(&sockets[sock_id].inq);
				sockets[sock_id].inq = old_in_gram;
				return (-1);
			}
		}
	}
#if DEBUG
	printf("tcp_drain_input: done with checking packets\n");
#endif
	while ((in_gram = sockets[sock_id].inq) != NULL) {
		/* Remove unknown inetgrams from the head of inq. */
		if (in_gram->igm_level != TRANSPORT_LVL) {
#if DEBUG
			printf("tcp_drain_input: unexpected packet "
			    "level %d frame found\n", in_gram->igm_level);
#endif
			del_gram(&sockets[sock_id].inq, in_gram, B_TRUE);
			continue;
		}
		mp = in_gram->igm_mp;
		del_gram(&sockets[sock_id].inq, in_gram, B_FALSE);
		bkmem_free((caddr_t)in_gram, sizeof (struct inetgram));
		tcp_rput_data(tcp, mp, sock_id);
		sockets[sock_id].in_timeout = old_timeout;

		/*
		 * The other side may have closed this connection or
		 * RST us.  But we need to continue to process other
		 * packets in the socket's queue because they may be
		 * belong to another TCP connections.
		 */
		if (sockets[sock_id].pcb == NULL)
			tcp = NULL;
	}

	if (tcp == NULL || sockets[sock_id].pcb == NULL) {
		if (sockets[sock_id].so_error != 0)
			return (-1);
		else
			return (0);
	}
#if DEBUG
	printf("tcp_drain_input: done with processing packets\n");
#endif
	sockets[sock_id].in_timeout = old_timeout;
	sockets[sock_id].inq = old_in_gram;

	/*
	 * Data may have been received so indicate it is available
	 */
	tcp_drain_needed(sock_id, tcp);
	return (0);
}

/*
 * The receive entry point for upper layer to call to get data.  Note
 * that this follows the current architecture that lower layer receive
 * routines have been called already.  Thus if the inq of socket is
 * not NULL, the packets must be for us.
 */
static int
tcp_input(int sock_id)
{
	struct inetgram *in_gram;
	mblk_t *mp;
	tcp_t *tcp;

	TCP_RUN_TIME_WAIT_COLLECTOR();

	if ((tcp = sockets[sock_id].pcb) == NULL)
		return (-1);

	while ((in_gram = sockets[sock_id].inq) != NULL) {
		/* Remove unknown inetgrams from the head of inq. */
		if (in_gram->igm_level != TRANSPORT_LVL) {
#ifdef DEBUG
			printf("tcp_input: unexpected packet "
			    "level %d frame found\n", in_gram->igm_level);
#endif
			del_gram(&sockets[sock_id].inq, in_gram, B_TRUE);
			continue;
		}
		mp = in_gram->igm_mp;
		del_gram(&sockets[sock_id].inq, in_gram, B_FALSE);
		bkmem_free((caddr_t)in_gram, sizeof (struct inetgram));
		tcp_rput_data(tcp, mp, sock_id);
		/* The TCP may be gone because it gets a RST. */
		if (sockets[sock_id].pcb == NULL)
			return (-1);
	}

	/* Flush the receive list. */
	if (tcp->tcp_rcv_list != NULL) {
		tcp_rcv_drain(sock_id, tcp);
	} else {
		/* The other side has closed the connection, report this up. */
		if (tcp->tcp_state == TCPS_CLOSE_WAIT) {
			sockets[sock_id].so_state |= SS_CANTRCVMORE;
			return (0);
		}
	}
	return (0);
}

/*
 * The send entry point for upper layer to call to send data.  In order
 * to minimize changes to the core TCP code, we need to put the
 * data into mblks.
 */
int
tcp_send(int sock_id, tcp_t *tcp, const void *msg, int len)
{
	mblk_t *mp;
	mblk_t *head = NULL;
	mblk_t *tail;
	int mss = tcp->tcp_mss;
	int cnt = 0;
	int win_size;
	char *buf = (char *)msg;

	TCP_RUN_TIME_WAIT_COLLECTOR();

	/* We don't want to append 0 size mblk. */
	if (len == 0)
		return (0);
	while (len > 0) {
		if (len < mss) {
			mss = len;
		}
		/*
		 * If we cannot allocate more buffer, stop here and
		 * the number of bytes buffered will be returned.
		 *
		 * Note that we follow the core TCP optimization that
		 * each mblk contains only MSS bytes data.
		 */
		if ((mp = allocb(mss + tcp->tcp_ip_hdr_len +
		    TCP_MAX_HDR_LENGTH + tcp_wroff_xtra, 0)) == NULL) {
			break;
		}
		mp->b_rptr += tcp->tcp_hdr_len + tcp_wroff_xtra;
		bcopy(buf, mp->b_rptr, mss);
		mp->b_wptr = mp->b_rptr + mss;
		buf += mss;
		cnt += mss;
		len -= mss;

		if (head == NULL) {
			head = mp;
			tail = mp;
		} else {
			tail->b_cont = mp;
			tail = mp;
		}
	}

	/*
	 * Since inetboot is not interrupt driven, there may be
	 * some ACKs in the MAC's buffer.  Drain them first,
	 * otherwise, we may not be able to send.
	 *
	 * We expect an ACK in two cases:
	 *
	 * 1) We have un-ACK'ed data.
	 *
	 * 2) All ACK's have been received and the sender's window has been
	 * closed.  We need an ACK back to open the window so that we can
	 * send.  In this case, call tcp_drain_input() if the window size is
	 * less than 2 * MSS.
	 */

	/* window size = MIN(swnd, cwnd) - unacked bytes */
	win_size = (tcp->tcp_swnd > tcp->tcp_cwnd) ? tcp->tcp_cwnd :
		tcp->tcp_swnd;
	win_size -= tcp->tcp_snxt;
	win_size += tcp->tcp_suna;
	if (win_size < (2 * tcp->tcp_mss))
		if (tcp_drain_input(tcp, sock_id, 5) < 0)
			return (-1);

	tcp_wput_data(tcp, head, sock_id);
	/*
	 * errno should be reset here as it may be
	 * set to ETIMEDOUT. This may be set by
	 * the MAC driver in case it has timed out
	 * waiting for ARP reply. Any segment which
	 * was not transmitted because of ARP timeout
	 * will be retransmitted by TCP.
	 */
	if (errno == ETIMEDOUT)
		errno = 0;
	return (cnt);
}

/* Free up all TCP related stuff */
static void
tcp_free(tcp_t *tcp)
{
	if (tcp->tcp_iphc != NULL) {
		bkmem_free((caddr_t)tcp->tcp_iphc, tcp->tcp_iphc_len);
		tcp->tcp_iphc = NULL;
	}
	if (tcp->tcp_xmit_head != NULL) {
		freemsg(tcp->tcp_xmit_head);
		tcp->tcp_xmit_head = NULL;
	}
	if (tcp->tcp_rcv_list != NULL) {
		freemsg(tcp->tcp_rcv_list);
		tcp->tcp_rcv_list = NULL;
	}
	if (tcp->tcp_reass_head != NULL) {
		freemsg(tcp->tcp_reass_head);
		tcp->tcp_reass_head = NULL;
	}
	if (tcp->tcp_sack_info != NULL) {
		bkmem_free((caddr_t)tcp->tcp_sack_info,
		    sizeof (tcp_sack_info_t));
		tcp->tcp_sack_info = NULL;
	}
}

static void
tcp_close_detached(tcp_t *tcp)
{
	if (tcp->tcp_listener != NULL)
		tcp_eager_unlink(tcp);
	tcp_free(tcp);
	bkmem_free((caddr_t)tcp, sizeof (tcp_t));
}

/*
 * If we are an eager connection hanging off a listener that hasn't
 * formally accepted the connection yet, get off its list and blow off
 * any data that we have accumulated.
 */
static void
tcp_eager_unlink(tcp_t *tcp)
{
	tcp_t	*listener = tcp->tcp_listener;

	assert(listener != NULL);
	if (tcp->tcp_eager_next_q0 != NULL) {
		assert(tcp->tcp_eager_prev_q0 != NULL);

		/* Remove the eager tcp from q0 */
		tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
		    tcp->tcp_eager_prev_q0;
		tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
		    tcp->tcp_eager_next_q0;
		listener->tcp_conn_req_cnt_q0--;
	} else {
		tcp_t   **tcpp = &listener->tcp_eager_next_q;
		tcp_t	*prev = NULL;

		for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
			if (tcpp[0] == tcp) {
				if (listener->tcp_eager_last_q == tcp) {
					/*
					 * If we are unlinking the last
					 * element on the list, adjust
					 * tail pointer. Set tail pointer
					 * to nil when list is empty.
					 */
					assert(tcp->tcp_eager_next_q == NULL);
					if (listener->tcp_eager_last_q ==
					    listener->tcp_eager_next_q) {
						listener->tcp_eager_last_q =
						NULL;
					} else {
						/*
						 * We won't get here if there
						 * is only one eager in the
						 * list.
						 */
						assert(prev != NULL);
						listener->tcp_eager_last_q =
						    prev;
					}
				}
				tcpp[0] = tcp->tcp_eager_next_q;
				tcp->tcp_eager_next_q = NULL;
				tcp->tcp_eager_last_q = NULL;
				listener->tcp_conn_req_cnt_q--;
				break;
			}
			prev = tcpp[0];
		}
	}
	tcp->tcp_listener = NULL;
}

/*
 * Reset any eager connection hanging off this listener
 * and then reclaim it's resources.
 */
static void
tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only, int sock_id)
{
	tcp_t	*eager;

	if (!q0_only) {
		/* First cleanup q */
		while ((eager = listener->tcp_eager_next_q) != NULL) {
			assert(listener->tcp_eager_last_q != NULL);
			tcp_xmit_ctl("tcp_eager_cleanup, can't wait",
			    eager, NULL, eager->tcp_snxt, 0, TH_RST, 0,
			    sock_id);
			tcp_close_detached(eager);
		}
		assert(listener->tcp_eager_last_q == NULL);
	}
	/* Then cleanup q0 */
	while ((eager = listener->tcp_eager_next_q0) != listener) {
		tcp_xmit_ctl("tcp_eager_cleanup, can't wait",
		    eager, NULL, eager->tcp_snxt, 0, TH_RST, 0, sock_id);
		tcp_close_detached(eager);
	}
}

/*
 * To handle the shutdown request. Called from shutdown()
 */
int
tcp_shutdown(int sock_id)
{
	tcp_t	*tcp;

	DEBUG_1("tcp_shutdown: sock_id %x\n", sock_id);

	if ((tcp = sockets[sock_id].pcb) == NULL) {
		return (-1);
	}

	/*
	 * Since inetboot is not interrupt driven, there may be
	 * some ACKs in the MAC's buffer.  Drain them first,
	 * otherwise, we may not be able to send.
	 */
	if (tcp_drain_input(tcp, sock_id, 5) < 0) {
		/*
		 * If we return now without freeing TCP, there will be
		 * a memory leak.
		 */
		if (sockets[sock_id].pcb != NULL)
			tcp_clean_death(sock_id, tcp, 0);
		return (-1);
	}

	DEBUG_1("tcp_shutdown: tcp_state %x\n", tcp->tcp_state);
	switch (tcp->tcp_state) {

	case TCPS_SYN_RCVD:
		/*
		 * Shutdown during the connect 3-way handshake
		 */
	case TCPS_ESTABLISHED:
		/*
		 * Transmit the FIN
		 * wait for the FIN to be ACKed,
		 * then remain in FIN_WAIT_2
		 */
		dprintf("tcp_shutdown: sending fin\n");
		if (tcp_xmit_end(tcp, sock_id) == 0 &&
			tcp_state_wait(sock_id, tcp, TCPS_FIN_WAIT_2) < 0) {
			/* During the wait, TCP may be gone... */
			if (sockets[sock_id].pcb == NULL)
				return (-1);
		}
		dprintf("tcp_shutdown: done\n");
		break;

	default:
		break;

	}
	return (0);
}

/* To handle closing of the socket */
static int
tcp_close(int sock_id)
{
	char	*msg;
	tcp_t	*tcp;
	int	error = 0;

	if ((tcp = sockets[sock_id].pcb) == NULL) {
		return (-1);
	}

	TCP_RUN_TIME_WAIT_COLLECTOR();

	/*
	 * Since inetboot is not interrupt driven, there may be
	 * some ACKs in the MAC's buffer.  Drain them first,
	 * otherwise, we may not be able to send.
	 */
	if (tcp_drain_input(tcp, sock_id, 5) < 0) {
		/*
		 * If we return now without freeing TCP, there will be
		 * a memory leak.
		 */
		if (sockets[sock_id].pcb != NULL)
			tcp_clean_death(sock_id, tcp, 0);
		return (-1);
	}

	if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) {
		/* Cleanup for listener */
		tcp_eager_cleanup(tcp, 0, sock_id);
	}

	msg = NULL;
	switch (tcp->tcp_state) {
	case TCPS_CLOSED:
	case TCPS_IDLE:
	case TCPS_BOUND:
	case TCPS_LISTEN:
		break;
	case TCPS_SYN_SENT:
		msg = "tcp_close, during connect";
		break;
	case TCPS_SYN_RCVD:
		/*
		 * Close during the connect 3-way handshake
		 * but here there may or may not be pending data
		 * already on queue. Process almost same as in
		 * the ESTABLISHED state.
		 */
		/* FALLTHRU */
	default:
		/*
		 * If SO_LINGER has set a zero linger time, abort the
		 * connection with a reset.
		 */
		if (tcp->tcp_linger && tcp->tcp_lingertime == 0) {
			msg = "tcp_close, zero lingertime";
			break;
		}

		/*
		 * Abort connection if there is unread data queued.
		 */
		if (tcp->tcp_rcv_list != NULL ||
				tcp->tcp_reass_head != NULL) {
			msg = "tcp_close, unread data";
			break;
		}
		if (tcp->tcp_state <= TCPS_LISTEN)
			break;

		/*
		 * Transmit the FIN before detaching the tcp_t.
		 * After tcp_detach returns this queue/perimeter
		 * no longer owns the tcp_t thus others can modify it.
		 * The TCP could be closed in tcp_state_wait called by
		 * tcp_wput_data called by tcp_xmit_end.
		 */
		(void) tcp_xmit_end(tcp, sock_id);
		if (sockets[sock_id].pcb == NULL)
			return (0);

		/*
		 * If lingering on close then wait until the fin is acked,
		 * the SO_LINGER time passes, or a reset is sent/received.
		 */
		if (tcp->tcp_linger && tcp->tcp_lingertime > 0 &&
		    !(tcp->tcp_fin_acked) &&
		    tcp->tcp_state >= TCPS_ESTABLISHED) {
			uint32_t stoptime; /* in ms */

			tcp->tcp_client_errno = 0;
			stoptime = prom_gettime() +
			    (tcp->tcp_lingertime * 1000);
			while (!(tcp->tcp_fin_acked) &&
			    tcp->tcp_state >= TCPS_ESTABLISHED &&
			    tcp->tcp_client_errno == 0 &&
			    ((int32_t)(stoptime - prom_gettime()) > 0)) {
				if (tcp_drain_input(tcp, sock_id, 5) < 0) {
					if (sockets[sock_id].pcb != NULL) {
						tcp_clean_death(sock_id,
						    tcp, 0);
					}
					return (-1);
				}
			}
			tcp->tcp_client_errno = 0;
		}
		if (tcp_state_wait(sock_id, tcp, TCPS_TIME_WAIT) < 0) {
			/* During the wait, TCP may be gone... */
			if (sockets[sock_id].pcb == NULL)
				return (0);
			msg = "tcp_close, couldn't detach";
		} else {
			return (0);
		}
		break;
	}

	/* Something went wrong...  Send a RST and report the error */
	if (msg != NULL) {
		if (tcp->tcp_state == TCPS_ESTABLISHED ||
		    tcp->tcp_state == TCPS_CLOSE_WAIT)
			BUMP_MIB(tcp_mib.tcpEstabResets);
		if (tcp->tcp_state == TCPS_SYN_SENT ||
		    tcp->tcp_state == TCPS_SYN_RCVD)
			BUMP_MIB(tcp_mib.tcpAttemptFails);
		tcp_xmit_ctl(msg, tcp, NULL, tcp->tcp_snxt, 0, TH_RST, 0,
		    sock_id);
	}

	tcp_free(tcp);
	bkmem_free((caddr_t)tcp, sizeof (tcp_t));
	sockets[sock_id].pcb = NULL;
	return (error);
}

/* To make an endpoint a listener. */
int
tcp_listen(int sock_id, int backlog)
{
	tcp_t *tcp;

	if ((tcp = (tcp_t *)(sockets[sock_id].pcb)) == NULL) {
		errno = EINVAL;
		return (-1);
	}
	/* We allow calling listen() multiple times to change the backlog. */
	if (tcp->tcp_state > TCPS_LISTEN || tcp->tcp_state < TCPS_BOUND) {
		errno = EOPNOTSUPP;
		return (-1);
	}
	/* The following initialization should only be done once. */
	if (tcp->tcp_state != TCPS_LISTEN) {
		tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
		tcp->tcp_eager_next_q = NULL;
		tcp->tcp_state = TCPS_LISTEN;
		tcp->tcp_second_ctimer_threshold = tcp_ip_abort_linterval;
	}
	if ((tcp->tcp_conn_req_max = backlog) > tcp_conn_req_max_q) {
		tcp->tcp_conn_req_max = tcp_conn_req_max_q;
	}
	if (tcp->tcp_conn_req_max < tcp_conn_req_min) {
		tcp->tcp_conn_req_max = tcp_conn_req_min;
	}
	return (0);
}

/* To accept connections. */
int
tcp_accept(int sock_id, struct sockaddr *addr, socklen_t *addr_len)
{
	tcp_t *listener;
	tcp_t *eager;
	int sd, new_sock_id;
	struct sockaddr_in *new_addr = (struct sockaddr_in *)addr;
	int timeout;

	/* Sanity check. */
	if ((listener = (tcp_t *)(sockets[sock_id].pcb)) == NULL ||
	    new_addr == NULL || addr_len == NULL ||
	    *addr_len < sizeof (struct sockaddr_in) ||
	    listener->tcp_state != TCPS_LISTEN) {
		errno = EINVAL;
		return (-1);
	}

	if (sockets[sock_id].in_timeout > tcp_accept_timeout)
		timeout = prom_gettime() + sockets[sock_id].in_timeout;
	else
		timeout = prom_gettime() + tcp_accept_timeout;
	while (listener->tcp_eager_next_q == NULL &&
	    timeout > prom_gettime()) {
#if DEBUG
		printf("tcp_accept: Waiting in tcp_accept()\n");
#endif
		if (tcp_drain_input(listener, sock_id, 5) < 0) {
			return (-1);
		}
	}
	/* If there is an eager, don't timeout... */
	if (timeout <= prom_gettime() && listener->tcp_eager_next_q == NULL) {
#if DEBUG
		printf("tcp_accept: timeout\n");
#endif
		errno = ETIMEDOUT;
		return (-1);
	}
#if DEBUG
	printf("tcp_accept: got a connection\n");
#endif

	/* Now create the socket for this new TCP. */
	if ((sd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
		return (-1);
	}
	if ((new_sock_id = so_check_fd(sd, &errno)) == -1)
		/* This should not happen! */
		prom_panic("so_check_fd() fails in tcp_accept()");
	/* Free the TCP PCB in the original socket. */
	bkmem_free((caddr_t)(sockets[new_sock_id].pcb), sizeof (tcp_t));
	/* Dequeue the eager and attach it to the socket. */
	eager = listener->tcp_eager_next_q;
	listener->tcp_eager_next_q = eager->tcp_eager_next_q;
	if (listener->tcp_eager_last_q == eager)
		listener->tcp_eager_last_q = NULL;
	eager->tcp_eager_next_q = NULL;
	sockets[new_sock_id].pcb = eager;
	listener->tcp_conn_req_cnt_q--;

	/* Copy in the address info. */
	bcopy(&eager->tcp_remote, &new_addr->sin_addr.s_addr,
	    sizeof (in_addr_t));
	bcopy(&eager->tcp_fport, &new_addr->sin_port, sizeof (in_port_t));
	new_addr->sin_family = AF_INET;

#ifdef DEBUG
	printf("tcp_accept(), new sock_id: %d\n", sd);
#endif
	return (sd);
}

/* Update the next anonymous port to use.  */
static in_port_t
tcp_update_next_port(in_port_t port)
{
	/* Don't allow the port to fall out of the anonymous port range. */
	if (port < tcp_smallest_anon_port || port > tcp_largest_anon_port)
		port = (in_port_t)tcp_smallest_anon_port;

	if (port < tcp_smallest_nonpriv_port)
		port = (in_port_t)tcp_smallest_nonpriv_port;
	return (port);
}

/* To check whether a bind to a port is allowed. */
static in_port_t
tcp_bindi(in_port_t port, in_addr_t *addr, boolean_t reuseaddr,
    boolean_t bind_to_req_port_only)
{
	int i, count;
	tcp_t *tcp;

	count = tcp_largest_anon_port - tcp_smallest_anon_port;
try_again:
	for (i = 0; i < MAXSOCKET; i++) {
		if (sockets[i].type != INETBOOT_STREAM ||
		    ((tcp = (tcp_t *)sockets[i].pcb) == NULL) ||
		    ntohs(tcp->tcp_lport) != port) {
			continue;
		}
		/*
		 * Both TCPs have the same port.  If SO_REUSEDADDR is
		 * set and the bound TCP has a state greater than
		 * TCPS_LISTEN, it is fine.
		 */
		if (reuseaddr && tcp->tcp_state > TCPS_LISTEN) {
			continue;
		}
		if (tcp->tcp_bound_source != INADDR_ANY &&
		    *addr != INADDR_ANY &&
		    tcp->tcp_bound_source != *addr) {
			continue;
		}
		if (bind_to_req_port_only) {
			return (0);
		}
		if (--count > 0) {
			port = tcp_update_next_port(++port);
			goto try_again;
		} else {
			return (0);
		}
	}
	return (port);
}

/* To handle the bind request. */
int
tcp_bind(int sock_id)
{
	tcp_t *tcp;
	in_port_t requested_port, allocated_port;
	boolean_t bind_to_req_port_only;
	boolean_t reuseaddr;

	if ((tcp = (tcp_t *)sockets[sock_id].pcb) == NULL) {
		errno = EINVAL;
		return (-1);
	}

	if (tcp->tcp_state >= TCPS_BOUND) {
		/* We don't allow multiple bind(). */
		errno = EPROTO;
		return (-1);
	}

	requested_port = ntohs(sockets[sock_id].bind.sin_port);

	/* The bound source can be INADDR_ANY. */
	tcp->tcp_bound_source = sockets[sock_id].bind.sin_addr.s_addr;

	tcp->tcp_ipha->ip_src.s_addr = tcp->tcp_bound_source;

	/* Verify the port is available. */
	if (requested_port == 0)
		bind_to_req_port_only = B_FALSE;
	else			/* T_BIND_REQ and requested_port != 0 */
		bind_to_req_port_only = B_TRUE;

	if (requested_port == 0) {
		requested_port = tcp_update_next_port(++tcp_next_port_to_try);
	}
	reuseaddr = sockets[sock_id].so_opt & SO_REUSEADDR;
	allocated_port = tcp_bindi(requested_port, &(tcp->tcp_bound_source),
	    reuseaddr, bind_to_req_port_only);

	if (allocated_port == 0) {
		errno = EADDRINUSE;
		return (-1);
	}
	tcp->tcp_lport = htons(allocated_port);
	*(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport;
	sockets[sock_id].bind.sin_port = tcp->tcp_lport;
	tcp->tcp_state = TCPS_BOUND;
	return (0);
}

/*
 * Check for duplicate TCP connections.
 */
static int
tcp_conn_check(tcp_t *tcp)
{
	int i;
	tcp_t *tmp_tcp;

	for (i = 0; i < MAXSOCKET; i++) {
		if (sockets[i].type != INETBOOT_STREAM)
			continue;
		/* Socket may not be closed but the TCP can be gone. */
		if ((tmp_tcp = (tcp_t *)sockets[i].pcb) == NULL)
			continue;
		/* We only care about TCP in states later than SYN_SENT. */
		if (tmp_tcp->tcp_state < TCPS_SYN_SENT)
			continue;
		if (tmp_tcp->tcp_lport != tcp->tcp_lport ||
		    tmp_tcp->tcp_fport != tcp->tcp_fport ||
		    tmp_tcp->tcp_bound_source != tcp->tcp_bound_source ||
		    tmp_tcp->tcp_remote != tcp->tcp_remote) {
			continue;
		} else {
			return (-1);
		}
	}
	return (0);
}

/* To handle a connect request. */
int
tcp_connect(int sock_id)
{
	tcp_t *tcp;
	in_addr_t dstaddr;
	in_port_t dstport;
	tcph_t	*tcph;
	int mss;
	mblk_t *syn_mp;

	if ((tcp = (tcp_t *)(sockets[sock_id].pcb)) == NULL) {
		errno = EINVAL;
		return (-1);
	}

	TCP_RUN_TIME_WAIT_COLLECTOR();

	dstaddr = sockets[sock_id].remote.sin_addr.s_addr;
	dstport = sockets[sock_id].remote.sin_port;

	/*
	 * Check for attempt to connect to INADDR_ANY or non-unicast addrress.
	 * We don't have enough info to check for broadcast addr, except
	 * for the all 1 broadcast.
	 */
	if (dstaddr == INADDR_ANY || IN_CLASSD(ntohl(dstaddr)) ||
	    dstaddr == INADDR_BROADCAST)  {
		/*
		 * SunOS 4.x and 4.3 BSD allow an application
		 * to connect a TCP socket to INADDR_ANY.
		 * When they do this, the kernel picks the
		 * address of one interface and uses it
		 * instead.  The kernel usually ends up
		 * picking the address of the loopback
		 * interface.  This is an undocumented feature.
		 * However, we provide the same thing here
		 * in order to have source and binary
		 * compatibility with SunOS 4.x.
		 * Update the T_CONN_REQ (sin/sin6) since it is used to
		 * generate the T_CONN_CON.
		 *
		 * Fail this for inetboot TCP.
		 */
		errno = EINVAL;
		return (-1);
	}

	/* It is not bound to any address yet... */
	if (tcp->tcp_bound_source == INADDR_ANY) {
		ipv4_getipaddr(&(sockets[sock_id].bind.sin_addr));
		/* We don't have an address! */
		if (ntohl(sockets[sock_id].bind.sin_addr.s_addr) ==
		    INADDR_ANY) {
			errno = EPROTO;
			return (-1);
		}
		tcp->tcp_bound_source = sockets[sock_id].bind.sin_addr.s_addr;
		tcp->tcp_ipha->ip_src.s_addr = tcp->tcp_bound_source;
	}

	/*
	 * Don't let an endpoint connect to itself.
	 */
	if (dstaddr == tcp->tcp_ipha->ip_src.s_addr &&
	    dstport == tcp->tcp_lport) {
		errno = EINVAL;
		return (-1);
	}

	tcp->tcp_ipha->ip_dst.s_addr = dstaddr;
	tcp->tcp_remote = dstaddr;
	tcph = tcp->tcp_tcph;
	*(uint16_t *)tcph->th_fport = dstport;
	tcp->tcp_fport = dstport;

	/*
	 * Don't allow this connection to completely duplicate
	 * an existing connection.
	 */
	if (tcp_conn_check(tcp) < 0) {
		errno = EADDRINUSE;
		return (-1);
	}

	/*
	 * Just make sure our rwnd is at
	 * least tcp_recv_hiwat_mss * MSS
	 * large, and round up to the nearest
	 * MSS.
	 *
	 * We do the round up here because
	 * we need to get the interface
	 * MTU first before we can do the
	 * round up.
	 */
	mss = tcp->tcp_mss - tcp->tcp_hdr_len;
	tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss),
	    tcp_recv_hiwat_minmss * mss);
	tcp->tcp_rwnd_max = tcp->tcp_rwnd;
	SET_WS_VALUE(tcp);
	U32_TO_ABE16((tcp->tcp_rwnd >> tcp->tcp_rcv_ws),
	    tcp->tcp_tcph->th_win);
	if (tcp->tcp_rcv_ws > 0 || tcp_wscale_always)
		tcp->tcp_snd_ws_ok = B_TRUE;

	/*
	 * Set tcp_snd_ts_ok to true
	 * so that tcp_xmit_mp will
	 * include the timestamp
	 * option in the SYN segment.
	 */
	if (tcp_tstamp_always ||
	    (tcp->tcp_rcv_ws && tcp_tstamp_if_wscale)) {
		tcp->tcp_snd_ts_ok = B_TRUE;
	}

	if (tcp_sack_permitted == 2 ||
	    tcp->tcp_snd_sack_ok) {
		assert(tcp->tcp_sack_info == NULL);
		if ((tcp->tcp_sack_info = (tcp_sack_info_t *)bkmem_zalloc(
		    sizeof (tcp_sack_info_t))) == NULL) {
			tcp->tcp_snd_sack_ok = B_FALSE;
		} else {
			tcp->tcp_snd_sack_ok = B_TRUE;
		}
	}
	/*
	 * Should we use ECN?  Note that the current
	 * default value (SunOS 5.9) of tcp_ecn_permitted
	 * is 2.  The reason for doing this is that there
	 * are equipments out there that will drop ECN
	 * enabled IP packets.  Setting it to 1 avoids
	 * compatibility problems.
	 */
	if (tcp_ecn_permitted == 2)
		tcp->tcp_ecn_ok = B_TRUE;

	tcp_iss_init(tcp);
	TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
	tcp->tcp_active_open = B_TRUE;

	tcp->tcp_state = TCPS_SYN_SENT;
	syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, tcp->tcp_iss, B_FALSE,
	    NULL, B_FALSE);
	if (syn_mp != NULL) {
		int ret;

		/* Dump the packet when debugging. */
		TCP_DUMP_PACKET("tcp_connect", syn_mp);
		/* Send out the SYN packet. */
		ret = ipv4_tcp_output(sock_id, syn_mp);
		freeb(syn_mp);
		/*
		 * errno ETIMEDOUT is set by the mac driver
		 * in case it is not able to receive ARP reply.
		 * TCP will retransmit this segment so we can
		 * ignore the ARP timeout.
		 */
		if ((ret < 0) && (errno != ETIMEDOUT)) {
			return (-1);
		}
		/* tcp_state_wait() will finish the 3 way handshake. */
		return (tcp_state_wait(sock_id, tcp, TCPS_ESTABLISHED));
	} else {
		errno = ENOBUFS;
		return (-1);
	}
}

/*
 * Common accept code.  Called by tcp_conn_request.
 * cr_pkt is the SYN packet.
 */
static int
tcp_accept_comm(tcp_t *listener, tcp_t *acceptor, mblk_t *cr_pkt,
    uint_t ip_hdr_len)
{
	tcph_t		*tcph;

#ifdef DEBUG
	printf("tcp_accept_comm #######################\n");
#endif

	/*
	 * When we get here, we know that the acceptor header template
	 * has already been initialized.
	 * However, it may not match the listener if the listener
	 * includes options...
	 * It may also not match the listener if the listener is v6 and
	 * and the acceptor is v4
	 */
	acceptor->tcp_lport = listener->tcp_lport;

	if (listener->tcp_ipversion == acceptor->tcp_ipversion) {
		if (acceptor->tcp_iphc_len != listener->tcp_iphc_len) {
			/*
			 * Listener had options of some sort; acceptor inherits.
			 * Free up the acceptor template and allocate one
			 * of the right size.
			 */
			bkmem_free(acceptor->tcp_iphc, acceptor->tcp_iphc_len);
			acceptor->tcp_iphc = bkmem_zalloc(
			    listener->tcp_iphc_len);
			if (acceptor->tcp_iphc == NULL) {
				acceptor->tcp_iphc_len = 0;
				return (ENOMEM);
			}
			acceptor->tcp_iphc_len = listener->tcp_iphc_len;
		}
		acceptor->tcp_hdr_len = listener->tcp_hdr_len;
		acceptor->tcp_ip_hdr_len = listener->tcp_ip_hdr_len;
		acceptor->tcp_tcp_hdr_len = listener->tcp_tcp_hdr_len;

		/*
		 * Copy the IP+TCP header template from listener to acceptor
		 */
		bcopy(listener->tcp_iphc, acceptor->tcp_iphc,
		    listener->tcp_hdr_len);
		acceptor->tcp_ipha = (struct ip *)acceptor->tcp_iphc;
		acceptor->tcp_tcph = (tcph_t *)(acceptor->tcp_iphc +
		    acceptor->tcp_ip_hdr_len);
	} else {
		prom_panic("tcp_accept_comm: version not equal");
	}

	/* Copy our new dest and fport from the connection request packet */
	if (acceptor->tcp_ipversion == IPV4_VERSION) {
		struct ip *ipha;

		ipha = (struct ip *)cr_pkt->b_rptr;
		acceptor->tcp_ipha->ip_dst = ipha->ip_src;
		acceptor->tcp_remote = ipha->ip_src.s_addr;
		acceptor->tcp_ipha->ip_src = ipha->ip_dst;
		acceptor->tcp_bound_source = ipha->ip_dst.s_addr;
		tcph = (tcph_t *)&cr_pkt->b_rptr[ip_hdr_len];
	} else {
		prom_panic("tcp_accept_comm: not IPv4");
	}
	bcopy(tcph->th_lport, acceptor->tcp_tcph->th_fport, sizeof (in_port_t));
	bcopy(acceptor->tcp_tcph->th_fport, &acceptor->tcp_fport,
	    sizeof (in_port_t));
	/*
	 * For an all-port proxy listener, the local port is determined by
	 * the port number field in the SYN packet.
	 */
	if (listener->tcp_lport == 0) {
		acceptor->tcp_lport = *(in_port_t *)tcph->th_fport;
		bcopy(tcph->th_fport, acceptor->tcp_tcph->th_lport,
		    sizeof (in_port_t));
	}
	/* Inherit various TCP parameters from the listener */
	acceptor->tcp_naglim = listener->tcp_naglim;
	acceptor->tcp_first_timer_threshold =
	    listener->tcp_first_timer_threshold;
	acceptor->tcp_second_timer_threshold =
	    listener->tcp_second_timer_threshold;

	acceptor->tcp_first_ctimer_threshold =
	    listener->tcp_first_ctimer_threshold;
	acceptor->tcp_second_ctimer_threshold =
	    listener->tcp_second_ctimer_threshold;

	acceptor->tcp_xmit_hiwater = listener->tcp_xmit_hiwater;

	acceptor->tcp_state = TCPS_LISTEN;
	tcp_iss_init(acceptor);

	/* Process all TCP options. */
	tcp_process_options(acceptor, tcph);

	/* Is the other end ECN capable? */
	if (tcp_ecn_permitted >= 1 &&
	    (tcph->th_flags[0] & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
		acceptor->tcp_ecn_ok = B_TRUE;
	}

	/*
	 * listener->tcp_rq->q_hiwat should be the default window size or a
	 * window size changed via SO_RCVBUF option.  First round up the
	 * acceptor's tcp_rwnd to the nearest MSS.  Then find out the window
	 * scale option value if needed.  Call tcp_rwnd_set() to finish the
	 * setting.
	 *
	 * Note if there is a rpipe metric associated with the remote host,
	 * we should not inherit receive window size from listener.
	 */
	acceptor->tcp_rwnd = MSS_ROUNDUP(
	    (acceptor->tcp_rwnd == 0 ? listener->tcp_rwnd_max :
	    acceptor->tcp_rwnd), acceptor->tcp_mss);
	if (acceptor->tcp_snd_ws_ok)
		SET_WS_VALUE(acceptor);
	/*
	 * Note that this is the only place tcp_rwnd_set() is called for
	 * accepting a connection.  We need to call it here instead of
	 * after the 3-way handshake because we need to tell the other
	 * side our rwnd in the SYN-ACK segment.
	 */
	(void) tcp_rwnd_set(acceptor, acceptor->tcp_rwnd);

	return (0);
}

/*
 * Defense for the SYN attack -
 * 1. When q0 is full, drop from the tail (tcp_eager_prev_q0) the oldest
 *    one that doesn't have the dontdrop bit set.
 * 2. Don't drop a SYN request before its first timeout. This gives every
 *    request at least til the first timeout to complete its 3-way handshake.
 * 3. The current threshold is - # of timeout > q0len/4 => SYN alert on
 *    # of timeout drops back to <= q0len/32 => SYN alert off
 */
static boolean_t
tcp_drop_q0(tcp_t *tcp)
{
	tcp_t	*eager;

	assert(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
	/*
	 * New one is added after next_q0 so prev_q0 points to the oldest
	 * Also do not drop any established connections that are deferred on
	 * q0 due to q being full
	 */

	eager = tcp->tcp_eager_prev_q0;
	while (eager->tcp_dontdrop || eager->tcp_conn_def_q0) {
		/* XXX should move the eager to the head */
		eager = eager->tcp_eager_prev_q0;
		if (eager == tcp) {
			eager = tcp->tcp_eager_prev_q0;
			break;
		}
	}
	dprintf("tcp_drop_q0: listen half-open queue (max=%d) overflow"
	    " (%d pending) on %s, drop one", tcp_conn_req_max_q0,
	    tcp->tcp_conn_req_cnt_q0,
	    tcp_display(tcp, NULL, DISP_PORT_ONLY));

	BUMP_MIB(tcp_mib.tcpHalfOpenDrop);
	bkmem_free((caddr_t)eager, sizeof (tcp_t));
	return (B_TRUE);
}

/* ARGSUSED */
static tcp_t *
tcp_conn_request(tcp_t *tcp, mblk_t *mp, uint_t sock_id, uint_t ip_hdr_len)
{
	tcp_t	*eager;
	struct ip *ipha;
	int	err;

#ifdef DEBUG
	printf("tcp_conn_request ###################\n");
#endif

	if (tcp->tcp_conn_req_cnt_q >= tcp->tcp_conn_req_max) {
		BUMP_MIB(tcp_mib.tcpListenDrop);
		dprintf("tcp_conn_request: listen backlog (max=%d) "
		    "overflow (%d pending) on %s",
		    tcp->tcp_conn_req_max, tcp->tcp_conn_req_cnt_q,
		    tcp_display(tcp, NULL, DISP_PORT_ONLY));
		return (NULL);
	}

	assert(OK_32PTR(mp->b_rptr));

	if (tcp->tcp_conn_req_cnt_q0 >=
	    tcp->tcp_conn_req_max + tcp_conn_req_max_q0) {
		/*
		 * Q0 is full. Drop a pending half-open req from the queue
		 * to make room for the new SYN req. Also mark the time we
		 * drop a SYN.
		 */
		tcp->tcp_last_rcv_lbolt = prom_gettime();
		if (!tcp_drop_q0(tcp)) {
			freemsg(mp);
			BUMP_MIB(tcp_mib.tcpListenDropQ0);
			dprintf("tcp_conn_request: listen half-open queue "
			    "(max=%d) full (%d pending) on %s",
			    tcp_conn_req_max_q0,
			    tcp->tcp_conn_req_cnt_q0,
			    tcp_display(tcp, NULL, DISP_PORT_ONLY));
			return (NULL);
		}
	}

	ipha = (struct ip *)mp->b_rptr;
	if (IN_CLASSD(ntohl(ipha->ip_src.s_addr)) ||
	    ipha->ip_src.s_addr == INADDR_BROADCAST ||
	    ipha->ip_src.s_addr == INADDR_ANY ||
	    ipha->ip_dst.s_addr == INADDR_BROADCAST) {
		freemsg(mp);
		return (NULL);
	}
	/*
	 * We allow the connection to proceed
	 * by generating a detached tcp state vector and put it in
	 * the eager queue.  When an accept happens, it will be
	 * dequeued sequentially.
	 */
	if ((eager = (tcp_t *)bkmem_alloc(sizeof (tcp_t))) == NULL) {
		freemsg(mp);
		errno = ENOBUFS;
		return (NULL);
	}
	if ((errno = tcp_init_values(eager, NULL)) != 0) {
		freemsg(mp);
		bkmem_free((caddr_t)eager, sizeof (tcp_t));
		return (NULL);
	}

	/*
	 * Eager connection inherits address form from its listener,
	 * but its packet form comes from the version of the received
	 * SYN segment.
	 */
	eager->tcp_family = tcp->tcp_family;

	err = tcp_accept_comm(tcp, eager, mp, ip_hdr_len);
	if (err) {
		bkmem_free((caddr_t)eager, sizeof (tcp_t));
		return (NULL);
	}

	tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
	eager->tcp_eager_next_q0 = tcp->tcp_eager_next_q0;
	tcp->tcp_eager_next_q0 = eager;
	eager->tcp_eager_prev_q0 = tcp;

	/* Set tcp_listener before adding it to tcp_conn_fanout */
	eager->tcp_listener = tcp;
	tcp->tcp_conn_req_cnt_q0++;

	return (eager);
}

/*
 * To get around the non-interrupt problem of inetboot.
 * Keep on processing packets until a certain state is reached or the
 * TCP is destroyed because of getting a RST packet.
 */
static int
tcp_state_wait(int sock_id, tcp_t *tcp, int state)
{
	int i;
	struct inetgram *in_gram;
	mblk_t *mp;
	int timeout;
	boolean_t changed = B_FALSE;

	/*
	 * We need to make sure that the MAC does not wait longer
	 * than RTO for any packet so that TCP can do retransmission.
	 * But if the MAC timeout is less than tcp_rto, we are fine
	 * and do not need to change it.
	 */
	timeout = sockets[sock_id].in_timeout;
	if (timeout > tcp->tcp_rto) {
		sockets[sock_id].in_timeout = tcp->tcp_rto;
		changed = B_TRUE;
	}
retry:
	if (sockets[sock_id].inq == NULL) {
		/* Go out and check the wire */
		for (i = MEDIA_LVL; i < TRANSPORT_LVL; i++) {
			if (sockets[sock_id].input[i] != NULL) {
				if (sockets[sock_id].input[i](sock_id) < 0) {
					if (changed) {
						sockets[sock_id].in_timeout =
						    timeout;
					}
					return (-1);
				}
			}
		}
	}

	while ((in_gram = sockets[sock_id].inq) != NULL) {
		if (tcp->tcp_state == state)
			break;

		/* Remove unknown inetgrams from the head of inq. */
		if (in_gram->igm_level != TRANSPORT_LVL) {
#ifdef DEBUG
			printf("tcp_state_wait for state %d: unexpected "
			    "packet level %d frame found\n", state,
			    in_gram->igm_level);
#endif
			del_gram(&sockets[sock_id].inq, in_gram, B_TRUE);
			continue;
		}
		mp = in_gram->igm_mp;
		del_gram(&sockets[sock_id].inq, in_gram, B_FALSE);
		bkmem_free((caddr_t)in_gram, sizeof (struct inetgram));
		tcp_rput_data(tcp, mp, sock_id);

		/*
		 * The other side may have closed this connection or
		 * RST us.  But we need to continue to process other
		 * packets in the socket's queue because they may be
		 * belong to another TCP connections.
		 */
		if (sockets[sock_id].pcb == NULL) {
			tcp = NULL;
		}
	}

	/* If the other side has closed the connection, just return. */
	if (tcp == NULL || sockets[sock_id].pcb == NULL) {
#ifdef DEBUG
		printf("tcp_state_wait other side dead: state %d "
		    "error %d\n", state, sockets[sock_id].so_error);
#endif
		if (sockets[sock_id].so_error != 0)
			return (-1);
		else
			return (0);
	}
	/*
	 * TCPS_ALL_ACKED is not a valid TCP state, it is just used as an
	 * indicator to tcp_state_wait to mean that it is being called
	 * to wait till we have received acks for all the new segments sent.
	 */
	if ((state == TCPS_ALL_ACKED) && (tcp->tcp_suna == tcp->tcp_snxt)) {
		goto done;
	}
	if (tcp->tcp_state != state) {
		if (prom_gettime() > tcp->tcp_rto_timeout)
			tcp_timer(tcp, sock_id);
		goto retry;
	}
done:
	if (changed)
		sockets[sock_id].in_timeout = timeout;

	tcp_drain_needed(sock_id, tcp);
	return (0);
}

/* Verify the checksum of a segment. */
static int
tcp_verify_cksum(mblk_t *mp)
{
	struct ip *iph;
	tcpha_t *tcph;
	int len;
	uint16_t old_sum;

	iph = (struct ip *)mp->b_rptr;
	tcph = (tcpha_t *)(iph + 1);
	len = ntohs(iph->ip_len);

	/*
	 * Calculate the TCP checksum.  Need to include the psuedo header,
	 * which is similar to the real IP header starting at the TTL field.
	 */
	iph->ip_sum = htons(len - IP_SIMPLE_HDR_LENGTH);
	old_sum = tcph->tha_sum;
	tcph->tha_sum = 0;
	iph->ip_ttl = 0;
	if (old_sum == tcp_cksum((uint16_t *)&(iph->ip_ttl),
	    len - IP_SIMPLE_HDR_LENGTH + 12)) {
		return (0);
	} else {
		tcp_cksum_errors++;
		return (-1);
	}
}

/* To find a TCP connection matching the incoming segment. */
static tcp_t *
tcp_lookup_ipv4(struct ip *iph, tcpha_t *tcph, int min_state, int *sock_id)
{
	int i;
	tcp_t *tcp;

	for (i = 0; i < MAXSOCKET; i++) {
		if (sockets[i].type == INETBOOT_STREAM &&
		    (tcp = (tcp_t *)sockets[i].pcb) != NULL) {
			if (tcph->tha_lport == tcp->tcp_fport &&
			    tcph->tha_fport == tcp->tcp_lport &&
			    iph->ip_src.s_addr == tcp->tcp_remote &&
			    iph->ip_dst.s_addr == tcp->tcp_bound_source &&
			    tcp->tcp_state >= min_state) {
				*sock_id = i;
				return (tcp);
			}
		}
	}
	/* Find it in the time wait list. */
	for (tcp = tcp_time_wait_head; tcp != NULL;
	    tcp = tcp->tcp_time_wait_next) {
		if (tcph->tha_lport == tcp->tcp_fport &&
		    tcph->tha_fport == tcp->tcp_lport &&
		    iph->ip_src.s_addr == tcp->tcp_remote &&
		    iph->ip_dst.s_addr == tcp->tcp_bound_source &&
		    tcp->tcp_state >= min_state) {
			*sock_id = -1;
			return (tcp);
		}
	}
	return (NULL);
}

/* To find a TCP listening connection matching the incoming segment. */
static tcp_t *
tcp_lookup_listener_ipv4(in_addr_t addr, in_port_t port, int *sock_id)
{
	int i;
	tcp_t *tcp;

	for (i = 0; i < MAXSOCKET; i++) {
		if (sockets[i].type == INETBOOT_STREAM &&
		    (tcp = (tcp_t *)sockets[i].pcb) != NULL) {
			if (tcp->tcp_lport == port &&
			    (tcp->tcp_bound_source == addr ||
			    tcp->tcp_bound_source == INADDR_ANY)) {
				*sock_id = i;
				return (tcp);
			}
		}
	}

	return (NULL);
}

/* To find a TCP eager matching the incoming segment. */
static tcp_t *
tcp_lookup_eager_ipv4(tcp_t *listener, struct ip *iph, tcpha_t *tcph)
{
	tcp_t *tcp;

#ifdef DEBUG
	printf("tcp_lookup_eager_ipv4 ###############\n");
#endif
	for (tcp = listener->tcp_eager_next_q; tcp != NULL;
	    tcp = tcp->tcp_eager_next_q) {
		if (tcph->tha_lport == tcp->tcp_fport &&
		    tcph->tha_fport == tcp->tcp_lport &&
		    iph->ip_src.s_addr == tcp->tcp_remote &&
		    iph->ip_dst.s_addr == tcp->tcp_bound_source) {
			return (tcp);
		}
	}

	for (tcp = listener->tcp_eager_next_q0; tcp != listener;
	    tcp = tcp->tcp_eager_next_q0) {
		if (tcph->tha_lport == tcp->tcp_fport &&
		    tcph->tha_fport == tcp->tcp_lport &&
		    iph->ip_src.s_addr == tcp->tcp_remote &&
		    iph->ip_dst.s_addr == tcp->tcp_bound_source) {
			return (tcp);
		}
	}
#ifdef DEBUG
	printf("No eager found\n");
#endif
	return (NULL);
}

/* To destroy a TCP control block. */
static void
tcp_clean_death(int sock_id, tcp_t *tcp, int err)
{
	tcp_free(tcp);
	if (tcp->tcp_state == TCPS_TIME_WAIT)
		tcp_time_wait_remove(tcp);

	if (sock_id >= 0) {
		sockets[sock_id].pcb = NULL;
		if (err != 0)
			sockets[sock_id].so_error = err;
	}
	bkmem_free((caddr_t)tcp, sizeof (tcp_t));
}

/*
 * tcp_rwnd_set() is called to adjust the receive window to a desired value.
 * We do not allow the receive window to shrink.  After setting rwnd,
 * set the flow control hiwat of the stream.
 *
 * This function is called in 2 cases:
 *
 * 1) Before data transfer begins, in tcp_accept_comm() for accepting a
 *    connection (passive open) and in tcp_rput_data() for active connect.
 *    This is called after tcp_mss_set() when the desired MSS value is known.
 *    This makes sure that our window size is a mutiple of the other side's
 *    MSS.
 * 2) Handling SO_RCVBUF option.
 *
 * It is ASSUMED that the requested size is a multiple of the current MSS.
 *
 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the
 * user requests so.
 */
static int
tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd)
{
	uint32_t	mss = tcp->tcp_mss;
	uint32_t	old_max_rwnd;
	uint32_t	max_transmittable_rwnd;

	if (tcp->tcp_rwnd_max != 0)
		old_max_rwnd = tcp->tcp_rwnd_max;
	else
		old_max_rwnd = tcp->tcp_rwnd;

	/*
	 * Insist on a receive window that is at least
	 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid
	 * funny TCP interactions of Nagle algorithm, SWS avoidance
	 * and delayed acknowledgement.
	 */
	rwnd = MAX(rwnd, tcp_recv_hiwat_minmss * mss);

	/*
	 * If window size info has already been exchanged, TCP should not
	 * shrink the window.  Shrinking window is doable if done carefully.
	 * We may add that support later.  But so far there is not a real
	 * need to do that.
	 */
	if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) {
		/* MSS may have changed, do a round up again. */
		rwnd = MSS_ROUNDUP(old_max_rwnd, mss);
	}

	/*
	 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check
	 * can be applied even before the window scale option is decided.
	 */
	max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws;
	if (rwnd > max_transmittable_rwnd) {
		rwnd = max_transmittable_rwnd -
		    (max_transmittable_rwnd % mss);
		if (rwnd < mss)
			rwnd = max_transmittable_rwnd;
		/*
		 * If we're over the limit we may have to back down tcp_rwnd.
		 * The increment below won't work for us. So we set all three
		 * here and the increment below will have no effect.
		 */
		tcp->tcp_rwnd = old_max_rwnd = rwnd;
	}

	/*
	 * Increment the current rwnd by the amount the maximum grew (we
	 * can not overwrite it since we might be in the middle of a
	 * connection.)
	 */
	tcp->tcp_rwnd += rwnd - old_max_rwnd;
	U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, tcp->tcp_tcph->th_win);
	if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
		tcp->tcp_cwnd_max = rwnd;
	tcp->tcp_rwnd_max = rwnd;

	return (rwnd);
}

/*
 * Extract option values from a tcp header.  We put any found values into the
 * tcpopt struct and return a bitmask saying which options were found.
 */
static int
tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt)
{
	uchar_t		*endp;
	int		len;
	uint32_t	mss;
	uchar_t		*up = (uchar_t *)tcph;
	int		found = 0;
	int32_t		sack_len;
	tcp_seq		sack_begin, sack_end;
	tcp_t		*tcp;

	endp = up + TCP_HDR_LENGTH(tcph);
	up += TCP_MIN_HEADER_LENGTH;
	while (up < endp) {
		len = endp - up;
		switch (*up) {
		case TCPOPT_EOL:
			break;

		case TCPOPT_NOP:
			up++;
			continue;

		case TCPOPT_MAXSEG:
			if (len < TCPOPT_MAXSEG_LEN ||
			    up[1] != TCPOPT_MAXSEG_LEN)
				break;

			mss = BE16_TO_U16(up+2);
			/* Caller must handle tcp_mss_min and tcp_mss_max_* */
			tcpopt->tcp_opt_mss = mss;
			found |= TCP_OPT_MSS_PRESENT;

			up += TCPOPT_MAXSEG_LEN;
			continue;

		case TCPOPT_WSCALE:
			if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
				break;

			if (up[2] > TCP_MAX_WINSHIFT)
				tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
			else
				tcpopt->tcp_opt_wscale = up[2];
			found |= TCP_OPT_WSCALE_PRESENT;

			up += TCPOPT_WS_LEN;
			continue;

		case TCPOPT_SACK_PERMITTED:
			if (len < TCPOPT_SACK_OK_LEN ||
			    up[1] != TCPOPT_SACK_OK_LEN)
				break;
			found |= TCP_OPT_SACK_OK_PRESENT;
			up += TCPOPT_SACK_OK_LEN;
			continue;

		case TCPOPT_SACK:
			if (len <= 2 || up[1] <= 2 || len < up[1])
				break;

			/* If TCP is not interested in SACK blks... */
			if ((tcp = tcpopt->tcp) == NULL) {
				up += up[1];
				continue;
			}
			sack_len = up[1] - TCPOPT_HEADER_LEN;
			up += TCPOPT_HEADER_LEN;

			/*
			 * If the list is empty, allocate one and assume
			 * nothing is sack'ed.
			 */
			assert(tcp->tcp_sack_info != NULL);
			if (tcp->tcp_notsack_list == NULL) {
				tcp_notsack_update(&(tcp->tcp_notsack_list),
				    tcp->tcp_suna, tcp->tcp_snxt,
				    &(tcp->tcp_num_notsack_blk),
				    &(tcp->tcp_cnt_notsack_list));

				/*
				 * Make sure tcp_notsack_list is not NULL.
				 * This happens when kmem_alloc(KM_NOSLEEP)
				 * returns NULL.
				 */
				if (tcp->tcp_notsack_list == NULL) {
					up += sack_len;
					continue;
				}
				tcp->tcp_fack = tcp->tcp_suna;
			}

			while (sack_len > 0) {
				if (up + 8 > endp) {
					up = endp;
					break;
				}
				sack_begin = BE32_TO_U32(up);
				up += 4;
				sack_end = BE32_TO_U32(up);
				up += 4;
				sack_len -= 8;
				/*
				 * Bounds checking.  Make sure the SACK
				 * info is within tcp_suna and tcp_snxt.
				 * If this SACK blk is out of bound, ignore
				 * it but continue to parse the following
				 * blks.
				 */
				if (SEQ_LEQ(sack_end, sack_begin) ||
				    SEQ_LT(sack_begin, tcp->tcp_suna) ||
				    SEQ_GT(sack_end, tcp->tcp_snxt)) {
					continue;
				}
				tcp_notsack_insert(&(tcp->tcp_notsack_list),
				    sack_begin, sack_end,
				    &(tcp->tcp_num_notsack_blk),
				    &(tcp->tcp_cnt_notsack_list));
				if (SEQ_GT(sack_end, tcp->tcp_fack)) {
					tcp->tcp_fack = sack_end;
				}
			}
			found |= TCP_OPT_SACK_PRESENT;
			continue;

		case TCPOPT_TSTAMP:
			if (len < TCPOPT_TSTAMP_LEN ||
			    up[1] != TCPOPT_TSTAMP_LEN)
				break;

			tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
			tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);

			found |= TCP_OPT_TSTAMP_PRESENT;

			up += TCPOPT_TSTAMP_LEN;
			continue;

		default:
			if (len <= 1 || len < (int)up[1] || up[1] == 0)
				break;
			up += up[1];
			continue;
		}
		break;
	}
	return (found);
}

/*
 * Set the mss associated with a particular tcp based on its current value,
 * and a new one passed in. Observe minimums and maximums, and reset
 * other state variables that we want to view as multiples of mss.
 *
 * This function is called in various places mainly because
 * 1) Various stuffs, tcp_mss, tcp_cwnd, ... need to be adjusted when the
 *    other side's SYN/SYN-ACK packet arrives.
 * 2) PMTUd may get us a new MSS.
 * 3) If the other side stops sending us timestamp option, we need to
 *    increase the MSS size to use the extra bytes available.
 */
static void
tcp_mss_set(tcp_t *tcp, uint32_t mss)
{
	uint32_t	mss_max;

	mss_max = tcp_mss_max_ipv4;

	if (mss < tcp_mss_min)
		mss = tcp_mss_min;
	if (mss > mss_max)
		mss = mss_max;
	/*
	 * Unless naglim has been set by our client to
	 * a non-mss value, force naglim to track mss.
	 * This can help to aggregate small writes.
	 */
	if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
		tcp->tcp_naglim = mss;
	/*
	 * TCP should be able to buffer at least 4 MSS data for obvious
	 * performance reason.
	 */
	if ((mss << 2) > tcp->tcp_xmit_hiwater)
		tcp->tcp_xmit_hiwater = mss << 2;
	tcp->tcp_mss = mss;
	/*
	 * Initialize cwnd according to draft-floyd-incr-init-win-01.txt.
	 * Previously, we use tcp_slow_start_initial to control the size
	 * of the initial cwnd.  Now, when tcp_slow_start_initial * mss
	 * is smaller than the cwnd calculated from the formula suggested in
	 * the draft, we use tcp_slow_start_initial * mss as the cwnd.
	 * Otherwise, use the cwnd from the draft's formula.  The default
	 * of tcp_slow_start_initial is 2.
	 */
	tcp->tcp_cwnd = MIN(tcp_slow_start_initial * mss,
	    MIN(4 * mss, MAX(2 * mss, 4380 / mss * mss)));
	tcp->tcp_cwnd_cnt = 0;
}

/*
 * Process all TCP option in SYN segment.
 *
 * This function sets up the correct tcp_mss value according to the
 * MSS option value and our header size.  It also sets up the window scale
 * and timestamp values, and initialize SACK info blocks.  But it does not
 * change receive window size after setting the tcp_mss value.  The caller
 * should do the appropriate change.
 */
void
tcp_process_options(tcp_t *tcp, tcph_t *tcph)
{
	int options;
	tcp_opt_t tcpopt;
	uint32_t mss_max;
	char *tmp_tcph;

	tcpopt.tcp = NULL;
	options = tcp_parse_options(tcph, &tcpopt);

	/*
	 * Process MSS option.  Note that MSS option value does not account
	 * for IP or TCP options.  This means that it is equal to MTU - minimum
	 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
	 * IPv6.
	 */
	if (!(options & TCP_OPT_MSS_PRESENT)) {
		tcpopt.tcp_opt_mss = tcp_mss_def_ipv4;
	} else {
		if (tcp->tcp_ipversion == IPV4_VERSION)
			mss_max = tcp_mss_max_ipv4;
		if (tcpopt.tcp_opt_mss < tcp_mss_min)
			tcpopt.tcp_opt_mss = tcp_mss_min;
		else if (tcpopt.tcp_opt_mss > mss_max)
			tcpopt.tcp_opt_mss = mss_max;
	}

	/* Process Window Scale option. */
	if (options & TCP_OPT_WSCALE_PRESENT) {
		tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
		tcp->tcp_snd_ws_ok = B_TRUE;
	} else {
		tcp->tcp_snd_ws = B_FALSE;
		tcp->tcp_snd_ws_ok = B_FALSE;
		tcp->tcp_rcv_ws = B_FALSE;
	}

	/* Process Timestamp option. */
	if ((options & TCP_OPT_TSTAMP_PRESENT) &&
	    (tcp->tcp_snd_ts_ok || !tcp->tcp_active_open)) {
		tmp_tcph = (char *)tcp->tcp_tcph;

		tcp->tcp_snd_ts_ok = B_TRUE;
		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
		tcp->tcp_last_rcv_lbolt = prom_gettime();
		assert(OK_32PTR(tmp_tcph));
		assert(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH);

		/* Fill in our template header with basic timestamp option. */
		tmp_tcph += tcp->tcp_tcp_hdr_len;
		tmp_tcph[0] = TCPOPT_NOP;
		tmp_tcph[1] = TCPOPT_NOP;
		tmp_tcph[2] = TCPOPT_TSTAMP;
		tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
		tcp->tcp_hdr_len += TCPOPT_REAL_TS_LEN;
		tcp->tcp_tcp_hdr_len += TCPOPT_REAL_TS_LEN;
		tcp->tcp_tcph->th_offset_and_rsrvd[0] += (3 << 4);
	} else {
		tcp->tcp_snd_ts_ok = B_FALSE;
	}

	/*
	 * Process SACK options.  If SACK is enabled for this connection,
	 * then allocate the SACK info structure.
	 */
	if ((options & TCP_OPT_SACK_OK_PRESENT) &&
	    (tcp->tcp_snd_sack_ok ||
	    (tcp_sack_permitted != 0 && !tcp->tcp_active_open))) {
		/* This should be true only in the passive case. */
		if (tcp->tcp_sack_info == NULL) {
			tcp->tcp_sack_info = (tcp_sack_info_t *)bkmem_zalloc(
			    sizeof (tcp_sack_info_t));
		}
		if (tcp->tcp_sack_info == NULL) {
			tcp->tcp_snd_sack_ok = B_FALSE;
		} else {
			tcp->tcp_snd_sack_ok = B_TRUE;
			if (tcp->tcp_snd_ts_ok) {
				tcp->tcp_max_sack_blk = 3;
			} else {
				tcp->tcp_max_sack_blk = 4;
			}
		}
	} else {
		/*
		 * Resetting tcp_snd_sack_ok to B_FALSE so that
		 * no SACK info will be used for this
		 * connection.  This assumes that SACK usage
		 * permission is negotiated.  This may need
		 * to be changed once this is clarified.
		 */
		if (tcp->tcp_sack_info != NULL) {
			bkmem_free((caddr_t)tcp->tcp_sack_info,
			    sizeof (tcp_sack_info_t));
			tcp->tcp_sack_info = NULL;
		}
		tcp->tcp_snd_sack_ok = B_FALSE;
	}

	/*
	 * Now we know the exact TCP/IP header length, subtract
	 * that from tcp_mss to get our side's MSS.
	 */
	tcp->tcp_mss -= tcp->tcp_hdr_len;
	/*
	 * Here we assume that the other side's header size will be equal to
	 * our header size.  We calculate the real MSS accordingly.  Need to
	 * take into additional stuffs IPsec puts in.
	 *
	 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
	 */
	tcpopt.tcp_opt_mss -= tcp->tcp_hdr_len -
	    (IP_SIMPLE_HDR_LENGTH + TCP_MIN_HEADER_LENGTH);

	/*
	 * Set MSS to the smaller one of both ends of the connection.
	 * We should not have called tcp_mss_set() before, but our
	 * side of the MSS should have been set to a proper value
	 * by tcp_adapt_ire().  tcp_mss_set() will also set up the
	 * STREAM head parameters properly.
	 *
	 * If we have a larger-than-16-bit window but the other side
	 * didn't want to do window scale, tcp_rwnd_set() will take
	 * care of that.
	 */
	tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
}

/*
 * This function does PAWS protection check.  Returns B_TRUE if the
 * segment passes the PAWS test, else returns B_FALSE.
 */
boolean_t
tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp)
{
	uint8_t	flags;
	int	options;
	uint8_t *up;

	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
	/*
	 * If timestamp option is aligned nicely, get values inline,
	 * otherwise call general routine to parse.  Only do that
	 * if timestamp is the only option.
	 */
	if (TCP_HDR_LENGTH(tcph) == (uint32_t)TCP_MIN_HEADER_LENGTH +
	    TCPOPT_REAL_TS_LEN &&
	    OK_32PTR((up = ((uint8_t *)tcph) +
	    TCP_MIN_HEADER_LENGTH)) &&
	    *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
		tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4));
		tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));

		options = TCP_OPT_TSTAMP_PRESENT;
	} else {
		if (tcp->tcp_snd_sack_ok) {
			tcpoptp->tcp = tcp;
		} else {
			tcpoptp->tcp = NULL;
		}
		options = tcp_parse_options(tcph, tcpoptp);
	}

	if (options & TCP_OPT_TSTAMP_PRESENT) {
		/*
		 * Do PAWS per RFC 1323 section 4.2.  Accept RST
		 * regardless of the timestamp, page 18 RFC 1323.bis.
		 */
		if ((flags & TH_RST) == 0 &&
		    TSTMP_LT(tcpoptp->tcp_opt_ts_val,
		    tcp->tcp_ts_recent)) {
			if (TSTMP_LT(prom_gettime(),
			    tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
				/* This segment is not acceptable. */
				return (B_FALSE);
			} else {
				/*
				 * Connection has been idle for
				 * too long.  Reset the timestamp
				 * and assume the segment is valid.
				 */
				tcp->tcp_ts_recent =
				    tcpoptp->tcp_opt_ts_val;
			}
		}
	} else {
		/*
		 * If we don't get a timestamp on every packet, we
		 * figure we can't really trust 'em, so we stop sending
		 * and parsing them.
		 */
		tcp->tcp_snd_ts_ok = B_FALSE;

		tcp->tcp_hdr_len -= TCPOPT_REAL_TS_LEN;
		tcp->tcp_tcp_hdr_len -= TCPOPT_REAL_TS_LEN;
		tcp->tcp_tcph->th_offset_and_rsrvd[0] -= (3 << 4);
		tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN);
		if (tcp->tcp_snd_sack_ok) {
			assert(tcp->tcp_sack_info != NULL);
			tcp->tcp_max_sack_blk = 4;
		}
	}
	return (B_TRUE);
}

/*
 * tcp_get_seg_mp() is called to get the pointer to a segment in the
 * send queue which starts at the given seq. no.
 *
 * Parameters:
 *	tcp_t *tcp: the tcp instance pointer.
 *	uint32_t seq: the starting seq. no of the requested segment.
 *	int32_t *off: after the execution, *off will be the offset to
 *		the returned mblk which points to the requested seq no.
 *
 * Return:
 *	A mblk_t pointer pointing to the requested segment in send queue.
 */
static mblk_t *
tcp_get_seg_mp(tcp_t *tcp, uint32_t seq, int32_t *off)
{
	int32_t	cnt;
	mblk_t	*mp;

	/* Defensive coding.  Make sure we don't send incorrect data. */
	if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt) ||
	    off == NULL) {
		return (NULL);
	}
	cnt = seq - tcp->tcp_suna;
	mp = tcp->tcp_xmit_head;
	while (cnt > 0 && mp) {
		cnt -= mp->b_wptr - mp->b_rptr;
		if (cnt < 0) {
			cnt += mp->b_wptr - mp->b_rptr;
			break;
		}
		mp = mp->b_cont;
	}
	assert(mp != NULL);
	*off = cnt;
	return (mp);
}

/*
 * This function handles all retransmissions if SACK is enabled for this
 * connection.  First it calculates how many segments can be retransmitted
 * based on tcp_pipe.  Then it goes thru the notsack list to find eligible
 * segments.  A segment is eligible if sack_cnt for that segment is greater
 * than or equal tcp_dupack_fast_retransmit.  After it has retransmitted
 * all eligible segments, it checks to see if TCP can send some new segments
 * (fast recovery).  If it can, it returns 1.  Otherwise it returns 0.
 *
 * Parameters:
 *	tcp_t *tcp: the tcp structure of the connection.
 *
 * Return:
 *	1 if the pipe is not full (new data can be sent), 0 otherwise
 */
static int32_t
tcp_sack_rxmit(tcp_t *tcp, int sock_id)
{
	notsack_blk_t	*notsack_blk;
	int32_t		usable_swnd;
	int32_t		mss;
	uint32_t	seg_len;
	mblk_t		*xmit_mp;

	assert(tcp->tcp_sack_info != NULL);
	assert(tcp->tcp_notsack_list != NULL);
	assert(tcp->tcp_rexmit == B_FALSE);

	/* Defensive coding in case there is a bug... */
	if (tcp->tcp_notsack_list == NULL) {
		return (0);
	}
	notsack_blk = tcp->tcp_notsack_list;
	mss = tcp->tcp_mss;

	/*
	 * Limit the num of outstanding data in the network to be
	 * tcp_cwnd_ssthresh, which is half of the original congestion wnd.
	 */
	usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe;

	/* At least retransmit 1 MSS of data. */
	if (usable_swnd <= 0) {
		usable_swnd = mss;
	}

	/* Make sure no new RTT samples will be taken. */
	tcp->tcp_csuna = tcp->tcp_snxt;

	notsack_blk = tcp->tcp_notsack_list;
	while (usable_swnd > 0) {
		mblk_t		*snxt_mp, *tmp_mp;
		tcp_seq		begin = tcp->tcp_sack_snxt;
		tcp_seq		end;
		int32_t		off;

		for (; notsack_blk != NULL; notsack_blk = notsack_blk->next) {
			if (SEQ_GT(notsack_blk->end, begin) &&
			    (notsack_blk->sack_cnt >=
			    tcp_dupack_fast_retransmit)) {
				end = notsack_blk->end;
				if (SEQ_LT(begin, notsack_blk->begin)) {
					begin = notsack_blk->begin;
				}
				break;
			}
		}
		/*
		 * All holes are filled.  Manipulate tcp_cwnd to send more
		 * if we can.  Note that after the SACK recovery, tcp_cwnd is
		 * set to tcp_cwnd_ssthresh.
		 */
		if (notsack_blk == NULL) {
			usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe;
			if (usable_swnd <= 0) {
				tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna;
				assert(tcp->tcp_cwnd > 0);
				return (0);
			} else {
				usable_swnd = usable_swnd / mss;
				tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna +
				    MAX(usable_swnd * mss, mss);
				return (1);
			}
		}

		/*
		 * Note that we may send more than usable_swnd allows here
		 * because of round off, but no more than 1 MSS of data.
		 */
		seg_len = end - begin;
		if (seg_len > mss)
			seg_len = mss;
		snxt_mp = tcp_get_seg_mp(tcp, begin, &off);
		assert(snxt_mp != NULL);
		/* This should not happen.  Defensive coding again... */
		if (snxt_mp == NULL) {
			return (0);
		}

		xmit_mp = tcp_xmit_mp(tcp, snxt_mp, seg_len, &off,
		    &tmp_mp, begin, B_TRUE, &seg_len, B_TRUE);

		if (xmit_mp == NULL)
			return (0);

		usable_swnd -= seg_len;
		tcp->tcp_pipe += seg_len;
		tcp->tcp_sack_snxt = begin + seg_len;
		TCP_DUMP_PACKET("tcp_sack_rxmit", xmit_mp);
		(void) ipv4_tcp_output(sock_id, xmit_mp);
		freeb(xmit_mp);

		/*
		 * Update the send timestamp to avoid false retransmission.
		 * Note. use uintptr_t to suppress the gcc warning.
		 */
		snxt_mp->b_prev = (mblk_t *)(uintptr_t)prom_gettime();

		BUMP_MIB(tcp_mib.tcpRetransSegs);
		UPDATE_MIB(tcp_mib.tcpRetransBytes, seg_len);
		BUMP_MIB(tcp_mib.tcpOutSackRetransSegs);
		/*
		 * Update tcp_rexmit_max to extend this SACK recovery phase.
		 * This happens when new data sent during fast recovery is
		 * also lost.  If TCP retransmits those new data, it needs
		 * to extend SACK recover phase to avoid starting another
		 * fast retransmit/recovery unnecessarily.
		 */
		if (SEQ_GT(tcp->tcp_sack_snxt, tcp->tcp_rexmit_max)) {
			tcp->tcp_rexmit_max = tcp->tcp_sack_snxt;
		}
	}
	return (0);
}

static void
tcp_rput_data(tcp_t *tcp, mblk_t *mp, int sock_id)
{
	uchar_t		*rptr;
	struct ip	*iph;
	tcp_t		*tcp1;
	tcpha_t		*tcph;
	uint32_t	seg_ack;
	int		seg_len;
	uint_t		ip_hdr_len;
	uint32_t	seg_seq;
	mblk_t		*mp1;
	uint_t		flags;
	uint32_t	new_swnd = 0;
	int		mss;
	boolean_t	ofo_seg = B_FALSE; /* Out of order segment */
	int32_t		gap;
	int32_t		rgap;
	tcp_opt_t	tcpopt;
	int32_t		bytes_acked;
	int		npkt;
	uint32_t	cwnd;
	uint32_t	add;

#ifdef DEBUG
	printf("tcp_rput_data sock %d mp %x mp_datap %x #################\n",
	    sock_id, mp, mp->b_datap);
#endif

	/* Dump the packet when debugging. */
	TCP_DUMP_PACKET("tcp_rput_data", mp);

	assert(OK_32PTR(mp->b_rptr));

	rptr = mp->b_rptr;
	iph = (struct ip *)rptr;
	ip_hdr_len = IPH_HDR_LENGTH(rptr);
	if (ip_hdr_len != IP_SIMPLE_HDR_LENGTH) {
#ifdef DEBUG
		printf("Not simple IP header\n");
#endif
		/* We cannot handle IP option yet... */
		tcp_drops++;
		freeb(mp);
		return;
	}
	/* The TCP header must be aligned. */
	tcph = (tcpha_t *)&rptr[ip_hdr_len];
	seg_seq = ntohl(tcph->tha_seq);
	seg_ack = ntohl(tcph->tha_ack);
	assert((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
	seg_len = (int)(mp->b_wptr - rptr) -
	    (ip_hdr_len + TCP_HDR_LENGTH(((tcph_t *)tcph)));
	/* In inetboot, b_cont should always be NULL. */
	assert(mp->b_cont == NULL);

	/* Verify the checksum. */
	if (tcp_verify_cksum(mp) < 0) {
#ifdef DEBUG
		printf("tcp_rput_data: wrong cksum\n");
#endif
		freemsg(mp);
		return;
	}

	/*
	 * This segment is not for us, try to find its
	 * intended receiver.
	 */
	if (tcp == NULL ||
	    tcph->tha_lport != tcp->tcp_fport ||
	    tcph->tha_fport != tcp->tcp_lport ||
	    iph->ip_src.s_addr != tcp->tcp_remote ||
	    iph->ip_dst.s_addr != tcp->tcp_bound_source) {
#ifdef DEBUG
		printf("tcp_rput_data: not for us, state %d\n",
		    tcp->tcp_state);
#endif
		/*
		 * First try to find a established connection.  If none
		 * is found, look for a listener.
		 *
		 * If a listener is found, we need to check to see if the
		 * incoming segment is for one of its eagers.  If it is,
		 * give it to the eager.  If not, listener should take care
		 * of it.
		 */
		if ((tcp1 = tcp_lookup_ipv4(iph, tcph, TCPS_SYN_SENT,
		    &sock_id)) != NULL ||
		    (tcp1 = tcp_lookup_listener_ipv4(iph->ip_dst.s_addr,
		    tcph->tha_fport, &sock_id)) != NULL) {
			if (tcp1->tcp_state == TCPS_LISTEN) {
				if ((tcp = tcp_lookup_eager_ipv4(tcp1,
				    iph, tcph)) == NULL) {
					/* No eager... sent to listener */
#ifdef DEBUG
					printf("found the listener: %s\n",
					    tcp_display(tcp1, NULL,
					    DISP_ADDR_AND_PORT));
#endif
					tcp = tcp1;
				}
#ifdef DEBUG
				else {
					printf("found the eager: %s\n",
					    tcp_display(tcp, NULL,
					    DISP_ADDR_AND_PORT));
				}
#endif
			} else {
				/* Non listener found... */
#ifdef DEBUG
				printf("found the connection: %s\n",
				    tcp_display(tcp1, NULL,
				    DISP_ADDR_AND_PORT));
#endif
				tcp = tcp1;
			}
		} else {
			/*
			 * No connection for this segment...
			 * Send a RST to the other side.
			 */
			tcp_xmit_listeners_reset(sock_id, mp, ip_hdr_len);
			return;
		}
	}

	flags = tcph->tha_flags & 0xFF;
	BUMP_MIB(tcp_mib.tcpInSegs);
	if (tcp->tcp_state == TCPS_TIME_WAIT) {
		tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
		    seg_len, (tcph_t *)tcph, sock_id);
		return;
	}
	/*
	 * From this point we can assume that the tcp is not compressed,
	 * since we would have branched off to tcp_time_wait_processing()
	 * in such a case.
	 */
	assert(tcp != NULL && tcp->tcp_state != TCPS_TIME_WAIT);

	/*
	 * After this point, we know we have the correct TCP, so update
	 * the receive time.
	 */
	tcp->tcp_last_recv_time = prom_gettime();

	/* In inetboot, we do not handle urgent pointer... */
	if (flags & TH_URG) {
		freemsg(mp);
		DEBUG_1("tcp_rput_data(%d): received segment with urgent "
		    "pointer\n", sock_id);
		tcp_drops++;
		return;
	}

	switch (tcp->tcp_state) {
	case TCPS_LISTEN:
		if ((flags & (TH_RST | TH_ACK | TH_SYN)) != TH_SYN) {
			if (flags & TH_RST) {
				freemsg(mp);
				return;
			}
			if (flags & TH_ACK) {
				tcp_xmit_early_reset("TCPS_LISTEN-TH_ACK",
				    sock_id, mp, seg_ack, 0, TH_RST,
				    ip_hdr_len);
				return;
			}
			if (!(flags & TH_SYN)) {
				freemsg(mp);
				return;
			}
			printf("tcp_rput_data: %d\n", __LINE__);
			prom_panic("inetboot");
		}
		if (tcp->tcp_conn_req_max > 0) {
			tcp = tcp_conn_request(tcp, mp, sock_id, ip_hdr_len);
			if (tcp == NULL) {
				freemsg(mp);
				return;
			}
#ifdef DEBUG
			printf("tcp_rput_data: new tcp created\n");
#endif
		}
		tcp->tcp_irs = seg_seq;
		tcp->tcp_rack = seg_seq;
		tcp->tcp_rnxt = seg_seq + 1;
		U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack);
		BUMP_MIB(tcp_mib.tcpPassiveOpens);
		goto syn_rcvd;
	case TCPS_SYN_SENT:
		if (flags & TH_ACK) {
			/*
			 * Note that our stack cannot send data before a
			 * connection is established, therefore the
			 * following check is valid.  Otherwise, it has
			 * to be changed.
			 */
			if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
			    SEQ_GT(seg_ack, tcp->tcp_snxt)) {
				if (flags & TH_RST) {
					freemsg(mp);
					return;
				}
				tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
				    tcp, mp, seg_ack, 0, TH_RST,
				    ip_hdr_len, sock_id);
				return;
			}
			assert(tcp->tcp_suna + 1 == seg_ack);
		}
		if (flags & TH_RST) {
			freemsg(mp);
			if (flags & TH_ACK) {
				tcp_clean_death(sock_id, tcp, ECONNREFUSED);
			}
			return;
		}
		if (!(flags & TH_SYN)) {
			freemsg(mp);
			return;
		}

		/* Process all TCP options. */
		tcp_process_options(tcp, (tcph_t *)tcph);
		/*
		 * The following changes our rwnd to be a multiple of the
		 * MIN(peer MSS, our MSS) for performance reason.
		 */
		(void) tcp_rwnd_set(tcp, MSS_ROUNDUP(tcp->tcp_rwnd,
		    tcp->tcp_mss));

		/* Is the other end ECN capable? */
		if (tcp->tcp_ecn_ok) {
			if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
				tcp->tcp_ecn_ok = B_FALSE;
			}
		}
		/*
		 * Clear ECN flags because it may interfere with later
		 * processing.
		 */
		flags &= ~(TH_ECE|TH_CWR);

		tcp->tcp_irs = seg_seq;
		tcp->tcp_rack = seg_seq;
		tcp->tcp_rnxt = seg_seq + 1;
		U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack);

		if (flags & TH_ACK) {
			/* One for the SYN */
			tcp->tcp_suna = tcp->tcp_iss + 1;
			tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
			tcp->tcp_state = TCPS_ESTABLISHED;

			/*
			 * If SYN was retransmitted, need to reset all
			 * retransmission info.  This is because this
			 * segment will be treated as a dup ACK.
			 */
			if (tcp->tcp_rexmit) {
				tcp->tcp_rexmit = B_FALSE;
				tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
				tcp->tcp_rexmit_max = tcp->tcp_snxt;
				tcp->tcp_snd_burst = TCP_CWND_NORMAL;

				/*
				 * Set tcp_cwnd back to 1 MSS, per
				 * recommendation from
				 * draft-floyd-incr-init-win-01.txt,
				 * Increasing TCP's Initial Window.
				 */
				tcp->tcp_cwnd = tcp->tcp_mss;
			}

			tcp->tcp_swl1 = seg_seq;
			tcp->tcp_swl2 = seg_ack;

			new_swnd = BE16_TO_U16(((tcph_t *)tcph)->th_win);
			tcp->tcp_swnd = new_swnd;
			if (new_swnd > tcp->tcp_max_swnd)
				tcp->tcp_max_swnd = new_swnd;

			/*
			 * Always send the three-way handshake ack immediately
			 * in order to make the connection complete as soon as
			 * possible on the accepting host.
			 */
			flags |= TH_ACK_NEEDED;
			/*
			 * Check to see if there is data to be sent.  If
			 * yes, set the transmit flag.  Then check to see
			 * if received data processing needs to be done.
			 * If not, go straight to xmit_check.  This short
			 * cut is OK as we don't support T/TCP.
			 */
			if (tcp->tcp_unsent)
				flags |= TH_XMIT_NEEDED;

			if (seg_len == 0) {
				freemsg(mp);
				goto xmit_check;
			}

			flags &= ~TH_SYN;
			seg_seq++;
			break;
		}
		syn_rcvd:
		tcp->tcp_state = TCPS_SYN_RCVD;
		mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
		    NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
		if (mp1 != NULL) {
			TCP_DUMP_PACKET("tcp_rput_data replying SYN", mp1);
			(void) ipv4_tcp_output(sock_id, mp1);
			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
			freeb(mp1);
			/*
			 * Let's wait till our SYN has been ACKED since we
			 * don't have a timer.
			 */
			if (tcp_state_wait(sock_id, tcp, TCPS_ALL_ACKED) < 0) {
				freemsg(mp);
				return;
			}
		}
		freemsg(mp);
		return;
	default:
		break;
	}
	mp->b_rptr = (uchar_t *)tcph + TCP_HDR_LENGTH((tcph_t *)tcph);
	new_swnd = ntohs(tcph->tha_win) <<
	    ((flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
	mss = tcp->tcp_mss;

	if (tcp->tcp_snd_ts_ok) {
		if (!tcp_paws_check(tcp, (tcph_t *)tcph, &tcpopt)) {
			/*
			 * This segment is not acceptable.
			 * Drop it and send back an ACK.
			 */
			freemsg(mp);
			flags |= TH_ACK_NEEDED;
			goto ack_check;
		}
	} else if (tcp->tcp_snd_sack_ok) {
		assert(tcp->tcp_sack_info != NULL);
		tcpopt.tcp = tcp;
		/*
		 * SACK info in already updated in tcp_parse_options.  Ignore
		 * all other TCP options...
		 */
		(void) tcp_parse_options((tcph_t *)tcph, &tcpopt);
	}
try_again:;
	gap = seg_seq - tcp->tcp_rnxt;
	rgap = tcp->tcp_rwnd - (gap + seg_len);
	/*
	 * gap is the amount of sequence space between what we expect to see
	 * and what we got for seg_seq.  A positive value for gap means
	 * something got lost.  A negative value means we got some old stuff.
	 */
	if (gap < 0) {
		/* Old stuff present.  Is the SYN in there? */
		if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
		    (seg_len != 0)) {
			flags &= ~TH_SYN;
			seg_seq++;
			/* Recompute the gaps after noting the SYN. */
			goto try_again;
		}
		BUMP_MIB(tcp_mib.tcpInDataDupSegs);
		UPDATE_MIB(tcp_mib.tcpInDataDupBytes,
		    (seg_len > -gap ? -gap : seg_len));
		/* Remove the old stuff from seg_len. */
		seg_len += gap;
		/*
		 * Anything left?
		 * Make sure to check for unack'd FIN when rest of data
		 * has been previously ack'd.
		 */
		if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
			/*
			 * Resets are only valid if they lie within our offered
			 * window.  If the RST bit is set, we just ignore this
			 * segment.
			 */
			if (flags & TH_RST) {
				freemsg(mp);
				return;
			}

			/*
			 * This segment is "unacceptable".  None of its
			 * sequence space lies within our advertized window.
			 *
			 * Adjust seg_len to the original value for tracing.
			 */
			seg_len -= gap;
#ifdef DEBUG
			printf("tcp_rput: unacceptable, gap %d, rgap "
			    "%d, flags 0x%x, seg_seq %u, seg_ack %u, "
			    "seg_len %d, rnxt %u, snxt %u, %s",
			    gap, rgap, flags, seg_seq, seg_ack,
			    seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
			    tcp_display(tcp, NULL, DISP_ADDR_AND_PORT));
#endif

			/*
			 * Arrange to send an ACK in response to the
			 * unacceptable segment per RFC 793 page 69. There
			 * is only one small difference between ours and the
			 * acceptability test in the RFC - we accept ACK-only
			 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
			 * will be generated.
			 *
			 * Note that we have to ACK an ACK-only packet at least
			 * for stacks that send 0-length keep-alives with
			 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
			 * section 4.2.3.6. As long as we don't ever generate
			 * an unacceptable packet in response to an incoming
			 * packet that is unacceptable, it should not cause
			 * "ACK wars".
			 */
			flags |=  TH_ACK_NEEDED;

			/*
			 * Continue processing this segment in order to use the
			 * ACK information it contains, but skip all other
			 * sequence-number processing.	Processing the ACK
			 * information is necessary in order to
			 * re-synchronize connections that may have lost
			 * synchronization.
			 *
			 * We clear seg_len and flag fields related to
			 * sequence number processing as they are not
			 * to be trusted for an unacceptable segment.
			 */
			seg_len = 0;
			flags &= ~(TH_SYN | TH_FIN | TH_URG);
			goto process_ack;
		}

		/* Fix seg_seq, and chew the gap off the front. */
		seg_seq = tcp->tcp_rnxt;
		do {
			mblk_t	*mp2;
			assert((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
			    (uintptr_t)UINT_MAX);
			gap += (uint_t)(mp->b_wptr - mp->b_rptr);
			if (gap > 0) {
				mp->b_rptr = mp->b_wptr - gap;
				break;
			}
			mp2 = mp;
			mp = mp->b_cont;
			freeb(mp2);
		} while (gap < 0);
	}
	/*
	 * rgap is the amount of stuff received out of window.  A negative
	 * value is the amount out of window.
	 */
	if (rgap < 0) {
		mblk_t	*mp2;

		if (tcp->tcp_rwnd == 0)
			BUMP_MIB(tcp_mib.tcpInWinProbe);
		else {
			BUMP_MIB(tcp_mib.tcpInDataPastWinSegs);
			UPDATE_MIB(tcp_mib.tcpInDataPastWinBytes, -rgap);
		}

		/*
		 * seg_len does not include the FIN, so if more than
		 * just the FIN is out of window, we act like we don't
		 * see it.  (If just the FIN is out of window, rgap
		 * will be zero and we will go ahead and acknowledge
		 * the FIN.)
		 */
		flags &= ~TH_FIN;

		/* Fix seg_len and make sure there is something left. */
		seg_len += rgap;
		if (seg_len <= 0) {
			/*
			 * Resets are only valid if they lie within our offered
			 * window.  If the RST bit is set, we just ignore this
			 * segment.
			 */
			if (flags & TH_RST) {
				freemsg(mp);
				return;
			}

			/* Per RFC 793, we need to send back an ACK. */
			flags |= TH_ACK_NEEDED;

			/*
			 * If this is a zero window probe, continue to
			 * process the ACK part.  But we need to set seg_len
			 * to 0 to avoid data processing.  Otherwise just
			 * drop the segment and send back an ACK.
			 */
			if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
				flags &= ~(TH_SYN | TH_URG);
				seg_len = 0;
				/* Let's see if we can update our rwnd */
				tcp_rcv_drain(sock_id, tcp);
				goto process_ack;
			} else {
				freemsg(mp);
				goto ack_check;
			}
		}
		/* Pitch out of window stuff off the end. */
		rgap = seg_len;
		mp2 = mp;
		do {
			assert((uintptr_t)(mp2->b_wptr -
			    mp2->b_rptr) <= (uintptr_t)INT_MAX);
			rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
			if (rgap < 0) {
				mp2->b_wptr += rgap;
				if ((mp1 = mp2->b_cont) != NULL) {
					mp2->b_cont = NULL;
					freemsg(mp1);
				}
				break;
			}
		} while ((mp2 = mp2->b_cont) != NULL);
	}
ok:;
	/*
	 * TCP should check ECN info for segments inside the window only.
	 * Therefore the check should be done here.
	 */
	if (tcp->tcp_ecn_ok) {
		uchar_t tos = ((struct ip *)rptr)->ip_tos;

		if (flags & TH_CWR) {
			tcp->tcp_ecn_echo_on = B_FALSE;
		}
		/*
		 * Note that both ECN_CE and CWR can be set in the
		 * same segment.  In this case, we once again turn
		 * on ECN_ECHO.
		 */
		if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
			tcp->tcp_ecn_echo_on = B_TRUE;
		}
	}

	/*
	 * Check whether we can update tcp_ts_recent.  This test is
	 * NOT the one in RFC 1323 3.4.  It is from Braden, 1993, "TCP
	 * Extensions for High Performance: An Update", Internet Draft.
	 */
	if (tcp->tcp_snd_ts_ok &&
	    TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
	    SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
		tcp->tcp_last_rcv_lbolt = prom_gettime();
	}

	if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
		/*
		 * FIN in an out of order segment.  We record this in
		 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
		 * Clear the FIN so that any check on FIN flag will fail.
		 * Remember that FIN also counts in the sequence number
		 * space.  So we need to ack out of order FIN only segments.
		 */
		if (flags & TH_FIN) {
			tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
			tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
			flags &= ~TH_FIN;
			flags |= TH_ACK_NEEDED;
		}
		if (seg_len > 0) {
			/* Fill in the SACK blk list. */
			if (tcp->tcp_snd_sack_ok) {
				assert(tcp->tcp_sack_info != NULL);
				tcp_sack_insert(tcp->tcp_sack_list,
				    seg_seq, seg_seq + seg_len,
				    &(tcp->tcp_num_sack_blk));
			}

			/*
			 * Attempt reassembly and see if we have something
			 * ready to go.
			 */
			mp = tcp_reass(tcp, mp, seg_seq);
			/* Always ack out of order packets */
			flags |= TH_ACK_NEEDED | TH_PUSH;
			if (mp != NULL) {
				assert((uintptr_t)(mp->b_wptr -
				    mp->b_rptr) <= (uintptr_t)INT_MAX);
				seg_len = mp->b_cont ? msgdsize(mp) :
					(int)(mp->b_wptr - mp->b_rptr);
				seg_seq = tcp->tcp_rnxt;
				/*
				 * A gap is filled and the seq num and len
				 * of the gap match that of a previously
				 * received FIN, put the FIN flag back in.
				 */
				if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
				    seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
					flags |= TH_FIN;
					tcp->tcp_valid_bits &=
					    ~TCP_OFO_FIN_VALID;
				}
			} else {
				/*
				 * Keep going even with NULL mp.
				 * There may be a useful ACK or something else
				 * we don't want to miss.
				 *
				 * But TCP should not perform fast retransmit
				 * because of the ack number.  TCP uses
				 * seg_len == 0 to determine if it is a pure
				 * ACK.  And this is not a pure ACK.
				 */
				seg_len = 0;
				ofo_seg = B_TRUE;
			}
		}
	} else if (seg_len > 0) {
		BUMP_MIB(tcp_mib.tcpInDataInorderSegs);
		UPDATE_MIB(tcp_mib.tcpInDataInorderBytes, seg_len);
		/*
		 * If an out of order FIN was received before, and the seq
		 * num and len of the new segment match that of the FIN,
		 * put the FIN flag back in.
		 */
		if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
		    seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
			flags |= TH_FIN;
			tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
		}
	}
	if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
	if (flags & TH_RST) {
		freemsg(mp);
		switch (tcp->tcp_state) {
		case TCPS_SYN_RCVD:
			(void) tcp_clean_death(sock_id, tcp, ECONNREFUSED);
			break;
		case TCPS_ESTABLISHED:
		case TCPS_FIN_WAIT_1:
		case TCPS_FIN_WAIT_2:
		case TCPS_CLOSE_WAIT:
			(void) tcp_clean_death(sock_id, tcp, ECONNRESET);
			break;
		case TCPS_CLOSING:
		case TCPS_LAST_ACK:
			(void) tcp_clean_death(sock_id, tcp, 0);
			break;
		default:
			assert(tcp->tcp_state != TCPS_TIME_WAIT);
			(void) tcp_clean_death(sock_id, tcp, ENXIO);
			break;
		}
		return;
	}
	if (flags & TH_SYN) {
		/*
		 * See RFC 793, Page 71
		 *
		 * The seq number must be in the window as it should
		 * be "fixed" above.  If it is outside window, it should
		 * be already rejected.  Note that we allow seg_seq to be
		 * rnxt + rwnd because we want to accept 0 window probe.
		 */
		assert(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
		    SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
		freemsg(mp);
		/*
		 * If the ACK flag is not set, just use our snxt as the
		 * seq number of the RST segment.
		 */
		if (!(flags & TH_ACK)) {
			seg_ack = tcp->tcp_snxt;
		}
		tcp_xmit_ctl("TH_SYN", tcp, NULL, seg_ack,
		    seg_seq + 1, TH_RST|TH_ACK, 0, sock_id);
		assert(tcp->tcp_state != TCPS_TIME_WAIT);
		(void) tcp_clean_death(sock_id, tcp, ECONNRESET);
		return;
	}

process_ack:
	if (!(flags & TH_ACK)) {
#ifdef DEBUG
		printf("No ack in segment, dropped it, seq:%x\n", seg_seq);
#endif
		freemsg(mp);
		goto xmit_check;
	}
	}
	bytes_acked = (int)(seg_ack - tcp->tcp_suna);

	if (tcp->tcp_state == TCPS_SYN_RCVD) {
		tcp_t	*listener = tcp->tcp_listener;
#ifdef DEBUG
		printf("Done with eager 3-way handshake\n");
#endif
		/*
		 * NOTE: RFC 793 pg. 72 says this should be 'bytes_acked < 0'
		 * but that would mean we have an ack that ignored our SYN.
		 */
		if (bytes_acked < 1 || SEQ_GT(seg_ack, tcp->tcp_snxt)) {
			freemsg(mp);
			tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
			    tcp, NULL, seg_ack, 0, TH_RST, 0, sock_id);
			return;
		}

		/*
		 * if the conn_req_q is full defer processing
		 * until space is availabe after accept()
		 * processing
		 */
		if (listener->tcp_conn_req_cnt_q <
		    listener->tcp_conn_req_max) {
			tcp_t *tail;

			listener->tcp_conn_req_cnt_q0--;
			listener->tcp_conn_req_cnt_q++;

			/* Move from SYN_RCVD to ESTABLISHED list  */
			tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
				tcp->tcp_eager_prev_q0;
			tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
				tcp->tcp_eager_next_q0;
			tcp->tcp_eager_prev_q0 = NULL;
			tcp->tcp_eager_next_q0 = NULL;

			/*
			 * Insert at end of the queue because sockfs
			 * sends down T_CONN_RES in chronological
			 * order. Leaving the older conn indications
			 * at front of the queue helps reducing search
			 * time.
			 */
			tail = listener->tcp_eager_last_q;
			if (tail != NULL) {
				tail->tcp_eager_next_q = tcp;
			} else {
				listener->tcp_eager_next_q = tcp;
			}
			listener->tcp_eager_last_q = tcp;
			tcp->tcp_eager_next_q = NULL;
		} else {
			/*
			 * Defer connection on q0 and set deferred
			 * connection bit true
			 */
			tcp->tcp_conn_def_q0 = B_TRUE;

			/* take tcp out of q0 ... */
			tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
			    tcp->tcp_eager_next_q0;
			tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
			    tcp->tcp_eager_prev_q0;

			/* ... and place it at the end of q0 */
			tcp->tcp_eager_prev_q0 = listener->tcp_eager_prev_q0;
			tcp->tcp_eager_next_q0 = listener;
			listener->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp;
			listener->tcp_eager_prev_q0 = tcp;
		}

		tcp->tcp_suna = tcp->tcp_iss + 1;	/* One for the SYN */
		bytes_acked--;

		/*
		 * If SYN was retransmitted, need to reset all
		 * retransmission info as this segment will be
		 * treated as a dup ACK.
		 */
		if (tcp->tcp_rexmit) {
			tcp->tcp_rexmit = B_FALSE;
			tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
			tcp->tcp_rexmit_max = tcp->tcp_snxt;
			tcp->tcp_snd_burst = TCP_CWND_NORMAL;
			tcp->tcp_ms_we_have_waited = 0;
			tcp->tcp_cwnd = mss;
		}

		/*
		 * We set the send window to zero here.
		 * This is needed if there is data to be
		 * processed already on the queue.
		 * Later (at swnd_update label), the
		 * "new_swnd > tcp_swnd" condition is satisfied
		 * the XMIT_NEEDED flag is set in the current
		 * (SYN_RCVD) state. This ensures tcp_wput_data() is
		 * called if there is already data on queue in
		 * this state.
		 */
		tcp->tcp_swnd = 0;

		if (new_swnd > tcp->tcp_max_swnd)
			tcp->tcp_max_swnd = new_swnd;
		tcp->tcp_swl1 = seg_seq;
		tcp->tcp_swl2 = seg_ack;
		tcp->tcp_state = TCPS_ESTABLISHED;
		tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
	}
	/* This code follows 4.4BSD-Lite2 mostly. */
	if (bytes_acked < 0)
		goto est;

	/*
	 * If TCP is ECN capable and the congestion experience bit is
	 * set, reduce tcp_cwnd and tcp_ssthresh.  But this should only be
	 * done once per window (or more loosely, per RTT).
	 */
	if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
		tcp->tcp_cwr = B_FALSE;
	if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
		if (!tcp->tcp_cwr) {
			npkt = (MIN(tcp->tcp_cwnd, tcp->tcp_swnd) >> 1) / mss;
			tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
			tcp->tcp_cwnd = npkt * mss;
			/*
			 * If the cwnd is 0, use the timer to clock out
			 * new segments.  This is required by the ECN spec.
			 */
			if (npkt == 0) {
				TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
				/*
				 * This makes sure that when the ACK comes
				 * back, we will increase tcp_cwnd by 1 MSS.
				 */
				tcp->tcp_cwnd_cnt = 0;
			}
			tcp->tcp_cwr = B_TRUE;
			/*
			 * This marks the end of the current window of in
			 * flight data.  That is why we don't use
			 * tcp_suna + tcp_swnd.  Only data in flight can
			 * provide ECN info.
			 */
			tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
			tcp->tcp_ecn_cwr_sent = B_FALSE;
		}
	}

	mp1 = tcp->tcp_xmit_head;
	if (bytes_acked == 0) {
		if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
			int dupack_cnt;

			BUMP_MIB(tcp_mib.tcpInDupAck);
			/*
			 * Fast retransmit.  When we have seen exactly three
			 * identical ACKs while we have unacked data
			 * outstanding we take it as a hint that our peer
			 * dropped something.
			 *
			 * If TCP is retransmitting, don't do fast retransmit.
			 */
			if (mp1 != NULL && tcp->tcp_suna != tcp->tcp_snxt &&
			    ! tcp->tcp_rexmit) {
				/* Do Limited Transmit */
				if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
				    tcp_dupack_fast_retransmit) {
					/*
					 * RFC 3042
					 *
					 * What we need to do is temporarily
					 * increase tcp_cwnd so that new
					 * data can be sent if it is allowed
					 * by the receive window (tcp_rwnd).
					 * tcp_wput_data() will take care of
					 * the rest.
					 *
					 * If the connection is SACK capable,
					 * only do limited xmit when there
					 * is SACK info.
					 *
					 * Note how tcp_cwnd is incremented.
					 * The first dup ACK will increase
					 * it by 1 MSS.  The second dup ACK
					 * will increase it by 2 MSS.  This
					 * means that only 1 new segment will
					 * be sent for each dup ACK.
					 */
					if (tcp->tcp_unsent > 0 &&
					    (!tcp->tcp_snd_sack_ok ||
					    (tcp->tcp_snd_sack_ok &&
					    tcp->tcp_notsack_list != NULL))) {
						tcp->tcp_cwnd += mss <<
						    (tcp->tcp_dupack_cnt - 1);
						flags |= TH_LIMIT_XMIT;
					}
				} else if (dupack_cnt ==
				    tcp_dupack_fast_retransmit) {

				BUMP_MIB(tcp_mib.tcpOutFastRetrans);
				/*
				 * If we have reduced tcp_ssthresh
				 * because of ECN, do not reduce it again
				 * unless it is already one window of data
				 * away.  After one window of data, tcp_cwr
				 * should then be cleared.  Note that
				 * for non ECN capable connection, tcp_cwr
				 * should always be false.
				 *
				 * Adjust cwnd since the duplicate
				 * ack indicates that a packet was
				 * dropped (due to congestion.)
				 */
				if (!tcp->tcp_cwr) {
					npkt = (MIN(tcp->tcp_cwnd,
					    tcp->tcp_swnd) >> 1) / mss;
					if (npkt < 2)
						npkt = 2;
					tcp->tcp_cwnd_ssthresh = npkt * mss;
					tcp->tcp_cwnd = (npkt +
					    tcp->tcp_dupack_cnt) * mss;
				}
				if (tcp->tcp_ecn_ok) {
					tcp->tcp_cwr = B_TRUE;
					tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
					tcp->tcp_ecn_cwr_sent = B_FALSE;
				}

				/*
				 * We do Hoe's algorithm.  Refer to her
				 * paper "Improving the Start-up Behavior
				 * of a Congestion Control Scheme for TCP,"
				 * appeared in SIGCOMM'96.
				 *
				 * Save highest seq no we have sent so far.
				 * Be careful about the invisible FIN byte.
				 */
				if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
				    (tcp->tcp_unsent == 0)) {
					tcp->tcp_rexmit_max = tcp->tcp_fss;
				} else {
					tcp->tcp_rexmit_max = tcp->tcp_snxt;
				}

				/*
				 * Do not allow bursty traffic during.
				 * fast recovery.  Refer to Fall and Floyd's
				 * paper "Simulation-based Comparisons of
				 * Tahoe, Reno and SACK TCP" (in CCR ??)
				 * This is a best current practise.
				 */
				tcp->tcp_snd_burst = TCP_CWND_SS;

				/*
				 * For SACK:
				 * Calculate tcp_pipe, which is the
				 * estimated number of bytes in
				 * network.
				 *
				 * tcp_fack is the highest sack'ed seq num
				 * TCP has received.
				 *
				 * tcp_pipe is explained in the above quoted
				 * Fall and Floyd's paper.  tcp_fack is
				 * explained in Mathis and Mahdavi's
				 * "Forward Acknowledgment: Refining TCP
				 * Congestion Control" in SIGCOMM '96.
				 */
				if (tcp->tcp_snd_sack_ok) {
					assert(tcp->tcp_sack_info != NULL);
					if (tcp->tcp_notsack_list != NULL) {
						tcp->tcp_pipe = tcp->tcp_snxt -
						    tcp->tcp_fack;
						tcp->tcp_sack_snxt = seg_ack;
						flags |= TH_NEED_SACK_REXMIT;
					} else {
						/*
						 * Always initialize tcp_pipe
						 * even though we don't have
						 * any SACK info.  If later
						 * we get SACK info and
						 * tcp_pipe is not initialized,
						 * funny things will happen.
						 */
						tcp->tcp_pipe =
						    tcp->tcp_cwnd_ssthresh;
					}
				} else {
					flags |= TH_REXMIT_NEEDED;
				} /* tcp_snd_sack_ok */

				} else {
					/*
					 * Here we perform congestion
					 * avoidance, but NOT slow start.
					 * This is known as the Fast
					 * Recovery Algorithm.
					 */
					if (tcp->tcp_snd_sack_ok &&
					    tcp->tcp_notsack_list != NULL) {
						flags |= TH_NEED_SACK_REXMIT;
						tcp->tcp_pipe -= mss;
						if (tcp->tcp_pipe < 0)
							tcp->tcp_pipe = 0;
					} else {
					/*
					 * We know that one more packet has
					 * left the pipe thus we can update
					 * cwnd.
					 */
					cwnd = tcp->tcp_cwnd + mss;
					if (cwnd > tcp->tcp_cwnd_max)
						cwnd = tcp->tcp_cwnd_max;
					tcp->tcp_cwnd = cwnd;
					flags |= TH_XMIT_NEEDED;
					}
				}
			}
		} else if (tcp->tcp_zero_win_probe) {
			/*
			 * If the window has opened, need to arrange
			 * to send additional data.
			 */
			if (new_swnd != 0) {
				/* tcp_suna != tcp_snxt */
				/* Packet contains a window update */
				BUMP_MIB(tcp_mib.tcpInWinUpdate);
				tcp->tcp_zero_win_probe = 0;
				tcp->tcp_timer_backoff = 0;
				tcp->tcp_ms_we_have_waited = 0;

				/*
				 * Transmit starting with tcp_suna since
				 * the one byte probe is not ack'ed.
				 * If TCP has sent more than one identical
				 * probe, tcp_rexmit will be set.  That means
				 * tcp_ss_rexmit() will send out the one
				 * byte along with new data.  Otherwise,
				 * fake the retransmission.
				 */
				flags |= TH_XMIT_NEEDED;
				if (!tcp->tcp_rexmit) {
					tcp->tcp_rexmit = B_TRUE;
					tcp->tcp_dupack_cnt = 0;
					tcp->tcp_rexmit_nxt = tcp->tcp_suna;
					tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
				}
			}
		}
		goto swnd_update;
	}

	/*
	 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
	 * If the ACK value acks something that we have not yet sent, it might
	 * be an old duplicate segment.  Send an ACK to re-synchronize the
	 * other side.
	 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
	 * state is handled above, so we can always just drop the segment and
	 * send an ACK here.
	 *
	 * Should we send ACKs in response to ACK only segments?
	 */
	if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
		BUMP_MIB(tcp_mib.tcpInAckUnsent);
		/* drop the received segment */
		freemsg(mp);

		/* Send back an ACK. */
		mp = tcp_ack_mp(tcp);

		if (mp == NULL) {
			return;
		}
		BUMP_MIB(tcp_mib.tcpOutAck);
		(void) ipv4_tcp_output(sock_id, mp);
		freeb(mp);
		return;
	}

	/*
	 * TCP gets a new ACK, update the notsack'ed list to delete those
	 * blocks that are covered by this ACK.
	 */
	if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
		tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
		    &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
	}

	/*
	 * If we got an ACK after fast retransmit, check to see
	 * if it is a partial ACK.  If it is not and the congestion
	 * window was inflated to account for the other side's
	 * cached packets, retract it.  If it is, do Hoe's algorithm.
	 */
	if (tcp->tcp_dupack_cnt >= tcp_dupack_fast_retransmit) {
		assert(tcp->tcp_rexmit == B_FALSE);
		if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
			tcp->tcp_dupack_cnt = 0;
			/*
			 * Restore the orig tcp_cwnd_ssthresh after
			 * fast retransmit phase.
			 */
			if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
				tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
			}
			tcp->tcp_rexmit_max = seg_ack;
			tcp->tcp_cwnd_cnt = 0;
			tcp->tcp_snd_burst = TCP_CWND_NORMAL;

			/*
			 * Remove all notsack info to avoid confusion with
			 * the next fast retrasnmit/recovery phase.
			 */
			if (tcp->tcp_snd_sack_ok &&
			    tcp->tcp_notsack_list != NULL) {
				TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list);
			}
		} else {
			if (tcp->tcp_snd_sack_ok &&
			    tcp->tcp_notsack_list != NULL) {
				flags |= TH_NEED_SACK_REXMIT;
				tcp->tcp_pipe -= mss;
				if (tcp->tcp_pipe < 0)
					tcp->tcp_pipe = 0;
			} else {
				/*
				 * Hoe's algorithm:
				 *
				 * Retransmit the unack'ed segment and
				 * restart fast recovery.  Note that we
				 * need to scale back tcp_cwnd to the
				 * original value when we started fast
				 * recovery.  This is to prevent overly
				 * aggressive behaviour in sending new
				 * segments.
				 */
				tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
					tcp_dupack_fast_retransmit * mss;
				tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
				BUMP_MIB(tcp_mib.tcpOutFastRetrans);
				flags |= TH_REXMIT_NEEDED;
			}
		}
	} else {
		tcp->tcp_dupack_cnt = 0;
		if (tcp->tcp_rexmit) {
			/*
			 * TCP is retranmitting.  If the ACK ack's all
			 * outstanding data, update tcp_rexmit_max and
			 * tcp_rexmit_nxt.  Otherwise, update tcp_rexmit_nxt
			 * to the correct value.
			 *
			 * Note that SEQ_LEQ() is used.  This is to avoid
			 * unnecessary fast retransmit caused by dup ACKs
			 * received when TCP does slow start retransmission
			 * after a time out.  During this phase, TCP may
			 * send out segments which are already received.
			 * This causes dup ACKs to be sent back.
			 */
			if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
				if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
					tcp->tcp_rexmit_nxt = seg_ack;
				}
				if (seg_ack != tcp->tcp_rexmit_max) {
					flags |= TH_XMIT_NEEDED;
				}
			} else {
				tcp->tcp_rexmit = B_FALSE;
				tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
				tcp->tcp_snd_burst = TCP_CWND_NORMAL;
			}
			tcp->tcp_ms_we_have_waited = 0;
		}
	}

	BUMP_MIB(tcp_mib.tcpInAckSegs);
	UPDATE_MIB(tcp_mib.tcpInAckBytes, bytes_acked);
	tcp->tcp_suna = seg_ack;
	if (tcp->tcp_zero_win_probe != 0) {
		tcp->tcp_zero_win_probe = 0;
		tcp->tcp_timer_backoff = 0;
	}

	/*
	 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
	 * Note that it cannot be the SYN being ack'ed.  The code flow
	 * will not reach here.
	 */
	if (mp1 == NULL) {
		goto fin_acked;
	}

	/*
	 * Update the congestion window.
	 *
	 * If TCP is not ECN capable or TCP is ECN capable but the
	 * congestion experience bit is not set, increase the tcp_cwnd as
	 * usual.
	 */
	if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
		cwnd = tcp->tcp_cwnd;
		add = mss;

		if (cwnd >= tcp->tcp_cwnd_ssthresh) {
			/*
			 * This is to prevent an increase of less than 1 MSS of
			 * tcp_cwnd.  With partial increase, tcp_wput_data()
			 * may send out tinygrams in order to preserve mblk
			 * boundaries.
			 *
			 * By initializing tcp_cwnd_cnt to new tcp_cwnd and
			 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
			 * increased by 1 MSS for every RTTs.
			 */
			if (tcp->tcp_cwnd_cnt <= 0) {
				tcp->tcp_cwnd_cnt = cwnd + add;
			} else {
				tcp->tcp_cwnd_cnt -= add;
				add = 0;
			}
		}
		tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
	}

	/* Can we update the RTT estimates? */
	if (tcp->tcp_snd_ts_ok) {
		/* Ignore zero timestamp echo-reply. */
		if (tcpopt.tcp_opt_ts_ecr != 0) {
			tcp_set_rto(tcp, (int32_t)(prom_gettime() -
			    tcpopt.tcp_opt_ts_ecr));
		}

		/* If needed, restart the timer. */
		if (tcp->tcp_set_timer == 1) {
			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
			tcp->tcp_set_timer = 0;
		}
		/*
		 * Update tcp_csuna in case the other side stops sending
		 * us timestamps.
		 */
		tcp->tcp_csuna = tcp->tcp_snxt;
	} else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
		/*
		 * An ACK sequence we haven't seen before, so get the RTT
		 * and update the RTO.
		 * Note. use uintptr_t to suppress the gcc warning.
		 */
		tcp_set_rto(tcp, (int32_t)(prom_gettime() -
		    (uint32_t)(uintptr_t)mp1->b_prev));

		/* Remeber the last sequence to be ACKed */
		tcp->tcp_csuna = seg_ack;
		if (tcp->tcp_set_timer == 1) {
			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
			tcp->tcp_set_timer = 0;
		}
	} else {
		BUMP_MIB(tcp_mib.tcpRttNoUpdate);
	}

	/* Eat acknowledged bytes off the xmit queue. */
	for (;;) {
		mblk_t	*mp2;
		uchar_t	*wptr;

		wptr = mp1->b_wptr;
		assert((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
		bytes_acked -= (int)(wptr - mp1->b_rptr);
		if (bytes_acked < 0) {
			mp1->b_rptr = wptr + bytes_acked;
			break;
		}
		mp1->b_prev = NULL;
		mp2 = mp1;
		mp1 = mp1->b_cont;
		freeb(mp2);
		if (bytes_acked == 0) {
			if (mp1 == NULL) {
				/* Everything is ack'ed, clear the tail. */
				tcp->tcp_xmit_tail = NULL;
				goto pre_swnd_update;
			}
			if (mp2 != tcp->tcp_xmit_tail)
				break;
			tcp->tcp_xmit_tail = mp1;
			assert((uintptr_t)(mp1->b_wptr -
			    mp1->b_rptr) <= (uintptr_t)INT_MAX);
			tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
			    mp1->b_rptr);
			break;
		}
		if (mp1 == NULL) {
			/*
			 * More was acked but there is nothing more
			 * outstanding.  This means that the FIN was
			 * just acked or that we're talking to a clown.
			 */
fin_acked:
			assert(tcp->tcp_fin_sent);
			tcp->tcp_xmit_tail = NULL;
			if (tcp->tcp_fin_sent) {
				tcp->tcp_fin_acked = B_TRUE;
			} else {
				/*
				 * We should never got here because
				 * we have already checked that the
				 * number of bytes ack'ed should be
				 * smaller than or equal to what we
				 * have sent so far (it is the
				 * acceptability check of the ACK).
				 * We can only get here if the send
				 * queue is corrupted.
				 *
				 * Terminate the connection and
				 * panic the system.  It is better
				 * for us to panic instead of
				 * continuing to avoid other disaster.
				 */
				tcp_xmit_ctl(NULL, tcp, NULL, tcp->tcp_snxt,
				    tcp->tcp_rnxt, TH_RST|TH_ACK, 0, sock_id);
				printf("Memory corruption "
				    "detected for connection %s.\n",
				    tcp_display(tcp, NULL,
					DISP_ADDR_AND_PORT));
				/* We should never get here... */
				prom_panic("tcp_rput_data");
			}
			goto pre_swnd_update;
		}
		assert(mp2 != tcp->tcp_xmit_tail);
	}
	if (tcp->tcp_unsent) {
		flags |= TH_XMIT_NEEDED;
	}
pre_swnd_update:
	tcp->tcp_xmit_head = mp1;
swnd_update:
	/*
	 * The following check is different from most other implementations.
	 * For bi-directional transfer, when segments are dropped, the
	 * "normal" check will not accept a window update in those
	 * retransmitted segemnts.  Failing to do that, TCP may send out
	 * segments which are outside receiver's window.  As TCP accepts
	 * the ack in those retransmitted segments, if the window update in
	 * the same segment is not accepted, TCP will incorrectly calculates
	 * that it can send more segments.  This can create a deadlock
	 * with the receiver if its window becomes zero.
	 */
	if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
	    SEQ_LT(tcp->tcp_swl1, seg_seq) ||
	    (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
		/*
		 * The criteria for update is:
		 *
		 * 1. the segment acknowledges some data.  Or
		 * 2. the segment is new, i.e. it has a higher seq num. Or
		 * 3. the segment is not old and the advertised window is
		 * larger than the previous advertised window.
		 */
		if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
			flags |= TH_XMIT_NEEDED;
		tcp->tcp_swnd = new_swnd;
		if (new_swnd > tcp->tcp_max_swnd)
			tcp->tcp_max_swnd = new_swnd;
		tcp->tcp_swl1 = seg_seq;
		tcp->tcp_swl2 = seg_ack;
	}
est:
	if (tcp->tcp_state > TCPS_ESTABLISHED) {
		switch (tcp->tcp_state) {
		case TCPS_FIN_WAIT_1:
			if (tcp->tcp_fin_acked) {
				tcp->tcp_state = TCPS_FIN_WAIT_2;
				/*
				 * We implement the non-standard BSD/SunOS
				 * FIN_WAIT_2 flushing algorithm.
				 * If there is no user attached to this
				 * TCP endpoint, then this TCP struct
				 * could hang around forever in FIN_WAIT_2
				 * state if the peer forgets to send us
				 * a FIN.  To prevent this, we wait only
				 * 2*MSL (a convenient time value) for
				 * the FIN to arrive.  If it doesn't show up,
				 * we flush the TCP endpoint.  This algorithm,
				 * though a violation of RFC-793, has worked
				 * for over 10 years in BSD systems.
				 * Note: SunOS 4.x waits 675 seconds before
				 * flushing the FIN_WAIT_2 connection.
				 */
				TCP_TIMER_RESTART(tcp,
				    tcp_fin_wait_2_flush_interval);
			}
			break;
		case TCPS_FIN_WAIT_2:
			break;	/* Shutdown hook? */
		case TCPS_LAST_ACK:
			freemsg(mp);
			if (tcp->tcp_fin_acked) {
				(void) tcp_clean_death(sock_id, tcp, 0);
				return;
			}
			goto xmit_check;
		case TCPS_CLOSING:
			if (tcp->tcp_fin_acked) {
				tcp->tcp_state = TCPS_TIME_WAIT;
				tcp_time_wait_append(tcp);
				TCP_TIMER_RESTART(tcp, tcp_time_wait_interval);
			}
			/*FALLTHRU*/
		case TCPS_CLOSE_WAIT:
			freemsg(mp);
			goto xmit_check;
		default:
			assert(tcp->tcp_state != TCPS_TIME_WAIT);
			break;
		}
	}
	if (flags & TH_FIN) {
		/* Make sure we ack the fin */
		flags |= TH_ACK_NEEDED;
		if (!tcp->tcp_fin_rcvd) {
			tcp->tcp_fin_rcvd = B_TRUE;
			tcp->tcp_rnxt++;
			U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack);

			switch (tcp->tcp_state) {
			case TCPS_SYN_RCVD:
			case TCPS_ESTABLISHED:
				tcp->tcp_state = TCPS_CLOSE_WAIT;
				/* Keepalive? */
				break;
			case TCPS_FIN_WAIT_1:
				if (!tcp->tcp_fin_acked) {
					tcp->tcp_state = TCPS_CLOSING;
					break;
				}
				/* FALLTHRU */
			case TCPS_FIN_WAIT_2:
				tcp->tcp_state = TCPS_TIME_WAIT;
				tcp_time_wait_append(tcp);
				TCP_TIMER_RESTART(tcp, tcp_time_wait_interval);
				if (seg_len) {
					/*
					 * implies data piggybacked on FIN.
					 * break to handle data.
					 */
					break;
				}
				freemsg(mp);
				goto ack_check;
			}
		}
	}
	if (mp == NULL)
		goto xmit_check;
	if (seg_len == 0) {
		freemsg(mp);
		goto xmit_check;
	}
	if (mp->b_rptr == mp->b_wptr) {
		/*
		 * The header has been consumed, so we remove the
		 * zero-length mblk here.
		 */
		mp1 = mp;
		mp = mp->b_cont;
		freeb(mp1);
	}
	/*
	 * ACK every other segments, unless the input queue is empty
	 * as we don't have a timer available.
	 */
	if (++tcp->tcp_rack_cnt == 2 || sockets[sock_id].inq == NULL) {
		flags |= TH_ACK_NEEDED;
		tcp->tcp_rack_cnt = 0;
	}
	tcp->tcp_rnxt += seg_len;
	U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack);

	/* Update SACK list */
	if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
		tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
		    &(tcp->tcp_num_sack_blk));
	}

	if (tcp->tcp_listener) {
		/*
		 * Side queue inbound data until the accept happens.
		 * tcp_accept/tcp_rput drains this when the accept happens.
		 */
		tcp_rcv_enqueue(tcp, mp, seg_len);
	} else {
		/* Just queue the data until the app calls read. */
		tcp_rcv_enqueue(tcp, mp, seg_len);
		/*
		 * Make sure the timer is running if we have data waiting
		 * for a push bit. This provides resiliency against
		 * implementations that do not correctly generate push bits.
		 */
		if (tcp->tcp_rcv_list != NULL)
			flags |= TH_TIMER_NEEDED;
	}

xmit_check:
	/* Is there anything left to do? */
	if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
	    TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_TIMER_NEEDED)) == 0)
		return;

	/* Any transmit work to do and a non-zero window? */
	if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
	    TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
		if (flags & TH_REXMIT_NEEDED) {
			uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;

			if (snd_size > mss)
				snd_size = mss;
			if (snd_size > tcp->tcp_swnd)
				snd_size = tcp->tcp_swnd;
			mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
			    NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
			    B_TRUE);

			if (mp1 != NULL) {
				/* use uintptr_t to suppress the gcc warning */
				tcp->tcp_xmit_head->b_prev =
				    (mblk_t *)(uintptr_t)prom_gettime();
				tcp->tcp_csuna = tcp->tcp_snxt;
				BUMP_MIB(tcp_mib.tcpRetransSegs);
				UPDATE_MIB(tcp_mib.tcpRetransBytes, snd_size);
				(void) ipv4_tcp_output(sock_id, mp1);
				freeb(mp1);
			}
		}
		if (flags & TH_NEED_SACK_REXMIT) {
			if (tcp_sack_rxmit(tcp, sock_id) != 0) {
				flags |= TH_XMIT_NEEDED;
			}
		}
		/*
		 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
		 * out new segment.  Note that tcp_rexmit should not be
		 * set, otherwise TH_LIMIT_XMIT should not be set.
		 */
		if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
			if (!tcp->tcp_rexmit) {
				tcp_wput_data(tcp, NULL, sock_id);
			} else {
				tcp_ss_rexmit(tcp, sock_id);
			}
			/*
			 * The TCP could be closed in tcp_state_wait via
			 * tcp_wput_data (tcp_ss_rexmit could call
			 * tcp_wput_data as well).
			 */
			if (sockets[sock_id].pcb == NULL)
				return;
		}
		/*
		 * Adjust tcp_cwnd back to normal value after sending
		 * new data segments.
		 */
		if (flags & TH_LIMIT_XMIT) {
			tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
		}

		/* Anything more to do? */
		if ((flags & (TH_ACK_NEEDED|TH_TIMER_NEEDED)) == 0)
			return;
	}
ack_check:
	if (flags & TH_ACK_NEEDED) {
		/*
		 * Time to send an ack for some reason.
		 */
		if ((mp1 = tcp_ack_mp(tcp)) != NULL) {
			TCP_DUMP_PACKET("tcp_rput_data: ack mp", mp1);
			(void) ipv4_tcp_output(sock_id, mp1);
			BUMP_MIB(tcp_mib.tcpOutAck);
			freeb(mp1);
		}
	}
}

/*
 * tcp_ss_rexmit() is called in tcp_rput_data() to do slow start
 * retransmission after a timeout.
 *
 * To limit the number of duplicate segments, we limit the number of segment
 * to be sent in one time to tcp_snd_burst, the burst variable.
 */
static void
tcp_ss_rexmit(tcp_t *tcp, int sock_id)
{
	uint32_t	snxt;
	uint32_t	smax;
	int32_t		win;
	int32_t		mss;
	int32_t		off;
	int32_t		burst = tcp->tcp_snd_burst;
	mblk_t		*snxt_mp;

	/*
	 * Note that tcp_rexmit can be set even though TCP has retransmitted
	 * all unack'ed segments.
	 */
	if (SEQ_LT(tcp->tcp_rexmit_nxt, tcp->tcp_rexmit_max)) {
		smax = tcp->tcp_rexmit_max;
		snxt = tcp->tcp_rexmit_nxt;
		if (SEQ_LT(snxt, tcp->tcp_suna)) {
			snxt = tcp->tcp_suna;
		}
		win = MIN(tcp->tcp_cwnd, tcp->tcp_swnd);
		win -= snxt - tcp->tcp_suna;
		mss = tcp->tcp_mss;
		snxt_mp = tcp_get_seg_mp(tcp, snxt, &off);

		while (SEQ_LT(snxt, smax) && (win > 0) &&
		    (burst > 0) && (snxt_mp != NULL)) {
			mblk_t	*xmit_mp;
			mblk_t	*old_snxt_mp = snxt_mp;
			uint32_t cnt = mss;

			if (win < cnt) {
				cnt = win;
			}
			if (SEQ_GT(snxt + cnt, smax)) {
				cnt = smax - snxt;
			}
			xmit_mp = tcp_xmit_mp(tcp, snxt_mp, cnt, &off,
			    &snxt_mp, snxt, B_TRUE, &cnt, B_TRUE);

			if (xmit_mp == NULL)
				return;

			(void) ipv4_tcp_output(sock_id, xmit_mp);
			freeb(xmit_mp);

			snxt += cnt;
			win -= cnt;
			/*
			 * Update the send timestamp to avoid false
			 * retransmission.
			 * Note. use uintptr_t to suppress the gcc warning.
			 */
			old_snxt_mp->b_prev =
			    (mblk_t *)(uintptr_t)prom_gettime();
			BUMP_MIB(tcp_mib.tcpRetransSegs);
			UPDATE_MIB(tcp_mib.tcpRetransBytes, cnt);

			tcp->tcp_rexmit_nxt = snxt;
			burst--;
		}
		/*
		 * If we have transmitted all we have at the time
		 * we started the retranmission, we can leave
		 * the rest of the job to tcp_wput_data().  But we
		 * need to check the send window first.  If the
		 * win is not 0, go on with tcp_wput_data().
		 */
		if (SEQ_LT(snxt, smax) || win == 0) {
			return;
		}
	}
	/* Only call tcp_wput_data() if there is data to be sent. */
	if (tcp->tcp_unsent) {
		tcp_wput_data(tcp, NULL, sock_id);
	}
}

/*
 * tcp_timer is the timer service routine.  It handles all timer events for
 * a tcp instance except keepalives.  It figures out from the state of the
 * tcp instance what kind of action needs to be done at the time it is called.
 */
static void
tcp_timer(tcp_t	*tcp, int sock_id)
{
	mblk_t		*mp;
	uint32_t	first_threshold;
	uint32_t	second_threshold;
	uint32_t	ms;
	uint32_t	mss;

	first_threshold =  tcp->tcp_first_timer_threshold;
	second_threshold = tcp->tcp_second_timer_threshold;
	switch (tcp->tcp_state) {
	case TCPS_IDLE:
	case TCPS_BOUND:
	case TCPS_LISTEN:
		return;
	case TCPS_SYN_RCVD:
	case TCPS_SYN_SENT:
		first_threshold =  tcp->tcp_first_ctimer_threshold;
		second_threshold = tcp->tcp_second_ctimer_threshold;
		break;
	case TCPS_ESTABLISHED:
	case TCPS_FIN_WAIT_1:
	case TCPS_CLOSING:
	case TCPS_CLOSE_WAIT:
	case TCPS_LAST_ACK:
		/* If we have data to rexmit */
		if (tcp->tcp_suna != tcp->tcp_snxt) {
			int32_t time_to_wait;

			BUMP_MIB(tcp_mib.tcpTimRetrans);
			if (tcp->tcp_xmit_head == NULL)
				break;
			/* use uintptr_t to suppress the gcc warning */
			time_to_wait = (int32_t)(prom_gettime() -
			    (uint32_t)(uintptr_t)tcp->tcp_xmit_head->b_prev);
			time_to_wait = tcp->tcp_rto - time_to_wait;
			if (time_to_wait > 0) {
				/*
				 * Timer fired too early, so restart it.
				 */
				TCP_TIMER_RESTART(tcp, time_to_wait);
				return;
			}
			/*
			 * When we probe zero windows, we force the swnd open.
			 * If our peer acks with a closed window swnd will be
			 * set to zero by tcp_rput(). As long as we are
			 * receiving acks tcp_rput will
			 * reset 'tcp_ms_we_have_waited' so as not to trip the
			 * first and second interval actions.  NOTE: the timer
			 * interval is allowed to continue its exponential
			 * backoff.
			 */
			if (tcp->tcp_swnd == 0 || tcp->tcp_zero_win_probe) {
				DEBUG_1("tcp_timer (%d): zero win", sock_id);
				break;
			} else {
				/*
				 * After retransmission, we need to do
				 * slow start.  Set the ssthresh to one
				 * half of current effective window and
				 * cwnd to one MSS.  Also reset
				 * tcp_cwnd_cnt.
				 *
				 * Note that if tcp_ssthresh is reduced because
				 * of ECN, do not reduce it again unless it is
				 * already one window of data away (tcp_cwr
				 * should then be cleared) or this is a
				 * timeout for a retransmitted segment.
				 */
				uint32_t npkt;

				if (!tcp->tcp_cwr || tcp->tcp_rexmit) {
					npkt = (MIN((tcp->tcp_timer_backoff ?
					    tcp->tcp_cwnd_ssthresh :
					    tcp->tcp_cwnd),
					    tcp->tcp_swnd) >> 1) /
					    tcp->tcp_mss;
					if (npkt < 2)
						npkt = 2;
					tcp->tcp_cwnd_ssthresh = npkt *
					    tcp->tcp_mss;
				}
				tcp->tcp_cwnd = tcp->tcp_mss;
				tcp->tcp_cwnd_cnt = 0;
				if (tcp->tcp_ecn_ok) {
					tcp->tcp_cwr = B_TRUE;
					tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
					tcp->tcp_ecn_cwr_sent = B_FALSE;
				}
			}
			break;
		}
		/*
		 * We have something to send yet we cannot send.  The
		 * reason can be:
		 *
		 * 1. Zero send window: we need to do zero window probe.
		 * 2. Zero cwnd: because of ECN, we need to "clock out
		 * segments.
		 * 3. SWS avoidance: receiver may have shrunk window,
		 * reset our knowledge.
		 *
		 * Note that condition 2 can happen with either 1 or
		 * 3.  But 1 and 3 are exclusive.
		 */
		if (tcp->tcp_unsent != 0) {
			if (tcp->tcp_cwnd == 0) {
				/*
				 * Set tcp_cwnd to 1 MSS so that a
				 * new segment can be sent out.  We
				 * are "clocking out" new data when
				 * the network is really congested.
				 */
				assert(tcp->tcp_ecn_ok);
				tcp->tcp_cwnd = tcp->tcp_mss;
			}
			if (tcp->tcp_swnd == 0) {
				/* Extend window for zero window probe */
				tcp->tcp_swnd++;
				tcp->tcp_zero_win_probe = B_TRUE;
				BUMP_MIB(tcp_mib.tcpOutWinProbe);
			} else {
				/*
				 * Handle timeout from sender SWS avoidance.
				 * Reset our knowledge of the max send window
				 * since the receiver might have reduced its
				 * receive buffer.  Avoid setting tcp_max_swnd
				 * to one since that will essentially disable
				 * the SWS checks.
				 *
				 * Note that since we don't have a SWS
				 * state variable, if the timeout is set
				 * for ECN but not for SWS, this
				 * code will also be executed.  This is
				 * fine as tcp_max_swnd is updated
				 * constantly and it will not affect
				 * anything.
				 */
				tcp->tcp_max_swnd = MAX(tcp->tcp_swnd, 2);
			}
			tcp_wput_data(tcp, NULL, sock_id);
			return;
		}
		/* Is there a FIN that needs to be to re retransmitted? */
		if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
		    !tcp->tcp_fin_acked)
			break;
		/* Nothing to do, return without restarting timer. */
		return;
	case TCPS_FIN_WAIT_2:
		/*
		 * User closed the TCP endpoint and peer ACK'ed our FIN.
		 * We waited some time for for peer's FIN, but it hasn't
		 * arrived.  We flush the connection now to avoid
		 * case where the peer has rebooted.
		 */
		/* FALLTHRU */
	case TCPS_TIME_WAIT:
		(void) tcp_clean_death(sock_id, tcp, 0);
		return;
	default:
		DEBUG_3("tcp_timer (%d): strange state (%d) %s", sock_id,
		    tcp->tcp_state, tcp_display(tcp, NULL,
		    DISP_PORT_ONLY));
		return;
	}
	if ((ms = tcp->tcp_ms_we_have_waited) > second_threshold) {
		/*
		 * For zero window probe, we need to send indefinitely,
		 * unless we have not heard from the other side for some
		 * time...
		 */
		if ((tcp->tcp_zero_win_probe == 0) ||
		    ((prom_gettime() - tcp->tcp_last_recv_time) >
		    second_threshold)) {
			BUMP_MIB(tcp_mib.tcpTimRetransDrop);
			/*
			 * If TCP is in SYN_RCVD state, send back a
			 * RST|ACK as BSD does.  Note that tcp_zero_win_probe
			 * should be zero in TCPS_SYN_RCVD state.
			 */
			if (tcp->tcp_state == TCPS_SYN_RCVD) {
				tcp_xmit_ctl("tcp_timer: RST sent on timeout "
				    "in SYN_RCVD",
				    tcp, NULL, tcp->tcp_snxt,
				    tcp->tcp_rnxt, TH_RST | TH_ACK, 0, sock_id);
			}
			(void) tcp_clean_death(sock_id, tcp,
			    tcp->tcp_client_errno ?
			    tcp->tcp_client_errno : ETIMEDOUT);
			return;
		} else {
			/*
			 * Set tcp_ms_we_have_waited to second_threshold
			 * so that in next timeout, we will do the above
			 * check (lbolt - tcp_last_recv_time).  This is
			 * also to avoid overflow.
			 *
			 * We don't need to decrement tcp_timer_backoff
			 * to avoid overflow because it will be decremented
			 * later if new timeout value is greater than
			 * tcp_rexmit_interval_max.  In the case when
			 * tcp_rexmit_interval_max is greater than
			 * second_threshold, it means that we will wait
			 * longer than second_threshold to send the next
			 * window probe.
			 */
			tcp->tcp_ms_we_have_waited = second_threshold;
		}
	} else if (ms > first_threshold && tcp->tcp_rtt_sa != 0) {
		/*
		 * We have been retransmitting for too long...  The RTT
		 * we calculated is probably incorrect.  Reinitialize it.
		 * Need to compensate for 0 tcp_rtt_sa.  Reset
		 * tcp_rtt_update so that we won't accidentally cache a
		 * bad value.  But only do this if this is not a zero
		 * window probe.
		 */
		if (tcp->tcp_zero_win_probe == 0) {
			tcp->tcp_rtt_sd += (tcp->tcp_rtt_sa >> 3) +
			    (tcp->tcp_rtt_sa >> 5);
			tcp->tcp_rtt_sa = 0;
			tcp->tcp_rtt_update = 0;
		}
	}
	tcp->tcp_timer_backoff++;
	if ((ms = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
	    tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5)) <
	    tcp_rexmit_interval_min) {
		/*
		 * This means the original RTO is tcp_rexmit_interval_min.
		 * So we will use tcp_rexmit_interval_min as the RTO value
		 * and do the backoff.
		 */
		ms = tcp_rexmit_interval_min << tcp->tcp_timer_backoff;
	} else {
		ms <<= tcp->tcp_timer_backoff;
	}
	if (ms > tcp_rexmit_interval_max) {
		ms = tcp_rexmit_interval_max;
		/*
		 * ms is at max, decrement tcp_timer_backoff to avoid
		 * overflow.
		 */
		tcp->tcp_timer_backoff--;
	}
	tcp->tcp_ms_we_have_waited += ms;
	if (tcp->tcp_zero_win_probe == 0) {
		tcp->tcp_rto = ms;
	}
	TCP_TIMER_RESTART(tcp, ms);
	/*
	 * This is after a timeout and tcp_rto is backed off.  Set
	 * tcp_set_timer to 1 so that next time RTO is updated, we will
	 * restart the timer with a correct value.
	 */
	tcp->tcp_set_timer = 1;
	mss = tcp->tcp_snxt - tcp->tcp_suna;
	if (mss > tcp->tcp_mss)
		mss = tcp->tcp_mss;
	if (mss > tcp->tcp_swnd && tcp->tcp_swnd != 0)
		mss = tcp->tcp_swnd;

	if ((mp = tcp->tcp_xmit_head) != NULL) {
		/* use uintptr_t to suppress the gcc warning */
		mp->b_prev = (mblk_t *)(uintptr_t)prom_gettime();
	}
	mp = tcp_xmit_mp(tcp, mp, mss, NULL, NULL, tcp->tcp_suna, B_TRUE, &mss,
	    B_TRUE);
	if (mp == NULL)
		return;
	tcp->tcp_csuna = tcp->tcp_snxt;
	BUMP_MIB(tcp_mib.tcpRetransSegs);
	UPDATE_MIB(tcp_mib.tcpRetransBytes, mss);
	/* Dump the packet when debugging. */
	TCP_DUMP_PACKET("tcp_timer", mp);

	(void) ipv4_tcp_output(sock_id, mp);
	freeb(mp);

	/*
	 * When slow start after retransmission begins, start with
	 * this seq no.  tcp_rexmit_max marks the end of special slow
	 * start phase.  tcp_snd_burst controls how many segments
	 * can be sent because of an ack.
	 */
	tcp->tcp_rexmit_nxt = tcp->tcp_suna;
	tcp->tcp_snd_burst = TCP_CWND_SS;
	if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
	    (tcp->tcp_unsent == 0)) {
		tcp->tcp_rexmit_max = tcp->tcp_fss;
	} else {
		tcp->tcp_rexmit_max = tcp->tcp_snxt;
	}
	tcp->tcp_rexmit = B_TRUE;
	tcp->tcp_dupack_cnt = 0;

	/*
	 * Remove all rexmit SACK blk to start from fresh.
	 */
	if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
		TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list);
		tcp->tcp_num_notsack_blk = 0;
		tcp->tcp_cnt_notsack_list = 0;
	}
}

/*
 * The TCP normal data output path.
 * NOTE: the logic of the fast path is duplicated from this function.
 */
static void
tcp_wput_data(tcp_t *tcp, mblk_t *mp, int sock_id)
{
	int		len;
	mblk_t		*local_time;
	mblk_t		*mp1;
	uchar_t		*rptr;
	uint32_t	snxt;
	int		tail_unsent;
	int		tcpstate;
	int		usable = 0;
	mblk_t		*xmit_tail;
	int32_t		num_burst_seg;
	int32_t		mss;
	int32_t		num_sack_blk = 0;
	int32_t		tcp_hdr_len;
	ipaddr_t	*dst;
	ipaddr_t	*src;

#ifdef DEBUG
	printf("tcp_wput_data(%d) ##############################\n", sock_id);
#endif
	tcpstate = tcp->tcp_state;
	if (mp == NULL) {
		/* Really tacky... but we need this for detached closes. */
		len = tcp->tcp_unsent;
		goto data_null;
	}

	/*
	 * Don't allow data after T_ORDREL_REQ or T_DISCON_REQ,
	 * or before a connection attempt has begun.
	 *
	 * The following should not happen in inetboot....
	 */
	if (tcpstate < TCPS_SYN_SENT || tcpstate > TCPS_CLOSE_WAIT ||
	    (tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) {
		if ((tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) {
			printf("tcp_wput_data: data after ordrel, %s\n",
			    tcp_display(tcp, NULL, DISP_ADDR_AND_PORT));
		}
		freemsg(mp);
		return;
	}

	/* Strip empties */
	for (;;) {
		assert((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
		    (uintptr_t)INT_MAX);
		len = (int)(mp->b_wptr - mp->b_rptr);
		if (len > 0)
			break;
		mp1 = mp;
		mp = mp->b_cont;
		freeb(mp1);
		if (mp == NULL) {
			return;
		}
	}

	/* If we are the first on the list ... */
	if (tcp->tcp_xmit_head == NULL) {
		tcp->tcp_xmit_head = mp;
		tcp->tcp_xmit_tail = mp;
		tcp->tcp_xmit_tail_unsent = len;
	} else {
		tcp->tcp_xmit_last->b_cont = mp;
		len += tcp->tcp_unsent;
	}

	/* Tack on however many more positive length mblks we have */
	if ((mp1 = mp->b_cont) != NULL) {
		do {
			int tlen;
			assert((uintptr_t)(mp1->b_wptr -
			    mp1->b_rptr) <= (uintptr_t)INT_MAX);
			tlen = (int)(mp1->b_wptr - mp1->b_rptr);
			if (tlen <= 0) {
				mp->b_cont = mp1->b_cont;
				freeb(mp1);
			} else {
				len += tlen;
				mp = mp1;
			}
		} while ((mp1 = mp->b_cont) != NULL);
	}
	tcp->tcp_xmit_last = mp;
	tcp->tcp_unsent = len;

data_null:
	snxt = tcp->tcp_snxt;
	xmit_tail = tcp->tcp_xmit_tail;
	tail_unsent = tcp->tcp_xmit_tail_unsent;

	/*
	 * Note that tcp_mss has been adjusted to take into account the
	 * timestamp option if applicable.  Because SACK options do not
	 * appear in every TCP segments and they are of variable lengths,
	 * they cannot be included in tcp_mss.  Thus we need to calculate
	 * the actual segment length when we need to send a segment which
	 * includes SACK options.
	 */
	if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
		int32_t	opt_len;

		num_sack_blk = MIN(tcp->tcp_max_sack_blk,
		    tcp->tcp_num_sack_blk);
		opt_len = num_sack_blk * sizeof (sack_blk_t) + TCPOPT_NOP_LEN *
		    2 + TCPOPT_HEADER_LEN;
		mss = tcp->tcp_mss - opt_len;
		tcp_hdr_len = tcp->tcp_hdr_len + opt_len;
	} else {
		mss = tcp->tcp_mss;
		tcp_hdr_len = tcp->tcp_hdr_len;
	}

	if ((tcp->tcp_suna == snxt) &&
	    (prom_gettime() - tcp->tcp_last_recv_time) >= tcp->tcp_rto) {
		tcp->tcp_cwnd = MIN(tcp_slow_start_after_idle * mss,
		    MIN(4 * mss, MAX(2 * mss, 4380 / mss * mss)));
	}
	if (tcpstate == TCPS_SYN_RCVD) {
		/*
		 * The three-way connection establishment handshake is not
		 * complete yet. We want to queue the data for transmission
		 * after entering ESTABLISHED state (RFC793). Setting usable to
		 * zero cause a jump to "done" label effectively leaving data
		 * on the queue.
		 */

		usable = 0;
	} else {
		int usable_r = tcp->tcp_swnd;

		/*
		 * In the special case when cwnd is zero, which can only
		 * happen if the connection is ECN capable, return now.
		 * New segments is sent using tcp_timer().  The timer
		 * is set in tcp_rput_data().
		 */
		if (tcp->tcp_cwnd == 0) {
			/*
			 * Note that tcp_cwnd is 0 before 3-way handshake is
			 * finished.
			 */
			assert(tcp->tcp_ecn_ok ||
			    tcp->tcp_state < TCPS_ESTABLISHED);
			return;
		}

		/* usable = MIN(swnd, cwnd) - unacked_bytes */
		if (usable_r > tcp->tcp_cwnd)
			usable_r = tcp->tcp_cwnd;

		/* NOTE: trouble if xmitting while SYN not acked? */
		usable_r -= snxt;
		usable_r += tcp->tcp_suna;

		/* usable = MIN(usable, unsent) */
		if (usable_r > len)
			usable_r = len;

		/* usable = MAX(usable, {1 for urgent, 0 for data}) */
		if (usable_r != 0)
			usable = usable_r;
	}

	/* use uintptr_t to suppress the gcc warning */
	local_time = (mblk_t *)(uintptr_t)prom_gettime();

	/*
	 * "Our" Nagle Algorithm.  This is not the same as in the old
	 * BSD.  This is more in line with the true intent of Nagle.
	 *
	 * The conditions are:
	 * 1. The amount of unsent data (or amount of data which can be
	 *    sent, whichever is smaller) is less than Nagle limit.
	 * 2. The last sent size is also less than Nagle limit.
	 * 3. There is unack'ed data.
	 * 4. Urgent pointer is not set.  Send urgent data ignoring the
	 *    Nagle algorithm.  This reduces the probability that urgent
	 *    bytes get "merged" together.
	 * 5. The app has not closed the connection.  This eliminates the
	 *    wait time of the receiving side waiting for the last piece of
	 *    (small) data.
	 *
	 * If all are satisified, exit without sending anything.  Note
	 * that Nagle limit can be smaller than 1 MSS.  Nagle limit is
	 * the smaller of 1 MSS and global tcp_naglim_def (default to be
	 * 4095).
	 */
	if (usable < (int)tcp->tcp_naglim &&
	    tcp->tcp_naglim > tcp->tcp_last_sent_len &&
	    snxt != tcp->tcp_suna &&
	    !(tcp->tcp_valid_bits & TCP_URG_VALID))
		goto done;

	num_burst_seg = tcp->tcp_snd_burst;
	for (;;) {
		tcph_t		*tcph;
		mblk_t		*new_mp;

		if (num_burst_seg-- == 0)
			goto done;

		len = mss;
		if (len > usable) {
			len = usable;
			if (len <= 0) {
				/* Terminate the loop */
				goto done;
			}
			/*
			 * Sender silly-window avoidance.
			 * Ignore this if we are going to send a
			 * zero window probe out.
			 *
			 * TODO: force data into microscopic window ??
			 *	==> (!pushed || (unsent > usable))
			 */
			if (len < (tcp->tcp_max_swnd >> 1) &&
			    (tcp->tcp_unsent - (snxt - tcp->tcp_snxt)) > len &&
			    !((tcp->tcp_valid_bits & TCP_URG_VALID) &&
			    len == 1) && (! tcp->tcp_zero_win_probe)) {
				/*
				 * If the retransmit timer is not running
				 * we start it so that we will retransmit
				 * in the case when the the receiver has
				 * decremented the window.
				 */
				if (snxt == tcp->tcp_snxt &&
				    snxt == tcp->tcp_suna) {
					/*
					 * We are not supposed to send
					 * anything.  So let's wait a little
					 * bit longer before breaking SWS
					 * avoidance.
					 *
					 * What should the value be?
					 * Suggestion: MAX(init rexmit time,
					 * tcp->tcp_rto)
					 */
					TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
				}
				goto done;
			}
		}

		tcph = tcp->tcp_tcph;

		usable -= len;	/* Approximate - can be adjusted later */
		if (usable > 0)
			tcph->th_flags[0] = TH_ACK;
		else
			tcph->th_flags[0] = (TH_ACK | TH_PUSH);

		U32_TO_ABE32(snxt, tcph->th_seq);

		if (tcp->tcp_valid_bits) {
			uchar_t		*prev_rptr = xmit_tail->b_rptr;
			uint32_t	prev_snxt = tcp->tcp_snxt;

			if (tail_unsent == 0) {
				assert(xmit_tail->b_cont != NULL);
				xmit_tail = xmit_tail->b_cont;
				prev_rptr = xmit_tail->b_rptr;
				tail_unsent = (int)(xmit_tail->b_wptr -
				    xmit_tail->b_rptr);
			} else {
				xmit_tail->b_rptr = xmit_tail->b_wptr -
				    tail_unsent;
			}
			mp = tcp_xmit_mp(tcp, xmit_tail, len, NULL, NULL,
			    snxt, B_FALSE, (uint32_t *)&len, B_FALSE);
			/* Restore tcp_snxt so we get amount sent right. */
			tcp->tcp_snxt = prev_snxt;
			if (prev_rptr == xmit_tail->b_rptr)
				xmit_tail->b_prev = local_time;
			else
				xmit_tail->b_rptr = prev_rptr;

			if (mp == NULL)
				break;

			mp1 = mp->b_cont;

			snxt += len;
			tcp->tcp_last_sent_len = (ushort_t)len;
			while (mp1->b_cont) {
				xmit_tail = xmit_tail->b_cont;
				xmit_tail->b_prev = local_time;
				mp1 = mp1->b_cont;
			}
			tail_unsent = xmit_tail->b_wptr - mp1->b_wptr;
			BUMP_MIB(tcp_mib.tcpOutDataSegs);
			UPDATE_MIB(tcp_mib.tcpOutDataBytes, len);
			/* Dump the packet when debugging. */
			TCP_DUMP_PACKET("tcp_wput_data (valid bits)", mp);
			(void) ipv4_tcp_output(sock_id, mp);
			freeb(mp);
			continue;
		}

		snxt += len;	/* Adjust later if we don't send all of len */
		BUMP_MIB(tcp_mib.tcpOutDataSegs);
		UPDATE_MIB(tcp_mib.tcpOutDataBytes, len);

		if (tail_unsent) {
			/* Are the bytes above us in flight? */
			rptr = xmit_tail->b_wptr - tail_unsent;
			if (rptr != xmit_tail->b_rptr) {
				tail_unsent -= len;
				len += tcp_hdr_len;
				tcp->tcp_ipha->ip_len = htons(len);
				mp = dupb(xmit_tail);
				if (!mp)
					break;
				mp->b_rptr = rptr;
				goto must_alloc;
			}
		} else {
			xmit_tail = xmit_tail->b_cont;
			assert((uintptr_t)(xmit_tail->b_wptr -
			    xmit_tail->b_rptr) <= (uintptr_t)INT_MAX);
			tail_unsent = (int)(xmit_tail->b_wptr -
			    xmit_tail->b_rptr);
		}

		tail_unsent -= len;
		tcp->tcp_last_sent_len = (ushort_t)len;

		len += tcp_hdr_len;
		if (tcp->tcp_ipversion == IPV4_VERSION)
			tcp->tcp_ipha->ip_len = htons(len);

		xmit_tail->b_prev = local_time;

		mp = dupb(xmit_tail);
		if (mp == NULL)
			goto out_of_mem;

		len = tcp_hdr_len;
		/*
		 * There are four reasons to allocate a new hdr mblk:
		 *  1) The bytes above us are in use by another packet
		 *  2) We don't have good alignment
		 *  3) The mblk is being shared
		 *  4) We don't have enough room for a header
		 */
		rptr = mp->b_rptr - len;
		if (!OK_32PTR(rptr) ||
		    rptr < mp->b_datap) {
			/* NOTE: we assume allocb returns an OK_32PTR */

		must_alloc:;
			mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH +
			    tcp_wroff_xtra, 0);
			if (mp1 == NULL) {
				freemsg(mp);
				goto out_of_mem;
			}
			mp1->b_cont = mp;
			mp = mp1;
			/* Leave room for Link Level header */
			len = tcp_hdr_len;
			rptr = &mp->b_rptr[tcp_wroff_xtra];
			mp->b_wptr = &rptr[len];
		}

		if (tcp->tcp_snd_ts_ok) {
			/* use uintptr_t to suppress the gcc warning */
			U32_TO_BE32((uint32_t)(uintptr_t)local_time,
				(char *)tcph+TCP_MIN_HEADER_LENGTH+4);
			U32_TO_BE32(tcp->tcp_ts_recent,
			    (char *)tcph+TCP_MIN_HEADER_LENGTH+8);
		} else {
			assert(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH);
		}

		mp->b_rptr = rptr;

		/* Copy the template header. */
		dst = (ipaddr_t *)rptr;
		src = (ipaddr_t *)tcp->tcp_iphc;
		dst[0] = src[0];
		dst[1] = src[1];
		dst[2] = src[2];
		dst[3] = src[3];
		dst[4] = src[4];
		dst[5] = src[5];
		dst[6] = src[6];
		dst[7] = src[7];
		dst[8] = src[8];
		dst[9] = src[9];
		len = tcp->tcp_hdr_len;
		if (len -= 40) {
			len >>= 2;
			dst += 10;
			src += 10;
			do {
				*dst++ = *src++;
			} while (--len);
		}

		/*
		 * Set tcph to point to the header of the outgoing packet,
		 * not to the template header.
		 */
		tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len);

		/*
		 * Set the ECN info in the TCP header if it is not a zero
		 * window probe.  Zero window probe is only sent in
		 * tcp_wput_data() and tcp_timer().
		 */
		if (tcp->tcp_ecn_ok && !tcp->tcp_zero_win_probe) {
			SET_ECT(tcp, rptr);

			if (tcp->tcp_ecn_echo_on)
				tcph->th_flags[0] |= TH_ECE;
			if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) {
				tcph->th_flags[0] |= TH_CWR;
				tcp->tcp_ecn_cwr_sent = B_TRUE;
			}
		}

		/* Fill in SACK options */
		if (num_sack_blk > 0) {
			uchar_t *wptr = rptr + tcp->tcp_hdr_len;
			sack_blk_t *tmp;
			int32_t	i;

			wptr[0] = TCPOPT_NOP;
			wptr[1] = TCPOPT_NOP;
			wptr[2] = TCPOPT_SACK;
			wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
			    sizeof (sack_blk_t);
			wptr += TCPOPT_REAL_SACK_LEN;

			tmp = tcp->tcp_sack_list;
			for (i = 0; i < num_sack_blk; i++) {
				U32_TO_BE32(tmp[i].begin, wptr);
				wptr += sizeof (tcp_seq);
				U32_TO_BE32(tmp[i].end, wptr);
				wptr += sizeof (tcp_seq);
			}
			tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1)
			    << 4);
		}

		if (tail_unsent) {
			mp1 = mp->b_cont;
			if (mp1 == NULL)
				mp1 = mp;
			/*
			 * If we're a little short, tack on more mblks
			 * as long as we don't need to split an mblk.
			 */
			while (tail_unsent < 0 &&
			    tail_unsent + (int)(xmit_tail->b_cont->b_wptr -
			    xmit_tail->b_cont->b_rptr) <= 0) {
				xmit_tail = xmit_tail->b_cont;
				/* Stash for rtt use later */
				xmit_tail->b_prev = local_time;
				mp1->b_cont = dupb(xmit_tail);
				mp1 = mp1->b_cont;
				assert((uintptr_t)(xmit_tail->b_wptr -
				    xmit_tail->b_rptr) <= (uintptr_t)INT_MAX);
				tail_unsent += (int)(xmit_tail->b_wptr -
				    xmit_tail->b_rptr);
				if (mp1 == NULL) {
					freemsg(mp);
					goto out_of_mem;
				}
			}
			/* Trim back any surplus on the last mblk */
			if (tail_unsent > 0)
				mp1->b_wptr -= tail_unsent;
			if (tail_unsent < 0) {
				uint32_t ip_len;

				/*
				 * We did not send everything we could in
				 * order to preserve mblk boundaries.
				 */
				usable -= tail_unsent;
				snxt += tail_unsent;
				tcp->tcp_last_sent_len += tail_unsent;
				UPDATE_MIB(tcp_mib.tcpOutDataBytes,
				    tail_unsent);
				/* Adjust the IP length field. */
				ip_len = ntohs(((struct ip *)rptr)->ip_len) +
				    tail_unsent;
				((struct ip *)rptr)->ip_len = htons(ip_len);
				tail_unsent = 0;
			}
		}

		if (mp == NULL)
			goto out_of_mem;

		/*
		 * Performance hit!  We need to pullup the whole message
		 * in order to do checksum and for the MAC output routine.
		 */
		if (mp->b_cont != NULL) {
			int mp_size;
#ifdef	DEBUG
			printf("Multiple mblk %d\n", msgdsize(mp));
#endif
			new_mp = allocb(msgdsize(mp) + tcp_wroff_xtra, 0);
			new_mp->b_rptr += tcp_wroff_xtra;
			new_mp->b_wptr = new_mp->b_rptr;
			while (mp != NULL) {
				mp_size = mp->b_wptr - mp->b_rptr;
				bcopy(mp->b_rptr, new_mp->b_wptr, mp_size);
				new_mp->b_wptr += mp_size;
				mp = mp->b_cont;
			}
			freemsg(mp);
			mp = new_mp;
		}
		tcp_set_cksum(mp);
		((struct ip *)mp->b_rptr)->ip_ttl = (uint8_t)tcp_ipv4_ttl;
		TCP_DUMP_PACKET("tcp_wput_data", mp);
		(void) ipv4_tcp_output(sock_id, mp);
		freemsg(mp);
	}
out_of_mem:;
	/* Pretend that all we were trying to send really got sent */
	if (tail_unsent < 0) {
		do {
			xmit_tail = xmit_tail->b_cont;
			xmit_tail->b_prev = local_time;
			assert((uintptr_t)(xmit_tail->b_wptr -
			    xmit_tail->b_rptr) <= (uintptr_t)INT_MAX);
			tail_unsent += (int)(xmit_tail->b_wptr -
			    xmit_tail->b_rptr);
		} while (tail_unsent < 0);
	}
done:;
	tcp->tcp_xmit_tail = xmit_tail;
	tcp->tcp_xmit_tail_unsent = tail_unsent;
	len = tcp->tcp_snxt - snxt;
	if (len) {
		/*
		 * If new data was sent, need to update the notsack
		 * list, which is, afterall, data blocks that have
		 * not been sack'ed by the receiver.  New data is
		 * not sack'ed.
		 */
		if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
			/* len is a negative value. */
			tcp->tcp_pipe -= len;
			tcp_notsack_update(&(tcp->tcp_notsack_list),
			    tcp->tcp_snxt, snxt,
			    &(tcp->tcp_num_notsack_blk),
			    &(tcp->tcp_cnt_notsack_list));
		}
		tcp->tcp_snxt = snxt + tcp->tcp_fin_sent;
		tcp->tcp_rack = tcp->tcp_rnxt;
		tcp->tcp_rack_cnt = 0;
		if ((snxt + len) == tcp->tcp_suna) {
			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
		}
		/*
		 * Note that len is the amount we just sent but with a negative
		 * sign. We update tcp_unsent here since we may come back to
		 * tcp_wput_data from tcp_state_wait.
		 */
		len += tcp->tcp_unsent;
		tcp->tcp_unsent = len;

		/*
		 * Let's wait till all the segments have been acked, since we
		 * don't have a timer.
		 */
		(void) tcp_state_wait(sock_id, tcp, TCPS_ALL_ACKED);
		return;
	} else if (snxt == tcp->tcp_suna && tcp->tcp_swnd == 0) {
		/*
		 * Didn't send anything. Make sure the timer is running
		 * so that we will probe a zero window.
		 */
		TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
	}

	/* Note that len is the amount we just sent but with a negative sign */
	len += tcp->tcp_unsent;
	tcp->tcp_unsent = len;

}

static void
tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp,
    uint32_t seg_seq, uint32_t seg_ack, int seg_len, tcph_t *tcph,
    int sock_id)
{
	int32_t		bytes_acked;
	int32_t		gap;
	int32_t		rgap;
	tcp_opt_t	tcpopt;
	uint_t		flags;
	uint32_t	new_swnd = 0;

#ifdef DEBUG
	printf("Time wait processing called ###############3\n");
#endif

	/* Just make sure we send the right sock_id to tcp_clean_death */
	if ((sockets[sock_id].pcb == NULL) || (sockets[sock_id].pcb != tcp))
		sock_id = -1;

	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
	new_swnd = BE16_TO_U16(tcph->th_win) <<
	    ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws);
	if (tcp->tcp_snd_ts_ok) {
		if (!tcp_paws_check(tcp, tcph, &tcpopt)) {
			freemsg(mp);
			tcp_xmit_ctl(NULL, tcp, NULL, tcp->tcp_snxt,
			    tcp->tcp_rnxt, TH_ACK, 0, -1);
			return;
		}
	}
	gap = seg_seq - tcp->tcp_rnxt;
	rgap = tcp->tcp_rwnd - (gap + seg_len);
	if (gap < 0) {
		BUMP_MIB(tcp_mib.tcpInDataDupSegs);
		UPDATE_MIB(tcp_mib.tcpInDataDupBytes,
		    (seg_len > -gap ? -gap : seg_len));
		seg_len += gap;
		if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
			if (flags & TH_RST) {
				freemsg(mp);
				return;
			}
			if ((flags & TH_FIN) && seg_len == -1) {
				/*
				 * When TCP receives a duplicate FIN in
				 * TIME_WAIT state, restart the 2 MSL timer.
				 * See page 73 in RFC 793. Make sure this TCP
				 * is already on the TIME_WAIT list. If not,
				 * just restart the timer.
				 */
				tcp_time_wait_remove(tcp);
				tcp_time_wait_append(tcp);
				TCP_TIMER_RESTART(tcp, tcp_time_wait_interval);
				tcp_xmit_ctl(NULL, tcp, NULL, tcp->tcp_snxt,
				    tcp->tcp_rnxt, TH_ACK, 0, -1);
				freemsg(mp);
				return;
			}
			flags |=  TH_ACK_NEEDED;
			seg_len = 0;
			goto process_ack;
		}

		/* Fix seg_seq, and chew the gap off the front. */
		seg_seq = tcp->tcp_rnxt;
	}

	if ((flags & TH_SYN) && gap > 0 && rgap < 0) {
		/*
		 * Make sure that when we accept the connection, pick
		 * an ISS greater than (tcp_snxt + ISS_INCR/2) for the
		 * old connection.
		 *
		 * The next ISS generated is equal to tcp_iss_incr_extra
		 * + ISS_INCR/2 + other components depending on the
		 * value of tcp_strong_iss.  We pre-calculate the new
		 * ISS here and compare with tcp_snxt to determine if
		 * we need to make adjustment to tcp_iss_incr_extra.
		 *
		 * Note that since we are now in the global queue
		 * perimeter and need to do a lateral_put() to the
		 * listener queue, there can be other connection requests/
		 * attempts while the lateral_put() is going on.  That
		 * means what we calculate here may not be correct.  This
		 * is extremely difficult to solve unless TCP and IP
		 * modules are merged and there is no perimeter, but just
		 * locks.  The above calculation is ugly and is a
		 * waste of CPU cycles...
		 */
		uint32_t new_iss = tcp_iss_incr_extra;
		int32_t adj;

		/* Add time component and min random (i.e. 1). */
		new_iss += (prom_gettime() >> ISS_NSEC_SHT) + 1;
		if ((adj = (int32_t)(tcp->tcp_snxt - new_iss)) > 0) {
			/*
			 * New ISS not guaranteed to be ISS_INCR/2
			 * ahead of the current tcp_snxt, so add the
			 * difference to tcp_iss_incr_extra.
			 */
			tcp_iss_incr_extra += adj;
		}
		tcp_clean_death(sock_id, tcp, 0);

		/*
		 * This is a passive open.  Right now we do not
		 * do anything...
		 */
		freemsg(mp);
		return;
	}

	/*
	 * rgap is the amount of stuff received out of window.  A negative
	 * value is the amount out of window.
	 */
	if (rgap < 0) {
		BUMP_MIB(tcp_mib.tcpInDataPastWinSegs);
		UPDATE_MIB(tcp_mib.tcpInDataPastWinBytes, -rgap);
		/* Fix seg_len and make sure there is something left. */
		seg_len += rgap;
		if (seg_len <= 0) {
			if (flags & TH_RST) {
				freemsg(mp);
				return;
			}
			flags |=  TH_ACK_NEEDED;
			seg_len = 0;
			goto process_ack;
		}
	}
	/*
	 * Check whether we can update tcp_ts_recent.  This test is
	 * NOT the one in RFC 1323 3.4.  It is from Braden, 1993, "TCP
	 * Extensions for High Performance: An Update", Internet Draft.
	 */
	if (tcp->tcp_snd_ts_ok &&
	    TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
	    SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
		tcp->tcp_last_rcv_lbolt = prom_gettime();
	}

	if (seg_seq != tcp->tcp_rnxt && seg_len > 0) {
		/* Always ack out of order packets */
		flags |= TH_ACK_NEEDED;
		seg_len = 0;
	} else if (seg_len > 0) {
		BUMP_MIB(tcp_mib.tcpInDataInorderSegs);
		UPDATE_MIB(tcp_mib.tcpInDataInorderBytes, seg_len);
	}
	if (flags & TH_RST) {
		freemsg(mp);
		(void) tcp_clean_death(sock_id, tcp, 0);
		return;
	}
	if (flags & TH_SYN) {
		freemsg(mp);
		tcp_xmit_ctl("TH_SYN", tcp, NULL, seg_ack, seg_seq + 1,
		    TH_RST|TH_ACK, 0, -1);
		/*
		 * Do not delete the TCP structure if it is in
		 * TIME_WAIT state.  Refer to RFC 1122, 4.2.2.13.
		 */
		return;
	}
process_ack:
	if (flags & TH_ACK) {
		bytes_acked = (int)(seg_ack - tcp->tcp_suna);
		if (bytes_acked <= 0) {
			if (bytes_acked == 0 && seg_len == 0 &&
			    new_swnd == tcp->tcp_swnd)
				BUMP_MIB(tcp_mib.tcpInDupAck);
		} else {
			/* Acks something not sent */
			flags |= TH_ACK_NEEDED;
		}
	}
	freemsg(mp);
	if (flags & TH_ACK_NEEDED) {
		/*
		 * Time to send an ack for some reason.
		 */
		tcp_xmit_ctl(NULL, tcp, NULL, tcp->tcp_snxt,
		    tcp->tcp_rnxt, TH_ACK, 0, -1);
	}
}

static int
tcp_init_values(tcp_t *tcp, struct inetboot_socket *isp)
{
	int	err;

	tcp->tcp_family = AF_INET;
	tcp->tcp_ipversion = IPV4_VERSION;

	/*
	 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO
	 * will be close to tcp_rexmit_interval_initial.  By doing this, we
	 * allow the algorithm to adjust slowly to large fluctuations of RTT
	 * during first few transmissions of a connection as seen in slow
	 * links.
	 */
	tcp->tcp_rtt_sa = tcp_rexmit_interval_initial << 2;
	tcp->tcp_rtt_sd = tcp_rexmit_interval_initial >> 1;
	tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
	    tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) +
	    tcp_conn_grace_period;
	if (tcp->tcp_rto < tcp_rexmit_interval_min)
		tcp->tcp_rto = tcp_rexmit_interval_min;
	tcp->tcp_timer_backoff = 0;
	tcp->tcp_ms_we_have_waited = 0;
	tcp->tcp_last_recv_time = prom_gettime();
	tcp->tcp_cwnd_max = tcp_cwnd_max_;
	tcp->tcp_snd_burst = TCP_CWND_INFINITE;
	tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
	/* For Ethernet, the mtu returned is actually 1550... */
	if (mac_get_type() == IFT_ETHER) {
		tcp->tcp_if_mtu = mac_get_mtu() - 50;
	} else {
		tcp->tcp_if_mtu = mac_get_mtu();
	}
	tcp->tcp_mss = tcp->tcp_if_mtu;

	tcp->tcp_first_timer_threshold = tcp_ip_notify_interval;
	tcp->tcp_first_ctimer_threshold = tcp_ip_notify_cinterval;
	tcp->tcp_second_timer_threshold = tcp_ip_abort_interval;
	/*
	 * Fix it to tcp_ip_abort_linterval later if it turns out to be a
	 * passive open.
	 */
	tcp->tcp_second_ctimer_threshold = tcp_ip_abort_cinterval;

	tcp->tcp_naglim = tcp_naglim_def;

	/* NOTE:  ISS is now set in tcp_adapt_ire(). */

	/* Initialize the header template */
	if (tcp->tcp_ipversion == IPV4_VERSION) {
		err = tcp_header_init_ipv4(tcp);
	}
	if (err)
		return (err);

	/*
	 * Init the window scale to the max so tcp_rwnd_set() won't pare
	 * down tcp_rwnd. tcp_adapt_ire() will set the right value later.
	 */
	tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT;
	tcp->tcp_xmit_lowater = tcp_xmit_lowat;
	if (isp != NULL) {
		tcp->tcp_xmit_hiwater = isp->so_sndbuf;
		tcp->tcp_rwnd = isp->so_rcvbuf;
		tcp->tcp_rwnd_max = isp->so_rcvbuf;
	}
	tcp->tcp_state = TCPS_IDLE;
	return (0);
}

/*
 * Initialize the IPv4 header. Loses any record of any IP options.
 */
static int
tcp_header_init_ipv4(tcp_t *tcp)
{
	tcph_t		*tcph;

	/*
	 * This is a simple initialization. If there's
	 * already a template, it should never be too small,
	 * so reuse it.  Otherwise, allocate space for the new one.
	 */
	if (tcp->tcp_iphc != NULL) {
		assert(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH);
		bzero(tcp->tcp_iphc, tcp->tcp_iphc_len);
	} else {
		tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH;
		tcp->tcp_iphc = bkmem_zalloc(tcp->tcp_iphc_len);
		if (tcp->tcp_iphc == NULL) {
			tcp->tcp_iphc_len = 0;
			return (ENOMEM);
		}
	}
	tcp->tcp_ipha = (struct ip *)tcp->tcp_iphc;
	tcp->tcp_ipversion = IPV4_VERSION;

	/*
	 * Note that it does not include TCP options yet.  It will
	 * after the connection is established.
	 */
	tcp->tcp_hdr_len = sizeof (struct ip) + sizeof (tcph_t);
	tcp->tcp_tcp_hdr_len = sizeof (tcph_t);
	tcp->tcp_ip_hdr_len = sizeof (struct ip);
	tcp->tcp_ipha->ip_v = IP_VERSION;
	/* We don't support IP options... */
	tcp->tcp_ipha->ip_hl = IP_SIMPLE_HDR_LENGTH_IN_WORDS;
	tcp->tcp_ipha->ip_p = IPPROTO_TCP;
	/* We are not supposed to do PMTU discovery... */
	tcp->tcp_ipha->ip_sum = 0;

	tcph = (tcph_t *)(tcp->tcp_iphc + sizeof (struct ip));
	tcp->tcp_tcph = tcph;
	tcph->th_offset_and_rsrvd[0] = (5 << 4);
	return (0);
}

/*
 * Send out a control packet on the tcp connection specified.  This routine
 * is typically called where we need a simple ACK or RST generated.
 *
 * This function is called with or without a mp.
 */
static void
tcp_xmit_ctl(char *str, tcp_t *tcp, mblk_t *mp, uint32_t seq,
    uint32_t ack, int ctl, uint_t ip_hdr_len, int sock_id)
{
	uchar_t		*rptr;
	tcph_t		*tcph;
	struct ip	*iph = NULL;
	int		tcp_hdr_len;
	int		tcp_ip_hdr_len;

	tcp_hdr_len = tcp->tcp_hdr_len;
	tcp_ip_hdr_len = tcp->tcp_ip_hdr_len;

	if (mp) {
		assert(ip_hdr_len != 0);
		rptr = mp->b_rptr;
		tcph = (tcph_t *)(rptr + ip_hdr_len);
		/* Don't reply to a RST segment. */
		if (tcph->th_flags[0] & TH_RST) {
			freeb(mp);
			return;
		}
		freemsg(mp);
		rptr = NULL;
	} else {
		assert(ip_hdr_len == 0);
	}
	/* If a text string is passed in with the request, print it out. */
	if (str != NULL) {
		dprintf("tcp_xmit_ctl(%d): '%s', seq 0x%x, ack 0x%x, "
		    "ctl 0x%x\n", sock_id, str, seq, ack, ctl);
	}
	mp = allocb(tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra, 0);
	if (mp == NULL) {
		dprintf("tcp_xmit_ctl(%d): Cannot allocate memory\n", sock_id);
		return;
	}
	rptr = &mp->b_rptr[tcp_wroff_xtra];
	mp->b_rptr = rptr;
	mp->b_wptr = &rptr[tcp_hdr_len];
	bcopy(tcp->tcp_iphc, rptr, tcp_hdr_len);

	iph = (struct ip *)rptr;
	iph->ip_len = htons(tcp_hdr_len);

	tcph = (tcph_t *)&rptr[tcp_ip_hdr_len];
	tcph->th_flags[0] = (uint8_t)ctl;
	if (ctl & TH_RST) {
		BUMP_MIB(tcp_mib.tcpOutRsts);
		BUMP_MIB(tcp_mib.tcpOutControl);
		/*
		 * Don't send TSopt w/ TH_RST packets per RFC 1323.
		 */
		if (tcp->tcp_snd_ts_ok && tcp->tcp_state > TCPS_SYN_SENT) {
			mp->b_wptr = &rptr[tcp_hdr_len - TCPOPT_REAL_TS_LEN];
			*(mp->b_wptr) = TCPOPT_EOL;
			iph->ip_len = htons(tcp_hdr_len -
			    TCPOPT_REAL_TS_LEN);
			tcph->th_offset_and_rsrvd[0] -= (3 << 4);
		}
	}
	if (ctl & TH_ACK) {
		uint32_t now = prom_gettime();

		if (tcp->tcp_snd_ts_ok) {
			U32_TO_BE32(now,
			    (char *)tcph+TCP_MIN_HEADER_LENGTH+4);
			U32_TO_BE32(tcp->tcp_ts_recent,
			    (char *)tcph+TCP_MIN_HEADER_LENGTH+8);
		}
		tcp->tcp_rack = ack;
		tcp->tcp_rack_cnt = 0;
		BUMP_MIB(tcp_mib.tcpOutAck);
	}
	BUMP_MIB(tcp_mib.tcpOutSegs);
	U32_TO_BE32(seq, tcph->th_seq);
	U32_TO_BE32(ack, tcph->th_ack);

	tcp_set_cksum(mp);
	iph->ip_ttl = (uint8_t)tcp_ipv4_ttl;
	TCP_DUMP_PACKET("tcp_xmit_ctl", mp);
	(void) ipv4_tcp_output(sock_id, mp);
	freeb(mp);
}

/* Generate an ACK-only (no data) segment for a TCP endpoint */
static mblk_t *
tcp_ack_mp(tcp_t *tcp)
{
	if (tcp->tcp_valid_bits) {
		/*
		 * For the complex case where we have to send some
		 * controls (FIN or SYN), let tcp_xmit_mp do it.
		 * When sending an ACK-only segment (no data)
		 * into a zero window, always set the seq number to
		 * suna, since snxt will be extended past the window.
		 * If we used snxt, the receiver might consider the ACK
		 * unacceptable.
		 */
		return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL,
		    (tcp->tcp_zero_win_probe) ?
		    tcp->tcp_suna :
		    tcp->tcp_snxt, B_FALSE, NULL, B_FALSE));
	} else {
		/* Generate a simple ACK */
		uchar_t	*rptr;
		tcph_t	*tcph;
		mblk_t	*mp1;
		int32_t	tcp_hdr_len;
		int32_t	num_sack_blk = 0;
		int32_t sack_opt_len;

		/*
		 * Allocate space for TCP + IP headers
		 * and link-level header
		 */
		if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
			num_sack_blk = MIN(tcp->tcp_max_sack_blk,
			    tcp->tcp_num_sack_blk);
			sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
			    TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
			tcp_hdr_len = tcp->tcp_hdr_len + sack_opt_len;
		} else {
			tcp_hdr_len = tcp->tcp_hdr_len;
		}
		mp1 = allocb(tcp_hdr_len + tcp_wroff_xtra, 0);
		if (mp1 == NULL)
			return (NULL);

		/* copy in prototype TCP + IP header */
		rptr = mp1->b_rptr + tcp_wroff_xtra;
		mp1->b_rptr = rptr;
		mp1->b_wptr = rptr + tcp_hdr_len;
		bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len);

		tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len];

		/*
		 * Set the TCP sequence number.
		 * When sending an ACK-only segment (no data)
		 * into a zero window, always set the seq number to
		 * suna, since snxt will be extended past the window.
		 * If we used snxt, the receiver might consider the ACK
		 * unacceptable.
		 */
		U32_TO_ABE32((tcp->tcp_zero_win_probe) ?
		    tcp->tcp_suna : tcp->tcp_snxt, tcph->th_seq);

		/* Set up the TCP flag field. */
		tcph->th_flags[0] = (uchar_t)TH_ACK;
		if (tcp->tcp_ecn_echo_on)
			tcph->th_flags[0] |= TH_ECE;

		tcp->tcp_rack = tcp->tcp_rnxt;
		tcp->tcp_rack_cnt = 0;

		/* fill in timestamp option if in use */
		if (tcp->tcp_snd_ts_ok) {
			uint32_t llbolt = (uint32_t)prom_gettime();

			U32_TO_BE32(llbolt,
			    (char *)tcph+TCP_MIN_HEADER_LENGTH+4);
			U32_TO_BE32(tcp->tcp_ts_recent,
			    (char *)tcph+TCP_MIN_HEADER_LENGTH+8);
		}

		/* Fill in SACK options */
		if (num_sack_blk > 0) {
			uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len;
			sack_blk_t *tmp;
			int32_t	i;

			wptr[0] = TCPOPT_NOP;
			wptr[1] = TCPOPT_NOP;
			wptr[2] = TCPOPT_SACK;
			wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
			    sizeof (sack_blk_t);
			wptr += TCPOPT_REAL_SACK_LEN;

			tmp = tcp->tcp_sack_list;
			for (i = 0; i < num_sack_blk; i++) {
				U32_TO_BE32(tmp[i].begin, wptr);
				wptr += sizeof (tcp_seq);
				U32_TO_BE32(tmp[i].end, wptr);
				wptr += sizeof (tcp_seq);
			}
			tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1)
			    << 4);
		}

		((struct ip *)rptr)->ip_len = htons(tcp_hdr_len);
		tcp_set_cksum(mp1);
		((struct ip *)rptr)->ip_ttl = (uint8_t)tcp_ipv4_ttl;
		return (mp1);
	}
}

/*
 * tcp_xmit_mp is called to return a pointer to an mblk chain complete with
 * ip and tcp header ready to pass down to IP.  If the mp passed in is
 * non-NULL, then up to max_to_send bytes of data will be dup'ed off that
 * mblk. (If sendall is not set the dup'ing will stop at an mblk boundary
 * otherwise it will dup partial mblks.)
 * Otherwise, an appropriate ACK packet will be generated.  This
 * routine is not usually called to send new data for the first time.  It
 * is mostly called out of the timer for retransmits, and to generate ACKs.
 *
 * If offset is not NULL, the returned mblk chain's first mblk's b_rptr will
 * be adjusted by *offset.  And after dupb(), the offset and the ending mblk
 * of the original mblk chain will be returned in *offset and *end_mp.
 */
static mblk_t *
tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, int32_t *offset,
    mblk_t **end_mp, uint32_t seq, boolean_t sendall, uint32_t *seg_len,
    boolean_t rexmit)
{
	int	data_length;
	int32_t	off = 0;
	uint_t	flags;
	mblk_t	*mp1;
	mblk_t	*mp2;
	mblk_t	*new_mp;
	uchar_t	*rptr;
	tcph_t	*tcph;
	int32_t	num_sack_blk = 0;
	int32_t	sack_opt_len = 0;

	/* Allocate for our maximum TCP header + link-level */
	mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH +
	    tcp_wroff_xtra, 0);
	if (mp1 == NULL)
		return (NULL);
	data_length = 0;

	/*
	 * Note that tcp_mss has been adjusted to take into account the
	 * timestamp option if applicable.  Because SACK options do not
	 * appear in every TCP segments and they are of variable lengths,
	 * they cannot be included in tcp_mss.  Thus we need to calculate
	 * the actual segment length when we need to send a segment which
	 * includes SACK options.
	 */
	if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
		num_sack_blk = MIN(tcp->tcp_max_sack_blk,
		    tcp->tcp_num_sack_blk);
		sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
		    TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
		if (max_to_send + sack_opt_len > tcp->tcp_mss)
			max_to_send -= sack_opt_len;
	}

	if (offset != NULL) {
		off = *offset;
		/* We use offset as an indicator that end_mp is not NULL. */
		*end_mp = NULL;
	}
	for (mp2 = mp1; mp && data_length != max_to_send; mp = mp->b_cont) {
		/* This could be faster with cooperation from downstream */
		if (mp2 != mp1 && !sendall &&
		    data_length + (int)(mp->b_wptr - mp->b_rptr) >
		    max_to_send)
			/*
			 * Don't send the next mblk since the whole mblk
			 * does not fit.
			 */
			break;
		mp2->b_cont = dupb(mp);
		mp2 = mp2->b_cont;
		if (mp2 == NULL) {
			freemsg(mp1);
			return (NULL);
		}
		mp2->b_rptr += off;
		assert((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
		    (uintptr_t)INT_MAX);

		data_length += (int)(mp2->b_wptr - mp2->b_rptr);
		if (data_length > max_to_send) {
			mp2->b_wptr -= data_length - max_to_send;
			data_length = max_to_send;
			off = mp2->b_wptr - mp->b_rptr;
			break;
		} else {
			off = 0;
		}
	}
	if (offset != NULL) {
		*offset = off;
		*end_mp = mp;
	}
	if (seg_len != NULL) {
		*seg_len = data_length;
	}

	rptr = mp1->b_rptr + tcp_wroff_xtra;
	mp1->b_rptr = rptr;
	mp1->b_wptr = rptr + tcp->tcp_hdr_len + sack_opt_len;
	bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len);
	tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len];
	U32_TO_ABE32(seq, tcph->th_seq);

	/*
	 * Use tcp_unsent to determine if the PUSH bit should be used assumes
	 * that this function was called from tcp_wput_data. Thus, when called
	 * to retransmit data the setting of the PUSH bit may appear some
	 * what random in that it might get set when it should not. This
	 * should not pose any performance issues.
	 */
	if (data_length != 0 && (tcp->tcp_unsent == 0 ||
	    tcp->tcp_unsent == data_length)) {
		flags = TH_ACK | TH_PUSH;
	} else {
		flags = TH_ACK;
	}

	if (tcp->tcp_ecn_ok) {
		if (tcp->tcp_ecn_echo_on)
			flags |= TH_ECE;

		/*
		 * Only set ECT bit and ECN_CWR if a segment contains new data.
		 * There is no TCP flow control for non-data segments, and
		 * only data segment is transmitted reliably.
		 */
		if (data_length > 0 && !rexmit) {
			SET_ECT(tcp, rptr);
			if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) {
				flags |= TH_CWR;
				tcp->tcp_ecn_cwr_sent = B_TRUE;
			}
		}
	}

	if (tcp->tcp_valid_bits) {
		uint32_t u1;

		if ((tcp->tcp_valid_bits & TCP_ISS_VALID) &&
		    seq == tcp->tcp_iss) {
			uchar_t	*wptr;

			/*
			 * Tack on the MSS option.  It is always needed
			 * for both active and passive open.
			 */
			wptr = mp1->b_wptr;
			wptr[0] = TCPOPT_MAXSEG;
			wptr[1] = TCPOPT_MAXSEG_LEN;
			wptr += 2;
			/*
			 * MSS option value should be interface MTU - MIN
			 * TCP/IP header.
			 */
			u1 = tcp->tcp_if_mtu - IP_SIMPLE_HDR_LENGTH -
			    TCP_MIN_HEADER_LENGTH;
			U16_TO_BE16(u1, wptr);
			mp1->b_wptr = wptr + 2;
			/* Update the offset to cover the additional word */
			tcph->th_offset_and_rsrvd[0] += (1 << 4);

			/*
			 * Note that the following way of filling in
			 * TCP options are not optimal.  Some NOPs can
			 * be saved.  But there is no need at this time
			 * to optimize it.  When it is needed, we will
			 * do it.
			 */
			switch (tcp->tcp_state) {
			case TCPS_SYN_SENT:
				flags = TH_SYN;

				if (tcp->tcp_snd_ws_ok) {
					wptr = mp1->b_wptr;
					wptr[0] =  TCPOPT_NOP;
					wptr[1] =  TCPOPT_WSCALE;
					wptr[2] =  TCPOPT_WS_LEN;
					wptr[3] = (uchar_t)tcp->tcp_rcv_ws;
					mp1->b_wptr += TCPOPT_REAL_WS_LEN;
					tcph->th_offset_and_rsrvd[0] +=
					    (1 << 4);
				}

				if (tcp->tcp_snd_ts_ok) {
					uint32_t llbolt;

					llbolt = prom_gettime();
					wptr = mp1->b_wptr;
					wptr[0] = TCPOPT_NOP;
					wptr[1] = TCPOPT_NOP;
					wptr[2] = TCPOPT_TSTAMP;
					wptr[3] = TCPOPT_TSTAMP_LEN;
					wptr += 4;
					U32_TO_BE32(llbolt, wptr);
					wptr += 4;
					assert(tcp->tcp_ts_recent == 0);
					U32_TO_BE32(0L, wptr);
					mp1->b_wptr += TCPOPT_REAL_TS_LEN;
					tcph->th_offset_and_rsrvd[0] +=
					    (3 << 4);
				}

				if (tcp->tcp_snd_sack_ok) {
					wptr = mp1->b_wptr;
					wptr[0] = TCPOPT_NOP;
					wptr[1] = TCPOPT_NOP;
					wptr[2] = TCPOPT_SACK_PERMITTED;
					wptr[3] = TCPOPT_SACK_OK_LEN;
					mp1->b_wptr += TCPOPT_REAL_SACK_OK_LEN;
					tcph->th_offset_and_rsrvd[0] +=
					    (1 << 4);
				}

				/*
				 * Set up all the bits to tell other side
				 * we are ECN capable.
				 */
				if (tcp->tcp_ecn_ok) {
					flags |= (TH_ECE | TH_CWR);
				}
				break;
			case TCPS_SYN_RCVD:
				flags |= TH_SYN;

				if (tcp->tcp_snd_ws_ok) {
				    wptr = mp1->b_wptr;
				    wptr[0] =  TCPOPT_NOP;
				    wptr[1] =  TCPOPT_WSCALE;
				    wptr[2] =  TCPOPT_WS_LEN;
				    wptr[3] = (uchar_t)tcp->tcp_rcv_ws;
				    mp1->b_wptr += TCPOPT_REAL_WS_LEN;
				    tcph->th_offset_and_rsrvd[0] += (1 << 4);
				}

				if (tcp->tcp_snd_sack_ok) {
					wptr = mp1->b_wptr;
					wptr[0] = TCPOPT_NOP;
					wptr[1] = TCPOPT_NOP;
					wptr[2] = TCPOPT_SACK_PERMITTED;
					wptr[3] = TCPOPT_SACK_OK_LEN;
					mp1->b_wptr += TCPOPT_REAL_SACK_OK_LEN;
					tcph->th_offset_and_rsrvd[0] +=
					    (1 << 4);
				}

				/*
				 * If the other side is ECN capable, reply
				 * that we are also ECN capable.
				 */
				if (tcp->tcp_ecn_ok) {
					flags |= TH_ECE;
				}
				break;
			default:
				break;
			}
			/* allocb() of adequate mblk assures space */
			assert((uintptr_t)(mp1->b_wptr -
			    mp1->b_rptr) <= (uintptr_t)INT_MAX);
			if (flags & TH_SYN)
				BUMP_MIB(tcp_mib.tcpOutControl);
		}
		if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
		    (seq + data_length) == tcp->tcp_fss) {
			if (!tcp->tcp_fin_acked) {
				flags |= TH_FIN;
				BUMP_MIB(tcp_mib.tcpOutControl);
			}
			if (!tcp->tcp_fin_sent) {
				tcp->tcp_fin_sent = B_TRUE;
				switch (tcp->tcp_state) {
				case TCPS_SYN_RCVD:
				case TCPS_ESTABLISHED:
					tcp->tcp_state = TCPS_FIN_WAIT_1;
					break;
				case TCPS_CLOSE_WAIT:
					tcp->tcp_state = TCPS_LAST_ACK;
					break;
				}
				if (tcp->tcp_suna == tcp->tcp_snxt) {
					TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
				}
				tcp->tcp_snxt = tcp->tcp_fss + 1;
			}
		}
	}
	tcph->th_flags[0] = (uchar_t)flags;
	tcp->tcp_rack = tcp->tcp_rnxt;
	tcp->tcp_rack_cnt = 0;

	if (tcp->tcp_snd_ts_ok) {
		if (tcp->tcp_state != TCPS_SYN_SENT) {
			uint32_t llbolt = prom_gettime();

			U32_TO_BE32(llbolt,
			    (char *)tcph+TCP_MIN_HEADER_LENGTH+4);
			U32_TO_BE32(tcp->tcp_ts_recent,
			    (char *)tcph+TCP_MIN_HEADER_LENGTH+8);
		}
	}

	if (num_sack_blk > 0) {
		uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len;
		sack_blk_t *tmp;
		int32_t	i;

		wptr[0] = TCPOPT_NOP;
		wptr[1] = TCPOPT_NOP;
		wptr[2] = TCPOPT_SACK;
		wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
		    sizeof (sack_blk_t);
		wptr += TCPOPT_REAL_SACK_LEN;

		tmp = tcp->tcp_sack_list;
		for (i = 0; i < num_sack_blk; i++) {
			U32_TO_BE32(tmp[i].begin, wptr);
			wptr += sizeof (tcp_seq);
			U32_TO_BE32(tmp[i].end, wptr);
			wptr += sizeof (tcp_seq);
		}
		tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1) << 4);
	}
	assert((uintptr_t)(mp1->b_wptr - rptr) <= (uintptr_t)INT_MAX);
	data_length += (int)(mp1->b_wptr - rptr);
	if (tcp->tcp_ipversion == IPV4_VERSION)
		((struct ip *)rptr)->ip_len = htons(data_length);

	/*
	 * Performance hit!  We need to pullup the whole message
	 * in order to do checksum and for the MAC output routine.
	 */
	if (mp1->b_cont != NULL) {
		int mp_size;
#ifdef DEBUG
		printf("Multiple mblk %d\n", msgdsize(mp1));
#endif
		mp2 = mp1;
		new_mp = allocb(msgdsize(mp1) + tcp_wroff_xtra, 0);
		new_mp->b_rptr += tcp_wroff_xtra;
		new_mp->b_wptr = new_mp->b_rptr;
		while (mp1 != NULL) {
			mp_size = mp1->b_wptr - mp1->b_rptr;
			bcopy(mp1->b_rptr, new_mp->b_wptr, mp_size);
			new_mp->b_wptr += mp_size;
			mp1 = mp1->b_cont;
		}
		freemsg(mp2);
		mp1 = new_mp;
	}
	tcp_set_cksum(mp1);
	/* Fill in the TTL field as it is 0 in the header template. */
	((struct ip *)mp1->b_rptr)->ip_ttl = (uint8_t)tcp_ipv4_ttl;

	return (mp1);
}

/*
 * Generate a "no listener here" reset in response to the
 * connection request contained within 'mp'
 */
static void
tcp_xmit_listeners_reset(int sock_id, mblk_t *mp, uint_t ip_hdr_len)
{
	uchar_t		*rptr;
	uint32_t	seg_len;
	tcph_t		*tcph;
	uint32_t	seg_seq;
	uint32_t	seg_ack;
	uint_t		flags;

	rptr = mp->b_rptr;

	tcph = (tcph_t *)&rptr[ip_hdr_len];
	seg_seq = BE32_TO_U32(tcph->th_seq);
	seg_ack = BE32_TO_U32(tcph->th_ack);
	flags = tcph->th_flags[0];

	seg_len = msgdsize(mp) - (TCP_HDR_LENGTH(tcph) + ip_hdr_len);
	if (flags & TH_RST) {
		freeb(mp);
	} else if (flags & TH_ACK) {
		tcp_xmit_early_reset("no tcp, reset",
		    sock_id, mp, seg_ack, 0, TH_RST, ip_hdr_len);
	} else {
		if (flags & TH_SYN)
			seg_len++;
		tcp_xmit_early_reset("no tcp, reset/ack", sock_id,
		    mp, 0, seg_seq + seg_len,
		    TH_RST | TH_ACK, ip_hdr_len);
	}
}

/* Non overlapping byte exchanger */
static void
tcp_xchg(uchar_t *a, uchar_t *b, int len)
{
	uchar_t	uch;

	while (len-- > 0) {
		uch = a[len];
		a[len] = b[len];
		b[len] = uch;
	}
}

/*
 * Generate a reset based on an inbound packet for which there is no active
 * tcp state that we can find.
 */
static void
tcp_xmit_early_reset(char *str, int sock_id, mblk_t *mp, uint32_t seq,
    uint32_t ack, int ctl, uint_t ip_hdr_len)
{
	struct ip	*iph = NULL;
	ushort_t	len;
	tcph_t		*tcph;
	int		i;
	ipaddr_t	addr;
	mblk_t		*new_mp;

	if (str != NULL) {
		dprintf("tcp_xmit_early_reset: '%s', seq 0x%x, ack 0x%x, "
		    "flags 0x%x\n", str, seq, ack, ctl);
	}

	/*
	 * We skip reversing source route here.
	 * (for now we replace all IP options with EOL)
	 */
	iph = (struct ip *)mp->b_rptr;
	for (i = IP_SIMPLE_HDR_LENGTH; i < (int)ip_hdr_len; i++)
		mp->b_rptr[i] = IPOPT_EOL;
	/*
	 * Make sure that src address is not a limited broadcast
	 * address. Not all broadcast address checking for the
	 * src address is possible, since we don't know the
	 * netmask of the src addr.
	 * No check for destination address is done, since
	 * IP will not pass up a packet with a broadcast dest address
	 * to TCP.
	 */
	if (iph->ip_src.s_addr == INADDR_ANY ||
	    iph->ip_src.s_addr == INADDR_BROADCAST) {
		freemsg(mp);
		return;
	}

	tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len];
	if (tcph->th_flags[0] & TH_RST) {
		freemsg(mp);
		return;
	}
	/*
	 * Now copy the original header to a new buffer.  The reason
	 * for doing this is that we need to put extra room before
	 * the header for the MAC layer address.  The original mblk
	 * does not have this extra head room.
	 */
	len = ip_hdr_len + sizeof (tcph_t);
	if ((new_mp = allocb(len + tcp_wroff_xtra, 0)) == NULL) {
		freemsg(mp);
		return;
	}
	new_mp->b_rptr += tcp_wroff_xtra;
	bcopy(mp->b_rptr, new_mp->b_rptr, len);
	new_mp->b_wptr = new_mp->b_rptr + len;
	freemsg(mp);
	mp = new_mp;
	iph = (struct ip *)mp->b_rptr;
	tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len];

	tcph->th_offset_and_rsrvd[0] = (5 << 4);
	tcp_xchg(tcph->th_fport, tcph->th_lport, 2);
	U32_TO_BE32(ack, tcph->th_ack);
	U32_TO_BE32(seq, tcph->th_seq);
	U16_TO_BE16(0, tcph->th_win);
	bzero(tcph->th_sum, sizeof (int16_t));
	tcph->th_flags[0] = (uint8_t)ctl;
	if (ctl & TH_RST) {
		BUMP_MIB(tcp_mib.tcpOutRsts);
		BUMP_MIB(tcp_mib.tcpOutControl);
	}

	iph->ip_len = htons(len);
	/* Swap addresses */
	addr = iph->ip_src.s_addr;
	iph->ip_src = iph->ip_dst;
	iph->ip_dst.s_addr = addr;
	iph->ip_id = 0;
	iph->ip_ttl = 0;
	tcp_set_cksum(mp);
	iph->ip_ttl = (uint8_t)tcp_ipv4_ttl;

	/* Dump the packet when debugging. */
	TCP_DUMP_PACKET("tcp_xmit_early_reset", mp);
	(void) ipv4_tcp_output(sock_id, mp);
	freemsg(mp);
}

static void
tcp_set_cksum(mblk_t *mp)
{
	struct ip *iph;
	tcpha_t *tcph;
	int len;

	iph = (struct ip *)mp->b_rptr;
	tcph = (tcpha_t *)(iph + 1);
	len = ntohs(iph->ip_len);
	/*
	 * Calculate the TCP checksum.  Need to include the psuedo header,
	 * which is similar to the real IP header starting at the TTL field.
	 */
	iph->ip_sum = htons(len - IP_SIMPLE_HDR_LENGTH);
	tcph->tha_sum = 0;
	tcph->tha_sum = tcp_cksum((uint16_t *)&(iph->ip_ttl),
	    len - IP_SIMPLE_HDR_LENGTH + 12);
	iph->ip_sum = 0;
}

static uint16_t
tcp_cksum(uint16_t *buf, uint32_t len)
{
	/*
	 * Compute Internet Checksum for "count" bytes
	 * beginning at location "addr".
	 */
	int32_t sum = 0;

	while (len > 1) {
		/*  This is the inner loop */
		sum += *buf++;
		len -= 2;
	}

	/*  Add left-over byte, if any */
	if (len > 0)
		sum += *(unsigned char *)buf * 256;

	/*  Fold 32-bit sum to 16 bits */
	while (sum >> 16)
		sum = (sum & 0xffff) + (sum >> 16);

	return ((uint16_t)~sum);
}

/*
 * Type three generator adapted from the random() function in 4.4 BSD:
 */

/*
 * Copyright (c) 1983, 1993
 *	The Regents of the University of California.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *	This product includes software developed by the University of
 *	California, Berkeley and its contributors.
 * 4. Neither the name of the University nor the names of its contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 */

/* Type 3 -- x**31 + x**3 + 1 */
#define	DEG_3		31
#define	SEP_3		3


/* Protected by tcp_random_lock */
static int tcp_randtbl[DEG_3 + 1];

static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1];
static int *tcp_random_rptr = &tcp_randtbl[1];

static int *tcp_random_state = &tcp_randtbl[1];
static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1];

static void
tcp_random_init(void)
{
	int i;
	uint32_t hrt;
	uint32_t wallclock;
	uint32_t result;

	/*
	 *
	 * XXX We don't have high resolution time in standalone...  The
	 * following is just some approximation on the comment below.
	 *
	 * Use high-res timer and current time for seed.  Gethrtime() returns
	 * a longlong, which may contain resolution down to nanoseconds.
	 * The current time will either be a 32-bit or a 64-bit quantity.
	 * XOR the two together in a 64-bit result variable.
	 * Convert the result to a 32-bit value by multiplying the high-order
	 * 32-bits by the low-order 32-bits.
	 *
	 * XXX We don't have gethrtime() in prom and the wallclock....
	 */

	hrt = prom_gettime();
	wallclock = (uint32_t)time(NULL);
	result = wallclock ^ hrt;
	tcp_random_state[0] = result;

	for (i = 1; i < DEG_3; i++)
		tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1]
			+ 12345;
	tcp_random_fptr = &tcp_random_state[SEP_3];
	tcp_random_rptr = &tcp_random_state[0];
	for (i = 0; i < 10 * DEG_3; i++)
		(void) tcp_random();
}

/*
 * tcp_random: Return a random number in the range [1 - (128K + 1)].
 * This range is selected to be approximately centered on TCP_ISS / 2,
 * and easy to compute. We get this value by generating a 32-bit random
 * number, selecting out the high-order 17 bits, and then adding one so
 * that we never return zero.
 */
static int
tcp_random(void)
{
	int i;

	*tcp_random_fptr += *tcp_random_rptr;

	/*
	 * The high-order bits are more random than the low-order bits,
	 * so we select out the high-order 17 bits and add one so that
	 * we never return zero.
	 */
	i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1;
	if (++tcp_random_fptr >= tcp_random_end_ptr) {
		tcp_random_fptr = tcp_random_state;
		++tcp_random_rptr;
	} else if (++tcp_random_rptr >= tcp_random_end_ptr)
		tcp_random_rptr = tcp_random_state;

	return (i);
}

/*
 * Generate ISS, taking into account NDD changes may happen halfway through.
 * (If the iss is not zero, set it.)
 */
static void
tcp_iss_init(tcp_t *tcp)
{
	tcp_iss_incr_extra += (ISS_INCR >> 1);
	tcp->tcp_iss = tcp_iss_incr_extra;
	tcp->tcp_iss += (prom_gettime() >> ISS_NSEC_SHT) + tcp_random();
	tcp->tcp_valid_bits = TCP_ISS_VALID;
	tcp->tcp_fss = tcp->tcp_iss - 1;
	tcp->tcp_suna = tcp->tcp_iss;
	tcp->tcp_snxt = tcp->tcp_iss + 1;
	tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
	tcp->tcp_csuna = tcp->tcp_snxt;
}

/*
 * Diagnostic routine used to return a string associated with the tcp state.
 * Note that if the caller does not supply a buffer, it will use an internal
 * static string.  This means that if multiple threads call this function at
 * the same time, output can be corrupted...  Note also that this function
 * does not check the size of the supplied buffer.  The caller has to make
 * sure that it is big enough.
 */
static char *
tcp_display(tcp_t *tcp, char *sup_buf, char format)
{
	char		buf1[30];
	static char	priv_buf[INET_ADDRSTRLEN * 2 + 80];
	char		*buf;
	char		*cp;
	char		local_addrbuf[INET_ADDRSTRLEN];
	char		remote_addrbuf[INET_ADDRSTRLEN];
	struct in_addr	addr;

	if (sup_buf != NULL)
		buf = sup_buf;
	else
		buf = priv_buf;

	if (tcp == NULL)
		return ("NULL_TCP");
	switch (tcp->tcp_state) {
	case TCPS_CLOSED:
		cp = "TCP_CLOSED";
		break;
	case TCPS_IDLE:
		cp = "TCP_IDLE";
		break;
	case TCPS_BOUND:
		cp = "TCP_BOUND";
		break;
	case TCPS_LISTEN:
		cp = "TCP_LISTEN";
		break;
	case TCPS_SYN_SENT:
		cp = "TCP_SYN_SENT";
		break;
	case TCPS_SYN_RCVD:
		cp = "TCP_SYN_RCVD";
		break;
	case TCPS_ESTABLISHED:
		cp = "TCP_ESTABLISHED";
		break;
	case TCPS_CLOSE_WAIT:
		cp = "TCP_CLOSE_WAIT";
		break;
	case TCPS_FIN_WAIT_1:
		cp = "TCP_FIN_WAIT_1";
		break;
	case TCPS_CLOSING:
		cp = "TCP_CLOSING";
		break;
	case TCPS_LAST_ACK:
		cp = "TCP_LAST_ACK";
		break;
	case TCPS_FIN_WAIT_2:
		cp = "TCP_FIN_WAIT_2";
		break;
	case TCPS_TIME_WAIT:
		cp = "TCP_TIME_WAIT";
		break;
	default:
		(void) sprintf(buf1, "TCPUnkState(%d)", tcp->tcp_state);
		cp = buf1;
		break;
	}
	switch (format) {
	case DISP_ADDR_AND_PORT:
		/*
		 * Note that we use the remote address in the tcp_b
		 * structure.  This means that it will print out
		 * the real destination address, not the next hop's
		 * address if source routing is used.
		 */
		addr.s_addr = tcp->tcp_bound_source;
		bcopy(inet_ntoa(addr), local_addrbuf, sizeof (local_addrbuf));
		addr.s_addr = tcp->tcp_remote;
		bcopy(inet_ntoa(addr), remote_addrbuf, sizeof (remote_addrbuf));
		(void) snprintf(buf, sizeof (priv_buf), "[%s.%u, %s.%u] %s",
		    local_addrbuf, ntohs(tcp->tcp_lport), remote_addrbuf,
		    ntohs(tcp->tcp_fport), cp);
		break;
	case DISP_PORT_ONLY:
	default:
		(void) snprintf(buf, sizeof (priv_buf), "[%u, %u] %s",
		    ntohs(tcp->tcp_lport), ntohs(tcp->tcp_fport), cp);
		break;
	}

	return (buf);
}

/*
 * Add a new piece to the tcp reassembly queue.  If the gap at the beginning
 * is filled, return as much as we can.  The message passed in may be
 * multi-part, chained using b_cont.  "start" is the starting sequence
 * number for this piece.
 */
static mblk_t *
tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
{
	uint32_t	end;
	mblk_t		*mp1;
	mblk_t		*mp2;
	mblk_t		*next_mp;
	uint32_t	u1;

	/* Walk through all the new pieces. */
	do {
		assert((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
		    (uintptr_t)INT_MAX);
		end = start + (int)(mp->b_wptr - mp->b_rptr);
		next_mp = mp->b_cont;
		if (start == end) {
			/* Empty.  Blast it. */
			freeb(mp);
			continue;
		}
		mp->b_cont = NULL;
		TCP_REASS_SET_SEQ(mp, start);
		TCP_REASS_SET_END(mp, end);
		mp1 = tcp->tcp_reass_tail;
		if (!mp1) {
			tcp->tcp_reass_tail = mp;
			tcp->tcp_reass_head = mp;
			BUMP_MIB(tcp_mib.tcpInDataUnorderSegs);
			UPDATE_MIB(tcp_mib.tcpInDataUnorderBytes, end - start);
			continue;
		}
		/* New stuff completely beyond tail? */
		if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
			/* Link it on end. */
			mp1->b_cont = mp;
			tcp->tcp_reass_tail = mp;
			BUMP_MIB(tcp_mib.tcpInDataUnorderSegs);
			UPDATE_MIB(tcp_mib.tcpInDataUnorderBytes, end - start);
			continue;
		}
		mp1 = tcp->tcp_reass_head;
		u1 = TCP_REASS_SEQ(mp1);
		/* New stuff at the front? */
		if (SEQ_LT(start, u1)) {
			/* Yes... Check for overlap. */
			mp->b_cont = mp1;
			tcp->tcp_reass_head = mp;
			tcp_reass_elim_overlap(tcp, mp);
			continue;
		}
		/*
		 * The new piece fits somewhere between the head and tail.
		 * We find our slot, where mp1 precedes us and mp2 trails.
		 */
		for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
			u1 = TCP_REASS_SEQ(mp2);
			if (SEQ_LEQ(start, u1))
				break;
		}
		/* Link ourselves in */
		mp->b_cont = mp2;
		mp1->b_cont = mp;

		/* Trim overlap with following mblk(s) first */
		tcp_reass_elim_overlap(tcp, mp);

		/* Trim overlap with preceding mblk */
		tcp_reass_elim_overlap(tcp, mp1);

	} while (start = end, mp = next_mp);
	mp1 = tcp->tcp_reass_head;
	/* Anything ready to go? */
	if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
		return (NULL);
	/* Eat what we can off the queue */
	for (;;) {
		mp = mp1->b_cont;
		end = TCP_REASS_END(mp1);
		TCP_REASS_SET_SEQ(mp1, 0);
		TCP_REASS_SET_END(mp1, 0);
		if (!mp) {
			tcp->tcp_reass_tail = NULL;
			break;
		}
		if (end != TCP_REASS_SEQ(mp)) {
			mp1->b_cont = NULL;
			break;
		}
		mp1 = mp;
	}
	mp1 = tcp->tcp_reass_head;
	tcp->tcp_reass_head = mp;
	return (mp1);
}

/* Eliminate any overlap that mp may have over later mblks */
static void
tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
{
	uint32_t	end;
	mblk_t		*mp1;
	uint32_t	u1;

	end = TCP_REASS_END(mp);
	while ((mp1 = mp->b_cont) != NULL) {
		u1 = TCP_REASS_SEQ(mp1);
		if (!SEQ_GT(end, u1))
			break;
		if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
			mp->b_wptr -= end - u1;
			TCP_REASS_SET_END(mp, u1);
			BUMP_MIB(tcp_mib.tcpInDataPartDupSegs);
			UPDATE_MIB(tcp_mib.tcpInDataPartDupBytes, end - u1);
			break;
		}
		mp->b_cont = mp1->b_cont;
		freeb(mp1);
		BUMP_MIB(tcp_mib.tcpInDataDupSegs);
		UPDATE_MIB(tcp_mib.tcpInDataDupBytes, end - u1);
	}
	if (!mp1)
		tcp->tcp_reass_tail = mp;
}

/*
 * Remove a connection from the list of detached TIME_WAIT connections.
 */
static void
tcp_time_wait_remove(tcp_t *tcp)
{
	if (tcp->tcp_time_wait_expire == 0) {
		assert(tcp->tcp_time_wait_next == NULL);
		assert(tcp->tcp_time_wait_prev == NULL);
		return;
	}
	assert(tcp->tcp_state == TCPS_TIME_WAIT);
	if (tcp == tcp_time_wait_head) {
		assert(tcp->tcp_time_wait_prev == NULL);
		tcp_time_wait_head = tcp->tcp_time_wait_next;
		if (tcp_time_wait_head != NULL) {
			tcp_time_wait_head->tcp_time_wait_prev = NULL;
		} else {
			tcp_time_wait_tail = NULL;
		}
	} else if (tcp == tcp_time_wait_tail) {
		assert(tcp != tcp_time_wait_head);
		assert(tcp->tcp_time_wait_next == NULL);
		tcp_time_wait_tail = tcp->tcp_time_wait_prev;
		assert(tcp_time_wait_tail != NULL);
		tcp_time_wait_tail->tcp_time_wait_next = NULL;
	} else {
		assert(tcp->tcp_time_wait_prev->tcp_time_wait_next == tcp);
		assert(tcp->tcp_time_wait_next->tcp_time_wait_prev == tcp);
		tcp->tcp_time_wait_prev->tcp_time_wait_next =
		    tcp->tcp_time_wait_next;
		tcp->tcp_time_wait_next->tcp_time_wait_prev =
		    tcp->tcp_time_wait_prev;
	}
	tcp->tcp_time_wait_next = NULL;
	tcp->tcp_time_wait_prev = NULL;
	tcp->tcp_time_wait_expire = 0;
}

/*
 * Add a connection to the list of detached TIME_WAIT connections
 * and set its time to expire ...
 */
static void
tcp_time_wait_append(tcp_t *tcp)
{
	tcp->tcp_time_wait_expire = prom_gettime() + tcp_time_wait_interval;
	if (tcp->tcp_time_wait_expire == 0)
		tcp->tcp_time_wait_expire = 1;

	if (tcp_time_wait_head == NULL) {
		assert(tcp_time_wait_tail == NULL);
		tcp_time_wait_head = tcp;
	} else {
		assert(tcp_time_wait_tail != NULL);
		assert(tcp_time_wait_tail->tcp_state == TCPS_TIME_WAIT);
		tcp_time_wait_tail->tcp_time_wait_next = tcp;
		tcp->tcp_time_wait_prev = tcp_time_wait_tail;
	}
	tcp_time_wait_tail = tcp;

	/* for ndd stats about compression */
	tcp_cum_timewait++;
}

/*
 * Periodic qtimeout routine run on the default queue.
 * Performs 2 functions.
 * 	1.  Does TIME_WAIT compression on all recently added tcps. List
 *	    traversal is done backwards from the tail.
 *	2.  Blows away all tcps whose TIME_WAIT has expired. List traversal
 *	    is done forwards from the head.
 */
void
tcp_time_wait_collector(void)
{
	tcp_t *tcp;
	uint32_t now;

	/*
	 * In order to reap time waits reliably, we should use a
	 * source of time that is not adjustable by the user
	 */
	now = prom_gettime();
	while ((tcp = tcp_time_wait_head) != NULL) {
		/*
		 * Compare times using modular arithmetic, since
		 * lbolt can wrapover.
		 */
		if ((int32_t)(now - tcp->tcp_time_wait_expire) < 0) {
			break;
		}
		/*
		 * Note that the err must be 0 as there is no socket
		 * associated with this TCP...
		 */
		(void) tcp_clean_death(-1, tcp, 0);
	}
	/* Schedule next run time. */
	tcp_time_wait_runtime = prom_gettime() + 10000;
}

void
tcp_time_wait_report(void)
{
	tcp_t *tcp;

	printf("Current time %u\n", prom_gettime());
	for (tcp = tcp_time_wait_head; tcp != NULL;
	    tcp = tcp->tcp_time_wait_next) {
		printf("%s expires at %u\n", tcp_display(tcp, NULL,
		    DISP_ADDR_AND_PORT), tcp->tcp_time_wait_expire);
	}
}

/*
 * Send up all messages queued on tcp_rcv_list.
 * Have to set tcp_co_norm since we use putnext.
 */
static void
tcp_rcv_drain(int sock_id, tcp_t *tcp)
{
	mblk_t *mp;
	struct inetgram *in_gram;
	mblk_t *in_mp;
	int len;

	/* Don't drain if the app has not finished reading all the data. */
	if (sockets[sock_id].so_rcvbuf <= 0)
		return;

	/* We might have come here just to updated the rwnd */
	if (tcp->tcp_rcv_list == NULL)
		goto win_update;

	if ((in_gram = (struct inetgram *)bkmem_zalloc(
	    sizeof (struct inetgram))) == NULL) {
		return;
	}
	if ((in_mp = allocb(tcp->tcp_rcv_cnt, 0)) == NULL) {
		bkmem_free((caddr_t)in_gram, sizeof (struct inetgram));
		return;
	}
	in_gram->igm_level = APP_LVL;
	in_gram->igm_mp = in_mp;
	in_gram->igm_id = 0;

	while ((mp = tcp->tcp_rcv_list) != NULL) {
		tcp->tcp_rcv_list = mp->b_cont;
		len = mp->b_wptr - mp->b_rptr;
		bcopy(mp->b_rptr, in_mp->b_wptr, len);
		in_mp->b_wptr += len;
		freeb(mp);
	}

	tcp->tcp_rcv_last_tail = NULL;
	tcp->tcp_rcv_cnt = 0;
	add_grams(&sockets[sock_id].inq, in_gram);

	/* This means that so_rcvbuf can be less than 0. */
	sockets[sock_id].so_rcvbuf -= in_mp->b_wptr - in_mp->b_rptr;
win_update:
	/*
	 * Increase the receive window to max.  But we need to do receiver
	 * SWS avoidance.  This means that we need to check the increase of
	 * of receive window is at least 1 MSS.
	 */
	if (sockets[sock_id].so_rcvbuf > 0 &&
	    (tcp->tcp_rwnd_max - tcp->tcp_rwnd >= tcp->tcp_mss)) {
		tcp->tcp_rwnd = tcp->tcp_rwnd_max;
		U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws,
		    tcp->tcp_tcph->th_win);
	}
}

/*
 * Wrapper for recvfrom to call
 */
void
tcp_rcv_drain_sock(int sock_id)
{
	tcp_t *tcp;
	if ((tcp = sockets[sock_id].pcb) == NULL)
		return;
	tcp_rcv_drain(sock_id, tcp);
}

/*
 * If the inq == NULL and the tcp_rcv_list != NULL, we have data that
 * recvfrom could read. Place a magic message in the inq to let recvfrom
 * know that it needs to call tcp_rcv_drain_sock to pullup the data.
 */
static void
tcp_drain_needed(int sock_id, tcp_t *tcp)
{
	struct inetgram *in_gram;
#ifdef DEBUG
	printf("tcp_drain_needed: inq %x, tcp_rcv_list %x\n",
		sockets[sock_id].inq, tcp->tcp_rcv_list);
#endif
	if ((sockets[sock_id].inq != NULL) ||
		(tcp->tcp_rcv_list == NULL))
		return;

	if ((in_gram = (struct inetgram *)bkmem_zalloc(
		sizeof (struct inetgram))) == NULL)
		return;

	in_gram->igm_level = APP_LVL;
	in_gram->igm_mp = NULL;
	in_gram->igm_id = TCP_CALLB_MAGIC_ID;

	add_grams(&sockets[sock_id].inq, in_gram);
}

/*
 * Queue data on tcp_rcv_list which is a b_next chain.
 * Each element of the chain is a b_cont chain.
 *
 * M_DATA messages are added to the current element.
 * Other messages are added as new (b_next) elements.
 */
static void
tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len)
{
	assert(seg_len == msgdsize(mp));
	if (tcp->tcp_rcv_list == NULL) {
		tcp->tcp_rcv_list = mp;
	} else {
		tcp->tcp_rcv_last_tail->b_cont = mp;
	}
	while (mp->b_cont)
		mp = mp->b_cont;
	tcp->tcp_rcv_last_tail = mp;
	tcp->tcp_rcv_cnt += seg_len;
	tcp->tcp_rwnd -= seg_len;
#ifdef DEBUG
	printf("tcp_rcv_enqueue rwnd %d\n", tcp->tcp_rwnd);
#endif
	U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, tcp->tcp_tcph->th_win);
}

/* The minimum of smoothed mean deviation in RTO calculation. */
#define	TCP_SD_MIN	400

/*
 * Set RTO for this connection.  The formula is from Jacobson and Karels'
 * "Congestion Avoidance and Control" in SIGCOMM '88.  The variable names
 * are the same as those in Appendix A.2 of that paper.
 *
 * m = new measurement
 * sa = smoothed RTT average (8 * average estimates).
 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
 */
static void
tcp_set_rto(tcp_t *tcp, int32_t rtt)
{
	int32_t m = rtt;
	uint32_t sa = tcp->tcp_rtt_sa;
	uint32_t sv = tcp->tcp_rtt_sd;
	uint32_t rto;

	BUMP_MIB(tcp_mib.tcpRttUpdate);
	tcp->tcp_rtt_update++;

	/* tcp_rtt_sa is not 0 means this is a new sample. */
	if (sa != 0) {
		/*
		 * Update average estimator:
		 *	new rtt = 7/8 old rtt + 1/8 Error
		 */

		/* m is now Error in estimate. */
		m -= sa >> 3;
		if ((int32_t)(sa += m) <= 0) {
			/*
			 * Don't allow the smoothed average to be negative.
			 * We use 0 to denote reinitialization of the
			 * variables.
			 */
			sa = 1;
		}

		/*
		 * Update deviation estimator:
		 *	new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
		 */
		if (m < 0)
			m = -m;
		m -= sv >> 2;
		sv += m;
	} else {
		/*
		 * This follows BSD's implementation.  So the reinitialized
		 * RTO is 3 * m.  We cannot go less than 2 because if the
		 * link is bandwidth dominated, doubling the window size
		 * during slow start means doubling the RTT.  We want to be
		 * more conservative when we reinitialize our estimates.  3
		 * is just a convenient number.
		 */
		sa = m << 3;
		sv = m << 1;
	}
	if (sv < TCP_SD_MIN) {
		/*
		 * We do not know that if sa captures the delay ACK
		 * effect as in a long train of segments, a receiver
		 * does not delay its ACKs.  So set the minimum of sv
		 * to be TCP_SD_MIN, which is default to 400 ms, twice
		 * of BSD DATO.  That means the minimum of mean
		 * deviation is 100 ms.
		 *
		 */
		sv = TCP_SD_MIN;
	}
	tcp->tcp_rtt_sa = sa;
	tcp->tcp_rtt_sd = sv;
	/*
	 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
	 *
	 * Add tcp_rexmit_interval extra in case of extreme environment
	 * where the algorithm fails to work.  The default value of
	 * tcp_rexmit_interval_extra should be 0.
	 *
	 * As we use a finer grained clock than BSD and update
	 * RTO for every ACKs, add in another .25 of RTT to the
	 * deviation of RTO to accomodate burstiness of 1/4 of
	 * window size.
	 */
	rto = (sa >> 3) + sv + tcp_rexmit_interval_extra + (sa >> 5);

	if (rto > tcp_rexmit_interval_max) {
		tcp->tcp_rto = tcp_rexmit_interval_max;
	} else if (rto < tcp_rexmit_interval_min) {
		tcp->tcp_rto = tcp_rexmit_interval_min;
	} else {
		tcp->tcp_rto = rto;
	}

	/* Now, we can reset tcp_timer_backoff to use the new RTO... */
	tcp->tcp_timer_backoff = 0;
}

/*
 * Initiate closedown sequence on an active connection.
 * Return value zero for OK return, non-zero for error return.
 */
static int
tcp_xmit_end(tcp_t *tcp, int sock_id)
{
	mblk_t	*mp;

	if (tcp->tcp_state < TCPS_SYN_RCVD ||
	    tcp->tcp_state > TCPS_CLOSE_WAIT) {
		/*
		 * Invalid state, only states TCPS_SYN_RCVD,
		 * TCPS_ESTABLISHED and TCPS_CLOSE_WAIT are valid
		 */
		return (-1);
	}

	tcp->tcp_fss = tcp->tcp_snxt + tcp->tcp_unsent;
	tcp->tcp_valid_bits |= TCP_FSS_VALID;
	/*
	 * If there is nothing more unsent, send the FIN now.
	 * Otherwise, it will go out with the last segment.
	 */
	if (tcp->tcp_unsent == 0) {
		mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL,
		    tcp->tcp_fss, B_FALSE, NULL, B_FALSE);

		if (mp != NULL) {
			/* Dump the packet when debugging. */
			TCP_DUMP_PACKET("tcp_xmit_end", mp);
			(void) ipv4_tcp_output(sock_id, mp);
			freeb(mp);
		} else {
			/*
			 * Couldn't allocate msg.  Pretend we got it out.
			 * Wait for rexmit timeout.
			 */
			tcp->tcp_snxt = tcp->tcp_fss + 1;
			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
		}

		/*
		 * If needed, update tcp_rexmit_snxt as tcp_snxt is
		 * changed.
		 */
		if (tcp->tcp_rexmit && tcp->tcp_rexmit_nxt == tcp->tcp_fss) {
			tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
		}
	} else {
		tcp_wput_data(tcp, NULL, B_FALSE);
	}

	return (0);
}

int
tcp_opt_set(tcp_t *tcp, int level, int option, const void *optval,
    socklen_t optlen)
{
	switch (level) {
	case SOL_SOCKET: {
		switch (option) {
		case SO_RCVBUF:
			if (optlen == sizeof (int)) {
				int val = *(int *)optval;

				if (val > tcp_max_buf) {
					errno = ENOBUFS;
					break;
				}
				/* Silently ignore zero */
				if (val != 0) {
					val = MSS_ROUNDUP(val, tcp->tcp_mss);
					(void) tcp_rwnd_set(tcp, val);
				}
			} else {
				errno = EINVAL;
			}
			break;
		case SO_SNDBUF:
			if (optlen == sizeof (int)) {
				tcp->tcp_xmit_hiwater = *(int *)optval;
				if (tcp->tcp_xmit_hiwater > tcp_max_buf)
					tcp->tcp_xmit_hiwater = tcp_max_buf;
			} else {
				errno = EINVAL;
			}
			break;
		case SO_LINGER:
			if (optlen == sizeof (struct linger)) {
				struct linger *lgr = (struct linger *)optval;

				if (lgr->l_onoff) {
					tcp->tcp_linger = 1;
					tcp->tcp_lingertime = lgr->l_linger;
				} else {
					tcp->tcp_linger = 0;
					tcp->tcp_lingertime = 0;
				}
			} else {
				errno = EINVAL;
			}
			break;
		default:
			errno = ENOPROTOOPT;
			break;
		}
		break;
	} /* case SOL_SOCKET */
	case IPPROTO_TCP: {
		switch (option) {
		default:
			errno = ENOPROTOOPT;
			break;
		}
		break;
	} /* case IPPROTO_TCP */
	case IPPROTO_IP: {
		switch (option) {
		default:
			errno = ENOPROTOOPT;
			break;
		}
		break;
	} /* case IPPROTO_IP */
	default:
		errno = ENOPROTOOPT;
		break;
	} /* switch (level) */

	if (errno != 0)
		return (-1);
	else
		return (0);
}