xref: /illumos-gate/usr/src/uts/common/inet/sctp/sctp.c (revision 5bbb4db2c3f208d12bf0fd11769728f9e5ba66a2)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <sys/types.h>
28 #include <sys/stream.h>
29 #include <sys/strsubr.h>
30 #include <sys/stropts.h>
31 #include <sys/strsun.h>
32 #define	_SUN_TPI_VERSION 2
33 #include <sys/tihdr.h>
34 #include <sys/ddi.h>
35 #include <sys/sunddi.h>
36 #include <sys/xti_inet.h>
37 #include <sys/cmn_err.h>
38 #include <sys/debug.h>
39 #include <sys/vtrace.h>
40 #include <sys/kmem.h>
41 #include <sys/cpuvar.h>
42 #include <sys/random.h>
43 #include <sys/priv.h>
44 #include <sys/sunldi.h>
45 
46 #include <sys/errno.h>
47 #include <sys/signal.h>
48 #include <sys/socket.h>
49 #include <sys/isa_defs.h>
50 #include <netinet/in.h>
51 #include <netinet/tcp.h>
52 #include <netinet/ip6.h>
53 #include <netinet/icmp6.h>
54 #include <netinet/sctp.h>
55 #include <net/if.h>
56 
57 #include <inet/common.h>
58 #include <inet/ip.h>
59 #include <inet/ip6.h>
60 #include <inet/mi.h>
61 #include <inet/mib2.h>
62 #include <inet/kstatcom.h>
63 #include <inet/nd.h>
64 #include <inet/optcom.h>
65 #include <inet/ipclassifier.h>
66 #include <inet/ipsec_impl.h>
67 #include <inet/sctp_ip.h>
68 #include <inet/sctp_crc32.h>
69 
70 #include "sctp_impl.h"
71 #include "sctp_addr.h"
72 #include "sctp_asconf.h"
73 
74 int sctpdebug;
75 sin6_t	sctp_sin6_null;	/* Zero address for quick clears */
76 
77 /*
78  * Have to ensure that sctp_g_q_close is not done by an
79  * interrupt thread.
80  */
81 static taskq_t *sctp_taskq;
82 
83 static void	sctp_closei_local(sctp_t *sctp);
84 static int	sctp_init_values(sctp_t *, sctp_t *, int);
85 static void	sctp_icmp_error_ipv6(sctp_t *sctp, mblk_t *mp);
86 static void	sctp_process_recvq(void *);
87 static void	sctp_rq_tq_init(sctp_stack_t *);
88 static void	sctp_rq_tq_fini(sctp_stack_t *);
89 static void	sctp_conn_cache_init();
90 static void	sctp_conn_cache_fini();
91 static int	sctp_conn_cache_constructor();
92 static void	sctp_conn_cache_destructor();
93 static void	sctp_conn_clear(conn_t *);
94 void		sctp_g_q_setup(sctp_stack_t *);
95 void		sctp_g_q_create(sctp_stack_t *);
96 void		sctp_g_q_destroy(sctp_stack_t *);
97 
98 static void	*sctp_stack_init(netstackid_t stackid, netstack_t *ns);
99 static void	sctp_stack_shutdown(netstackid_t stackid, void *arg);
100 static void	sctp_stack_fini(netstackid_t stackid, void *arg);
101 
102 /*
103  * SCTP receive queue taskq
104  *
105  * At SCTP initialization time, a default taskq is created for
106  * servicing packets received when the interrupt thread cannot
107  * get a hold on the sctp_t.  The number of taskq can be increased in
108  * sctp_find_next_tq() when an existing taskq cannot be dispatched.
109  * The taskqs are never removed.  But the max number of taskq which
110  * can be created is controlled by sctp_recvq_tq_list_max_sz.  Note
111  * that SCTP recvq taskq is not tied to any specific CPU or ill.
112  *
113  * Those taskqs are stored in an array recvq_tq_list.  And they are
114  * used in a round robin fashion.  The current taskq being used is
115  * determined by recvq_tq_list_cur.
116  */
117 
118 /* /etc/system variables */
119 /* The minimum number of threads for each taskq. */
120 int		sctp_recvq_tq_thr_min = 4;
121 /* The maximum number of threads for each taskq. */
122 int		sctp_recvq_tq_thr_max = 16;
123 /* The minimum number of tasks for each taskq. */
124 int		sctp_recvq_tq_task_min = 5;
125 /* The maxiimum number of tasks for each taskq. */
126 int		sctp_recvq_tq_task_max = 50;
127 
128 /*  sctp_t/conn_t kmem cache */
129 struct kmem_cache	*sctp_conn_cache;
130 
131 #define	SCTP_CONDEMNED(sctp)				\
132 	mutex_enter(&(sctp)->sctp_reflock);		\
133 	((sctp)->sctp_condemned = B_TRUE);		\
134 	mutex_exit(&(sctp)->sctp_reflock);
135 
136 /* Link/unlink a sctp_t to/from the global list. */
137 #define	SCTP_LINK(sctp, sctps)				\
138 	mutex_enter(&(sctps)->sctps_g_lock);		\
139 	list_insert_tail(&sctps->sctps_g_list, (sctp));	\
140 	mutex_exit(&(sctps)->sctps_g_lock);
141 
142 #define	SCTP_UNLINK(sctp, sctps)				\
143 	mutex_enter(&(sctps)->sctps_g_lock);		\
144 	ASSERT((sctp)->sctp_condemned);			\
145 	list_remove(&(sctps)->sctps_g_list, (sctp));	\
146 	mutex_exit(&(sctps)->sctps_g_lock);
147 
148 /*
149  * Hooks for Sun Cluster. On non-clustered nodes these will remain NULL.
150  * PSARC/2005/602.
151  */
152 void (*cl_sctp_listen)(sa_family_t, uchar_t *, uint_t, in_port_t) = NULL;
153 void (*cl_sctp_unlisten)(sa_family_t, uchar_t *, uint_t, in_port_t) = NULL;
154 void (*cl_sctp_connect)(sa_family_t, uchar_t *, uint_t, in_port_t,
155     uchar_t *, uint_t, in_port_t, boolean_t, cl_sctp_handle_t) = NULL;
156 void (*cl_sctp_disconnect)(sa_family_t, cl_sctp_handle_t) = NULL;
157 void (*cl_sctp_assoc_change)(sa_family_t, uchar_t *, size_t, uint_t,
158     uchar_t *, size_t, uint_t, int, cl_sctp_handle_t) = NULL;
159 void (*cl_sctp_check_addrs)(sa_family_t, in_port_t, uchar_t **, size_t,
160     uint_t *, boolean_t) = NULL;
161 /*
162  * Return the version number of the SCTP kernel interface.
163  */
164 int
165 sctp_itf_ver(int cl_ver)
166 {
167 	if (cl_ver != SCTP_ITF_VER)
168 		return (-1);
169 	return (SCTP_ITF_VER);
170 }
171 
172 /*
173  * Called when we need a new sctp instantiation but don't really have a
174  * new q to hang it off of. Copy the priv flag from the passed in structure.
175  */
176 sctp_t *
177 sctp_create_eager(sctp_t *psctp)
178 {
179 	sctp_t	*sctp;
180 	mblk_t	*ack_mp, *hb_mp;
181 	conn_t	*connp, *pconnp;
182 	cred_t *credp;
183 	sctp_stack_t	*sctps = psctp->sctp_sctps;
184 
185 	if ((connp = ipcl_conn_create(IPCL_SCTPCONN, KM_NOSLEEP,
186 	    sctps->sctps_netstack)) == NULL) {
187 		return (NULL);
188 	}
189 
190 	connp->conn_ulp_labeled = is_system_labeled();
191 
192 	sctp = CONN2SCTP(connp);
193 	sctp->sctp_sctps = sctps;
194 
195 	if ((ack_mp = sctp_timer_alloc(sctp, sctp_ack_timer,
196 	    KM_NOSLEEP)) == NULL ||
197 	    (hb_mp = sctp_timer_alloc(sctp, sctp_heartbeat_timer,
198 	    KM_NOSLEEP)) == NULL) {
199 		if (ack_mp != NULL)
200 			freeb(ack_mp);
201 		sctp_conn_clear(connp);
202 		sctp->sctp_sctps = NULL;
203 		SCTP_G_Q_REFRELE(sctps);
204 		kmem_cache_free(sctp_conn_cache, connp);
205 		return (NULL);
206 	}
207 
208 	sctp->sctp_ack_mp = ack_mp;
209 	sctp->sctp_heartbeat_mp = hb_mp;
210 
211 	/* Inherit information from the "parent" */
212 	sctp->sctp_ipversion = psctp->sctp_ipversion;
213 	sctp->sctp_family = psctp->sctp_family;
214 	pconnp = psctp->sctp_connp;
215 	connp->conn_af_isv6 = pconnp->conn_af_isv6;
216 	connp->conn_pkt_isv6 = pconnp->conn_pkt_isv6;
217 	connp->conn_ipv6_v6only = pconnp->conn_ipv6_v6only;
218 	if (sctp_init_values(sctp, psctp, KM_NOSLEEP) != 0) {
219 		freeb(ack_mp);
220 		freeb(hb_mp);
221 		sctp_conn_clear(connp);
222 		sctp->sctp_sctps = NULL;
223 		SCTP_G_Q_REFRELE(sctps);
224 		kmem_cache_free(sctp_conn_cache, connp);
225 		return (NULL);
226 	}
227 
228 	/*
229 	 * If the parent is multilevel, then we'll fix up the remote cred
230 	 * when we do sctp_accept_comm.
231 	 */
232 	if ((credp = pconnp->conn_cred) != NULL) {
233 		connp->conn_cred = credp;
234 		crhold(credp);
235 		/*
236 		 * If the caller has the process-wide flag set, then default to
237 		 * MAC exempt mode.  This allows read-down to unlabeled hosts.
238 		 */
239 		if (getpflags(NET_MAC_AWARE, credp) != 0)
240 			connp->conn_mac_exempt = B_TRUE;
241 	}
242 
243 	connp->conn_allzones = pconnp->conn_allzones;
244 	connp->conn_zoneid = pconnp->conn_zoneid;
245 	sctp->sctp_cpid = psctp->sctp_cpid;
246 	sctp->sctp_open_time = lbolt64;
247 
248 	sctp->sctp_mss = psctp->sctp_mss;
249 	sctp->sctp_detached = B_TRUE;
250 	/*
251 	 * Link to the global as soon as possible so that this sctp_t
252 	 * can be found.
253 	 */
254 	SCTP_LINK(sctp, sctps);
255 
256 	return (sctp);
257 }
258 
259 /*
260  * We are dying for some reason.  Try to do it gracefully.
261  */
262 void
263 sctp_clean_death(sctp_t *sctp, int err)
264 {
265 	ASSERT(sctp != NULL);
266 	ASSERT((sctp->sctp_family == AF_INET &&
267 	    sctp->sctp_ipversion == IPV4_VERSION) ||
268 	    (sctp->sctp_family == AF_INET6 &&
269 	    (sctp->sctp_ipversion == IPV4_VERSION ||
270 	    sctp->sctp_ipversion == IPV6_VERSION)));
271 
272 	dprint(3, ("sctp_clean_death %p, state %d\n", (void *)sctp,
273 	    sctp->sctp_state));
274 
275 	sctp->sctp_client_errno = err;
276 	/*
277 	 * Check to see if we need to notify upper layer.
278 	 */
279 	if ((sctp->sctp_state >= SCTPS_COOKIE_WAIT) &&
280 	    !SCTP_IS_DETACHED(sctp)) {
281 		if (sctp->sctp_xmit_head || sctp->sctp_xmit_unsent) {
282 			sctp_regift_xmitlist(sctp);
283 		}
284 		if (sctp->sctp_ulp_disconnected(sctp->sctp_ulpd, 0, err)) {
285 			/*
286 			 * Socket is gone, detach.
287 			 */
288 			sctp->sctp_detached = B_TRUE;
289 			sctp->sctp_ulpd = NULL;
290 			sctp->sctp_upcalls = NULL;
291 		}
292 	}
293 
294 	/* Remove this sctp from all hashes. */
295 	sctp_closei_local(sctp);
296 
297 	/*
298 	 * If the sctp_t is detached, we need to finish freeing up
299 	 * the resources.  At this point, ip_fanout_sctp() should have
300 	 * a hold on this sctp_t.  Some thread doing snmp stuff can
301 	 * have a hold.  And a taskq can also have a hold waiting to
302 	 * work.  sctp_unlink() the sctp_t from the global list so
303 	 * that no new thread can find it.  Then do a SCTP_REFRELE().
304 	 * The sctp_t will be freed after all those threads are done.
305 	 */
306 	if (SCTP_IS_DETACHED(sctp)) {
307 		SCTP_CONDEMNED(sctp);
308 		SCTP_REFRELE(sctp);
309 	}
310 }
311 
312 /*
313  * Called by upper layer when it wants to close this association.
314  * Depending on the state of this assoication, we need to do
315  * different things.
316  *
317  * If the state is below COOKIE_ECHOED or it is COOKIE_ECHOED but with
318  * no sent data, just remove this sctp from all the hashes.  This
319  * makes sure that all packets from the other end will go to the default
320  * sctp handling.  The upper layer will then do a sctp_close() to clean
321  * up.
322  *
323  * Otherwise, check and see if SO_LINGER is set.  If it is set, check
324  * the value.  If the value is 0, consider this an abortive close.  Send
325  * an ABORT message and kill the associatiion.
326  *
327  */
328 int
329 sctp_disconnect(sctp_t *sctp)
330 {
331 	int	error = 0;
332 
333 	dprint(3, ("sctp_disconnect %p, state %d\n", (void *)sctp,
334 	    sctp->sctp_state));
335 
336 	RUN_SCTP(sctp);
337 
338 	switch (sctp->sctp_state) {
339 	case SCTPS_IDLE:
340 	case SCTPS_BOUND:
341 	case SCTPS_LISTEN:
342 		break;
343 	case SCTPS_COOKIE_WAIT:
344 	case SCTPS_COOKIE_ECHOED:
345 		/*
346 		 * Close during the connect 3-way handshake
347 		 * but here there may or may not be pending data
348 		 * already on queue. Process almost same as in
349 		 * the ESTABLISHED state.
350 		 */
351 		if (sctp->sctp_xmit_head == NULL &&
352 		    sctp->sctp_xmit_unsent == NULL) {
353 			break;
354 		}
355 		/* FALLTHRU */
356 	default:
357 		/*
358 		 * If SO_LINGER has set a zero linger time, terminate the
359 		 * association and send an ABORT.
360 		 */
361 		if (sctp->sctp_linger && sctp->sctp_lingertime == 0) {
362 			sctp_user_abort(sctp, NULL);
363 			WAKE_SCTP(sctp);
364 			return (error);
365 		}
366 
367 		/*
368 		 * In there is unread data, send an ABORT and terminate the
369 		 * association.
370 		 */
371 		if (sctp->sctp_rxqueued > 0 || sctp->sctp_irwnd >
372 		    sctp->sctp_rwnd) {
373 			sctp_user_abort(sctp, NULL);
374 			WAKE_SCTP(sctp);
375 			return (error);
376 		}
377 		/*
378 		 * Transmit the shutdown before detaching the sctp_t.
379 		 * After sctp_detach returns this queue/perimeter
380 		 * no longer owns the sctp_t thus others can modify it.
381 		 */
382 		sctp_send_shutdown(sctp, 0);
383 
384 		/* Pass gathered wisdom to IP for keeping */
385 		sctp_update_ire(sctp);
386 
387 		/*
388 		 * If lingering on close then wait until the shutdown
389 		 * is complete, or the SO_LINGER time passes, or an
390 		 * ABORT is sent/received.  Note that sctp_disconnect()
391 		 * can be called more than once.  Make sure that only
392 		 * one thread waits.
393 		 */
394 		if (sctp->sctp_linger && sctp->sctp_lingertime > 0 &&
395 		    sctp->sctp_state >= SCTPS_ESTABLISHED &&
396 		    !sctp->sctp_lingering) {
397 			clock_t stoptime;	/* in ticks */
398 			clock_t ret;
399 
400 			/*
401 			 * Process the sendq to send the SHUTDOWN out
402 			 * before waiting.
403 			 */
404 			sctp_process_sendq(sctp);
405 
406 			sctp->sctp_lingering = 1;
407 			sctp->sctp_client_errno = 0;
408 			stoptime = lbolt + sctp->sctp_lingertime;
409 
410 			mutex_enter(&sctp->sctp_lock);
411 			sctp->sctp_running = B_FALSE;
412 			while (sctp->sctp_state >= SCTPS_ESTABLISHED &&
413 			    sctp->sctp_client_errno == 0) {
414 				cv_broadcast(&sctp->sctp_cv);
415 				ret = cv_timedwait_sig(&sctp->sctp_cv,
416 				    &sctp->sctp_lock, stoptime);
417 				if (ret < 0) {
418 					/* Stoptime has reached. */
419 					sctp->sctp_client_errno = EWOULDBLOCK;
420 					break;
421 				} else if (ret == 0) {
422 					/* Got a signal. */
423 					break;
424 				}
425 			}
426 			error = sctp->sctp_client_errno;
427 			sctp->sctp_client_errno = 0;
428 			mutex_exit(&sctp->sctp_lock);
429 		}
430 
431 		WAKE_SCTP(sctp);
432 		sctp_process_sendq(sctp);
433 		return (error);
434 	}
435 
436 
437 	/* Remove this sctp from all hashes so nobody can find it. */
438 	sctp_closei_local(sctp);
439 	WAKE_SCTP(sctp);
440 	return (error);
441 }
442 
443 void
444 sctp_close(sctp_t *sctp)
445 {
446 	dprint(3, ("sctp_close %p, state %d\n", (void *)sctp,
447 	    sctp->sctp_state));
448 
449 	RUN_SCTP(sctp);
450 	sctp->sctp_detached = 1;
451 	sctp->sctp_ulpd = NULL;
452 	sctp->sctp_upcalls = NULL;
453 	bzero(&sctp->sctp_events, sizeof (sctp->sctp_events));
454 
455 	/* If the graceful shutdown has not been completed, just return. */
456 	if (sctp->sctp_state != SCTPS_IDLE) {
457 		WAKE_SCTP(sctp);
458 		return;
459 	}
460 
461 	/*
462 	 * Since sctp_t is in SCTPS_IDLE state, so the only thread which
463 	 * can have a hold on the sctp_t is doing snmp stuff.  Just do
464 	 * a SCTP_REFRELE() here after the SCTP_UNLINK().  It will
465 	 * be freed when the other thread is done.
466 	 */
467 	SCTP_CONDEMNED(sctp);
468 	WAKE_SCTP(sctp);
469 	SCTP_REFRELE(sctp);
470 }
471 
472 /*
473  * Unlink from global list and do the eager close.
474  * Remove the refhold implicit in being on the global list.
475  */
476 void
477 sctp_close_eager(sctp_t *sctp)
478 {
479 	SCTP_CONDEMNED(sctp);
480 	sctp_closei_local(sctp);
481 	SCTP_REFRELE(sctp);
482 }
483 
484 /*
485  * The sctp_t is going away. Remove it from all lists and set it
486  * to SCTPS_IDLE. The caller has to remove it from the
487  * global list. The freeing up of memory is deferred until
488  * sctp_free(). This is needed since a thread in sctp_input() might have
489  * done a SCTP_REFHOLD on this structure before it was removed from the
490  * hashes.
491  */
492 static void
493 sctp_closei_local(sctp_t *sctp)
494 {
495 	mblk_t	*mp;
496 	ire_t	*ire = NULL;
497 	conn_t	*connp = sctp->sctp_connp;
498 
499 	/* Sanity check, don't do the same thing twice.  */
500 	if (connp->conn_state_flags & CONN_CLOSING) {
501 		ASSERT(sctp->sctp_state == SCTPS_IDLE);
502 		return;
503 	}
504 
505 	/* Stop and free the timers */
506 	sctp_free_faddr_timers(sctp);
507 	if ((mp = sctp->sctp_heartbeat_mp) != NULL) {
508 		sctp_timer_free(mp);
509 		sctp->sctp_heartbeat_mp = NULL;
510 	}
511 	if ((mp = sctp->sctp_ack_mp) != NULL) {
512 		sctp_timer_free(mp);
513 		sctp->sctp_ack_mp = NULL;
514 	}
515 
516 	/* Set the CONN_CLOSING flag so that IP will not cache IRE again. */
517 	mutex_enter(&connp->conn_lock);
518 	connp->conn_state_flags |= CONN_CLOSING;
519 	ire = connp->conn_ire_cache;
520 	connp->conn_ire_cache = NULL;
521 	mutex_exit(&connp->conn_lock);
522 	if (ire != NULL)
523 		IRE_REFRELE_NOTR(ire);
524 
525 	/* Remove from all hashes. */
526 	sctp_bind_hash_remove(sctp);
527 	sctp_conn_hash_remove(sctp);
528 	sctp_listen_hash_remove(sctp);
529 	sctp->sctp_state = SCTPS_IDLE;
530 
531 	/*
532 	 * Clean up the recvq as much as possible.  All those packets
533 	 * will be silently dropped as this sctp_t is now in idle state.
534 	 */
535 	mutex_enter(&sctp->sctp_recvq_lock);
536 	while ((mp = sctp->sctp_recvq) != NULL) {
537 		mblk_t *ipsec_mp;
538 
539 		sctp->sctp_recvq = mp->b_next;
540 		mp->b_next = NULL;
541 		if ((ipsec_mp = mp->b_prev) != NULL) {
542 			freeb(ipsec_mp);
543 			mp->b_prev = NULL;
544 		}
545 		freemsg(mp);
546 	}
547 	mutex_exit(&sctp->sctp_recvq_lock);
548 }
549 
550 /*
551  * Free memory associated with the sctp/ip header template.
552  */
553 static void
554 sctp_headers_free(sctp_t *sctp)
555 {
556 	if (sctp->sctp_iphc != NULL) {
557 		kmem_free(sctp->sctp_iphc, sctp->sctp_iphc_len);
558 		sctp->sctp_iphc = NULL;
559 		sctp->sctp_ipha = NULL;
560 		sctp->sctp_hdr_len = 0;
561 		sctp->sctp_ip_hdr_len = 0;
562 		sctp->sctp_iphc_len = 0;
563 		sctp->sctp_sctph = NULL;
564 		sctp->sctp_hdr_len = 0;
565 	}
566 	if (sctp->sctp_iphc6 != NULL) {
567 		kmem_free(sctp->sctp_iphc6, sctp->sctp_iphc6_len);
568 		sctp->sctp_iphc6 = NULL;
569 		sctp->sctp_ip6h = NULL;
570 		sctp->sctp_hdr6_len = 0;
571 		sctp->sctp_ip_hdr6_len = 0;
572 		sctp->sctp_iphc6_len = 0;
573 		sctp->sctp_sctph6 = NULL;
574 		sctp->sctp_hdr6_len = 0;
575 	}
576 }
577 
578 static void
579 sctp_free_xmit_data(sctp_t *sctp)
580 {
581 	mblk_t	*ump = NULL;
582 	mblk_t	*nump;
583 	mblk_t	*mp;
584 	mblk_t	*nmp;
585 
586 	sctp->sctp_xmit_unacked = NULL;
587 	ump = sctp->sctp_xmit_head;
588 	sctp->sctp_xmit_tail = sctp->sctp_xmit_head = NULL;
589 free_unsent:
590 	for (; ump != NULL; ump = nump) {
591 		for (mp = ump->b_cont; mp != NULL; mp = nmp) {
592 			nmp = mp->b_next;
593 			mp->b_next = NULL;
594 			mp->b_prev = NULL;
595 			freemsg(mp);
596 		}
597 		ASSERT(DB_REF(ump) == 1);
598 		nump = ump->b_next;
599 		ump->b_next = NULL;
600 		ump->b_prev = NULL;
601 		ump->b_cont = NULL;
602 		freeb(ump);
603 	}
604 	if ((ump = sctp->sctp_xmit_unsent) == NULL) {
605 		ASSERT(sctp->sctp_xmit_unsent_tail == NULL);
606 		return;
607 	}
608 	sctp->sctp_xmit_unsent = sctp->sctp_xmit_unsent_tail = NULL;
609 	goto free_unsent;
610 }
611 
612 /*
613  * Cleanup all the messages in the stream queue and the reassembly lists.
614  * If 'free' is true, then delete the streams as well.
615  */
616 void
617 sctp_instream_cleanup(sctp_t *sctp, boolean_t free)
618 {
619 	int	i;
620 	mblk_t	*mp;
621 	mblk_t	*mp1;
622 
623 	if (sctp->sctp_instr != NULL) {
624 		/* walk thru and flush out anything remaining in the Q */
625 		for (i = 0; i < sctp->sctp_num_istr; i++) {
626 			mp = sctp->sctp_instr[i].istr_msgs;
627 			while (mp != NULL) {
628 				mp1 = mp->b_next;
629 				mp->b_next = mp->b_prev = NULL;
630 				freemsg(mp);
631 				mp = mp1;
632 			}
633 			sctp->sctp_instr[i].istr_msgs = NULL;
634 			sctp->sctp_instr[i].istr_nmsgs = 0;
635 			sctp_free_reass((sctp->sctp_instr) + i);
636 			sctp->sctp_instr[i].nextseq = 0;
637 		}
638 		if (free) {
639 			kmem_free(sctp->sctp_instr,
640 			    sizeof (*sctp->sctp_instr) * sctp->sctp_num_istr);
641 			sctp->sctp_instr = NULL;
642 			sctp->sctp_num_istr = 0;
643 		}
644 	}
645 	/* un-ordered fragments */
646 	if (sctp->sctp_uo_frags != NULL) {
647 		for (mp = sctp->sctp_uo_frags; mp != NULL; mp = mp1) {
648 			mp1 = mp->b_next;
649 			mp->b_next = mp->b_prev = NULL;
650 			freemsg(mp);
651 		}
652 	}
653 }
654 
655 /*
656  * Last reference to the sctp_t is gone. Free all memory associated with it.
657  * Called from SCTP_REFRELE. Called inline in sctp_close()
658  */
659 void
660 sctp_free(conn_t *connp)
661 {
662 	sctp_t *sctp = CONN2SCTP(connp);
663 	int		cnt;
664 	sctp_stack_t	*sctps = sctp->sctp_sctps;
665 
666 	ASSERT(sctps != NULL);
667 	/* Unlink it from the global list */
668 	SCTP_UNLINK(sctp, sctps);
669 
670 	ASSERT(connp->conn_ref == 0);
671 	ASSERT(connp->conn_ulp == IPPROTO_SCTP);
672 	ASSERT(!MUTEX_HELD(&sctp->sctp_reflock));
673 	ASSERT(sctp->sctp_refcnt == 0);
674 
675 	ASSERT(sctp->sctp_ptpbhn == NULL && sctp->sctp_bind_hash == NULL);
676 	ASSERT(sctp->sctp_conn_hash_next == NULL &&
677 	    sctp->sctp_conn_hash_prev == NULL);
678 
679 
680 	/* Free up all the resources. */
681 
682 	/* blow away sctp stream management */
683 	if (sctp->sctp_ostrcntrs != NULL) {
684 		kmem_free(sctp->sctp_ostrcntrs,
685 		    sizeof (uint16_t) * sctp->sctp_num_ostr);
686 		sctp->sctp_ostrcntrs = NULL;
687 	}
688 	sctp_instream_cleanup(sctp, B_TRUE);
689 
690 	/* Remove all data transfer resources. */
691 	sctp->sctp_istr_nmsgs = 0;
692 	sctp->sctp_rxqueued = 0;
693 	sctp_free_xmit_data(sctp);
694 	sctp->sctp_unacked = 0;
695 	sctp->sctp_unsent = 0;
696 	if (sctp->sctp_cxmit_list != NULL)
697 		sctp_asconf_free_cxmit(sctp, NULL);
698 
699 	sctp->sctp_lastdata = NULL;
700 
701 	/* Clear out default xmit settings */
702 	sctp->sctp_def_stream = 0;
703 	sctp->sctp_def_flags = 0;
704 	sctp->sctp_def_ppid = 0;
705 	sctp->sctp_def_context = 0;
706 	sctp->sctp_def_timetolive = 0;
707 
708 	if (sctp->sctp_sack_info != NULL) {
709 		sctp_free_set(sctp->sctp_sack_info);
710 		sctp->sctp_sack_info = NULL;
711 	}
712 	sctp->sctp_sack_gaps = 0;
713 
714 	if (sctp->sctp_cookie_mp != NULL) {
715 		freemsg(sctp->sctp_cookie_mp);
716 		sctp->sctp_cookie_mp = NULL;
717 	}
718 
719 	/* Remove all the address resources. */
720 	sctp_zap_addrs(sctp);
721 	for (cnt = 0; cnt < SCTP_IPIF_HASH; cnt++) {
722 		ASSERT(sctp->sctp_saddrs[cnt].ipif_count == 0);
723 		list_destroy(&sctp->sctp_saddrs[cnt].sctp_ipif_list);
724 	}
725 
726 	ip6_pkt_free(&sctp->sctp_sticky_ipp);
727 
728 	if (sctp->sctp_hopopts != NULL) {
729 		mi_free(sctp->sctp_hopopts);
730 		sctp->sctp_hopopts = NULL;
731 		sctp->sctp_hopoptslen = 0;
732 	}
733 	ASSERT(sctp->sctp_hopoptslen == 0);
734 	if (sctp->sctp_dstopts != NULL) {
735 		mi_free(sctp->sctp_dstopts);
736 		sctp->sctp_dstopts = NULL;
737 		sctp->sctp_dstoptslen = 0;
738 	}
739 	ASSERT(sctp->sctp_dstoptslen == 0);
740 	if (sctp->sctp_rtdstopts != NULL) {
741 		mi_free(sctp->sctp_rtdstopts);
742 		sctp->sctp_rtdstopts = NULL;
743 		sctp->sctp_rtdstoptslen = 0;
744 	}
745 	ASSERT(sctp->sctp_rtdstoptslen == 0);
746 	if (sctp->sctp_rthdr != NULL) {
747 		mi_free(sctp->sctp_rthdr);
748 		sctp->sctp_rthdr = NULL;
749 		sctp->sctp_rthdrlen = 0;
750 	}
751 	ASSERT(sctp->sctp_rthdrlen == 0);
752 	sctp_headers_free(sctp);
753 
754 	sctp->sctp_shutdown_faddr = NULL;
755 
756 	if (sctp->sctp_err_chunks != NULL) {
757 		freemsg(sctp->sctp_err_chunks);
758 		sctp->sctp_err_chunks = NULL;
759 		sctp->sctp_err_len = 0;
760 	}
761 
762 	/* Clear all the bitfields. */
763 	bzero(&sctp->sctp_bits, sizeof (sctp->sctp_bits));
764 
765 	/* It is time to update the global statistics. */
766 	UPDATE_MIB(&sctps->sctps_mib, sctpOutSCTPPkts, sctp->sctp_opkts);
767 	UPDATE_MIB(&sctps->sctps_mib, sctpOutCtrlChunks, sctp->sctp_obchunks);
768 	UPDATE_MIB(&sctps->sctps_mib, sctpOutOrderChunks, sctp->sctp_odchunks);
769 	UPDATE_MIB(&sctps->sctps_mib,
770 	    sctpOutUnorderChunks, sctp->sctp_oudchunks);
771 	UPDATE_MIB(&sctps->sctps_mib, sctpRetransChunks, sctp->sctp_rxtchunks);
772 	UPDATE_MIB(&sctps->sctps_mib, sctpInSCTPPkts, sctp->sctp_ipkts);
773 	UPDATE_MIB(&sctps->sctps_mib, sctpInCtrlChunks, sctp->sctp_ibchunks);
774 	UPDATE_MIB(&sctps->sctps_mib, sctpInOrderChunks, sctp->sctp_idchunks);
775 	UPDATE_MIB(&sctps->sctps_mib,
776 	    sctpInUnorderChunks, sctp->sctp_iudchunks);
777 	UPDATE_MIB(&sctps->sctps_mib, sctpFragUsrMsgs, sctp->sctp_fragdmsgs);
778 	UPDATE_MIB(&sctps->sctps_mib, sctpReasmUsrMsgs, sctp->sctp_reassmsgs);
779 	sctp->sctp_opkts = 0;
780 	sctp->sctp_obchunks = 0;
781 	sctp->sctp_odchunks = 0;
782 	sctp->sctp_oudchunks = 0;
783 	sctp->sctp_rxtchunks = 0;
784 	sctp->sctp_ipkts = 0;
785 	sctp->sctp_ibchunks = 0;
786 	sctp->sctp_idchunks = 0;
787 	sctp->sctp_iudchunks = 0;
788 	sctp->sctp_fragdmsgs = 0;
789 	sctp->sctp_reassmsgs = 0;
790 	sctp->sctp_outseqtsns = 0;
791 	sctp->sctp_osacks = 0;
792 	sctp->sctp_isacks = 0;
793 	sctp->sctp_idupchunks = 0;
794 	sctp->sctp_gapcnt = 0;
795 	sctp->sctp_cum_obchunks = 0;
796 	sctp->sctp_cum_odchunks = 0;
797 	sctp->sctp_cum_oudchunks = 0;
798 	sctp->sctp_cum_rxtchunks = 0;
799 	sctp->sctp_cum_ibchunks = 0;
800 	sctp->sctp_cum_idchunks = 0;
801 	sctp->sctp_cum_iudchunks = 0;
802 
803 	sctp->sctp_autoclose = 0;
804 	sctp->sctp_tx_adaptation_code = 0;
805 
806 	sctp->sctp_v6label_len = 0;
807 	sctp->sctp_v4label_len = 0;
808 
809 	/* Every sctp_t holds one reference on the default queue */
810 	sctp->sctp_sctps = NULL;
811 	SCTP_G_Q_REFRELE(sctps);
812 
813 	sctp_conn_clear(connp);
814 	kmem_cache_free(sctp_conn_cache, connp);
815 }
816 
817 /* Diagnostic routine used to return a string associated with the sctp state. */
818 char *
819 sctp_display(sctp_t *sctp, char *sup_buf)
820 {
821 	char	*buf;
822 	char	buf1[30];
823 	static char	priv_buf[INET6_ADDRSTRLEN * 2 + 80];
824 	char	*cp;
825 
826 	if (sctp == NULL)
827 		return ("NULL_SCTP");
828 
829 	buf = (sup_buf != NULL) ? sup_buf : priv_buf;
830 
831 	switch (sctp->sctp_state) {
832 	case SCTPS_IDLE:
833 		cp = "SCTP_IDLE";
834 		break;
835 	case SCTPS_BOUND:
836 		cp = "SCTP_BOUND";
837 		break;
838 	case SCTPS_LISTEN:
839 		cp = "SCTP_LISTEN";
840 		break;
841 	case SCTPS_COOKIE_WAIT:
842 		cp = "SCTP_COOKIE_WAIT";
843 		break;
844 	case SCTPS_COOKIE_ECHOED:
845 		cp = "SCTP_COOKIE_ECHOED";
846 		break;
847 	case SCTPS_ESTABLISHED:
848 		cp = "SCTP_ESTABLISHED";
849 		break;
850 	case SCTPS_SHUTDOWN_PENDING:
851 		cp = "SCTP_SHUTDOWN_PENDING";
852 		break;
853 	case SCTPS_SHUTDOWN_SENT:
854 		cp = "SCTPS_SHUTDOWN_SENT";
855 		break;
856 	case SCTPS_SHUTDOWN_RECEIVED:
857 		cp = "SCTPS_SHUTDOWN_RECEIVED";
858 		break;
859 	case SCTPS_SHUTDOWN_ACK_SENT:
860 		cp = "SCTPS_SHUTDOWN_ACK_SENT";
861 		break;
862 	default:
863 		(void) mi_sprintf(buf1, "SCTPUnkState(%d)", sctp->sctp_state);
864 		cp = buf1;
865 		break;
866 	}
867 	(void) mi_sprintf(buf, "[%u, %u] %s",
868 	    ntohs(sctp->sctp_lport), ntohs(sctp->sctp_fport), cp);
869 
870 	return (buf);
871 }
872 
873 /*
874  * Initialize protocol control block. If a parent exists, inherit
875  * all values set through setsockopt().
876  */
877 static int
878 sctp_init_values(sctp_t *sctp, sctp_t *psctp, int sleep)
879 {
880 	int	err;
881 	int	cnt;
882 	sctp_stack_t	*sctps = sctp->sctp_sctps;
883 	conn_t 	*connp, *pconnp;
884 
885 	ASSERT((sctp->sctp_family == AF_INET &&
886 	    sctp->sctp_ipversion == IPV4_VERSION) ||
887 	    (sctp->sctp_family == AF_INET6 &&
888 	    (sctp->sctp_ipversion == IPV4_VERSION ||
889 	    sctp->sctp_ipversion == IPV6_VERSION)));
890 
891 	sctp->sctp_nsaddrs = 0;
892 	for (cnt = 0; cnt < SCTP_IPIF_HASH; cnt++) {
893 		sctp->sctp_saddrs[cnt].ipif_count = 0;
894 		list_create(&sctp->sctp_saddrs[cnt].sctp_ipif_list,
895 		    sizeof (sctp_saddr_ipif_t), offsetof(sctp_saddr_ipif_t,
896 		    saddr_ipif));
897 	}
898 	sctp->sctp_ports = 0;
899 	sctp->sctp_running = B_FALSE;
900 	sctp->sctp_state = SCTPS_IDLE;
901 
902 	sctp->sctp_refcnt = 1;
903 
904 	sctp->sctp_strikes = 0;
905 
906 	sctp->sctp_last_mtu_probe = lbolt64;
907 	sctp->sctp_mtu_probe_intvl = sctps->sctps_mtu_probe_interval;
908 
909 	sctp->sctp_sack_gaps = 0;
910 	sctp->sctp_sack_toggle = 2;
911 
912 	/* Only need to do the allocation if there is no "cached" one. */
913 	if (sctp->sctp_pad_mp == NULL) {
914 		if (sleep == KM_SLEEP) {
915 			sctp->sctp_pad_mp = allocb_wait(SCTP_ALIGN, BPRI_MED,
916 			    STR_NOSIG, NULL);
917 		} else {
918 			sctp->sctp_pad_mp = allocb(SCTP_ALIGN, BPRI_MED);
919 			if (sctp->sctp_pad_mp == NULL)
920 				return (ENOMEM);
921 		}
922 		bzero(sctp->sctp_pad_mp->b_rptr, SCTP_ALIGN);
923 	}
924 
925 	if (psctp != NULL) {
926 		/*
927 		 * Inherit from parent
928 		 */
929 		sctp->sctp_iphc = kmem_zalloc(psctp->sctp_iphc_len, sleep);
930 		if (sctp->sctp_iphc == NULL) {
931 			sctp->sctp_iphc_len = 0;
932 			err = ENOMEM;
933 			goto failure;
934 		}
935 		sctp->sctp_iphc_len = psctp->sctp_iphc_len;
936 		sctp->sctp_hdr_len = psctp->sctp_hdr_len;
937 
938 		sctp->sctp_iphc6 = kmem_zalloc(psctp->sctp_iphc6_len, sleep);
939 		if (sctp->sctp_iphc6 == NULL) {
940 			sctp->sctp_iphc6_len = 0;
941 			err = ENOMEM;
942 			goto failure;
943 		}
944 		sctp->sctp_iphc6_len = psctp->sctp_iphc6_len;
945 		sctp->sctp_hdr6_len = psctp->sctp_hdr6_len;
946 
947 		sctp->sctp_ip_hdr_len = psctp->sctp_ip_hdr_len;
948 		sctp->sctp_ip_hdr6_len = psctp->sctp_ip_hdr6_len;
949 
950 		/*
951 		 * Copy the IP+SCTP header templates from listener
952 		 */
953 		bcopy(psctp->sctp_iphc, sctp->sctp_iphc,
954 		    psctp->sctp_hdr_len);
955 		sctp->sctp_ipha = (ipha_t *)sctp->sctp_iphc;
956 		sctp->sctp_sctph = (sctp_hdr_t *)(sctp->sctp_iphc +
957 		    sctp->sctp_ip_hdr_len);
958 
959 		bcopy(psctp->sctp_iphc6, sctp->sctp_iphc6,
960 		    psctp->sctp_hdr6_len);
961 		if (((ip6i_t *)(sctp->sctp_iphc6))->ip6i_nxt == IPPROTO_RAW) {
962 			sctp->sctp_ip6h = (ip6_t *)(sctp->sctp_iphc6 +
963 			    sizeof (ip6i_t));
964 		} else {
965 			sctp->sctp_ip6h = (ip6_t *)sctp->sctp_iphc6;
966 		}
967 		sctp->sctp_sctph6 = (sctp_hdr_t *)(sctp->sctp_iphc6 +
968 		    sctp->sctp_ip_hdr6_len);
969 
970 		sctp->sctp_cookie_lifetime = psctp->sctp_cookie_lifetime;
971 		sctp->sctp_xmit_lowater = psctp->sctp_xmit_lowater;
972 		sctp->sctp_xmit_hiwater = psctp->sctp_xmit_hiwater;
973 		sctp->sctp_cwnd_max = psctp->sctp_cwnd_max;
974 		sctp->sctp_rwnd = psctp->sctp_rwnd;
975 		sctp->sctp_irwnd = psctp->sctp_rwnd;
976 		sctp->sctp_pd_point = psctp->sctp_pd_point;
977 		sctp->sctp_rto_max = psctp->sctp_rto_max;
978 		sctp->sctp_init_rto_max = psctp->sctp_init_rto_max;
979 		sctp->sctp_rto_min = psctp->sctp_rto_min;
980 		sctp->sctp_rto_initial = psctp->sctp_rto_initial;
981 		sctp->sctp_pa_max_rxt = psctp->sctp_pa_max_rxt;
982 		sctp->sctp_pp_max_rxt = psctp->sctp_pp_max_rxt;
983 		sctp->sctp_max_init_rxt = psctp->sctp_max_init_rxt;
984 
985 		sctp->sctp_def_stream = psctp->sctp_def_stream;
986 		sctp->sctp_def_flags = psctp->sctp_def_flags;
987 		sctp->sctp_def_ppid = psctp->sctp_def_ppid;
988 		sctp->sctp_def_context = psctp->sctp_def_context;
989 		sctp->sctp_def_timetolive = psctp->sctp_def_timetolive;
990 
991 		sctp->sctp_num_istr = psctp->sctp_num_istr;
992 		sctp->sctp_num_ostr = psctp->sctp_num_ostr;
993 
994 		sctp->sctp_hb_interval = psctp->sctp_hb_interval;
995 		sctp->sctp_autoclose = psctp->sctp_autoclose;
996 		sctp->sctp_tx_adaptation_code = psctp->sctp_tx_adaptation_code;
997 
998 		/* xxx should be a better way to copy these flags xxx */
999 		sctp->sctp_debug = psctp->sctp_debug;
1000 		sctp->sctp_bound_to_all = psctp->sctp_bound_to_all;
1001 		sctp->sctp_cansleep = psctp->sctp_cansleep;
1002 		sctp->sctp_send_adaptation = psctp->sctp_send_adaptation;
1003 		sctp->sctp_ndelay = psctp->sctp_ndelay;
1004 		sctp->sctp_events = psctp->sctp_events;
1005 		sctp->sctp_ipv6_recvancillary = psctp->sctp_ipv6_recvancillary;
1006 
1007 		/* Copy IP-layer options */
1008 		connp = sctp->sctp_connp;
1009 		pconnp = psctp->sctp_connp;
1010 
1011 		connp->conn_broadcast = pconnp->conn_broadcast;
1012 		connp->conn_loopback = pconnp->conn_loopback;
1013 		connp->conn_dontroute = pconnp->conn_dontroute;
1014 		connp->conn_reuseaddr = pconnp->conn_reuseaddr;
1015 
1016 	} else {
1017 		/*
1018 		 * Initialize the header template
1019 		 */
1020 		if ((err = sctp_header_init_ipv4(sctp, sleep)) != 0) {
1021 			goto failure;
1022 		}
1023 		if ((err = sctp_header_init_ipv6(sctp, sleep)) != 0) {
1024 			goto failure;
1025 		}
1026 
1027 		/*
1028 		 * Set to system defaults
1029 		 */
1030 		sctp->sctp_cookie_lifetime =
1031 		    MSEC_TO_TICK(sctps->sctps_cookie_life);
1032 		sctp->sctp_xmit_lowater = sctps->sctps_xmit_lowat;
1033 		sctp->sctp_xmit_hiwater = sctps->sctps_xmit_hiwat;
1034 		sctp->sctp_cwnd_max = sctps->sctps_cwnd_max_;
1035 		sctp->sctp_rwnd = sctps->sctps_recv_hiwat;
1036 		sctp->sctp_irwnd = sctp->sctp_rwnd;
1037 		sctp->sctp_pd_point = sctp->sctp_rwnd;
1038 		sctp->sctp_rto_max = MSEC_TO_TICK(sctps->sctps_rto_maxg);
1039 		sctp->sctp_init_rto_max = sctp->sctp_rto_max;
1040 		sctp->sctp_rto_min = MSEC_TO_TICK(sctps->sctps_rto_ming);
1041 		sctp->sctp_rto_initial = MSEC_TO_TICK(
1042 		    sctps->sctps_rto_initialg);
1043 		sctp->sctp_pa_max_rxt = sctps->sctps_pa_max_retr;
1044 		sctp->sctp_pp_max_rxt = sctps->sctps_pp_max_retr;
1045 		sctp->sctp_max_init_rxt = sctps->sctps_max_init_retr;
1046 
1047 		sctp->sctp_num_istr = sctps->sctps_max_in_streams;
1048 		sctp->sctp_num_ostr = sctps->sctps_initial_out_streams;
1049 
1050 		sctp->sctp_hb_interval =
1051 		    MSEC_TO_TICK(sctps->sctps_heartbeat_interval);
1052 	}
1053 	sctp->sctp_understands_asconf = B_TRUE;
1054 	sctp->sctp_understands_addip = B_TRUE;
1055 	sctp->sctp_prsctp_aware = B_FALSE;
1056 
1057 	sctp->sctp_connp->conn_ref = 1;
1058 	sctp->sctp_connp->conn_fully_bound = B_FALSE;
1059 
1060 	sctp->sctp_prsctpdrop = 0;
1061 	sctp->sctp_msgcount = 0;
1062 
1063 	return (0);
1064 
1065 failure:
1066 	if (sctp->sctp_iphc != NULL) {
1067 		kmem_free(sctp->sctp_iphc, sctp->sctp_iphc_len);
1068 		sctp->sctp_iphc = NULL;
1069 	}
1070 	if (sctp->sctp_iphc6 != NULL) {
1071 		kmem_free(sctp->sctp_iphc6, sctp->sctp_iphc6_len);
1072 		sctp->sctp_iphc6 = NULL;
1073 	}
1074 	return (err);
1075 }
1076 
1077 /*
1078  * Extracts the init tag from an INIT chunk and checks if it matches
1079  * the sctp's verification tag. Returns 0 if it doesn't match, 1 if
1080  * it does.
1081  */
1082 static boolean_t
1083 sctp_icmp_verf(sctp_t *sctp, sctp_hdr_t *sh, mblk_t *mp)
1084 {
1085 	sctp_chunk_hdr_t *sch;
1086 	uint32_t verf, *vp;
1087 
1088 	sch = (sctp_chunk_hdr_t *)(sh + 1);
1089 	vp = (uint32_t *)(sch + 1);
1090 
1091 	/* Need at least the data chunk hdr and the first 4 bytes of INIT */
1092 	if ((unsigned char *)(vp + 1) > mp->b_wptr) {
1093 		return (B_FALSE);
1094 	}
1095 
1096 	bcopy(vp, &verf, sizeof (verf));
1097 
1098 	if (verf == sctp->sctp_lvtag) {
1099 		return (B_TRUE);
1100 	}
1101 	return (B_FALSE);
1102 }
1103 
1104 /*
1105  * sctp_icmp_error is called by sctp_input() to process ICMP error messages
1106  * passed up by IP.  The queue is the default queue.  We need to find a sctp_t
1107  * that corresponds to the returned datagram.  Passes the message back in on
1108  * the correct queue once it has located the connection.
1109  * Assumes that IP has pulled up everything up to and including
1110  * the ICMP header.
1111  */
1112 void
1113 sctp_icmp_error(sctp_t *sctp, mblk_t *mp)
1114 {
1115 	icmph_t *icmph;
1116 	ipha_t	*ipha;
1117 	int	iph_hdr_length;
1118 	sctp_hdr_t *sctph;
1119 	mblk_t *first_mp;
1120 	uint32_t new_mtu;
1121 	in6_addr_t dst;
1122 	sctp_faddr_t *fp;
1123 	sctp_stack_t	*sctps = sctp->sctp_sctps;
1124 
1125 	dprint(1, ("sctp_icmp_error: sctp=%p, mp=%p\n", (void *)sctp,
1126 	    (void *)mp));
1127 
1128 	first_mp = mp;
1129 
1130 	ipha = (ipha_t *)mp->b_rptr;
1131 	if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
1132 		ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
1133 		sctp_icmp_error_ipv6(sctp, first_mp);
1134 		return;
1135 	}
1136 
1137 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1138 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1139 	ipha = (ipha_t *)&icmph[1];
1140 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1141 	sctph = (sctp_hdr_t *)((char *)ipha + iph_hdr_length);
1142 	if ((uchar_t *)(sctph + 1) >= mp->b_wptr) {
1143 		/* not enough data for SCTP header */
1144 		freemsg(first_mp);
1145 		return;
1146 	}
1147 
1148 	switch (icmph->icmph_type) {
1149 	case ICMP_DEST_UNREACHABLE:
1150 		switch (icmph->icmph_code) {
1151 		case ICMP_FRAGMENTATION_NEEDED:
1152 			/*
1153 			 * Reduce the MSS based on the new MTU.  This will
1154 			 * eliminate any fragmentation locally.
1155 			 * N.B.  There may well be some funny side-effects on
1156 			 * the local send policy and the remote receive policy.
1157 			 * Pending further research, we provide
1158 			 * sctp_ignore_path_mtu just in case this proves
1159 			 * disastrous somewhere.
1160 			 *
1161 			 * After updating the MSS, retransmit part of the
1162 			 * dropped segment using the new mss by calling
1163 			 * sctp_wput_slow().  Need to adjust all those
1164 			 * params to make sure sctp_wput_slow() work properly.
1165 			 */
1166 			if (sctps->sctps_ignore_path_mtu)
1167 				break;
1168 
1169 			/* find the offending faddr */
1170 			IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &dst);
1171 			fp = sctp_lookup_faddr(sctp, &dst);
1172 			if (fp == NULL) {
1173 				break;
1174 			}
1175 
1176 			new_mtu = ntohs(icmph->icmph_du_mtu);
1177 
1178 			if (new_mtu - sctp->sctp_hdr_len >= fp->sfa_pmss)
1179 				break;
1180 
1181 			/*
1182 			 * Make sure that sfa_pmss is a multiple of
1183 			 * SCTP_ALIGN.
1184 			 */
1185 			fp->sfa_pmss = (new_mtu - sctp->sctp_hdr_len) &
1186 			    ~(SCTP_ALIGN - 1);
1187 			fp->pmtu_discovered = 1;
1188 
1189 			break;
1190 		case ICMP_PORT_UNREACHABLE:
1191 		case ICMP_PROTOCOL_UNREACHABLE:
1192 			switch (sctp->sctp_state) {
1193 			case SCTPS_COOKIE_WAIT:
1194 			case SCTPS_COOKIE_ECHOED:
1195 				/* make sure the verification tag matches */
1196 				if (!sctp_icmp_verf(sctp, sctph, mp)) {
1197 					break;
1198 				}
1199 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1200 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1201 				    NULL);
1202 				sctp_clean_death(sctp, ECONNREFUSED);
1203 				break;
1204 			}
1205 			break;
1206 		case ICMP_HOST_UNREACHABLE:
1207 		case ICMP_NET_UNREACHABLE:
1208 			/* Record the error in case we finally time out. */
1209 			sctp->sctp_client_errno = (icmph->icmph_code ==
1210 			    ICMP_HOST_UNREACHABLE) ? EHOSTUNREACH : ENETUNREACH;
1211 			break;
1212 		default:
1213 			break;
1214 		}
1215 		break;
1216 	case ICMP_SOURCE_QUENCH: {
1217 		/* Reduce the sending rate as if we got a retransmit timeout */
1218 		break;
1219 	}
1220 	}
1221 	freemsg(first_mp);
1222 }
1223 
1224 /*
1225  * sctp_icmp_error_ipv6() is called by sctp_icmp_error() to process ICMPv6
1226  * error messages passed up by IP.
1227  * Assumes that IP has pulled up all the extension headers as well
1228  * as the ICMPv6 header.
1229  */
1230 static void
1231 sctp_icmp_error_ipv6(sctp_t *sctp, mblk_t *mp)
1232 {
1233 	icmp6_t *icmp6;
1234 	ip6_t	*ip6h;
1235 	uint16_t	iph_hdr_length;
1236 	sctp_hdr_t *sctpha;
1237 	uint8_t	*nexthdrp;
1238 	uint32_t new_mtu;
1239 	sctp_faddr_t *fp;
1240 	sctp_stack_t	*sctps = sctp->sctp_sctps;
1241 
1242 	ip6h = (ip6_t *)mp->b_rptr;
1243 	iph_hdr_length = (ip6h->ip6_nxt != IPPROTO_SCTP) ?
1244 	    ip_hdr_length_v6(mp, ip6h) : IPV6_HDR_LEN;
1245 
1246 	icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1247 	ip6h = (ip6_t *)&icmp6[1];
1248 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1249 		freemsg(mp);
1250 		return;
1251 	}
1252 	ASSERT(*nexthdrp == IPPROTO_SCTP);
1253 
1254 	/* XXX need ifindex to find connection */
1255 	sctpha = (sctp_hdr_t *)((char *)ip6h + iph_hdr_length);
1256 	if ((uchar_t *)sctpha >= mp->b_wptr) {
1257 		/* not enough data for SCTP header */
1258 		freemsg(mp);
1259 		return;
1260 	}
1261 	switch (icmp6->icmp6_type) {
1262 	case ICMP6_PACKET_TOO_BIG:
1263 		/*
1264 		 * Reduce the MSS based on the new MTU.  This will
1265 		 * eliminate any fragmentation locally.
1266 		 * N.B.  There may well be some funny side-effects on
1267 		 * the local send policy and the remote receive policy.
1268 		 * Pending further research, we provide
1269 		 * sctp_ignore_path_mtu just in case this proves
1270 		 * disastrous somewhere.
1271 		 *
1272 		 * After updating the MSS, retransmit part of the
1273 		 * dropped segment using the new mss by calling
1274 		 * sctp_wput_slow().  Need to adjust all those
1275 		 * params to make sure sctp_wput_slow() work properly.
1276 		 */
1277 		if (sctps->sctps_ignore_path_mtu)
1278 			break;
1279 
1280 		/* find the offending faddr */
1281 		fp = sctp_lookup_faddr(sctp, &ip6h->ip6_dst);
1282 		if (fp == NULL) {
1283 			break;
1284 		}
1285 
1286 		new_mtu = ntohs(icmp6->icmp6_mtu);
1287 
1288 		if (new_mtu - sctp->sctp_hdr6_len >= fp->sfa_pmss)
1289 			break;
1290 
1291 		/* Make sure that sfa_pmss is a multiple of SCTP_ALIGN. */
1292 		fp->sfa_pmss = (new_mtu - sctp->sctp_hdr6_len) &
1293 		    ~(SCTP_ALIGN - 1);
1294 		fp->pmtu_discovered = 1;
1295 
1296 		break;
1297 
1298 	case ICMP6_DST_UNREACH:
1299 		switch (icmp6->icmp6_code) {
1300 		case ICMP6_DST_UNREACH_NOPORT:
1301 			/* make sure the verification tag matches */
1302 			if (!sctp_icmp_verf(sctp, sctpha, mp)) {
1303 				break;
1304 			}
1305 			if (sctp->sctp_state == SCTPS_COOKIE_WAIT ||
1306 			    sctp->sctp_state == SCTPS_COOKIE_ECHOED) {
1307 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1308 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1309 				    NULL);
1310 				sctp_clean_death(sctp, ECONNREFUSED);
1311 			}
1312 			break;
1313 
1314 		case ICMP6_DST_UNREACH_ADMIN:
1315 		case ICMP6_DST_UNREACH_NOROUTE:
1316 		case ICMP6_DST_UNREACH_NOTNEIGHBOR:
1317 		case ICMP6_DST_UNREACH_ADDR:
1318 			/* Record the error in case we finally time out. */
1319 			sctp->sctp_client_errno = EHOSTUNREACH;
1320 			break;
1321 		default:
1322 			break;
1323 		}
1324 		break;
1325 
1326 	case ICMP6_PARAM_PROB:
1327 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1328 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1329 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1330 		    (uchar_t *)nexthdrp) {
1331 			/* make sure the verification tag matches */
1332 			if (!sctp_icmp_verf(sctp, sctpha, mp)) {
1333 				break;
1334 			}
1335 			if (sctp->sctp_state == SCTPS_COOKIE_WAIT) {
1336 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1337 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1338 				    NULL);
1339 				sctp_clean_death(sctp, ECONNREFUSED);
1340 			}
1341 			break;
1342 		}
1343 		break;
1344 
1345 	case ICMP6_TIME_EXCEEDED:
1346 	default:
1347 		break;
1348 	}
1349 	freemsg(mp);
1350 }
1351 
1352 /*
1353  * Called by sockfs to create a new sctp instance.
1354  *
1355  * If parent pointer is passed in, inherit settings from it.
1356  */
1357 sctp_t *
1358 sctp_create(void *ulpd, sctp_t *parent, int family, int flags,
1359     sock_upcalls_t *upcalls, sctp_sockbuf_limits_t *sbl,
1360     cred_t *credp)
1361 {
1362 	sctp_t		*sctp, *psctp;
1363 	conn_t		*sctp_connp;
1364 	mblk_t		*ack_mp, *hb_mp;
1365 	int		sleep = flags & SCTP_CAN_BLOCK ? KM_SLEEP : KM_NOSLEEP;
1366 	zoneid_t	zoneid;
1367 	sctp_stack_t	*sctps;
1368 
1369 	/* User must supply a credential. */
1370 	if (credp == NULL)
1371 		return (NULL);
1372 
1373 	psctp = (sctp_t *)parent;
1374 	if (psctp != NULL) {
1375 		sctps = psctp->sctp_sctps;
1376 		/* Increase here to have common decrease at end */
1377 		netstack_hold(sctps->sctps_netstack);
1378 	} else {
1379 		netstack_t *ns;
1380 
1381 		ns = netstack_find_by_cred(credp);
1382 		ASSERT(ns != NULL);
1383 		sctps = ns->netstack_sctp;
1384 		ASSERT(sctps != NULL);
1385 
1386 		/*
1387 		 * For exclusive stacks we set the zoneid to zero
1388 		 * to make SCTP operate as if in the global zone.
1389 		 */
1390 		if (sctps->sctps_netstack->netstack_stackid !=
1391 		    GLOBAL_NETSTACKID)
1392 			zoneid = GLOBAL_ZONEID;
1393 		else
1394 			zoneid = crgetzoneid(credp);
1395 
1396 		/*
1397 		 * For stackid zero this is done from strplumb.c, but
1398 		 * non-zero stackids are handled here.
1399 		 */
1400 		if (sctps->sctps_g_q == NULL &&
1401 		    sctps->sctps_netstack->netstack_stackid !=
1402 		    GLOBAL_NETSTACKID) {
1403 			sctp_g_q_setup(sctps);
1404 		}
1405 	}
1406 	if ((sctp_connp = ipcl_conn_create(IPCL_SCTPCONN, sleep,
1407 	    sctps->sctps_netstack)) == NULL) {
1408 		netstack_rele(sctps->sctps_netstack);
1409 		SCTP_KSTAT(sctps, sctp_conn_create);
1410 		return (NULL);
1411 	}
1412 	/*
1413 	 * ipcl_conn_create did a netstack_hold. Undo the hold that was
1414 	 * done at top of sctp_create.
1415 	 */
1416 	netstack_rele(sctps->sctps_netstack);
1417 	sctp = CONN2SCTP(sctp_connp);
1418 	sctp->sctp_sctps = sctps;
1419 
1420 	sctp_connp->conn_ulp_labeled = is_system_labeled();
1421 	if ((ack_mp = sctp_timer_alloc(sctp, sctp_ack_timer, sleep)) == NULL ||
1422 	    (hb_mp = sctp_timer_alloc(sctp, sctp_heartbeat_timer,
1423 	    sleep)) == NULL) {
1424 		if (ack_mp != NULL)
1425 			freeb(ack_mp);
1426 		sctp_conn_clear(sctp_connp);
1427 		sctp->sctp_sctps = NULL;
1428 		SCTP_G_Q_REFRELE(sctps);
1429 		kmem_cache_free(sctp_conn_cache, sctp_connp);
1430 		return (NULL);
1431 	}
1432 
1433 	sctp->sctp_ack_mp = ack_mp;
1434 	sctp->sctp_heartbeat_mp = hb_mp;
1435 
1436 	switch (family) {
1437 	case AF_INET6:
1438 		sctp_connp->conn_af_isv6 = B_TRUE;
1439 		sctp->sctp_ipversion = IPV6_VERSION;
1440 		sctp->sctp_family = AF_INET6;
1441 		break;
1442 
1443 	case AF_INET:
1444 		sctp_connp->conn_af_isv6 = B_FALSE;
1445 		sctp_connp->conn_pkt_isv6 = B_FALSE;
1446 		sctp->sctp_ipversion = IPV4_VERSION;
1447 		sctp->sctp_family = AF_INET;
1448 		break;
1449 	default:
1450 		ASSERT(0);
1451 		break;
1452 	}
1453 	if (sctp_init_values(sctp, psctp, sleep) != 0) {
1454 		freeb(ack_mp);
1455 		freeb(hb_mp);
1456 		sctp_conn_clear(sctp_connp);
1457 		sctp->sctp_sctps = NULL;
1458 		SCTP_G_Q_REFRELE(sctps);
1459 		kmem_cache_free(sctp_conn_cache, sctp_connp);
1460 		return (NULL);
1461 	}
1462 	sctp->sctp_cansleep = ((flags & SCTP_CAN_BLOCK) == SCTP_CAN_BLOCK);
1463 
1464 	sctp->sctp_mss = sctps->sctps_initial_mtu - ((family == AF_INET6) ?
1465 	    sctp->sctp_hdr6_len : sctp->sctp_hdr_len);
1466 
1467 	if (psctp != NULL) {
1468 		RUN_SCTP(psctp);
1469 		/*
1470 		 * Inherit local address list, local port. Parent is either
1471 		 * in SCTPS_BOUND, or SCTPS_LISTEN state.
1472 		 */
1473 		ASSERT((psctp->sctp_state == SCTPS_BOUND) ||
1474 		    (psctp->sctp_state == SCTPS_LISTEN));
1475 		if (sctp_dup_saddrs(psctp, sctp, sleep)) {
1476 			WAKE_SCTP(psctp);
1477 			freeb(ack_mp);
1478 			freeb(hb_mp);
1479 			sctp_headers_free(sctp);
1480 			sctp_conn_clear(sctp_connp);
1481 			sctp->sctp_sctps = NULL;
1482 			SCTP_G_Q_REFRELE(sctps);
1483 			kmem_cache_free(sctp_conn_cache, sctp_connp);
1484 			return (NULL);
1485 		}
1486 
1487 		/*
1488 		 * If the parent is specified, it'll be immediatelly
1489 		 * followed by sctp_connect(). So don't add this guy to
1490 		 * bind hash.
1491 		 */
1492 		sctp->sctp_lport = psctp->sctp_lport;
1493 		sctp->sctp_state = SCTPS_BOUND;
1494 		sctp->sctp_allzones = psctp->sctp_allzones;
1495 		sctp->sctp_zoneid = psctp->sctp_zoneid;
1496 		WAKE_SCTP(psctp);
1497 	} else {
1498 		sctp->sctp_zoneid = zoneid;
1499 	}
1500 
1501 	sctp->sctp_cpid = curproc->p_pid;
1502 	sctp->sctp_open_time = lbolt64;
1503 
1504 	ASSERT(sctp_connp->conn_cred == NULL);
1505 	sctp_connp->conn_cred = credp;
1506 	crhold(credp);
1507 
1508 	/*
1509 	 * If the caller has the process-wide flag set, then default to MAC
1510 	 * exempt mode.  This allows read-down to unlabeled hosts.
1511 	 */
1512 	if (getpflags(NET_MAC_AWARE, credp) != 0)
1513 		sctp_connp->conn_mac_exempt = B_TRUE;
1514 
1515 	/* Initialize SCTP instance values,  our verf tag must never be 0 */
1516 	(void) random_get_pseudo_bytes((uint8_t *)&sctp->sctp_lvtag,
1517 	    sizeof (sctp->sctp_lvtag));
1518 	if (sctp->sctp_lvtag == 0)
1519 		sctp->sctp_lvtag = (uint32_t)gethrtime();
1520 	ASSERT(sctp->sctp_lvtag != 0);
1521 
1522 	sctp->sctp_ltsn = sctp->sctp_lvtag + 1;
1523 	sctp->sctp_lcsn = sctp->sctp_ltsn;
1524 	sctp->sctp_recovery_tsn = sctp->sctp_lastack_rxd = sctp->sctp_ltsn - 1;
1525 	sctp->sctp_adv_pap = sctp->sctp_lastack_rxd;
1526 
1527 	/* Information required by upper layer */
1528 	if (ulpd != NULL) {
1529 		sctp->sctp_ulpd = ulpd;
1530 
1531 		ASSERT(upcalls != NULL);
1532 		sctp->sctp_upcalls = upcalls;
1533 		ASSERT(sbl != NULL);
1534 		/* Fill in the socket buffer limits for sctpsockfs */
1535 		sbl->sbl_txlowat = sctp->sctp_xmit_lowater;
1536 		sbl->sbl_txbuf = sctp->sctp_xmit_hiwater;
1537 		sbl->sbl_rxbuf = sctp->sctp_rwnd;
1538 		sbl->sbl_rxlowat = SCTP_RECV_LOWATER;
1539 	}
1540 	/* If no ulpd, must be creating the default sctp */
1541 	ASSERT(ulpd != NULL || sctps->sctps_gsctp == NULL);
1542 
1543 	/* Insert this in the global list. */
1544 	SCTP_LINK(sctp, sctps);
1545 
1546 	return (sctp);
1547 }
1548 
1549 /*
1550  * Make sure we wait until the default queue is setup, yet allow
1551  * sctp_g_q_create() to open a SCTP stream.
1552  * We need to allow sctp_g_q_create() do do an open
1553  * of sctp, hence we compare curhread.
1554  * All others have to wait until the sctps_g_q has been
1555  * setup.
1556  */
1557 void
1558 sctp_g_q_setup(sctp_stack_t *sctps)
1559 {
1560 	mutex_enter(&sctps->sctps_g_q_lock);
1561 	if (sctps->sctps_g_q != NULL) {
1562 		mutex_exit(&sctps->sctps_g_q_lock);
1563 		return;
1564 	}
1565 	if (sctps->sctps_g_q_creator == NULL) {
1566 		/* This thread will set it up */
1567 		sctps->sctps_g_q_creator = curthread;
1568 		mutex_exit(&sctps->sctps_g_q_lock);
1569 		sctp_g_q_create(sctps);
1570 		mutex_enter(&sctps->sctps_g_q_lock);
1571 		ASSERT(sctps->sctps_g_q_creator == curthread);
1572 		sctps->sctps_g_q_creator = NULL;
1573 		cv_signal(&sctps->sctps_g_q_cv);
1574 		ASSERT(sctps->sctps_g_q != NULL);
1575 		mutex_exit(&sctps->sctps_g_q_lock);
1576 		return;
1577 	}
1578 	/* Everybody but the creator has to wait */
1579 	if (sctps->sctps_g_q_creator != curthread) {
1580 		while (sctps->sctps_g_q == NULL)
1581 			cv_wait(&sctps->sctps_g_q_cv, &sctps->sctps_g_q_lock);
1582 	}
1583 	mutex_exit(&sctps->sctps_g_q_lock);
1584 }
1585 
1586 #define	IP	"ip"
1587 
1588 #define	SCTP6DEV		"/devices/pseudo/sctp6@0:sctp6"
1589 
1590 /*
1591  * Create a default sctp queue here instead of in strplumb
1592  */
1593 void
1594 sctp_g_q_create(sctp_stack_t *sctps)
1595 {
1596 	int error;
1597 	ldi_handle_t	lh = NULL;
1598 	ldi_ident_t	li = NULL;
1599 	int		rval;
1600 	cred_t		*cr;
1601 	major_t IP_MAJ;
1602 
1603 #ifdef NS_DEBUG
1604 	(void) printf("sctp_g_q_create()for stack %d\n",
1605 	    sctps->sctps_netstack->netstack_stackid);
1606 #endif
1607 
1608 	IP_MAJ = ddi_name_to_major(IP);
1609 
1610 	ASSERT(sctps->sctps_g_q_creator == curthread);
1611 
1612 	error = ldi_ident_from_major(IP_MAJ, &li);
1613 	if (error) {
1614 #ifdef DEBUG
1615 		printf("sctp_g_q_create: lyr ident get failed error %d\n",
1616 		    error);
1617 #endif
1618 		return;
1619 	}
1620 
1621 	cr = zone_get_kcred(netstackid_to_zoneid(
1622 	    sctps->sctps_netstack->netstack_stackid));
1623 	ASSERT(cr != NULL);
1624 	/*
1625 	 * We set the sctp default queue to IPv6 because IPv4 falls
1626 	 * back to IPv6 when it can't find a client, but
1627 	 * IPv6 does not fall back to IPv4.
1628 	 */
1629 	error = ldi_open_by_name(SCTP6DEV, FREAD|FWRITE, cr, &lh, li);
1630 	if (error) {
1631 #ifdef DEBUG
1632 		printf("sctp_g_q_create: open of SCTP6DEV failed error %d\n",
1633 		    error);
1634 #endif
1635 		goto out;
1636 	}
1637 
1638 	/*
1639 	 * This ioctl causes the sctp framework to cache a pointer to
1640 	 * this stream, so we don't want to close the stream after
1641 	 * this operation.
1642 	 * Use the kernel credentials that are for the zone we're in.
1643 	 */
1644 	error = ldi_ioctl(lh, SCTP_IOC_DEFAULT_Q,
1645 	    (intptr_t)0, FKIOCTL, cr, &rval);
1646 	if (error) {
1647 #ifdef DEBUG
1648 		printf("sctp_g_q_create: ioctl SCTP_IOC_DEFAULT_Q failed "
1649 		    "error %d\n", error);
1650 #endif
1651 		goto out;
1652 	}
1653 	sctps->sctps_g_q_lh = lh;	/* For sctp_g_q_inactive */
1654 	lh = NULL;
1655 out:
1656 	/* Close layered handles */
1657 	if (li)
1658 		ldi_ident_release(li);
1659 	/* Keep cred around until _inactive needs it */
1660 	sctps->sctps_g_q_cr = cr;
1661 }
1662 
1663 /*
1664  * Remove the sctp_default queue so that new connections will not find it.
1665  * SCTP uses sctp_g_q for all transmission, so all sctp'ts implicitly
1666  * refer to it. Hence have each one have a reference on sctp_g_q_ref!
1667  *
1668  * We decrement the refcnt added in sctp_g_q_create. Once all the
1669  * sctp_t's which use the default go away, sctp_g_q_close will be called
1670  * and close the sctp_g_q. Once sctp_g_q is closed, sctp_close() will drop the
1671  * last reference count on the stack by calling netstack_rele().
1672  */
1673 void
1674 sctp_g_q_destroy(sctp_stack_t *sctps)
1675 {
1676 	if (sctps->sctps_g_q == NULL) {
1677 		return;	/* Nothing to cleanup */
1678 	}
1679 	/*
1680 	 * Keep sctps_g_q and sctps_gsctp until the last reference has
1681 	 * dropped, since the output is always done using those.
1682 	 * Need to decrement twice to take sctp_g_q_create and
1683 	 * the gsctp reference into account so that sctp_g_q_inactive is called
1684 	 * when all but the default queue remains.
1685 	 */
1686 #ifdef NS_DEBUG
1687 	(void) printf("sctp_g_q_destroy: ref %d\n",
1688 	    sctps->sctps_g_q_ref);
1689 #endif
1690 	SCTP_G_Q_REFRELE(sctps);
1691 }
1692 
1693 /*
1694  * Called when last user (could be sctp_g_q_destroy) drops reference count
1695  * using SCTP_G_Q_REFRELE.
1696  * Run by sctp_q_q_inactive using a taskq.
1697  */
1698 static void
1699 sctp_g_q_close(void *arg)
1700 {
1701 	sctp_stack_t *sctps = arg;
1702 	int error;
1703 	ldi_handle_t	lh = NULL;
1704 	ldi_ident_t	li = NULL;
1705 	cred_t		*cr;
1706 	major_t IP_MAJ;
1707 
1708 	IP_MAJ = ddi_name_to_major(IP);
1709 
1710 	lh = sctps->sctps_g_q_lh;
1711 	if (lh == NULL)
1712 		return;	/* Nothing to cleanup */
1713 
1714 	error = ldi_ident_from_major(IP_MAJ, &li);
1715 	if (error) {
1716 #ifdef NS_DEBUG
1717 		printf("sctp_g_q_inactive: lyr ident get failed error %d\n",
1718 		    error);
1719 #endif
1720 		return;
1721 	}
1722 
1723 	cr = sctps->sctps_g_q_cr;
1724 	sctps->sctps_g_q_cr = NULL;
1725 	ASSERT(cr != NULL);
1726 
1727 	/*
1728 	 * Make sure we can break the recursion when sctp_close decrements
1729 	 * the reference count causing g_q_inactive to be called again.
1730 	 */
1731 	sctps->sctps_g_q_lh = NULL;
1732 
1733 	/* close the default queue */
1734 	(void) ldi_close(lh, FREAD|FWRITE, cr);
1735 
1736 	/* Close layered handles */
1737 	ldi_ident_release(li);
1738 	crfree(cr);
1739 
1740 	ASSERT(sctps->sctps_g_q != NULL);
1741 	sctps->sctps_g_q = NULL;
1742 	/*
1743 	 * Now free sctps_gsctp.
1744 	 */
1745 	ASSERT(sctps->sctps_gsctp != NULL);
1746 	sctp_closei_local(sctps->sctps_gsctp);
1747 	SCTP_CONDEMNED(sctps->sctps_gsctp);
1748 	SCTP_REFRELE(sctps->sctps_gsctp);
1749 	sctps->sctps_gsctp = NULL;
1750 }
1751 
1752 /*
1753  * Called when last sctp_t drops reference count using SCTP_G_Q_REFRELE.
1754  *
1755  * Have to ensure that the ldi routines are not used by an
1756  * interrupt thread by using a taskq.
1757  */
1758 void
1759 sctp_g_q_inactive(sctp_stack_t *sctps)
1760 {
1761 	if (sctps->sctps_g_q_lh == NULL)
1762 		return;	/* Nothing to cleanup */
1763 
1764 	ASSERT(sctps->sctps_g_q_ref == 0);
1765 	SCTP_G_Q_REFHOLD(sctps); /* Compensate for what g_q_destroy did */
1766 
1767 	if (servicing_interrupt()) {
1768 		(void) taskq_dispatch(sctp_taskq, sctp_g_q_close,
1769 		    (void *) sctps, TQ_SLEEP);
1770 	} else {
1771 		sctp_g_q_close(sctps);
1772 	}
1773 }
1774 
1775 /* Run at module load time */
1776 void
1777 sctp_ddi_g_init(void)
1778 {
1779 	/* Create sctp_t/conn_t cache */
1780 	sctp_conn_cache_init();
1781 
1782 	/* Create the faddr cache */
1783 	sctp_faddr_init();
1784 
1785 	/* Create the sets cache */
1786 	sctp_sets_init();
1787 
1788 	/* Create the PR-SCTP sets cache */
1789 	sctp_ftsn_sets_init();
1790 
1791 	/* Initialize tables used for CRC calculation */
1792 	sctp_crc32_init();
1793 
1794 	sctp_taskq = taskq_create("sctp_taskq", 1, minclsyspri, 1, 1,
1795 	    TASKQ_PREPOPULATE);
1796 
1797 	/*
1798 	 * We want to be informed each time a stack is created or
1799 	 * destroyed in the kernel, so we can maintain the
1800 	 * set of sctp_stack_t's.
1801 	 */
1802 	netstack_register(NS_SCTP, sctp_stack_init, sctp_stack_shutdown,
1803 	    sctp_stack_fini);
1804 }
1805 
1806 static void *
1807 sctp_stack_init(netstackid_t stackid, netstack_t *ns)
1808 {
1809 	sctp_stack_t	*sctps;
1810 
1811 	sctps = kmem_zalloc(sizeof (*sctps), KM_SLEEP);
1812 	sctps->sctps_netstack = ns;
1813 
1814 	/* Initialize locks */
1815 	mutex_init(&sctps->sctps_g_q_lock, NULL, MUTEX_DEFAULT, NULL);
1816 	cv_init(&sctps->sctps_g_q_cv, NULL, CV_DEFAULT, NULL);
1817 	mutex_init(&sctps->sctps_g_lock, NULL, MUTEX_DEFAULT, NULL);
1818 	mutex_init(&sctps->sctps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
1819 	sctps->sctps_g_num_epriv_ports = SCTP_NUM_EPRIV_PORTS;
1820 	sctps->sctps_g_epriv_ports[0] = 2049;
1821 	sctps->sctps_g_epriv_ports[1] = 4045;
1822 
1823 	/* Initialize SCTP hash arrays. */
1824 	sctp_hash_init(sctps);
1825 
1826 	if (!sctp_nd_init(sctps)) {
1827 		sctp_nd_free(sctps);
1828 	}
1829 
1830 	/* Initialize the recvq taskq. */
1831 	sctp_rq_tq_init(sctps);
1832 
1833 	/* saddr init */
1834 	sctp_saddr_init(sctps);
1835 
1836 	/* Global SCTP PCB list. */
1837 	list_create(&sctps->sctps_g_list, sizeof (sctp_t),
1838 	    offsetof(sctp_t, sctp_list));
1839 
1840 	/* Initialize sctp kernel stats. */
1841 	sctps->sctps_mibkp = sctp_kstat_init(stackid);
1842 	sctps->sctps_kstat =
1843 	    sctp_kstat2_init(stackid, &sctps->sctps_statistics);
1844 
1845 	return (sctps);
1846 }
1847 
1848 /*
1849  * Called when the module is about to be unloaded.
1850  */
1851 void
1852 sctp_ddi_g_destroy(void)
1853 {
1854 	/* Destroy sctp_t/conn_t caches */
1855 	sctp_conn_cache_fini();
1856 
1857 	/* Destroy the faddr cache */
1858 	sctp_faddr_fini();
1859 
1860 	/* Destroy the sets cache */
1861 	sctp_sets_fini();
1862 
1863 	/* Destroy the PR-SCTP sets cache */
1864 	sctp_ftsn_sets_fini();
1865 
1866 	netstack_unregister(NS_SCTP);
1867 	taskq_destroy(sctp_taskq);
1868 }
1869 
1870 /*
1871  * Shut down the SCTP stack instance.
1872  */
1873 /* ARGSUSED */
1874 static void
1875 sctp_stack_shutdown(netstackid_t stackid, void *arg)
1876 {
1877 	sctp_stack_t *sctps = (sctp_stack_t *)arg;
1878 
1879 	sctp_g_q_destroy(sctps);
1880 }
1881 
1882 /*
1883  * Free the SCTP stack instance.
1884  */
1885 static void
1886 sctp_stack_fini(netstackid_t stackid, void *arg)
1887 {
1888 	sctp_stack_t *sctps = (sctp_stack_t *)arg;
1889 
1890 	sctp_nd_free(sctps);
1891 
1892 	/* Destroy the recvq taskqs. */
1893 	sctp_rq_tq_fini(sctps);
1894 
1895 	/* Destroy saddr  */
1896 	sctp_saddr_fini(sctps);
1897 
1898 	/* Global SCTP PCB list. */
1899 	list_destroy(&sctps->sctps_g_list);
1900 
1901 	/* Destroy SCTP hash arrays. */
1902 	sctp_hash_destroy(sctps);
1903 
1904 	/* Destroy SCTP kernel stats. */
1905 	sctp_kstat2_fini(stackid, sctps->sctps_kstat);
1906 	sctps->sctps_kstat = NULL;
1907 	bzero(&sctps->sctps_statistics, sizeof (sctps->sctps_statistics));
1908 
1909 	sctp_kstat_fini(stackid, sctps->sctps_mibkp);
1910 	sctps->sctps_mibkp = NULL;
1911 
1912 	mutex_destroy(&sctps->sctps_g_lock);
1913 	mutex_destroy(&sctps->sctps_epriv_port_lock);
1914 	mutex_destroy(&sctps->sctps_g_q_lock);
1915 	cv_destroy(&sctps->sctps_g_q_cv);
1916 
1917 	kmem_free(sctps, sizeof (*sctps));
1918 }
1919 
1920 void
1921 sctp_display_all(sctp_stack_t *sctps)
1922 {
1923 	sctp_t *sctp_walker;
1924 
1925 	mutex_enter(&sctps->sctps_g_lock);
1926 	for (sctp_walker = sctps->sctps_gsctp; sctp_walker != NULL;
1927 	    sctp_walker = (sctp_t *)list_next(&sctps->sctps_g_list,
1928 	    sctp_walker)) {
1929 		(void) sctp_display(sctp_walker, NULL);
1930 	}
1931 	mutex_exit(&sctps->sctps_g_lock);
1932 }
1933 
1934 static void
1935 sctp_rq_tq_init(sctp_stack_t *sctps)
1936 {
1937 	sctps->sctps_recvq_tq_list_max_sz = 16;
1938 	sctps->sctps_recvq_tq_list_cur_sz = 1;
1939 	/*
1940 	 * Initialize the recvq_tq_list and create the first recvq taskq.
1941 	 * What to do if it fails?
1942 	 */
1943 	sctps->sctps_recvq_tq_list =
1944 	    kmem_zalloc(sctps->sctps_recvq_tq_list_max_sz * sizeof (taskq_t *),
1945 	    KM_SLEEP);
1946 	sctps->sctps_recvq_tq_list[0] = taskq_create("sctp_def_recvq_taskq",
1947 	    MIN(sctp_recvq_tq_thr_max, MAX(sctp_recvq_tq_thr_min, ncpus)),
1948 	    minclsyspri, sctp_recvq_tq_task_min, sctp_recvq_tq_task_max,
1949 	    TASKQ_PREPOPULATE);
1950 	mutex_init(&sctps->sctps_rq_tq_lock, NULL, MUTEX_DEFAULT, NULL);
1951 }
1952 
1953 static void
1954 sctp_rq_tq_fini(sctp_stack_t *sctps)
1955 {
1956 	int i;
1957 
1958 	for (i = 0; i < sctps->sctps_recvq_tq_list_cur_sz; i++) {
1959 		ASSERT(sctps->sctps_recvq_tq_list[i] != NULL);
1960 		taskq_destroy(sctps->sctps_recvq_tq_list[i]);
1961 	}
1962 	kmem_free(sctps->sctps_recvq_tq_list,
1963 	    sctps->sctps_recvq_tq_list_max_sz * sizeof (taskq_t *));
1964 	sctps->sctps_recvq_tq_list = NULL;
1965 }
1966 
1967 /* Add another taskq for a new ill. */
1968 void
1969 sctp_inc_taskq(sctp_stack_t *sctps)
1970 {
1971 	taskq_t *tq;
1972 	char tq_name[TASKQ_NAMELEN];
1973 
1974 	mutex_enter(&sctps->sctps_rq_tq_lock);
1975 	if (sctps->sctps_recvq_tq_list_cur_sz + 1 >
1976 	    sctps->sctps_recvq_tq_list_max_sz) {
1977 		mutex_exit(&sctps->sctps_rq_tq_lock);
1978 		cmn_err(CE_NOTE, "Cannot create more SCTP recvq taskq");
1979 		return;
1980 	}
1981 
1982 	(void) snprintf(tq_name, sizeof (tq_name), "sctp_recvq_taskq_%u",
1983 	    sctps->sctps_recvq_tq_list_cur_sz);
1984 	tq = taskq_create(tq_name,
1985 	    MIN(sctp_recvq_tq_thr_max, MAX(sctp_recvq_tq_thr_min, ncpus)),
1986 	    minclsyspri, sctp_recvq_tq_task_min, sctp_recvq_tq_task_max,
1987 	    TASKQ_PREPOPULATE);
1988 	if (tq == NULL) {
1989 		mutex_exit(&sctps->sctps_rq_tq_lock);
1990 		cmn_err(CE_NOTE, "SCTP recvq taskq creation failed");
1991 		return;
1992 	}
1993 	ASSERT(sctps->sctps_recvq_tq_list[
1994 	    sctps->sctps_recvq_tq_list_cur_sz] == NULL);
1995 	sctps->sctps_recvq_tq_list[sctps->sctps_recvq_tq_list_cur_sz] = tq;
1996 	atomic_add_32(&sctps->sctps_recvq_tq_list_cur_sz, 1);
1997 	mutex_exit(&sctps->sctps_rq_tq_lock);
1998 }
1999 
2000 #ifdef DEBUG
2001 uint32_t sendq_loop_cnt = 0;
2002 uint32_t sendq_collision = 0;
2003 uint32_t sendq_empty = 0;
2004 #endif
2005 
2006 void
2007 sctp_add_sendq(sctp_t *sctp, mblk_t *mp)
2008 {
2009 	mutex_enter(&sctp->sctp_sendq_lock);
2010 	if (sctp->sctp_sendq == NULL) {
2011 		sctp->sctp_sendq = mp;
2012 		sctp->sctp_sendq_tail = mp;
2013 	} else {
2014 		sctp->sctp_sendq_tail->b_next = mp;
2015 		sctp->sctp_sendq_tail = mp;
2016 	}
2017 	mutex_exit(&sctp->sctp_sendq_lock);
2018 }
2019 
2020 void
2021 sctp_process_sendq(sctp_t *sctp)
2022 {
2023 	mblk_t *mp;
2024 #ifdef DEBUG
2025 	uint32_t loop_cnt = 0;
2026 #endif
2027 
2028 	mutex_enter(&sctp->sctp_sendq_lock);
2029 	if (sctp->sctp_sendq == NULL || sctp->sctp_sendq_sending) {
2030 #ifdef DEBUG
2031 		if (sctp->sctp_sendq == NULL)
2032 			sendq_empty++;
2033 		else
2034 			sendq_collision++;
2035 #endif
2036 		mutex_exit(&sctp->sctp_sendq_lock);
2037 		return;
2038 	}
2039 	sctp->sctp_sendq_sending = B_TRUE;
2040 
2041 	/*
2042 	 * Note that while we are in this loop, other thread can put
2043 	 * new packets in the receive queue.  We may be looping for
2044 	 * quite a while.  This is OK even for an interrupt thread.
2045 	 * The reason is that SCTP should only able to send a limited
2046 	 * number of packets out in a burst.  So the number of times
2047 	 * we go through this loop should not be many.
2048 	 */
2049 	while ((mp = sctp->sctp_sendq) != NULL) {
2050 		sctp->sctp_sendq = mp->b_next;
2051 		ASSERT(sctp->sctp_connp->conn_ref > 0);
2052 		mutex_exit(&sctp->sctp_sendq_lock);
2053 		mp->b_next = NULL;
2054 		CONN_INC_REF(sctp->sctp_connp);
2055 		mp->b_flag |= MSGHASREF;
2056 		/* If we don't have sctp_current, default to IPv4 */
2057 		IP_PUT(mp, sctp->sctp_connp, sctp->sctp_current == NULL ?
2058 		    B_TRUE : sctp->sctp_current->isv4);
2059 		BUMP_LOCAL(sctp->sctp_opkts);
2060 #ifdef DEBUG
2061 		loop_cnt++;
2062 #endif
2063 		mutex_enter(&sctp->sctp_sendq_lock);
2064 	}
2065 
2066 	sctp->sctp_sendq_tail = NULL;
2067 	sctp->sctp_sendq_sending = B_FALSE;
2068 #ifdef DEBUG
2069 	if (loop_cnt > sendq_loop_cnt)
2070 		sendq_loop_cnt = loop_cnt;
2071 #endif
2072 	mutex_exit(&sctp->sctp_sendq_lock);
2073 }
2074 
2075 #ifdef DEBUG
2076 uint32_t recvq_loop_cnt = 0;
2077 uint32_t recvq_call = 0;
2078 #endif
2079 
2080 /*
2081  * Find the next recvq_tq to use.  This routine will go thru all the
2082  * taskqs until it can dispatch a job for the sctp.  If this fails,
2083  * it will create a new taskq and try it.
2084  */
2085 static boolean_t
2086 sctp_find_next_tq(sctp_t *sctp)
2087 {
2088 	int next_tq, try;
2089 	taskq_t *tq;
2090 	sctp_stack_t	*sctps = sctp->sctp_sctps;
2091 
2092 	/*
2093 	 * Note that since we don't hold a lock on sctp_rq_tq_lock for
2094 	 * performance reason, recvq_ta_list_cur_sz can be changed during
2095 	 * this loop.  The problem this will create is that the loop may
2096 	 * not have tried all the recvq_tq.  This should be OK.
2097 	 */
2098 	next_tq = atomic_add_32_nv(&sctps->sctps_recvq_tq_list_cur, 1) %
2099 	    sctps->sctps_recvq_tq_list_cur_sz;
2100 	for (try = 0; try < sctps->sctps_recvq_tq_list_cur_sz; try++) {
2101 		tq = sctps->sctps_recvq_tq_list[next_tq];
2102 		if (taskq_dispatch(tq, sctp_process_recvq, sctp,
2103 		    TQ_NOSLEEP) != NULL) {
2104 			sctp->sctp_recvq_tq = tq;
2105 			return (B_TRUE);
2106 		}
2107 		next_tq = (next_tq + 1) % sctps->sctps_recvq_tq_list_cur_sz;
2108 	}
2109 
2110 	/*
2111 	 * Create one more taskq and try it.  Note that sctp_inc_taskq()
2112 	 * may not have created another taskq if the number of recvq
2113 	 * taskqs is at the maximum.  We are probably in a pretty bad
2114 	 * shape if this actually happens...
2115 	 */
2116 	sctp_inc_taskq(sctps);
2117 	tq = sctps->sctps_recvq_tq_list[sctps->sctps_recvq_tq_list_cur_sz - 1];
2118 	if (taskq_dispatch(tq, sctp_process_recvq, sctp, TQ_NOSLEEP) != NULL) {
2119 		sctp->sctp_recvq_tq = tq;
2120 		return (B_TRUE);
2121 	}
2122 	SCTP_KSTAT(sctps, sctp_find_next_tq);
2123 	return (B_FALSE);
2124 }
2125 
2126 /*
2127  * To add a message to the recvq.  Note that the sctp_timer_fire()
2128  * routine also uses this function to add the timer message to the
2129  * receive queue for later processing.  And it should be the only
2130  * caller of sctp_add_recvq() which sets the try_harder argument
2131  * to B_TRUE.
2132  *
2133  * If the try_harder argument is B_TRUE, this routine sctp_find_next_tq()
2134  * will try very hard to dispatch the task.  Refer to the comment
2135  * for that routine on how it does that.
2136  */
2137 boolean_t
2138 sctp_add_recvq(sctp_t *sctp, mblk_t *mp, boolean_t caller_hold_lock)
2139 {
2140 	if (!caller_hold_lock)
2141 		mutex_enter(&sctp->sctp_recvq_lock);
2142 
2143 	/* If the taskq dispatch has not been scheduled, do it now. */
2144 	if (sctp->sctp_recvq_tq == NULL) {
2145 		ASSERT(sctp->sctp_recvq == NULL);
2146 		if (!sctp_find_next_tq(sctp)) {
2147 			if (!caller_hold_lock)
2148 				mutex_exit(&sctp->sctp_recvq_lock);
2149 			return (B_FALSE);
2150 		}
2151 		/* Make sure the sctp_t will not go away. */
2152 		SCTP_REFHOLD(sctp);
2153 	}
2154 
2155 	if (sctp->sctp_recvq == NULL) {
2156 		sctp->sctp_recvq = mp;
2157 		sctp->sctp_recvq_tail = mp;
2158 	} else {
2159 		sctp->sctp_recvq_tail->b_next = mp;
2160 		sctp->sctp_recvq_tail = mp;
2161 	}
2162 
2163 	if (!caller_hold_lock)
2164 		mutex_exit(&sctp->sctp_recvq_lock);
2165 	return (B_TRUE);
2166 }
2167 
2168 static void
2169 sctp_process_recvq(void *arg)
2170 {
2171 	sctp_t		*sctp = (sctp_t *)arg;
2172 	mblk_t		*mp;
2173 	mblk_t		*ipsec_mp;
2174 #ifdef DEBUG
2175 	uint32_t	loop_cnt = 0;
2176 #endif
2177 
2178 #ifdef	_BIG_ENDIAN
2179 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 28) & 0x7)
2180 #else
2181 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 4) & 0x7)
2182 #endif
2183 
2184 	RUN_SCTP(sctp);
2185 	mutex_enter(&sctp->sctp_recvq_lock);
2186 
2187 #ifdef DEBUG
2188 	recvq_call++;
2189 #endif
2190 	/*
2191 	 * Note that while we are in this loop, other thread can put
2192 	 * new packets in the receive queue.  We may be looping for
2193 	 * quite a while.
2194 	 */
2195 	while ((mp = sctp->sctp_recvq) != NULL) {
2196 		sctp->sctp_recvq = mp->b_next;
2197 		mutex_exit(&sctp->sctp_recvq_lock);
2198 		mp->b_next = NULL;
2199 #ifdef DEBUG
2200 		loop_cnt++;
2201 #endif
2202 		ipsec_mp = mp->b_prev;
2203 		mp->b_prev = NULL;
2204 		sctp_input_data(sctp, mp, ipsec_mp);
2205 
2206 		mutex_enter(&sctp->sctp_recvq_lock);
2207 	}
2208 
2209 	sctp->sctp_recvq_tail = NULL;
2210 	sctp->sctp_recvq_tq = NULL;
2211 
2212 	mutex_exit(&sctp->sctp_recvq_lock);
2213 
2214 	WAKE_SCTP(sctp);
2215 
2216 	/* We may have sent something when processing the receive queue. */
2217 	sctp_process_sendq(sctp);
2218 #ifdef DEBUG
2219 	if (loop_cnt > recvq_loop_cnt)
2220 		recvq_loop_cnt = loop_cnt;
2221 #endif
2222 	/* Now it can go away. */
2223 	SCTP_REFRELE(sctp);
2224 }
2225 
2226 /* ARGSUSED */
2227 static int
2228 sctp_conn_cache_constructor(void *buf, void *cdrarg, int kmflags)
2229 {
2230 	conn_t	*sctp_connp = (conn_t *)buf;
2231 	sctp_t	*sctp = (sctp_t *)&sctp_connp[1];
2232 
2233 	bzero(buf, (char *)&sctp[1] - (char *)buf);
2234 
2235 	sctp->sctp_connp = sctp_connp;
2236 	mutex_init(&sctp->sctp_reflock, NULL, MUTEX_DEFAULT, NULL);
2237 	mutex_init(&sctp->sctp_lock, NULL, MUTEX_DEFAULT, NULL);
2238 	mutex_init(&sctp->sctp_recvq_lock, NULL, MUTEX_DEFAULT, NULL);
2239 	cv_init(&sctp->sctp_cv, NULL, CV_DEFAULT, NULL);
2240 	mutex_init(&sctp->sctp_sendq_lock, NULL, MUTEX_DEFAULT, NULL);
2241 
2242 	return (0);
2243 }
2244 
2245 /* ARGSUSED */
2246 static void
2247 sctp_conn_cache_destructor(void *buf, void *cdrarg)
2248 {
2249 	conn_t	*sctp_connp = (conn_t *)buf;
2250 	sctp_t	*sctp = (sctp_t *)&sctp_connp[1];
2251 
2252 	ASSERT(!MUTEX_HELD(&sctp->sctp_lock));
2253 	ASSERT(!MUTEX_HELD(&sctp->sctp_reflock));
2254 	ASSERT(!MUTEX_HELD(&sctp->sctp_recvq_lock));
2255 	ASSERT(!MUTEX_HELD(&sctp->sctp_sendq_lock));
2256 	ASSERT(!MUTEX_HELD(&sctp->sctp_connp->conn_lock));
2257 
2258 	ASSERT(sctp->sctp_conn_hash_next == NULL);
2259 	ASSERT(sctp->sctp_conn_hash_prev == NULL);
2260 	ASSERT(sctp->sctp_listen_hash_next == NULL);
2261 	ASSERT(sctp->sctp_listen_hash_prev == NULL);
2262 	ASSERT(sctp->sctp_listen_tfp == NULL);
2263 	ASSERT(sctp->sctp_conn_tfp == NULL);
2264 
2265 	ASSERT(sctp->sctp_faddrs == NULL);
2266 	ASSERT(sctp->sctp_nsaddrs == 0);
2267 
2268 	ASSERT(sctp->sctp_ulpd == NULL);
2269 
2270 	ASSERT(sctp->sctp_lastfaddr == NULL);
2271 	ASSERT(sctp->sctp_primary == NULL);
2272 	ASSERT(sctp->sctp_current == NULL);
2273 	ASSERT(sctp->sctp_lastdata == NULL);
2274 
2275 	ASSERT(sctp->sctp_xmit_head == NULL);
2276 	ASSERT(sctp->sctp_xmit_tail == NULL);
2277 	ASSERT(sctp->sctp_xmit_unsent == NULL);
2278 	ASSERT(sctp->sctp_xmit_unsent_tail == NULL);
2279 
2280 	ASSERT(sctp->sctp_ostrcntrs == NULL);
2281 
2282 	ASSERT(sctp->sctp_sack_info == NULL);
2283 	ASSERT(sctp->sctp_ack_mp == NULL);
2284 	ASSERT(sctp->sctp_instr == NULL);
2285 
2286 	ASSERT(sctp->sctp_iphc == NULL);
2287 	ASSERT(sctp->sctp_iphc6 == NULL);
2288 	ASSERT(sctp->sctp_ipha == NULL);
2289 	ASSERT(sctp->sctp_ip6h == NULL);
2290 	ASSERT(sctp->sctp_sctph == NULL);
2291 	ASSERT(sctp->sctp_sctph6 == NULL);
2292 
2293 	ASSERT(sctp->sctp_cookie_mp == NULL);
2294 
2295 	ASSERT(sctp->sctp_refcnt == 0);
2296 	ASSERT(sctp->sctp_timer_mp == NULL);
2297 	ASSERT(sctp->sctp_connp->conn_ref == 0);
2298 	ASSERT(sctp->sctp_heartbeat_mp == NULL);
2299 	ASSERT(sctp->sctp_ptpbhn == NULL && sctp->sctp_bind_hash == NULL);
2300 
2301 	ASSERT(sctp->sctp_shutdown_faddr == NULL);
2302 
2303 	ASSERT(sctp->sctp_cxmit_list == NULL);
2304 
2305 	ASSERT(sctp->sctp_recvq == NULL);
2306 	ASSERT(sctp->sctp_recvq_tail == NULL);
2307 	ASSERT(sctp->sctp_recvq_tq == NULL);
2308 
2309 	ASSERT(sctp->sctp_sendq == NULL);
2310 	ASSERT(sctp->sctp_sendq_tail == NULL);
2311 	ASSERT(sctp->sctp_sendq_sending == B_FALSE);
2312 
2313 	ASSERT(sctp->sctp_ipp_hopopts == NULL);
2314 	ASSERT(sctp->sctp_ipp_rtdstopts == NULL);
2315 	ASSERT(sctp->sctp_ipp_rthdr == NULL);
2316 	ASSERT(sctp->sctp_ipp_dstopts == NULL);
2317 	ASSERT(sctp->sctp_ipp_pathmtu == NULL);
2318 
2319 	/*
2320 	 * sctp_pad_mp can be NULL if the memory allocation fails
2321 	 * in sctp_init_values() and the conn_t is freed.
2322 	 */
2323 	if (sctp->sctp_pad_mp != NULL) {
2324 		freeb(sctp->sctp_pad_mp);
2325 		sctp->sctp_pad_mp = NULL;
2326 	}
2327 
2328 	mutex_destroy(&sctp->sctp_reflock);
2329 	mutex_destroy(&sctp->sctp_lock);
2330 	mutex_destroy(&sctp->sctp_recvq_lock);
2331 	cv_destroy(&sctp->sctp_cv);
2332 	mutex_destroy(&sctp->sctp_sendq_lock);
2333 
2334 }
2335 
2336 static void
2337 sctp_conn_cache_init()
2338 {
2339 	sctp_conn_cache = kmem_cache_create("sctp_conn_cache",
2340 	    sizeof (sctp_t) + sizeof (conn_t), 0, sctp_conn_cache_constructor,
2341 	    sctp_conn_cache_destructor, NULL, NULL, NULL, 0);
2342 }
2343 
2344 static void
2345 sctp_conn_cache_fini()
2346 {
2347 	kmem_cache_destroy(sctp_conn_cache);
2348 }
2349 
2350 void
2351 sctp_conn_init(conn_t *connp)
2352 {
2353 	connp->conn_flags = IPCL_SCTPCONN;
2354 	connp->conn_rq = connp->conn_wq = NULL;
2355 	connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
2356 	connp->conn_ulp = IPPROTO_SCTP;
2357 	connp->conn_state_flags |= CONN_INCIPIENT;
2358 	mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
2359 	cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);
2360 }
2361 
2362 static void
2363 sctp_conn_clear(conn_t *connp)
2364 {
2365 	/* Clean up conn_t stuff */
2366 	if (connp->conn_latch != NULL)
2367 		IPLATCH_REFRELE(connp->conn_latch, connp->conn_netstack);
2368 	if (connp->conn_policy != NULL)
2369 		IPPH_REFRELE(connp->conn_policy, connp->conn_netstack);
2370 	if (connp->conn_ipsec_opt_mp != NULL)
2371 		freemsg(connp->conn_ipsec_opt_mp);
2372 	if (connp->conn_cred != NULL)
2373 		crfree(connp->conn_cred);
2374 	if (connp->conn_effective_cred != NULL)
2375 		crfree(connp->conn_effective_cred);
2376 	mutex_destroy(&connp->conn_lock);
2377 	cv_destroy(&connp->conn_cv);
2378 	netstack_rele(connp->conn_netstack);
2379 	bzero(connp, sizeof (struct conn_s));
2380 }
2381