xref: /titanic_44/usr/src/uts/common/inet/sctp/sctp.c (revision 3d0479833b8db89da4bca3e8e8e88f996686aa8e)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/strsubr.h>
32 #include <sys/stropts.h>
33 #include <sys/strsun.h>
34 #define	_SUN_TPI_VERSION 2
35 #include <sys/tihdr.h>
36 #include <sys/ddi.h>
37 #include <sys/sunddi.h>
38 #include <sys/xti_inet.h>
39 #include <sys/cmn_err.h>
40 #include <sys/debug.h>
41 #include <sys/vtrace.h>
42 #include <sys/kmem.h>
43 #include <sys/cpuvar.h>
44 #include <sys/random.h>
45 #include <sys/priv.h>
46 #include <sys/sunldi.h>
47 
48 #include <sys/errno.h>
49 #include <sys/signal.h>
50 #include <sys/socket.h>
51 #include <sys/isa_defs.h>
52 #include <netinet/in.h>
53 #include <netinet/tcp.h>
54 #include <netinet/ip6.h>
55 #include <netinet/icmp6.h>
56 #include <netinet/sctp.h>
57 #include <net/if.h>
58 
59 #include <inet/common.h>
60 #include <inet/ip.h>
61 #include <inet/ip6.h>
62 #include <inet/mi.h>
63 #include <inet/mib2.h>
64 #include <inet/kstatcom.h>
65 #include <inet/nd.h>
66 #include <inet/optcom.h>
67 #include <inet/ipclassifier.h>
68 #include <inet/ipsec_impl.h>
69 #include <inet/sctp_ip.h>
70 #include <inet/sctp_crc32.h>
71 
72 #include "sctp_impl.h"
73 #include "sctp_addr.h"
74 #include "sctp_asconf.h"
75 
76 extern major_t SCTP6_MAJ;
77 extern major_t SCTP_MAJ;
78 
79 int sctpdebug;
80 sin6_t	sctp_sin6_null;	/* Zero address for quick clears */
81 
82 /*
83  * Have to ensure that sctp_g_q_close is not done by an
84  * interrupt thread.
85  */
86 static taskq_t *sctp_taskq;
87 
88 static void	sctp_closei_local(sctp_t *sctp);
89 static int	sctp_init_values(sctp_t *, sctp_t *, int);
90 static void	sctp_icmp_error_ipv6(sctp_t *sctp, mblk_t *mp);
91 static void	sctp_process_recvq(void *);
92 static void	sctp_rq_tq_init(sctp_stack_t *);
93 static void	sctp_rq_tq_fini(sctp_stack_t *);
94 static void	sctp_conn_cache_init();
95 static void	sctp_conn_cache_fini();
96 static int	sctp_conn_cache_constructor();
97 static void	sctp_conn_cache_destructor();
98 static void	sctp_conn_clear(conn_t *);
99 void		sctp_g_q_setup(sctp_stack_t *);
100 void		sctp_g_q_create(sctp_stack_t *);
101 void		sctp_g_q_destroy(sctp_stack_t *);
102 
103 static void	*sctp_stack_init(netstackid_t stackid, netstack_t *ns);
104 static void	sctp_stack_shutdown(netstackid_t stackid, void *arg);
105 static void	sctp_stack_fini(netstackid_t stackid, void *arg);
106 
107 /*
108  * SCTP receive queue taskq
109  *
110  * At SCTP initialization time, a default taskq is created for
111  * servicing packets received when the interrupt thread cannot
112  * get a hold on the sctp_t.  The number of taskq can be increased in
113  * sctp_find_next_tq() when an existing taskq cannot be dispatched.
114  * The taskqs are never removed.  But the max number of taskq which
115  * can be created is controlled by sctp_recvq_tq_list_max_sz.  Note
116  * that SCTP recvq taskq is not tied to any specific CPU or ill.
117  *
118  * Those taskqs are stored in an array recvq_tq_list.  And they are
119  * used in a round robin fashion.  The current taskq being used is
120  * determined by recvq_tq_list_cur.
121  */
122 
123 /* /etc/system variables */
124 /* The minimum number of threads for each taskq. */
125 int		sctp_recvq_tq_thr_min = 4;
126 /* The maximum number of threads for each taskq. */
127 int		sctp_recvq_tq_thr_max = 16;
128 /* The minimum number of tasks for each taskq. */
129 int		sctp_recvq_tq_task_min = 5;
130 /* The maxiimum number of tasks for each taskq. */
131 int		sctp_recvq_tq_task_max = 50;
132 
133 /*  sctp_t/conn_t kmem cache */
134 struct kmem_cache	*sctp_conn_cache;
135 
136 #define	SCTP_CONDEMNED(sctp)				\
137 	mutex_enter(&(sctp)->sctp_reflock);		\
138 	((sctp)->sctp_condemned = B_TRUE);		\
139 	mutex_exit(&(sctp)->sctp_reflock);
140 
141 /* Link/unlink a sctp_t to/from the global list. */
142 #define	SCTP_LINK(sctp, sctps)				\
143 	mutex_enter(&(sctps)->sctps_g_lock);		\
144 	list_insert_tail(&sctps->sctps_g_list, (sctp));	\
145 	mutex_exit(&(sctps)->sctps_g_lock);
146 
147 #define	SCTP_UNLINK(sctp, sctps)				\
148 	mutex_enter(&(sctps)->sctps_g_lock);		\
149 	ASSERT((sctp)->sctp_condemned);			\
150 	list_remove(&(sctps)->sctps_g_list, (sctp));	\
151 	mutex_exit(&(sctps)->sctps_g_lock);
152 
153 /*
154  * Hooks for Sun Cluster. On non-clustered nodes these will remain NULL.
155  * PSARC/2005/602.
156  */
157 void (*cl_sctp_listen)(sa_family_t, uchar_t *, uint_t, in_port_t) = NULL;
158 void (*cl_sctp_unlisten)(sa_family_t, uchar_t *, uint_t, in_port_t) = NULL;
159 void (*cl_sctp_connect)(sa_family_t, uchar_t *, uint_t, in_port_t,
160     uchar_t *, uint_t, in_port_t, boolean_t, cl_sctp_handle_t) = NULL;
161 void (*cl_sctp_disconnect)(sa_family_t, cl_sctp_handle_t) = NULL;
162 void (*cl_sctp_assoc_change)(sa_family_t, uchar_t *, size_t, uint_t,
163     uchar_t *, size_t, uint_t, int, cl_sctp_handle_t) = NULL;
164 void (*cl_sctp_check_addrs)(sa_family_t, in_port_t, uchar_t **, size_t,
165     uint_t *, boolean_t) = NULL;
166 /*
167  * Return the version number of the SCTP kernel interface.
168  */
169 int
170 sctp_itf_ver(int cl_ver)
171 {
172 	if (cl_ver != SCTP_ITF_VER)
173 		return (-1);
174 	return (SCTP_ITF_VER);
175 }
176 
177 /*
178  * Called when we need a new sctp instantiation but don't really have a
179  * new q to hang it off of. Copy the priv flag from the passed in structure.
180  */
181 sctp_t *
182 sctp_create_eager(sctp_t *psctp)
183 {
184 	sctp_t	*sctp;
185 	mblk_t	*ack_mp, *hb_mp;
186 	conn_t	*connp, *pconnp;
187 	cred_t *credp;
188 	sctp_stack_t	*sctps = psctp->sctp_sctps;
189 
190 	if ((connp = ipcl_conn_create(IPCL_SCTPCONN, KM_NOSLEEP,
191 	    sctps->sctps_netstack)) == NULL) {
192 		return (NULL);
193 	}
194 
195 	connp->conn_ulp_labeled = is_system_labeled();
196 
197 	sctp = CONN2SCTP(connp);
198 	sctp->sctp_sctps = sctps;
199 
200 	if ((ack_mp = sctp_timer_alloc(sctp, sctp_ack_timer,
201 	    KM_NOSLEEP)) == NULL ||
202 	    (hb_mp = sctp_timer_alloc(sctp, sctp_heartbeat_timer,
203 	    KM_NOSLEEP)) == NULL) {
204 		if (ack_mp != NULL)
205 			freeb(ack_mp);
206 		sctp_conn_clear(connp);
207 		sctp->sctp_sctps = NULL;
208 		SCTP_G_Q_REFRELE(sctps);
209 		kmem_cache_free(sctp_conn_cache, connp);
210 		return (NULL);
211 	}
212 
213 	sctp->sctp_ack_mp = ack_mp;
214 	sctp->sctp_heartbeat_mp = hb_mp;
215 
216 	/* Inherit information from the "parent" */
217 	sctp->sctp_ipversion = psctp->sctp_ipversion;
218 	sctp->sctp_family = psctp->sctp_family;
219 	pconnp = psctp->sctp_connp;
220 	connp->conn_af_isv6 = pconnp->conn_af_isv6;
221 	connp->conn_pkt_isv6 = pconnp->conn_pkt_isv6;
222 	connp->conn_ipv6_v6only = pconnp->conn_ipv6_v6only;
223 	if (sctp_init_values(sctp, psctp, KM_NOSLEEP) != 0) {
224 		freeb(ack_mp);
225 		freeb(hb_mp);
226 		sctp_conn_clear(connp);
227 		sctp->sctp_sctps = NULL;
228 		SCTP_G_Q_REFRELE(sctps);
229 		kmem_cache_free(sctp_conn_cache, connp);
230 		return (NULL);
231 	}
232 
233 	/*
234 	 * If the parent is multilevel, then we'll fix up the remote cred
235 	 * when we do sctp_accept_comm.
236 	 */
237 	if ((credp = pconnp->conn_cred) != NULL) {
238 		connp->conn_cred = credp;
239 		crhold(credp);
240 		/*
241 		 * If the caller has the process-wide flag set, then default to
242 		 * MAC exempt mode.  This allows read-down to unlabeled hosts.
243 		 */
244 		if (getpflags(NET_MAC_AWARE, credp) != 0)
245 			connp->conn_mac_exempt = B_TRUE;
246 	}
247 
248 	connp->conn_allzones = pconnp->conn_allzones;
249 	connp->conn_zoneid = pconnp->conn_zoneid;
250 
251 	sctp->sctp_mss = psctp->sctp_mss;
252 	sctp->sctp_detached = B_TRUE;
253 	/*
254 	 * Link to the global as soon as possible so that this sctp_t
255 	 * can be found.
256 	 */
257 	SCTP_LINK(sctp, sctps);
258 
259 	return (sctp);
260 }
261 
262 /*
263  * We are dying for some reason.  Try to do it gracefully.
264  */
265 void
266 sctp_clean_death(sctp_t *sctp, int err)
267 {
268 	ASSERT(sctp != NULL);
269 	ASSERT((sctp->sctp_family == AF_INET &&
270 	    sctp->sctp_ipversion == IPV4_VERSION) ||
271 	    (sctp->sctp_family == AF_INET6 &&
272 	    (sctp->sctp_ipversion == IPV4_VERSION ||
273 	    sctp->sctp_ipversion == IPV6_VERSION)));
274 
275 	dprint(3, ("sctp_clean_death %p, state %d\n", (void *)sctp,
276 	    sctp->sctp_state));
277 
278 	sctp->sctp_client_errno = err;
279 	/*
280 	 * Check to see if we need to notify upper layer.
281 	 */
282 	if ((sctp->sctp_state >= SCTPS_COOKIE_WAIT) &&
283 	    !SCTP_IS_DETACHED(sctp)) {
284 		if (sctp->sctp_xmit_head || sctp->sctp_xmit_unsent) {
285 			sctp_regift_xmitlist(sctp);
286 		}
287 		if (sctp->sctp_ulp_disconnected(sctp->sctp_ulpd, err)) {
288 			/*
289 			 * Socket is gone, detach.
290 			 */
291 			sctp->sctp_detached = B_TRUE;
292 			sctp->sctp_ulpd = NULL;
293 			bzero(&sctp->sctp_upcalls, sizeof (sctp_upcalls_t));
294 		}
295 	}
296 
297 	/* Remove this sctp from all hashes. */
298 	sctp_closei_local(sctp);
299 
300 	/*
301 	 * If the sctp_t is detached, we need to finish freeing up
302 	 * the resources.  At this point, ip_fanout_sctp() should have
303 	 * a hold on this sctp_t.  Some thread doing snmp stuff can
304 	 * have a hold.  And a taskq can also have a hold waiting to
305 	 * work.  sctp_unlink() the sctp_t from the global list so
306 	 * that no new thread can find it.  Then do a SCTP_REFRELE().
307 	 * The sctp_t will be freed after all those threads are done.
308 	 */
309 	if (SCTP_IS_DETACHED(sctp)) {
310 		SCTP_CONDEMNED(sctp);
311 		SCTP_REFRELE(sctp);
312 	}
313 }
314 
315 /*
316  * Called by upper layer when it wants to close this association.
317  * Depending on the state of this assoication, we need to do
318  * different things.
319  *
320  * If the state is below COOKIE_ECHOED or it is COOKIE_ECHOED but with
321  * no sent data, just remove this sctp from all the hashes.  This
322  * makes sure that all packets from the other end will go to the default
323  * sctp handling.  The upper layer will then do a sctp_close() to clean
324  * up.
325  *
326  * Otherwise, check and see if SO_LINGER is set.  If it is set, check
327  * the value.  If the value is 0, consider this an abortive close.  Send
328  * an ABORT message and kill the associatiion.
329  *
330  */
331 int
332 sctp_disconnect(sctp_t *sctp)
333 {
334 	int	error = 0;
335 
336 	dprint(3, ("sctp_disconnect %p, state %d\n", (void *)sctp,
337 	    sctp->sctp_state));
338 
339 	RUN_SCTP(sctp);
340 
341 	switch (sctp->sctp_state) {
342 	case SCTPS_IDLE:
343 	case SCTPS_BOUND:
344 	case SCTPS_LISTEN:
345 		break;
346 	case SCTPS_COOKIE_WAIT:
347 	case SCTPS_COOKIE_ECHOED:
348 		/*
349 		 * Close during the connect 3-way handshake
350 		 * but here there may or may not be pending data
351 		 * already on queue. Process almost same as in
352 		 * the ESTABLISHED state.
353 		 */
354 		if (sctp->sctp_xmit_head == NULL &&
355 		    sctp->sctp_xmit_unsent == NULL) {
356 			break;
357 		}
358 		/* FALLTHRU */
359 	default:
360 		/*
361 		 * If SO_LINGER has set a zero linger time, abort the
362 		 * connection with a reset.
363 		 */
364 		if (sctp->sctp_linger && sctp->sctp_lingertime == 0) {
365 			sctp_user_abort(sctp, NULL, B_FALSE);
366 			break;
367 		}
368 
369 		/*
370 		 * In there is unread data, send an ABORT
371 		 */
372 		if (sctp->sctp_rxqueued > 0 || sctp->sctp_irwnd >
373 		    sctp->sctp_rwnd) {
374 			sctp_user_abort(sctp, NULL, B_FALSE);
375 			break;
376 		}
377 		/*
378 		 * Transmit the shutdown before detaching the sctp_t.
379 		 * After sctp_detach returns this queue/perimeter
380 		 * no longer owns the sctp_t thus others can modify it.
381 		 */
382 		sctp_send_shutdown(sctp, 0);
383 
384 		/* Pass gathered wisdom to IP for keeping */
385 		sctp_update_ire(sctp);
386 
387 		/*
388 		 * If lingering on close then wait until the shutdown
389 		 * is complete, or the SO_LINGER time passes, or an
390 		 * ABORT is sent/received.  Note that sctp_disconnect()
391 		 * can be called more than once.  Make sure that only
392 		 * one thread waits.
393 		 */
394 		if (sctp->sctp_linger && sctp->sctp_lingertime > 0 &&
395 		    sctp->sctp_state >= SCTPS_ESTABLISHED &&
396 		    !sctp->sctp_lingering) {
397 			clock_t stoptime;	/* in ticks */
398 			clock_t ret;
399 
400 			/*
401 			 * Process the sendq to send the SHUTDOWN out
402 			 * before waiting.
403 			 */
404 			sctp_process_sendq(sctp);
405 
406 			sctp->sctp_lingering = 1;
407 			sctp->sctp_client_errno = 0;
408 			stoptime = lbolt + sctp->sctp_lingertime;
409 
410 			mutex_enter(&sctp->sctp_lock);
411 			sctp->sctp_running = B_FALSE;
412 			while (sctp->sctp_state >= SCTPS_ESTABLISHED &&
413 			    sctp->sctp_client_errno == 0) {
414 				cv_broadcast(&sctp->sctp_cv);
415 				ret = cv_timedwait_sig(&sctp->sctp_cv,
416 				    &sctp->sctp_lock, stoptime);
417 				if (ret < 0) {
418 					/* Stoptime has reached. */
419 					sctp->sctp_client_errno = EWOULDBLOCK;
420 					break;
421 				} else if (ret == 0) {
422 					/* Got a signal. */
423 					break;
424 				}
425 			}
426 			error = sctp->sctp_client_errno;
427 			sctp->sctp_client_errno = 0;
428 			mutex_exit(&sctp->sctp_lock);
429 		}
430 
431 		WAKE_SCTP(sctp);
432 		sctp_process_sendq(sctp);
433 		return (error);
434 	}
435 
436 
437 	/* Remove this sctp from all hashes so nobody can find it. */
438 	sctp_closei_local(sctp);
439 	WAKE_SCTP(sctp);
440 	return (error);
441 }
442 
443 void
444 sctp_close(sctp_t *sctp)
445 {
446 	dprint(3, ("sctp_close %p, state %d\n", (void *)sctp,
447 	    sctp->sctp_state));
448 
449 	RUN_SCTP(sctp);
450 	sctp->sctp_detached = 1;
451 	sctp->sctp_ulpd = NULL;
452 	bzero(&sctp->sctp_upcalls, sizeof (sctp_upcalls_t));
453 	bzero(&sctp->sctp_events, sizeof (sctp->sctp_events));
454 
455 	/* If the graceful shutdown has not been completed, just return. */
456 	if (sctp->sctp_state != SCTPS_IDLE) {
457 		WAKE_SCTP(sctp);
458 		return;
459 	}
460 
461 	/*
462 	 * Since sctp_t is in SCTPS_IDLE state, so the only thread which
463 	 * can have a hold on the sctp_t is doing snmp stuff.  Just do
464 	 * a SCTP_REFRELE() here after the SCTP_UNLINK().  It will
465 	 * be freed when the other thread is done.
466 	 */
467 	SCTP_CONDEMNED(sctp);
468 	WAKE_SCTP(sctp);
469 	SCTP_REFRELE(sctp);
470 }
471 
472 /*
473  * Unlink from global list and do the eager close.
474  * Remove the refhold implicit in being on the global list.
475  */
476 void
477 sctp_close_eager(sctp_t *sctp)
478 {
479 	SCTP_CONDEMNED(sctp);
480 	sctp_closei_local(sctp);
481 	SCTP_REFRELE(sctp);
482 }
483 
484 /*
485  * The sctp_t is going away. Remove it from all lists and set it
486  * to SCTPS_IDLE. The caller has to remove it from the
487  * global list. The freeing up of memory is deferred until
488  * sctp_free(). This is needed since a thread in sctp_input() might have
489  * done a SCTP_REFHOLD on this structure before it was removed from the
490  * hashes.
491  */
492 static void
493 sctp_closei_local(sctp_t *sctp)
494 {
495 	mblk_t	*mp;
496 	ire_t	*ire = NULL;
497 	conn_t	*connp = sctp->sctp_connp;
498 
499 	/* Sanity check, don't do the same thing twice.  */
500 	if (connp->conn_state_flags & CONN_CLOSING) {
501 		ASSERT(sctp->sctp_state == SCTPS_IDLE);
502 		return;
503 	}
504 
505 	/* Stop and free the timers */
506 	sctp_free_faddr_timers(sctp);
507 	if ((mp = sctp->sctp_heartbeat_mp) != NULL) {
508 		sctp_timer_free(mp);
509 		sctp->sctp_heartbeat_mp = NULL;
510 	}
511 	if ((mp = sctp->sctp_ack_mp) != NULL) {
512 		sctp_timer_free(mp);
513 		sctp->sctp_ack_mp = NULL;
514 	}
515 
516 	/* Set the CONN_CLOSING flag so that IP will not cache IRE again. */
517 	mutex_enter(&connp->conn_lock);
518 	connp->conn_state_flags |= CONN_CLOSING;
519 	ire = connp->conn_ire_cache;
520 	connp->conn_ire_cache = NULL;
521 	mutex_exit(&connp->conn_lock);
522 	if (ire != NULL)
523 		IRE_REFRELE_NOTR(ire);
524 
525 	/* Remove from all hashes. */
526 	sctp_bind_hash_remove(sctp);
527 	sctp_conn_hash_remove(sctp);
528 	sctp_listen_hash_remove(sctp);
529 	sctp->sctp_state = SCTPS_IDLE;
530 
531 	/*
532 	 * Clean up the recvq as much as possible.  All those packets
533 	 * will be silently dropped as this sctp_t is now in idle state.
534 	 */
535 	mutex_enter(&sctp->sctp_recvq_lock);
536 	while ((mp = sctp->sctp_recvq) != NULL) {
537 		mblk_t *ipsec_mp;
538 
539 		sctp->sctp_recvq = mp->b_next;
540 		mp->b_next = NULL;
541 		if ((ipsec_mp = mp->b_prev) != NULL) {
542 			freeb(ipsec_mp);
543 			mp->b_prev = NULL;
544 		}
545 		freemsg(mp);
546 	}
547 	mutex_exit(&sctp->sctp_recvq_lock);
548 }
549 
550 /*
551  * Free memory associated with the sctp/ip header template.
552  */
553 static void
554 sctp_headers_free(sctp_t *sctp)
555 {
556 	if (sctp->sctp_iphc != NULL) {
557 		kmem_free(sctp->sctp_iphc, sctp->sctp_iphc_len);
558 		sctp->sctp_iphc = NULL;
559 		sctp->sctp_ipha = NULL;
560 		sctp->sctp_hdr_len = 0;
561 		sctp->sctp_ip_hdr_len = 0;
562 		sctp->sctp_iphc_len = 0;
563 		sctp->sctp_sctph = NULL;
564 		sctp->sctp_hdr_len = 0;
565 	}
566 	if (sctp->sctp_iphc6 != NULL) {
567 		kmem_free(sctp->sctp_iphc6, sctp->sctp_iphc6_len);
568 		sctp->sctp_iphc6 = NULL;
569 		sctp->sctp_ip6h = NULL;
570 		sctp->sctp_hdr6_len = 0;
571 		sctp->sctp_ip_hdr6_len = 0;
572 		sctp->sctp_iphc6_len = 0;
573 		sctp->sctp_sctph6 = NULL;
574 		sctp->sctp_hdr6_len = 0;
575 	}
576 }
577 
578 static void
579 sctp_free_xmit_data(sctp_t *sctp)
580 {
581 	mblk_t	*ump = NULL;
582 	mblk_t	*nump;
583 	mblk_t	*mp;
584 	mblk_t	*nmp;
585 
586 	sctp->sctp_xmit_unacked = NULL;
587 	ump = sctp->sctp_xmit_head;
588 	sctp->sctp_xmit_tail = sctp->sctp_xmit_head = NULL;
589 free_unsent:
590 	for (; ump != NULL; ump = nump) {
591 		for (mp = ump->b_cont; mp != NULL; mp = nmp) {
592 			nmp = mp->b_next;
593 			mp->b_next = NULL;
594 			mp->b_prev = NULL;
595 			freemsg(mp);
596 		}
597 		ASSERT(DB_REF(ump) == 1);
598 		nump = ump->b_next;
599 		ump->b_next = NULL;
600 		ump->b_prev = NULL;
601 		ump->b_cont = NULL;
602 		freeb(ump);
603 	}
604 	if ((ump = sctp->sctp_xmit_unsent) == NULL) {
605 		ASSERT(sctp->sctp_xmit_unsent_tail == NULL);
606 		return;
607 	}
608 	sctp->sctp_xmit_unsent = sctp->sctp_xmit_unsent_tail = NULL;
609 	goto free_unsent;
610 }
611 
612 /*
613  * Cleanup all the messages in the stream queue and the reassembly lists.
614  * If 'free' is true, then delete the streams as well.
615  */
616 void
617 sctp_instream_cleanup(sctp_t *sctp, boolean_t free)
618 {
619 	int	i;
620 	mblk_t	*mp;
621 	mblk_t	*mp1;
622 
623 	if (sctp->sctp_instr != NULL) {
624 		/* walk thru and flush out anything remaining in the Q */
625 		for (i = 0; i < sctp->sctp_num_istr; i++) {
626 			mp = sctp->sctp_instr[i].istr_msgs;
627 			while (mp != NULL) {
628 				mp1 = mp->b_next;
629 				mp->b_next = mp->b_prev = NULL;
630 				freemsg(mp);
631 				mp = mp1;
632 			}
633 			sctp->sctp_instr[i].istr_msgs = NULL;
634 			sctp->sctp_instr[i].istr_nmsgs = 0;
635 			sctp_free_reass((sctp->sctp_instr) + i);
636 			sctp->sctp_instr[i].nextseq = 0;
637 		}
638 		if (free) {
639 			kmem_free(sctp->sctp_instr,
640 			    sizeof (*sctp->sctp_instr) * sctp->sctp_num_istr);
641 			sctp->sctp_instr = NULL;
642 			sctp->sctp_num_istr = 0;
643 		}
644 	}
645 	/* un-ordered fragments */
646 	if (sctp->sctp_uo_frags != NULL) {
647 		for (mp = sctp->sctp_uo_frags; mp != NULL; mp = mp1) {
648 			mp1 = mp->b_next;
649 			mp->b_next = mp->b_prev = NULL;
650 			freemsg(mp);
651 		}
652 	}
653 }
654 
655 /*
656  * Last reference to the sctp_t is gone. Free all memory associated with it.
657  * Called from SCTP_REFRELE. Called inline in sctp_close()
658  */
659 void
660 sctp_free(conn_t *connp)
661 {
662 	sctp_t *sctp = CONN2SCTP(connp);
663 	int		cnt;
664 	sctp_stack_t	*sctps = sctp->sctp_sctps;
665 
666 	ASSERT(sctps != NULL);
667 	/* Unlink it from the global list */
668 	SCTP_UNLINK(sctp, sctps);
669 
670 	ASSERT(connp->conn_ref == 0);
671 	ASSERT(connp->conn_ulp == IPPROTO_SCTP);
672 	ASSERT(!MUTEX_HELD(&sctp->sctp_reflock));
673 	ASSERT(sctp->sctp_refcnt == 0);
674 
675 	ASSERT(sctp->sctp_ptpbhn == NULL && sctp->sctp_bind_hash == NULL);
676 	ASSERT(sctp->sctp_conn_hash_next == NULL &&
677 	    sctp->sctp_conn_hash_prev == NULL);
678 
679 
680 	/* Free up all the resources. */
681 
682 	/* blow away sctp stream management */
683 	if (sctp->sctp_ostrcntrs != NULL) {
684 		kmem_free(sctp->sctp_ostrcntrs,
685 		    sizeof (uint16_t) * sctp->sctp_num_ostr);
686 		sctp->sctp_ostrcntrs = NULL;
687 	}
688 	sctp_instream_cleanup(sctp, B_TRUE);
689 
690 	/* Remove all data transfer resources. */
691 	sctp->sctp_istr_nmsgs = 0;
692 	sctp->sctp_rxqueued = 0;
693 	sctp_free_xmit_data(sctp);
694 	sctp->sctp_unacked = 0;
695 	sctp->sctp_unsent = 0;
696 	if (sctp->sctp_cxmit_list != NULL)
697 		sctp_asconf_free_cxmit(sctp, NULL);
698 
699 	sctp->sctp_lastdata = NULL;
700 
701 	/* Clear out default xmit settings */
702 	sctp->sctp_def_stream = 0;
703 	sctp->sctp_def_flags = 0;
704 	sctp->sctp_def_ppid = 0;
705 	sctp->sctp_def_context = 0;
706 	sctp->sctp_def_timetolive = 0;
707 
708 	if (sctp->sctp_sack_info != NULL) {
709 		sctp_free_set(sctp->sctp_sack_info);
710 		sctp->sctp_sack_info = NULL;
711 	}
712 	sctp->sctp_sack_gaps = 0;
713 
714 	if (sctp->sctp_cookie_mp != NULL) {
715 		freemsg(sctp->sctp_cookie_mp);
716 		sctp->sctp_cookie_mp = NULL;
717 	}
718 
719 	/* Remove all the address resources. */
720 	sctp_zap_addrs(sctp);
721 	for (cnt = 0; cnt < SCTP_IPIF_HASH; cnt++) {
722 		ASSERT(sctp->sctp_saddrs[cnt].ipif_count == 0);
723 		list_destroy(&sctp->sctp_saddrs[cnt].sctp_ipif_list);
724 	}
725 
726 	ip6_pkt_free(&sctp->sctp_sticky_ipp);
727 
728 	if (sctp->sctp_hopopts != NULL) {
729 		mi_free(sctp->sctp_hopopts);
730 		sctp->sctp_hopopts = NULL;
731 		sctp->sctp_hopoptslen = 0;
732 	}
733 	ASSERT(sctp->sctp_hopoptslen == 0);
734 	if (sctp->sctp_dstopts != NULL) {
735 		mi_free(sctp->sctp_dstopts);
736 		sctp->sctp_dstopts = NULL;
737 		sctp->sctp_dstoptslen = 0;
738 	}
739 	ASSERT(sctp->sctp_dstoptslen == 0);
740 	if (sctp->sctp_rtdstopts != NULL) {
741 		mi_free(sctp->sctp_rtdstopts);
742 		sctp->sctp_rtdstopts = NULL;
743 		sctp->sctp_rtdstoptslen = 0;
744 	}
745 	ASSERT(sctp->sctp_rtdstoptslen == 0);
746 	if (sctp->sctp_rthdr != NULL) {
747 		mi_free(sctp->sctp_rthdr);
748 		sctp->sctp_rthdr = NULL;
749 		sctp->sctp_rthdrlen = 0;
750 	}
751 	ASSERT(sctp->sctp_rthdrlen == 0);
752 	sctp_headers_free(sctp);
753 
754 	sctp->sctp_shutdown_faddr = NULL;
755 
756 	/* Clear all the bitfields. */
757 	bzero(&sctp->sctp_bits, sizeof (sctp->sctp_bits));
758 
759 	/* It is time to update the global statistics. */
760 	UPDATE_MIB(&sctps->sctps_mib, sctpOutSCTPPkts, sctp->sctp_opkts);
761 	UPDATE_MIB(&sctps->sctps_mib, sctpOutCtrlChunks, sctp->sctp_obchunks);
762 	UPDATE_MIB(&sctps->sctps_mib, sctpOutOrderChunks, sctp->sctp_odchunks);
763 	UPDATE_MIB(&sctps->sctps_mib,
764 	    sctpOutUnorderChunks, sctp->sctp_oudchunks);
765 	UPDATE_MIB(&sctps->sctps_mib, sctpRetransChunks, sctp->sctp_rxtchunks);
766 	UPDATE_MIB(&sctps->sctps_mib, sctpInSCTPPkts, sctp->sctp_ipkts);
767 	UPDATE_MIB(&sctps->sctps_mib, sctpInCtrlChunks, sctp->sctp_ibchunks);
768 	UPDATE_MIB(&sctps->sctps_mib, sctpInOrderChunks, sctp->sctp_idchunks);
769 	UPDATE_MIB(&sctps->sctps_mib,
770 	    sctpInUnorderChunks, sctp->sctp_iudchunks);
771 	UPDATE_MIB(&sctps->sctps_mib, sctpFragUsrMsgs, sctp->sctp_fragdmsgs);
772 	UPDATE_MIB(&sctps->sctps_mib, sctpReasmUsrMsgs, sctp->sctp_reassmsgs);
773 	sctp->sctp_opkts = 0;
774 	sctp->sctp_obchunks = 0;
775 	sctp->sctp_odchunks = 0;
776 	sctp->sctp_oudchunks = 0;
777 	sctp->sctp_rxtchunks = 0;
778 	sctp->sctp_ipkts = 0;
779 	sctp->sctp_ibchunks = 0;
780 	sctp->sctp_idchunks = 0;
781 	sctp->sctp_iudchunks = 0;
782 	sctp->sctp_fragdmsgs = 0;
783 	sctp->sctp_reassmsgs = 0;
784 
785 	sctp->sctp_autoclose = 0;
786 	sctp->sctp_tx_adaption_code = 0;
787 
788 	sctp->sctp_v6label_len = 0;
789 	sctp->sctp_v4label_len = 0;
790 
791 	/* Every sctp_t holds one reference on the default queue */
792 	sctp->sctp_sctps = NULL;
793 	SCTP_G_Q_REFRELE(sctps);
794 
795 	sctp_conn_clear(connp);
796 	kmem_cache_free(sctp_conn_cache, connp);
797 }
798 
799 /* Diagnostic routine used to return a string associated with the sctp state. */
800 char *
801 sctp_display(sctp_t *sctp, char *sup_buf)
802 {
803 	char	*buf;
804 	char	buf1[30];
805 	static char	priv_buf[INET6_ADDRSTRLEN * 2 + 80];
806 	char	*cp;
807 
808 	if (sctp == NULL)
809 		return ("NULL_SCTP");
810 
811 	buf = (sup_buf != NULL) ? sup_buf : priv_buf;
812 
813 	switch (sctp->sctp_state) {
814 	case SCTPS_IDLE:
815 		cp = "SCTP_IDLE";
816 		break;
817 	case SCTPS_BOUND:
818 		cp = "SCTP_BOUND";
819 		break;
820 	case SCTPS_LISTEN:
821 		cp = "SCTP_LISTEN";
822 		break;
823 	case SCTPS_COOKIE_WAIT:
824 		cp = "SCTP_COOKIE_WAIT";
825 		break;
826 	case SCTPS_COOKIE_ECHOED:
827 		cp = "SCTP_COOKIE_ECHOED";
828 		break;
829 	case SCTPS_ESTABLISHED:
830 		cp = "SCTP_ESTABLISHED";
831 		break;
832 	case SCTPS_SHUTDOWN_PENDING:
833 		cp = "SCTP_SHUTDOWN_PENDING";
834 		break;
835 	case SCTPS_SHUTDOWN_SENT:
836 		cp = "SCTPS_SHUTDOWN_SENT";
837 		break;
838 	case SCTPS_SHUTDOWN_RECEIVED:
839 		cp = "SCTPS_SHUTDOWN_RECEIVED";
840 		break;
841 	case SCTPS_SHUTDOWN_ACK_SENT:
842 		cp = "SCTPS_SHUTDOWN_ACK_SENT";
843 		break;
844 	default:
845 		(void) mi_sprintf(buf1, "SCTPUnkState(%d)", sctp->sctp_state);
846 		cp = buf1;
847 		break;
848 	}
849 	(void) mi_sprintf(buf, "[%u, %u] %s",
850 	    ntohs(sctp->sctp_lport), ntohs(sctp->sctp_fport), cp);
851 
852 	return (buf);
853 }
854 
855 /*
856  * Initialize protocol control block. If a parent exists, inherit
857  * all values set through setsockopt().
858  */
859 static int
860 sctp_init_values(sctp_t *sctp, sctp_t *psctp, int sleep)
861 {
862 	int	err;
863 	int	cnt;
864 	sctp_stack_t	*sctps = sctp->sctp_sctps;
865 	conn_t 	*connp, *pconnp;
866 
867 	ASSERT((sctp->sctp_family == AF_INET &&
868 	    sctp->sctp_ipversion == IPV4_VERSION) ||
869 	    (sctp->sctp_family == AF_INET6 &&
870 	    (sctp->sctp_ipversion == IPV4_VERSION ||
871 	    sctp->sctp_ipversion == IPV6_VERSION)));
872 
873 	sctp->sctp_nsaddrs = 0;
874 	for (cnt = 0; cnt < SCTP_IPIF_HASH; cnt++) {
875 		sctp->sctp_saddrs[cnt].ipif_count = 0;
876 		list_create(&sctp->sctp_saddrs[cnt].sctp_ipif_list,
877 		    sizeof (sctp_saddr_ipif_t), offsetof(sctp_saddr_ipif_t,
878 		    saddr_ipif));
879 	}
880 	sctp->sctp_ports = 0;
881 	sctp->sctp_running = B_FALSE;
882 	sctp->sctp_state = SCTPS_IDLE;
883 
884 	sctp->sctp_refcnt = 1;
885 
886 	sctp->sctp_strikes = 0;
887 
888 	sctp->sctp_last_mtu_probe = lbolt64;
889 	sctp->sctp_mtu_probe_intvl = sctps->sctps_mtu_probe_interval;
890 
891 	sctp->sctp_sack_gaps = 0;
892 	sctp->sctp_sack_toggle = 2;
893 
894 	/* Only need to do the allocation if there is no "cached" one. */
895 	if (sctp->sctp_pad_mp == NULL) {
896 		if (sleep == KM_SLEEP) {
897 			sctp->sctp_pad_mp = allocb_wait(SCTP_ALIGN, BPRI_MED,
898 			    STR_NOSIG, NULL);
899 		} else {
900 			sctp->sctp_pad_mp = allocb(SCTP_ALIGN, BPRI_MED);
901 			if (sctp->sctp_pad_mp == NULL)
902 				return (ENOMEM);
903 		}
904 		bzero(sctp->sctp_pad_mp->b_rptr, SCTP_ALIGN);
905 	}
906 
907 	if (psctp != NULL) {
908 		/*
909 		 * Inherit from parent
910 		 */
911 		sctp->sctp_iphc = kmem_zalloc(psctp->sctp_iphc_len, sleep);
912 		if (sctp->sctp_iphc == NULL) {
913 			sctp->sctp_iphc_len = 0;
914 			err = ENOMEM;
915 			goto failure;
916 		}
917 		sctp->sctp_iphc_len = psctp->sctp_iphc_len;
918 		sctp->sctp_hdr_len = psctp->sctp_hdr_len;
919 
920 		sctp->sctp_iphc6 = kmem_zalloc(psctp->sctp_iphc6_len, sleep);
921 		if (sctp->sctp_iphc6 == NULL) {
922 			sctp->sctp_iphc6_len = 0;
923 			err = ENOMEM;
924 			goto failure;
925 		}
926 		sctp->sctp_iphc6_len = psctp->sctp_iphc6_len;
927 		sctp->sctp_hdr6_len = psctp->sctp_hdr6_len;
928 
929 		sctp->sctp_ip_hdr_len = psctp->sctp_ip_hdr_len;
930 		sctp->sctp_ip_hdr6_len = psctp->sctp_ip_hdr6_len;
931 
932 		/*
933 		 * Copy the IP+SCTP header templates from listener
934 		 */
935 		bcopy(psctp->sctp_iphc, sctp->sctp_iphc,
936 		    psctp->sctp_hdr_len);
937 		sctp->sctp_ipha = (ipha_t *)sctp->sctp_iphc;
938 		sctp->sctp_sctph = (sctp_hdr_t *)(sctp->sctp_iphc +
939 		    sctp->sctp_ip_hdr_len);
940 
941 		bcopy(psctp->sctp_iphc6, sctp->sctp_iphc6,
942 		    psctp->sctp_hdr6_len);
943 		if (((ip6i_t *)(sctp->sctp_iphc6))->ip6i_nxt == IPPROTO_RAW) {
944 			sctp->sctp_ip6h = (ip6_t *)(sctp->sctp_iphc6 +
945 			    sizeof (ip6i_t));
946 		} else {
947 			sctp->sctp_ip6h = (ip6_t *)sctp->sctp_iphc6;
948 		}
949 		sctp->sctp_sctph6 = (sctp_hdr_t *)(sctp->sctp_iphc6 +
950 		    sctp->sctp_ip_hdr6_len);
951 
952 		sctp->sctp_cookie_lifetime = psctp->sctp_cookie_lifetime;
953 		sctp->sctp_xmit_lowater = psctp->sctp_xmit_lowater;
954 		sctp->sctp_xmit_hiwater = psctp->sctp_xmit_hiwater;
955 		sctp->sctp_cwnd_max = psctp->sctp_cwnd_max;
956 		sctp->sctp_rwnd = psctp->sctp_rwnd;
957 		sctp->sctp_irwnd = psctp->sctp_rwnd;
958 		sctp->sctp_pd_point = psctp->sctp_pd_point;
959 		sctp->sctp_rto_max = psctp->sctp_rto_max;
960 		sctp->sctp_init_rto_max = psctp->sctp_init_rto_max;
961 		sctp->sctp_rto_min = psctp->sctp_rto_min;
962 		sctp->sctp_rto_initial = psctp->sctp_rto_initial;
963 		sctp->sctp_pa_max_rxt = psctp->sctp_pa_max_rxt;
964 		sctp->sctp_pp_max_rxt = psctp->sctp_pp_max_rxt;
965 		sctp->sctp_max_init_rxt = psctp->sctp_max_init_rxt;
966 
967 		sctp->sctp_def_stream = psctp->sctp_def_stream;
968 		sctp->sctp_def_flags = psctp->sctp_def_flags;
969 		sctp->sctp_def_ppid = psctp->sctp_def_ppid;
970 		sctp->sctp_def_context = psctp->sctp_def_context;
971 		sctp->sctp_def_timetolive = psctp->sctp_def_timetolive;
972 
973 		sctp->sctp_num_istr = psctp->sctp_num_istr;
974 		sctp->sctp_num_ostr = psctp->sctp_num_ostr;
975 
976 		sctp->sctp_hb_interval = psctp->sctp_hb_interval;
977 		sctp->sctp_autoclose = psctp->sctp_autoclose;
978 		sctp->sctp_tx_adaption_code = psctp->sctp_tx_adaption_code;
979 
980 		/* xxx should be a better way to copy these flags xxx */
981 		sctp->sctp_debug = psctp->sctp_debug;
982 		sctp->sctp_bound_to_all = psctp->sctp_bound_to_all;
983 		sctp->sctp_cansleep = psctp->sctp_cansleep;
984 		sctp->sctp_send_adaption = psctp->sctp_send_adaption;
985 		sctp->sctp_ndelay = psctp->sctp_ndelay;
986 		sctp->sctp_events = psctp->sctp_events;
987 		sctp->sctp_ipv6_recvancillary = psctp->sctp_ipv6_recvancillary;
988 
989 		/* Copy IP-layer options */
990 		connp = sctp->sctp_connp;
991 		pconnp = psctp->sctp_connp;
992 
993 		connp->conn_broadcast = pconnp->conn_broadcast;
994 		connp->conn_loopback = pconnp->conn_loopback;
995 		connp->conn_dontroute = pconnp->conn_dontroute;
996 		connp->conn_reuseaddr = pconnp->conn_reuseaddr;
997 
998 	} else {
999 		/*
1000 		 * Initialize the header template
1001 		 */
1002 		if ((err = sctp_header_init_ipv4(sctp, sleep)) != 0) {
1003 			goto failure;
1004 		}
1005 		if ((err = sctp_header_init_ipv6(sctp, sleep)) != 0) {
1006 			goto failure;
1007 		}
1008 
1009 		/*
1010 		 * Set to system defaults
1011 		 */
1012 		sctp->sctp_cookie_lifetime =
1013 		    MSEC_TO_TICK(sctps->sctps_cookie_life);
1014 		sctp->sctp_xmit_lowater = sctps->sctps_xmit_lowat;
1015 		sctp->sctp_xmit_hiwater = sctps->sctps_xmit_hiwat;
1016 		sctp->sctp_cwnd_max = sctps->sctps_cwnd_max_;
1017 		sctp->sctp_rwnd = sctps->sctps_recv_hiwat;
1018 		sctp->sctp_irwnd = sctp->sctp_rwnd;
1019 		sctp->sctp_pd_point = sctp->sctp_rwnd;
1020 		sctp->sctp_rto_max = MSEC_TO_TICK(sctps->sctps_rto_maxg);
1021 		sctp->sctp_init_rto_max = sctp->sctp_rto_max;
1022 		sctp->sctp_rto_min = MSEC_TO_TICK(sctps->sctps_rto_ming);
1023 		sctp->sctp_rto_initial = MSEC_TO_TICK(
1024 		    sctps->sctps_rto_initialg);
1025 		sctp->sctp_pa_max_rxt = sctps->sctps_pa_max_retr;
1026 		sctp->sctp_pp_max_rxt = sctps->sctps_pp_max_retr;
1027 		sctp->sctp_max_init_rxt = sctps->sctps_max_init_retr;
1028 
1029 		sctp->sctp_num_istr = sctps->sctps_max_in_streams;
1030 		sctp->sctp_num_ostr = sctps->sctps_initial_out_streams;
1031 
1032 		sctp->sctp_hb_interval =
1033 		    MSEC_TO_TICK(sctps->sctps_heartbeat_interval);
1034 	}
1035 	sctp->sctp_understands_asconf = B_TRUE;
1036 	sctp->sctp_understands_addip = B_TRUE;
1037 	sctp->sctp_prsctp_aware = B_FALSE;
1038 
1039 	sctp->sctp_connp->conn_ref = 1;
1040 	sctp->sctp_connp->conn_fully_bound = B_FALSE;
1041 
1042 	sctp->sctp_prsctpdrop = 0;
1043 	sctp->sctp_msgcount = 0;
1044 
1045 	return (0);
1046 
1047 failure:
1048 	if (sctp->sctp_iphc != NULL) {
1049 		kmem_free(sctp->sctp_iphc, sctp->sctp_iphc_len);
1050 		sctp->sctp_iphc = NULL;
1051 	}
1052 	if (sctp->sctp_iphc6 != NULL) {
1053 		kmem_free(sctp->sctp_iphc6, sctp->sctp_iphc6_len);
1054 		sctp->sctp_iphc6 = NULL;
1055 	}
1056 	return (err);
1057 }
1058 
1059 /*
1060  * Extracts the init tag from an INIT chunk and checks if it matches
1061  * the sctp's verification tag. Returns 0 if it doesn't match, 1 if
1062  * it does.
1063  */
1064 static boolean_t
1065 sctp_icmp_verf(sctp_t *sctp, sctp_hdr_t *sh, mblk_t *mp)
1066 {
1067 	sctp_chunk_hdr_t *sch;
1068 	uint32_t verf, *vp;
1069 
1070 	sch = (sctp_chunk_hdr_t *)(sh + 1);
1071 	vp = (uint32_t *)(sch + 1);
1072 
1073 	/* Need at least the data chunk hdr and the first 4 bytes of INIT */
1074 	if ((unsigned char *)(vp + 1) > mp->b_wptr) {
1075 		return (B_FALSE);
1076 	}
1077 
1078 	bcopy(vp, &verf, sizeof (verf));
1079 
1080 	if (verf == sctp->sctp_lvtag) {
1081 		return (B_TRUE);
1082 	}
1083 	return (B_FALSE);
1084 }
1085 
1086 /*
1087  * sctp_icmp_error is called by sctp_input() to process ICMP error messages
1088  * passed up by IP.  The queue is the default queue.  We need to find a sctp_t
1089  * that corresponds to the returned datagram.  Passes the message back in on
1090  * the correct queue once it has located the connection.
1091  * Assumes that IP has pulled up everything up to and including
1092  * the ICMP header.
1093  */
1094 void
1095 sctp_icmp_error(sctp_t *sctp, mblk_t *mp)
1096 {
1097 	icmph_t *icmph;
1098 	ipha_t	*ipha;
1099 	int	iph_hdr_length;
1100 	sctp_hdr_t *sctph;
1101 	mblk_t *first_mp;
1102 	uint32_t new_mtu;
1103 	in6_addr_t dst;
1104 	sctp_faddr_t *fp;
1105 	sctp_stack_t	*sctps = sctp->sctp_sctps;
1106 
1107 	dprint(1, ("sctp_icmp_error: sctp=%p, mp=%p\n", (void *)sctp,
1108 	    (void *)mp));
1109 
1110 	first_mp = mp;
1111 
1112 	ipha = (ipha_t *)mp->b_rptr;
1113 	if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
1114 		ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
1115 		sctp_icmp_error_ipv6(sctp, first_mp);
1116 		return;
1117 	}
1118 
1119 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1120 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1121 	ipha = (ipha_t *)&icmph[1];
1122 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1123 	sctph = (sctp_hdr_t *)((char *)ipha + iph_hdr_length);
1124 	if ((uchar_t *)(sctph + 1) >= mp->b_wptr) {
1125 		/* not enough data for SCTP header */
1126 		freemsg(first_mp);
1127 		return;
1128 	}
1129 
1130 	switch (icmph->icmph_type) {
1131 	case ICMP_DEST_UNREACHABLE:
1132 		switch (icmph->icmph_code) {
1133 		case ICMP_FRAGMENTATION_NEEDED:
1134 			/*
1135 			 * Reduce the MSS based on the new MTU.  This will
1136 			 * eliminate any fragmentation locally.
1137 			 * N.B.  There may well be some funny side-effects on
1138 			 * the local send policy and the remote receive policy.
1139 			 * Pending further research, we provide
1140 			 * sctp_ignore_path_mtu just in case this proves
1141 			 * disastrous somewhere.
1142 			 *
1143 			 * After updating the MSS, retransmit part of the
1144 			 * dropped segment using the new mss by calling
1145 			 * sctp_wput_slow().  Need to adjust all those
1146 			 * params to make sure sctp_wput_slow() work properly.
1147 			 */
1148 			if (sctps->sctps_ignore_path_mtu)
1149 				break;
1150 
1151 			/* find the offending faddr */
1152 			IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &dst);
1153 			fp = sctp_lookup_faddr(sctp, &dst);
1154 			if (fp == NULL) {
1155 				break;
1156 			}
1157 
1158 			new_mtu = ntohs(icmph->icmph_du_mtu);
1159 
1160 			if (new_mtu - sctp->sctp_hdr_len >= fp->sfa_pmss)
1161 				break;
1162 
1163 			/*
1164 			 * Make sure that sfa_pmss is a multiple of
1165 			 * SCTP_ALIGN.
1166 			 */
1167 			fp->sfa_pmss = (new_mtu - sctp->sctp_hdr_len) &
1168 			    ~(SCTP_ALIGN - 1);
1169 			fp->pmtu_discovered = 1;
1170 
1171 			break;
1172 		case ICMP_PORT_UNREACHABLE:
1173 		case ICMP_PROTOCOL_UNREACHABLE:
1174 			switch (sctp->sctp_state) {
1175 			case SCTPS_COOKIE_WAIT:
1176 			case SCTPS_COOKIE_ECHOED:
1177 				/* make sure the verification tag matches */
1178 				if (!sctp_icmp_verf(sctp, sctph, mp)) {
1179 					break;
1180 				}
1181 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1182 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1183 				    NULL);
1184 				sctp_clean_death(sctp, ECONNREFUSED);
1185 				break;
1186 			}
1187 			break;
1188 		case ICMP_HOST_UNREACHABLE:
1189 		case ICMP_NET_UNREACHABLE:
1190 			/* Record the error in case we finally time out. */
1191 			sctp->sctp_client_errno = (icmph->icmph_code ==
1192 			    ICMP_HOST_UNREACHABLE) ? EHOSTUNREACH : ENETUNREACH;
1193 			break;
1194 		default:
1195 			break;
1196 		}
1197 		break;
1198 	case ICMP_SOURCE_QUENCH: {
1199 		/* Reduce the sending rate as if we got a retransmit timeout */
1200 		break;
1201 	}
1202 	}
1203 	freemsg(first_mp);
1204 }
1205 
1206 /*
1207  * sctp_icmp_error_ipv6() is called by sctp_icmp_error() to process ICMPv6
1208  * error messages passed up by IP.
1209  * Assumes that IP has pulled up all the extension headers as well
1210  * as the ICMPv6 header.
1211  */
1212 static void
1213 sctp_icmp_error_ipv6(sctp_t *sctp, mblk_t *mp)
1214 {
1215 	icmp6_t *icmp6;
1216 	ip6_t	*ip6h;
1217 	uint16_t	iph_hdr_length;
1218 	sctp_hdr_t *sctpha;
1219 	uint8_t	*nexthdrp;
1220 	uint32_t new_mtu;
1221 	sctp_faddr_t *fp;
1222 	sctp_stack_t	*sctps = sctp->sctp_sctps;
1223 
1224 	ip6h = (ip6_t *)mp->b_rptr;
1225 	iph_hdr_length = (ip6h->ip6_nxt != IPPROTO_SCTP) ?
1226 	    ip_hdr_length_v6(mp, ip6h) : IPV6_HDR_LEN;
1227 
1228 	icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1229 	ip6h = (ip6_t *)&icmp6[1];
1230 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1231 		freemsg(mp);
1232 		return;
1233 	}
1234 	ASSERT(*nexthdrp == IPPROTO_SCTP);
1235 
1236 	/* XXX need ifindex to find connection */
1237 	sctpha = (sctp_hdr_t *)((char *)ip6h + iph_hdr_length);
1238 	if ((uchar_t *)sctpha >= mp->b_wptr) {
1239 		/* not enough data for SCTP header */
1240 		freemsg(mp);
1241 		return;
1242 	}
1243 	switch (icmp6->icmp6_type) {
1244 	case ICMP6_PACKET_TOO_BIG:
1245 		/*
1246 		 * Reduce the MSS based on the new MTU.  This will
1247 		 * eliminate any fragmentation locally.
1248 		 * N.B.  There may well be some funny side-effects on
1249 		 * the local send policy and the remote receive policy.
1250 		 * Pending further research, we provide
1251 		 * sctp_ignore_path_mtu just in case this proves
1252 		 * disastrous somewhere.
1253 		 *
1254 		 * After updating the MSS, retransmit part of the
1255 		 * dropped segment using the new mss by calling
1256 		 * sctp_wput_slow().  Need to adjust all those
1257 		 * params to make sure sctp_wput_slow() work properly.
1258 		 */
1259 		if (sctps->sctps_ignore_path_mtu)
1260 			break;
1261 
1262 		/* find the offending faddr */
1263 		fp = sctp_lookup_faddr(sctp, &ip6h->ip6_dst);
1264 		if (fp == NULL) {
1265 			break;
1266 		}
1267 
1268 		new_mtu = ntohs(icmp6->icmp6_mtu);
1269 
1270 		if (new_mtu - sctp->sctp_hdr6_len >= fp->sfa_pmss)
1271 			break;
1272 
1273 		/* Make sure that sfa_pmss is a multiple of SCTP_ALIGN. */
1274 		fp->sfa_pmss = (new_mtu - sctp->sctp_hdr6_len) &
1275 		    ~(SCTP_ALIGN - 1);
1276 		fp->pmtu_discovered = 1;
1277 
1278 		break;
1279 
1280 	case ICMP6_DST_UNREACH:
1281 		switch (icmp6->icmp6_code) {
1282 		case ICMP6_DST_UNREACH_NOPORT:
1283 			/* make sure the verification tag matches */
1284 			if (!sctp_icmp_verf(sctp, sctpha, mp)) {
1285 				break;
1286 			}
1287 			if (sctp->sctp_state == SCTPS_COOKIE_WAIT ||
1288 			    sctp->sctp_state == SCTPS_COOKIE_ECHOED) {
1289 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1290 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1291 				    NULL);
1292 				sctp_clean_death(sctp, ECONNREFUSED);
1293 			}
1294 			break;
1295 
1296 		case ICMP6_DST_UNREACH_ADMIN:
1297 		case ICMP6_DST_UNREACH_NOROUTE:
1298 		case ICMP6_DST_UNREACH_NOTNEIGHBOR:
1299 		case ICMP6_DST_UNREACH_ADDR:
1300 			/* Record the error in case we finally time out. */
1301 			sctp->sctp_client_errno = EHOSTUNREACH;
1302 			break;
1303 		default:
1304 			break;
1305 		}
1306 		break;
1307 
1308 	case ICMP6_PARAM_PROB:
1309 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1310 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1311 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1312 		    (uchar_t *)nexthdrp) {
1313 			/* make sure the verification tag matches */
1314 			if (!sctp_icmp_verf(sctp, sctpha, mp)) {
1315 				break;
1316 			}
1317 			if (sctp->sctp_state == SCTPS_COOKIE_WAIT) {
1318 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1319 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1320 				    NULL);
1321 				sctp_clean_death(sctp, ECONNREFUSED);
1322 			}
1323 			break;
1324 		}
1325 		break;
1326 
1327 	case ICMP6_TIME_EXCEEDED:
1328 	default:
1329 		break;
1330 	}
1331 	freemsg(mp);
1332 }
1333 
1334 /*
1335  * Called by sockfs to create a new sctp instance.
1336  *
1337  * If parent pointer is passed in, inherit settings from it.
1338  */
1339 sctp_t *
1340 sctp_create(void *sctp_ulpd, sctp_t *parent, int family, int flags,
1341     const sctp_upcalls_t *sctp_upcalls, sctp_sockbuf_limits_t *sbl,
1342     cred_t *credp)
1343 {
1344 	sctp_t		*sctp, *psctp;
1345 	conn_t		*sctp_connp;
1346 	mblk_t		*ack_mp, *hb_mp;
1347 	int		sleep = flags & SCTP_CAN_BLOCK ? KM_SLEEP : KM_NOSLEEP;
1348 	zoneid_t	zoneid;
1349 	sctp_stack_t	*sctps;
1350 
1351 	/* User must supply a credential. */
1352 	if (credp == NULL)
1353 		return (NULL);
1354 
1355 	psctp = (sctp_t *)parent;
1356 	if (psctp != NULL) {
1357 		sctps = psctp->sctp_sctps;
1358 		/* Increase here to have common decrease at end */
1359 		netstack_hold(sctps->sctps_netstack);
1360 	} else {
1361 		netstack_t *ns;
1362 
1363 		ns = netstack_find_by_cred(credp);
1364 		ASSERT(ns != NULL);
1365 		sctps = ns->netstack_sctp;
1366 		ASSERT(sctps != NULL);
1367 
1368 		/*
1369 		 * For exclusive stacks we set the zoneid to zero
1370 		 * to make SCTP operate as if in the global zone.
1371 		 */
1372 		if (sctps->sctps_netstack->netstack_stackid !=
1373 		    GLOBAL_NETSTACKID)
1374 			zoneid = GLOBAL_ZONEID;
1375 		else
1376 			zoneid = crgetzoneid(credp);
1377 
1378 		/*
1379 		 * For stackid zero this is done from strplumb.c, but
1380 		 * non-zero stackids are handled here.
1381 		 */
1382 		if (sctps->sctps_g_q == NULL &&
1383 		    sctps->sctps_netstack->netstack_stackid !=
1384 		    GLOBAL_NETSTACKID) {
1385 			sctp_g_q_setup(sctps);
1386 		}
1387 	}
1388 	if ((sctp_connp = ipcl_conn_create(IPCL_SCTPCONN, sleep,
1389 	    sctps->sctps_netstack)) == NULL) {
1390 		netstack_rele(sctps->sctps_netstack);
1391 		SCTP_KSTAT(sctps, sctp_conn_create);
1392 		return (NULL);
1393 	}
1394 	/*
1395 	 * ipcl_conn_create did a netstack_hold. Undo the hold that was
1396 	 * done at top of sctp_create.
1397 	 */
1398 	netstack_rele(sctps->sctps_netstack);
1399 	sctp = CONN2SCTP(sctp_connp);
1400 	sctp->sctp_sctps = sctps;
1401 
1402 	sctp_connp->conn_ulp_labeled = is_system_labeled();
1403 	if ((ack_mp = sctp_timer_alloc(sctp, sctp_ack_timer, sleep)) == NULL ||
1404 	    (hb_mp = sctp_timer_alloc(sctp, sctp_heartbeat_timer,
1405 	    sleep)) == NULL) {
1406 		if (ack_mp != NULL)
1407 			freeb(ack_mp);
1408 		sctp_conn_clear(sctp_connp);
1409 		sctp->sctp_sctps = NULL;
1410 		SCTP_G_Q_REFRELE(sctps);
1411 		kmem_cache_free(sctp_conn_cache, sctp_connp);
1412 		return (NULL);
1413 	}
1414 
1415 	sctp->sctp_ack_mp = ack_mp;
1416 	sctp->sctp_heartbeat_mp = hb_mp;
1417 
1418 	switch (family) {
1419 	case AF_INET6:
1420 		sctp_connp->conn_af_isv6 = B_TRUE;
1421 		sctp->sctp_ipversion = IPV6_VERSION;
1422 		sctp->sctp_family = AF_INET6;
1423 		break;
1424 
1425 	case AF_INET:
1426 		sctp_connp->conn_af_isv6 = B_FALSE;
1427 		sctp_connp->conn_pkt_isv6 = B_FALSE;
1428 		sctp->sctp_ipversion = IPV4_VERSION;
1429 		sctp->sctp_family = AF_INET;
1430 		break;
1431 	default:
1432 		ASSERT(0);
1433 		break;
1434 	}
1435 	if (sctp_init_values(sctp, psctp, sleep) != 0) {
1436 		freeb(ack_mp);
1437 		freeb(hb_mp);
1438 		sctp_conn_clear(sctp_connp);
1439 		sctp->sctp_sctps = NULL;
1440 		SCTP_G_Q_REFRELE(sctps);
1441 		kmem_cache_free(sctp_conn_cache, sctp_connp);
1442 		return (NULL);
1443 	}
1444 	sctp->sctp_cansleep = ((flags & SCTP_CAN_BLOCK) == SCTP_CAN_BLOCK);
1445 
1446 	sctp->sctp_mss = sctps->sctps_initial_mtu - ((family == AF_INET6) ?
1447 	    sctp->sctp_hdr6_len : sctp->sctp_hdr_len);
1448 
1449 	if (psctp != NULL) {
1450 		RUN_SCTP(psctp);
1451 		/*
1452 		 * Inherit local address list, local port. Parent is either
1453 		 * in SCTPS_BOUND, or SCTPS_LISTEN state.
1454 		 */
1455 		ASSERT((psctp->sctp_state == SCTPS_BOUND) ||
1456 		    (psctp->sctp_state == SCTPS_LISTEN));
1457 		if (sctp_dup_saddrs(psctp, sctp, sleep)) {
1458 			WAKE_SCTP(psctp);
1459 			freeb(ack_mp);
1460 			freeb(hb_mp);
1461 			sctp_headers_free(sctp);
1462 			sctp_conn_clear(sctp_connp);
1463 			sctp->sctp_sctps = NULL;
1464 			SCTP_G_Q_REFRELE(sctps);
1465 			kmem_cache_free(sctp_conn_cache, sctp_connp);
1466 			return (NULL);
1467 		}
1468 
1469 		/*
1470 		 * If the parent is specified, it'll be immediatelly
1471 		 * followed by sctp_connect(). So don't add this guy to
1472 		 * bind hash.
1473 		 */
1474 		sctp->sctp_lport = psctp->sctp_lport;
1475 		sctp->sctp_state = SCTPS_BOUND;
1476 		sctp->sctp_allzones = psctp->sctp_allzones;
1477 		sctp->sctp_zoneid = psctp->sctp_zoneid;
1478 		WAKE_SCTP(psctp);
1479 	} else {
1480 		sctp->sctp_zoneid = zoneid;
1481 	}
1482 
1483 	sctp_connp->conn_cred = credp;
1484 	crhold(credp);
1485 
1486 	/*
1487 	 * If the caller has the process-wide flag set, then default to MAC
1488 	 * exempt mode.  This allows read-down to unlabeled hosts.
1489 	 */
1490 	if (getpflags(NET_MAC_AWARE, credp) != 0)
1491 		sctp_connp->conn_mac_exempt = B_TRUE;
1492 
1493 	/* Initialize SCTP instance values,  our verf tag must never be 0 */
1494 	(void) random_get_pseudo_bytes((uint8_t *)&sctp->sctp_lvtag,
1495 	    sizeof (sctp->sctp_lvtag));
1496 	if (sctp->sctp_lvtag == 0)
1497 		sctp->sctp_lvtag = (uint32_t)gethrtime();
1498 	ASSERT(sctp->sctp_lvtag != 0);
1499 
1500 	sctp->sctp_ltsn = sctp->sctp_lvtag + 1;
1501 	sctp->sctp_lcsn = sctp->sctp_ltsn;
1502 	sctp->sctp_recovery_tsn = sctp->sctp_lastack_rxd = sctp->sctp_ltsn - 1;
1503 	sctp->sctp_adv_pap = sctp->sctp_lastack_rxd;
1504 
1505 	/* Information required by upper layer */
1506 	if (sctp_ulpd != NULL) {
1507 		sctp->sctp_ulpd = sctp_ulpd;
1508 
1509 		ASSERT(sctp_upcalls != NULL);
1510 		bcopy(sctp_upcalls, &sctp->sctp_upcalls,
1511 		    sizeof (sctp_upcalls_t));
1512 		ASSERT(sbl != NULL);
1513 		/* Fill in the socket buffer limits for sctpsockfs */
1514 		sbl->sbl_txlowat = sctp->sctp_xmit_lowater;
1515 		sbl->sbl_txbuf = sctp->sctp_xmit_hiwater;
1516 		sbl->sbl_rxbuf = sctp->sctp_rwnd;
1517 		sbl->sbl_rxlowat = SCTP_RECV_LOWATER;
1518 	}
1519 	/* If no sctp_ulpd, must be creating the default sctp */
1520 	ASSERT(sctp_ulpd != NULL || sctps->sctps_gsctp == NULL);
1521 
1522 	/* Insert this in the global list. */
1523 	SCTP_LINK(sctp, sctps);
1524 
1525 	return (sctp);
1526 }
1527 
1528 /*
1529  * Make sure we wait until the default queue is setup, yet allow
1530  * sctp_g_q_create() to open a SCTP stream.
1531  * We need to allow sctp_g_q_create() do do an open
1532  * of sctp, hence we compare curhread.
1533  * All others have to wait until the sctps_g_q has been
1534  * setup.
1535  */
1536 void
1537 sctp_g_q_setup(sctp_stack_t *sctps)
1538 {
1539 	mutex_enter(&sctps->sctps_g_q_lock);
1540 	if (sctps->sctps_g_q != NULL) {
1541 		mutex_exit(&sctps->sctps_g_q_lock);
1542 		return;
1543 	}
1544 	if (sctps->sctps_g_q_creator == NULL) {
1545 		/* This thread will set it up */
1546 		sctps->sctps_g_q_creator = curthread;
1547 		mutex_exit(&sctps->sctps_g_q_lock);
1548 		sctp_g_q_create(sctps);
1549 		mutex_enter(&sctps->sctps_g_q_lock);
1550 		ASSERT(sctps->sctps_g_q_creator == curthread);
1551 		sctps->sctps_g_q_creator = NULL;
1552 		cv_signal(&sctps->sctps_g_q_cv);
1553 		ASSERT(sctps->sctps_g_q != NULL);
1554 		mutex_exit(&sctps->sctps_g_q_lock);
1555 		return;
1556 	}
1557 	/* Everybody but the creator has to wait */
1558 	if (sctps->sctps_g_q_creator != curthread) {
1559 		while (sctps->sctps_g_q == NULL)
1560 			cv_wait(&sctps->sctps_g_q_cv, &sctps->sctps_g_q_lock);
1561 	}
1562 	mutex_exit(&sctps->sctps_g_q_lock);
1563 }
1564 
1565 major_t IP_MAJ;
1566 #define	IP	"ip"
1567 
1568 #define	SCTP6DEV		"/devices/pseudo/sctp6@0:sctp6"
1569 
1570 /*
1571  * Create a default sctp queue here instead of in strplumb
1572  */
1573 void
1574 sctp_g_q_create(sctp_stack_t *sctps)
1575 {
1576 	int error;
1577 	ldi_handle_t	lh = NULL;
1578 	ldi_ident_t	li = NULL;
1579 	int		rval;
1580 	cred_t		*cr;
1581 
1582 #ifdef NS_DEBUG
1583 	(void) printf("sctp_g_q_create()for stack %d\n",
1584 	    sctps->sctps_netstack->netstack_stackid);
1585 #endif
1586 
1587 	ASSERT(sctps->sctps_g_q_creator == curthread);
1588 
1589 	error = ldi_ident_from_major(IP_MAJ, &li);
1590 	if (error) {
1591 #ifdef DEBUG
1592 		printf("sctp_g_q_create: lyr ident get failed error %d\n",
1593 		    error);
1594 #endif
1595 		return;
1596 	}
1597 
1598 	cr = zone_get_kcred(netstackid_to_zoneid(
1599 	    sctps->sctps_netstack->netstack_stackid));
1600 	ASSERT(cr != NULL);
1601 	/*
1602 	 * We set the sctp default queue to IPv6 because IPv4 falls
1603 	 * back to IPv6 when it can't find a client, but
1604 	 * IPv6 does not fall back to IPv4.
1605 	 */
1606 	error = ldi_open_by_name(SCTP6DEV, FREAD|FWRITE, cr, &lh, li);
1607 	if (error) {
1608 #ifdef DEBUG
1609 		printf("sctp_g_q_create: open of SCTP6DEV failed error %d\n",
1610 		    error);
1611 #endif
1612 		goto out;
1613 	}
1614 
1615 	/*
1616 	 * This ioctl causes the sctp framework to cache a pointer to
1617 	 * this stream, so we don't want to close the stream after
1618 	 * this operation.
1619 	 * Use the kernel credentials that are for the zone we're in.
1620 	 */
1621 	error = ldi_ioctl(lh, SCTP_IOC_DEFAULT_Q,
1622 	    (intptr_t)0, FKIOCTL, cr, &rval);
1623 	if (error) {
1624 #ifdef DEBUG
1625 		printf("sctp_g_q_create: ioctl SCTP_IOC_DEFAULT_Q failed "
1626 		    "error %d\n", error);
1627 #endif
1628 		goto out;
1629 	}
1630 	sctps->sctps_g_q_lh = lh;	/* For sctp_g_q_inactive */
1631 	lh = NULL;
1632 out:
1633 	/* Close layered handles */
1634 	if (li)
1635 		ldi_ident_release(li);
1636 	/* Keep cred around until _inactive needs it */
1637 	sctps->sctps_g_q_cr = cr;
1638 }
1639 
1640 /*
1641  * Remove the sctp_default queue so that new connections will not find it.
1642  * SCTP uses sctp_g_q for all transmission, so all sctp'ts implicitly
1643  * refer to it. Hence have each one have a reference on sctp_g_q_ref!
1644  *
1645  * We decrement the refcnt added in sctp_g_q_create. Once all the
1646  * sctp_t's which use the default go away, sctp_g_q_close will be called
1647  * and close the sctp_g_q. Once sctp_g_q is closed, sctp_close() will drop the
1648  * last reference count on the stack by calling netstack_rele().
1649  */
1650 void
1651 sctp_g_q_destroy(sctp_stack_t *sctps)
1652 {
1653 	if (sctps->sctps_g_q == NULL) {
1654 		return;	/* Nothing to cleanup */
1655 	}
1656 	/*
1657 	 * Keep sctps_g_q and sctps_gsctp until the last reference has
1658 	 * dropped, since the output is always done using those.
1659 	 * Need to decrement twice to take sctp_g_q_create and
1660 	 * the gsctp reference into account so that sctp_g_q_inactive is called
1661 	 * when all but the default queue remains.
1662 	 */
1663 #ifdef NS_DEBUG
1664 	(void) printf("sctp_g_q_destroy: ref %d\n",
1665 	    sctps->sctps_g_q_ref);
1666 #endif
1667 	SCTP_G_Q_REFRELE(sctps);
1668 }
1669 
1670 /*
1671  * Called when last user (could be sctp_g_q_destroy) drops reference count
1672  * using SCTP_G_Q_REFRELE.
1673  * Run by sctp_q_q_inactive using a taskq.
1674  */
1675 static void
1676 sctp_g_q_close(void *arg)
1677 {
1678 	sctp_stack_t *sctps = arg;
1679 	int error;
1680 	ldi_handle_t	lh = NULL;
1681 	ldi_ident_t	li = NULL;
1682 	cred_t		*cr;
1683 
1684 	lh = sctps->sctps_g_q_lh;
1685 	if (lh == NULL)
1686 		return;	/* Nothing to cleanup */
1687 
1688 	error = ldi_ident_from_major(IP_MAJ, &li);
1689 	if (error) {
1690 #ifdef NS_DEBUG
1691 		printf("sctp_g_q_inactive: lyr ident get failed error %d\n",
1692 		    error);
1693 #endif
1694 		return;
1695 	}
1696 
1697 	cr = sctps->sctps_g_q_cr;
1698 	sctps->sctps_g_q_cr = NULL;
1699 	ASSERT(cr != NULL);
1700 
1701 	/*
1702 	 * Make sure we can break the recursion when sctp_close decrements
1703 	 * the reference count causing g_q_inactive to be called again.
1704 	 */
1705 	sctps->sctps_g_q_lh = NULL;
1706 
1707 	/* close the default queue */
1708 	(void) ldi_close(lh, FREAD|FWRITE, cr);
1709 
1710 	/* Close layered handles */
1711 	ldi_ident_release(li);
1712 	crfree(cr);
1713 
1714 	ASSERT(sctps->sctps_g_q != NULL);
1715 	sctps->sctps_g_q = NULL;
1716 	/*
1717 	 * Now free sctps_gsctp.
1718 	 */
1719 	ASSERT(sctps->sctps_gsctp != NULL);
1720 	sctp_closei_local(sctps->sctps_gsctp);
1721 	SCTP_CONDEMNED(sctps->sctps_gsctp);
1722 	SCTP_REFRELE(sctps->sctps_gsctp);
1723 	sctps->sctps_gsctp = NULL;
1724 }
1725 
1726 /*
1727  * Called when last sctp_t drops reference count using SCTP_G_Q_REFRELE.
1728  *
1729  * Have to ensure that the ldi routines are not used by an
1730  * interrupt thread by using a taskq.
1731  */
1732 void
1733 sctp_g_q_inactive(sctp_stack_t *sctps)
1734 {
1735 	if (sctps->sctps_g_q_lh == NULL)
1736 		return;	/* Nothing to cleanup */
1737 
1738 	ASSERT(sctps->sctps_g_q_ref == 0);
1739 	SCTP_G_Q_REFHOLD(sctps); /* Compensate for what g_q_destroy did */
1740 
1741 	if (servicing_interrupt()) {
1742 		(void) taskq_dispatch(sctp_taskq, sctp_g_q_close,
1743 		    (void *) sctps, TQ_SLEEP);
1744 	} else {
1745 		sctp_g_q_close(sctps);
1746 	}
1747 }
1748 
1749 /* Run at module load time */
1750 void
1751 sctp_ddi_g_init(void)
1752 {
1753 	IP_MAJ = ddi_name_to_major(IP);
1754 
1755 	/* Create sctp_t/conn_t cache */
1756 	sctp_conn_cache_init();
1757 
1758 	/* Create the faddr cache */
1759 	sctp_faddr_init();
1760 
1761 	/* Create the sets cache */
1762 	sctp_sets_init();
1763 
1764 	/* Create the PR-SCTP sets cache */
1765 	sctp_ftsn_sets_init();
1766 
1767 	/* Initialize tables used for CRC calculation */
1768 	sctp_crc32_init();
1769 
1770 	sctp_taskq = taskq_create("sctp_taskq", 1, minclsyspri, 1, 1,
1771 	    TASKQ_PREPOPULATE);
1772 
1773 	/*
1774 	 * We want to be informed each time a stack is created or
1775 	 * destroyed in the kernel, so we can maintain the
1776 	 * set of sctp_stack_t's.
1777 	 */
1778 	netstack_register(NS_SCTP, sctp_stack_init, sctp_stack_shutdown,
1779 	    sctp_stack_fini);
1780 }
1781 
1782 static void *
1783 sctp_stack_init(netstackid_t stackid, netstack_t *ns)
1784 {
1785 	sctp_stack_t	*sctps;
1786 
1787 	sctps = kmem_zalloc(sizeof (*sctps), KM_SLEEP);
1788 	sctps->sctps_netstack = ns;
1789 
1790 	/* Initialize locks */
1791 	mutex_init(&sctps->sctps_g_q_lock, NULL, MUTEX_DEFAULT, NULL);
1792 	cv_init(&sctps->sctps_g_q_cv, NULL, CV_DEFAULT, NULL);
1793 	mutex_init(&sctps->sctps_g_lock, NULL, MUTEX_DEFAULT, NULL);
1794 	mutex_init(&sctps->sctps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
1795 	sctps->sctps_g_num_epriv_ports = SCTP_NUM_EPRIV_PORTS;
1796 	sctps->sctps_g_epriv_ports[0] = 2049;
1797 	sctps->sctps_g_epriv_ports[1] = 4045;
1798 
1799 	/* Initialize SCTP hash arrays. */
1800 	sctp_hash_init(sctps);
1801 
1802 	if (!sctp_nd_init(sctps)) {
1803 		sctp_nd_free(sctps);
1804 	}
1805 
1806 	/* Initialize the recvq taskq. */
1807 	sctp_rq_tq_init(sctps);
1808 
1809 	/* saddr init */
1810 	sctp_saddr_init(sctps);
1811 
1812 	/* Global SCTP PCB list. */
1813 	list_create(&sctps->sctps_g_list, sizeof (sctp_t),
1814 	    offsetof(sctp_t, sctp_list));
1815 
1816 	/* Initialize sctp kernel stats. */
1817 	sctps->sctps_mibkp = sctp_kstat_init(stackid);
1818 	sctps->sctps_kstat =
1819 	    sctp_kstat2_init(stackid, &sctps->sctps_statistics);
1820 
1821 	return (sctps);
1822 }
1823 
1824 /*
1825  * Called when the module is about to be unloaded.
1826  */
1827 void
1828 sctp_ddi_g_destroy(void)
1829 {
1830 	/* Destroy sctp_t/conn_t caches */
1831 	sctp_conn_cache_fini();
1832 
1833 	/* Destroy the faddr cache */
1834 	sctp_faddr_fini();
1835 
1836 	/* Destroy the sets cache */
1837 	sctp_sets_fini();
1838 
1839 	/* Destroy the PR-SCTP sets cache */
1840 	sctp_ftsn_sets_fini();
1841 
1842 	netstack_unregister(NS_SCTP);
1843 	taskq_destroy(sctp_taskq);
1844 }
1845 
1846 /*
1847  * Shut down the SCTP stack instance.
1848  */
1849 /* ARGSUSED */
1850 static void
1851 sctp_stack_shutdown(netstackid_t stackid, void *arg)
1852 {
1853 	sctp_stack_t *sctps = (sctp_stack_t *)arg;
1854 
1855 	sctp_g_q_destroy(sctps);
1856 }
1857 
1858 /*
1859  * Free the SCTP stack instance.
1860  */
1861 static void
1862 sctp_stack_fini(netstackid_t stackid, void *arg)
1863 {
1864 	sctp_stack_t *sctps = (sctp_stack_t *)arg;
1865 
1866 	sctp_nd_free(sctps);
1867 
1868 	/* Destroy the recvq taskqs. */
1869 	sctp_rq_tq_fini(sctps);
1870 
1871 	/* Destroy saddr  */
1872 	sctp_saddr_fini(sctps);
1873 
1874 	/* Global SCTP PCB list. */
1875 	list_destroy(&sctps->sctps_g_list);
1876 
1877 	/* Destroy SCTP hash arrays. */
1878 	sctp_hash_destroy(sctps);
1879 
1880 	/* Destroy SCTP kernel stats. */
1881 	sctp_kstat2_fini(stackid, sctps->sctps_kstat);
1882 	sctps->sctps_kstat = NULL;
1883 	bzero(&sctps->sctps_statistics, sizeof (sctps->sctps_statistics));
1884 
1885 	sctp_kstat_fini(stackid, sctps->sctps_mibkp);
1886 	sctps->sctps_mibkp = NULL;
1887 
1888 	mutex_destroy(&sctps->sctps_g_lock);
1889 	mutex_destroy(&sctps->sctps_epriv_port_lock);
1890 	mutex_destroy(&sctps->sctps_g_q_lock);
1891 	cv_destroy(&sctps->sctps_g_q_cv);
1892 
1893 	kmem_free(sctps, sizeof (*sctps));
1894 }
1895 
1896 void
1897 sctp_display_all(sctp_stack_t *sctps)
1898 {
1899 	sctp_t *sctp_walker;
1900 
1901 	mutex_enter(&sctps->sctps_g_lock);
1902 	for (sctp_walker = sctps->sctps_gsctp; sctp_walker != NULL;
1903 	    sctp_walker = (sctp_t *)list_next(&sctps->sctps_g_list,
1904 	    sctp_walker)) {
1905 		(void) sctp_display(sctp_walker, NULL);
1906 	}
1907 	mutex_exit(&sctps->sctps_g_lock);
1908 }
1909 
1910 static void
1911 sctp_rq_tq_init(sctp_stack_t *sctps)
1912 {
1913 	sctps->sctps_recvq_tq_list_max_sz = 16;
1914 	sctps->sctps_recvq_tq_list_cur_sz = 1;
1915 	/*
1916 	 * Initialize the recvq_tq_list and create the first recvq taskq.
1917 	 * What to do if it fails?
1918 	 */
1919 	sctps->sctps_recvq_tq_list =
1920 	    kmem_zalloc(sctps->sctps_recvq_tq_list_max_sz * sizeof (taskq_t *),
1921 	    KM_SLEEP);
1922 	sctps->sctps_recvq_tq_list[0] = taskq_create("sctp_def_recvq_taskq",
1923 	    MIN(sctp_recvq_tq_thr_max, MAX(sctp_recvq_tq_thr_min, ncpus)),
1924 	    minclsyspri, sctp_recvq_tq_task_min, sctp_recvq_tq_task_max,
1925 	    TASKQ_PREPOPULATE);
1926 	mutex_init(&sctps->sctps_rq_tq_lock, NULL, MUTEX_DEFAULT, NULL);
1927 }
1928 
1929 static void
1930 sctp_rq_tq_fini(sctp_stack_t *sctps)
1931 {
1932 	int i;
1933 
1934 	for (i = 0; i < sctps->sctps_recvq_tq_list_cur_sz; i++) {
1935 		ASSERT(sctps->sctps_recvq_tq_list[i] != NULL);
1936 		taskq_destroy(sctps->sctps_recvq_tq_list[i]);
1937 	}
1938 	kmem_free(sctps->sctps_recvq_tq_list,
1939 	    sctps->sctps_recvq_tq_list_max_sz * sizeof (taskq_t *));
1940 	sctps->sctps_recvq_tq_list = NULL;
1941 }
1942 
1943 /* Add another taskq for a new ill. */
1944 void
1945 sctp_inc_taskq(sctp_stack_t *sctps)
1946 {
1947 	taskq_t *tq;
1948 	char tq_name[TASKQ_NAMELEN];
1949 
1950 	mutex_enter(&sctps->sctps_rq_tq_lock);
1951 	if (sctps->sctps_recvq_tq_list_cur_sz + 1 >
1952 	    sctps->sctps_recvq_tq_list_max_sz) {
1953 		mutex_exit(&sctps->sctps_rq_tq_lock);
1954 		cmn_err(CE_NOTE, "Cannot create more SCTP recvq taskq");
1955 		return;
1956 	}
1957 
1958 	(void) snprintf(tq_name, sizeof (tq_name), "sctp_recvq_taskq_%u",
1959 	    sctps->sctps_recvq_tq_list_cur_sz);
1960 	tq = taskq_create(tq_name,
1961 	    MIN(sctp_recvq_tq_thr_max, MAX(sctp_recvq_tq_thr_min, ncpus)),
1962 	    minclsyspri, sctp_recvq_tq_task_min, sctp_recvq_tq_task_max,
1963 	    TASKQ_PREPOPULATE);
1964 	if (tq == NULL) {
1965 		mutex_exit(&sctps->sctps_rq_tq_lock);
1966 		cmn_err(CE_NOTE, "SCTP recvq taskq creation failed");
1967 		return;
1968 	}
1969 	ASSERT(sctps->sctps_recvq_tq_list[
1970 	    sctps->sctps_recvq_tq_list_cur_sz] == NULL);
1971 	sctps->sctps_recvq_tq_list[sctps->sctps_recvq_tq_list_cur_sz] = tq;
1972 	atomic_add_32(&sctps->sctps_recvq_tq_list_cur_sz, 1);
1973 	mutex_exit(&sctps->sctps_rq_tq_lock);
1974 }
1975 
1976 #ifdef DEBUG
1977 uint32_t sendq_loop_cnt = 0;
1978 uint32_t sendq_collision = 0;
1979 uint32_t sendq_empty = 0;
1980 #endif
1981 
1982 void
1983 sctp_add_sendq(sctp_t *sctp, mblk_t *mp)
1984 {
1985 	mutex_enter(&sctp->sctp_sendq_lock);
1986 	if (sctp->sctp_sendq == NULL) {
1987 		sctp->sctp_sendq = mp;
1988 		sctp->sctp_sendq_tail = mp;
1989 	} else {
1990 		sctp->sctp_sendq_tail->b_next = mp;
1991 		sctp->sctp_sendq_tail = mp;
1992 	}
1993 	mutex_exit(&sctp->sctp_sendq_lock);
1994 }
1995 
1996 void
1997 sctp_process_sendq(sctp_t *sctp)
1998 {
1999 	mblk_t *mp;
2000 #ifdef DEBUG
2001 	uint32_t loop_cnt = 0;
2002 #endif
2003 
2004 	mutex_enter(&sctp->sctp_sendq_lock);
2005 	if (sctp->sctp_sendq == NULL || sctp->sctp_sendq_sending) {
2006 #ifdef DEBUG
2007 		if (sctp->sctp_sendq == NULL)
2008 			sendq_empty++;
2009 		else
2010 			sendq_collision++;
2011 #endif
2012 		mutex_exit(&sctp->sctp_sendq_lock);
2013 		return;
2014 	}
2015 	sctp->sctp_sendq_sending = B_TRUE;
2016 
2017 	/*
2018 	 * Note that while we are in this loop, other thread can put
2019 	 * new packets in the receive queue.  We may be looping for
2020 	 * quite a while.  This is OK even for an interrupt thread.
2021 	 * The reason is that SCTP should only able to send a limited
2022 	 * number of packets out in a burst.  So the number of times
2023 	 * we go through this loop should not be many.
2024 	 */
2025 	while ((mp = sctp->sctp_sendq) != NULL) {
2026 		sctp->sctp_sendq = mp->b_next;
2027 		ASSERT(sctp->sctp_connp->conn_ref > 0);
2028 		mutex_exit(&sctp->sctp_sendq_lock);
2029 		mp->b_next = NULL;
2030 		CONN_INC_REF(sctp->sctp_connp);
2031 		mp->b_flag |= MSGHASREF;
2032 		/* If we don't have sctp_current, default to IPv4 */
2033 		IP_PUT(mp, sctp->sctp_connp, sctp->sctp_current == NULL ?
2034 		    B_TRUE : sctp->sctp_current->isv4);
2035 		BUMP_LOCAL(sctp->sctp_opkts);
2036 #ifdef DEBUG
2037 		loop_cnt++;
2038 #endif
2039 		mutex_enter(&sctp->sctp_sendq_lock);
2040 	}
2041 
2042 	sctp->sctp_sendq_tail = NULL;
2043 	sctp->sctp_sendq_sending = B_FALSE;
2044 #ifdef DEBUG
2045 	if (loop_cnt > sendq_loop_cnt)
2046 		sendq_loop_cnt = loop_cnt;
2047 #endif
2048 	mutex_exit(&sctp->sctp_sendq_lock);
2049 }
2050 
2051 #ifdef DEBUG
2052 uint32_t recvq_loop_cnt = 0;
2053 uint32_t recvq_call = 0;
2054 #endif
2055 
2056 /*
2057  * Find the next recvq_tq to use.  This routine will go thru all the
2058  * taskqs until it can dispatch a job for the sctp.  If this fails,
2059  * it will create a new taskq and try it.
2060  */
2061 static boolean_t
2062 sctp_find_next_tq(sctp_t *sctp)
2063 {
2064 	int next_tq, try;
2065 	taskq_t *tq;
2066 	sctp_stack_t	*sctps = sctp->sctp_sctps;
2067 
2068 	/*
2069 	 * Note that since we don't hold a lock on sctp_rq_tq_lock for
2070 	 * performance reason, recvq_ta_list_cur_sz can be changed during
2071 	 * this loop.  The problem this will create is that the loop may
2072 	 * not have tried all the recvq_tq.  This should be OK.
2073 	 */
2074 	next_tq = atomic_add_32_nv(&sctps->sctps_recvq_tq_list_cur, 1) %
2075 	    sctps->sctps_recvq_tq_list_cur_sz;
2076 	for (try = 0; try < sctps->sctps_recvq_tq_list_cur_sz; try++) {
2077 		tq = sctps->sctps_recvq_tq_list[next_tq];
2078 		if (taskq_dispatch(tq, sctp_process_recvq, sctp,
2079 		    TQ_NOSLEEP) != NULL) {
2080 			sctp->sctp_recvq_tq = tq;
2081 			return (B_TRUE);
2082 		}
2083 		next_tq = (next_tq + 1) % sctps->sctps_recvq_tq_list_cur_sz;
2084 	}
2085 
2086 	/*
2087 	 * Create one more taskq and try it.  Note that sctp_inc_taskq()
2088 	 * may not have created another taskq if the number of recvq
2089 	 * taskqs is at the maximum.  We are probably in a pretty bad
2090 	 * shape if this actually happens...
2091 	 */
2092 	sctp_inc_taskq(sctps);
2093 	tq = sctps->sctps_recvq_tq_list[sctps->sctps_recvq_tq_list_cur_sz - 1];
2094 	if (taskq_dispatch(tq, sctp_process_recvq, sctp, TQ_NOSLEEP) != NULL) {
2095 		sctp->sctp_recvq_tq = tq;
2096 		return (B_TRUE);
2097 	}
2098 	SCTP_KSTAT(sctps, sctp_find_next_tq);
2099 	return (B_FALSE);
2100 }
2101 
2102 /*
2103  * To add a message to the recvq.  Note that the sctp_timer_fire()
2104  * routine also uses this function to add the timer message to the
2105  * receive queue for later processing.  And it should be the only
2106  * caller of sctp_add_recvq() which sets the try_harder argument
2107  * to B_TRUE.
2108  *
2109  * If the try_harder argument is B_TRUE, this routine sctp_find_next_tq()
2110  * will try very hard to dispatch the task.  Refer to the comment
2111  * for that routine on how it does that.
2112  */
2113 boolean_t
2114 sctp_add_recvq(sctp_t *sctp, mblk_t *mp, boolean_t caller_hold_lock)
2115 {
2116 	if (!caller_hold_lock)
2117 		mutex_enter(&sctp->sctp_recvq_lock);
2118 
2119 	/* If the taskq dispatch has not been scheduled, do it now. */
2120 	if (sctp->sctp_recvq_tq == NULL) {
2121 		ASSERT(sctp->sctp_recvq == NULL);
2122 		if (!sctp_find_next_tq(sctp)) {
2123 			if (!caller_hold_lock)
2124 				mutex_exit(&sctp->sctp_recvq_lock);
2125 			return (B_FALSE);
2126 		}
2127 		/* Make sure the sctp_t will not go away. */
2128 		SCTP_REFHOLD(sctp);
2129 	}
2130 
2131 	if (sctp->sctp_recvq == NULL) {
2132 		sctp->sctp_recvq = mp;
2133 		sctp->sctp_recvq_tail = mp;
2134 	} else {
2135 		sctp->sctp_recvq_tail->b_next = mp;
2136 		sctp->sctp_recvq_tail = mp;
2137 	}
2138 
2139 	if (!caller_hold_lock)
2140 		mutex_exit(&sctp->sctp_recvq_lock);
2141 	return (B_TRUE);
2142 }
2143 
2144 static void
2145 sctp_process_recvq(void *arg)
2146 {
2147 	sctp_t		*sctp = (sctp_t *)arg;
2148 	mblk_t		*mp;
2149 	mblk_t		*ipsec_mp;
2150 #ifdef DEBUG
2151 	uint32_t	loop_cnt = 0;
2152 #endif
2153 
2154 #ifdef	_BIG_ENDIAN
2155 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 28) & 0x7)
2156 #else
2157 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 4) & 0x7)
2158 #endif
2159 
2160 	RUN_SCTP(sctp);
2161 	mutex_enter(&sctp->sctp_recvq_lock);
2162 
2163 #ifdef DEBUG
2164 	recvq_call++;
2165 #endif
2166 	/*
2167 	 * Note that while we are in this loop, other thread can put
2168 	 * new packets in the receive queue.  We may be looping for
2169 	 * quite a while.
2170 	 */
2171 	while ((mp = sctp->sctp_recvq) != NULL) {
2172 		sctp->sctp_recvq = mp->b_next;
2173 		mutex_exit(&sctp->sctp_recvq_lock);
2174 		mp->b_next = NULL;
2175 #ifdef DEBUG
2176 		loop_cnt++;
2177 #endif
2178 		ipsec_mp = mp->b_prev;
2179 		mp->b_prev = NULL;
2180 		sctp_input_data(sctp, mp, ipsec_mp);
2181 
2182 		mutex_enter(&sctp->sctp_recvq_lock);
2183 	}
2184 
2185 	sctp->sctp_recvq_tail = NULL;
2186 	sctp->sctp_recvq_tq = NULL;
2187 
2188 	mutex_exit(&sctp->sctp_recvq_lock);
2189 
2190 	WAKE_SCTP(sctp);
2191 
2192 	/* We may have sent something when processing the receive queue. */
2193 	sctp_process_sendq(sctp);
2194 #ifdef DEBUG
2195 	if (loop_cnt > recvq_loop_cnt)
2196 		recvq_loop_cnt = loop_cnt;
2197 #endif
2198 	/* Now it can go away. */
2199 	SCTP_REFRELE(sctp);
2200 }
2201 
2202 /* ARGSUSED */
2203 static int
2204 sctp_conn_cache_constructor(void *buf, void *cdrarg, int kmflags)
2205 {
2206 	conn_t	*sctp_connp = (conn_t *)buf;
2207 	sctp_t	*sctp = (sctp_t *)&sctp_connp[1];
2208 
2209 	bzero(buf, (char *)&sctp[1] - (char *)buf);
2210 
2211 	sctp->sctp_connp = sctp_connp;
2212 	mutex_init(&sctp->sctp_reflock, NULL, MUTEX_DEFAULT, NULL);
2213 	mutex_init(&sctp->sctp_lock, NULL, MUTEX_DEFAULT, NULL);
2214 	mutex_init(&sctp->sctp_recvq_lock, NULL, MUTEX_DEFAULT, NULL);
2215 	cv_init(&sctp->sctp_cv, NULL, CV_DEFAULT, NULL);
2216 	mutex_init(&sctp->sctp_sendq_lock, NULL, MUTEX_DEFAULT, NULL);
2217 
2218 	return (0);
2219 }
2220 
2221 /* ARGSUSED */
2222 static void
2223 sctp_conn_cache_destructor(void *buf, void *cdrarg)
2224 {
2225 	conn_t	*sctp_connp = (conn_t *)buf;
2226 	sctp_t	*sctp = (sctp_t *)&sctp_connp[1];
2227 
2228 	ASSERT(!MUTEX_HELD(&sctp->sctp_lock));
2229 	ASSERT(!MUTEX_HELD(&sctp->sctp_reflock));
2230 	ASSERT(!MUTEX_HELD(&sctp->sctp_recvq_lock));
2231 	ASSERT(!MUTEX_HELD(&sctp->sctp_sendq_lock));
2232 	ASSERT(!MUTEX_HELD(&sctp->sctp_connp->conn_lock));
2233 
2234 	ASSERT(sctp->sctp_conn_hash_next == NULL);
2235 	ASSERT(sctp->sctp_conn_hash_prev == NULL);
2236 	ASSERT(sctp->sctp_listen_hash_next == NULL);
2237 	ASSERT(sctp->sctp_listen_hash_prev == NULL);
2238 	ASSERT(sctp->sctp_listen_tfp == NULL);
2239 	ASSERT(sctp->sctp_conn_tfp == NULL);
2240 
2241 	ASSERT(sctp->sctp_faddrs == NULL);
2242 	ASSERT(sctp->sctp_nsaddrs == 0);
2243 
2244 	ASSERT(sctp->sctp_ulpd == NULL);
2245 
2246 	ASSERT(sctp->sctp_lastfaddr == NULL);
2247 	ASSERT(sctp->sctp_primary == NULL);
2248 	ASSERT(sctp->sctp_current == NULL);
2249 	ASSERT(sctp->sctp_lastdata == NULL);
2250 
2251 	ASSERT(sctp->sctp_xmit_head == NULL);
2252 	ASSERT(sctp->sctp_xmit_tail == NULL);
2253 	ASSERT(sctp->sctp_xmit_unsent == NULL);
2254 	ASSERT(sctp->sctp_xmit_unsent_tail == NULL);
2255 
2256 	ASSERT(sctp->sctp_ostrcntrs == NULL);
2257 
2258 	ASSERT(sctp->sctp_sack_info == NULL);
2259 	ASSERT(sctp->sctp_ack_mp == NULL);
2260 	ASSERT(sctp->sctp_instr == NULL);
2261 
2262 	ASSERT(sctp->sctp_iphc == NULL);
2263 	ASSERT(sctp->sctp_iphc6 == NULL);
2264 	ASSERT(sctp->sctp_ipha == NULL);
2265 	ASSERT(sctp->sctp_ip6h == NULL);
2266 	ASSERT(sctp->sctp_sctph == NULL);
2267 	ASSERT(sctp->sctp_sctph6 == NULL);
2268 
2269 	ASSERT(sctp->sctp_cookie_mp == NULL);
2270 
2271 	ASSERT(sctp->sctp_refcnt == 0);
2272 	ASSERT(sctp->sctp_timer_mp == NULL);
2273 	ASSERT(sctp->sctp_connp->conn_ref == 0);
2274 	ASSERT(sctp->sctp_heartbeat_mp == NULL);
2275 	ASSERT(sctp->sctp_ptpbhn == NULL && sctp->sctp_bind_hash == NULL);
2276 
2277 	ASSERT(sctp->sctp_shutdown_faddr == NULL);
2278 
2279 	ASSERT(sctp->sctp_cxmit_list == NULL);
2280 
2281 	ASSERT(sctp->sctp_recvq == NULL);
2282 	ASSERT(sctp->sctp_recvq_tail == NULL);
2283 	ASSERT(sctp->sctp_recvq_tq == NULL);
2284 
2285 	ASSERT(sctp->sctp_sendq == NULL);
2286 	ASSERT(sctp->sctp_sendq_tail == NULL);
2287 	ASSERT(sctp->sctp_sendq_sending == B_FALSE);
2288 
2289 	ASSERT(sctp->sctp_ipp_hopopts == NULL);
2290 	ASSERT(sctp->sctp_ipp_rtdstopts == NULL);
2291 	ASSERT(sctp->sctp_ipp_rthdr == NULL);
2292 	ASSERT(sctp->sctp_ipp_dstopts == NULL);
2293 	ASSERT(sctp->sctp_ipp_pathmtu == NULL);
2294 
2295 	/*
2296 	 * sctp_pad_mp can be NULL if the memory allocation fails
2297 	 * in sctp_init_values() and the conn_t is freed.
2298 	 */
2299 	if (sctp->sctp_pad_mp != NULL) {
2300 		freeb(sctp->sctp_pad_mp);
2301 		sctp->sctp_pad_mp = NULL;
2302 	}
2303 
2304 	mutex_destroy(&sctp->sctp_reflock);
2305 	mutex_destroy(&sctp->sctp_lock);
2306 	mutex_destroy(&sctp->sctp_recvq_lock);
2307 	cv_destroy(&sctp->sctp_cv);
2308 	mutex_destroy(&sctp->sctp_sendq_lock);
2309 
2310 }
2311 
2312 static void
2313 sctp_conn_cache_init()
2314 {
2315 	sctp_conn_cache = kmem_cache_create("sctp_conn_cache",
2316 	    sizeof (sctp_t) + sizeof (conn_t), 0, sctp_conn_cache_constructor,
2317 	    sctp_conn_cache_destructor, NULL, NULL, NULL, 0);
2318 }
2319 
2320 static void
2321 sctp_conn_cache_fini()
2322 {
2323 	kmem_cache_destroy(sctp_conn_cache);
2324 }
2325 
2326 void
2327 sctp_conn_init(conn_t *connp)
2328 {
2329 	connp->conn_flags = IPCL_SCTPCONN;
2330 	connp->conn_rq = connp->conn_wq = NULL;
2331 	connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
2332 	connp->conn_ulp = IPPROTO_SCTP;
2333 	connp->conn_state_flags |= CONN_INCIPIENT;
2334 	mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
2335 	cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);
2336 }
2337 
2338 static void
2339 sctp_conn_clear(conn_t *connp)
2340 {
2341 	/* Clean up conn_t stuff */
2342 	if (connp->conn_latch != NULL)
2343 		IPLATCH_REFRELE(connp->conn_latch, connp->conn_netstack);
2344 	if (connp->conn_policy != NULL)
2345 		IPPH_REFRELE(connp->conn_policy, connp->conn_netstack);
2346 	if (connp->conn_ipsec_opt_mp != NULL)
2347 		freemsg(connp->conn_ipsec_opt_mp);
2348 	mutex_destroy(&connp->conn_lock);
2349 	cv_destroy(&connp->conn_cv);
2350 	netstack_rele(connp->conn_netstack);
2351 	bzero(connp, sizeof (struct conn_s));
2352 }
2353