xref: /titanic_44/usr/src/uts/common/inet/tcp/tcp_input.c (revision 8622ec4569457733001d4982ef7f5b44427069be)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25  * Copyright (c) 2011 Joyent, Inc. All rights reserved.
26  * Copyright (c) 2014 by Delphix. All rights reserved.
27  */
28 
29 /* This file contains all TCP input processing functions. */
30 
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/strsun.h>
34 #include <sys/strsubr.h>
35 #include <sys/stropts.h>
36 #include <sys/strlog.h>
37 #define	_SUN_TPI_VERSION 2
38 #include <sys/tihdr.h>
39 #include <sys/suntpi.h>
40 #include <sys/xti_inet.h>
41 #include <sys/squeue_impl.h>
42 #include <sys/squeue.h>
43 #include <sys/tsol/tnet.h>
44 
45 #include <inet/common.h>
46 #include <inet/ip.h>
47 #include <inet/tcp.h>
48 #include <inet/tcp_impl.h>
49 #include <inet/tcp_cluster.h>
50 #include <inet/proto_set.h>
51 #include <inet/ipsec_impl.h>
52 
53 /*
54  * RFC1323-recommended phrasing of TSTAMP option, for easier parsing
55  */
56 
57 #ifdef _BIG_ENDIAN
58 #define	TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
59 	(TCPOPT_TSTAMP << 8) | 10)
60 #else
61 #define	TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
62 	(TCPOPT_NOP << 8) | TCPOPT_NOP)
63 #endif
64 
65 /*
66  * Flags returned from tcp_parse_options.
67  */
68 #define	TCP_OPT_MSS_PRESENT	1
69 #define	TCP_OPT_WSCALE_PRESENT	2
70 #define	TCP_OPT_TSTAMP_PRESENT	4
71 #define	TCP_OPT_SACK_OK_PRESENT	8
72 #define	TCP_OPT_SACK_PRESENT	16
73 
74 /*
75  *  PAWS needs a timer for 24 days.  This is the number of ticks in 24 days
76  */
77 #define	PAWS_TIMEOUT	((clock_t)(24*24*60*60*hz))
78 
79 /*
80  * Since tcp_listener is not cleared atomically with tcp_detached
81  * being cleared we need this extra bit to tell a detached connection
82  * apart from one that is in the process of being accepted.
83  */
84 #define	TCP_IS_DETACHED_NONEAGER(tcp)	\
85 	(TCP_IS_DETACHED(tcp) &&	\
86 	    (!(tcp)->tcp_hard_binding))
87 
88 /*
89  * Steps to do when a tcp_t moves to TIME-WAIT state.
90  *
91  * This connection is done, we don't need to account for it.  Decrement
92  * the listener connection counter if needed.
93  *
94  * Decrement the connection counter of the stack.  Note that this counter
95  * is per CPU.  So the total number of connections in a stack is the sum of all
96  * of them.  Since there is no lock for handling all of them exclusively, the
97  * resulting sum is only an approximation.
98  *
99  * Unconditionally clear the exclusive binding bit so this TIME-WAIT
100  * connection won't interfere with new ones.
101  *
102  * Start the TIME-WAIT timer.  If upper layer has not closed the connection,
103  * the timer is handled within the context of this tcp_t.  When the timer
104  * fires, tcp_clean_death() is called.  If upper layer closes the connection
105  * during this period, tcp_time_wait_append() will be called to add this
106  * tcp_t to the global TIME-WAIT list.  Note that this means that the
107  * actual wait time in TIME-WAIT state will be longer than the
108  * tcps_time_wait_interval since the period before upper layer closes the
109  * connection is not accounted for when tcp_time_wait_append() is called.
110  *
111  * If uppser layer has closed the connection, call tcp_time_wait_append()
112  * directly.
113  *
114  */
115 #define	SET_TIME_WAIT(tcps, tcp, connp)				\
116 {								\
117 	(tcp)->tcp_state = TCPS_TIME_WAIT;			\
118 	if ((tcp)->tcp_listen_cnt != NULL)			\
119 		TCP_DECR_LISTEN_CNT(tcp);			\
120 	atomic_dec_64(						\
121 	    (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
122 	(connp)->conn_exclbind = 0;				\
123 	if (!TCP_IS_DETACHED(tcp)) {				\
124 		TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
125 	} else {						\
126 		tcp_time_wait_append(tcp);			\
127 		TCP_DBGSTAT(tcps, tcp_rput_time_wait);		\
128 	}							\
129 }
130 
131 /*
132  * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
133  * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
134  * data, TCP will not respond with an ACK.  RFC 793 requires that
135  * TCP responds with an ACK for such a bogus ACK.  By not following
136  * the RFC, we prevent TCP from getting into an ACK storm if somehow
137  * an attacker successfully spoofs an acceptable segment to our
138  * peer; or when our peer is "confused."
139  */
140 static uint32_t tcp_drop_ack_unsent_cnt = 10;
141 
142 /*
143  * To protect TCP against attacker using a small window and requesting
144  * large amount of data (DoS attack by conuming memory), TCP checks the
145  * window advertised in the last ACK of the 3-way handshake.  TCP uses
146  * the tcp_mss (the size of one packet) value for comparion.  The window
147  * should be larger than tcp_mss.  But while a sane TCP should advertise
148  * a receive window larger than or equal to 4*MSS to avoid stop and go
149  * tarrfic, not all TCP stacks do that.  This is especially true when
150  * tcp_mss is a big value.
151  *
152  * To work around this issue, an additional fixed value for comparison
153  * is also used.  If the advertised window is smaller than both tcp_mss
154  * and tcp_init_wnd_chk, the ACK is considered as invalid.  So for large
155  * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
156  * smaller than 8K is considered to be OK.
157  */
158 static uint32_t tcp_init_wnd_chk = 4096;
159 
160 /* Process ICMP source quench message or not. */
161 static boolean_t tcp_icmp_source_quench = B_FALSE;
162 
163 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
164 
165 static mblk_t	*tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
166 		    ip_recv_attr_t *);
167 static mblk_t	*tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
168 		    ip_recv_attr_t *);
169 static boolean_t	tcp_drop_q0(tcp_t *);
170 static void	tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
171 static mblk_t	*tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
172 		    ip_recv_attr_t *);
173 static void	tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
174 static int	tcp_parse_options(tcpha_t *, tcp_opt_t *);
175 static void	tcp_process_options(tcp_t *, tcpha_t *);
176 static mblk_t	*tcp_reass(tcp_t *, mblk_t *, uint32_t);
177 static void	tcp_reass_elim_overlap(tcp_t *, mblk_t *);
178 static void	tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
179 static void	tcp_set_rto(tcp_t *, time_t);
180 static void	tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
181 
182 /*
183  * Set the MSS associated with a particular tcp based on its current value,
184  * and a new one passed in. Observe minimums and maximums, and reset other
185  * state variables that we want to view as multiples of MSS.
186  *
187  * The value of MSS could be either increased or descreased.
188  */
189 void
190 tcp_mss_set(tcp_t *tcp, uint32_t mss)
191 {
192 	uint32_t	mss_max;
193 	tcp_stack_t	*tcps = tcp->tcp_tcps;
194 	conn_t		*connp = tcp->tcp_connp;
195 
196 	if (connp->conn_ipversion == IPV4_VERSION)
197 		mss_max = tcps->tcps_mss_max_ipv4;
198 	else
199 		mss_max = tcps->tcps_mss_max_ipv6;
200 
201 	if (mss < tcps->tcps_mss_min)
202 		mss = tcps->tcps_mss_min;
203 	if (mss > mss_max)
204 		mss = mss_max;
205 	/*
206 	 * Unless naglim has been set by our client to
207 	 * a non-mss value, force naglim to track mss.
208 	 * This can help to aggregate small writes.
209 	 */
210 	if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
211 		tcp->tcp_naglim = mss;
212 	/*
213 	 * TCP should be able to buffer at least 4 MSS data for obvious
214 	 * performance reason.
215 	 */
216 	if ((mss << 2) > connp->conn_sndbuf)
217 		connp->conn_sndbuf = mss << 2;
218 
219 	/*
220 	 * Set the send lowater to at least twice of MSS.
221 	 */
222 	if ((mss << 1) > connp->conn_sndlowat)
223 		connp->conn_sndlowat = mss << 1;
224 
225 	/*
226 	 * Update tcp_cwnd according to the new value of MSS. Keep the
227 	 * previous ratio to preserve the transmit rate.
228 	 */
229 	tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
230 	tcp->tcp_cwnd_cnt = 0;
231 
232 	tcp->tcp_mss = mss;
233 	(void) tcp_maxpsz_set(tcp, B_TRUE);
234 }
235 
236 /*
237  * Extract option values from a tcp header.  We put any found values into the
238  * tcpopt struct and return a bitmask saying which options were found.
239  */
240 static int
241 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
242 {
243 	uchar_t		*endp;
244 	int		len;
245 	uint32_t	mss;
246 	uchar_t		*up = (uchar_t *)tcpha;
247 	int		found = 0;
248 	int32_t		sack_len;
249 	tcp_seq		sack_begin, sack_end;
250 	tcp_t		*tcp;
251 
252 	endp = up + TCP_HDR_LENGTH(tcpha);
253 	up += TCP_MIN_HEADER_LENGTH;
254 	while (up < endp) {
255 		len = endp - up;
256 		switch (*up) {
257 		case TCPOPT_EOL:
258 			break;
259 
260 		case TCPOPT_NOP:
261 			up++;
262 			continue;
263 
264 		case TCPOPT_MAXSEG:
265 			if (len < TCPOPT_MAXSEG_LEN ||
266 			    up[1] != TCPOPT_MAXSEG_LEN)
267 				break;
268 
269 			mss = BE16_TO_U16(up+2);
270 			/* Caller must handle tcp_mss_min and tcp_mss_max_* */
271 			tcpopt->tcp_opt_mss = mss;
272 			found |= TCP_OPT_MSS_PRESENT;
273 
274 			up += TCPOPT_MAXSEG_LEN;
275 			continue;
276 
277 		case TCPOPT_WSCALE:
278 			if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
279 				break;
280 
281 			if (up[2] > TCP_MAX_WINSHIFT)
282 				tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
283 			else
284 				tcpopt->tcp_opt_wscale = up[2];
285 			found |= TCP_OPT_WSCALE_PRESENT;
286 
287 			up += TCPOPT_WS_LEN;
288 			continue;
289 
290 		case TCPOPT_SACK_PERMITTED:
291 			if (len < TCPOPT_SACK_OK_LEN ||
292 			    up[1] != TCPOPT_SACK_OK_LEN)
293 				break;
294 			found |= TCP_OPT_SACK_OK_PRESENT;
295 			up += TCPOPT_SACK_OK_LEN;
296 			continue;
297 
298 		case TCPOPT_SACK:
299 			if (len <= 2 || up[1] <= 2 || len < up[1])
300 				break;
301 
302 			/* If TCP is not interested in SACK blks... */
303 			if ((tcp = tcpopt->tcp) == NULL) {
304 				up += up[1];
305 				continue;
306 			}
307 			sack_len = up[1] - TCPOPT_HEADER_LEN;
308 			up += TCPOPT_HEADER_LEN;
309 
310 			/*
311 			 * If the list is empty, allocate one and assume
312 			 * nothing is sack'ed.
313 			 */
314 			if (tcp->tcp_notsack_list == NULL) {
315 				tcp_notsack_update(&(tcp->tcp_notsack_list),
316 				    tcp->tcp_suna, tcp->tcp_snxt,
317 				    &(tcp->tcp_num_notsack_blk),
318 				    &(tcp->tcp_cnt_notsack_list));
319 
320 				/*
321 				 * Make sure tcp_notsack_list is not NULL.
322 				 * This happens when kmem_alloc(KM_NOSLEEP)
323 				 * returns NULL.
324 				 */
325 				if (tcp->tcp_notsack_list == NULL) {
326 					up += sack_len;
327 					continue;
328 				}
329 				tcp->tcp_fack = tcp->tcp_suna;
330 			}
331 
332 			while (sack_len > 0) {
333 				if (up + 8 > endp) {
334 					up = endp;
335 					break;
336 				}
337 				sack_begin = BE32_TO_U32(up);
338 				up += 4;
339 				sack_end = BE32_TO_U32(up);
340 				up += 4;
341 				sack_len -= 8;
342 				/*
343 				 * Bounds checking.  Make sure the SACK
344 				 * info is within tcp_suna and tcp_snxt.
345 				 * If this SACK blk is out of bound, ignore
346 				 * it but continue to parse the following
347 				 * blks.
348 				 */
349 				if (SEQ_LEQ(sack_end, sack_begin) ||
350 				    SEQ_LT(sack_begin, tcp->tcp_suna) ||
351 				    SEQ_GT(sack_end, tcp->tcp_snxt)) {
352 					continue;
353 				}
354 				tcp_notsack_insert(&(tcp->tcp_notsack_list),
355 				    sack_begin, sack_end,
356 				    &(tcp->tcp_num_notsack_blk),
357 				    &(tcp->tcp_cnt_notsack_list));
358 				if (SEQ_GT(sack_end, tcp->tcp_fack)) {
359 					tcp->tcp_fack = sack_end;
360 				}
361 			}
362 			found |= TCP_OPT_SACK_PRESENT;
363 			continue;
364 
365 		case TCPOPT_TSTAMP:
366 			if (len < TCPOPT_TSTAMP_LEN ||
367 			    up[1] != TCPOPT_TSTAMP_LEN)
368 				break;
369 
370 			tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
371 			tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
372 
373 			found |= TCP_OPT_TSTAMP_PRESENT;
374 
375 			up += TCPOPT_TSTAMP_LEN;
376 			continue;
377 
378 		default:
379 			if (len <= 1 || len < (int)up[1] || up[1] == 0)
380 				break;
381 			up += up[1];
382 			continue;
383 		}
384 		break;
385 	}
386 	return (found);
387 }
388 
389 /*
390  * Process all TCP option in SYN segment.  Note that this function should
391  * be called after tcp_set_destination() is called so that the necessary info
392  * from IRE is already set in the tcp structure.
393  *
394  * This function sets up the correct tcp_mss value according to the
395  * MSS option value and our header size.  It also sets up the window scale
396  * and timestamp values, and initialize SACK info blocks.  But it does not
397  * change receive window size after setting the tcp_mss value.  The caller
398  * should do the appropriate change.
399  */
400 static void
401 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
402 {
403 	int options;
404 	tcp_opt_t tcpopt;
405 	uint32_t mss_max;
406 	char *tmp_tcph;
407 	tcp_stack_t	*tcps = tcp->tcp_tcps;
408 	conn_t		*connp = tcp->tcp_connp;
409 
410 	tcpopt.tcp = NULL;
411 	options = tcp_parse_options(tcpha, &tcpopt);
412 
413 	/*
414 	 * Process MSS option.  Note that MSS option value does not account
415 	 * for IP or TCP options.  This means that it is equal to MTU - minimum
416 	 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
417 	 * IPv6.
418 	 */
419 	if (!(options & TCP_OPT_MSS_PRESENT)) {
420 		if (connp->conn_ipversion == IPV4_VERSION)
421 			tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
422 		else
423 			tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
424 	} else {
425 		if (connp->conn_ipversion == IPV4_VERSION)
426 			mss_max = tcps->tcps_mss_max_ipv4;
427 		else
428 			mss_max = tcps->tcps_mss_max_ipv6;
429 		if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
430 			tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
431 		else if (tcpopt.tcp_opt_mss > mss_max)
432 			tcpopt.tcp_opt_mss = mss_max;
433 	}
434 
435 	/* Process Window Scale option. */
436 	if (options & TCP_OPT_WSCALE_PRESENT) {
437 		tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
438 		tcp->tcp_snd_ws_ok = B_TRUE;
439 	} else {
440 		tcp->tcp_snd_ws = B_FALSE;
441 		tcp->tcp_snd_ws_ok = B_FALSE;
442 		tcp->tcp_rcv_ws = B_FALSE;
443 	}
444 
445 	/* Process Timestamp option. */
446 	if ((options & TCP_OPT_TSTAMP_PRESENT) &&
447 	    (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
448 		tmp_tcph = (char *)tcp->tcp_tcpha;
449 
450 		tcp->tcp_snd_ts_ok = B_TRUE;
451 		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
452 		tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
453 		ASSERT(OK_32PTR(tmp_tcph));
454 		ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
455 
456 		/* Fill in our template header with basic timestamp option. */
457 		tmp_tcph += connp->conn_ht_ulp_len;
458 		tmp_tcph[0] = TCPOPT_NOP;
459 		tmp_tcph[1] = TCPOPT_NOP;
460 		tmp_tcph[2] = TCPOPT_TSTAMP;
461 		tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
462 		connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
463 		connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
464 		tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
465 	} else {
466 		tcp->tcp_snd_ts_ok = B_FALSE;
467 	}
468 
469 	/*
470 	 * Process SACK options.  If SACK is enabled for this connection,
471 	 * then allocate the SACK info structure.  Note the following ways
472 	 * when tcp_snd_sack_ok is set to true.
473 	 *
474 	 * For active connection: in tcp_set_destination() called in
475 	 * tcp_connect().
476 	 *
477 	 * For passive connection: in tcp_set_destination() called in
478 	 * tcp_input_listener().
479 	 *
480 	 * That's the reason why the extra TCP_IS_DETACHED() check is there.
481 	 * That check makes sure that if we did not send a SACK OK option,
482 	 * we will not enable SACK for this connection even though the other
483 	 * side sends us SACK OK option.  For active connection, the SACK
484 	 * info structure has already been allocated.  So we need to free
485 	 * it if SACK is disabled.
486 	 */
487 	if ((options & TCP_OPT_SACK_OK_PRESENT) &&
488 	    (tcp->tcp_snd_sack_ok ||
489 	    (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
490 		ASSERT(tcp->tcp_num_sack_blk == 0);
491 		ASSERT(tcp->tcp_notsack_list == NULL);
492 
493 		tcp->tcp_snd_sack_ok = B_TRUE;
494 		if (tcp->tcp_snd_ts_ok) {
495 			tcp->tcp_max_sack_blk = 3;
496 		} else {
497 			tcp->tcp_max_sack_blk = 4;
498 		}
499 	} else if (tcp->tcp_snd_sack_ok) {
500 		/*
501 		 * Resetting tcp_snd_sack_ok to B_FALSE so that
502 		 * no SACK info will be used for this
503 		 * connection.  This assumes that SACK usage
504 		 * permission is negotiated.  This may need
505 		 * to be changed once this is clarified.
506 		 */
507 		ASSERT(tcp->tcp_num_sack_blk == 0);
508 		ASSERT(tcp->tcp_notsack_list == NULL);
509 		tcp->tcp_snd_sack_ok = B_FALSE;
510 	}
511 
512 	/*
513 	 * Now we know the exact TCP/IP header length, subtract
514 	 * that from tcp_mss to get our side's MSS.
515 	 */
516 	tcp->tcp_mss -= connp->conn_ht_iphc_len;
517 
518 	/*
519 	 * Here we assume that the other side's header size will be equal to
520 	 * our header size.  We calculate the real MSS accordingly.  Need to
521 	 * take into additional stuffs IPsec puts in.
522 	 *
523 	 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
524 	 */
525 	tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
526 	    tcp->tcp_ipsec_overhead -
527 	    ((connp->conn_ipversion == IPV4_VERSION ?
528 	    IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
529 
530 	/*
531 	 * Set MSS to the smaller one of both ends of the connection.
532 	 * We should not have called tcp_mss_set() before, but our
533 	 * side of the MSS should have been set to a proper value
534 	 * by tcp_set_destination().  tcp_mss_set() will also set up the
535 	 * STREAM head parameters properly.
536 	 *
537 	 * If we have a larger-than-16-bit window but the other side
538 	 * didn't want to do window scale, tcp_rwnd_set() will take
539 	 * care of that.
540 	 */
541 	tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
542 
543 	/*
544 	 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
545 	 * updated properly.
546 	 */
547 	TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
548 }
549 
550 /*
551  * Add a new piece to the tcp reassembly queue.  If the gap at the beginning
552  * is filled, return as much as we can.  The message passed in may be
553  * multi-part, chained using b_cont.  "start" is the starting sequence
554  * number for this piece.
555  */
556 static mblk_t *
557 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
558 {
559 	uint32_t	end;
560 	mblk_t		*mp1;
561 	mblk_t		*mp2;
562 	mblk_t		*next_mp;
563 	uint32_t	u1;
564 	tcp_stack_t	*tcps = tcp->tcp_tcps;
565 
566 
567 	/* Walk through all the new pieces. */
568 	do {
569 		ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
570 		    (uintptr_t)INT_MAX);
571 		end = start + (int)(mp->b_wptr - mp->b_rptr);
572 		next_mp = mp->b_cont;
573 		if (start == end) {
574 			/* Empty.  Blast it. */
575 			freeb(mp);
576 			continue;
577 		}
578 		mp->b_cont = NULL;
579 		TCP_REASS_SET_SEQ(mp, start);
580 		TCP_REASS_SET_END(mp, end);
581 		mp1 = tcp->tcp_reass_tail;
582 		if (!mp1) {
583 			tcp->tcp_reass_tail = mp;
584 			tcp->tcp_reass_head = mp;
585 			TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
586 			TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
587 			    end - start);
588 			continue;
589 		}
590 		/* New stuff completely beyond tail? */
591 		if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
592 			/* Link it on end. */
593 			mp1->b_cont = mp;
594 			tcp->tcp_reass_tail = mp;
595 			TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
596 			TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
597 			    end - start);
598 			continue;
599 		}
600 		mp1 = tcp->tcp_reass_head;
601 		u1 = TCP_REASS_SEQ(mp1);
602 		/* New stuff at the front? */
603 		if (SEQ_LT(start, u1)) {
604 			/* Yes... Check for overlap. */
605 			mp->b_cont = mp1;
606 			tcp->tcp_reass_head = mp;
607 			tcp_reass_elim_overlap(tcp, mp);
608 			continue;
609 		}
610 		/*
611 		 * The new piece fits somewhere between the head and tail.
612 		 * We find our slot, where mp1 precedes us and mp2 trails.
613 		 */
614 		for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
615 			u1 = TCP_REASS_SEQ(mp2);
616 			if (SEQ_LEQ(start, u1))
617 				break;
618 		}
619 		/* Link ourselves in */
620 		mp->b_cont = mp2;
621 		mp1->b_cont = mp;
622 
623 		/* Trim overlap with following mblk(s) first */
624 		tcp_reass_elim_overlap(tcp, mp);
625 
626 		/* Trim overlap with preceding mblk */
627 		tcp_reass_elim_overlap(tcp, mp1);
628 
629 	} while (start = end, mp = next_mp);
630 	mp1 = tcp->tcp_reass_head;
631 	/* Anything ready to go? */
632 	if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
633 		return (NULL);
634 	/* Eat what we can off the queue */
635 	for (;;) {
636 		mp = mp1->b_cont;
637 		end = TCP_REASS_END(mp1);
638 		TCP_REASS_SET_SEQ(mp1, 0);
639 		TCP_REASS_SET_END(mp1, 0);
640 		if (!mp) {
641 			tcp->tcp_reass_tail = NULL;
642 			break;
643 		}
644 		if (end != TCP_REASS_SEQ(mp)) {
645 			mp1->b_cont = NULL;
646 			break;
647 		}
648 		mp1 = mp;
649 	}
650 	mp1 = tcp->tcp_reass_head;
651 	tcp->tcp_reass_head = mp;
652 	return (mp1);
653 }
654 
655 /* Eliminate any overlap that mp may have over later mblks */
656 static void
657 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
658 {
659 	uint32_t	end;
660 	mblk_t		*mp1;
661 	uint32_t	u1;
662 	tcp_stack_t	*tcps = tcp->tcp_tcps;
663 
664 	end = TCP_REASS_END(mp);
665 	while ((mp1 = mp->b_cont) != NULL) {
666 		u1 = TCP_REASS_SEQ(mp1);
667 		if (!SEQ_GT(end, u1))
668 			break;
669 		if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
670 			mp->b_wptr -= end - u1;
671 			TCP_REASS_SET_END(mp, u1);
672 			TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
673 			TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
674 			    end - u1);
675 			break;
676 		}
677 		mp->b_cont = mp1->b_cont;
678 		TCP_REASS_SET_SEQ(mp1, 0);
679 		TCP_REASS_SET_END(mp1, 0);
680 		freeb(mp1);
681 		TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
682 		TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
683 	}
684 	if (!mp1)
685 		tcp->tcp_reass_tail = mp;
686 }
687 
688 /*
689  * This function does PAWS protection check. Returns B_TRUE if the
690  * segment passes the PAWS test, else returns B_FALSE.
691  */
692 boolean_t
693 tcp_paws_check(tcp_t *tcp, tcpha_t *tcpha, tcp_opt_t *tcpoptp)
694 {
695 	uint8_t	flags;
696 	int	options;
697 	uint8_t *up;
698 	conn_t	*connp = tcp->tcp_connp;
699 
700 	flags = (unsigned int)tcpha->tha_flags & 0xFF;
701 	/*
702 	 * If timestamp option is aligned nicely, get values inline,
703 	 * otherwise call general routine to parse.  Only do that
704 	 * if timestamp is the only option.
705 	 */
706 	if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
707 	    TCPOPT_REAL_TS_LEN &&
708 	    OK_32PTR((up = ((uint8_t *)tcpha) +
709 	    TCP_MIN_HEADER_LENGTH)) &&
710 	    *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
711 		tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4));
712 		tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
713 
714 		options = TCP_OPT_TSTAMP_PRESENT;
715 	} else {
716 		if (tcp->tcp_snd_sack_ok) {
717 			tcpoptp->tcp = tcp;
718 		} else {
719 			tcpoptp->tcp = NULL;
720 		}
721 		options = tcp_parse_options(tcpha, tcpoptp);
722 	}
723 
724 	if (options & TCP_OPT_TSTAMP_PRESENT) {
725 		/*
726 		 * Do PAWS per RFC 1323 section 4.2.  Accept RST
727 		 * regardless of the timestamp, page 18 RFC 1323.bis.
728 		 */
729 		if ((flags & TH_RST) == 0 &&
730 		    TSTMP_LT(tcpoptp->tcp_opt_ts_val,
731 		    tcp->tcp_ts_recent)) {
732 			if (LBOLT_FASTPATH64 <
733 			    (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
734 				/* This segment is not acceptable. */
735 				return (B_FALSE);
736 			} else {
737 				/*
738 				 * Connection has been idle for
739 				 * too long.  Reset the timestamp
740 				 * and assume the segment is valid.
741 				 */
742 				tcp->tcp_ts_recent =
743 				    tcpoptp->tcp_opt_ts_val;
744 			}
745 		}
746 	} else {
747 		/*
748 		 * If we don't get a timestamp on every packet, we
749 		 * figure we can't really trust 'em, so we stop sending
750 		 * and parsing them.
751 		 */
752 		tcp->tcp_snd_ts_ok = B_FALSE;
753 
754 		connp->conn_ht_iphc_len -= TCPOPT_REAL_TS_LEN;
755 		connp->conn_ht_ulp_len -= TCPOPT_REAL_TS_LEN;
756 		tcp->tcp_tcpha->tha_offset_and_reserved -= (3 << 4);
757 		/*
758 		 * Adjust the tcp_mss and tcp_cwnd accordingly. We avoid
759 		 * doing a slow start here so as to not to lose on the
760 		 * transfer rate built up so far.
761 		 */
762 		tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN);
763 		if (tcp->tcp_snd_sack_ok)
764 			tcp->tcp_max_sack_blk = 4;
765 	}
766 	return (B_TRUE);
767 }
768 
769 /*
770  * Defense for the SYN attack -
771  * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
772  *    one from the list of droppable eagers. This list is a subset of q0.
773  *    see comments before the definition of MAKE_DROPPABLE().
774  * 2. Don't drop a SYN request before its first timeout. This gives every
775  *    request at least til the first timeout to complete its 3-way handshake.
776  * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
777  *    requests currently on the queue that has timed out. This will be used
778  *    as an indicator of whether an attack is under way, so that appropriate
779  *    actions can be taken. (It's incremented in tcp_timer() and decremented
780  *    either when eager goes into ESTABLISHED, or gets freed up.)
781  * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
782  *    # of timeout drops back to <= q0len/32 => SYN alert off
783  */
784 static boolean_t
785 tcp_drop_q0(tcp_t *tcp)
786 {
787 	tcp_t	*eager;
788 	mblk_t	*mp;
789 	tcp_stack_t	*tcps = tcp->tcp_tcps;
790 
791 	ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
792 	ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
793 
794 	/* Pick oldest eager from the list of droppable eagers */
795 	eager = tcp->tcp_eager_prev_drop_q0;
796 
797 	/* If list is empty. return B_FALSE */
798 	if (eager == tcp) {
799 		return (B_FALSE);
800 	}
801 
802 	/* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
803 	if ((mp = allocb(0, BPRI_HI)) == NULL)
804 		return (B_FALSE);
805 
806 	/*
807 	 * Take this eager out from the list of droppable eagers since we are
808 	 * going to drop it.
809 	 */
810 	MAKE_UNDROPPABLE(eager);
811 
812 	if (tcp->tcp_connp->conn_debug) {
813 		(void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
814 		    "tcp_drop_q0: listen half-open queue (max=%d) overflow"
815 		    " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
816 		    tcp->tcp_conn_req_cnt_q0,
817 		    tcp_display(tcp, NULL, DISP_PORT_ONLY));
818 	}
819 
820 	TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
821 
822 	/* Put a reference on the conn as we are enqueueing it in the sqeue */
823 	CONN_INC_REF(eager->tcp_connp);
824 
825 	SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
826 	    tcp_clean_death_wrapper, eager->tcp_connp, NULL,
827 	    SQ_FILL, SQTAG_TCP_DROP_Q0);
828 
829 	return (B_TRUE);
830 }
831 
832 /*
833  * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
834  */
835 static mblk_t *
836 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
837     ip_recv_attr_t *ira)
838 {
839 	tcp_t 		*ltcp = lconnp->conn_tcp;
840 	tcp_t		*tcp = connp->conn_tcp;
841 	mblk_t		*tpi_mp;
842 	ipha_t		*ipha;
843 	ip6_t		*ip6h;
844 	sin6_t 		sin6;
845 	uint_t		ifindex = ira->ira_ruifindex;
846 	tcp_stack_t	*tcps = tcp->tcp_tcps;
847 
848 	if (ira->ira_flags & IRAF_IS_IPV4) {
849 		ipha = (ipha_t *)mp->b_rptr;
850 
851 		connp->conn_ipversion = IPV4_VERSION;
852 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
853 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
854 		connp->conn_saddr_v6 = connp->conn_laddr_v6;
855 
856 		sin6 = sin6_null;
857 		sin6.sin6_addr = connp->conn_faddr_v6;
858 		sin6.sin6_port = connp->conn_fport;
859 		sin6.sin6_family = AF_INET6;
860 		sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
861 		    IPCL_ZONEID(lconnp), tcps->tcps_netstack);
862 
863 		if (connp->conn_recv_ancillary.crb_recvdstaddr) {
864 			sin6_t	sin6d;
865 
866 			sin6d = sin6_null;
867 			sin6d.sin6_addr = connp->conn_laddr_v6;
868 			sin6d.sin6_port = connp->conn_lport;
869 			sin6d.sin6_family = AF_INET;
870 			tpi_mp = mi_tpi_extconn_ind(NULL,
871 			    (char *)&sin6d, sizeof (sin6_t),
872 			    (char *)&tcp,
873 			    (t_scalar_t)sizeof (intptr_t),
874 			    (char *)&sin6d, sizeof (sin6_t),
875 			    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
876 		} else {
877 			tpi_mp = mi_tpi_conn_ind(NULL,
878 			    (char *)&sin6, sizeof (sin6_t),
879 			    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
880 			    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
881 		}
882 	} else {
883 		ip6h = (ip6_t *)mp->b_rptr;
884 
885 		connp->conn_ipversion = IPV6_VERSION;
886 		connp->conn_laddr_v6 = ip6h->ip6_dst;
887 		connp->conn_faddr_v6 = ip6h->ip6_src;
888 		connp->conn_saddr_v6 = connp->conn_laddr_v6;
889 
890 		sin6 = sin6_null;
891 		sin6.sin6_addr = connp->conn_faddr_v6;
892 		sin6.sin6_port = connp->conn_fport;
893 		sin6.sin6_family = AF_INET6;
894 		sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
895 		sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
896 		    IPCL_ZONEID(lconnp), tcps->tcps_netstack);
897 
898 		if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
899 			/* Pass up the scope_id of remote addr */
900 			sin6.sin6_scope_id = ifindex;
901 		} else {
902 			sin6.sin6_scope_id = 0;
903 		}
904 		if (connp->conn_recv_ancillary.crb_recvdstaddr) {
905 			sin6_t	sin6d;
906 
907 			sin6d = sin6_null;
908 			sin6.sin6_addr = connp->conn_laddr_v6;
909 			sin6d.sin6_port = connp->conn_lport;
910 			sin6d.sin6_family = AF_INET6;
911 			if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
912 				sin6d.sin6_scope_id = ifindex;
913 
914 			tpi_mp = mi_tpi_extconn_ind(NULL,
915 			    (char *)&sin6d, sizeof (sin6_t),
916 			    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
917 			    (char *)&sin6d, sizeof (sin6_t),
918 			    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
919 		} else {
920 			tpi_mp = mi_tpi_conn_ind(NULL,
921 			    (char *)&sin6, sizeof (sin6_t),
922 			    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
923 			    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
924 		}
925 	}
926 
927 	tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
928 	return (tpi_mp);
929 }
930 
931 /* Handle a SYN on an AF_INET socket */
932 static mblk_t *
933 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
934     ip_recv_attr_t *ira)
935 {
936 	tcp_t 		*ltcp = lconnp->conn_tcp;
937 	tcp_t		*tcp = connp->conn_tcp;
938 	sin_t		sin;
939 	mblk_t		*tpi_mp = NULL;
940 	tcp_stack_t	*tcps = tcp->tcp_tcps;
941 	ipha_t		*ipha;
942 
943 	ASSERT(ira->ira_flags & IRAF_IS_IPV4);
944 	ipha = (ipha_t *)mp->b_rptr;
945 
946 	connp->conn_ipversion = IPV4_VERSION;
947 	IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
948 	IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
949 	connp->conn_saddr_v6 = connp->conn_laddr_v6;
950 
951 	sin = sin_null;
952 	sin.sin_addr.s_addr = connp->conn_faddr_v4;
953 	sin.sin_port = connp->conn_fport;
954 	sin.sin_family = AF_INET;
955 	if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
956 		sin_t	sind;
957 
958 		sind = sin_null;
959 		sind.sin_addr.s_addr = connp->conn_laddr_v4;
960 		sind.sin_port = connp->conn_lport;
961 		sind.sin_family = AF_INET;
962 		tpi_mp = mi_tpi_extconn_ind(NULL,
963 		    (char *)&sind, sizeof (sin_t), (char *)&tcp,
964 		    (t_scalar_t)sizeof (intptr_t), (char *)&sind,
965 		    sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
966 	} else {
967 		tpi_mp = mi_tpi_conn_ind(NULL,
968 		    (char *)&sin, sizeof (sin_t),
969 		    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
970 		    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
971 	}
972 
973 	tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
974 	return (tpi_mp);
975 }
976 
977 /*
978  * Called via squeue to get on to eager's perimeter. It sends a
979  * TH_RST if eager is in the fanout table. The listener wants the
980  * eager to disappear either by means of tcp_eager_blowoff() or
981  * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
982  * called (via squeue) if the eager cannot be inserted in the
983  * fanout table in tcp_input_listener().
984  */
985 /* ARGSUSED */
986 void
987 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
988 {
989 	conn_t	*econnp = (conn_t *)arg;
990 	tcp_t	*eager = econnp->conn_tcp;
991 	tcp_t	*listener = eager->tcp_listener;
992 
993 	/*
994 	 * We could be called because listener is closing. Since
995 	 * the eager was using listener's queue's, we avoid
996 	 * using the listeners queues from now on.
997 	 */
998 	ASSERT(eager->tcp_detached);
999 	econnp->conn_rq = NULL;
1000 	econnp->conn_wq = NULL;
1001 
1002 	/*
1003 	 * An eager's conn_fanout will be NULL if it's a duplicate
1004 	 * for an existing 4-tuples in the conn fanout table.
1005 	 * We don't want to send an RST out in such case.
1006 	 */
1007 	if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
1008 		tcp_xmit_ctl("tcp_eager_kill, can't wait",
1009 		    eager, eager->tcp_snxt, 0, TH_RST);
1010 	}
1011 
1012 	/* We are here because listener wants this eager gone */
1013 	if (listener != NULL) {
1014 		mutex_enter(&listener->tcp_eager_lock);
1015 		tcp_eager_unlink(eager);
1016 		if (eager->tcp_tconnind_started) {
1017 			/*
1018 			 * The eager has sent a conn_ind up to the
1019 			 * listener but listener decides to close
1020 			 * instead. We need to drop the extra ref
1021 			 * placed on eager in tcp_input_data() before
1022 			 * sending the conn_ind to listener.
1023 			 */
1024 			CONN_DEC_REF(econnp);
1025 		}
1026 		mutex_exit(&listener->tcp_eager_lock);
1027 		CONN_DEC_REF(listener->tcp_connp);
1028 	}
1029 
1030 	if (eager->tcp_state != TCPS_CLOSED)
1031 		tcp_close_detached(eager);
1032 }
1033 
1034 /*
1035  * Reset any eager connection hanging off this listener marked
1036  * with 'seqnum' and then reclaim it's resources.
1037  */
1038 boolean_t
1039 tcp_eager_blowoff(tcp_t	*listener, t_scalar_t seqnum)
1040 {
1041 	tcp_t	*eager;
1042 	mblk_t 	*mp;
1043 
1044 	eager = listener;
1045 	mutex_enter(&listener->tcp_eager_lock);
1046 	do {
1047 		eager = eager->tcp_eager_next_q;
1048 		if (eager == NULL) {
1049 			mutex_exit(&listener->tcp_eager_lock);
1050 			return (B_FALSE);
1051 		}
1052 	} while (eager->tcp_conn_req_seqnum != seqnum);
1053 
1054 	if (eager->tcp_closemp_used) {
1055 		mutex_exit(&listener->tcp_eager_lock);
1056 		return (B_TRUE);
1057 	}
1058 	eager->tcp_closemp_used = B_TRUE;
1059 	TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1060 	CONN_INC_REF(eager->tcp_connp);
1061 	mutex_exit(&listener->tcp_eager_lock);
1062 	mp = &eager->tcp_closemp;
1063 	SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1064 	    eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1065 	return (B_TRUE);
1066 }
1067 
1068 /*
1069  * Reset any eager connection hanging off this listener
1070  * and then reclaim it's resources.
1071  */
1072 void
1073 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1074 {
1075 	tcp_t	*eager;
1076 	mblk_t	*mp;
1077 	tcp_stack_t	*tcps = listener->tcp_tcps;
1078 
1079 	ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1080 
1081 	if (!q0_only) {
1082 		/* First cleanup q */
1083 		TCP_STAT(tcps, tcp_eager_blowoff_q);
1084 		eager = listener->tcp_eager_next_q;
1085 		while (eager != NULL) {
1086 			if (!eager->tcp_closemp_used) {
1087 				eager->tcp_closemp_used = B_TRUE;
1088 				TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1089 				CONN_INC_REF(eager->tcp_connp);
1090 				mp = &eager->tcp_closemp;
1091 				SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1092 				    tcp_eager_kill, eager->tcp_connp, NULL,
1093 				    SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1094 			}
1095 			eager = eager->tcp_eager_next_q;
1096 		}
1097 	}
1098 	/* Then cleanup q0 */
1099 	TCP_STAT(tcps, tcp_eager_blowoff_q0);
1100 	eager = listener->tcp_eager_next_q0;
1101 	while (eager != listener) {
1102 		if (!eager->tcp_closemp_used) {
1103 			eager->tcp_closemp_used = B_TRUE;
1104 			TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1105 			CONN_INC_REF(eager->tcp_connp);
1106 			mp = &eager->tcp_closemp;
1107 			SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1108 			    tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1109 			    SQTAG_TCP_EAGER_CLEANUP_Q0);
1110 		}
1111 		eager = eager->tcp_eager_next_q0;
1112 	}
1113 }
1114 
1115 /*
1116  * If we are an eager connection hanging off a listener that hasn't
1117  * formally accepted the connection yet, get off his list and blow off
1118  * any data that we have accumulated.
1119  */
1120 void
1121 tcp_eager_unlink(tcp_t *tcp)
1122 {
1123 	tcp_t	*listener = tcp->tcp_listener;
1124 
1125 	ASSERT(listener != NULL);
1126 	ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1127 	if (tcp->tcp_eager_next_q0 != NULL) {
1128 		ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1129 
1130 		/* Remove the eager tcp from q0 */
1131 		tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1132 		    tcp->tcp_eager_prev_q0;
1133 		tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1134 		    tcp->tcp_eager_next_q0;
1135 		ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1136 		listener->tcp_conn_req_cnt_q0--;
1137 
1138 		tcp->tcp_eager_next_q0 = NULL;
1139 		tcp->tcp_eager_prev_q0 = NULL;
1140 
1141 		/*
1142 		 * Take the eager out, if it is in the list of droppable
1143 		 * eagers.
1144 		 */
1145 		MAKE_UNDROPPABLE(tcp);
1146 
1147 		if (tcp->tcp_syn_rcvd_timeout != 0) {
1148 			/* we have timed out before */
1149 			ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1150 			listener->tcp_syn_rcvd_timeout--;
1151 		}
1152 	} else {
1153 		tcp_t   **tcpp = &listener->tcp_eager_next_q;
1154 		tcp_t	*prev = NULL;
1155 
1156 		for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1157 			if (tcpp[0] == tcp) {
1158 				if (listener->tcp_eager_last_q == tcp) {
1159 					/*
1160 					 * If we are unlinking the last
1161 					 * element on the list, adjust
1162 					 * tail pointer. Set tail pointer
1163 					 * to nil when list is empty.
1164 					 */
1165 					ASSERT(tcp->tcp_eager_next_q == NULL);
1166 					if (listener->tcp_eager_last_q ==
1167 					    listener->tcp_eager_next_q) {
1168 						listener->tcp_eager_last_q =
1169 						    NULL;
1170 					} else {
1171 						/*
1172 						 * We won't get here if there
1173 						 * is only one eager in the
1174 						 * list.
1175 						 */
1176 						ASSERT(prev != NULL);
1177 						listener->tcp_eager_last_q =
1178 						    prev;
1179 					}
1180 				}
1181 				tcpp[0] = tcp->tcp_eager_next_q;
1182 				tcp->tcp_eager_next_q = NULL;
1183 				tcp->tcp_eager_last_q = NULL;
1184 				ASSERT(listener->tcp_conn_req_cnt_q > 0);
1185 				listener->tcp_conn_req_cnt_q--;
1186 				break;
1187 			}
1188 			prev = tcpp[0];
1189 		}
1190 	}
1191 	tcp->tcp_listener = NULL;
1192 }
1193 
1194 /* BEGIN CSTYLED */
1195 /*
1196  *
1197  * The sockfs ACCEPT path:
1198  * =======================
1199  *
1200  * The eager is now established in its own perimeter as soon as SYN is
1201  * received in tcp_input_listener(). When sockfs receives conn_ind, it
1202  * completes the accept processing on the acceptor STREAM. The sending
1203  * of conn_ind part is common for both sockfs listener and a TLI/XTI
1204  * listener but a TLI/XTI listener completes the accept processing
1205  * on the listener perimeter.
1206  *
1207  * Common control flow for 3 way handshake:
1208  * ----------------------------------------
1209  *
1210  * incoming SYN (listener perimeter)	-> tcp_input_listener()
1211  *
1212  * incoming SYN-ACK-ACK (eager perim) 	-> tcp_input_data()
1213  * send T_CONN_IND (listener perim)	-> tcp_send_conn_ind()
1214  *
1215  * Sockfs ACCEPT Path:
1216  * -------------------
1217  *
1218  * open acceptor stream (tcp_open allocates tcp_tli_accept()
1219  * as STREAM entry point)
1220  *
1221  * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1222  *
1223  * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1224  * association (we are not behind eager's squeue but sockfs is protecting us
1225  * and no one knows about this stream yet. The STREAMS entry point q->q_info
1226  * is changed to point at tcp_wput().
1227  *
1228  * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1229  * listener (done on listener's perimeter).
1230  *
1231  * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1232  * accept.
1233  *
1234  * TLI/XTI client ACCEPT path:
1235  * ---------------------------
1236  *
1237  * soaccept() sends T_CONN_RES on the listener STREAM.
1238  *
1239  * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1240  * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1241  *
1242  * Locks:
1243  * ======
1244  *
1245  * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1246  * and listeners->tcp_eager_next_q.
1247  *
1248  * Referencing:
1249  * ============
1250  *
1251  * 1) We start out in tcp_input_listener by eager placing a ref on
1252  * listener and listener adding eager to listeners->tcp_eager_next_q0.
1253  *
1254  * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1255  * doing so we place a ref on the eager. This ref is finally dropped at the
1256  * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1257  * reference is dropped by the squeue framework.
1258  *
1259  * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1260  *
1261  * The reference must be released by the same entity that added the reference
1262  * In the above scheme, the eager is the entity that adds and releases the
1263  * references. Note that tcp_accept_finish executes in the squeue of the eager
1264  * (albeit after it is attached to the acceptor stream). Though 1. executes
1265  * in the listener's squeue, the eager is nascent at this point and the
1266  * reference can be considered to have been added on behalf of the eager.
1267  *
1268  * Eager getting a Reset or listener closing:
1269  * ==========================================
1270  *
1271  * Once the listener and eager are linked, the listener never does the unlink.
1272  * If the listener needs to close, tcp_eager_cleanup() is called which queues
1273  * a message on all eager perimeter. The eager then does the unlink, clears
1274  * any pointers to the listener's queue and drops the reference to the
1275  * listener. The listener waits in tcp_close outside the squeue until its
1276  * refcount has dropped to 1. This ensures that the listener has waited for
1277  * all eagers to clear their association with the listener.
1278  *
1279  * Similarly, if eager decides to go away, it can unlink itself and close.
1280  * When the T_CONN_RES comes down, we check if eager has closed. Note that
1281  * the reference to eager is still valid because of the extra ref we put
1282  * in tcp_send_conn_ind.
1283  *
1284  * Listener can always locate the eager under the protection
1285  * of the listener->tcp_eager_lock, and then do a refhold
1286  * on the eager during the accept processing.
1287  *
1288  * The acceptor stream accesses the eager in the accept processing
1289  * based on the ref placed on eager before sending T_conn_ind.
1290  * The only entity that can negate this refhold is a listener close
1291  * which is mutually exclusive with an active acceptor stream.
1292  *
1293  * Eager's reference on the listener
1294  * ===================================
1295  *
1296  * If the accept happens (even on a closed eager) the eager drops its
1297  * reference on the listener at the start of tcp_accept_finish. If the
1298  * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1299  * the reference is dropped in tcp_closei_local. If the listener closes,
1300  * the reference is dropped in tcp_eager_kill. In all cases the reference
1301  * is dropped while executing in the eager's context (squeue).
1302  */
1303 /* END CSTYLED */
1304 
1305 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1306 
1307 /*
1308  * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1309  * tcp_input_data will not see any packets for listeners since the listener
1310  * has conn_recv set to tcp_input_listener.
1311  */
1312 /* ARGSUSED */
1313 static void
1314 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1315 {
1316 	tcpha_t		*tcpha;
1317 	uint32_t	seg_seq;
1318 	tcp_t		*eager;
1319 	int		err;
1320 	conn_t		*econnp = NULL;
1321 	squeue_t	*new_sqp;
1322 	mblk_t		*mp1;
1323 	uint_t 		ip_hdr_len;
1324 	conn_t		*lconnp = (conn_t *)arg;
1325 	tcp_t		*listener = lconnp->conn_tcp;
1326 	tcp_stack_t	*tcps = listener->tcp_tcps;
1327 	ip_stack_t	*ipst = tcps->tcps_netstack->netstack_ip;
1328 	uint_t		flags;
1329 	mblk_t		*tpi_mp;
1330 	uint_t		ifindex = ira->ira_ruifindex;
1331 	boolean_t	tlc_set = B_FALSE;
1332 
1333 	ip_hdr_len = ira->ira_ip_hdr_length;
1334 	tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1335 	flags = (unsigned int)tcpha->tha_flags & 0xFF;
1336 
1337 	DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1338 	    __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1339 	    __dtrace_tcp_tcph_t *, tcpha);
1340 
1341 	if (!(flags & TH_SYN)) {
1342 		if ((flags & TH_RST) || (flags & TH_URG)) {
1343 			freemsg(mp);
1344 			return;
1345 		}
1346 		if (flags & TH_ACK) {
1347 			/* Note this executes in listener's squeue */
1348 			tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1349 			return;
1350 		}
1351 
1352 		freemsg(mp);
1353 		return;
1354 	}
1355 
1356 	if (listener->tcp_state != TCPS_LISTEN)
1357 		goto error2;
1358 
1359 	ASSERT(IPCL_IS_BOUND(lconnp));
1360 
1361 	mutex_enter(&listener->tcp_eager_lock);
1362 
1363 	/*
1364 	 * The system is under memory pressure, so we need to do our part
1365 	 * to relieve the pressure.  So we only accept new request if there
1366 	 * is nothing waiting to be accepted or waiting to complete the 3-way
1367 	 * handshake.  This means that busy listener will not get too many
1368 	 * new requests which they cannot handle in time while non-busy
1369 	 * listener is still functioning properly.
1370 	 */
1371 	if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1372 	    listener->tcp_conn_req_cnt_q0 > 0)) {
1373 		mutex_exit(&listener->tcp_eager_lock);
1374 		TCP_STAT(tcps, tcp_listen_mem_drop);
1375 		goto error2;
1376 	}
1377 
1378 	if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1379 		mutex_exit(&listener->tcp_eager_lock);
1380 		TCP_STAT(tcps, tcp_listendrop);
1381 		TCPS_BUMP_MIB(tcps, tcpListenDrop);
1382 		if (lconnp->conn_debug) {
1383 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1384 			    "tcp_input_listener: listen backlog (max=%d) "
1385 			    "overflow (%d pending) on %s",
1386 			    listener->tcp_conn_req_max,
1387 			    listener->tcp_conn_req_cnt_q,
1388 			    tcp_display(listener, NULL, DISP_PORT_ONLY));
1389 		}
1390 		goto error2;
1391 	}
1392 
1393 	if (listener->tcp_conn_req_cnt_q0 >=
1394 	    listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1395 		/*
1396 		 * Q0 is full. Drop a pending half-open req from the queue
1397 		 * to make room for the new SYN req. Also mark the time we
1398 		 * drop a SYN.
1399 		 *
1400 		 * A more aggressive defense against SYN attack will
1401 		 * be to set the "tcp_syn_defense" flag now.
1402 		 */
1403 		TCP_STAT(tcps, tcp_listendropq0);
1404 		listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1405 		if (!tcp_drop_q0(listener)) {
1406 			mutex_exit(&listener->tcp_eager_lock);
1407 			TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1408 			if (lconnp->conn_debug) {
1409 				(void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1410 				    "tcp_input_listener: listen half-open "
1411 				    "queue (max=%d) full (%d pending) on %s",
1412 				    tcps->tcps_conn_req_max_q0,
1413 				    listener->tcp_conn_req_cnt_q0,
1414 				    tcp_display(listener, NULL,
1415 				    DISP_PORT_ONLY));
1416 			}
1417 			goto error2;
1418 		}
1419 	}
1420 
1421 	/*
1422 	 * Enforce the limit set on the number of connections per listener.
1423 	 * Note that tlc_cnt starts with 1.  So need to add 1 to tlc_max
1424 	 * for comparison.
1425 	 */
1426 	if (listener->tcp_listen_cnt != NULL) {
1427 		tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1428 		int64_t now;
1429 
1430 		if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) {
1431 			mutex_exit(&listener->tcp_eager_lock);
1432 			now = ddi_get_lbolt64();
1433 			atomic_dec_32(&tlc->tlc_cnt);
1434 			TCP_STAT(tcps, tcp_listen_cnt_drop);
1435 			tlc->tlc_drop++;
1436 			if (now - tlc->tlc_report_time >
1437 			    MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1438 				zcmn_err(lconnp->conn_zoneid, CE_WARN,
1439 				    "Listener (port %d) connection max (%u) "
1440 				    "reached: %u attempts dropped total\n",
1441 				    ntohs(listener->tcp_connp->conn_lport),
1442 				    tlc->tlc_max, tlc->tlc_drop);
1443 				tlc->tlc_report_time = now;
1444 			}
1445 			goto error2;
1446 		}
1447 		tlc_set = B_TRUE;
1448 	}
1449 
1450 	mutex_exit(&listener->tcp_eager_lock);
1451 
1452 	/*
1453 	 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1454 	 * or based on the ring (for packets from GLD). Otherwise it is
1455 	 * set based on lbolt i.e., a somewhat random number.
1456 	 */
1457 	ASSERT(ira->ira_sqp != NULL);
1458 	new_sqp = ira->ira_sqp;
1459 
1460 	econnp = (conn_t *)tcp_get_conn(arg2, tcps);
1461 	if (econnp == NULL)
1462 		goto error2;
1463 
1464 	ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1465 	econnp->conn_sqp = new_sqp;
1466 	econnp->conn_initial_sqp = new_sqp;
1467 	econnp->conn_ixa->ixa_sqp = new_sqp;
1468 
1469 	econnp->conn_fport = tcpha->tha_lport;
1470 	econnp->conn_lport = tcpha->tha_fport;
1471 
1472 	err = conn_inherit_parent(lconnp, econnp);
1473 	if (err != 0)
1474 		goto error3;
1475 
1476 	/* We already know the laddr of the new connection is ours */
1477 	econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1478 
1479 	ASSERT(OK_32PTR(mp->b_rptr));
1480 	ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1481 	    IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1482 
1483 	if (lconnp->conn_family == AF_INET) {
1484 		ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1485 		tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1486 	} else {
1487 		tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1488 	}
1489 
1490 	if (tpi_mp == NULL)
1491 		goto error3;
1492 
1493 	eager = econnp->conn_tcp;
1494 	eager->tcp_detached = B_TRUE;
1495 	SOCK_CONNID_INIT(eager->tcp_connid);
1496 
1497 	/*
1498 	 * Initialize the eager's tcp_t and inherit some parameters from
1499 	 * the listener.
1500 	 */
1501 	tcp_init_values(eager, listener);
1502 
1503 	ASSERT((econnp->conn_ixa->ixa_flags &
1504 	    (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1505 	    IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1506 	    (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1507 	    IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1508 
1509 	if (!tcps->tcps_dev_flow_ctl)
1510 		econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1511 
1512 	/* Prepare for diffing against previous packets */
1513 	eager->tcp_recvifindex = 0;
1514 	eager->tcp_recvhops = 0xffffffffU;
1515 
1516 	if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1517 		if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1518 		    IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1519 			econnp->conn_incoming_ifindex = ifindex;
1520 			econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1521 			econnp->conn_ixa->ixa_scopeid = ifindex;
1522 		}
1523 	}
1524 
1525 	if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1526 	    (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1527 	    tcps->tcps_rev_src_routes) {
1528 		ipha_t *ipha = (ipha_t *)mp->b_rptr;
1529 		ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1530 
1531 		/* Source routing option copyover (reverse it) */
1532 		err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1533 		if (err != 0) {
1534 			freemsg(tpi_mp);
1535 			goto error3;
1536 		}
1537 		ip_pkt_source_route_reverse_v4(ipp);
1538 	}
1539 
1540 	ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1541 	ASSERT(!eager->tcp_tconnind_started);
1542 	/*
1543 	 * If the SYN came with a credential, it's a loopback packet or a
1544 	 * labeled packet; attach the credential to the TPI message.
1545 	 */
1546 	if (ira->ira_cred != NULL)
1547 		mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1548 
1549 	eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1550 	ASSERT(eager->tcp_ordrel_mp == NULL);
1551 
1552 	/* Inherit the listener's non-STREAMS flag */
1553 	if (IPCL_IS_NONSTR(lconnp)) {
1554 		econnp->conn_flags |= IPCL_NONSTR;
1555 		/* All non-STREAMS tcp_ts are sockets */
1556 		eager->tcp_issocket = B_TRUE;
1557 	} else {
1558 		/*
1559 		 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1560 		 * at close time, we will always have that to send up.
1561 		 * Otherwise, we need to do special handling in case the
1562 		 * allocation fails at that time.
1563 		 */
1564 		if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1565 			goto error3;
1566 	}
1567 	/*
1568 	 * Now that the IP addresses and ports are setup in econnp we
1569 	 * can do the IPsec policy work.
1570 	 */
1571 	if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1572 		if (lconnp->conn_policy != NULL) {
1573 			/*
1574 			 * Inherit the policy from the listener; use
1575 			 * actions from ira
1576 			 */
1577 			if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1578 				CONN_DEC_REF(econnp);
1579 				freemsg(mp);
1580 				goto error3;
1581 			}
1582 		}
1583 	}
1584 
1585 	/*
1586 	 * tcp_set_destination() may set tcp_rwnd according to the route
1587 	 * metrics. If it does not, the eager's receive window will be set
1588 	 * to the listener's receive window later in this function.
1589 	 */
1590 	eager->tcp_rwnd = 0;
1591 
1592 	if (is_system_labeled()) {
1593 		ip_xmit_attr_t *ixa = econnp->conn_ixa;
1594 
1595 		ASSERT(ira->ira_tsl != NULL);
1596 		/* Discard any old label */
1597 		if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1598 			ASSERT(ixa->ixa_tsl != NULL);
1599 			label_rele(ixa->ixa_tsl);
1600 			ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1601 			ixa->ixa_tsl = NULL;
1602 		}
1603 		if ((lconnp->conn_mlp_type != mlptSingle ||
1604 		    lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1605 		    ira->ira_tsl != NULL) {
1606 			/*
1607 			 * If this is an MLP connection or a MAC-Exempt
1608 			 * connection with an unlabeled node, packets are to be
1609 			 * exchanged using the security label of the received
1610 			 * SYN packet instead of the server application's label.
1611 			 * tsol_check_dest called from ip_set_destination
1612 			 * might later update TSF_UNLABELED by replacing
1613 			 * ixa_tsl with a new label.
1614 			 */
1615 			label_hold(ira->ira_tsl);
1616 			ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1617 			DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1618 			    econnp, ts_label_t *, ixa->ixa_tsl)
1619 		} else {
1620 			ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1621 			DTRACE_PROBE2(syn_accept, conn_t *,
1622 			    econnp, ts_label_t *, ixa->ixa_tsl)
1623 		}
1624 		/*
1625 		 * conn_connect() called from tcp_set_destination will verify
1626 		 * the destination is allowed to receive packets at the
1627 		 * security label of the SYN-ACK we are generating. As part of
1628 		 * that, tsol_check_dest() may create a new effective label for
1629 		 * this connection.
1630 		 * Finally conn_connect() will call conn_update_label.
1631 		 * All that remains for TCP to do is to call
1632 		 * conn_build_hdr_template which is done as part of
1633 		 * tcp_set_destination.
1634 		 */
1635 	}
1636 
1637 	/*
1638 	 * Since we will clear tcp_listener before we clear tcp_detached
1639 	 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1640 	 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1641 	 */
1642 	eager->tcp_hard_binding = B_TRUE;
1643 
1644 	tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1645 	    TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1646 
1647 	CL_INET_CONNECT(econnp, B_FALSE, err);
1648 	if (err != 0) {
1649 		tcp_bind_hash_remove(eager);
1650 		goto error3;
1651 	}
1652 
1653 	SOCK_CONNID_BUMP(eager->tcp_connid);
1654 
1655 	/*
1656 	 * Adapt our mss, ttl, ... based on the remote address.
1657 	 */
1658 
1659 	if (tcp_set_destination(eager) != 0) {
1660 		TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1661 		/* Undo the bind_hash_insert */
1662 		tcp_bind_hash_remove(eager);
1663 		goto error3;
1664 	}
1665 
1666 	/* Process all TCP options. */
1667 	tcp_process_options(eager, tcpha);
1668 
1669 	/* Is the other end ECN capable? */
1670 	if (tcps->tcps_ecn_permitted >= 1 &&
1671 	    (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1672 		eager->tcp_ecn_ok = B_TRUE;
1673 	}
1674 
1675 	/*
1676 	 * The listener's conn_rcvbuf should be the default window size or a
1677 	 * window size changed via SO_RCVBUF option. First round up the
1678 	 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1679 	 * scale option value if needed. Call tcp_rwnd_set() to finish the
1680 	 * setting.
1681 	 *
1682 	 * Note if there is a rpipe metric associated with the remote host,
1683 	 * we should not inherit receive window size from listener.
1684 	 */
1685 	eager->tcp_rwnd = MSS_ROUNDUP(
1686 	    (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1687 	    eager->tcp_rwnd), eager->tcp_mss);
1688 	if (eager->tcp_snd_ws_ok)
1689 		tcp_set_ws_value(eager);
1690 	/*
1691 	 * Note that this is the only place tcp_rwnd_set() is called for
1692 	 * accepting a connection.  We need to call it here instead of
1693 	 * after the 3-way handshake because we need to tell the other
1694 	 * side our rwnd in the SYN-ACK segment.
1695 	 */
1696 	(void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1697 
1698 	ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1699 	    eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1700 
1701 	ASSERT(econnp->conn_rcvbuf != 0 &&
1702 	    econnp->conn_rcvbuf == eager->tcp_rwnd);
1703 
1704 	/* Put a ref on the listener for the eager. */
1705 	CONN_INC_REF(lconnp);
1706 	mutex_enter(&listener->tcp_eager_lock);
1707 	listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1708 	eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1709 	listener->tcp_eager_next_q0 = eager;
1710 	eager->tcp_eager_prev_q0 = listener;
1711 
1712 	/* Set tcp_listener before adding it to tcp_conn_fanout */
1713 	eager->tcp_listener = listener;
1714 	eager->tcp_saved_listener = listener;
1715 
1716 	/*
1717 	 * Set tcp_listen_cnt so that when the connection is done, the counter
1718 	 * is decremented.
1719 	 */
1720 	eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1721 
1722 	/*
1723 	 * Tag this detached tcp vector for later retrieval
1724 	 * by our listener client in tcp_accept().
1725 	 */
1726 	eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1727 	listener->tcp_conn_req_cnt_q0++;
1728 	if (++listener->tcp_conn_req_seqnum == -1) {
1729 		/*
1730 		 * -1 is "special" and defined in TPI as something
1731 		 * that should never be used in T_CONN_IND
1732 		 */
1733 		++listener->tcp_conn_req_seqnum;
1734 	}
1735 	mutex_exit(&listener->tcp_eager_lock);
1736 
1737 	if (listener->tcp_syn_defense) {
1738 		/* Don't drop the SYN that comes from a good IP source */
1739 		ipaddr_t *addr_cache;
1740 
1741 		addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1742 		if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1743 		    addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1744 			eager->tcp_dontdrop = B_TRUE;
1745 		}
1746 	}
1747 
1748 	/*
1749 	 * We need to insert the eager in its own perimeter but as soon
1750 	 * as we do that, we expose the eager to the classifier and
1751 	 * should not touch any field outside the eager's perimeter.
1752 	 * So do all the work necessary before inserting the eager
1753 	 * in its own perimeter. Be optimistic that conn_connect()
1754 	 * will succeed but undo everything if it fails.
1755 	 */
1756 	seg_seq = ntohl(tcpha->tha_seq);
1757 	eager->tcp_irs = seg_seq;
1758 	eager->tcp_rack = seg_seq;
1759 	eager->tcp_rnxt = seg_seq + 1;
1760 	eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1761 	TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1762 	eager->tcp_state = TCPS_SYN_RCVD;
1763 	DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1764 	    econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1765 	    int32_t, TCPS_LISTEN);
1766 
1767 	mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1768 	    NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1769 	if (mp1 == NULL) {
1770 		/*
1771 		 * Increment the ref count as we are going to
1772 		 * enqueueing an mp in squeue
1773 		 */
1774 		CONN_INC_REF(econnp);
1775 		goto error;
1776 	}
1777 
1778 	/*
1779 	 * We need to start the rto timer. In normal case, we start
1780 	 * the timer after sending the packet on the wire (or at
1781 	 * least believing that packet was sent by waiting for
1782 	 * conn_ip_output() to return). Since this is the first packet
1783 	 * being sent on the wire for the eager, our initial tcp_rto
1784 	 * is at least tcp_rexmit_interval_min which is a fairly
1785 	 * large value to allow the algorithm to adjust slowly to large
1786 	 * fluctuations of RTT during first few transmissions.
1787 	 *
1788 	 * Starting the timer first and then sending the packet in this
1789 	 * case shouldn't make much difference since tcp_rexmit_interval_min
1790 	 * is of the order of several 100ms and starting the timer
1791 	 * first and then sending the packet will result in difference
1792 	 * of few micro seconds.
1793 	 *
1794 	 * Without this optimization, we are forced to hold the fanout
1795 	 * lock across the ipcl_bind_insert() and sending the packet
1796 	 * so that we don't race against an incoming packet (maybe RST)
1797 	 * for this eager.
1798 	 *
1799 	 * It is necessary to acquire an extra reference on the eager
1800 	 * at this point and hold it until after tcp_send_data() to
1801 	 * ensure against an eager close race.
1802 	 */
1803 
1804 	CONN_INC_REF(econnp);
1805 
1806 	TCP_TIMER_RESTART(eager, eager->tcp_rto);
1807 
1808 	/*
1809 	 * Insert the eager in its own perimeter now. We are ready to deal
1810 	 * with any packets on eager.
1811 	 */
1812 	if (ipcl_conn_insert(econnp) != 0)
1813 		goto error;
1814 
1815 	ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1816 	freemsg(mp);
1817 	/*
1818 	 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1819 	 * only used by one thread at a time.
1820 	 */
1821 	if (econnp->conn_sqp == lconnp->conn_sqp) {
1822 		DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1823 		    econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1824 		    tcp_t *, eager, __dtrace_tcp_tcph_t *,
1825 		    &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1826 		(void) conn_ip_output(mp1, econnp->conn_ixa);
1827 		CONN_DEC_REF(econnp);
1828 	} else {
1829 		SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1830 		    econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1831 	}
1832 	return;
1833 error:
1834 	freemsg(mp1);
1835 	eager->tcp_closemp_used = B_TRUE;
1836 	TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1837 	mp1 = &eager->tcp_closemp;
1838 	SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1839 	    econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1840 
1841 	/*
1842 	 * If a connection already exists, send the mp to that connections so
1843 	 * that it can be appropriately dealt with.
1844 	 */
1845 	ipst = tcps->tcps_netstack->netstack_ip;
1846 
1847 	if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1848 		if (!IPCL_IS_CONNECTED(econnp)) {
1849 			/*
1850 			 * Something bad happened. ipcl_conn_insert()
1851 			 * failed because a connection already existed
1852 			 * in connected hash but we can't find it
1853 			 * anymore (someone blew it away). Just
1854 			 * free this message and hopefully remote
1855 			 * will retransmit at which time the SYN can be
1856 			 * treated as a new connection or dealth with
1857 			 * a TH_RST if a connection already exists.
1858 			 */
1859 			CONN_DEC_REF(econnp);
1860 			freemsg(mp);
1861 		} else {
1862 			SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1863 			    econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1864 		}
1865 	} else {
1866 		/* Nobody wants this packet */
1867 		freemsg(mp);
1868 	}
1869 	return;
1870 error3:
1871 	CONN_DEC_REF(econnp);
1872 error2:
1873 	freemsg(mp);
1874 	if (tlc_set)
1875 		atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt);
1876 }
1877 
1878 /*
1879  * In an ideal case of vertical partition in NUMA architecture, its
1880  * beneficial to have the listener and all the incoming connections
1881  * tied to the same squeue. The other constraint is that incoming
1882  * connections should be tied to the squeue attached to interrupted
1883  * CPU for obvious locality reason so this leaves the listener to
1884  * be tied to the same squeue. Our only problem is that when listener
1885  * is binding, the CPU that will get interrupted by the NIC whose
1886  * IP address the listener is binding to is not even known. So
1887  * the code below allows us to change that binding at the time the
1888  * CPU is interrupted by virtue of incoming connection's squeue.
1889  *
1890  * This is usefull only in case of a listener bound to a specific IP
1891  * address. For other kind of listeners, they get bound the
1892  * very first time and there is no attempt to rebind them.
1893  */
1894 void
1895 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
1896     ip_recv_attr_t *ira)
1897 {
1898 	conn_t		*connp = (conn_t *)arg;
1899 	squeue_t	*sqp = (squeue_t *)arg2;
1900 	squeue_t	*new_sqp;
1901 	uint32_t	conn_flags;
1902 
1903 	/*
1904 	 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1905 	 * or based on the ring (for packets from GLD). Otherwise it is
1906 	 * set based on lbolt i.e., a somewhat random number.
1907 	 */
1908 	ASSERT(ira->ira_sqp != NULL);
1909 	new_sqp = ira->ira_sqp;
1910 
1911 	if (connp->conn_fanout == NULL)
1912 		goto done;
1913 
1914 	if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
1915 		mutex_enter(&connp->conn_fanout->connf_lock);
1916 		mutex_enter(&connp->conn_lock);
1917 		/*
1918 		 * No one from read or write side can access us now
1919 		 * except for already queued packets on this squeue.
1920 		 * But since we haven't changed the squeue yet, they
1921 		 * can't execute. If they are processed after we have
1922 		 * changed the squeue, they are sent back to the
1923 		 * correct squeue down below.
1924 		 * But a listner close can race with processing of
1925 		 * incoming SYN. If incoming SYN processing changes
1926 		 * the squeue then the listener close which is waiting
1927 		 * to enter the squeue would operate on the wrong
1928 		 * squeue. Hence we don't change the squeue here unless
1929 		 * the refcount is exactly the minimum refcount. The
1930 		 * minimum refcount of 4 is counted as - 1 each for
1931 		 * TCP and IP, 1 for being in the classifier hash, and
1932 		 * 1 for the mblk being processed.
1933 		 */
1934 
1935 		if (connp->conn_ref != 4 ||
1936 		    connp->conn_tcp->tcp_state != TCPS_LISTEN) {
1937 			mutex_exit(&connp->conn_lock);
1938 			mutex_exit(&connp->conn_fanout->connf_lock);
1939 			goto done;
1940 		}
1941 		if (connp->conn_sqp != new_sqp) {
1942 			while (connp->conn_sqp != new_sqp)
1943 				(void) atomic_cas_ptr(&connp->conn_sqp, sqp,
1944 				    new_sqp);
1945 			/* No special MT issues for outbound ixa_sqp hint */
1946 			connp->conn_ixa->ixa_sqp = new_sqp;
1947 		}
1948 
1949 		do {
1950 			conn_flags = connp->conn_flags;
1951 			conn_flags |= IPCL_FULLY_BOUND;
1952 			(void) atomic_cas_32(&connp->conn_flags,
1953 			    connp->conn_flags, conn_flags);
1954 		} while (!(connp->conn_flags & IPCL_FULLY_BOUND));
1955 
1956 		mutex_exit(&connp->conn_fanout->connf_lock);
1957 		mutex_exit(&connp->conn_lock);
1958 
1959 		/*
1960 		 * Assume we have picked a good squeue for the listener. Make
1961 		 * subsequent SYNs not try to change the squeue.
1962 		 */
1963 		connp->conn_recv = tcp_input_listener;
1964 	}
1965 
1966 done:
1967 	if (connp->conn_sqp != sqp) {
1968 		CONN_INC_REF(connp);
1969 		SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
1970 		    ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
1971 	} else {
1972 		tcp_input_listener(connp, mp, sqp, ira);
1973 	}
1974 }
1975 
1976 /*
1977  * Send up all messages queued on tcp_rcv_list.
1978  */
1979 uint_t
1980 tcp_rcv_drain(tcp_t *tcp)
1981 {
1982 	mblk_t *mp;
1983 	uint_t ret = 0;
1984 #ifdef DEBUG
1985 	uint_t cnt = 0;
1986 #endif
1987 	queue_t	*q = tcp->tcp_connp->conn_rq;
1988 
1989 	/* Can't drain on an eager connection */
1990 	if (tcp->tcp_listener != NULL)
1991 		return (ret);
1992 
1993 	/* Can't be a non-STREAMS connection */
1994 	ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1995 
1996 	/* No need for the push timer now. */
1997 	if (tcp->tcp_push_tid != 0) {
1998 		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
1999 		tcp->tcp_push_tid = 0;
2000 	}
2001 
2002 	/*
2003 	 * Handle two cases here: we are currently fused or we were
2004 	 * previously fused and have some urgent data to be delivered
2005 	 * upstream.  The latter happens because we either ran out of
2006 	 * memory or were detached and therefore sending the SIGURG was
2007 	 * deferred until this point.  In either case we pass control
2008 	 * over to tcp_fuse_rcv_drain() since it may need to complete
2009 	 * some work.
2010 	 */
2011 	if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
2012 		if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
2013 		    &tcp->tcp_fused_sigurg_mp))
2014 			return (ret);
2015 	}
2016 
2017 	while ((mp = tcp->tcp_rcv_list) != NULL) {
2018 		tcp->tcp_rcv_list = mp->b_next;
2019 		mp->b_next = NULL;
2020 #ifdef DEBUG
2021 		cnt += msgdsize(mp);
2022 #endif
2023 		putnext(q, mp);
2024 	}
2025 #ifdef DEBUG
2026 	ASSERT(cnt == tcp->tcp_rcv_cnt);
2027 #endif
2028 	tcp->tcp_rcv_last_head = NULL;
2029 	tcp->tcp_rcv_last_tail = NULL;
2030 	tcp->tcp_rcv_cnt = 0;
2031 
2032 	if (canputnext(q))
2033 		return (tcp_rwnd_reopen(tcp));
2034 
2035 	return (ret);
2036 }
2037 
2038 /*
2039  * Queue data on tcp_rcv_list which is a b_next chain.
2040  * tcp_rcv_last_head/tail is the last element of this chain.
2041  * Each element of the chain is a b_cont chain.
2042  *
2043  * M_DATA messages are added to the current element.
2044  * Other messages are added as new (b_next) elements.
2045  */
2046 void
2047 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
2048 {
2049 	ASSERT(seg_len == msgdsize(mp));
2050 	ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
2051 
2052 	if (is_system_labeled()) {
2053 		ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2054 		/*
2055 		 * Provide for protocols above TCP such as RPC. NOPID leaves
2056 		 * db_cpid unchanged.
2057 		 * The cred could have already been set.
2058 		 */
2059 		if (cr != NULL)
2060 			mblk_setcred(mp, cr, NOPID);
2061 	}
2062 
2063 	if (tcp->tcp_rcv_list == NULL) {
2064 		ASSERT(tcp->tcp_rcv_last_head == NULL);
2065 		tcp->tcp_rcv_list = mp;
2066 		tcp->tcp_rcv_last_head = mp;
2067 	} else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2068 		tcp->tcp_rcv_last_tail->b_cont = mp;
2069 	} else {
2070 		tcp->tcp_rcv_last_head->b_next = mp;
2071 		tcp->tcp_rcv_last_head = mp;
2072 	}
2073 
2074 	while (mp->b_cont)
2075 		mp = mp->b_cont;
2076 
2077 	tcp->tcp_rcv_last_tail = mp;
2078 	tcp->tcp_rcv_cnt += seg_len;
2079 	tcp->tcp_rwnd -= seg_len;
2080 }
2081 
2082 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2083 mblk_t *
2084 tcp_ack_mp(tcp_t *tcp)
2085 {
2086 	uint32_t	seq_no;
2087 	tcp_stack_t	*tcps = tcp->tcp_tcps;
2088 	conn_t		*connp = tcp->tcp_connp;
2089 
2090 	/*
2091 	 * There are a few cases to be considered while setting the sequence no.
2092 	 * Essentially, we can come here while processing an unacceptable pkt
2093 	 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2094 	 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2095 	 * If we are here for a zero window probe, stick with suna. In all
2096 	 * other cases, we check if suna + swnd encompasses snxt and set
2097 	 * the sequence number to snxt, if so. If snxt falls outside the
2098 	 * window (the receiver probably shrunk its window), we will go with
2099 	 * suna + swnd, otherwise the sequence no will be unacceptable to the
2100 	 * receiver.
2101 	 */
2102 	if (tcp->tcp_zero_win_probe) {
2103 		seq_no = tcp->tcp_suna;
2104 	} else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2105 		ASSERT(tcp->tcp_swnd == 0);
2106 		seq_no = tcp->tcp_snxt;
2107 	} else {
2108 		seq_no = SEQ_GT(tcp->tcp_snxt,
2109 		    (tcp->tcp_suna + tcp->tcp_swnd)) ?
2110 		    (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2111 	}
2112 
2113 	if (tcp->tcp_valid_bits) {
2114 		/*
2115 		 * For the complex case where we have to send some
2116 		 * controls (FIN or SYN), let tcp_xmit_mp do it.
2117 		 */
2118 		return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2119 		    NULL, B_FALSE));
2120 	} else {
2121 		/* Generate a simple ACK */
2122 		int	data_length;
2123 		uchar_t	*rptr;
2124 		tcpha_t	*tcpha;
2125 		mblk_t	*mp1;
2126 		int32_t	total_hdr_len;
2127 		int32_t	tcp_hdr_len;
2128 		int32_t	num_sack_blk = 0;
2129 		int32_t sack_opt_len;
2130 		ip_xmit_attr_t *ixa = connp->conn_ixa;
2131 
2132 		/*
2133 		 * Allocate space for TCP + IP headers
2134 		 * and link-level header
2135 		 */
2136 		if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2137 			num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2138 			    tcp->tcp_num_sack_blk);
2139 			sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2140 			    TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2141 			total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2142 			tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2143 		} else {
2144 			total_hdr_len = connp->conn_ht_iphc_len;
2145 			tcp_hdr_len = connp->conn_ht_ulp_len;
2146 		}
2147 		mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2148 		if (!mp1)
2149 			return (NULL);
2150 
2151 		/* Update the latest receive window size in TCP header. */
2152 		tcp->tcp_tcpha->tha_win =
2153 		    htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2154 		/* copy in prototype TCP + IP header */
2155 		rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2156 		mp1->b_rptr = rptr;
2157 		mp1->b_wptr = rptr + total_hdr_len;
2158 		bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2159 
2160 		tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2161 
2162 		/* Set the TCP sequence number. */
2163 		tcpha->tha_seq = htonl(seq_no);
2164 
2165 		/* Set up the TCP flag field. */
2166 		tcpha->tha_flags = (uchar_t)TH_ACK;
2167 		if (tcp->tcp_ecn_echo_on)
2168 			tcpha->tha_flags |= TH_ECE;
2169 
2170 		tcp->tcp_rack = tcp->tcp_rnxt;
2171 		tcp->tcp_rack_cnt = 0;
2172 
2173 		/* fill in timestamp option if in use */
2174 		if (tcp->tcp_snd_ts_ok) {
2175 			uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2176 
2177 			U32_TO_BE32(llbolt,
2178 			    (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2179 			U32_TO_BE32(tcp->tcp_ts_recent,
2180 			    (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2181 		}
2182 
2183 		/* Fill in SACK options */
2184 		if (num_sack_blk > 0) {
2185 			uchar_t *wptr = (uchar_t *)tcpha +
2186 			    connp->conn_ht_ulp_len;
2187 			sack_blk_t *tmp;
2188 			int32_t	i;
2189 
2190 			wptr[0] = TCPOPT_NOP;
2191 			wptr[1] = TCPOPT_NOP;
2192 			wptr[2] = TCPOPT_SACK;
2193 			wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2194 			    sizeof (sack_blk_t);
2195 			wptr += TCPOPT_REAL_SACK_LEN;
2196 
2197 			tmp = tcp->tcp_sack_list;
2198 			for (i = 0; i < num_sack_blk; i++) {
2199 				U32_TO_BE32(tmp[i].begin, wptr);
2200 				wptr += sizeof (tcp_seq);
2201 				U32_TO_BE32(tmp[i].end, wptr);
2202 				wptr += sizeof (tcp_seq);
2203 			}
2204 			tcpha->tha_offset_and_reserved +=
2205 			    ((num_sack_blk * 2 + 1) << 4);
2206 		}
2207 
2208 		ixa->ixa_pktlen = total_hdr_len;
2209 
2210 		if (ixa->ixa_flags & IXAF_IS_IPV4) {
2211 			((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2212 		} else {
2213 			ip6_t *ip6 = (ip6_t *)rptr;
2214 
2215 			ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2216 		}
2217 
2218 		/*
2219 		 * Prime pump for checksum calculation in IP.  Include the
2220 		 * adjustment for a source route if any.
2221 		 */
2222 		data_length = tcp_hdr_len + connp->conn_sum;
2223 		data_length = (data_length >> 16) + (data_length & 0xFFFF);
2224 		tcpha->tha_sum = htons(data_length);
2225 
2226 		if (tcp->tcp_ip_forward_progress) {
2227 			tcp->tcp_ip_forward_progress = B_FALSE;
2228 			connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2229 		} else {
2230 			connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2231 		}
2232 		return (mp1);
2233 	}
2234 }
2235 
2236 /*
2237  * Dummy socket upcalls for if/when the conn_t gets detached from a
2238  * direct-callback sonode via a user-driven close().  Easy to catch with
2239  * DTrace FBT, and should be mostly harmless.
2240  */
2241 
2242 /* ARGSUSED */
2243 static sock_upper_handle_t
2244 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2245     sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2246 {
2247 	ASSERT(0);	/* Panic in debug, otherwise ignore. */
2248 	return (NULL);
2249 }
2250 
2251 /* ARGSUSED */
2252 static void
2253 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2254     pid_t pid)
2255 {
2256 	ASSERT(x == NULL);
2257 	/* Normally we'd crhold(cr) and attach it to socket state. */
2258 	/* LINTED */
2259 }
2260 
2261 /* ARGSUSED */
2262 static int
2263 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2264 {
2265 	ASSERT(0);	/* Panic in debug, otherwise ignore. */
2266 	return (-1);
2267 }
2268 
2269 /* ARGSUSED */
2270 static void
2271 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2272 {
2273 	ASSERT(x == NULL);
2274 	/* We really want this one to be a harmless NOP for now. */
2275 	/* LINTED */
2276 }
2277 
2278 /* ARGSUSED */
2279 static ssize_t
2280 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2281     int *error, boolean_t *push)
2282 {
2283 	ASSERT(x == NULL);
2284 
2285 	/*
2286 	 * Consume the message, set ESHUTDOWN, and return an error.
2287 	 * Nobody's home!
2288 	 */
2289 	freemsg(mp);
2290 	*error = ESHUTDOWN;
2291 	return (-1);
2292 }
2293 
2294 /* ARGSUSED */
2295 static void
2296 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2297 {
2298 	ASSERT(0);	/* Panic in debug, otherwise ignore. */
2299 }
2300 
2301 /* ARGSUSED */
2302 static void
2303 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2304 {
2305 	ASSERT(0);	/* Panic in debug, otherwise ignore. */
2306 }
2307 
2308 /* ARGSUSED */
2309 static void
2310 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2311 {
2312 	ASSERT(x == NULL);
2313 	/* Otherwise, this would signal socket state about OOB data. */
2314 }
2315 
2316 /* ARGSUSED */
2317 static void
2318 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2319 {
2320 	ASSERT(0);	/* Panic in debug, otherwise ignore. */
2321 }
2322 
2323 /* ARGSUSED */
2324 static void
2325 tcp_dummy_onearg(sock_upper_handle_t x)
2326 {
2327 	ASSERT(0);	/* Panic in debug, otherwise ignore. */
2328 }
2329 
2330 static sock_upcalls_t tcp_dummy_upcalls = {
2331 	tcp_dummy_newconn,
2332 	tcp_dummy_connected,
2333 	tcp_dummy_disconnected,
2334 	tcp_dummy_opctl,
2335 	tcp_dummy_recv,
2336 	tcp_dummy_set_proto_props,
2337 	tcp_dummy_txq_full,
2338 	tcp_dummy_signal_oob,
2339 	tcp_dummy_onearg,
2340 	tcp_dummy_set_error,
2341 	tcp_dummy_onearg
2342 };
2343 
2344 /*
2345  * Handle M_DATA messages from IP. Its called directly from IP via
2346  * squeue for received IP packets.
2347  *
2348  * The first argument is always the connp/tcp to which the mp belongs.
2349  * There are no exceptions to this rule. The caller has already put
2350  * a reference on this connp/tcp and once tcp_input_data() returns,
2351  * the squeue will do the refrele.
2352  *
2353  * The TH_SYN for the listener directly go to tcp_input_listener via
2354  * squeue. ICMP errors go directly to tcp_icmp_input().
2355  *
2356  * sqp: NULL = recursive, sqp != NULL means called from squeue
2357  */
2358 void
2359 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2360 {
2361 	int32_t		bytes_acked;
2362 	int32_t		gap;
2363 	mblk_t		*mp1;
2364 	uint_t		flags;
2365 	uint32_t	new_swnd = 0;
2366 	uchar_t		*iphdr;
2367 	uchar_t		*rptr;
2368 	int32_t		rgap;
2369 	uint32_t	seg_ack;
2370 	int		seg_len;
2371 	uint_t		ip_hdr_len;
2372 	uint32_t	seg_seq;
2373 	tcpha_t		*tcpha;
2374 	int		urp;
2375 	tcp_opt_t	tcpopt;
2376 	ip_pkt_t	ipp;
2377 	boolean_t	ofo_seg = B_FALSE; /* Out of order segment */
2378 	uint32_t	cwnd;
2379 	uint32_t	add;
2380 	int		npkt;
2381 	int		mss;
2382 	conn_t		*connp = (conn_t *)arg;
2383 	squeue_t	*sqp = (squeue_t *)arg2;
2384 	tcp_t		*tcp = connp->conn_tcp;
2385 	tcp_stack_t	*tcps = tcp->tcp_tcps;
2386 	sock_upcalls_t	*sockupcalls;
2387 
2388 	/*
2389 	 * RST from fused tcp loopback peer should trigger an unfuse.
2390 	 */
2391 	if (tcp->tcp_fused) {
2392 		TCP_STAT(tcps, tcp_fusion_aborted);
2393 		tcp_unfuse(tcp);
2394 	}
2395 
2396 	iphdr = mp->b_rptr;
2397 	rptr = mp->b_rptr;
2398 	ASSERT(OK_32PTR(rptr));
2399 
2400 	ip_hdr_len = ira->ira_ip_hdr_length;
2401 	if (connp->conn_recv_ancillary.crb_all != 0) {
2402 		/*
2403 		 * Record packet information in the ip_pkt_t
2404 		 */
2405 		ipp.ipp_fields = 0;
2406 		if (ira->ira_flags & IRAF_IS_IPV4) {
2407 			(void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2408 			    B_FALSE);
2409 		} else {
2410 			uint8_t nexthdrp;
2411 
2412 			/*
2413 			 * IPv6 packets can only be received by applications
2414 			 * that are prepared to receive IPv6 addresses.
2415 			 * The IP fanout must ensure this.
2416 			 */
2417 			ASSERT(connp->conn_family == AF_INET6);
2418 
2419 			(void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2420 			    &nexthdrp);
2421 			ASSERT(nexthdrp == IPPROTO_TCP);
2422 
2423 			/* Could have caused a pullup? */
2424 			iphdr = mp->b_rptr;
2425 			rptr = mp->b_rptr;
2426 		}
2427 	}
2428 	ASSERT(DB_TYPE(mp) == M_DATA);
2429 	ASSERT(mp->b_next == NULL);
2430 
2431 	tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2432 	seg_seq = ntohl(tcpha->tha_seq);
2433 	seg_ack = ntohl(tcpha->tha_ack);
2434 	ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2435 	seg_len = (int)(mp->b_wptr - rptr) -
2436 	    (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2437 	if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2438 		do {
2439 			ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2440 			    (uintptr_t)INT_MAX);
2441 			seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2442 		} while ((mp1 = mp1->b_cont) != NULL &&
2443 		    mp1->b_datap->db_type == M_DATA);
2444 	}
2445 
2446 	DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2447 	    __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2448 	    __dtrace_tcp_tcph_t *, tcpha);
2449 
2450 	if (tcp->tcp_state == TCPS_TIME_WAIT) {
2451 		tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2452 		    seg_len, tcpha, ira);
2453 		return;
2454 	}
2455 
2456 	if (sqp != NULL) {
2457 		/*
2458 		 * This is the correct place to update tcp_last_recv_time. Note
2459 		 * that it is also updated for tcp structure that belongs to
2460 		 * global and listener queues which do not really need updating.
2461 		 * But that should not cause any harm.  And it is updated for
2462 		 * all kinds of incoming segments, not only for data segments.
2463 		 */
2464 		tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2465 	}
2466 
2467 	flags = (unsigned int)tcpha->tha_flags & 0xFF;
2468 
2469 	BUMP_LOCAL(tcp->tcp_ibsegs);
2470 	DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2471 
2472 	if ((flags & TH_URG) && sqp != NULL) {
2473 		/*
2474 		 * TCP can't handle urgent pointers that arrive before
2475 		 * the connection has been accept()ed since it can't
2476 		 * buffer OOB data.  Discard segment if this happens.
2477 		 *
2478 		 * We can't just rely on a non-null tcp_listener to indicate
2479 		 * that the accept() has completed since unlinking of the
2480 		 * eager and completion of the accept are not atomic.
2481 		 * tcp_detached, when it is not set (B_FALSE) indicates
2482 		 * that the accept() has completed.
2483 		 *
2484 		 * Nor can it reassemble urgent pointers, so discard
2485 		 * if it's not the next segment expected.
2486 		 *
2487 		 * Otherwise, collapse chain into one mblk (discard if
2488 		 * that fails).  This makes sure the headers, retransmitted
2489 		 * data, and new data all are in the same mblk.
2490 		 */
2491 		ASSERT(mp != NULL);
2492 		if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2493 			freemsg(mp);
2494 			return;
2495 		}
2496 		/* Update pointers into message */
2497 		iphdr = rptr = mp->b_rptr;
2498 		tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2499 		if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2500 			/*
2501 			 * Since we can't handle any data with this urgent
2502 			 * pointer that is out of sequence, we expunge
2503 			 * the data.  This allows us to still register
2504 			 * the urgent mark and generate the M_PCSIG,
2505 			 * which we can do.
2506 			 */
2507 			mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2508 			seg_len = 0;
2509 		}
2510 	}
2511 
2512 	sockupcalls = connp->conn_upcalls;
2513 	/* A conn_t may have belonged to a now-closed socket.  Be careful. */
2514 	if (sockupcalls == NULL)
2515 		sockupcalls = &tcp_dummy_upcalls;
2516 
2517 	switch (tcp->tcp_state) {
2518 	case TCPS_SYN_SENT:
2519 		if (connp->conn_final_sqp == NULL &&
2520 		    tcp_outbound_squeue_switch && sqp != NULL) {
2521 			ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2522 			connp->conn_final_sqp = sqp;
2523 			if (connp->conn_final_sqp != connp->conn_sqp) {
2524 				DTRACE_PROBE1(conn__final__sqp__switch,
2525 				    conn_t *, connp);
2526 				CONN_INC_REF(connp);
2527 				SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2528 				SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2529 				    tcp_input_data, connp, ira, ip_squeue_flag,
2530 				    SQTAG_CONNECT_FINISH);
2531 				return;
2532 			}
2533 			DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2534 		}
2535 		if (flags & TH_ACK) {
2536 			/*
2537 			 * Note that our stack cannot send data before a
2538 			 * connection is established, therefore the
2539 			 * following check is valid.  Otherwise, it has
2540 			 * to be changed.
2541 			 */
2542 			if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2543 			    SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2544 				freemsg(mp);
2545 				if (flags & TH_RST)
2546 					return;
2547 				tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2548 				    tcp, seg_ack, 0, TH_RST);
2549 				return;
2550 			}
2551 			ASSERT(tcp->tcp_suna + 1 == seg_ack);
2552 		}
2553 		if (flags & TH_RST) {
2554 			if (flags & TH_ACK) {
2555 				DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2556 				    ip_xmit_attr_t *, connp->conn_ixa,
2557 				    void_ip_t *, iphdr, tcp_t *, tcp,
2558 				    tcph_t *, tcpha);
2559 				(void) tcp_clean_death(tcp, ECONNREFUSED);
2560 			}
2561 			freemsg(mp);
2562 			return;
2563 		}
2564 		if (!(flags & TH_SYN)) {
2565 			freemsg(mp);
2566 			return;
2567 		}
2568 
2569 		/* Process all TCP options. */
2570 		tcp_process_options(tcp, tcpha);
2571 		/*
2572 		 * The following changes our rwnd to be a multiple of the
2573 		 * MIN(peer MSS, our MSS) for performance reason.
2574 		 */
2575 		(void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2576 		    tcp->tcp_mss));
2577 
2578 		/* Is the other end ECN capable? */
2579 		if (tcp->tcp_ecn_ok) {
2580 			if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2581 				tcp->tcp_ecn_ok = B_FALSE;
2582 			}
2583 		}
2584 		/*
2585 		 * Clear ECN flags because it may interfere with later
2586 		 * processing.
2587 		 */
2588 		flags &= ~(TH_ECE|TH_CWR);
2589 
2590 		tcp->tcp_irs = seg_seq;
2591 		tcp->tcp_rack = seg_seq;
2592 		tcp->tcp_rnxt = seg_seq + 1;
2593 		tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2594 		if (!TCP_IS_DETACHED(tcp)) {
2595 			/* Allocate room for SACK options if needed. */
2596 			connp->conn_wroff = connp->conn_ht_iphc_len;
2597 			if (tcp->tcp_snd_sack_ok)
2598 				connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2599 			if (!tcp->tcp_loopback)
2600 				connp->conn_wroff += tcps->tcps_wroff_xtra;
2601 
2602 			(void) proto_set_tx_wroff(connp->conn_rq, connp,
2603 			    connp->conn_wroff);
2604 		}
2605 		if (flags & TH_ACK) {
2606 			/*
2607 			 * If we can't get the confirmation upstream, pretend
2608 			 * we didn't even see this one.
2609 			 *
2610 			 * XXX: how can we pretend we didn't see it if we
2611 			 * have updated rnxt et. al.
2612 			 *
2613 			 * For loopback we defer sending up the T_CONN_CON
2614 			 * until after some checks below.
2615 			 */
2616 			mp1 = NULL;
2617 			/*
2618 			 * tcp_sendmsg() checks tcp_state without entering
2619 			 * the squeue so tcp_state should be updated before
2620 			 * sending up connection confirmation.  Probe the
2621 			 * state change below when we are sure the connection
2622 			 * confirmation has been sent.
2623 			 */
2624 			tcp->tcp_state = TCPS_ESTABLISHED;
2625 			if (!tcp_conn_con(tcp, iphdr, mp,
2626 			    tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2627 				tcp->tcp_state = TCPS_SYN_SENT;
2628 				freemsg(mp);
2629 				return;
2630 			}
2631 			TCPS_CONN_INC(tcps);
2632 			/* SYN was acked - making progress */
2633 			tcp->tcp_ip_forward_progress = B_TRUE;
2634 
2635 			/* One for the SYN */
2636 			tcp->tcp_suna = tcp->tcp_iss + 1;
2637 			tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
2638 
2639 			/*
2640 			 * If SYN was retransmitted, need to reset all
2641 			 * retransmission info.  This is because this
2642 			 * segment will be treated as a dup ACK.
2643 			 */
2644 			if (tcp->tcp_rexmit) {
2645 				tcp->tcp_rexmit = B_FALSE;
2646 				tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2647 				tcp->tcp_rexmit_max = tcp->tcp_snxt;
2648 				tcp->tcp_ms_we_have_waited = 0;
2649 
2650 				/*
2651 				 * Set tcp_cwnd back to 1 MSS, per
2652 				 * recommendation from
2653 				 * draft-floyd-incr-init-win-01.txt,
2654 				 * Increasing TCP's Initial Window.
2655 				 */
2656 				tcp->tcp_cwnd = tcp->tcp_mss;
2657 			}
2658 
2659 			tcp->tcp_swl1 = seg_seq;
2660 			tcp->tcp_swl2 = seg_ack;
2661 
2662 			new_swnd = ntohs(tcpha->tha_win);
2663 			tcp->tcp_swnd = new_swnd;
2664 			if (new_swnd > tcp->tcp_max_swnd)
2665 				tcp->tcp_max_swnd = new_swnd;
2666 
2667 			/*
2668 			 * Always send the three-way handshake ack immediately
2669 			 * in order to make the connection complete as soon as
2670 			 * possible on the accepting host.
2671 			 */
2672 			flags |= TH_ACK_NEEDED;
2673 
2674 			/*
2675 			 * Trace connect-established here.
2676 			 */
2677 			DTRACE_TCP5(connect__established, mblk_t *, NULL,
2678 			    ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2679 			    void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2680 
2681 			/* Trace change from SYN_SENT -> ESTABLISHED here */
2682 			DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2683 			    connp->conn_ixa, void, NULL, tcp_t *, tcp,
2684 			    void, NULL, int32_t, TCPS_SYN_SENT);
2685 
2686 			/*
2687 			 * Special case for loopback.  At this point we have
2688 			 * received SYN-ACK from the remote endpoint.  In
2689 			 * order to ensure that both endpoints reach the
2690 			 * fused state prior to any data exchange, the final
2691 			 * ACK needs to be sent before we indicate T_CONN_CON
2692 			 * to the module upstream.
2693 			 */
2694 			if (tcp->tcp_loopback) {
2695 				mblk_t *ack_mp;
2696 
2697 				ASSERT(!tcp->tcp_unfusable);
2698 				ASSERT(mp1 != NULL);
2699 				/*
2700 				 * For loopback, we always get a pure SYN-ACK
2701 				 * and only need to send back the final ACK
2702 				 * with no data (this is because the other
2703 				 * tcp is ours and we don't do T/TCP).  This
2704 				 * final ACK triggers the passive side to
2705 				 * perform fusion in ESTABLISHED state.
2706 				 */
2707 				if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2708 					if (tcp->tcp_ack_tid != 0) {
2709 						(void) TCP_TIMER_CANCEL(tcp,
2710 						    tcp->tcp_ack_tid);
2711 						tcp->tcp_ack_tid = 0;
2712 					}
2713 					tcp_send_data(tcp, ack_mp);
2714 					BUMP_LOCAL(tcp->tcp_obsegs);
2715 					TCPS_BUMP_MIB(tcps, tcpOutAck);
2716 
2717 					if (!IPCL_IS_NONSTR(connp)) {
2718 						/* Send up T_CONN_CON */
2719 						if (ira->ira_cred != NULL) {
2720 							mblk_setcred(mp1,
2721 							    ira->ira_cred,
2722 							    ira->ira_cpid);
2723 						}
2724 						putnext(connp->conn_rq, mp1);
2725 					} else {
2726 						(*sockupcalls->su_connected)
2727 						    (connp->conn_upper_handle,
2728 						    tcp->tcp_connid,
2729 						    ira->ira_cred,
2730 						    ira->ira_cpid);
2731 						freemsg(mp1);
2732 					}
2733 
2734 					freemsg(mp);
2735 					return;
2736 				}
2737 				/*
2738 				 * Forget fusion; we need to handle more
2739 				 * complex cases below.  Send the deferred
2740 				 * T_CONN_CON message upstream and proceed
2741 				 * as usual.  Mark this tcp as not capable
2742 				 * of fusion.
2743 				 */
2744 				TCP_STAT(tcps, tcp_fusion_unfusable);
2745 				tcp->tcp_unfusable = B_TRUE;
2746 				if (!IPCL_IS_NONSTR(connp)) {
2747 					if (ira->ira_cred != NULL) {
2748 						mblk_setcred(mp1, ira->ira_cred,
2749 						    ira->ira_cpid);
2750 					}
2751 					putnext(connp->conn_rq, mp1);
2752 				} else {
2753 					(*sockupcalls->su_connected)
2754 					    (connp->conn_upper_handle,
2755 					    tcp->tcp_connid, ira->ira_cred,
2756 					    ira->ira_cpid);
2757 					freemsg(mp1);
2758 				}
2759 			}
2760 
2761 			/*
2762 			 * Check to see if there is data to be sent.  If
2763 			 * yes, set the transmit flag.  Then check to see
2764 			 * if received data processing needs to be done.
2765 			 * If not, go straight to xmit_check.  This short
2766 			 * cut is OK as we don't support T/TCP.
2767 			 */
2768 			if (tcp->tcp_unsent)
2769 				flags |= TH_XMIT_NEEDED;
2770 
2771 			if (seg_len == 0 && !(flags & TH_URG)) {
2772 				freemsg(mp);
2773 				goto xmit_check;
2774 			}
2775 
2776 			flags &= ~TH_SYN;
2777 			seg_seq++;
2778 			break;
2779 		}
2780 		tcp->tcp_state = TCPS_SYN_RCVD;
2781 		DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2782 		    connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2783 		    tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2784 		mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2785 		    NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2786 		if (mp1 != NULL) {
2787 			tcp_send_data(tcp, mp1);
2788 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2789 		}
2790 		freemsg(mp);
2791 		return;
2792 	case TCPS_SYN_RCVD:
2793 		if (flags & TH_ACK) {
2794 			uint32_t pinit_wnd;
2795 
2796 			/*
2797 			 * In this state, a SYN|ACK packet is either bogus
2798 			 * because the other side must be ACKing our SYN which
2799 			 * indicates it has seen the ACK for their SYN and
2800 			 * shouldn't retransmit it or we're crossing SYNs
2801 			 * on active open.
2802 			 */
2803 			if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2804 				freemsg(mp);
2805 				tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2806 				    tcp, seg_ack, 0, TH_RST);
2807 				return;
2808 			}
2809 			/*
2810 			 * NOTE: RFC 793 pg. 72 says this should be
2811 			 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2812 			 * but that would mean we have an ack that ignored
2813 			 * our SYN.
2814 			 */
2815 			if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2816 			    SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2817 				freemsg(mp);
2818 				tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2819 				    tcp, seg_ack, 0, TH_RST);
2820 				return;
2821 			}
2822 			/*
2823 			 * No sane TCP stack will send such a small window
2824 			 * without receiving any data.  Just drop this invalid
2825 			 * ACK.  We also shorten the abort timeout in case
2826 			 * this is an attack.
2827 			 */
2828 			pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2829 			if (pinit_wnd < tcp->tcp_mss &&
2830 			    pinit_wnd < tcp_init_wnd_chk) {
2831 				freemsg(mp);
2832 				TCP_STAT(tcps, tcp_zwin_ack_syn);
2833 				tcp->tcp_second_ctimer_threshold =
2834 				    tcp_early_abort * SECONDS;
2835 				return;
2836 			}
2837 		}
2838 		break;
2839 	case TCPS_LISTEN:
2840 		/*
2841 		 * Only a TLI listener can come through this path when a
2842 		 * acceptor is going back to be a listener and a packet
2843 		 * for the acceptor hits the classifier. For a socket
2844 		 * listener, this can never happen because a listener
2845 		 * can never accept connection on itself and hence a
2846 		 * socket acceptor can not go back to being a listener.
2847 		 */
2848 		ASSERT(!TCP_IS_SOCKET(tcp));
2849 		/*FALLTHRU*/
2850 	case TCPS_CLOSED:
2851 	case TCPS_BOUND: {
2852 		conn_t	*new_connp;
2853 		ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2854 
2855 		/*
2856 		 * Don't accept any input on a closed tcp as this TCP logically
2857 		 * does not exist on the system. Don't proceed further with
2858 		 * this TCP. For instance, this packet could trigger another
2859 		 * close of this tcp which would be disastrous for tcp_refcnt.
2860 		 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2861 		 * be called at most once on a TCP. In this case we need to
2862 		 * refeed the packet into the classifier and figure out where
2863 		 * the packet should go.
2864 		 */
2865 		new_connp = ipcl_classify(mp, ira, ipst);
2866 		if (new_connp != NULL) {
2867 			/* Drops ref on new_connp */
2868 			tcp_reinput(new_connp, mp, ira, ipst);
2869 			return;
2870 		}
2871 		/* We failed to classify. For now just drop the packet */
2872 		freemsg(mp);
2873 		return;
2874 	}
2875 	case TCPS_IDLE:
2876 		/*
2877 		 * Handle the case where the tcp_clean_death() has happened
2878 		 * on a connection (application hasn't closed yet) but a packet
2879 		 * was already queued on squeue before tcp_clean_death()
2880 		 * was processed. Calling tcp_clean_death() twice on same
2881 		 * connection can result in weird behaviour.
2882 		 */
2883 		freemsg(mp);
2884 		return;
2885 	default:
2886 		break;
2887 	}
2888 
2889 	/*
2890 	 * Already on the correct queue/perimeter.
2891 	 * If this is a detached connection and not an eager
2892 	 * connection hanging off a listener then new data
2893 	 * (past the FIN) will cause a reset.
2894 	 * We do a special check here where it
2895 	 * is out of the main line, rather than check
2896 	 * if we are detached every time we see new
2897 	 * data down below.
2898 	 */
2899 	if (TCP_IS_DETACHED_NONEAGER(tcp) &&
2900 	    (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
2901 		TCPS_BUMP_MIB(tcps, tcpInClosed);
2902 		DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2903 		freemsg(mp);
2904 		tcp_xmit_ctl("new data when detached", tcp,
2905 		    tcp->tcp_snxt, 0, TH_RST);
2906 		(void) tcp_clean_death(tcp, EPROTO);
2907 		return;
2908 	}
2909 
2910 	mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2911 	urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
2912 	new_swnd = ntohs(tcpha->tha_win) <<
2913 	    ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
2914 
2915 	if (tcp->tcp_snd_ts_ok) {
2916 		if (!tcp_paws_check(tcp, tcpha, &tcpopt)) {
2917 			/*
2918 			 * This segment is not acceptable.
2919 			 * Drop it and send back an ACK.
2920 			 */
2921 			freemsg(mp);
2922 			flags |= TH_ACK_NEEDED;
2923 			goto ack_check;
2924 		}
2925 	} else if (tcp->tcp_snd_sack_ok) {
2926 		tcpopt.tcp = tcp;
2927 		/*
2928 		 * SACK info in already updated in tcp_parse_options.  Ignore
2929 		 * all other TCP options...
2930 		 */
2931 		(void) tcp_parse_options(tcpha, &tcpopt);
2932 	}
2933 try_again:;
2934 	mss = tcp->tcp_mss;
2935 	gap = seg_seq - tcp->tcp_rnxt;
2936 	rgap = tcp->tcp_rwnd - (gap + seg_len);
2937 	/*
2938 	 * gap is the amount of sequence space between what we expect to see
2939 	 * and what we got for seg_seq.  A positive value for gap means
2940 	 * something got lost.  A negative value means we got some old stuff.
2941 	 */
2942 	if (gap < 0) {
2943 		/* Old stuff present.  Is the SYN in there? */
2944 		if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
2945 		    (seg_len != 0)) {
2946 			flags &= ~TH_SYN;
2947 			seg_seq++;
2948 			urp--;
2949 			/* Recompute the gaps after noting the SYN. */
2950 			goto try_again;
2951 		}
2952 		TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
2953 		TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
2954 		    (seg_len > -gap ? -gap : seg_len));
2955 		/* Remove the old stuff from seg_len. */
2956 		seg_len += gap;
2957 		/*
2958 		 * Anything left?
2959 		 * Make sure to check for unack'd FIN when rest of data
2960 		 * has been previously ack'd.
2961 		 */
2962 		if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
2963 			/*
2964 			 * Resets are only valid if they lie within our offered
2965 			 * window.  If the RST bit is set, we just ignore this
2966 			 * segment.
2967 			 */
2968 			if (flags & TH_RST) {
2969 				freemsg(mp);
2970 				return;
2971 			}
2972 
2973 			/*
2974 			 * The arriving of dup data packets indicate that we
2975 			 * may have postponed an ack for too long, or the other
2976 			 * side's RTT estimate is out of shape. Start acking
2977 			 * more often.
2978 			 */
2979 			if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
2980 			    tcp->tcp_rack_cnt >= 1 &&
2981 			    tcp->tcp_rack_abs_max > 2) {
2982 				tcp->tcp_rack_abs_max--;
2983 			}
2984 			tcp->tcp_rack_cur_max = 1;
2985 
2986 			/*
2987 			 * This segment is "unacceptable".  None of its
2988 			 * sequence space lies within our advertized window.
2989 			 *
2990 			 * Adjust seg_len to the original value for tracing.
2991 			 */
2992 			seg_len -= gap;
2993 			if (connp->conn_debug) {
2994 				(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
2995 				    "tcp_rput: unacceptable, gap %d, rgap %d, "
2996 				    "flags 0x%x, seg_seq %u, seg_ack %u, "
2997 				    "seg_len %d, rnxt %u, snxt %u, %s",
2998 				    gap, rgap, flags, seg_seq, seg_ack,
2999 				    seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
3000 				    tcp_display(tcp, NULL,
3001 				    DISP_ADDR_AND_PORT));
3002 			}
3003 
3004 			/*
3005 			 * Arrange to send an ACK in response to the
3006 			 * unacceptable segment per RFC 793 page 69. There
3007 			 * is only one small difference between ours and the
3008 			 * acceptability test in the RFC - we accept ACK-only
3009 			 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
3010 			 * will be generated.
3011 			 *
3012 			 * Note that we have to ACK an ACK-only packet at least
3013 			 * for stacks that send 0-length keep-alives with
3014 			 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
3015 			 * section 4.2.3.6. As long as we don't ever generate
3016 			 * an unacceptable packet in response to an incoming
3017 			 * packet that is unacceptable, it should not cause
3018 			 * "ACK wars".
3019 			 */
3020 			flags |=  TH_ACK_NEEDED;
3021 
3022 			/*
3023 			 * Continue processing this segment in order to use the
3024 			 * ACK information it contains, but skip all other
3025 			 * sequence-number processing.	Processing the ACK
3026 			 * information is necessary in order to
3027 			 * re-synchronize connections that may have lost
3028 			 * synchronization.
3029 			 *
3030 			 * We clear seg_len and flag fields related to
3031 			 * sequence number processing as they are not
3032 			 * to be trusted for an unacceptable segment.
3033 			 */
3034 			seg_len = 0;
3035 			flags &= ~(TH_SYN | TH_FIN | TH_URG);
3036 			goto process_ack;
3037 		}
3038 
3039 		/* Fix seg_seq, and chew the gap off the front. */
3040 		seg_seq = tcp->tcp_rnxt;
3041 		urp += gap;
3042 		do {
3043 			mblk_t	*mp2;
3044 			ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3045 			    (uintptr_t)UINT_MAX);
3046 			gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3047 			if (gap > 0) {
3048 				mp->b_rptr = mp->b_wptr - gap;
3049 				break;
3050 			}
3051 			mp2 = mp;
3052 			mp = mp->b_cont;
3053 			freeb(mp2);
3054 		} while (gap < 0);
3055 		/*
3056 		 * If the urgent data has already been acknowledged, we
3057 		 * should ignore TH_URG below
3058 		 */
3059 		if (urp < 0)
3060 			flags &= ~TH_URG;
3061 	}
3062 	/*
3063 	 * rgap is the amount of stuff received out of window.  A negative
3064 	 * value is the amount out of window.
3065 	 */
3066 	if (rgap < 0) {
3067 		mblk_t	*mp2;
3068 
3069 		if (tcp->tcp_rwnd == 0) {
3070 			TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3071 		} else {
3072 			TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3073 			TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3074 		}
3075 
3076 		/*
3077 		 * seg_len does not include the FIN, so if more than
3078 		 * just the FIN is out of window, we act like we don't
3079 		 * see it.  (If just the FIN is out of window, rgap
3080 		 * will be zero and we will go ahead and acknowledge
3081 		 * the FIN.)
3082 		 */
3083 		flags &= ~TH_FIN;
3084 
3085 		/* Fix seg_len and make sure there is something left. */
3086 		seg_len += rgap;
3087 		if (seg_len <= 0) {
3088 			/*
3089 			 * Resets are only valid if they lie within our offered
3090 			 * window.  If the RST bit is set, we just ignore this
3091 			 * segment.
3092 			 */
3093 			if (flags & TH_RST) {
3094 				freemsg(mp);
3095 				return;
3096 			}
3097 
3098 			/* Per RFC 793, we need to send back an ACK. */
3099 			flags |= TH_ACK_NEEDED;
3100 
3101 			/*
3102 			 * Send SIGURG as soon as possible i.e. even
3103 			 * if the TH_URG was delivered in a window probe
3104 			 * packet (which will be unacceptable).
3105 			 *
3106 			 * We generate a signal if none has been generated
3107 			 * for this connection or if this is a new urgent
3108 			 * byte. Also send a zero-length "unmarked" message
3109 			 * to inform SIOCATMARK that this is not the mark.
3110 			 *
3111 			 * tcp_urp_last_valid is cleared when the T_exdata_ind
3112 			 * is sent up. This plus the check for old data
3113 			 * (gap >= 0) handles the wraparound of the sequence
3114 			 * number space without having to always track the
3115 			 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3116 			 * this max in its rcv_up variable).
3117 			 *
3118 			 * This prevents duplicate SIGURGS due to a "late"
3119 			 * zero-window probe when the T_EXDATA_IND has already
3120 			 * been sent up.
3121 			 */
3122 			if ((flags & TH_URG) &&
3123 			    (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3124 			    tcp->tcp_urp_last))) {
3125 				if (IPCL_IS_NONSTR(connp)) {
3126 					if (!TCP_IS_DETACHED(tcp)) {
3127 						(*sockupcalls->su_signal_oob)
3128 						    (connp->conn_upper_handle,
3129 						    urp);
3130 					}
3131 				} else {
3132 					mp1 = allocb(0, BPRI_MED);
3133 					if (mp1 == NULL) {
3134 						freemsg(mp);
3135 						return;
3136 					}
3137 					if (!TCP_IS_DETACHED(tcp) &&
3138 					    !putnextctl1(connp->conn_rq,
3139 					    M_PCSIG, SIGURG)) {
3140 						/* Try again on the rexmit. */
3141 						freemsg(mp1);
3142 						freemsg(mp);
3143 						return;
3144 					}
3145 					/*
3146 					 * If the next byte would be the mark
3147 					 * then mark with MARKNEXT else mark
3148 					 * with NOTMARKNEXT.
3149 					 */
3150 					if (gap == 0 && urp == 0)
3151 						mp1->b_flag |= MSGMARKNEXT;
3152 					else
3153 						mp1->b_flag |= MSGNOTMARKNEXT;
3154 					freemsg(tcp->tcp_urp_mark_mp);
3155 					tcp->tcp_urp_mark_mp = mp1;
3156 					flags |= TH_SEND_URP_MARK;
3157 				}
3158 				tcp->tcp_urp_last_valid = B_TRUE;
3159 				tcp->tcp_urp_last = urp + seg_seq;
3160 			}
3161 			/*
3162 			 * If this is a zero window probe, continue to
3163 			 * process the ACK part.  But we need to set seg_len
3164 			 * to 0 to avoid data processing.  Otherwise just
3165 			 * drop the segment and send back an ACK.
3166 			 */
3167 			if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3168 				flags &= ~(TH_SYN | TH_URG);
3169 				seg_len = 0;
3170 				goto process_ack;
3171 			} else {
3172 				freemsg(mp);
3173 				goto ack_check;
3174 			}
3175 		}
3176 		/* Pitch out of window stuff off the end. */
3177 		rgap = seg_len;
3178 		mp2 = mp;
3179 		do {
3180 			ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3181 			    (uintptr_t)INT_MAX);
3182 			rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3183 			if (rgap < 0) {
3184 				mp2->b_wptr += rgap;
3185 				if ((mp1 = mp2->b_cont) != NULL) {
3186 					mp2->b_cont = NULL;
3187 					freemsg(mp1);
3188 				}
3189 				break;
3190 			}
3191 		} while ((mp2 = mp2->b_cont) != NULL);
3192 	}
3193 ok:;
3194 	/*
3195 	 * TCP should check ECN info for segments inside the window only.
3196 	 * Therefore the check should be done here.
3197 	 */
3198 	if (tcp->tcp_ecn_ok) {
3199 		if (flags & TH_CWR) {
3200 			tcp->tcp_ecn_echo_on = B_FALSE;
3201 		}
3202 		/*
3203 		 * Note that both ECN_CE and CWR can be set in the
3204 		 * same segment.  In this case, we once again turn
3205 		 * on ECN_ECHO.
3206 		 */
3207 		if (connp->conn_ipversion == IPV4_VERSION) {
3208 			uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3209 
3210 			if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3211 				tcp->tcp_ecn_echo_on = B_TRUE;
3212 			}
3213 		} else {
3214 			uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3215 
3216 			if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3217 			    htonl(IPH_ECN_CE << 20)) {
3218 				tcp->tcp_ecn_echo_on = B_TRUE;
3219 			}
3220 		}
3221 	}
3222 
3223 	/*
3224 	 * Check whether we can update tcp_ts_recent.  This test is
3225 	 * NOT the one in RFC 1323 3.4.  It is from Braden, 1993, "TCP
3226 	 * Extensions for High Performance: An Update", Internet Draft.
3227 	 */
3228 	if (tcp->tcp_snd_ts_ok &&
3229 	    TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3230 	    SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3231 		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3232 		tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3233 	}
3234 
3235 	if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3236 		/*
3237 		 * FIN in an out of order segment.  We record this in
3238 		 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3239 		 * Clear the FIN so that any check on FIN flag will fail.
3240 		 * Remember that FIN also counts in the sequence number
3241 		 * space.  So we need to ack out of order FIN only segments.
3242 		 */
3243 		if (flags & TH_FIN) {
3244 			tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3245 			tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3246 			flags &= ~TH_FIN;
3247 			flags |= TH_ACK_NEEDED;
3248 		}
3249 		if (seg_len > 0) {
3250 			/* Fill in the SACK blk list. */
3251 			if (tcp->tcp_snd_sack_ok) {
3252 				tcp_sack_insert(tcp->tcp_sack_list,
3253 				    seg_seq, seg_seq + seg_len,
3254 				    &(tcp->tcp_num_sack_blk));
3255 			}
3256 
3257 			/*
3258 			 * Attempt reassembly and see if we have something
3259 			 * ready to go.
3260 			 */
3261 			mp = tcp_reass(tcp, mp, seg_seq);
3262 			/* Always ack out of order packets */
3263 			flags |= TH_ACK_NEEDED | TH_PUSH;
3264 			if (mp) {
3265 				ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3266 				    (uintptr_t)INT_MAX);
3267 				seg_len = mp->b_cont ? msgdsize(mp) :
3268 				    (int)(mp->b_wptr - mp->b_rptr);
3269 				seg_seq = tcp->tcp_rnxt;
3270 				/*
3271 				 * A gap is filled and the seq num and len
3272 				 * of the gap match that of a previously
3273 				 * received FIN, put the FIN flag back in.
3274 				 */
3275 				if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3276 				    seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3277 					flags |= TH_FIN;
3278 					tcp->tcp_valid_bits &=
3279 					    ~TCP_OFO_FIN_VALID;
3280 				}
3281 				if (tcp->tcp_reass_tid != 0) {
3282 					(void) TCP_TIMER_CANCEL(tcp,
3283 					    tcp->tcp_reass_tid);
3284 					/*
3285 					 * Restart the timer if there is still
3286 					 * data in the reassembly queue.
3287 					 */
3288 					if (tcp->tcp_reass_head != NULL) {
3289 						tcp->tcp_reass_tid = TCP_TIMER(
3290 						    tcp, tcp_reass_timer,
3291 						    tcps->tcps_reass_timeout);
3292 					} else {
3293 						tcp->tcp_reass_tid = 0;
3294 					}
3295 				}
3296 			} else {
3297 				/*
3298 				 * Keep going even with NULL mp.
3299 				 * There may be a useful ACK or something else
3300 				 * we don't want to miss.
3301 				 *
3302 				 * But TCP should not perform fast retransmit
3303 				 * because of the ack number.  TCP uses
3304 				 * seg_len == 0 to determine if it is a pure
3305 				 * ACK.  And this is not a pure ACK.
3306 				 */
3307 				seg_len = 0;
3308 				ofo_seg = B_TRUE;
3309 
3310 				if (tcps->tcps_reass_timeout != 0 &&
3311 				    tcp->tcp_reass_tid == 0) {
3312 					tcp->tcp_reass_tid = TCP_TIMER(tcp,
3313 					    tcp_reass_timer,
3314 					    tcps->tcps_reass_timeout);
3315 				}
3316 			}
3317 		}
3318 	} else if (seg_len > 0) {
3319 		TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3320 		TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3321 		/*
3322 		 * If an out of order FIN was received before, and the seq
3323 		 * num and len of the new segment match that of the FIN,
3324 		 * put the FIN flag back in.
3325 		 */
3326 		if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3327 		    seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3328 			flags |= TH_FIN;
3329 			tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3330 		}
3331 	}
3332 	if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3333 	if (flags & TH_RST) {
3334 		freemsg(mp);
3335 		switch (tcp->tcp_state) {
3336 		case TCPS_SYN_RCVD:
3337 			(void) tcp_clean_death(tcp, ECONNREFUSED);
3338 			break;
3339 		case TCPS_ESTABLISHED:
3340 		case TCPS_FIN_WAIT_1:
3341 		case TCPS_FIN_WAIT_2:
3342 		case TCPS_CLOSE_WAIT:
3343 			(void) tcp_clean_death(tcp, ECONNRESET);
3344 			break;
3345 		case TCPS_CLOSING:
3346 		case TCPS_LAST_ACK:
3347 			(void) tcp_clean_death(tcp, 0);
3348 			break;
3349 		default:
3350 			ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3351 			(void) tcp_clean_death(tcp, ENXIO);
3352 			break;
3353 		}
3354 		return;
3355 	}
3356 	if (flags & TH_SYN) {
3357 		/*
3358 		 * See RFC 793, Page 71
3359 		 *
3360 		 * The seq number must be in the window as it should
3361 		 * be "fixed" above.  If it is outside window, it should
3362 		 * be already rejected.  Note that we allow seg_seq to be
3363 		 * rnxt + rwnd because we want to accept 0 window probe.
3364 		 */
3365 		ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3366 		    SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3367 		freemsg(mp);
3368 		/*
3369 		 * If the ACK flag is not set, just use our snxt as the
3370 		 * seq number of the RST segment.
3371 		 */
3372 		if (!(flags & TH_ACK)) {
3373 			seg_ack = tcp->tcp_snxt;
3374 		}
3375 		tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
3376 		    TH_RST|TH_ACK);
3377 		ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3378 		(void) tcp_clean_death(tcp, ECONNRESET);
3379 		return;
3380 	}
3381 	/*
3382 	 * urp could be -1 when the urp field in the packet is 0
3383 	 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3384 	 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3385 	 */
3386 	if (flags & TH_URG && urp >= 0) {
3387 		if (!tcp->tcp_urp_last_valid ||
3388 		    SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3389 			/*
3390 			 * Non-STREAMS sockets handle the urgent data a litte
3391 			 * differently from STREAMS based sockets. There is no
3392 			 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3393 			 * flags to keep SIOCATMARK happy. Instead a
3394 			 * su_signal_oob upcall is made to update the mark.
3395 			 * Neither is a T_EXDATA_IND mblk needed to be
3396 			 * prepended to the urgent data. The urgent data is
3397 			 * delivered using the su_recv upcall, where we set
3398 			 * the MSG_OOB flag to indicate that it is urg data.
3399 			 *
3400 			 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3401 			 * are used by non-STREAMS sockets.
3402 			 */
3403 			if (IPCL_IS_NONSTR(connp)) {
3404 				if (!TCP_IS_DETACHED(tcp)) {
3405 					(*sockupcalls->su_signal_oob)
3406 					    (connp->conn_upper_handle, urp);
3407 				}
3408 			} else {
3409 				/*
3410 				 * If we haven't generated the signal yet for
3411 				 * this urgent pointer value, do it now.  Also,
3412 				 * send up a zero-length M_DATA indicating
3413 				 * whether or not this is the mark. The latter
3414 				 * is not needed when a T_EXDATA_IND is sent up.
3415 				 * However, if there are allocation failures
3416 				 * this code relies on the sender retransmitting
3417 				 * and the socket code for determining the mark
3418 				 * should not block waiting for the peer to
3419 				 * transmit. Thus, for simplicity we always
3420 				 * send up the mark indication.
3421 				 */
3422 				mp1 = allocb(0, BPRI_MED);
3423 				if (mp1 == NULL) {
3424 					freemsg(mp);
3425 					return;
3426 				}
3427 				if (!TCP_IS_DETACHED(tcp) &&
3428 				    !putnextctl1(connp->conn_rq, M_PCSIG,
3429 				    SIGURG)) {
3430 					/* Try again on the rexmit. */
3431 					freemsg(mp1);
3432 					freemsg(mp);
3433 					return;
3434 				}
3435 				/*
3436 				 * Mark with NOTMARKNEXT for now.
3437 				 * The code below will change this to MARKNEXT
3438 				 * if we are at the mark.
3439 				 *
3440 				 * If there are allocation failures (e.g. in
3441 				 * dupmsg below) the next time tcp_input_data
3442 				 * sees the urgent segment it will send up the
3443 				 * MSGMARKNEXT message.
3444 				 */
3445 				mp1->b_flag |= MSGNOTMARKNEXT;
3446 				freemsg(tcp->tcp_urp_mark_mp);
3447 				tcp->tcp_urp_mark_mp = mp1;
3448 				flags |= TH_SEND_URP_MARK;
3449 #ifdef DEBUG
3450 				(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3451 				    "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3452 				    "last %x, %s",
3453 				    seg_seq, urp, tcp->tcp_urp_last,
3454 				    tcp_display(tcp, NULL, DISP_PORT_ONLY));
3455 #endif /* DEBUG */
3456 			}
3457 			tcp->tcp_urp_last_valid = B_TRUE;
3458 			tcp->tcp_urp_last = urp + seg_seq;
3459 		} else if (tcp->tcp_urp_mark_mp != NULL) {
3460 			/*
3461 			 * An allocation failure prevented the previous
3462 			 * tcp_input_data from sending up the allocated
3463 			 * MSG*MARKNEXT message - send it up this time
3464 			 * around.
3465 			 */
3466 			flags |= TH_SEND_URP_MARK;
3467 		}
3468 
3469 		/*
3470 		 * If the urgent byte is in this segment, make sure that it is
3471 		 * all by itself.  This makes it much easier to deal with the
3472 		 * possibility of an allocation failure on the T_exdata_ind.
3473 		 * Note that seg_len is the number of bytes in the segment, and
3474 		 * urp is the offset into the segment of the urgent byte.
3475 		 * urp < seg_len means that the urgent byte is in this segment.
3476 		 */
3477 		if (urp < seg_len) {
3478 			if (seg_len != 1) {
3479 				uint32_t  tmp_rnxt;
3480 				/*
3481 				 * Break it up and feed it back in.
3482 				 * Re-attach the IP header.
3483 				 */
3484 				mp->b_rptr = iphdr;
3485 				if (urp > 0) {
3486 					/*
3487 					 * There is stuff before the urgent
3488 					 * byte.
3489 					 */
3490 					mp1 = dupmsg(mp);
3491 					if (!mp1) {
3492 						/*
3493 						 * Trim from urgent byte on.
3494 						 * The rest will come back.
3495 						 */
3496 						(void) adjmsg(mp,
3497 						    urp - seg_len);
3498 						tcp_input_data(connp,
3499 						    mp, NULL, ira);
3500 						return;
3501 					}
3502 					(void) adjmsg(mp1, urp - seg_len);
3503 					/* Feed this piece back in. */
3504 					tmp_rnxt = tcp->tcp_rnxt;
3505 					tcp_input_data(connp, mp1, NULL, ira);
3506 					/*
3507 					 * If the data passed back in was not
3508 					 * processed (ie: bad ACK) sending
3509 					 * the remainder back in will cause a
3510 					 * loop. In this case, drop the
3511 					 * packet and let the sender try
3512 					 * sending a good packet.
3513 					 */
3514 					if (tmp_rnxt == tcp->tcp_rnxt) {
3515 						freemsg(mp);
3516 						return;
3517 					}
3518 				}
3519 				if (urp != seg_len - 1) {
3520 					uint32_t  tmp_rnxt;
3521 					/*
3522 					 * There is stuff after the urgent
3523 					 * byte.
3524 					 */
3525 					mp1 = dupmsg(mp);
3526 					if (!mp1) {
3527 						/*
3528 						 * Trim everything beyond the
3529 						 * urgent byte.  The rest will
3530 						 * come back.
3531 						 */
3532 						(void) adjmsg(mp,
3533 						    urp + 1 - seg_len);
3534 						tcp_input_data(connp,
3535 						    mp, NULL, ira);
3536 						return;
3537 					}
3538 					(void) adjmsg(mp1, urp + 1 - seg_len);
3539 					tmp_rnxt = tcp->tcp_rnxt;
3540 					tcp_input_data(connp, mp1, NULL, ira);
3541 					/*
3542 					 * If the data passed back in was not
3543 					 * processed (ie: bad ACK) sending
3544 					 * the remainder back in will cause a
3545 					 * loop. In this case, drop the
3546 					 * packet and let the sender try
3547 					 * sending a good packet.
3548 					 */
3549 					if (tmp_rnxt == tcp->tcp_rnxt) {
3550 						freemsg(mp);
3551 						return;
3552 					}
3553 				}
3554 				tcp_input_data(connp, mp, NULL, ira);
3555 				return;
3556 			}
3557 			/*
3558 			 * This segment contains only the urgent byte.  We
3559 			 * have to allocate the T_exdata_ind, if we can.
3560 			 */
3561 			if (IPCL_IS_NONSTR(connp)) {
3562 				int error;
3563 
3564 				(*sockupcalls->su_recv)
3565 				    (connp->conn_upper_handle, mp, seg_len,
3566 				    MSG_OOB, &error, NULL);
3567 				/*
3568 				 * We should never be in middle of a
3569 				 * fallback, the squeue guarantees that.
3570 				 */
3571 				ASSERT(error != EOPNOTSUPP);
3572 				mp = NULL;
3573 				goto update_ack;
3574 			} else if (!tcp->tcp_urp_mp) {
3575 				struct T_exdata_ind *tei;
3576 				mp1 = allocb(sizeof (struct T_exdata_ind),
3577 				    BPRI_MED);
3578 				if (!mp1) {
3579 					/*
3580 					 * Sigh... It'll be back.
3581 					 * Generate any MSG*MARK message now.
3582 					 */
3583 					freemsg(mp);
3584 					seg_len = 0;
3585 					if (flags & TH_SEND_URP_MARK) {
3586 
3587 
3588 						ASSERT(tcp->tcp_urp_mark_mp);
3589 						tcp->tcp_urp_mark_mp->b_flag &=
3590 						    ~MSGNOTMARKNEXT;
3591 						tcp->tcp_urp_mark_mp->b_flag |=
3592 						    MSGMARKNEXT;
3593 					}
3594 					goto ack_check;
3595 				}
3596 				mp1->b_datap->db_type = M_PROTO;
3597 				tei = (struct T_exdata_ind *)mp1->b_rptr;
3598 				tei->PRIM_type = T_EXDATA_IND;
3599 				tei->MORE_flag = 0;
3600 				mp1->b_wptr = (uchar_t *)&tei[1];
3601 				tcp->tcp_urp_mp = mp1;
3602 #ifdef DEBUG
3603 				(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3604 				    "tcp_rput: allocated exdata_ind %s",
3605 				    tcp_display(tcp, NULL,
3606 				    DISP_PORT_ONLY));
3607 #endif /* DEBUG */
3608 				/*
3609 				 * There is no need to send a separate MSG*MARK
3610 				 * message since the T_EXDATA_IND will be sent
3611 				 * now.
3612 				 */
3613 				flags &= ~TH_SEND_URP_MARK;
3614 				freemsg(tcp->tcp_urp_mark_mp);
3615 				tcp->tcp_urp_mark_mp = NULL;
3616 			}
3617 			/*
3618 			 * Now we are all set.  On the next putnext upstream,
3619 			 * tcp_urp_mp will be non-NULL and will get prepended
3620 			 * to what has to be this piece containing the urgent
3621 			 * byte.  If for any reason we abort this segment below,
3622 			 * if it comes back, we will have this ready, or it
3623 			 * will get blown off in close.
3624 			 */
3625 		} else if (urp == seg_len) {
3626 			/*
3627 			 * The urgent byte is the next byte after this sequence
3628 			 * number. If this endpoint is non-STREAMS, then there
3629 			 * is nothing to do here since the socket has already
3630 			 * been notified about the urg pointer by the
3631 			 * su_signal_oob call above.
3632 			 *
3633 			 * In case of STREAMS, some more work might be needed.
3634 			 * If there is data it is marked with MSGMARKNEXT and
3635 			 * and any tcp_urp_mark_mp is discarded since it is not
3636 			 * needed. Otherwise, if the code above just allocated
3637 			 * a zero-length tcp_urp_mark_mp message, that message
3638 			 * is tagged with MSGMARKNEXT. Sending up these
3639 			 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3640 			 * even though the T_EXDATA_IND will not be sent up
3641 			 * until the urgent byte arrives.
3642 			 */
3643 			if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3644 				if (seg_len != 0) {
3645 					flags |= TH_MARKNEXT_NEEDED;
3646 					freemsg(tcp->tcp_urp_mark_mp);
3647 					tcp->tcp_urp_mark_mp = NULL;
3648 					flags &= ~TH_SEND_URP_MARK;
3649 				} else if (tcp->tcp_urp_mark_mp != NULL) {
3650 					flags |= TH_SEND_URP_MARK;
3651 					tcp->tcp_urp_mark_mp->b_flag &=
3652 					    ~MSGNOTMARKNEXT;
3653 					tcp->tcp_urp_mark_mp->b_flag |=
3654 					    MSGMARKNEXT;
3655 				}
3656 			}
3657 #ifdef DEBUG
3658 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3659 			    "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3660 			    seg_len, flags,
3661 			    tcp_display(tcp, NULL, DISP_PORT_ONLY));
3662 #endif /* DEBUG */
3663 		}
3664 #ifdef DEBUG
3665 		else {
3666 			/* Data left until we hit mark */
3667 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3668 			    "tcp_rput: URP %d bytes left, %s",
3669 			    urp - seg_len, tcp_display(tcp, NULL,
3670 			    DISP_PORT_ONLY));
3671 		}
3672 #endif /* DEBUG */
3673 	}
3674 
3675 process_ack:
3676 	if (!(flags & TH_ACK)) {
3677 		freemsg(mp);
3678 		goto xmit_check;
3679 	}
3680 	}
3681 	bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3682 
3683 	if (bytes_acked > 0)
3684 		tcp->tcp_ip_forward_progress = B_TRUE;
3685 	if (tcp->tcp_state == TCPS_SYN_RCVD) {
3686 		/*
3687 		 * tcp_sendmsg() checks tcp_state without entering
3688 		 * the squeue so tcp_state should be updated before
3689 		 * sending up a connection confirmation or a new
3690 		 * connection indication.
3691 		 */
3692 		tcp->tcp_state = TCPS_ESTABLISHED;
3693 
3694 		/*
3695 		 * We are seeing the final ack in the three way
3696 		 * hand shake of a active open'ed connection
3697 		 * so we must send up a T_CONN_CON
3698 		 */
3699 		if (tcp->tcp_active_open) {
3700 			if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3701 				freemsg(mp);
3702 				tcp->tcp_state = TCPS_SYN_RCVD;
3703 				return;
3704 			}
3705 			/*
3706 			 * Don't fuse the loopback endpoints for
3707 			 * simultaneous active opens.
3708 			 */
3709 			if (tcp->tcp_loopback) {
3710 				TCP_STAT(tcps, tcp_fusion_unfusable);
3711 				tcp->tcp_unfusable = B_TRUE;
3712 			}
3713 			/*
3714 			 * For simultaneous active open, trace receipt of final
3715 			 * ACK as tcp:::connect-established.
3716 			 */
3717 			DTRACE_TCP5(connect__established, mblk_t *, NULL,
3718 			    ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3719 			    iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3720 		} else if (IPCL_IS_NONSTR(connp)) {
3721 			/*
3722 			 * 3-way handshake has completed, so notify socket
3723 			 * of the new connection.
3724 			 *
3725 			 * We are here means eager is fine but it can
3726 			 * get a TH_RST at any point between now and till
3727 			 * accept completes and disappear. We need to
3728 			 * ensure that reference to eager is valid after
3729 			 * we get out of eager's perimeter. So we do
3730 			 * an extra refhold.
3731 			 */
3732 			CONN_INC_REF(connp);
3733 
3734 			if (!tcp_newconn_notify(tcp, ira)) {
3735 				/*
3736 				 * The state-change probe for SYN_RCVD ->
3737 				 * ESTABLISHED has not fired yet. We reset
3738 				 * the state to SYN_RCVD so that future
3739 				 * state-change probes report correct state
3740 				 * transistions.
3741 				 */
3742 				tcp->tcp_state = TCPS_SYN_RCVD;
3743 				freemsg(mp);
3744 				/* notification did not go up, so drop ref */
3745 				CONN_DEC_REF(connp);
3746 				/* ... and close the eager */
3747 				ASSERT(TCP_IS_DETACHED(tcp));
3748 				(void) tcp_close_detached(tcp);
3749 				return;
3750 			}
3751 			/*
3752 			 * tcp_newconn_notify() changes conn_upcalls and
3753 			 * connp->conn_upper_handle.  Fix things now, in case
3754 			 * there's data attached to this ack.
3755 			 */
3756 			if (connp->conn_upcalls != NULL)
3757 				sockupcalls = connp->conn_upcalls;
3758 			/*
3759 			 * For passive open, trace receipt of final ACK as
3760 			 * tcp:::accept-established.
3761 			 */
3762 			DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3763 			    ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3764 			    iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3765 		} else {
3766 			/*
3767 			 * 3-way handshake complete - this is a STREAMS based
3768 			 * socket, so pass up the T_CONN_IND.
3769 			 */
3770 			tcp_t	*listener = tcp->tcp_listener;
3771 			mblk_t	*mp = tcp->tcp_conn.tcp_eager_conn_ind;
3772 
3773 			tcp->tcp_tconnind_started = B_TRUE;
3774 			tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3775 			ASSERT(mp != NULL);
3776 			/*
3777 			 * We are here means eager is fine but it can
3778 			 * get a TH_RST at any point between now and till
3779 			 * accept completes and disappear. We need to
3780 			 * ensure that reference to eager is valid after
3781 			 * we get out of eager's perimeter. So we do
3782 			 * an extra refhold.
3783 			 */
3784 			CONN_INC_REF(connp);
3785 
3786 			/*
3787 			 * The listener also exists because of the refhold
3788 			 * done in tcp_input_listener. Its possible that it
3789 			 * might have closed. We will check that once we
3790 			 * get inside listeners context.
3791 			 */
3792 			CONN_INC_REF(listener->tcp_connp);
3793 			if (listener->tcp_connp->conn_sqp ==
3794 			    connp->conn_sqp) {
3795 				/*
3796 				 * We optimize by not calling an SQUEUE_ENTER
3797 				 * on the listener since we know that the
3798 				 * listener and eager squeues are the same.
3799 				 * We are able to make this check safely only
3800 				 * because neither the eager nor the listener
3801 				 * can change its squeue. Only an active connect
3802 				 * can change its squeue
3803 				 */
3804 				tcp_send_conn_ind(listener->tcp_connp, mp,
3805 				    listener->tcp_connp->conn_sqp);
3806 				CONN_DEC_REF(listener->tcp_connp);
3807 			} else if (!tcp->tcp_loopback) {
3808 				SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3809 				    mp, tcp_send_conn_ind,
3810 				    listener->tcp_connp, NULL, SQ_FILL,
3811 				    SQTAG_TCP_CONN_IND);
3812 			} else {
3813 				SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3814 				    mp, tcp_send_conn_ind,
3815 				    listener->tcp_connp, NULL, SQ_NODRAIN,
3816 				    SQTAG_TCP_CONN_IND);
3817 			}
3818 			/*
3819 			 * For passive open, trace receipt of final ACK as
3820 			 * tcp:::accept-established.
3821 			 */
3822 			DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3823 			    ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3824 			    iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3825 		}
3826 		TCPS_CONN_INC(tcps);
3827 
3828 		tcp->tcp_suna = tcp->tcp_iss + 1;	/* One for the SYN */
3829 		bytes_acked--;
3830 		/* SYN was acked - making progress */
3831 		tcp->tcp_ip_forward_progress = B_TRUE;
3832 
3833 		/*
3834 		 * If SYN was retransmitted, need to reset all
3835 		 * retransmission info as this segment will be
3836 		 * treated as a dup ACK.
3837 		 */
3838 		if (tcp->tcp_rexmit) {
3839 			tcp->tcp_rexmit = B_FALSE;
3840 			tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3841 			tcp->tcp_rexmit_max = tcp->tcp_snxt;
3842 			tcp->tcp_ms_we_have_waited = 0;
3843 			tcp->tcp_cwnd = mss;
3844 		}
3845 
3846 		/*
3847 		 * We set the send window to zero here.
3848 		 * This is needed if there is data to be
3849 		 * processed already on the queue.
3850 		 * Later (at swnd_update label), the
3851 		 * "new_swnd > tcp_swnd" condition is satisfied
3852 		 * the XMIT_NEEDED flag is set in the current
3853 		 * (SYN_RCVD) state. This ensures tcp_wput_data() is
3854 		 * called if there is already data on queue in
3855 		 * this state.
3856 		 */
3857 		tcp->tcp_swnd = 0;
3858 
3859 		if (new_swnd > tcp->tcp_max_swnd)
3860 			tcp->tcp_max_swnd = new_swnd;
3861 		tcp->tcp_swl1 = seg_seq;
3862 		tcp->tcp_swl2 = seg_ack;
3863 		tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
3864 
3865 		/* Trace change from SYN_RCVD -> ESTABLISHED here */
3866 		DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3867 		    connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3868 		    int32_t, TCPS_SYN_RCVD);
3869 
3870 		/* Fuse when both sides are in ESTABLISHED state */
3871 		if (tcp->tcp_loopback && do_tcp_fusion)
3872 			tcp_fuse(tcp, iphdr, tcpha);
3873 
3874 	}
3875 	/* This code follows 4.4BSD-Lite2 mostly. */
3876 	if (bytes_acked < 0)
3877 		goto est;
3878 
3879 	/*
3880 	 * If TCP is ECN capable and the congestion experience bit is
3881 	 * set, reduce tcp_cwnd and tcp_ssthresh.  But this should only be
3882 	 * done once per window (or more loosely, per RTT).
3883 	 */
3884 	if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
3885 		tcp->tcp_cwr = B_FALSE;
3886 	if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
3887 		if (!tcp->tcp_cwr) {
3888 			npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
3889 			tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
3890 			tcp->tcp_cwnd = npkt * mss;
3891 			/*
3892 			 * If the cwnd is 0, use the timer to clock out
3893 			 * new segments.  This is required by the ECN spec.
3894 			 */
3895 			if (npkt == 0) {
3896 				TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
3897 				/*
3898 				 * This makes sure that when the ACK comes
3899 				 * back, we will increase tcp_cwnd by 1 MSS.
3900 				 */
3901 				tcp->tcp_cwnd_cnt = 0;
3902 			}
3903 			tcp->tcp_cwr = B_TRUE;
3904 			/*
3905 			 * This marks the end of the current window of in
3906 			 * flight data.  That is why we don't use
3907 			 * tcp_suna + tcp_swnd.  Only data in flight can
3908 			 * provide ECN info.
3909 			 */
3910 			tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3911 			tcp->tcp_ecn_cwr_sent = B_FALSE;
3912 		}
3913 	}
3914 
3915 	mp1 = tcp->tcp_xmit_head;
3916 	if (bytes_acked == 0) {
3917 		if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
3918 			int dupack_cnt;
3919 
3920 			TCPS_BUMP_MIB(tcps, tcpInDupAck);
3921 			/*
3922 			 * Fast retransmit.  When we have seen exactly three
3923 			 * identical ACKs while we have unacked data
3924 			 * outstanding we take it as a hint that our peer
3925 			 * dropped something.
3926 			 *
3927 			 * If TCP is retransmitting, don't do fast retransmit.
3928 			 */
3929 			if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
3930 			    ! tcp->tcp_rexmit) {
3931 				/* Do Limited Transmit */
3932 				if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
3933 				    tcps->tcps_dupack_fast_retransmit) {
3934 					/*
3935 					 * RFC 3042
3936 					 *
3937 					 * What we need to do is temporarily
3938 					 * increase tcp_cwnd so that new
3939 					 * data can be sent if it is allowed
3940 					 * by the receive window (tcp_rwnd).
3941 					 * tcp_wput_data() will take care of
3942 					 * the rest.
3943 					 *
3944 					 * If the connection is SACK capable,
3945 					 * only do limited xmit when there
3946 					 * is SACK info.
3947 					 *
3948 					 * Note how tcp_cwnd is incremented.
3949 					 * The first dup ACK will increase
3950 					 * it by 1 MSS.  The second dup ACK
3951 					 * will increase it by 2 MSS.  This
3952 					 * means that only 1 new segment will
3953 					 * be sent for each dup ACK.
3954 					 */
3955 					if (tcp->tcp_unsent > 0 &&
3956 					    (!tcp->tcp_snd_sack_ok ||
3957 					    (tcp->tcp_snd_sack_ok &&
3958 					    tcp->tcp_notsack_list != NULL))) {
3959 						tcp->tcp_cwnd += mss <<
3960 						    (tcp->tcp_dupack_cnt - 1);
3961 						flags |= TH_LIMIT_XMIT;
3962 					}
3963 				} else if (dupack_cnt ==
3964 				    tcps->tcps_dupack_fast_retransmit) {
3965 
3966 				/*
3967 				 * If we have reduced tcp_ssthresh
3968 				 * because of ECN, do not reduce it again
3969 				 * unless it is already one window of data
3970 				 * away.  After one window of data, tcp_cwr
3971 				 * should then be cleared.  Note that
3972 				 * for non ECN capable connection, tcp_cwr
3973 				 * should always be false.
3974 				 *
3975 				 * Adjust cwnd since the duplicate
3976 				 * ack indicates that a packet was
3977 				 * dropped (due to congestion.)
3978 				 */
3979 				if (!tcp->tcp_cwr) {
3980 					npkt = ((tcp->tcp_snxt -
3981 					    tcp->tcp_suna) >> 1) / mss;
3982 					tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
3983 					    mss;
3984 					tcp->tcp_cwnd = (npkt +
3985 					    tcp->tcp_dupack_cnt) * mss;
3986 				}
3987 				if (tcp->tcp_ecn_ok) {
3988 					tcp->tcp_cwr = B_TRUE;
3989 					tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3990 					tcp->tcp_ecn_cwr_sent = B_FALSE;
3991 				}
3992 
3993 				/*
3994 				 * We do Hoe's algorithm.  Refer to her
3995 				 * paper "Improving the Start-up Behavior
3996 				 * of a Congestion Control Scheme for TCP,"
3997 				 * appeared in SIGCOMM'96.
3998 				 *
3999 				 * Save highest seq no we have sent so far.
4000 				 * Be careful about the invisible FIN byte.
4001 				 */
4002 				if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
4003 				    (tcp->tcp_unsent == 0)) {
4004 					tcp->tcp_rexmit_max = tcp->tcp_fss;
4005 				} else {
4006 					tcp->tcp_rexmit_max = tcp->tcp_snxt;
4007 				}
4008 
4009 				/*
4010 				 * For SACK:
4011 				 * Calculate tcp_pipe, which is the
4012 				 * estimated number of bytes in
4013 				 * network.
4014 				 *
4015 				 * tcp_fack is the highest sack'ed seq num
4016 				 * TCP has received.
4017 				 *
4018 				 * tcp_pipe is explained in the above quoted
4019 				 * Fall and Floyd's paper.  tcp_fack is
4020 				 * explained in Mathis and Mahdavi's
4021 				 * "Forward Acknowledgment: Refining TCP
4022 				 * Congestion Control" in SIGCOMM '96.
4023 				 */
4024 				if (tcp->tcp_snd_sack_ok) {
4025 					if (tcp->tcp_notsack_list != NULL) {
4026 						tcp->tcp_pipe = tcp->tcp_snxt -
4027 						    tcp->tcp_fack;
4028 						tcp->tcp_sack_snxt = seg_ack;
4029 						flags |= TH_NEED_SACK_REXMIT;
4030 					} else {
4031 						/*
4032 						 * Always initialize tcp_pipe
4033 						 * even though we don't have
4034 						 * any SACK info.  If later
4035 						 * we get SACK info and
4036 						 * tcp_pipe is not initialized,
4037 						 * funny things will happen.
4038 						 */
4039 						tcp->tcp_pipe =
4040 						    tcp->tcp_cwnd_ssthresh;
4041 					}
4042 				} else {
4043 					flags |= TH_REXMIT_NEEDED;
4044 				} /* tcp_snd_sack_ok */
4045 
4046 				} else {
4047 					/*
4048 					 * Here we perform congestion
4049 					 * avoidance, but NOT slow start.
4050 					 * This is known as the Fast
4051 					 * Recovery Algorithm.
4052 					 */
4053 					if (tcp->tcp_snd_sack_ok &&
4054 					    tcp->tcp_notsack_list != NULL) {
4055 						flags |= TH_NEED_SACK_REXMIT;
4056 						tcp->tcp_pipe -= mss;
4057 						if (tcp->tcp_pipe < 0)
4058 							tcp->tcp_pipe = 0;
4059 					} else {
4060 					/*
4061 					 * We know that one more packet has
4062 					 * left the pipe thus we can update
4063 					 * cwnd.
4064 					 */
4065 					cwnd = tcp->tcp_cwnd + mss;
4066 					if (cwnd > tcp->tcp_cwnd_max)
4067 						cwnd = tcp->tcp_cwnd_max;
4068 					tcp->tcp_cwnd = cwnd;
4069 					if (tcp->tcp_unsent > 0)
4070 						flags |= TH_XMIT_NEEDED;
4071 					}
4072 				}
4073 			}
4074 		} else if (tcp->tcp_zero_win_probe) {
4075 			/*
4076 			 * If the window has opened, need to arrange
4077 			 * to send additional data.
4078 			 */
4079 			if (new_swnd != 0) {
4080 				/* tcp_suna != tcp_snxt */
4081 				/* Packet contains a window update */
4082 				TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4083 				tcp->tcp_zero_win_probe = 0;
4084 				tcp->tcp_timer_backoff = 0;
4085 				tcp->tcp_ms_we_have_waited = 0;
4086 
4087 				/*
4088 				 * Transmit starting with tcp_suna since
4089 				 * the one byte probe is not ack'ed.
4090 				 * If TCP has sent more than one identical
4091 				 * probe, tcp_rexmit will be set.  That means
4092 				 * tcp_ss_rexmit() will send out the one
4093 				 * byte along with new data.  Otherwise,
4094 				 * fake the retransmission.
4095 				 */
4096 				flags |= TH_XMIT_NEEDED;
4097 				if (!tcp->tcp_rexmit) {
4098 					tcp->tcp_rexmit = B_TRUE;
4099 					tcp->tcp_dupack_cnt = 0;
4100 					tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4101 					tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4102 				}
4103 			}
4104 		}
4105 		goto swnd_update;
4106 	}
4107 
4108 	/*
4109 	 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4110 	 * If the ACK value acks something that we have not yet sent, it might
4111 	 * be an old duplicate segment.  Send an ACK to re-synchronize the
4112 	 * other side.
4113 	 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4114 	 * state is handled above, so we can always just drop the segment and
4115 	 * send an ACK here.
4116 	 *
4117 	 * In the case where the peer shrinks the window, we see the new window
4118 	 * update, but all the data sent previously is queued up by the peer.
4119 	 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4120 	 * number, which was already sent, and within window, is recorded.
4121 	 * tcp_snxt is then updated.
4122 	 *
4123 	 * If the window has previously shrunk, and an ACK for data not yet
4124 	 * sent, according to tcp_snxt is recieved, it may still be valid. If
4125 	 * the ACK is for data within the window at the time the window was
4126 	 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4127 	 * the sequence number ACK'ed.
4128 	 *
4129 	 * If the ACK covers all the data sent at the time the window was
4130 	 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4131 	 *
4132 	 * Should we send ACKs in response to ACK only segments?
4133 	 */
4134 
4135 	if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4136 		if ((tcp->tcp_is_wnd_shrnk) &&
4137 		    (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4138 			uint32_t data_acked_ahead_snxt;
4139 
4140 			data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4141 			tcp_update_xmit_tail(tcp, seg_ack);
4142 			tcp->tcp_unsent -= data_acked_ahead_snxt;
4143 		} else {
4144 			TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4145 			/* drop the received segment */
4146 			freemsg(mp);
4147 
4148 			/*
4149 			 * Send back an ACK.  If tcp_drop_ack_unsent_cnt is
4150 			 * greater than 0, check if the number of such
4151 			 * bogus ACks is greater than that count.  If yes,
4152 			 * don't send back any ACK.  This prevents TCP from
4153 			 * getting into an ACK storm if somehow an attacker
4154 			 * successfully spoofs an acceptable segment to our
4155 			 * peer.  If this continues (count > 2 X threshold),
4156 			 * we should abort this connection.
4157 			 */
4158 			if (tcp_drop_ack_unsent_cnt > 0 &&
4159 			    ++tcp->tcp_in_ack_unsent >
4160 			    tcp_drop_ack_unsent_cnt) {
4161 				TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4162 				if (tcp->tcp_in_ack_unsent > 2 *
4163 				    tcp_drop_ack_unsent_cnt) {
4164 					(void) tcp_clean_death(tcp, EPROTO);
4165 				}
4166 				return;
4167 			}
4168 			mp = tcp_ack_mp(tcp);
4169 			if (mp != NULL) {
4170 				BUMP_LOCAL(tcp->tcp_obsegs);
4171 				TCPS_BUMP_MIB(tcps, tcpOutAck);
4172 				tcp_send_data(tcp, mp);
4173 			}
4174 			return;
4175 		}
4176 	} else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4177 	    tcp->tcp_snxt_shrunk)) {
4178 			tcp->tcp_is_wnd_shrnk = B_FALSE;
4179 	}
4180 
4181 	/*
4182 	 * TCP gets a new ACK, update the notsack'ed list to delete those
4183 	 * blocks that are covered by this ACK.
4184 	 */
4185 	if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4186 		tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4187 		    &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4188 	}
4189 
4190 	/*
4191 	 * If we got an ACK after fast retransmit, check to see
4192 	 * if it is a partial ACK.  If it is not and the congestion
4193 	 * window was inflated to account for the other side's
4194 	 * cached packets, retract it.  If it is, do Hoe's algorithm.
4195 	 */
4196 	if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4197 		ASSERT(tcp->tcp_rexmit == B_FALSE);
4198 		if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
4199 			tcp->tcp_dupack_cnt = 0;
4200 			/*
4201 			 * Restore the orig tcp_cwnd_ssthresh after
4202 			 * fast retransmit phase.
4203 			 */
4204 			if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
4205 				tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
4206 			}
4207 			tcp->tcp_rexmit_max = seg_ack;
4208 			tcp->tcp_cwnd_cnt = 0;
4209 
4210 			/*
4211 			 * Remove all notsack info to avoid confusion with
4212 			 * the next fast retrasnmit/recovery phase.
4213 			 */
4214 			if (tcp->tcp_snd_sack_ok) {
4215 				TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4216 				    tcp);
4217 			}
4218 		} else {
4219 			if (tcp->tcp_snd_sack_ok &&
4220 			    tcp->tcp_notsack_list != NULL) {
4221 				flags |= TH_NEED_SACK_REXMIT;
4222 				tcp->tcp_pipe -= mss;
4223 				if (tcp->tcp_pipe < 0)
4224 					tcp->tcp_pipe = 0;
4225 			} else {
4226 				/*
4227 				 * Hoe's algorithm:
4228 				 *
4229 				 * Retransmit the unack'ed segment and
4230 				 * restart fast recovery.  Note that we
4231 				 * need to scale back tcp_cwnd to the
4232 				 * original value when we started fast
4233 				 * recovery.  This is to prevent overly
4234 				 * aggressive behaviour in sending new
4235 				 * segments.
4236 				 */
4237 				tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
4238 				    tcps->tcps_dupack_fast_retransmit * mss;
4239 				tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4240 				flags |= TH_REXMIT_NEEDED;
4241 			}
4242 		}
4243 	} else {
4244 		tcp->tcp_dupack_cnt = 0;
4245 		if (tcp->tcp_rexmit) {
4246 			/*
4247 			 * TCP is retranmitting.  If the ACK ack's all
4248 			 * outstanding data, update tcp_rexmit_max and
4249 			 * tcp_rexmit_nxt.  Otherwise, update tcp_rexmit_nxt
4250 			 * to the correct value.
4251 			 *
4252 			 * Note that SEQ_LEQ() is used.  This is to avoid
4253 			 * unnecessary fast retransmit caused by dup ACKs
4254 			 * received when TCP does slow start retransmission
4255 			 * after a time out.  During this phase, TCP may
4256 			 * send out segments which are already received.
4257 			 * This causes dup ACKs to be sent back.
4258 			 */
4259 			if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4260 				if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4261 					tcp->tcp_rexmit_nxt = seg_ack;
4262 				}
4263 				if (seg_ack != tcp->tcp_rexmit_max) {
4264 					flags |= TH_XMIT_NEEDED;
4265 				}
4266 			} else {
4267 				tcp->tcp_rexmit = B_FALSE;
4268 				tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4269 			}
4270 			tcp->tcp_ms_we_have_waited = 0;
4271 		}
4272 	}
4273 
4274 	TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4275 	TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4276 	tcp->tcp_suna = seg_ack;
4277 	if (tcp->tcp_zero_win_probe != 0) {
4278 		tcp->tcp_zero_win_probe = 0;
4279 		tcp->tcp_timer_backoff = 0;
4280 	}
4281 
4282 	/*
4283 	 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4284 	 * Note that it cannot be the SYN being ack'ed.  The code flow
4285 	 * will not reach here.
4286 	 */
4287 	if (mp1 == NULL) {
4288 		goto fin_acked;
4289 	}
4290 
4291 	/*
4292 	 * Update the congestion window.
4293 	 *
4294 	 * If TCP is not ECN capable or TCP is ECN capable but the
4295 	 * congestion experience bit is not set, increase the tcp_cwnd as
4296 	 * usual.
4297 	 */
4298 	if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4299 		cwnd = tcp->tcp_cwnd;
4300 		add = mss;
4301 
4302 		if (cwnd >= tcp->tcp_cwnd_ssthresh) {
4303 			/*
4304 			 * This is to prevent an increase of less than 1 MSS of
4305 			 * tcp_cwnd.  With partial increase, tcp_wput_data()
4306 			 * may send out tinygrams in order to preserve mblk
4307 			 * boundaries.
4308 			 *
4309 			 * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4310 			 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4311 			 * increased by 1 MSS for every RTTs.
4312 			 */
4313 			if (tcp->tcp_cwnd_cnt <= 0) {
4314 				tcp->tcp_cwnd_cnt = cwnd + add;
4315 			} else {
4316 				tcp->tcp_cwnd_cnt -= add;
4317 				add = 0;
4318 			}
4319 		}
4320 		tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
4321 	}
4322 
4323 	/* See if the latest urgent data has been acknowledged */
4324 	if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4325 	    SEQ_GT(seg_ack, tcp->tcp_urg))
4326 		tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4327 
4328 	/* Can we update the RTT estimates? */
4329 	if (tcp->tcp_snd_ts_ok) {
4330 		/* Ignore zero timestamp echo-reply. */
4331 		if (tcpopt.tcp_opt_ts_ecr != 0) {
4332 			tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4333 			    (int32_t)tcpopt.tcp_opt_ts_ecr);
4334 		}
4335 
4336 		/* If needed, restart the timer. */
4337 		if (tcp->tcp_set_timer == 1) {
4338 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4339 			tcp->tcp_set_timer = 0;
4340 		}
4341 		/*
4342 		 * Update tcp_csuna in case the other side stops sending
4343 		 * us timestamps.
4344 		 */
4345 		tcp->tcp_csuna = tcp->tcp_snxt;
4346 	} else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4347 		/*
4348 		 * An ACK sequence we haven't seen before, so get the RTT
4349 		 * and update the RTO. But first check if the timestamp is
4350 		 * valid to use.
4351 		 */
4352 		if ((mp1->b_next != NULL) &&
4353 		    SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next)))
4354 			tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4355 			    (int32_t)(intptr_t)mp1->b_prev);
4356 		else
4357 			TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4358 
4359 		/* Remeber the last sequence to be ACKed */
4360 		tcp->tcp_csuna = seg_ack;
4361 		if (tcp->tcp_set_timer == 1) {
4362 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4363 			tcp->tcp_set_timer = 0;
4364 		}
4365 	} else {
4366 		TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4367 	}
4368 
4369 	/* Eat acknowledged bytes off the xmit queue. */
4370 	for (;;) {
4371 		mblk_t	*mp2;
4372 		uchar_t	*wptr;
4373 
4374 		wptr = mp1->b_wptr;
4375 		ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4376 		bytes_acked -= (int)(wptr - mp1->b_rptr);
4377 		if (bytes_acked < 0) {
4378 			mp1->b_rptr = wptr + bytes_acked;
4379 			/*
4380 			 * Set a new timestamp if all the bytes timed by the
4381 			 * old timestamp have been ack'ed.
4382 			 */
4383 			if (SEQ_GT(seg_ack,
4384 			    (uint32_t)(uintptr_t)(mp1->b_next))) {
4385 				mp1->b_prev =
4386 				    (mblk_t *)(uintptr_t)LBOLT_FASTPATH;
4387 				mp1->b_next = NULL;
4388 			}
4389 			break;
4390 		}
4391 		mp1->b_next = NULL;
4392 		mp1->b_prev = NULL;
4393 		mp2 = mp1;
4394 		mp1 = mp1->b_cont;
4395 
4396 		/*
4397 		 * This notification is required for some zero-copy
4398 		 * clients to maintain a copy semantic. After the data
4399 		 * is ack'ed, client is safe to modify or reuse the buffer.
4400 		 */
4401 		if (tcp->tcp_snd_zcopy_aware &&
4402 		    (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4403 			tcp_zcopy_notify(tcp);
4404 		freeb(mp2);
4405 		if (bytes_acked == 0) {
4406 			if (mp1 == NULL) {
4407 				/* Everything is ack'ed, clear the tail. */
4408 				tcp->tcp_xmit_tail = NULL;
4409 				/*
4410 				 * Cancel the timer unless we are still
4411 				 * waiting for an ACK for the FIN packet.
4412 				 */
4413 				if (tcp->tcp_timer_tid != 0 &&
4414 				    tcp->tcp_snxt == tcp->tcp_suna) {
4415 					(void) TCP_TIMER_CANCEL(tcp,
4416 					    tcp->tcp_timer_tid);
4417 					tcp->tcp_timer_tid = 0;
4418 				}
4419 				goto pre_swnd_update;
4420 			}
4421 			if (mp2 != tcp->tcp_xmit_tail)
4422 				break;
4423 			tcp->tcp_xmit_tail = mp1;
4424 			ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4425 			    (uintptr_t)INT_MAX);
4426 			tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4427 			    mp1->b_rptr);
4428 			break;
4429 		}
4430 		if (mp1 == NULL) {
4431 			/*
4432 			 * More was acked but there is nothing more
4433 			 * outstanding.  This means that the FIN was
4434 			 * just acked or that we're talking to a clown.
4435 			 */
4436 fin_acked:
4437 			ASSERT(tcp->tcp_fin_sent);
4438 			tcp->tcp_xmit_tail = NULL;
4439 			if (tcp->tcp_fin_sent) {
4440 				/* FIN was acked - making progress */
4441 				if (!tcp->tcp_fin_acked)
4442 					tcp->tcp_ip_forward_progress = B_TRUE;
4443 				tcp->tcp_fin_acked = B_TRUE;
4444 				if (tcp->tcp_linger_tid != 0 &&
4445 				    TCP_TIMER_CANCEL(tcp,
4446 				    tcp->tcp_linger_tid) >= 0) {
4447 					tcp_stop_lingering(tcp);
4448 					freemsg(mp);
4449 					mp = NULL;
4450 				}
4451 			} else {
4452 				/*
4453 				 * We should never get here because
4454 				 * we have already checked that the
4455 				 * number of bytes ack'ed should be
4456 				 * smaller than or equal to what we
4457 				 * have sent so far (it is the
4458 				 * acceptability check of the ACK).
4459 				 * We can only get here if the send
4460 				 * queue is corrupted.
4461 				 *
4462 				 * Terminate the connection and
4463 				 * panic the system.  It is better
4464 				 * for us to panic instead of
4465 				 * continuing to avoid other disaster.
4466 				 */
4467 				tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4468 				    tcp->tcp_rnxt, TH_RST|TH_ACK);
4469 				panic("Memory corruption "
4470 				    "detected for connection %s.",
4471 				    tcp_display(tcp, NULL,
4472 				    DISP_ADDR_AND_PORT));
4473 				/*NOTREACHED*/
4474 			}
4475 			goto pre_swnd_update;
4476 		}
4477 		ASSERT(mp2 != tcp->tcp_xmit_tail);
4478 	}
4479 	if (tcp->tcp_unsent) {
4480 		flags |= TH_XMIT_NEEDED;
4481 	}
4482 pre_swnd_update:
4483 	tcp->tcp_xmit_head = mp1;
4484 swnd_update:
4485 	/*
4486 	 * The following check is different from most other implementations.
4487 	 * For bi-directional transfer, when segments are dropped, the
4488 	 * "normal" check will not accept a window update in those
4489 	 * retransmitted segemnts.  Failing to do that, TCP may send out
4490 	 * segments which are outside receiver's window.  As TCP accepts
4491 	 * the ack in those retransmitted segments, if the window update in
4492 	 * the same segment is not accepted, TCP will incorrectly calculates
4493 	 * that it can send more segments.  This can create a deadlock
4494 	 * with the receiver if its window becomes zero.
4495 	 */
4496 	if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4497 	    SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4498 	    (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4499 		/*
4500 		 * The criteria for update is:
4501 		 *
4502 		 * 1. the segment acknowledges some data.  Or
4503 		 * 2. the segment is new, i.e. it has a higher seq num. Or
4504 		 * 3. the segment is not old and the advertised window is
4505 		 * larger than the previous advertised window.
4506 		 */
4507 		if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4508 			flags |= TH_XMIT_NEEDED;
4509 		tcp->tcp_swnd = new_swnd;
4510 		if (new_swnd > tcp->tcp_max_swnd)
4511 			tcp->tcp_max_swnd = new_swnd;
4512 		tcp->tcp_swl1 = seg_seq;
4513 		tcp->tcp_swl2 = seg_ack;
4514 	}
4515 est:
4516 	if (tcp->tcp_state > TCPS_ESTABLISHED) {
4517 
4518 		switch (tcp->tcp_state) {
4519 		case TCPS_FIN_WAIT_1:
4520 			if (tcp->tcp_fin_acked) {
4521 				tcp->tcp_state = TCPS_FIN_WAIT_2;
4522 				DTRACE_TCP6(state__change, void, NULL,
4523 				    ip_xmit_attr_t *, connp->conn_ixa,
4524 				    void, NULL, tcp_t *, tcp, void, NULL,
4525 				    int32_t, TCPS_FIN_WAIT_1);
4526 				/*
4527 				 * We implement the non-standard BSD/SunOS
4528 				 * FIN_WAIT_2 flushing algorithm.
4529 				 * If there is no user attached to this
4530 				 * TCP endpoint, then this TCP struct
4531 				 * could hang around forever in FIN_WAIT_2
4532 				 * state if the peer forgets to send us
4533 				 * a FIN.  To prevent this, we wait only
4534 				 * 2*MSL (a convenient time value) for
4535 				 * the FIN to arrive.  If it doesn't show up,
4536 				 * we flush the TCP endpoint.  This algorithm,
4537 				 * though a violation of RFC-793, has worked
4538 				 * for over 10 years in BSD systems.
4539 				 * Note: SunOS 4.x waits 675 seconds before
4540 				 * flushing the FIN_WAIT_2 connection.
4541 				 */
4542 				TCP_TIMER_RESTART(tcp,
4543 				    tcp->tcp_fin_wait_2_flush_interval);
4544 			}
4545 			break;
4546 		case TCPS_FIN_WAIT_2:
4547 			break;	/* Shutdown hook? */
4548 		case TCPS_LAST_ACK:
4549 			freemsg(mp);
4550 			if (tcp->tcp_fin_acked) {
4551 				(void) tcp_clean_death(tcp, 0);
4552 				return;
4553 			}
4554 			goto xmit_check;
4555 		case TCPS_CLOSING:
4556 			if (tcp->tcp_fin_acked) {
4557 				SET_TIME_WAIT(tcps, tcp, connp);
4558 				DTRACE_TCP6(state__change, void, NULL,
4559 				    ip_xmit_attr_t *, connp->conn_ixa, void,
4560 				    NULL, tcp_t *, tcp, void, NULL, int32_t,
4561 				    TCPS_CLOSING);
4562 			}
4563 			/*FALLTHRU*/
4564 		case TCPS_CLOSE_WAIT:
4565 			freemsg(mp);
4566 			goto xmit_check;
4567 		default:
4568 			ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4569 			break;
4570 		}
4571 	}
4572 	if (flags & TH_FIN) {
4573 		/* Make sure we ack the fin */
4574 		flags |= TH_ACK_NEEDED;
4575 		if (!tcp->tcp_fin_rcvd) {
4576 			tcp->tcp_fin_rcvd = B_TRUE;
4577 			tcp->tcp_rnxt++;
4578 			tcpha = tcp->tcp_tcpha;
4579 			tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4580 
4581 			/*
4582 			 * Generate the ordrel_ind at the end unless the
4583 			 * conn is detached or it is a STREAMS based eager.
4584 			 * In the eager case we defer the notification until
4585 			 * tcp_accept_finish has run.
4586 			 */
4587 			if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4588 			    (tcp->tcp_listener == NULL &&
4589 			    !tcp->tcp_hard_binding)))
4590 				flags |= TH_ORDREL_NEEDED;
4591 			switch (tcp->tcp_state) {
4592 			case TCPS_SYN_RCVD:
4593 				tcp->tcp_state = TCPS_CLOSE_WAIT;
4594 				DTRACE_TCP6(state__change, void, NULL,
4595 				    ip_xmit_attr_t *, connp->conn_ixa,
4596 				    void, NULL, tcp_t *, tcp, void, NULL,
4597 				    int32_t, TCPS_SYN_RCVD);
4598 				/* Keepalive? */
4599 				break;
4600 			case TCPS_ESTABLISHED:
4601 				tcp->tcp_state = TCPS_CLOSE_WAIT;
4602 				DTRACE_TCP6(state__change, void, NULL,
4603 				    ip_xmit_attr_t *, connp->conn_ixa,
4604 				    void, NULL, tcp_t *, tcp, void, NULL,
4605 				    int32_t, TCPS_ESTABLISHED);
4606 				/* Keepalive? */
4607 				break;
4608 			case TCPS_FIN_WAIT_1:
4609 				if (!tcp->tcp_fin_acked) {
4610 					tcp->tcp_state = TCPS_CLOSING;
4611 					DTRACE_TCP6(state__change, void, NULL,
4612 					    ip_xmit_attr_t *, connp->conn_ixa,
4613 					    void, NULL, tcp_t *, tcp, void,
4614 					    NULL, int32_t, TCPS_FIN_WAIT_1);
4615 					break;
4616 				}
4617 				/* FALLTHRU */
4618 			case TCPS_FIN_WAIT_2:
4619 				SET_TIME_WAIT(tcps, tcp, connp);
4620 				DTRACE_TCP6(state__change, void, NULL,
4621 				    ip_xmit_attr_t *, connp->conn_ixa, void,
4622 				    NULL, tcp_t *, tcp, void, NULL, int32_t,
4623 				    TCPS_FIN_WAIT_2);
4624 				if (seg_len) {
4625 					/*
4626 					 * implies data piggybacked on FIN.
4627 					 * break to handle data.
4628 					 */
4629 					break;
4630 				}
4631 				freemsg(mp);
4632 				goto ack_check;
4633 			}
4634 		}
4635 	}
4636 	if (mp == NULL)
4637 		goto xmit_check;
4638 	if (seg_len == 0) {
4639 		freemsg(mp);
4640 		goto xmit_check;
4641 	}
4642 	if (mp->b_rptr == mp->b_wptr) {
4643 		/*
4644 		 * The header has been consumed, so we remove the
4645 		 * zero-length mblk here.
4646 		 */
4647 		mp1 = mp;
4648 		mp = mp->b_cont;
4649 		freeb(mp1);
4650 	}
4651 update_ack:
4652 	tcpha = tcp->tcp_tcpha;
4653 	tcp->tcp_rack_cnt++;
4654 	{
4655 		uint32_t cur_max;
4656 
4657 		cur_max = tcp->tcp_rack_cur_max;
4658 		if (tcp->tcp_rack_cnt >= cur_max) {
4659 			/*
4660 			 * We have more unacked data than we should - send
4661 			 * an ACK now.
4662 			 */
4663 			flags |= TH_ACK_NEEDED;
4664 			cur_max++;
4665 			if (cur_max > tcp->tcp_rack_abs_max)
4666 				tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4667 			else
4668 				tcp->tcp_rack_cur_max = cur_max;
4669 		} else if (TCP_IS_DETACHED(tcp)) {
4670 			/* We don't have an ACK timer for detached TCP. */
4671 			flags |= TH_ACK_NEEDED;
4672 		} else if (seg_len < mss) {
4673 			/*
4674 			 * If we get a segment that is less than an mss, and we
4675 			 * already have unacknowledged data, and the amount
4676 			 * unacknowledged is not a multiple of mss, then we
4677 			 * better generate an ACK now.  Otherwise, this may be
4678 			 * the tail piece of a transaction, and we would rather
4679 			 * wait for the response.
4680 			 */
4681 			uint32_t udif;
4682 			ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4683 			    (uintptr_t)INT_MAX);
4684 			udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4685 			if (udif && (udif % mss))
4686 				flags |= TH_ACK_NEEDED;
4687 			else
4688 				flags |= TH_ACK_TIMER_NEEDED;
4689 		} else {
4690 			/* Start delayed ack timer */
4691 			flags |= TH_ACK_TIMER_NEEDED;
4692 		}
4693 	}
4694 	tcp->tcp_rnxt += seg_len;
4695 	tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4696 
4697 	if (mp == NULL)
4698 		goto xmit_check;
4699 
4700 	/* Update SACK list */
4701 	if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4702 		tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4703 		    &(tcp->tcp_num_sack_blk));
4704 	}
4705 
4706 	if (tcp->tcp_urp_mp) {
4707 		tcp->tcp_urp_mp->b_cont = mp;
4708 		mp = tcp->tcp_urp_mp;
4709 		tcp->tcp_urp_mp = NULL;
4710 		/* Ready for a new signal. */
4711 		tcp->tcp_urp_last_valid = B_FALSE;
4712 #ifdef DEBUG
4713 		(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4714 		    "tcp_rput: sending exdata_ind %s",
4715 		    tcp_display(tcp, NULL, DISP_PORT_ONLY));
4716 #endif /* DEBUG */
4717 	}
4718 
4719 	/*
4720 	 * Check for ancillary data changes compared to last segment.
4721 	 */
4722 	if (connp->conn_recv_ancillary.crb_all != 0) {
4723 		mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4724 		if (mp == NULL)
4725 			return;
4726 	}
4727 
4728 	if (IPCL_IS_NONSTR(connp)) {
4729 		/*
4730 		 * Non-STREAMS socket
4731 		 */
4732 		boolean_t push = flags & (TH_PUSH|TH_FIN);
4733 		int error;
4734 
4735 		if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4736 		    mp, seg_len, 0, &error, &push) <= 0) {
4737 			/*
4738 			 * We should never be in middle of a
4739 			 * fallback, the squeue guarantees that.
4740 			 */
4741 			ASSERT(error != EOPNOTSUPP);
4742 			if (error == ENOSPC)
4743 				tcp->tcp_rwnd -= seg_len;
4744 		} else if (push) {
4745 			/* PUSH bit set and sockfs is not flow controlled */
4746 			flags |= tcp_rwnd_reopen(tcp);
4747 		}
4748 	} else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4749 		/*
4750 		 * Side queue inbound data until the accept happens.
4751 		 * tcp_accept/tcp_rput drains this when the accept happens.
4752 		 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4753 		 * T_EXDATA_IND) it is queued on b_next.
4754 		 * XXX Make urgent data use this. Requires:
4755 		 *	Removing tcp_listener check for TH_URG
4756 		 *	Making M_PCPROTO and MARK messages skip the eager case
4757 		 */
4758 
4759 		tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4760 	} else {
4761 		/* Active STREAMS socket */
4762 		if (mp->b_datap->db_type != M_DATA ||
4763 		    (flags & TH_MARKNEXT_NEEDED)) {
4764 			if (tcp->tcp_rcv_list != NULL) {
4765 				flags |= tcp_rcv_drain(tcp);
4766 			}
4767 			ASSERT(tcp->tcp_rcv_list == NULL ||
4768 			    tcp->tcp_fused_sigurg);
4769 
4770 			if (flags & TH_MARKNEXT_NEEDED) {
4771 #ifdef DEBUG
4772 				(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4773 				    "tcp_rput: sending MSGMARKNEXT %s",
4774 				    tcp_display(tcp, NULL,
4775 				    DISP_PORT_ONLY));
4776 #endif /* DEBUG */
4777 				mp->b_flag |= MSGMARKNEXT;
4778 				flags &= ~TH_MARKNEXT_NEEDED;
4779 			}
4780 
4781 			if (is_system_labeled())
4782 				tcp_setcred_data(mp, ira);
4783 
4784 			putnext(connp->conn_rq, mp);
4785 			if (!canputnext(connp->conn_rq))
4786 				tcp->tcp_rwnd -= seg_len;
4787 		} else if ((flags & (TH_PUSH|TH_FIN)) ||
4788 		    tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4789 			if (tcp->tcp_rcv_list != NULL) {
4790 				/*
4791 				 * Enqueue the new segment first and then
4792 				 * call tcp_rcv_drain() to send all data
4793 				 * up.  The other way to do this is to
4794 				 * send all queued data up and then call
4795 				 * putnext() to send the new segment up.
4796 				 * This way can remove the else part later
4797 				 * on.
4798 				 *
4799 				 * We don't do this to avoid one more call to
4800 				 * canputnext() as tcp_rcv_drain() needs to
4801 				 * call canputnext().
4802 				 */
4803 				tcp_rcv_enqueue(tcp, mp, seg_len,
4804 				    ira->ira_cred);
4805 				flags |= tcp_rcv_drain(tcp);
4806 			} else {
4807 				if (is_system_labeled())
4808 					tcp_setcred_data(mp, ira);
4809 
4810 				putnext(connp->conn_rq, mp);
4811 				if (!canputnext(connp->conn_rq))
4812 					tcp->tcp_rwnd -= seg_len;
4813 			}
4814 		} else {
4815 			/*
4816 			 * Enqueue all packets when processing an mblk
4817 			 * from the co queue and also enqueue normal packets.
4818 			 */
4819 			tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4820 		}
4821 		/*
4822 		 * Make sure the timer is running if we have data waiting
4823 		 * for a push bit. This provides resiliency against
4824 		 * implementations that do not correctly generate push bits.
4825 		 */
4826 		if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4827 			/*
4828 			 * The connection may be closed at this point, so don't
4829 			 * do anything for a detached tcp.
4830 			 */
4831 			if (!TCP_IS_DETACHED(tcp))
4832 				tcp->tcp_push_tid = TCP_TIMER(tcp,
4833 				    tcp_push_timer,
4834 				    tcps->tcps_push_timer_interval);
4835 		}
4836 	}
4837 
4838 xmit_check:
4839 	/* Is there anything left to do? */
4840 	ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4841 	if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4842 	    TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4843 	    TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4844 		goto done;
4845 
4846 	/* Any transmit work to do and a non-zero window? */
4847 	if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4848 	    TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4849 		if (flags & TH_REXMIT_NEEDED) {
4850 			uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4851 
4852 			TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4853 			if (snd_size > mss)
4854 				snd_size = mss;
4855 			if (snd_size > tcp->tcp_swnd)
4856 				snd_size = tcp->tcp_swnd;
4857 			mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
4858 			    NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
4859 			    B_TRUE);
4860 
4861 			if (mp1 != NULL) {
4862 				tcp->tcp_xmit_head->b_prev =
4863 				    (mblk_t *)LBOLT_FASTPATH;
4864 				tcp->tcp_csuna = tcp->tcp_snxt;
4865 				TCPS_BUMP_MIB(tcps, tcpRetransSegs);
4866 				TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
4867 				    snd_size);
4868 				tcp_send_data(tcp, mp1);
4869 			}
4870 		}
4871 		if (flags & TH_NEED_SACK_REXMIT) {
4872 			tcp_sack_rexmit(tcp, &flags);
4873 		}
4874 		/*
4875 		 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4876 		 * out new segment.  Note that tcp_rexmit should not be
4877 		 * set, otherwise TH_LIMIT_XMIT should not be set.
4878 		 */
4879 		if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
4880 			if (!tcp->tcp_rexmit) {
4881 				tcp_wput_data(tcp, NULL, B_FALSE);
4882 			} else {
4883 				tcp_ss_rexmit(tcp);
4884 			}
4885 		}
4886 		/*
4887 		 * Adjust tcp_cwnd back to normal value after sending
4888 		 * new data segments.
4889 		 */
4890 		if (flags & TH_LIMIT_XMIT) {
4891 			tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
4892 			/*
4893 			 * This will restart the timer.  Restarting the
4894 			 * timer is used to avoid a timeout before the
4895 			 * limited transmitted segment's ACK gets back.
4896 			 */
4897 			if (tcp->tcp_xmit_head != NULL)
4898 				tcp->tcp_xmit_head->b_prev =
4899 				    (mblk_t *)LBOLT_FASTPATH;
4900 		}
4901 
4902 		/* Anything more to do? */
4903 		if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
4904 		    TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4905 			goto done;
4906 	}
4907 ack_check:
4908 	if (flags & TH_SEND_URP_MARK) {
4909 		ASSERT(tcp->tcp_urp_mark_mp);
4910 		ASSERT(!IPCL_IS_NONSTR(connp));
4911 		/*
4912 		 * Send up any queued data and then send the mark message
4913 		 */
4914 		if (tcp->tcp_rcv_list != NULL) {
4915 			flags |= tcp_rcv_drain(tcp);
4916 
4917 		}
4918 		ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4919 		mp1 = tcp->tcp_urp_mark_mp;
4920 		tcp->tcp_urp_mark_mp = NULL;
4921 		if (is_system_labeled())
4922 			tcp_setcred_data(mp1, ira);
4923 
4924 		putnext(connp->conn_rq, mp1);
4925 #ifdef DEBUG
4926 		(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4927 		    "tcp_rput: sending zero-length %s %s",
4928 		    ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
4929 		    "MSGNOTMARKNEXT"),
4930 		    tcp_display(tcp, NULL, DISP_PORT_ONLY));
4931 #endif /* DEBUG */
4932 		flags &= ~TH_SEND_URP_MARK;
4933 	}
4934 	if (flags & TH_ACK_NEEDED) {
4935 		/*
4936 		 * Time to send an ack for some reason.
4937 		 */
4938 		mp1 = tcp_ack_mp(tcp);
4939 
4940 		if (mp1 != NULL) {
4941 			tcp_send_data(tcp, mp1);
4942 			BUMP_LOCAL(tcp->tcp_obsegs);
4943 			TCPS_BUMP_MIB(tcps, tcpOutAck);
4944 		}
4945 		if (tcp->tcp_ack_tid != 0) {
4946 			(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
4947 			tcp->tcp_ack_tid = 0;
4948 		}
4949 	}
4950 	if (flags & TH_ACK_TIMER_NEEDED) {
4951 		/*
4952 		 * Arrange for deferred ACK or push wait timeout.
4953 		 * Start timer if it is not already running.
4954 		 */
4955 		if (tcp->tcp_ack_tid == 0) {
4956 			tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
4957 			    tcp->tcp_localnet ?
4958 			    tcps->tcps_local_dack_interval :
4959 			    tcps->tcps_deferred_ack_interval);
4960 		}
4961 	}
4962 	if (flags & TH_ORDREL_NEEDED) {
4963 		/*
4964 		 * Notify upper layer about an orderly release. If this is
4965 		 * a non-STREAMS socket, then just make an upcall. For STREAMS
4966 		 * we send up an ordrel_ind, unless this is an eager, in which
4967 		 * case the ordrel will be sent when tcp_accept_finish runs.
4968 		 * Note that for non-STREAMS we make an upcall even if it is an
4969 		 * eager, because we have an upper handle to send it to.
4970 		 */
4971 		ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
4972 		ASSERT(!tcp->tcp_detached);
4973 
4974 		if (IPCL_IS_NONSTR(connp)) {
4975 			ASSERT(tcp->tcp_ordrel_mp == NULL);
4976 			tcp->tcp_ordrel_done = B_TRUE;
4977 			(*sockupcalls->su_opctl)(connp->conn_upper_handle,
4978 			    SOCK_OPCTL_SHUT_RECV, 0);
4979 			goto done;
4980 		}
4981 
4982 		if (tcp->tcp_rcv_list != NULL) {
4983 			/*
4984 			 * Push any mblk(s) enqueued from co processing.
4985 			 */
4986 			flags |= tcp_rcv_drain(tcp);
4987 		}
4988 		ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4989 
4990 		mp1 = tcp->tcp_ordrel_mp;
4991 		tcp->tcp_ordrel_mp = NULL;
4992 		tcp->tcp_ordrel_done = B_TRUE;
4993 		putnext(connp->conn_rq, mp1);
4994 	}
4995 done:
4996 	ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4997 }
4998 
4999 /*
5000  * Attach ancillary data to a received TCP segments for the
5001  * ancillary pieces requested by the application that are
5002  * different than they were in the previous data segment.
5003  *
5004  * Save the "current" values once memory allocation is ok so that
5005  * when memory allocation fails we can just wait for the next data segment.
5006  */
5007 static mblk_t *
5008 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
5009     ip_recv_attr_t *ira)
5010 {
5011 	struct T_optdata_ind *todi;
5012 	int optlen;
5013 	uchar_t *optptr;
5014 	struct T_opthdr *toh;
5015 	crb_t addflag;	/* Which pieces to add */
5016 	mblk_t *mp1;
5017 	conn_t	*connp = tcp->tcp_connp;
5018 
5019 	optlen = 0;
5020 	addflag.crb_all = 0;
5021 	/* If app asked for pktinfo and the index has changed ... */
5022 	if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
5023 	    ira->ira_ruifindex != tcp->tcp_recvifindex) {
5024 		optlen += sizeof (struct T_opthdr) +
5025 		    sizeof (struct in6_pktinfo);
5026 		addflag.crb_ip_recvpktinfo = 1;
5027 	}
5028 	/* If app asked for hoplimit and it has changed ... */
5029 	if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5030 	    ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5031 		optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5032 		addflag.crb_ipv6_recvhoplimit = 1;
5033 	}
5034 	/* If app asked for tclass and it has changed ... */
5035 	if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5036 	    ipp->ipp_tclass != tcp->tcp_recvtclass) {
5037 		optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5038 		addflag.crb_ipv6_recvtclass = 1;
5039 	}
5040 	/*
5041 	 * If app asked for hopbyhop headers and it has changed ...
5042 	 * For security labels, note that (1) security labels can't change on
5043 	 * a connected socket at all, (2) we're connected to at most one peer,
5044 	 * (3) if anything changes, then it must be some other extra option.
5045 	 */
5046 	if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5047 	    ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5048 	    (ipp->ipp_fields & IPPF_HOPOPTS),
5049 	    ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5050 		optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5051 		addflag.crb_ipv6_recvhopopts = 1;
5052 		if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5053 		    &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5054 		    ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5055 			return (mp);
5056 	}
5057 	/* If app asked for dst headers before routing headers ... */
5058 	if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5059 	    ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5060 	    (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5061 	    ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5062 		optlen += sizeof (struct T_opthdr) +
5063 		    ipp->ipp_rthdrdstoptslen;
5064 		addflag.crb_ipv6_recvrthdrdstopts = 1;
5065 		if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5066 		    &tcp->tcp_rthdrdstoptslen,
5067 		    (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5068 		    ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5069 			return (mp);
5070 	}
5071 	/* If app asked for routing headers and it has changed ... */
5072 	if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5073 	    ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5074 	    (ipp->ipp_fields & IPPF_RTHDR),
5075 	    ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5076 		optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5077 		addflag.crb_ipv6_recvrthdr = 1;
5078 		if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5079 		    &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5080 		    ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5081 			return (mp);
5082 	}
5083 	/* If app asked for dest headers and it has changed ... */
5084 	if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5085 	    connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5086 	    ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5087 	    (ipp->ipp_fields & IPPF_DSTOPTS),
5088 	    ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5089 		optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5090 		addflag.crb_ipv6_recvdstopts = 1;
5091 		if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5092 		    &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5093 		    ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5094 			return (mp);
5095 	}
5096 
5097 	if (optlen == 0) {
5098 		/* Nothing to add */
5099 		return (mp);
5100 	}
5101 	mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5102 	if (mp1 == NULL) {
5103 		/*
5104 		 * Defer sending ancillary data until the next TCP segment
5105 		 * arrives.
5106 		 */
5107 		return (mp);
5108 	}
5109 	mp1->b_cont = mp;
5110 	mp = mp1;
5111 	mp->b_wptr += sizeof (*todi) + optlen;
5112 	mp->b_datap->db_type = M_PROTO;
5113 	todi = (struct T_optdata_ind *)mp->b_rptr;
5114 	todi->PRIM_type = T_OPTDATA_IND;
5115 	todi->DATA_flag = 1;	/* MORE data */
5116 	todi->OPT_length = optlen;
5117 	todi->OPT_offset = sizeof (*todi);
5118 	optptr = (uchar_t *)&todi[1];
5119 	/*
5120 	 * If app asked for pktinfo and the index has changed ...
5121 	 * Note that the local address never changes for the connection.
5122 	 */
5123 	if (addflag.crb_ip_recvpktinfo) {
5124 		struct in6_pktinfo *pkti;
5125 		uint_t ifindex;
5126 
5127 		ifindex = ira->ira_ruifindex;
5128 		toh = (struct T_opthdr *)optptr;
5129 		toh->level = IPPROTO_IPV6;
5130 		toh->name = IPV6_PKTINFO;
5131 		toh->len = sizeof (*toh) + sizeof (*pkti);
5132 		toh->status = 0;
5133 		optptr += sizeof (*toh);
5134 		pkti = (struct in6_pktinfo *)optptr;
5135 		pkti->ipi6_addr = connp->conn_laddr_v6;
5136 		pkti->ipi6_ifindex = ifindex;
5137 		optptr += sizeof (*pkti);
5138 		ASSERT(OK_32PTR(optptr));
5139 		/* Save as "last" value */
5140 		tcp->tcp_recvifindex = ifindex;
5141 	}
5142 	/* If app asked for hoplimit and it has changed ... */
5143 	if (addflag.crb_ipv6_recvhoplimit) {
5144 		toh = (struct T_opthdr *)optptr;
5145 		toh->level = IPPROTO_IPV6;
5146 		toh->name = IPV6_HOPLIMIT;
5147 		toh->len = sizeof (*toh) + sizeof (uint_t);
5148 		toh->status = 0;
5149 		optptr += sizeof (*toh);
5150 		*(uint_t *)optptr = ipp->ipp_hoplimit;
5151 		optptr += sizeof (uint_t);
5152 		ASSERT(OK_32PTR(optptr));
5153 		/* Save as "last" value */
5154 		tcp->tcp_recvhops = ipp->ipp_hoplimit;
5155 	}
5156 	/* If app asked for tclass and it has changed ... */
5157 	if (addflag.crb_ipv6_recvtclass) {
5158 		toh = (struct T_opthdr *)optptr;
5159 		toh->level = IPPROTO_IPV6;
5160 		toh->name = IPV6_TCLASS;
5161 		toh->len = sizeof (*toh) + sizeof (uint_t);
5162 		toh->status = 0;
5163 		optptr += sizeof (*toh);
5164 		*(uint_t *)optptr = ipp->ipp_tclass;
5165 		optptr += sizeof (uint_t);
5166 		ASSERT(OK_32PTR(optptr));
5167 		/* Save as "last" value */
5168 		tcp->tcp_recvtclass = ipp->ipp_tclass;
5169 	}
5170 	if (addflag.crb_ipv6_recvhopopts) {
5171 		toh = (struct T_opthdr *)optptr;
5172 		toh->level = IPPROTO_IPV6;
5173 		toh->name = IPV6_HOPOPTS;
5174 		toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5175 		toh->status = 0;
5176 		optptr += sizeof (*toh);
5177 		bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5178 		optptr += ipp->ipp_hopoptslen;
5179 		ASSERT(OK_32PTR(optptr));
5180 		/* Save as last value */
5181 		ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5182 		    (ipp->ipp_fields & IPPF_HOPOPTS),
5183 		    ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5184 	}
5185 	if (addflag.crb_ipv6_recvrthdrdstopts) {
5186 		toh = (struct T_opthdr *)optptr;
5187 		toh->level = IPPROTO_IPV6;
5188 		toh->name = IPV6_RTHDRDSTOPTS;
5189 		toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5190 		toh->status = 0;
5191 		optptr += sizeof (*toh);
5192 		bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5193 		optptr += ipp->ipp_rthdrdstoptslen;
5194 		ASSERT(OK_32PTR(optptr));
5195 		/* Save as last value */
5196 		ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5197 		    &tcp->tcp_rthdrdstoptslen,
5198 		    (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5199 		    ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5200 	}
5201 	if (addflag.crb_ipv6_recvrthdr) {
5202 		toh = (struct T_opthdr *)optptr;
5203 		toh->level = IPPROTO_IPV6;
5204 		toh->name = IPV6_RTHDR;
5205 		toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5206 		toh->status = 0;
5207 		optptr += sizeof (*toh);
5208 		bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5209 		optptr += ipp->ipp_rthdrlen;
5210 		ASSERT(OK_32PTR(optptr));
5211 		/* Save as last value */
5212 		ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5213 		    (ipp->ipp_fields & IPPF_RTHDR),
5214 		    ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5215 	}
5216 	if (addflag.crb_ipv6_recvdstopts) {
5217 		toh = (struct T_opthdr *)optptr;
5218 		toh->level = IPPROTO_IPV6;
5219 		toh->name = IPV6_DSTOPTS;
5220 		toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5221 		toh->status = 0;
5222 		optptr += sizeof (*toh);
5223 		bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5224 		optptr += ipp->ipp_dstoptslen;
5225 		ASSERT(OK_32PTR(optptr));
5226 		/* Save as last value */
5227 		ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5228 		    (ipp->ipp_fields & IPPF_DSTOPTS),
5229 		    ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5230 	}
5231 	ASSERT(optptr == mp->b_wptr);
5232 	return (mp);
5233 }
5234 
5235 /* The minimum of smoothed mean deviation in RTO calculation. */
5236 #define	TCP_SD_MIN	400
5237 
5238 /*
5239  * Set RTO for this connection.  The formula is from Jacobson and Karels'
5240  * "Congestion Avoidance and Control" in SIGCOMM '88.  The variable names
5241  * are the same as those in Appendix A.2 of that paper.
5242  *
5243  * m = new measurement
5244  * sa = smoothed RTT average (8 * average estimates).
5245  * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5246  */
5247 static void
5248 tcp_set_rto(tcp_t *tcp, clock_t rtt)
5249 {
5250 	long m = TICK_TO_MSEC(rtt);
5251 	clock_t sa = tcp->tcp_rtt_sa;
5252 	clock_t sv = tcp->tcp_rtt_sd;
5253 	clock_t rto;
5254 	tcp_stack_t	*tcps = tcp->tcp_tcps;
5255 
5256 	TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5257 	tcp->tcp_rtt_update++;
5258 
5259 	/* tcp_rtt_sa is not 0 means this is a new sample. */
5260 	if (sa != 0) {
5261 		/*
5262 		 * Update average estimator:
5263 		 *	new rtt = 7/8 old rtt + 1/8 Error
5264 		 */
5265 
5266 		/* m is now Error in estimate. */
5267 		m -= sa >> 3;
5268 		if ((sa += m) <= 0) {
5269 			/*
5270 			 * Don't allow the smoothed average to be negative.
5271 			 * We use 0 to denote reinitialization of the
5272 			 * variables.
5273 			 */
5274 			sa = 1;
5275 		}
5276 
5277 		/*
5278 		 * Update deviation estimator:
5279 		 *	new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
5280 		 */
5281 		if (m < 0)
5282 			m = -m;
5283 		m -= sv >> 2;
5284 		sv += m;
5285 	} else {
5286 		/*
5287 		 * This follows BSD's implementation.  So the reinitialized
5288 		 * RTO is 3 * m.  We cannot go less than 2 because if the
5289 		 * link is bandwidth dominated, doubling the window size
5290 		 * during slow start means doubling the RTT.  We want to be
5291 		 * more conservative when we reinitialize our estimates.  3
5292 		 * is just a convenient number.
5293 		 */
5294 		sa = m << 3;
5295 		sv = m << 1;
5296 	}
5297 	if (sv < TCP_SD_MIN) {
5298 		/*
5299 		 * We do not know that if sa captures the delay ACK
5300 		 * effect as in a long train of segments, a receiver
5301 		 * does not delay its ACKs.  So set the minimum of sv
5302 		 * to be TCP_SD_MIN, which is default to 400 ms, twice
5303 		 * of BSD DATO.  That means the minimum of mean
5304 		 * deviation is 100 ms.
5305 		 *
5306 		 */
5307 		sv = TCP_SD_MIN;
5308 	}
5309 	tcp->tcp_rtt_sa = sa;
5310 	tcp->tcp_rtt_sd = sv;
5311 	/*
5312 	 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
5313 	 *
5314 	 * Add tcp_rexmit_interval extra in case of extreme environment
5315 	 * where the algorithm fails to work.  The default value of
5316 	 * tcp_rexmit_interval_extra should be 0.
5317 	 *
5318 	 * As we use a finer grained clock than BSD and update
5319 	 * RTO for every ACKs, add in another .25 of RTT to the
5320 	 * deviation of RTO to accomodate burstiness of 1/4 of
5321 	 * window size.
5322 	 */
5323 	rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5);
5324 
5325 	TCP_SET_RTO(tcp, rto);
5326 
5327 	/* Now, we can reset tcp_timer_backoff to use the new RTO... */
5328 	tcp->tcp_timer_backoff = 0;
5329 }
5330 
5331 /*
5332  * On a labeled system we have some protocols above TCP, such as RPC, which
5333  * appear to assume that every mblk in a chain has a db_credp.
5334  */
5335 static void
5336 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5337 {
5338 	ASSERT(is_system_labeled());
5339 	ASSERT(ira->ira_cred != NULL);
5340 
5341 	while (mp != NULL) {
5342 		mblk_setcred(mp, ira->ira_cred, NOPID);
5343 		mp = mp->b_cont;
5344 	}
5345 }
5346 
5347 uint_t
5348 tcp_rwnd_reopen(tcp_t *tcp)
5349 {
5350 	uint_t ret = 0;
5351 	uint_t thwin;
5352 	conn_t *connp = tcp->tcp_connp;
5353 
5354 	/* Learn the latest rwnd information that we sent to the other side. */
5355 	thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5356 	    << tcp->tcp_rcv_ws;
5357 	/* This is peer's calculated send window (our receive window). */
5358 	thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5359 	/*
5360 	 * Increase the receive window to max.  But we need to do receiver
5361 	 * SWS avoidance.  This means that we need to check the increase of
5362 	 * of receive window is at least 1 MSS.
5363 	 */
5364 	if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5365 		/*
5366 		 * If the window that the other side knows is less than max
5367 		 * deferred acks segments, send an update immediately.
5368 		 */
5369 		if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5370 			TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5371 			ret = TH_ACK_NEEDED;
5372 		}
5373 		tcp->tcp_rwnd = connp->conn_rcvbuf;
5374 	}
5375 	return (ret);
5376 }
5377 
5378 /*
5379  * Handle a packet that has been reclassified by TCP.
5380  * This function drops the ref on connp that the caller had.
5381  */
5382 void
5383 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5384 {
5385 	ipsec_stack_t	*ipss = ipst->ips_netstack->netstack_ipsec;
5386 
5387 	if (connp->conn_incoming_ifindex != 0 &&
5388 	    connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5389 		freemsg(mp);
5390 		CONN_DEC_REF(connp);
5391 		return;
5392 	}
5393 
5394 	if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5395 	    (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5396 		ip6_t *ip6h;
5397 		ipha_t *ipha;
5398 
5399 		if (ira->ira_flags & IRAF_IS_IPV4) {
5400 			ipha = (ipha_t *)mp->b_rptr;
5401 			ip6h = NULL;
5402 		} else {
5403 			ipha = NULL;
5404 			ip6h = (ip6_t *)mp->b_rptr;
5405 		}
5406 		mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5407 		if (mp == NULL) {
5408 			BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5409 			/* Note that mp is NULL */
5410 			ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5411 			CONN_DEC_REF(connp);
5412 			return;
5413 		}
5414 	}
5415 
5416 	if (IPCL_IS_TCP(connp)) {
5417 		/*
5418 		 * do not drain, certain use cases can blow
5419 		 * the stack
5420 		 */
5421 		SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5422 		    connp->conn_recv, connp, ira,
5423 		    SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5424 	} else {
5425 		/* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5426 		(connp->conn_recv)(connp, mp, NULL,
5427 		    ira);
5428 		CONN_DEC_REF(connp);
5429 	}
5430 
5431 }
5432 
5433 /* ARGSUSED */
5434 static void
5435 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5436 {
5437 	conn_t	*connp = (conn_t *)arg;
5438 	tcp_t	*tcp = connp->conn_tcp;
5439 	queue_t	*q = connp->conn_rq;
5440 
5441 	ASSERT(!IPCL_IS_NONSTR(connp));
5442 	mutex_enter(&tcp->tcp_rsrv_mp_lock);
5443 	tcp->tcp_rsrv_mp = mp;
5444 	mutex_exit(&tcp->tcp_rsrv_mp_lock);
5445 
5446 	if (TCP_IS_DETACHED(tcp) || q == NULL) {
5447 		return;
5448 	}
5449 
5450 	if (tcp->tcp_fused) {
5451 		tcp_fuse_backenable(tcp);
5452 		return;
5453 	}
5454 
5455 	if (canputnext(q)) {
5456 		/* Not flow-controlled, open rwnd */
5457 		tcp->tcp_rwnd = connp->conn_rcvbuf;
5458 
5459 		/*
5460 		 * Send back a window update immediately if TCP is above
5461 		 * ESTABLISHED state and the increase of the rcv window
5462 		 * that the other side knows is at least 1 MSS after flow
5463 		 * control is lifted.
5464 		 */
5465 		if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5466 		    tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5467 			tcp_xmit_ctl(NULL, tcp,
5468 			    (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5469 			    tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5470 		}
5471 	}
5472 }
5473 
5474 /*
5475  * The read side service routine is called mostly when we get back-enabled as a
5476  * result of flow control relief.  Since we don't actually queue anything in
5477  * TCP, we have no data to send out of here.  What we do is clear the receive
5478  * window, and send out a window update.
5479  */
5480 void
5481 tcp_rsrv(queue_t *q)
5482 {
5483 	conn_t		*connp = Q_TO_CONN(q);
5484 	tcp_t		*tcp = connp->conn_tcp;
5485 	mblk_t		*mp;
5486 
5487 	/* No code does a putq on the read side */
5488 	ASSERT(q->q_first == NULL);
5489 
5490 	/*
5491 	 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5492 	 * been run.  So just return.
5493 	 */
5494 	mutex_enter(&tcp->tcp_rsrv_mp_lock);
5495 	if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5496 		mutex_exit(&tcp->tcp_rsrv_mp_lock);
5497 		return;
5498 	}
5499 	tcp->tcp_rsrv_mp = NULL;
5500 	mutex_exit(&tcp->tcp_rsrv_mp_lock);
5501 
5502 	CONN_INC_REF(connp);
5503 	SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5504 	    NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5505 }
5506 
5507 /* At minimum we need 8 bytes in the TCP header for the lookup */
5508 #define	ICMP_MIN_TCP_HDR	8
5509 
5510 /*
5511  * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5512  * passed up by IP. The message is always received on the correct tcp_t.
5513  * Assumes that IP has pulled up everything up to and including the ICMP header.
5514  */
5515 /* ARGSUSED2 */
5516 void
5517 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5518 {
5519 	conn_t		*connp = (conn_t *)arg1;
5520 	icmph_t		*icmph;
5521 	ipha_t		*ipha;
5522 	int		iph_hdr_length;
5523 	tcpha_t		*tcpha;
5524 	uint32_t	seg_seq;
5525 	tcp_t		*tcp = connp->conn_tcp;
5526 
5527 	/* Assume IP provides aligned packets */
5528 	ASSERT(OK_32PTR(mp->b_rptr));
5529 	ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5530 
5531 	/*
5532 	 * It's possible we have a closed, but not yet destroyed, TCP
5533 	 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5534 	 * in the closed state, so don't take any chances and drop the packet.
5535 	 */
5536 	if (tcp->tcp_state == TCPS_CLOSED) {
5537 		freemsg(mp);
5538 		return;
5539 	}
5540 
5541 	/*
5542 	 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5543 	 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5544 	 */
5545 	if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5546 		tcp_icmp_error_ipv6(tcp, mp, ira);
5547 		return;
5548 	}
5549 
5550 	/* Skip past the outer IP and ICMP headers */
5551 	iph_hdr_length = ira->ira_ip_hdr_length;
5552 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5553 	/*
5554 	 * If we don't have the correct outer IP header length
5555 	 * or if we don't have a complete inner IP header
5556 	 * drop it.
5557 	 */
5558 	if (iph_hdr_length < sizeof (ipha_t) ||
5559 	    (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5560 noticmpv4:
5561 		freemsg(mp);
5562 		return;
5563 	}
5564 	ipha = (ipha_t *)&icmph[1];
5565 
5566 	/* Skip past the inner IP and find the ULP header */
5567 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
5568 	tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5569 	/*
5570 	 * If we don't have the correct inner IP header length or if the ULP
5571 	 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5572 	 * bytes of TCP header, drop it.
5573 	 */
5574 	if (iph_hdr_length < sizeof (ipha_t) ||
5575 	    ipha->ipha_protocol != IPPROTO_TCP ||
5576 	    (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5577 		goto noticmpv4;
5578 	}
5579 
5580 	seg_seq = ntohl(tcpha->tha_seq);
5581 	switch (icmph->icmph_type) {
5582 	case ICMP_DEST_UNREACHABLE:
5583 		switch (icmph->icmph_code) {
5584 		case ICMP_FRAGMENTATION_NEEDED:
5585 			/*
5586 			 * Update Path MTU, then try to send something out.
5587 			 */
5588 			tcp_update_pmtu(tcp, B_TRUE);
5589 			tcp_rexmit_after_error(tcp);
5590 			break;
5591 		case ICMP_PORT_UNREACHABLE:
5592 		case ICMP_PROTOCOL_UNREACHABLE:
5593 			switch (tcp->tcp_state) {
5594 			case TCPS_SYN_SENT:
5595 			case TCPS_SYN_RCVD:
5596 				/*
5597 				 * ICMP can snipe away incipient
5598 				 * TCP connections as long as
5599 				 * seq number is same as initial
5600 				 * send seq number.
5601 				 */
5602 				if (seg_seq == tcp->tcp_iss) {
5603 					(void) tcp_clean_death(tcp,
5604 					    ECONNREFUSED);
5605 				}
5606 				break;
5607 			}
5608 			break;
5609 		case ICMP_HOST_UNREACHABLE:
5610 		case ICMP_NET_UNREACHABLE:
5611 			/* Record the error in case we finally time out. */
5612 			if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5613 				tcp->tcp_client_errno = EHOSTUNREACH;
5614 			else
5615 				tcp->tcp_client_errno = ENETUNREACH;
5616 			if (tcp->tcp_state == TCPS_SYN_RCVD) {
5617 				if (tcp->tcp_listener != NULL &&
5618 				    tcp->tcp_listener->tcp_syn_defense) {
5619 					/*
5620 					 * Ditch the half-open connection if we
5621 					 * suspect a SYN attack is under way.
5622 					 */
5623 					(void) tcp_clean_death(tcp,
5624 					    tcp->tcp_client_errno);
5625 				}
5626 			}
5627 			break;
5628 		default:
5629 			break;
5630 		}
5631 		break;
5632 	case ICMP_SOURCE_QUENCH: {
5633 		/*
5634 		 * use a global boolean to control
5635 		 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5636 		 * The default is false.
5637 		 */
5638 		if (tcp_icmp_source_quench) {
5639 			/*
5640 			 * Reduce the sending rate as if we got a
5641 			 * retransmit timeout
5642 			 */
5643 			uint32_t npkt;
5644 
5645 			npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5646 			    tcp->tcp_mss;
5647 			tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5648 			tcp->tcp_cwnd = tcp->tcp_mss;
5649 			tcp->tcp_cwnd_cnt = 0;
5650 		}
5651 		break;
5652 	}
5653 	}
5654 	freemsg(mp);
5655 }
5656 
5657 /*
5658  * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5659  * error messages passed up by IP.
5660  * Assumes that IP has pulled up all the extension headers as well
5661  * as the ICMPv6 header.
5662  */
5663 static void
5664 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5665 {
5666 	icmp6_t		*icmp6;
5667 	ip6_t		*ip6h;
5668 	uint16_t	iph_hdr_length = ira->ira_ip_hdr_length;
5669 	tcpha_t		*tcpha;
5670 	uint8_t		*nexthdrp;
5671 	uint32_t	seg_seq;
5672 
5673 	/*
5674 	 * Verify that we have a complete IP header.
5675 	 */
5676 	ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5677 
5678 	icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5679 	ip6h = (ip6_t *)&icmp6[1];
5680 	/*
5681 	 * Verify if we have a complete ICMP and inner IP header.
5682 	 */
5683 	if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5684 noticmpv6:
5685 		freemsg(mp);
5686 		return;
5687 	}
5688 
5689 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5690 		goto noticmpv6;
5691 	tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5692 	/*
5693 	 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5694 	 * have at least ICMP_MIN_TCP_HDR bytes of  TCP header drop the
5695 	 * packet.
5696 	 */
5697 	if ((*nexthdrp != IPPROTO_TCP) ||
5698 	    ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5699 		goto noticmpv6;
5700 	}
5701 
5702 	seg_seq = ntohl(tcpha->tha_seq);
5703 	switch (icmp6->icmp6_type) {
5704 	case ICMP6_PACKET_TOO_BIG:
5705 		/*
5706 		 * Update Path MTU, then try to send something out.
5707 		 */
5708 		tcp_update_pmtu(tcp, B_TRUE);
5709 		tcp_rexmit_after_error(tcp);
5710 		break;
5711 	case ICMP6_DST_UNREACH:
5712 		switch (icmp6->icmp6_code) {
5713 		case ICMP6_DST_UNREACH_NOPORT:
5714 			if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5715 			    (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5716 			    (seg_seq == tcp->tcp_iss)) {
5717 				(void) tcp_clean_death(tcp, ECONNREFUSED);
5718 			}
5719 			break;
5720 		case ICMP6_DST_UNREACH_ADMIN:
5721 		case ICMP6_DST_UNREACH_NOROUTE:
5722 		case ICMP6_DST_UNREACH_BEYONDSCOPE:
5723 		case ICMP6_DST_UNREACH_ADDR:
5724 			/* Record the error in case we finally time out. */
5725 			tcp->tcp_client_errno = EHOSTUNREACH;
5726 			if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5727 			    (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5728 			    (seg_seq == tcp->tcp_iss)) {
5729 				if (tcp->tcp_listener != NULL &&
5730 				    tcp->tcp_listener->tcp_syn_defense) {
5731 					/*
5732 					 * Ditch the half-open connection if we
5733 					 * suspect a SYN attack is under way.
5734 					 */
5735 					(void) tcp_clean_death(tcp,
5736 					    tcp->tcp_client_errno);
5737 				}
5738 			}
5739 
5740 
5741 			break;
5742 		default:
5743 			break;
5744 		}
5745 		break;
5746 	case ICMP6_PARAM_PROB:
5747 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5748 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5749 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5750 		    (uchar_t *)nexthdrp) {
5751 			if (tcp->tcp_state == TCPS_SYN_SENT ||
5752 			    tcp->tcp_state == TCPS_SYN_RCVD) {
5753 				(void) tcp_clean_death(tcp, ECONNREFUSED);
5754 			}
5755 			break;
5756 		}
5757 		break;
5758 
5759 	case ICMP6_TIME_EXCEEDED:
5760 	default:
5761 		break;
5762 	}
5763 	freemsg(mp);
5764 }
5765 
5766 /*
5767  * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5768  * change. But it can refer to fields like tcp_suna and tcp_snxt.
5769  *
5770  * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5771  * error messages received by IP. The message is always received on the correct
5772  * tcp_t.
5773  */
5774 /* ARGSUSED */
5775 boolean_t
5776 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5777     ip_recv_attr_t *ira)
5778 {
5779 	tcpha_t		*tcpha = (tcpha_t *)arg2;
5780 	uint32_t	seq = ntohl(tcpha->tha_seq);
5781 	tcp_t		*tcp = connp->conn_tcp;
5782 
5783 	/*
5784 	 * TCP sequence number contained in payload of the ICMP error message
5785 	 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5786 	 * the message is either a stale ICMP error, or an attack from the
5787 	 * network. Fail the verification.
5788 	 */
5789 	if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5790 		return (B_FALSE);
5791 
5792 	/* For "too big" we also check the ignore flag */
5793 	if (ira->ira_flags & IRAF_IS_IPV4) {
5794 		ASSERT(icmph != NULL);
5795 		if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5796 		    icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5797 		    tcp->tcp_tcps->tcps_ignore_path_mtu)
5798 			return (B_FALSE);
5799 	} else {
5800 		ASSERT(icmp6 != NULL);
5801 		if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5802 		    tcp->tcp_tcps->tcps_ignore_path_mtu)
5803 			return (B_FALSE);
5804 	}
5805 	return (B_TRUE);
5806 }
5807