xref: /titanic_44/usr/src/uts/common/inet/sctp/sctp.c (revision b11e536c7bee7ad575c31194d5e3da89f572ebb5)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/stream.h>
31 #include <sys/strsubr.h>
32 #include <sys/stropts.h>
33 #include <sys/strsun.h>
34 #define	_SUN_TPI_VERSION 2
35 #include <sys/tihdr.h>
36 #include <sys/ddi.h>
37 #include <sys/sunddi.h>
38 #include <sys/xti_inet.h>
39 #include <sys/cmn_err.h>
40 #include <sys/debug.h>
41 #include <sys/vtrace.h>
42 #include <sys/kmem.h>
43 #include <sys/cpuvar.h>
44 #include <sys/random.h>
45 #include <sys/priv.h>
46 
47 #include <sys/errno.h>
48 #include <sys/signal.h>
49 #include <sys/socket.h>
50 #include <sys/isa_defs.h>
51 #include <netinet/in.h>
52 #include <netinet/tcp.h>
53 #include <netinet/ip6.h>
54 #include <netinet/icmp6.h>
55 #include <netinet/sctp.h>
56 #include <net/if.h>
57 
58 #include <inet/common.h>
59 #include <inet/ip.h>
60 #include <inet/ip6.h>
61 #include <inet/mi.h>
62 #include <inet/mib2.h>
63 #include <inet/nd.h>
64 #include <inet/optcom.h>
65 #include <inet/ipclassifier.h>
66 #include <inet/ipsec_impl.h>
67 #include <inet/sctp_ip.h>
68 #include <inet/sctp_crc32.h>
69 
70 #include "sctp_impl.h"
71 #include "sctp_addr.h"
72 #include "sctp_asconf.h"
73 
74 extern major_t SCTP6_MAJ;
75 extern major_t SCTP_MAJ;
76 
77 int sctpdebug;
78 sin6_t	sctp_sin6_null;	/* Zero address for quick clears */
79 
80 extern mblk_t *sctp_pad_mp;	/* pad unaligned data chunks */
81 
82 static void	sctp_closei_local(sctp_t *sctp);
83 static int	sctp_init_values(sctp_t *, sctp_t *, int);
84 static void	sctp_icmp_error_ipv6(sctp_t *sctp, mblk_t *mp);
85 static void	sctp_process_recvq(void *);
86 static void	sctp_rq_tq_init(void);
87 static void	sctp_rq_tq_fini(void);
88 static void	sctp_conn_cache_init();
89 static void	sctp_conn_cache_fini();
90 static int	sctp_conn_cache_constructor();
91 static void	sctp_conn_cache_destructor();
92 
93 /*
94  * SCTP receive queue taskq
95  *
96  * At SCTP initialization time, a default taskq is created for
97  * servicing packets received when the interrupt thread cannot
98  * get a hold on the sctp_t.  The number of taskq can be increased in
99  * sctp_find_next_tq() when an existing taskq cannot be dispatched.
100  * The taskqs are never removed.  But the max number of taskq which
101  * can be created is controlled by sctp_recvq_tq_list_max_sz.  Note
102  * that SCTP recvq taskq is not tied to any specific CPU or ill.
103  *
104  * Those taskqs are stored in an array recvq_tq_list.  And they are
105  * used in a round robin fashion.  The current taskq being used is
106  * determined by recvq_tq_list_cur.
107  */
108 
109 /* This lock protects the SCTP recvq_tq_list array and recvq_tq_list_cur_sz. */
110 static kmutex_t	sctp_rq_tq_lock;
111 int		sctp_recvq_tq_list_max_sz = 16;
112 static taskq_t	**recvq_tq_list;
113 
114 /* Current number of recvq taskq.  At least 1 for the default taskq. */
115 static uint32_t	recvq_tq_list_cur_sz = 1;
116 static uint32_t	recvq_tq_list_cur = 0;
117 
118 /* The minimum number of threads for each taskq. */
119 int		sctp_recvq_tq_thr_min = 4;
120 /* The maximum number of threads for each taskq. */
121 int		sctp_recvq_tq_thr_max = 16;
122 /* The minimum number of tasks for each taskq. */
123 int		sctp_recvq_tq_task_min = 5;
124 /* The maxiimum number of tasks for each taskq. */
125 int		sctp_recvq_tq_task_max = 50;
126 
127 /*
128  * Default queue used for sending packets.  No need to have lock for it
129  * as it should never be changed.
130  */
131 queue_t	*sctp_g_q;
132 int sctp_g_q_fd;
133 /* The default sctp_t for responding out of the blue packets. */
134 sctp_t *gsctp;
135 
136 /* Protected by sctp_g_lock */
137 list_t	sctp_g_list;	/* SCTP instance data chain */
138 kmutex_t sctp_g_lock;
139 
140 /*  sctp_t/conn_t kmem cache */
141 struct kmem_cache	*sctp_conn_cache;
142 
143 #define	SCTP_CONDEMNED(sctp)				\
144 	mutex_enter(&(sctp)->sctp_reflock);		\
145 	((sctp)->sctp_condemned = B_TRUE);		\
146 	mutex_exit(&(sctp)->sctp_reflock);
147 
148 /* Link/unlink a sctp_t to/from the global list. */
149 #define	SCTP_LINK(sctp)					\
150 	mutex_enter(&sctp_g_lock);			\
151 	list_insert_tail(&sctp_g_list, (sctp));		\
152 	mutex_exit(&sctp_g_lock);
153 
154 #define	SCTP_UNLINK(sctp)				\
155 	mutex_enter(&sctp_g_lock);			\
156 	ASSERT((sctp)->sctp_condemned);			\
157 	list_remove(&sctp_g_list, (sctp));		\
158 	mutex_exit(&sctp_g_lock);
159 
160 /*
161  * Hooks for Sun Cluster. On non-clustered nodes these will remain NULL.
162  * PSARC/2005/602.
163  */
164 void (*cl_sctp_listen)(sa_family_t, uchar_t *, uint_t, in_port_t) = NULL;
165 void (*cl_sctp_unlisten)(sa_family_t, uchar_t *, uint_t, in_port_t) = NULL;
166 void (*cl_sctp_connect)(sa_family_t, uchar_t *, uint_t, in_port_t,
167     uchar_t *, uint_t, in_port_t, boolean_t, cl_sctp_handle_t) = NULL;
168 void (*cl_sctp_disconnect)(sa_family_t, cl_sctp_handle_t) = NULL;
169 void (*cl_sctp_assoc_change)(sa_family_t, uchar_t *, size_t, uint_t,
170     uchar_t *, size_t, uint_t, int, cl_sctp_handle_t) = NULL;
171 void (*cl_sctp_check_addrs)(sa_family_t, in_port_t, uchar_t **, size_t,
172     uint_t *, boolean_t) = NULL;
173 /*
174  * Return the version number of the SCTP kernel interface.
175  */
176 int
177 sctp_itf_ver(int cl_ver)
178 {
179 	if (cl_ver != SCTP_ITF_VER)
180 		return (-1);
181 	return (SCTP_ITF_VER);
182 }
183 
184 /*
185  * Called when we need a new sctp instantiation but don't really have a
186  * new q to hang it off of. Copy the priv flag from the passed in structure.
187  */
188 sctp_t *
189 sctp_create_eager(sctp_t *psctp)
190 {
191 	sctp_t	*sctp;
192 	mblk_t	*ack_mp, *hb_mp;
193 	conn_t	*connp, *pconnp;
194 	cred_t *credp;
195 
196 	if ((connp = ipcl_conn_create(IPCL_SCTPCONN, KM_NOSLEEP)) == NULL)
197 		return (NULL);
198 
199 	connp->conn_ulp_labeled = is_system_labeled();
200 
201 	sctp = CONN2SCTP(connp);
202 
203 	if ((ack_mp = sctp_timer_alloc(sctp, sctp_ack_timer)) == NULL ||
204 	    (hb_mp = sctp_timer_alloc(sctp, sctp_heartbeat_timer)) == NULL) {
205 		if (ack_mp != NULL)
206 			freeb(ack_mp);
207 		kmem_cache_free(sctp_conn_cache, connp);
208 		return (NULL);
209 	}
210 
211 	sctp->sctp_ack_mp = ack_mp;
212 	sctp->sctp_heartbeat_mp = hb_mp;
213 
214 	/* Inherit information from the "parent" */
215 	sctp->sctp_ipversion = psctp->sctp_ipversion;
216 	sctp->sctp_family = psctp->sctp_family;
217 	pconnp = psctp->sctp_connp;
218 	connp->conn_af_isv6 = pconnp->conn_af_isv6;
219 	connp->conn_pkt_isv6 = pconnp->conn_pkt_isv6;
220 	connp->conn_ipv6_v6only = pconnp->conn_ipv6_v6only;
221 	if (sctp_init_values(sctp, psctp, KM_NOSLEEP) != 0) {
222 		freeb(ack_mp);
223 		freeb(hb_mp);
224 		kmem_cache_free(sctp_conn_cache, connp);
225 		return (NULL);
226 	}
227 
228 	/*
229 	 * If the parent is multilevel, then we'll fix up the remote cred
230 	 * when we do sctp_accept_comm.
231 	 */
232 	if ((credp = pconnp->conn_cred) != NULL) {
233 		connp->conn_cred = credp;
234 		crhold(credp);
235 		/*
236 		 * If the caller has the process-wide flag set, then default to
237 		 * MAC exempt mode.  This allows read-down to unlabeled hosts.
238 		 */
239 		if (getpflags(NET_MAC_AWARE, credp) != 0)
240 			connp->conn_mac_exempt = B_TRUE;
241 	}
242 	connp->conn_zoneid = psctp->sctp_zoneid;
243 	sctp->sctp_mss = psctp->sctp_mss;
244 	sctp->sctp_detached = B_TRUE;
245 	/*
246 	 * Link to the global as soon as possible so that this sctp_t
247 	 * can be found.
248 	 */
249 	SCTP_LINK(sctp);
250 
251 	return (sctp);
252 }
253 
254 /*
255  * We are dying for some reason.  Try to do it gracefully.
256  */
257 void
258 sctp_clean_death(sctp_t *sctp, int err)
259 {
260 	ASSERT(sctp != NULL);
261 	ASSERT((sctp->sctp_family == AF_INET &&
262 	    sctp->sctp_ipversion == IPV4_VERSION) ||
263 	    (sctp->sctp_family == AF_INET6 &&
264 	    (sctp->sctp_ipversion == IPV4_VERSION ||
265 	    sctp->sctp_ipversion == IPV6_VERSION)));
266 
267 	dprint(3, ("sctp_clean_death %p, state %d\n", (void *)sctp,
268 	    sctp->sctp_state));
269 
270 	sctp->sctp_client_errno = err;
271 	/*
272 	 * Check to see if we need to notify upper layer.
273 	 */
274 	if ((sctp->sctp_state >= SCTPS_COOKIE_WAIT) &&
275 	    !SCTP_IS_DETACHED(sctp)) {
276 		if (sctp->sctp_xmit_head || sctp->sctp_xmit_unsent) {
277 			sctp_regift_xmitlist(sctp);
278 		}
279 		if (sctp->sctp_ulp_disconnected(sctp->sctp_ulpd, err)) {
280 			/*
281 			 * Socket is gone, detach.
282 			 */
283 			sctp->sctp_detached = B_TRUE;
284 			sctp->sctp_ulpd = NULL;
285 			bzero(&sctp->sctp_upcalls, sizeof (sctp_upcalls_t));
286 		}
287 	}
288 
289 	/* Remove this sctp from all hashes. */
290 	sctp_closei_local(sctp);
291 
292 	/*
293 	 * If the sctp_t is detached, we need to finish freeing up
294 	 * the resources.  At this point, ip_fanout_sctp() should have
295 	 * a hold on this sctp_t.  Some thread doing snmp stuff can
296 	 * have a hold.  And a taskq can also have a hold waiting to
297 	 * work.  sctp_unlink() the sctp_t from the global list so
298 	 * that no new thread can find it.  Then do a SCTP_REFRELE().
299 	 * The sctp_t will be freed after all those threads are done.
300 	 */
301 	if (SCTP_IS_DETACHED(sctp)) {
302 		SCTP_CONDEMNED(sctp);
303 		SCTP_REFRELE(sctp);
304 	}
305 }
306 
307 /*
308  * Called by upper layer when it wants to close this association.
309  * Depending on the state of this assoication, we need to do
310  * different things.
311  *
312  * If the state is below COOKIE_ECHOED or it is COOKIE_ECHOED but with
313  * no sent data, just remove this sctp from all the hashes.  This
314  * makes sure that all packets from the other end will go to the default
315  * sctp handling.  The upper layer will then do a sctp_close() to clean
316  * up.
317  *
318  * Otherwise, check and see if SO_LINGER is set.  If it is set, check
319  * the value.  If the value is 0, consider this an abortive close.  Send
320  * an ABORT message and kill the associatiion.
321  *
322  */
323 int
324 sctp_disconnect(sctp_t *sctp)
325 {
326 	int	error = 0;
327 
328 	dprint(3, ("sctp_disconnect %p, state %d\n", (void *)sctp,
329 	    sctp->sctp_state));
330 
331 	RUN_SCTP(sctp);
332 
333 	switch (sctp->sctp_state) {
334 	case SCTPS_IDLE:
335 	case SCTPS_BOUND:
336 	case SCTPS_LISTEN:
337 		break;
338 	case SCTPS_COOKIE_WAIT:
339 	case SCTPS_COOKIE_ECHOED:
340 		/*
341 		 * Close during the connect 3-way handshake
342 		 * but here there may or may not be pending data
343 		 * already on queue. Process almost same as in
344 		 * the ESTABLISHED state.
345 		 */
346 		if (sctp->sctp_xmit_head == NULL &&
347 		    sctp->sctp_xmit_unsent == NULL) {
348 			break;
349 		}
350 		/* FALLTHRU */
351 	default:
352 		/*
353 		 * If SO_LINGER has set a zero linger time, abort the
354 		 * connection with a reset.
355 		 */
356 		if (sctp->sctp_linger && sctp->sctp_lingertime == 0) {
357 			sctp_user_abort(sctp, NULL, B_FALSE);
358 			break;
359 		}
360 
361 		/*
362 		 * In there is unread data, send an ABORT
363 		 */
364 		if (sctp->sctp_rxqueued > 0 || sctp->sctp_irwnd >
365 		    sctp->sctp_rwnd) {
366 			sctp_user_abort(sctp, NULL, B_FALSE);
367 			break;
368 		}
369 		/*
370 		 * Transmit the shutdown before detaching the sctp_t.
371 		 * After sctp_detach returns this queue/perimeter
372 		 * no longer owns the sctp_t thus others can modify it.
373 		 */
374 		sctp_send_shutdown(sctp, 0);
375 
376 		/* Pass gathered wisdom to IP for keeping */
377 		sctp_update_ire(sctp);
378 
379 		/*
380 		 * If lingering on close then wait until the shutdown
381 		 * is complete, or the SO_LINGER time passes, or an
382 		 * ABORT is sent/received.  Note that sctp_disconnect()
383 		 * can be called more than once.  Make sure that only
384 		 * one thread waits.
385 		 */
386 		if (sctp->sctp_linger && sctp->sctp_lingertime > 0 &&
387 		    sctp->sctp_state >= SCTPS_ESTABLISHED &&
388 		    !sctp->sctp_lingering) {
389 			clock_t stoptime;	/* in ticks */
390 			clock_t ret;
391 
392 			/*
393 			 * Process the sendq to send the SHUTDOWN out
394 			 * before waiting.
395 			 */
396 			sctp_process_sendq(sctp);
397 
398 			sctp->sctp_lingering = 1;
399 			sctp->sctp_client_errno = 0;
400 			stoptime = lbolt + sctp->sctp_lingertime;
401 
402 			mutex_enter(&sctp->sctp_lock);
403 			sctp->sctp_running = B_FALSE;
404 			while (sctp->sctp_state >= SCTPS_ESTABLISHED &&
405 			    sctp->sctp_client_errno == 0) {
406 				cv_broadcast(&sctp->sctp_cv);
407 				ret = cv_timedwait_sig(&sctp->sctp_cv,
408 				    &sctp->sctp_lock, stoptime);
409 				if (ret < 0) {
410 					/* Stoptime has reached. */
411 					sctp->sctp_client_errno = EWOULDBLOCK;
412 					break;
413 				} else if (ret == 0) {
414 					/* Got a signal. */
415 					break;
416 				}
417 			}
418 			error = sctp->sctp_client_errno;
419 			sctp->sctp_client_errno = 0;
420 			mutex_exit(&sctp->sctp_lock);
421 		}
422 
423 		WAKE_SCTP(sctp);
424 		sctp_process_sendq(sctp);
425 		return (error);
426 	}
427 
428 
429 	/* Remove this sctp from all hashes so nobody can find it. */
430 	sctp_closei_local(sctp);
431 	WAKE_SCTP(sctp);
432 	return (error);
433 }
434 
435 void
436 sctp_close(sctp_t *sctp)
437 {
438 	dprint(3, ("sctp_close %p, state %d\n", (void *)sctp,
439 	    sctp->sctp_state));
440 
441 	RUN_SCTP(sctp);
442 	sctp->sctp_detached = 1;
443 	sctp->sctp_ulpd = NULL;
444 	bzero(&sctp->sctp_upcalls, sizeof (sctp_upcalls_t));
445 	bzero(&sctp->sctp_events, sizeof (sctp->sctp_events));
446 
447 	/* If the graceful shutdown has not been completed, just return. */
448 	if (sctp->sctp_state != SCTPS_IDLE) {
449 		WAKE_SCTP(sctp);
450 		return;
451 	}
452 
453 	/*
454 	 * Since sctp_t is in SCTPS_IDLE state, so the only thread which
455 	 * can have a hold on the sctp_t is doing snmp stuff.  Just do
456 	 * a SCTP_REFRELE() here after the SCTP_UNLINK().  It will
457 	 * be freed when the other thread is done.
458 	 */
459 	SCTP_CONDEMNED(sctp);
460 	WAKE_SCTP(sctp);
461 	SCTP_REFRELE(sctp);
462 }
463 
464 /*
465  * Unlink from global list and do the eager close.
466  * Remove the refhold implicit in being on the global list.
467  */
468 void
469 sctp_close_eager(sctp_t *sctp)
470 {
471 	SCTP_CONDEMNED(sctp);
472 	sctp_closei_local(sctp);
473 	SCTP_REFRELE(sctp);
474 }
475 
476 /*
477  * The sctp_t is going away. Remove it from all lists and set it
478  * to SCTPS_IDLE. The caller has to remove it from the
479  * global list. The freeing up of memory is deferred until
480  * sctp_free(). This is needed since a thread in sctp_input() might have
481  * done a SCTP_REFHOLD on this structure before it was removed from the
482  * hashes.
483  */
484 static void
485 sctp_closei_local(sctp_t *sctp)
486 {
487 	mblk_t	*mp;
488 	ire_t	*ire = NULL;
489 	conn_t	*connp = sctp->sctp_connp;
490 
491 	/* Stop and free the timers */
492 	sctp_free_faddr_timers(sctp);
493 	if ((mp = sctp->sctp_heartbeat_mp) != NULL) {
494 		sctp_timer_free(mp);
495 		sctp->sctp_heartbeat_mp = NULL;
496 	}
497 	if ((mp = sctp->sctp_ack_mp) != NULL) {
498 		sctp_timer_free(mp);
499 		sctp->sctp_ack_mp = NULL;
500 	}
501 
502 	/* Set the CONN_CLOSING flag so that IP will not cache IRE again. */
503 	mutex_enter(&connp->conn_lock);
504 	connp->conn_state_flags |= CONN_CLOSING;
505 	ire = connp->conn_ire_cache;
506 	connp->conn_ire_cache = NULL;
507 	mutex_exit(&connp->conn_lock);
508 	if (ire != NULL)
509 		IRE_REFRELE_NOTR(ire);
510 
511 	/* Remove from all hashes. */
512 	sctp_bind_hash_remove(sctp);
513 	sctp_conn_hash_remove(sctp);
514 	sctp_listen_hash_remove(sctp);
515 	sctp->sctp_state = SCTPS_IDLE;
516 
517 	/*
518 	 * Clean up the recvq as much as possible.  All those packets
519 	 * will be silently dropped as this sctp_t is now in idle state.
520 	 */
521 	mutex_enter(&sctp->sctp_recvq_lock);
522 	while ((mp = sctp->sctp_recvq) != NULL) {
523 		mblk_t *ipsec_mp;
524 
525 		sctp->sctp_recvq = mp->b_next;
526 		mp->b_next = NULL;
527 		if ((ipsec_mp = mp->b_prev) != NULL) {
528 			freeb(ipsec_mp);
529 			mp->b_prev = NULL;
530 		}
531 		freemsg(mp);
532 	}
533 	mutex_exit(&sctp->sctp_recvq_lock);
534 }
535 
536 /*
537  * Free memory associated with the sctp/ip header template.
538  */
539 static void
540 sctp_headers_free(sctp_t *sctp)
541 {
542 	if (sctp->sctp_iphc != NULL) {
543 		kmem_free(sctp->sctp_iphc, sctp->sctp_iphc_len);
544 		sctp->sctp_iphc = NULL;
545 		sctp->sctp_ipha = NULL;
546 		sctp->sctp_hdr_len = 0;
547 		sctp->sctp_ip_hdr_len = 0;
548 		sctp->sctp_iphc_len = 0;
549 		sctp->sctp_sctph = NULL;
550 		sctp->sctp_hdr_len = 0;
551 	}
552 	if (sctp->sctp_iphc6 != NULL) {
553 		kmem_free(sctp->sctp_iphc6, sctp->sctp_iphc6_len);
554 		sctp->sctp_iphc6 = NULL;
555 		sctp->sctp_ip6h = NULL;
556 		sctp->sctp_hdr6_len = 0;
557 		sctp->sctp_ip_hdr6_len = 0;
558 		sctp->sctp_iphc6_len = 0;
559 		sctp->sctp_sctph6 = NULL;
560 		sctp->sctp_hdr6_len = 0;
561 	}
562 }
563 
564 static void
565 sctp_free_xmit_data(sctp_t *sctp)
566 {
567 	mblk_t	*ump = NULL;
568 	mblk_t	*nump;
569 	mblk_t	*mp;
570 	mblk_t	*nmp;
571 
572 	sctp->sctp_xmit_unacked = NULL;
573 	ump = sctp->sctp_xmit_head;
574 	sctp->sctp_xmit_tail = sctp->sctp_xmit_head = NULL;
575 free_unsent:
576 	for (; ump != NULL; ump = nump) {
577 		for (mp = ump->b_cont; mp != NULL; mp = nmp) {
578 			nmp = mp->b_next;
579 			mp->b_next = NULL;
580 			mp->b_prev = NULL;
581 			freemsg(mp);
582 		}
583 		ASSERT(DB_REF(ump) == 1);
584 		nump = ump->b_next;
585 		ump->b_next = NULL;
586 		ump->b_prev = NULL;
587 		ump->b_cont = NULL;
588 		freeb(ump);
589 	}
590 	if ((ump = sctp->sctp_xmit_unsent) == NULL) {
591 		ASSERT(sctp->sctp_xmit_unsent_tail == NULL);
592 		return;
593 	}
594 	sctp->sctp_xmit_unsent = sctp->sctp_xmit_unsent_tail = NULL;
595 	goto free_unsent;
596 }
597 
598 /*
599  * Cleanup all the messages in the stream queue and the reassembly lists.
600  * If 'free' is true, then delete the streams as well.
601  */
602 void
603 sctp_instream_cleanup(sctp_t *sctp, boolean_t free)
604 {
605 	int	i;
606 	mblk_t	*mp;
607 	mblk_t	*mp1;
608 
609 	if (sctp->sctp_instr != NULL) {
610 		/* walk thru and flush out anything remaining in the Q */
611 		for (i = 0; i < sctp->sctp_num_istr; i++) {
612 			mp = sctp->sctp_instr[i].istr_msgs;
613 			while (mp != NULL) {
614 				mp1 = mp->b_next;
615 				mp->b_next = mp->b_prev = NULL;
616 				freemsg(mp);
617 				mp = mp1;
618 			}
619 			sctp->sctp_instr[i].istr_msgs = NULL;
620 			sctp_free_reass((sctp->sctp_instr) + i);
621 			sctp->sctp_instr[i].nextseq = 0;
622 		}
623 		if (free) {
624 			kmem_free(sctp->sctp_instr,
625 			    sizeof (*sctp->sctp_instr) * sctp->sctp_num_istr);
626 			sctp->sctp_instr = NULL;
627 			sctp->sctp_num_istr = 0;
628 		}
629 	}
630 	/* un-ordered fragments */
631 	if (sctp->sctp_uo_frags != NULL) {
632 		for (mp = sctp->sctp_uo_frags; mp != NULL; mp = mp1) {
633 			mp1 = mp->b_next;
634 			mp->b_next = mp->b_prev = NULL;
635 			freemsg(mp);
636 		}
637 	}
638 }
639 
640 /*
641  * Last reference to the sctp_t is gone. Free all memory associated with it.
642  * Called from SCTP_REFRELE. Called inline in sctp_close()
643  */
644 void
645 sctp_free(conn_t *connp)
646 {
647 	sctp_t *sctp = CONN2SCTP(connp);
648 	int		cnt;
649 
650 	/* Unlink it from the global list */
651 	SCTP_UNLINK(sctp);
652 
653 	ASSERT(connp->conn_ref == 0);
654 	ASSERT(connp->conn_ulp == IPPROTO_SCTP);
655 	ASSERT(!MUTEX_HELD(&sctp->sctp_reflock));
656 	ASSERT(sctp->sctp_refcnt == 0);
657 
658 	ASSERT(sctp->sctp_ptpbhn == NULL && sctp->sctp_bind_hash == NULL);
659 	ASSERT(sctp->sctp_conn_hash_next == NULL &&
660 	    sctp->sctp_conn_hash_prev == NULL);
661 
662 
663 	/* Free up all the resources. */
664 
665 	/* blow away sctp stream management */
666 	if (sctp->sctp_ostrcntrs != NULL) {
667 		kmem_free(sctp->sctp_ostrcntrs,
668 		    sizeof (uint16_t) * sctp->sctp_num_ostr);
669 		sctp->sctp_ostrcntrs = NULL;
670 	}
671 	sctp_instream_cleanup(sctp, B_TRUE);
672 
673 	/* Remove all data transfer resources. */
674 	sctp->sctp_istr_nmsgs = 0;
675 	sctp->sctp_rxqueued = 0;
676 	sctp_free_xmit_data(sctp);
677 	sctp->sctp_unacked = 0;
678 	sctp->sctp_unsent = 0;
679 	if (sctp->sctp_cxmit_list != NULL)
680 		sctp_asconf_free_cxmit(sctp, NULL);
681 
682 	sctp->sctp_lastdata = NULL;
683 
684 	/* Clear out default xmit settings */
685 	sctp->sctp_def_stream = 0;
686 	sctp->sctp_def_flags = 0;
687 	sctp->sctp_def_ppid = 0;
688 	sctp->sctp_def_context = 0;
689 	sctp->sctp_def_timetolive = 0;
690 
691 	if (sctp->sctp_sack_info != NULL) {
692 		sctp_free_set(sctp->sctp_sack_info);
693 		sctp->sctp_sack_info = NULL;
694 	}
695 	sctp->sctp_sack_gaps = 0;
696 
697 	if (sctp->sctp_cookie_mp != NULL) {
698 		freemsg(sctp->sctp_cookie_mp);
699 		sctp->sctp_cookie_mp = NULL;
700 	}
701 
702 	/* Remove all the address resources. */
703 	sctp_zap_addrs(sctp);
704 	for (cnt = 0; cnt < SCTP_IPIF_HASH; cnt++) {
705 		ASSERT(sctp->sctp_saddrs[cnt].ipif_count == 0);
706 		list_destroy(&sctp->sctp_saddrs[cnt].sctp_ipif_list);
707 	}
708 
709 	ip6_pkt_free(&sctp->sctp_sticky_ipp);
710 
711 	if (sctp->sctp_hopopts != NULL) {
712 		mi_free(sctp->sctp_hopopts);
713 		sctp->sctp_hopopts = NULL;
714 		sctp->sctp_hopoptslen = 0;
715 	}
716 	ASSERT(sctp->sctp_hopoptslen == 0);
717 	if (sctp->sctp_dstopts != NULL) {
718 		mi_free(sctp->sctp_dstopts);
719 		sctp->sctp_dstopts = NULL;
720 		sctp->sctp_dstoptslen = 0;
721 	}
722 	ASSERT(sctp->sctp_dstoptslen == 0);
723 	if (sctp->sctp_rtdstopts != NULL) {
724 		mi_free(sctp->sctp_rtdstopts);
725 		sctp->sctp_rtdstopts = NULL;
726 		sctp->sctp_rtdstoptslen = 0;
727 	}
728 	ASSERT(sctp->sctp_rtdstoptslen == 0);
729 	if (sctp->sctp_rthdr != NULL) {
730 		mi_free(sctp->sctp_rthdr);
731 		sctp->sctp_rthdr = NULL;
732 		sctp->sctp_rthdrlen = 0;
733 	}
734 	ASSERT(sctp->sctp_rthdrlen == 0);
735 	sctp_headers_free(sctp);
736 
737 	sctp->sctp_shutdown_faddr = NULL;
738 
739 	/* Clear all the bitfields. */
740 	bzero(&sctp->sctp_bits, sizeof (sctp->sctp_bits));
741 
742 	/* It is time to update the global statistics. */
743 	UPDATE_MIB(&sctp_mib, sctpOutSCTPPkts, sctp->sctp_opkts);
744 	UPDATE_MIB(&sctp_mib, sctpOutCtrlChunks, sctp->sctp_obchunks);
745 	UPDATE_MIB(&sctp_mib, sctpOutOrderChunks, sctp->sctp_odchunks);
746 	UPDATE_MIB(&sctp_mib, sctpOutUnorderChunks, sctp->sctp_oudchunks);
747 	UPDATE_MIB(&sctp_mib, sctpRetransChunks, sctp->sctp_rxtchunks);
748 	UPDATE_MIB(&sctp_mib, sctpInSCTPPkts, sctp->sctp_ipkts);
749 	UPDATE_MIB(&sctp_mib, sctpInCtrlChunks, sctp->sctp_ibchunks);
750 	UPDATE_MIB(&sctp_mib, sctpInOrderChunks, sctp->sctp_idchunks);
751 	UPDATE_MIB(&sctp_mib, sctpInUnorderChunks, sctp->sctp_iudchunks);
752 	UPDATE_MIB(&sctp_mib, sctpFragUsrMsgs, sctp->sctp_fragdmsgs);
753 	UPDATE_MIB(&sctp_mib, sctpReasmUsrMsgs, sctp->sctp_reassmsgs);
754 	sctp->sctp_opkts = 0;
755 	sctp->sctp_obchunks = 0;
756 	sctp->sctp_odchunks = 0;
757 	sctp->sctp_oudchunks = 0;
758 	sctp->sctp_rxtchunks = 0;
759 	sctp->sctp_ipkts = 0;
760 	sctp->sctp_ibchunks = 0;
761 	sctp->sctp_idchunks = 0;
762 	sctp->sctp_iudchunks = 0;
763 	sctp->sctp_fragdmsgs = 0;
764 	sctp->sctp_reassmsgs = 0;
765 
766 	sctp->sctp_autoclose = 0;
767 	sctp->sctp_tx_adaption_code = 0;
768 
769 	/* Clean up conn_t stuff */
770 	connp->conn_policy_cached = B_FALSE;
771 	if (connp->conn_latch != NULL) {
772 		IPLATCH_REFRELE(connp->conn_latch);
773 		connp->conn_latch = NULL;
774 	}
775 	if (connp->conn_policy != NULL) {
776 		IPPH_REFRELE(connp->conn_policy);
777 		connp->conn_policy = NULL;
778 	}
779 	if (connp->conn_ipsec_opt_mp != NULL) {
780 		freemsg(connp->conn_ipsec_opt_mp);
781 		connp->conn_ipsec_opt_mp = NULL;
782 	}
783 	if (connp->conn_cred != NULL) {
784 		crfree(connp->conn_cred);
785 		connp->conn_cred = NULL;
786 	}
787 
788 	kmem_cache_free(sctp_conn_cache, connp);
789 }
790 
791 /* Diagnostic routine used to return a string associated with the sctp state. */
792 char *
793 sctp_display(sctp_t *sctp, char *sup_buf)
794 {
795 	char	*buf;
796 	char	buf1[30];
797 	static char	priv_buf[INET6_ADDRSTRLEN * 2 + 80];
798 	char	*cp;
799 
800 	if (sctp == NULL)
801 		return ("NULL_SCTP");
802 
803 	buf = (sup_buf != NULL) ? sup_buf : priv_buf;
804 
805 	switch (sctp->sctp_state) {
806 	case SCTPS_IDLE:
807 		cp = "SCTP_IDLE";
808 		break;
809 	case SCTPS_BOUND:
810 		cp = "SCTP_BOUND";
811 		break;
812 	case SCTPS_LISTEN:
813 		cp = "SCTP_LISTEN";
814 		break;
815 	case SCTPS_COOKIE_WAIT:
816 		cp = "SCTP_COOKIE_WAIT";
817 		break;
818 	case SCTPS_COOKIE_ECHOED:
819 		cp = "SCTP_COOKIE_ECHOED";
820 		break;
821 	case SCTPS_ESTABLISHED:
822 		cp = "SCTP_ESTABLISHED";
823 		break;
824 	case SCTPS_SHUTDOWN_PENDING:
825 		cp = "SCTP_SHUTDOWN_PENDING";
826 		break;
827 	case SCTPS_SHUTDOWN_SENT:
828 		cp = "SCTPS_SHUTDOWN_SENT";
829 		break;
830 	case SCTPS_SHUTDOWN_RECEIVED:
831 		cp = "SCTPS_SHUTDOWN_RECEIVED";
832 		break;
833 	case SCTPS_SHUTDOWN_ACK_SENT:
834 		cp = "SCTPS_SHUTDOWN_ACK_SENT";
835 		break;
836 	default:
837 		(void) mi_sprintf(buf1, "SCTPUnkState(%d)", sctp->sctp_state);
838 		cp = buf1;
839 		break;
840 	}
841 	(void) mi_sprintf(buf, "[%u, %u] %s",
842 	    ntohs(sctp->sctp_lport), ntohs(sctp->sctp_fport), cp);
843 
844 	return (buf);
845 }
846 
847 /*
848  * Initialize protocol control block. If a parent exists, inherit
849  * all values set through setsockopt().
850  */
851 static int
852 sctp_init_values(sctp_t *sctp, sctp_t *psctp, int sleep)
853 {
854 	int	err;
855 	int	cnt;
856 
857 	ASSERT((sctp->sctp_family == AF_INET &&
858 	    sctp->sctp_ipversion == IPV4_VERSION) ||
859 	    (sctp->sctp_family == AF_INET6 &&
860 	    (sctp->sctp_ipversion == IPV4_VERSION ||
861 	    sctp->sctp_ipversion == IPV6_VERSION)));
862 
863 	sctp->sctp_nsaddrs = 0;
864 	for (cnt = 0; cnt < SCTP_IPIF_HASH; cnt++) {
865 		sctp->sctp_saddrs[cnt].ipif_count = 0;
866 		list_create(&sctp->sctp_saddrs[cnt].sctp_ipif_list,
867 		    sizeof (sctp_saddr_ipif_t), offsetof(sctp_saddr_ipif_t,
868 		    saddr_ipif));
869 	}
870 	sctp->sctp_ports = 0;
871 	sctp->sctp_running = B_FALSE;
872 	sctp->sctp_state = SCTPS_IDLE;
873 
874 	sctp->sctp_refcnt = 1;
875 
876 	sctp->sctp_strikes = 0;
877 
878 	sctp->sctp_last_mtu_probe = lbolt64;
879 	sctp->sctp_mtu_probe_intvl = sctp_mtu_probe_interval;
880 
881 	sctp->sctp_sack_gaps = 0;
882 	sctp->sctp_sack_toggle = 2;
883 
884 	if (psctp != NULL) {
885 		/*
886 		 * Inherit from parent
887 		 */
888 		sctp->sctp_iphc = kmem_zalloc(psctp->sctp_iphc_len,
889 		    KM_NOSLEEP);
890 		if (sctp->sctp_iphc == NULL)
891 			return (ENOMEM);
892 		sctp->sctp_iphc_len = psctp->sctp_iphc_len;
893 		sctp->sctp_hdr_len = psctp->sctp_hdr_len;
894 
895 		sctp->sctp_iphc6 = kmem_zalloc(psctp->sctp_iphc6_len,
896 		    KM_NOSLEEP);
897 		if (sctp->sctp_iphc6 == NULL) {
898 			sctp->sctp_iphc6_len = 0;
899 			return (ENOMEM);
900 		}
901 		sctp->sctp_iphc6_len = psctp->sctp_iphc6_len;
902 		sctp->sctp_hdr6_len = psctp->sctp_hdr6_len;
903 
904 		sctp->sctp_ip_hdr_len = psctp->sctp_ip_hdr_len;
905 		sctp->sctp_ip_hdr6_len = psctp->sctp_ip_hdr6_len;
906 
907 		/*
908 		 * Copy the IP+SCTP header templates from listener
909 		 */
910 		bcopy(psctp->sctp_iphc, sctp->sctp_iphc,
911 		    psctp->sctp_hdr_len);
912 		sctp->sctp_ipha = (ipha_t *)sctp->sctp_iphc;
913 		sctp->sctp_sctph = (sctp_hdr_t *)(sctp->sctp_iphc +
914 		    sctp->sctp_ip_hdr_len);
915 
916 		bcopy(psctp->sctp_iphc6, sctp->sctp_iphc6,
917 		    psctp->sctp_hdr6_len);
918 		if (((ip6i_t *)(sctp->sctp_iphc6))->ip6i_nxt == IPPROTO_RAW) {
919 			sctp->sctp_ip6h = (ip6_t *)(sctp->sctp_iphc6 +
920 			    sizeof (ip6i_t));
921 		} else {
922 			sctp->sctp_ip6h = (ip6_t *)sctp->sctp_iphc6;
923 		}
924 		sctp->sctp_sctph6 = (sctp_hdr_t *)(sctp->sctp_iphc6 +
925 		    sctp->sctp_ip_hdr6_len);
926 
927 		sctp->sctp_cookie_lifetime = psctp->sctp_cookie_lifetime;
928 		sctp->sctp_xmit_lowater = psctp->sctp_xmit_lowater;
929 		sctp->sctp_xmit_hiwater = psctp->sctp_xmit_hiwater;
930 		sctp->sctp_cwnd_max = psctp->sctp_cwnd_max;
931 		sctp->sctp_rwnd = psctp->sctp_rwnd;
932 		sctp->sctp_irwnd = psctp->sctp_rwnd;
933 
934 		sctp->sctp_rto_max = psctp->sctp_rto_max;
935 		sctp->sctp_init_rto_max = psctp->sctp_init_rto_max;
936 		sctp->sctp_rto_min = psctp->sctp_rto_min;
937 		sctp->sctp_rto_initial = psctp->sctp_rto_initial;
938 		sctp->sctp_pa_max_rxt = psctp->sctp_pa_max_rxt;
939 		sctp->sctp_pp_max_rxt = psctp->sctp_pp_max_rxt;
940 		sctp->sctp_max_init_rxt = psctp->sctp_max_init_rxt;
941 
942 		sctp->sctp_def_stream = psctp->sctp_def_stream;
943 		sctp->sctp_def_flags = psctp->sctp_def_flags;
944 		sctp->sctp_def_ppid = psctp->sctp_def_ppid;
945 		sctp->sctp_def_context = psctp->sctp_def_context;
946 		sctp->sctp_def_timetolive = psctp->sctp_def_timetolive;
947 
948 		sctp->sctp_num_istr = psctp->sctp_num_istr;
949 		sctp->sctp_num_ostr = psctp->sctp_num_ostr;
950 
951 		sctp->sctp_hb_interval = psctp->sctp_hb_interval;
952 		sctp->sctp_autoclose = psctp->sctp_autoclose;
953 		sctp->sctp_tx_adaption_code = psctp->sctp_tx_adaption_code;
954 
955 		/* xxx should be a better way to copy these flags xxx */
956 		sctp->sctp_debug = psctp->sctp_debug;
957 		sctp->sctp_dontroute = psctp->sctp_dontroute;
958 		sctp->sctp_useloopback = psctp->sctp_useloopback;
959 		sctp->sctp_broadcast = psctp->sctp_broadcast;
960 		sctp->sctp_reuseaddr = psctp->sctp_reuseaddr;
961 		sctp->sctp_bound_to_all = psctp->sctp_bound_to_all;
962 		sctp->sctp_cansleep = psctp->sctp_cansleep;
963 		sctp->sctp_send_adaption = psctp->sctp_send_adaption;
964 		sctp->sctp_ndelay = psctp->sctp_ndelay;
965 		sctp->sctp_events = psctp->sctp_events;
966 		sctp->sctp_ipv6_recvancillary = psctp->sctp_ipv6_recvancillary;
967 	} else {
968 		/*
969 		 * Initialize the header template
970 		 */
971 		if ((err = sctp_header_init_ipv4(sctp, sleep)) != 0) {
972 			return (err);
973 		}
974 		if ((err = sctp_header_init_ipv6(sctp, sleep)) != 0) {
975 			return (err);
976 		}
977 
978 		/*
979 		 * Set to system defaults
980 		 */
981 		sctp->sctp_cookie_lifetime = MSEC_TO_TICK(sctp_cookie_life);
982 		sctp->sctp_xmit_lowater = sctp_xmit_lowat;
983 		sctp->sctp_xmit_hiwater = sctp_xmit_hiwat;
984 		sctp->sctp_cwnd_max = sctp_cwnd_max_;
985 		sctp->sctp_rwnd = sctp_recv_hiwat;
986 		sctp->sctp_irwnd = sctp->sctp_rwnd;
987 		sctp->sctp_rto_max = MSEC_TO_TICK(sctp_rto_maxg);
988 		sctp->sctp_init_rto_max = sctp->sctp_rto_max;
989 		sctp->sctp_rto_min = MSEC_TO_TICK(sctp_rto_ming);
990 		sctp->sctp_rto_initial = MSEC_TO_TICK(sctp_rto_initialg);
991 		sctp->sctp_pa_max_rxt = sctp_pa_max_retr;
992 		sctp->sctp_pp_max_rxt = sctp_pp_max_retr;
993 		sctp->sctp_max_init_rxt = sctp_max_init_retr;
994 
995 		sctp->sctp_num_istr = sctp_max_in_streams;
996 		sctp->sctp_num_ostr = sctp_initial_out_streams;
997 
998 		sctp->sctp_hb_interval = MSEC_TO_TICK(sctp_heartbeat_interval);
999 	}
1000 	sctp->sctp_understands_asconf = B_TRUE;
1001 	sctp->sctp_understands_addip = B_TRUE;
1002 	sctp->sctp_prsctp_aware = B_FALSE;
1003 
1004 	sctp->sctp_connp->conn_ref = 1;
1005 	sctp->sctp_connp->conn_fully_bound = B_FALSE;
1006 
1007 	sctp->sctp_prsctpdrop = 0;
1008 	sctp->sctp_msgcount = 0;
1009 
1010 	return (0);
1011 }
1012 
1013 /*
1014  * Extracts the init tag from an INIT chunk and checks if it matches
1015  * the sctp's verification tag. Returns 0 if it doesn't match, 1 if
1016  * it does.
1017  */
1018 static boolean_t
1019 sctp_icmp_verf(sctp_t *sctp, sctp_hdr_t *sh, mblk_t *mp)
1020 {
1021 	sctp_chunk_hdr_t *sch;
1022 	uint32_t verf, *vp;
1023 
1024 	sch = (sctp_chunk_hdr_t *)(sh + 1);
1025 	vp = (uint32_t *)(sch + 1);
1026 
1027 	/* Need at least the data chunk hdr and the first 4 bytes of INIT */
1028 	if ((unsigned char *)(vp + 1) > mp->b_wptr) {
1029 		return (B_FALSE);
1030 	}
1031 
1032 	bcopy(vp, &verf, sizeof (verf));
1033 
1034 	if (verf == sctp->sctp_lvtag) {
1035 		return (B_TRUE);
1036 	}
1037 	return (B_FALSE);
1038 }
1039 
1040 /*
1041  * sctp_icmp_error is called by sctp_input() to process ICMP error messages
1042  * passed up by IP.  The queue is the default queue.  We need to find a sctp_t
1043  * that corresponds to the returned datagram.  Passes the message back in on
1044  * the correct queue once it has located the connection.
1045  * Assumes that IP has pulled up everything up to and including
1046  * the ICMP header.
1047  */
1048 void
1049 sctp_icmp_error(sctp_t *sctp, mblk_t *mp)
1050 {
1051 	icmph_t *icmph;
1052 	ipha_t	*ipha;
1053 	int	iph_hdr_length;
1054 	sctp_hdr_t *sctph;
1055 	mblk_t *first_mp;
1056 	uint32_t new_mtu;
1057 	in6_addr_t dst;
1058 	sctp_faddr_t *fp;
1059 
1060 	dprint(1, ("sctp_icmp_error: sctp=%p, mp=%p\n", (void *)sctp,
1061 	    (void *)mp));
1062 
1063 	first_mp = mp;
1064 
1065 	ipha = (ipha_t *)mp->b_rptr;
1066 	if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
1067 		ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
1068 		sctp_icmp_error_ipv6(sctp, first_mp);
1069 		return;
1070 	}
1071 
1072 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1073 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1074 	ipha = (ipha_t *)&icmph[1];
1075 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1076 	sctph = (sctp_hdr_t *)((char *)ipha + iph_hdr_length);
1077 	if ((uchar_t *)(sctph + 1) >= mp->b_wptr) {
1078 		/* not enough data for SCTP header */
1079 		freemsg(first_mp);
1080 		return;
1081 	}
1082 
1083 	switch (icmph->icmph_type) {
1084 	case ICMP_DEST_UNREACHABLE:
1085 		switch (icmph->icmph_code) {
1086 		case ICMP_FRAGMENTATION_NEEDED:
1087 			/*
1088 			 * Reduce the MSS based on the new MTU.  This will
1089 			 * eliminate any fragmentation locally.
1090 			 * N.B.  There may well be some funny side-effects on
1091 			 * the local send policy and the remote receive policy.
1092 			 * Pending further research, we provide
1093 			 * sctp_ignore_path_mtu just in case this proves
1094 			 * disastrous somewhere.
1095 			 *
1096 			 * After updating the MSS, retransmit part of the
1097 			 * dropped segment using the new mss by calling
1098 			 * sctp_wput_slow().  Need to adjust all those
1099 			 * params to make sure sctp_wput_slow() work properly.
1100 			 */
1101 			if (sctp_ignore_path_mtu)
1102 				break;
1103 
1104 			/* find the offending faddr */
1105 			IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &dst);
1106 			fp = sctp_lookup_faddr(sctp, &dst);
1107 			if (fp == NULL) {
1108 				break;
1109 			}
1110 
1111 			new_mtu = ntohs(icmph->icmph_du_mtu);
1112 
1113 			if (new_mtu - sctp->sctp_hdr_len >= fp->sfa_pmss)
1114 				break;
1115 
1116 			/*
1117 			 * Make sure that sfa_pmss is a multiple of
1118 			 * SCTP_ALIGN.
1119 			 */
1120 			fp->sfa_pmss = (new_mtu - sctp->sctp_hdr_len) &
1121 				~(SCTP_ALIGN - 1);
1122 			fp->pmtu_discovered = 1;
1123 
1124 			break;
1125 		case ICMP_PORT_UNREACHABLE:
1126 		case ICMP_PROTOCOL_UNREACHABLE:
1127 			switch (sctp->sctp_state) {
1128 			case SCTPS_COOKIE_WAIT:
1129 			case SCTPS_COOKIE_ECHOED:
1130 				/* make sure the verification tag matches */
1131 				if (!sctp_icmp_verf(sctp, sctph, mp)) {
1132 					break;
1133 				}
1134 				BUMP_MIB(&sctp_mib, sctpAborted);
1135 				sctp_clean_death(sctp, ECONNREFUSED);
1136 				break;
1137 			}
1138 			break;
1139 		case ICMP_HOST_UNREACHABLE:
1140 		case ICMP_NET_UNREACHABLE:
1141 			/* Record the error in case we finally time out. */
1142 			sctp->sctp_client_errno = (icmph->icmph_code ==
1143 			    ICMP_HOST_UNREACHABLE) ? EHOSTUNREACH : ENETUNREACH;
1144 			break;
1145 		default:
1146 			break;
1147 		}
1148 		break;
1149 	case ICMP_SOURCE_QUENCH: {
1150 		/* Reduce the sending rate as if we got a retransmit timeout */
1151 		break;
1152 	}
1153 	}
1154 	freemsg(first_mp);
1155 }
1156 
1157 /*
1158  * sctp_icmp_error_ipv6() is called by sctp_icmp_error() to process ICMPv6
1159  * error messages passed up by IP.
1160  * Assumes that IP has pulled up all the extension headers as well
1161  * as the ICMPv6 header.
1162  */
1163 static void
1164 sctp_icmp_error_ipv6(sctp_t *sctp, mblk_t *mp)
1165 {
1166 	icmp6_t *icmp6;
1167 	ip6_t	*ip6h;
1168 	uint16_t	iph_hdr_length;
1169 	sctp_hdr_t *sctpha;
1170 	uint8_t	*nexthdrp;
1171 	uint32_t new_mtu;
1172 	sctp_faddr_t *fp;
1173 
1174 	ip6h = (ip6_t *)mp->b_rptr;
1175 	iph_hdr_length = (ip6h->ip6_nxt != IPPROTO_SCTP) ?
1176 	    ip_hdr_length_v6(mp, ip6h) : IPV6_HDR_LEN;
1177 
1178 	icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1179 	ip6h = (ip6_t *)&icmp6[1];
1180 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1181 		freemsg(mp);
1182 		return;
1183 	}
1184 	ASSERT(*nexthdrp == IPPROTO_SCTP);
1185 
1186 	/* XXX need ifindex to find connection */
1187 	sctpha = (sctp_hdr_t *)((char *)ip6h + iph_hdr_length);
1188 	if ((uchar_t *)sctpha >= mp->b_wptr) {
1189 		/* not enough data for SCTP header */
1190 		freemsg(mp);
1191 		return;
1192 	}
1193 	switch (icmp6->icmp6_type) {
1194 	case ICMP6_PACKET_TOO_BIG:
1195 		/*
1196 		 * Reduce the MSS based on the new MTU.  This will
1197 		 * eliminate any fragmentation locally.
1198 		 * N.B.  There may well be some funny side-effects on
1199 		 * the local send policy and the remote receive policy.
1200 		 * Pending further research, we provide
1201 		 * sctp_ignore_path_mtu just in case this proves
1202 		 * disastrous somewhere.
1203 		 *
1204 		 * After updating the MSS, retransmit part of the
1205 		 * dropped segment using the new mss by calling
1206 		 * sctp_wput_slow().  Need to adjust all those
1207 		 * params to make sure sctp_wput_slow() work properly.
1208 		 */
1209 		if (sctp_ignore_path_mtu)
1210 			break;
1211 
1212 		/* find the offending faddr */
1213 		fp = sctp_lookup_faddr(sctp, &ip6h->ip6_dst);
1214 		if (fp == NULL) {
1215 			break;
1216 		}
1217 
1218 		new_mtu = ntohs(icmp6->icmp6_mtu);
1219 
1220 		if (new_mtu - sctp->sctp_hdr6_len >= fp->sfa_pmss)
1221 			break;
1222 
1223 		/* Make sure that sfa_pmss is a multiple of SCTP_ALIGN. */
1224 		fp->sfa_pmss = (new_mtu - sctp->sctp_hdr6_len) &
1225 			~(SCTP_ALIGN - 1);
1226 		fp->pmtu_discovered = 1;
1227 
1228 		break;
1229 
1230 	case ICMP6_DST_UNREACH:
1231 		switch (icmp6->icmp6_code) {
1232 		case ICMP6_DST_UNREACH_NOPORT:
1233 			/* make sure the verification tag matches */
1234 			if (!sctp_icmp_verf(sctp, sctpha, mp)) {
1235 				break;
1236 			}
1237 			if (sctp->sctp_state == SCTPS_COOKIE_WAIT ||
1238 			    sctp->sctp_state == SCTPS_COOKIE_ECHOED) {
1239 				BUMP_MIB(&sctp_mib, sctpAborted);
1240 				sctp_clean_death(sctp, ECONNREFUSED);
1241 			}
1242 			break;
1243 
1244 		case ICMP6_DST_UNREACH_ADMIN:
1245 		case ICMP6_DST_UNREACH_NOROUTE:
1246 		case ICMP6_DST_UNREACH_NOTNEIGHBOR:
1247 		case ICMP6_DST_UNREACH_ADDR:
1248 			/* Record the error in case we finally time out. */
1249 			sctp->sctp_client_errno = EHOSTUNREACH;
1250 			break;
1251 		default:
1252 			break;
1253 		}
1254 		break;
1255 
1256 	case ICMP6_PARAM_PROB:
1257 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1258 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1259 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1260 		    (uchar_t *)nexthdrp) {
1261 			/* make sure the verification tag matches */
1262 			if (!sctp_icmp_verf(sctp, sctpha, mp)) {
1263 				break;
1264 			}
1265 			if (sctp->sctp_state == SCTPS_COOKIE_WAIT) {
1266 				BUMP_MIB(&sctp_mib, sctpAborted);
1267 				sctp_clean_death(sctp, ECONNREFUSED);
1268 			}
1269 			break;
1270 		}
1271 		break;
1272 
1273 	case ICMP6_TIME_EXCEEDED:
1274 	default:
1275 		break;
1276 	}
1277 	freemsg(mp);
1278 }
1279 
1280 /*
1281  * Called by sockfs to create a new sctp instance.
1282  *
1283  * If parent pointer is passed in, inherit settings from it.
1284  */
1285 sctp_t *
1286 sctp_create(void *sctp_ulpd, sctp_t *parent, int family, int flags,
1287     const sctp_upcalls_t *sctp_upcalls, sctp_sockbuf_limits_t *sbl,
1288     cred_t *credp)
1289 {
1290 	sctp_t		*sctp, *psctp;
1291 	conn_t		*sctp_connp;
1292 	mblk_t		*ack_mp, *hb_mp;
1293 	int		sleep = flags & SCTP_CAN_BLOCK ? KM_SLEEP : KM_NOSLEEP;
1294 
1295 	/* User must supply a credential. */
1296 	if (credp == NULL)
1297 		return (NULL);
1298 
1299 	if ((sctp_connp = ipcl_conn_create(IPCL_SCTPCONN, sleep)) == NULL) {
1300 		SCTP_KSTAT(sctp_conn_create);
1301 		return (NULL);
1302 	}
1303 	sctp_connp->conn_ulp_labeled = is_system_labeled();
1304 
1305 	psctp = (sctp_t *)parent;
1306 
1307 	sctp = CONN2SCTP(sctp_connp);
1308 
1309 	if ((ack_mp = sctp_timer_alloc(sctp, sctp_ack_timer)) == NULL ||
1310 	    (hb_mp = sctp_timer_alloc(sctp, sctp_heartbeat_timer)) == NULL) {
1311 		if (ack_mp != NULL)
1312 			freeb(ack_mp);
1313 		kmem_cache_free(sctp_conn_cache, sctp_connp);
1314 		return (NULL);
1315 	}
1316 
1317 	sctp->sctp_ack_mp = ack_mp;
1318 	sctp->sctp_heartbeat_mp = hb_mp;
1319 
1320 	switch (family) {
1321 	case AF_INET6:
1322 		sctp_connp->conn_af_isv6 = B_TRUE;
1323 		sctp->sctp_ipversion = IPV6_VERSION;
1324 		sctp->sctp_family = AF_INET6;
1325 		break;
1326 
1327 	case AF_INET:
1328 		sctp_connp->conn_af_isv6 = B_FALSE;
1329 		sctp_connp->conn_pkt_isv6 = B_FALSE;
1330 		sctp->sctp_ipversion = IPV4_VERSION;
1331 		sctp->sctp_family = AF_INET;
1332 		break;
1333 	default:
1334 		ASSERT(0);
1335 		break;
1336 	}
1337 	if (sctp_init_values(sctp, psctp, sleep) != 0) {
1338 		freeb(ack_mp);
1339 		freeb(hb_mp);
1340 		kmem_cache_free(sctp_conn_cache, sctp_connp);
1341 		return (NULL);
1342 	}
1343 	sctp->sctp_cansleep = ((flags & SCTP_CAN_BLOCK) == SCTP_CAN_BLOCK);
1344 
1345 	sctp->sctp_mss = sctp_initial_mtu - ((family == AF_INET6) ?
1346 		sctp->sctp_hdr6_len : sctp->sctp_hdr_len);
1347 
1348 	if (psctp != NULL) {
1349 		RUN_SCTP(psctp);
1350 		/*
1351 		 * Inherit local address list, local port. Parent is either
1352 		 * in SCTPS_BOUND, or SCTPS_LISTEN state.
1353 		 */
1354 		ASSERT((psctp->sctp_state == SCTPS_BOUND) ||
1355 		    (psctp->sctp_state == SCTPS_LISTEN));
1356 		if (sctp_dup_saddrs(psctp, sctp, sleep)) {
1357 			WAKE_SCTP(psctp);
1358 			freeb(ack_mp);
1359 			freeb(hb_mp);
1360 			sctp_headers_free(sctp);
1361 			kmem_cache_free(sctp_conn_cache, sctp_connp);
1362 			return (NULL);
1363 		}
1364 
1365 		/*
1366 		 * If the parent is specified, it'll be immediatelly
1367 		 * followed by sctp_connect(). So don't add this guy to
1368 		 * bind hash.
1369 		 */
1370 		sctp->sctp_lport = psctp->sctp_lport;
1371 		sctp->sctp_state = SCTPS_BOUND;
1372 		sctp->sctp_zoneid = psctp->sctp_zoneid;
1373 		WAKE_SCTP(psctp);
1374 	} else {
1375 		sctp->sctp_zoneid = getzoneid();
1376 	}
1377 
1378 	sctp_connp->conn_cred = credp;
1379 	crhold(credp);
1380 
1381 	/*
1382 	 * If the caller has the process-wide flag set, then default to MAC
1383 	 * exempt mode.  This allows read-down to unlabeled hosts.
1384 	 */
1385 	if (getpflags(NET_MAC_AWARE, credp) != 0)
1386 		sctp_connp->conn_mac_exempt = B_TRUE;
1387 
1388 	/* Initialize SCTP instance values,  our verf tag must never be 0 */
1389 	(void) random_get_pseudo_bytes((uint8_t *)&sctp->sctp_lvtag,
1390 	    sizeof (sctp->sctp_lvtag));
1391 	if (sctp->sctp_lvtag == 0)
1392 		sctp->sctp_lvtag = (uint32_t)gethrtime();
1393 	ASSERT(sctp->sctp_lvtag != 0);
1394 
1395 	sctp->sctp_ltsn = sctp->sctp_lvtag + 1;
1396 	sctp->sctp_lcsn = sctp->sctp_ltsn;
1397 	sctp->sctp_recovery_tsn = sctp->sctp_lastack_rxd = sctp->sctp_ltsn - 1;
1398 	sctp->sctp_adv_pap = sctp->sctp_lastack_rxd;
1399 
1400 	/* Information required by upper layer */
1401 	if (sctp_ulpd != NULL) {
1402 		sctp->sctp_ulpd = sctp_ulpd;
1403 
1404 		ASSERT(sctp_upcalls != NULL);
1405 		bcopy(sctp_upcalls, &sctp->sctp_upcalls,
1406 		    sizeof (sctp_upcalls_t));
1407 		ASSERT(sbl != NULL);
1408 		/* Fill in the socket buffer limits for sctpsockfs */
1409 		sbl->sbl_txlowat = sctp->sctp_xmit_lowater;
1410 		sbl->sbl_txbuf = sctp->sctp_xmit_hiwater;
1411 		sbl->sbl_rxbuf = sctp->sctp_rwnd;
1412 		sbl->sbl_rxlowat = SCTP_RECV_LOWATER;
1413 	}
1414 	/* If no sctp_ulpd, must be creating the default sctp */
1415 	ASSERT(sctp_ulpd != NULL || gsctp == NULL);
1416 
1417 	/* Insert this in the global list. */
1418 	SCTP_LINK(sctp);
1419 
1420 	return (sctp);
1421 }
1422 
1423 void
1424 sctp_ddi_init(void)
1425 {
1426 	/* Initialize locks */
1427 	mutex_init(&sctp_g_lock, NULL, MUTEX_DEFAULT, NULL);
1428 	mutex_init(&sctp_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
1429 
1430 	/* Initialize SCTP hash arrays. */
1431 	sctp_hash_init();
1432 
1433 	sctp_pad_mp = allocb(SCTP_ALIGN, BPRI_MED);
1434 	bzero(sctp_pad_mp->b_rptr, SCTP_ALIGN);
1435 	ASSERT(sctp_pad_mp);
1436 
1437 	if (!sctp_nd_init()) {
1438 		sctp_nd_free();
1439 	}
1440 
1441 	/* Create sctp_t/conn_t cache */
1442 	sctp_conn_cache_init();
1443 
1444 	/* Create the faddr cache */
1445 	sctp_faddr_init();
1446 
1447 	/* Create the sets cache */
1448 	sctp_sets_init();
1449 
1450 	/* Create the PR-SCTP sets cache */
1451 	sctp_ftsn_sets_init();
1452 
1453 	/* Initialize the recvq taskq. */
1454 	sctp_rq_tq_init();
1455 
1456 	/* saddr init */
1457 	sctp_saddr_init();
1458 
1459 	/* Global SCTP PCB list. */
1460 	list_create(&sctp_g_list, sizeof (sctp_t),
1461 	    offsetof(sctp_t, sctp_list));
1462 
1463 	/* Initialize tables used for CRC calculation */
1464 	sctp_crc32_init();
1465 
1466 	/* Initialize sctp kernel stats. */
1467 	sctp_kstat_init();
1468 }
1469 
1470 void
1471 sctp_ddi_destroy(void)
1472 {
1473 	sctp_nd_free();
1474 
1475 	/* Destroy sctp_t/conn_t caches */
1476 	sctp_conn_cache_fini();
1477 
1478 	/* Destroy the faddr cache */
1479 	sctp_faddr_fini();
1480 
1481 	/* Destroy the sets cache */
1482 	sctp_sets_fini();
1483 
1484 	/* Destroy the PR-SCTP sets cache */
1485 	sctp_ftsn_sets_fini();
1486 
1487 	/* Destroy the recvq taskqs. */
1488 	sctp_rq_tq_fini();
1489 
1490 	/* Destroy saddr  */
1491 	sctp_saddr_fini();
1492 
1493 	/* Global SCTP PCB list. */
1494 	list_destroy(&sctp_g_list);
1495 
1496 	/* Destroy SCTP hash arrays. */
1497 	sctp_hash_destroy();
1498 
1499 	/* Destroy SCTP kenrel stats. */
1500 	sctp_kstat_fini();
1501 
1502 	mutex_destroy(&sctp_g_lock);
1503 	mutex_destroy(&sctp_epriv_port_lock);
1504 }
1505 
1506 void
1507 sctp_display_all()
1508 {
1509 	sctp_t *sctp_walker;
1510 
1511 	mutex_enter(&sctp_g_lock);
1512 	for (sctp_walker = gsctp; sctp_walker != NULL;
1513 		sctp_walker = (sctp_t *)list_next(&sctp_g_list, sctp_walker)) {
1514 		(void) sctp_display(sctp_walker, NULL);
1515 	}
1516 	mutex_exit(&sctp_g_lock);
1517 }
1518 
1519 static void
1520 sctp_rq_tq_init(void)
1521 {
1522 	/*
1523 	 * Initialize the recvq_tq_list and create the first recvq taskq.
1524 	 * What to do if it fails?
1525 	 */
1526 	recvq_tq_list = kmem_zalloc(sctp_recvq_tq_list_max_sz *
1527 	    sizeof (taskq_t *), KM_SLEEP);
1528 	recvq_tq_list[0] = taskq_create("sctp_def_recvq_taskq",
1529 	    MIN(sctp_recvq_tq_thr_max, MAX(sctp_recvq_tq_thr_min, ncpus)),
1530 	    minclsyspri, sctp_recvq_tq_task_min, sctp_recvq_tq_task_max,
1531 	    TASKQ_PREPOPULATE);
1532 	mutex_init(&sctp_rq_tq_lock, NULL, MUTEX_DEFAULT, NULL);
1533 }
1534 
1535 static void
1536 sctp_rq_tq_fini(void)
1537 {
1538 	int i;
1539 
1540 	for (i = 0; i < recvq_tq_list_cur_sz; i++) {
1541 		ASSERT(recvq_tq_list[i] != NULL);
1542 		taskq_destroy(recvq_tq_list[i]);
1543 	}
1544 	kmem_free(recvq_tq_list, sctp_recvq_tq_list_max_sz *
1545 	    sizeof (taskq_t *));
1546 }
1547 
1548 /* Add another taskq for a new ill. */
1549 void
1550 sctp_inc_taskq(void)
1551 {
1552 	taskq_t *tq;
1553 	char tq_name[TASKQ_NAMELEN];
1554 
1555 	mutex_enter(&sctp_rq_tq_lock);
1556 	if (recvq_tq_list_cur_sz + 1 > sctp_recvq_tq_list_max_sz) {
1557 		mutex_exit(&sctp_rq_tq_lock);
1558 		cmn_err(CE_NOTE, "Cannot create more SCTP recvq taskq");
1559 		return;
1560 	}
1561 
1562 	(void) snprintf(tq_name, sizeof (tq_name), "sctp_recvq_taskq_%u",
1563 	    recvq_tq_list_cur_sz);
1564 	tq = taskq_create(tq_name,
1565 	    MIN(sctp_recvq_tq_thr_max, MAX(sctp_recvq_tq_thr_min, ncpus)),
1566 	    minclsyspri, sctp_recvq_tq_task_min, sctp_recvq_tq_task_max,
1567 	    TASKQ_PREPOPULATE);
1568 	if (tq == NULL) {
1569 		mutex_exit(&sctp_rq_tq_lock);
1570 		cmn_err(CE_NOTE, "SCTP recvq taskq creation failed");
1571 		return;
1572 	}
1573 	ASSERT(recvq_tq_list[recvq_tq_list_cur_sz] == NULL);
1574 	recvq_tq_list[recvq_tq_list_cur_sz] = tq;
1575 	atomic_add_32(&recvq_tq_list_cur_sz, 1);
1576 	mutex_exit(&sctp_rq_tq_lock);
1577 }
1578 
1579 #ifdef DEBUG
1580 uint32_t sendq_loop_cnt = 0;
1581 uint32_t sendq_collision = 0;
1582 uint32_t sendq_empty = 0;
1583 #endif
1584 
1585 void
1586 sctp_add_sendq(sctp_t *sctp, mblk_t *mp)
1587 {
1588 	mutex_enter(&sctp->sctp_sendq_lock);
1589 	if (sctp->sctp_sendq == NULL) {
1590 		sctp->sctp_sendq = mp;
1591 		sctp->sctp_sendq_tail = mp;
1592 	} else {
1593 		sctp->sctp_sendq_tail->b_next = mp;
1594 		sctp->sctp_sendq_tail = mp;
1595 	}
1596 	mutex_exit(&sctp->sctp_sendq_lock);
1597 }
1598 
1599 void
1600 sctp_process_sendq(sctp_t *sctp)
1601 {
1602 	mblk_t *mp;
1603 #ifdef DEBUG
1604 	uint32_t loop_cnt = 0;
1605 #endif
1606 
1607 	mutex_enter(&sctp->sctp_sendq_lock);
1608 	if (sctp->sctp_sendq == NULL || sctp->sctp_sendq_sending) {
1609 #ifdef DEBUG
1610 		if (sctp->sctp_sendq == NULL)
1611 			sendq_empty++;
1612 		else
1613 			sendq_collision++;
1614 #endif
1615 		mutex_exit(&sctp->sctp_sendq_lock);
1616 		return;
1617 	}
1618 	sctp->sctp_sendq_sending = B_TRUE;
1619 
1620 	/*
1621 	 * Note that while we are in this loop, other thread can put
1622 	 * new packets in the receive queue.  We may be looping for
1623 	 * quite a while.  This is OK even for an interrupt thread.
1624 	 * The reason is that SCTP should only able to send a limited
1625 	 * number of packets out in a burst.  So the number of times
1626 	 * we go through this loop should not be many.
1627 	 */
1628 	while ((mp = sctp->sctp_sendq) != NULL) {
1629 		sctp->sctp_sendq = mp->b_next;
1630 		ASSERT(sctp->sctp_connp->conn_ref > 0);
1631 		mutex_exit(&sctp->sctp_sendq_lock);
1632 		mp->b_next = NULL;
1633 		CONN_INC_REF(sctp->sctp_connp);
1634 		mp->b_flag |= MSGHASREF;
1635 		/* If we don't have sctp_current, default to IPv4 */
1636 		IP_PUT(mp, sctp->sctp_connp, sctp->sctp_current == NULL ?
1637 		    B_TRUE : sctp->sctp_current->isv4);
1638 		BUMP_LOCAL(sctp->sctp_opkts);
1639 #ifdef DEBUG
1640 		loop_cnt++;
1641 #endif
1642 		mutex_enter(&sctp->sctp_sendq_lock);
1643 	}
1644 
1645 	sctp->sctp_sendq_tail = NULL;
1646 	sctp->sctp_sendq_sending = B_FALSE;
1647 #ifdef DEBUG
1648 	if (loop_cnt > sendq_loop_cnt)
1649 		sendq_loop_cnt = loop_cnt;
1650 #endif
1651 	mutex_exit(&sctp->sctp_sendq_lock);
1652 }
1653 
1654 #ifdef DEBUG
1655 uint32_t recvq_loop_cnt = 0;
1656 uint32_t recvq_call = 0;
1657 #endif
1658 
1659 /*
1660  * Find the next recvq_tq to use.  This routine will go thru all the
1661  * taskqs until it can dispatch a job for the sctp.  If this fails,
1662  * it will create a new taskq and try it.
1663  */
1664 static boolean_t
1665 sctp_find_next_tq(sctp_t *sctp)
1666 {
1667 	int next_tq, try;
1668 	taskq_t *tq;
1669 
1670 	/*
1671 	 * Note that since we don't hold a lock on sctp_rq_tq_lock for
1672 	 * performance reason, recvq_ta_list_cur_sz can be changed during
1673 	 * this loop.  The problem this will create is that the loop may
1674 	 * not have tried all the recvq_tq.  This should be OK.
1675 	 */
1676 	next_tq = atomic_add_32_nv(&recvq_tq_list_cur, 1) %
1677 	    recvq_tq_list_cur_sz;
1678 	for (try = 0; try < recvq_tq_list_cur_sz;
1679 	    try++, next_tq = (next_tq + 1) % recvq_tq_list_cur_sz) {
1680 		tq = recvq_tq_list[next_tq];
1681 		if (taskq_dispatch(tq, sctp_process_recvq, sctp,
1682 		    TQ_NOSLEEP) != NULL) {
1683 			sctp->sctp_recvq_tq = tq;
1684 			return (B_TRUE);
1685 		}
1686 	}
1687 
1688 	/*
1689 	 * Create one more taskq and try it.  Note that sctp_inc_taskq()
1690 	 * may not have created another taskq if the number of recvq
1691 	 * taskqs is at the maximum.  We are probably in a pretty bad
1692 	 * shape if this actually happens...
1693 	 */
1694 	sctp_inc_taskq();
1695 	tq = recvq_tq_list[recvq_tq_list_cur_sz - 1];
1696 	if (taskq_dispatch(tq, sctp_process_recvq, sctp, TQ_NOSLEEP) != NULL) {
1697 		sctp->sctp_recvq_tq = tq;
1698 		return (B_TRUE);
1699 	}
1700 	SCTP_KSTAT(sctp_find_next_tq);
1701 	return (B_FALSE);
1702 }
1703 
1704 /*
1705  * To add a message to the recvq.  Note that the sctp_timer_fire()
1706  * routine also uses this function to add the timer message to the
1707  * receive queue for later processing.  And it should be the only
1708  * caller of sctp_add_recvq() which sets the try_harder argument
1709  * to B_TRUE.
1710  *
1711  * If the try_harder argument is B_TRUE, this routine sctp_find_next_tq()
1712  * will try very hard to dispatch the task.  Refer to the comment
1713  * for that routine on how it does that.
1714  */
1715 boolean_t
1716 sctp_add_recvq(sctp_t *sctp, mblk_t *mp, boolean_t caller_hold_lock)
1717 {
1718 	if (!caller_hold_lock)
1719 		mutex_enter(&sctp->sctp_recvq_lock);
1720 
1721 	/* If the taskq dispatch has not been scheduled, do it now. */
1722 	if (sctp->sctp_recvq_tq == NULL) {
1723 		ASSERT(sctp->sctp_recvq == NULL);
1724 		if (!sctp_find_next_tq(sctp)) {
1725 			if (!caller_hold_lock)
1726 				mutex_exit(&sctp->sctp_recvq_lock);
1727 			return (B_FALSE);
1728 		}
1729 		/* Make sure the sctp_t will not go away. */
1730 		SCTP_REFHOLD(sctp);
1731 	}
1732 
1733 	if (sctp->sctp_recvq == NULL) {
1734 		sctp->sctp_recvq = mp;
1735 		sctp->sctp_recvq_tail = mp;
1736 	} else {
1737 		sctp->sctp_recvq_tail->b_next = mp;
1738 		sctp->sctp_recvq_tail = mp;
1739 	}
1740 
1741 	if (!caller_hold_lock)
1742 		mutex_exit(&sctp->sctp_recvq_lock);
1743 	return (B_TRUE);
1744 }
1745 
1746 static void
1747 sctp_process_recvq(void *arg)
1748 {
1749 	sctp_t		*sctp = (sctp_t *)arg;
1750 	mblk_t		*mp;
1751 	mblk_t		*ipsec_mp;
1752 #ifdef DEBUG
1753 	uint32_t	loop_cnt = 0;
1754 #endif
1755 
1756 #ifdef	_BIG_ENDIAN
1757 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 28) & 0x7)
1758 #else
1759 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 4) & 0x7)
1760 #endif
1761 
1762 	RUN_SCTP(sctp);
1763 	mutex_enter(&sctp->sctp_recvq_lock);
1764 
1765 #ifdef DEBUG
1766 	recvq_call++;
1767 #endif
1768 	/*
1769 	 * Note that while we are in this loop, other thread can put
1770 	 * new packets in the receive queue.  We may be looping for
1771 	 * quite a while.
1772 	 */
1773 	while ((mp = sctp->sctp_recvq) != NULL) {
1774 		sctp->sctp_recvq = mp->b_next;
1775 		mutex_exit(&sctp->sctp_recvq_lock);
1776 		mp->b_next = NULL;
1777 #ifdef DEBUG
1778 		loop_cnt++;
1779 #endif
1780 		ipsec_mp = mp->b_prev;
1781 		mp->b_prev = NULL;
1782 		sctp_input_data(sctp, mp, ipsec_mp);
1783 
1784 		mutex_enter(&sctp->sctp_recvq_lock);
1785 	}
1786 
1787 	sctp->sctp_recvq_tail = NULL;
1788 	sctp->sctp_recvq_tq = NULL;
1789 
1790 	mutex_exit(&sctp->sctp_recvq_lock);
1791 
1792 	WAKE_SCTP(sctp);
1793 
1794 	/* We may have sent something when processing the receive queue. */
1795 	sctp_process_sendq(sctp);
1796 #ifdef DEBUG
1797 	if (loop_cnt > recvq_loop_cnt)
1798 		recvq_loop_cnt = loop_cnt;
1799 #endif
1800 	/* Now it can go away. */
1801 	SCTP_REFRELE(sctp);
1802 }
1803 
1804 /* ARGSUSED */
1805 static int
1806 sctp_conn_cache_constructor(void *buf, void *cdrarg, int kmflags)
1807 {
1808 	conn_t	*sctp_connp = (conn_t *)buf;
1809 	sctp_t	*sctp = (sctp_t *)&sctp_connp[1];
1810 
1811 	bzero(buf, (char *)&sctp[1] - (char *)buf);
1812 
1813 	ASSERT(sctp_g_q != NULL);
1814 	sctp->sctp_connp = sctp_connp;
1815 	mutex_init(&sctp->sctp_reflock, NULL, MUTEX_DEFAULT, NULL);
1816 	mutex_init(&sctp->sctp_lock, NULL, MUTEX_DEFAULT, NULL);
1817 	mutex_init(&sctp->sctp_recvq_lock, NULL, MUTEX_DEFAULT, NULL);
1818 	cv_init(&sctp->sctp_cv, NULL, CV_DEFAULT, NULL);
1819 	mutex_init(&sctp->sctp_sendq_lock, NULL, MUTEX_DEFAULT, NULL);
1820 
1821 	sctp_connp->conn_rq = sctp_connp->conn_wq = NULL;
1822 	sctp_connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
1823 	sctp_connp->conn_ulp = IPPROTO_SCTP;
1824 	mutex_init(&sctp_connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
1825 	cv_init(&sctp_connp->conn_cv, NULL, CV_DEFAULT, NULL);
1826 
1827 	return (0);
1828 }
1829 
1830 /* ARGSUSED */
1831 static void
1832 sctp_conn_cache_destructor(void *buf, void *cdrarg)
1833 {
1834 	conn_t	*sctp_connp = (conn_t *)buf;
1835 	sctp_t	*sctp = (sctp_t *)&sctp_connp[1];
1836 
1837 	ASSERT(!MUTEX_HELD(&sctp->sctp_lock));
1838 	ASSERT(!MUTEX_HELD(&sctp->sctp_reflock));
1839 	ASSERT(!MUTEX_HELD(&sctp->sctp_recvq_lock));
1840 	ASSERT(!MUTEX_HELD(&sctp->sctp_sendq_lock));
1841 	ASSERT(!MUTEX_HELD(&sctp->sctp_connp->conn_lock));
1842 
1843 	ASSERT(sctp->sctp_conn_hash_next == NULL);
1844 	ASSERT(sctp->sctp_conn_hash_prev == NULL);
1845 	ASSERT(sctp->sctp_listen_hash_next == NULL);
1846 	ASSERT(sctp->sctp_listen_hash_prev == NULL);
1847 	ASSERT(sctp->sctp_listen_tfp == NULL);
1848 	ASSERT(sctp->sctp_conn_tfp == NULL);
1849 
1850 	ASSERT(sctp->sctp_faddrs == NULL);
1851 	ASSERT(sctp->sctp_nsaddrs == 0);
1852 
1853 	ASSERT(sctp->sctp_ulpd == NULL);
1854 
1855 	ASSERT(sctp->sctp_lastfaddr == NULL);
1856 	ASSERT(sctp->sctp_primary == NULL);
1857 	ASSERT(sctp->sctp_current == NULL);
1858 	ASSERT(sctp->sctp_lastdata == NULL);
1859 
1860 	ASSERT(sctp->sctp_xmit_head == NULL);
1861 	ASSERT(sctp->sctp_xmit_tail == NULL);
1862 	ASSERT(sctp->sctp_xmit_unsent == NULL);
1863 	ASSERT(sctp->sctp_xmit_unsent_tail == NULL);
1864 
1865 	ASSERT(sctp->sctp_ostrcntrs == NULL);
1866 
1867 	ASSERT(sctp->sctp_sack_info == NULL);
1868 	ASSERT(sctp->sctp_ack_mp == NULL);
1869 	ASSERT(sctp->sctp_instr == NULL);
1870 
1871 	ASSERT(sctp->sctp_iphc == NULL);
1872 	ASSERT(sctp->sctp_iphc6 == NULL);
1873 	ASSERT(sctp->sctp_ipha == NULL);
1874 	ASSERT(sctp->sctp_ip6h == NULL);
1875 	ASSERT(sctp->sctp_sctph == NULL);
1876 	ASSERT(sctp->sctp_sctph6 == NULL);
1877 
1878 	ASSERT(sctp->sctp_cookie_mp == NULL);
1879 
1880 	ASSERT(sctp->sctp_refcnt == 0);
1881 	ASSERT(sctp->sctp_timer_mp == NULL);
1882 	ASSERT(sctp->sctp_connp->conn_ref == 0);
1883 	ASSERT(sctp->sctp_heartbeat_mp == NULL);
1884 	ASSERT(sctp->sctp_ptpbhn == NULL && sctp->sctp_bind_hash == NULL);
1885 
1886 	ASSERT(sctp->sctp_shutdown_faddr == NULL);
1887 
1888 	ASSERT(sctp->sctp_cxmit_list == NULL);
1889 
1890 	ASSERT(sctp->sctp_recvq == NULL);
1891 	ASSERT(sctp->sctp_recvq_tail == NULL);
1892 	ASSERT(sctp->sctp_recvq_tq == NULL);
1893 
1894 	ASSERT(sctp->sctp_sendq == NULL);
1895 	ASSERT(sctp->sctp_sendq_tail == NULL);
1896 	ASSERT(sctp->sctp_sendq_sending == B_FALSE);
1897 
1898 	mutex_destroy(&sctp->sctp_reflock);
1899 	mutex_destroy(&sctp->sctp_lock);
1900 	mutex_destroy(&sctp->sctp_recvq_lock);
1901 	cv_destroy(&sctp->sctp_cv);
1902 	mutex_destroy(&sctp->sctp_sendq_lock);
1903 
1904 	mutex_destroy(&sctp_connp->conn_lock);
1905 	cv_destroy(&sctp_connp->conn_cv);
1906 }
1907 
1908 static void
1909 sctp_conn_cache_init()
1910 {
1911 	sctp_conn_cache = kmem_cache_create("sctp_conn_cache",
1912 	    sizeof (sctp_t) + sizeof (conn_t), 0, sctp_conn_cache_constructor,
1913 	    sctp_conn_cache_destructor, NULL, NULL, NULL, 0);
1914 }
1915 
1916 static void
1917 sctp_conn_cache_fini()
1918 {
1919 	kmem_cache_destroy(sctp_conn_cache);
1920 }
1921