xref: /titanic_51/usr/src/uts/common/inet/sctp/sctp.c (revision 65cf7c958eb9457cf2c83a853d128e4ecfc187a6)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #include <sys/types.h>
28 #include <sys/stream.h>
29 #include <sys/strsubr.h>
30 #include <sys/stropts.h>
31 #include <sys/strsun.h>
32 #define	_SUN_TPI_VERSION 2
33 #include <sys/tihdr.h>
34 #include <sys/ddi.h>
35 #include <sys/sunddi.h>
36 #include <sys/xti_inet.h>
37 #include <sys/cmn_err.h>
38 #include <sys/debug.h>
39 #include <sys/vtrace.h>
40 #include <sys/kmem.h>
41 #include <sys/cpuvar.h>
42 #include <sys/random.h>
43 #include <sys/priv.h>
44 #include <sys/sunldi.h>
45 
46 #include <sys/errno.h>
47 #include <sys/signal.h>
48 #include <sys/socket.h>
49 #include <sys/isa_defs.h>
50 #include <netinet/in.h>
51 #include <netinet/tcp.h>
52 #include <netinet/ip6.h>
53 #include <netinet/icmp6.h>
54 #include <netinet/sctp.h>
55 #include <net/if.h>
56 
57 #include <inet/common.h>
58 #include <inet/ip.h>
59 #include <inet/ip6.h>
60 #include <inet/mi.h>
61 #include <inet/mib2.h>
62 #include <inet/kstatcom.h>
63 #include <inet/nd.h>
64 #include <inet/optcom.h>
65 #include <inet/ipclassifier.h>
66 #include <inet/ipsec_impl.h>
67 #include <inet/sctp_ip.h>
68 #include <inet/sctp_crc32.h>
69 
70 #include "sctp_impl.h"
71 #include "sctp_addr.h"
72 #include "sctp_asconf.h"
73 
74 int sctpdebug;
75 sin6_t	sctp_sin6_null;	/* Zero address for quick clears */
76 
77 /*
78  * Have to ensure that sctp_g_q_close is not done by an
79  * interrupt thread.
80  */
81 static taskq_t *sctp_taskq;
82 
83 static void	sctp_closei_local(sctp_t *sctp);
84 static int	sctp_init_values(sctp_t *, sctp_t *, int);
85 static void	sctp_icmp_error_ipv6(sctp_t *sctp, mblk_t *mp);
86 static void	sctp_process_recvq(void *);
87 static void	sctp_rq_tq_init(sctp_stack_t *);
88 static void	sctp_rq_tq_fini(sctp_stack_t *);
89 static void	sctp_conn_cache_init();
90 static void	sctp_conn_cache_fini();
91 static int	sctp_conn_cache_constructor();
92 static void	sctp_conn_cache_destructor();
93 static void	sctp_conn_clear(conn_t *);
94 void		sctp_g_q_setup(sctp_stack_t *);
95 void		sctp_g_q_create(sctp_stack_t *);
96 void		sctp_g_q_destroy(sctp_stack_t *);
97 
98 static void	*sctp_stack_init(netstackid_t stackid, netstack_t *ns);
99 static void	sctp_stack_shutdown(netstackid_t stackid, void *arg);
100 static void	sctp_stack_fini(netstackid_t stackid, void *arg);
101 
102 /*
103  * SCTP receive queue taskq
104  *
105  * At SCTP initialization time, a default taskq is created for
106  * servicing packets received when the interrupt thread cannot
107  * get a hold on the sctp_t.  The number of taskq can be increased in
108  * sctp_find_next_tq() when an existing taskq cannot be dispatched.
109  * The taskqs are never removed.  But the max number of taskq which
110  * can be created is controlled by sctp_recvq_tq_list_max_sz.  Note
111  * that SCTP recvq taskq is not tied to any specific CPU or ill.
112  *
113  * Those taskqs are stored in an array recvq_tq_list.  And they are
114  * used in a round robin fashion.  The current taskq being used is
115  * determined by recvq_tq_list_cur.
116  */
117 
118 /* /etc/system variables */
119 /* The minimum number of threads for each taskq. */
120 int		sctp_recvq_tq_thr_min = 4;
121 /* The maximum number of threads for each taskq. */
122 int		sctp_recvq_tq_thr_max = 16;
123 /* The minimum number of tasks for each taskq. */
124 int		sctp_recvq_tq_task_min = 5;
125 /* The maxiimum number of tasks for each taskq. */
126 int		sctp_recvq_tq_task_max = 50;
127 
128 /*  sctp_t/conn_t kmem cache */
129 struct kmem_cache	*sctp_conn_cache;
130 
131 #define	SCTP_CONDEMNED(sctp)				\
132 	mutex_enter(&(sctp)->sctp_reflock);		\
133 	((sctp)->sctp_condemned = B_TRUE);		\
134 	mutex_exit(&(sctp)->sctp_reflock);
135 
136 /* Link/unlink a sctp_t to/from the global list. */
137 #define	SCTP_LINK(sctp, sctps)				\
138 	mutex_enter(&(sctps)->sctps_g_lock);		\
139 	list_insert_tail(&sctps->sctps_g_list, (sctp));	\
140 	mutex_exit(&(sctps)->sctps_g_lock);
141 
142 #define	SCTP_UNLINK(sctp, sctps)				\
143 	mutex_enter(&(sctps)->sctps_g_lock);		\
144 	ASSERT((sctp)->sctp_condemned);			\
145 	list_remove(&(sctps)->sctps_g_list, (sctp));	\
146 	mutex_exit(&(sctps)->sctps_g_lock);
147 
148 /*
149  * Hooks for Sun Cluster. On non-clustered nodes these will remain NULL.
150  * PSARC/2005/602.
151  */
152 void (*cl_sctp_listen)(sa_family_t, uchar_t *, uint_t, in_port_t) = NULL;
153 void (*cl_sctp_unlisten)(sa_family_t, uchar_t *, uint_t, in_port_t) = NULL;
154 void (*cl_sctp_connect)(sa_family_t, uchar_t *, uint_t, in_port_t,
155     uchar_t *, uint_t, in_port_t, boolean_t, cl_sctp_handle_t) = NULL;
156 void (*cl_sctp_disconnect)(sa_family_t, cl_sctp_handle_t) = NULL;
157 void (*cl_sctp_assoc_change)(sa_family_t, uchar_t *, size_t, uint_t,
158     uchar_t *, size_t, uint_t, int, cl_sctp_handle_t) = NULL;
159 void (*cl_sctp_check_addrs)(sa_family_t, in_port_t, uchar_t **, size_t,
160     uint_t *, boolean_t) = NULL;
161 /*
162  * Return the version number of the SCTP kernel interface.
163  */
164 int
165 sctp_itf_ver(int cl_ver)
166 {
167 	if (cl_ver != SCTP_ITF_VER)
168 		return (-1);
169 	return (SCTP_ITF_VER);
170 }
171 
172 /*
173  * Called when we need a new sctp instantiation but don't really have a
174  * new q to hang it off of. Copy the priv flag from the passed in structure.
175  */
176 sctp_t *
177 sctp_create_eager(sctp_t *psctp)
178 {
179 	sctp_t	*sctp;
180 	mblk_t	*ack_mp, *hb_mp;
181 	conn_t	*connp, *pconnp;
182 	cred_t *credp;
183 	sctp_stack_t	*sctps = psctp->sctp_sctps;
184 
185 	if ((connp = ipcl_conn_create(IPCL_SCTPCONN, KM_NOSLEEP,
186 	    sctps->sctps_netstack)) == NULL) {
187 		return (NULL);
188 	}
189 
190 	connp->conn_ulp_labeled = is_system_labeled();
191 
192 	sctp = CONN2SCTP(connp);
193 	sctp->sctp_sctps = sctps;
194 
195 	if ((ack_mp = sctp_timer_alloc(sctp, sctp_ack_timer,
196 	    KM_NOSLEEP)) == NULL ||
197 	    (hb_mp = sctp_timer_alloc(sctp, sctp_heartbeat_timer,
198 	    KM_NOSLEEP)) == NULL) {
199 		if (ack_mp != NULL)
200 			freeb(ack_mp);
201 		sctp_conn_clear(connp);
202 		sctp->sctp_sctps = NULL;
203 		SCTP_G_Q_REFRELE(sctps);
204 		kmem_cache_free(sctp_conn_cache, connp);
205 		return (NULL);
206 	}
207 
208 	sctp->sctp_ack_mp = ack_mp;
209 	sctp->sctp_heartbeat_mp = hb_mp;
210 
211 	/* Inherit information from the "parent" */
212 	sctp->sctp_ipversion = psctp->sctp_ipversion;
213 	sctp->sctp_family = psctp->sctp_family;
214 	pconnp = psctp->sctp_connp;
215 	connp->conn_af_isv6 = pconnp->conn_af_isv6;
216 	connp->conn_pkt_isv6 = pconnp->conn_pkt_isv6;
217 	connp->conn_ipv6_v6only = pconnp->conn_ipv6_v6only;
218 	if (sctp_init_values(sctp, psctp, KM_NOSLEEP) != 0) {
219 		freeb(ack_mp);
220 		freeb(hb_mp);
221 		sctp_conn_clear(connp);
222 		sctp->sctp_sctps = NULL;
223 		SCTP_G_Q_REFRELE(sctps);
224 		kmem_cache_free(sctp_conn_cache, connp);
225 		return (NULL);
226 	}
227 
228 	/*
229 	 * If the parent is multilevel, then we'll fix up the remote cred
230 	 * when we do sctp_accept_comm.
231 	 */
232 	if ((credp = pconnp->conn_cred) != NULL) {
233 		connp->conn_cred = credp;
234 		crhold(credp);
235 		/*
236 		 * If the caller has the process-wide flag set, then default to
237 		 * MAC exempt mode.  This allows read-down to unlabeled hosts.
238 		 */
239 		if (getpflags(NET_MAC_AWARE, credp) != 0)
240 			connp->conn_mac_exempt = B_TRUE;
241 	}
242 
243 	connp->conn_allzones = pconnp->conn_allzones;
244 	connp->conn_zoneid = pconnp->conn_zoneid;
245 
246 	sctp->sctp_mss = psctp->sctp_mss;
247 	sctp->sctp_detached = B_TRUE;
248 	/*
249 	 * Link to the global as soon as possible so that this sctp_t
250 	 * can be found.
251 	 */
252 	SCTP_LINK(sctp, sctps);
253 
254 	return (sctp);
255 }
256 
257 /*
258  * We are dying for some reason.  Try to do it gracefully.
259  */
260 void
261 sctp_clean_death(sctp_t *sctp, int err)
262 {
263 	ASSERT(sctp != NULL);
264 	ASSERT((sctp->sctp_family == AF_INET &&
265 	    sctp->sctp_ipversion == IPV4_VERSION) ||
266 	    (sctp->sctp_family == AF_INET6 &&
267 	    (sctp->sctp_ipversion == IPV4_VERSION ||
268 	    sctp->sctp_ipversion == IPV6_VERSION)));
269 
270 	dprint(3, ("sctp_clean_death %p, state %d\n", (void *)sctp,
271 	    sctp->sctp_state));
272 
273 	sctp->sctp_client_errno = err;
274 	/*
275 	 * Check to see if we need to notify upper layer.
276 	 */
277 	if ((sctp->sctp_state >= SCTPS_COOKIE_WAIT) &&
278 	    !SCTP_IS_DETACHED(sctp)) {
279 		if (sctp->sctp_xmit_head || sctp->sctp_xmit_unsent) {
280 			sctp_regift_xmitlist(sctp);
281 		}
282 		if (sctp->sctp_ulp_disconnected(sctp->sctp_ulpd, 0, err)) {
283 			/*
284 			 * Socket is gone, detach.
285 			 */
286 			sctp->sctp_detached = B_TRUE;
287 			sctp->sctp_ulpd = NULL;
288 			sctp->sctp_upcalls = NULL;
289 		}
290 	}
291 
292 	/* Remove this sctp from all hashes. */
293 	sctp_closei_local(sctp);
294 
295 	/*
296 	 * If the sctp_t is detached, we need to finish freeing up
297 	 * the resources.  At this point, ip_fanout_sctp() should have
298 	 * a hold on this sctp_t.  Some thread doing snmp stuff can
299 	 * have a hold.  And a taskq can also have a hold waiting to
300 	 * work.  sctp_unlink() the sctp_t from the global list so
301 	 * that no new thread can find it.  Then do a SCTP_REFRELE().
302 	 * The sctp_t will be freed after all those threads are done.
303 	 */
304 	if (SCTP_IS_DETACHED(sctp)) {
305 		SCTP_CONDEMNED(sctp);
306 		SCTP_REFRELE(sctp);
307 	}
308 }
309 
310 /*
311  * Called by upper layer when it wants to close this association.
312  * Depending on the state of this assoication, we need to do
313  * different things.
314  *
315  * If the state is below COOKIE_ECHOED or it is COOKIE_ECHOED but with
316  * no sent data, just remove this sctp from all the hashes.  This
317  * makes sure that all packets from the other end will go to the default
318  * sctp handling.  The upper layer will then do a sctp_close() to clean
319  * up.
320  *
321  * Otherwise, check and see if SO_LINGER is set.  If it is set, check
322  * the value.  If the value is 0, consider this an abortive close.  Send
323  * an ABORT message and kill the associatiion.
324  *
325  */
326 int
327 sctp_disconnect(sctp_t *sctp)
328 {
329 	int	error = 0;
330 
331 	dprint(3, ("sctp_disconnect %p, state %d\n", (void *)sctp,
332 	    sctp->sctp_state));
333 
334 	RUN_SCTP(sctp);
335 
336 	switch (sctp->sctp_state) {
337 	case SCTPS_IDLE:
338 	case SCTPS_BOUND:
339 	case SCTPS_LISTEN:
340 		break;
341 	case SCTPS_COOKIE_WAIT:
342 	case SCTPS_COOKIE_ECHOED:
343 		/*
344 		 * Close during the connect 3-way handshake
345 		 * but here there may or may not be pending data
346 		 * already on queue. Process almost same as in
347 		 * the ESTABLISHED state.
348 		 */
349 		if (sctp->sctp_xmit_head == NULL &&
350 		    sctp->sctp_xmit_unsent == NULL) {
351 			break;
352 		}
353 		/* FALLTHRU */
354 	default:
355 		/*
356 		 * If SO_LINGER has set a zero linger time, terminate the
357 		 * association and send an ABORT.
358 		 */
359 		if (sctp->sctp_linger && sctp->sctp_lingertime == 0) {
360 			sctp_user_abort(sctp, NULL);
361 			WAKE_SCTP(sctp);
362 			return (error);
363 		}
364 
365 		/*
366 		 * In there is unread data, send an ABORT and terminate the
367 		 * association.
368 		 */
369 		if (sctp->sctp_rxqueued > 0 || sctp->sctp_irwnd >
370 		    sctp->sctp_rwnd) {
371 			sctp_user_abort(sctp, NULL);
372 			WAKE_SCTP(sctp);
373 			return (error);
374 		}
375 		/*
376 		 * Transmit the shutdown before detaching the sctp_t.
377 		 * After sctp_detach returns this queue/perimeter
378 		 * no longer owns the sctp_t thus others can modify it.
379 		 */
380 		sctp_send_shutdown(sctp, 0);
381 
382 		/* Pass gathered wisdom to IP for keeping */
383 		sctp_update_ire(sctp);
384 
385 		/*
386 		 * If lingering on close then wait until the shutdown
387 		 * is complete, or the SO_LINGER time passes, or an
388 		 * ABORT is sent/received.  Note that sctp_disconnect()
389 		 * can be called more than once.  Make sure that only
390 		 * one thread waits.
391 		 */
392 		if (sctp->sctp_linger && sctp->sctp_lingertime > 0 &&
393 		    sctp->sctp_state >= SCTPS_ESTABLISHED &&
394 		    !sctp->sctp_lingering) {
395 			clock_t stoptime;	/* in ticks */
396 			clock_t ret;
397 
398 			/*
399 			 * Process the sendq to send the SHUTDOWN out
400 			 * before waiting.
401 			 */
402 			sctp_process_sendq(sctp);
403 
404 			sctp->sctp_lingering = 1;
405 			sctp->sctp_client_errno = 0;
406 			stoptime = lbolt + sctp->sctp_lingertime;
407 
408 			mutex_enter(&sctp->sctp_lock);
409 			sctp->sctp_running = B_FALSE;
410 			while (sctp->sctp_state >= SCTPS_ESTABLISHED &&
411 			    sctp->sctp_client_errno == 0) {
412 				cv_broadcast(&sctp->sctp_cv);
413 				ret = cv_timedwait_sig(&sctp->sctp_cv,
414 				    &sctp->sctp_lock, stoptime);
415 				if (ret < 0) {
416 					/* Stoptime has reached. */
417 					sctp->sctp_client_errno = EWOULDBLOCK;
418 					break;
419 				} else if (ret == 0) {
420 					/* Got a signal. */
421 					break;
422 				}
423 			}
424 			error = sctp->sctp_client_errno;
425 			sctp->sctp_client_errno = 0;
426 			mutex_exit(&sctp->sctp_lock);
427 		}
428 
429 		WAKE_SCTP(sctp);
430 		sctp_process_sendq(sctp);
431 		return (error);
432 	}
433 
434 
435 	/* Remove this sctp from all hashes so nobody can find it. */
436 	sctp_closei_local(sctp);
437 	WAKE_SCTP(sctp);
438 	return (error);
439 }
440 
441 void
442 sctp_close(sctp_t *sctp)
443 {
444 	dprint(3, ("sctp_close %p, state %d\n", (void *)sctp,
445 	    sctp->sctp_state));
446 
447 	RUN_SCTP(sctp);
448 	sctp->sctp_detached = 1;
449 	sctp->sctp_ulpd = NULL;
450 	sctp->sctp_upcalls = NULL;
451 	bzero(&sctp->sctp_events, sizeof (sctp->sctp_events));
452 
453 	/* If the graceful shutdown has not been completed, just return. */
454 	if (sctp->sctp_state != SCTPS_IDLE) {
455 		WAKE_SCTP(sctp);
456 		return;
457 	}
458 
459 	/*
460 	 * Since sctp_t is in SCTPS_IDLE state, so the only thread which
461 	 * can have a hold on the sctp_t is doing snmp stuff.  Just do
462 	 * a SCTP_REFRELE() here after the SCTP_UNLINK().  It will
463 	 * be freed when the other thread is done.
464 	 */
465 	SCTP_CONDEMNED(sctp);
466 	WAKE_SCTP(sctp);
467 	SCTP_REFRELE(sctp);
468 }
469 
470 /*
471  * Unlink from global list and do the eager close.
472  * Remove the refhold implicit in being on the global list.
473  */
474 void
475 sctp_close_eager(sctp_t *sctp)
476 {
477 	SCTP_CONDEMNED(sctp);
478 	sctp_closei_local(sctp);
479 	SCTP_REFRELE(sctp);
480 }
481 
482 /*
483  * The sctp_t is going away. Remove it from all lists and set it
484  * to SCTPS_IDLE. The caller has to remove it from the
485  * global list. The freeing up of memory is deferred until
486  * sctp_free(). This is needed since a thread in sctp_input() might have
487  * done a SCTP_REFHOLD on this structure before it was removed from the
488  * hashes.
489  */
490 static void
491 sctp_closei_local(sctp_t *sctp)
492 {
493 	mblk_t	*mp;
494 	ire_t	*ire = NULL;
495 	conn_t	*connp = sctp->sctp_connp;
496 
497 	/* Sanity check, don't do the same thing twice.  */
498 	if (connp->conn_state_flags & CONN_CLOSING) {
499 		ASSERT(sctp->sctp_state == SCTPS_IDLE);
500 		return;
501 	}
502 
503 	/* Stop and free the timers */
504 	sctp_free_faddr_timers(sctp);
505 	if ((mp = sctp->sctp_heartbeat_mp) != NULL) {
506 		sctp_timer_free(mp);
507 		sctp->sctp_heartbeat_mp = NULL;
508 	}
509 	if ((mp = sctp->sctp_ack_mp) != NULL) {
510 		sctp_timer_free(mp);
511 		sctp->sctp_ack_mp = NULL;
512 	}
513 
514 	/* Set the CONN_CLOSING flag so that IP will not cache IRE again. */
515 	mutex_enter(&connp->conn_lock);
516 	connp->conn_state_flags |= CONN_CLOSING;
517 	ire = connp->conn_ire_cache;
518 	connp->conn_ire_cache = NULL;
519 	mutex_exit(&connp->conn_lock);
520 	if (ire != NULL)
521 		IRE_REFRELE_NOTR(ire);
522 
523 	/* Remove from all hashes. */
524 	sctp_bind_hash_remove(sctp);
525 	sctp_conn_hash_remove(sctp);
526 	sctp_listen_hash_remove(sctp);
527 	sctp->sctp_state = SCTPS_IDLE;
528 
529 	/*
530 	 * Clean up the recvq as much as possible.  All those packets
531 	 * will be silently dropped as this sctp_t is now in idle state.
532 	 */
533 	mutex_enter(&sctp->sctp_recvq_lock);
534 	while ((mp = sctp->sctp_recvq) != NULL) {
535 		mblk_t *ipsec_mp;
536 
537 		sctp->sctp_recvq = mp->b_next;
538 		mp->b_next = NULL;
539 		if ((ipsec_mp = mp->b_prev) != NULL) {
540 			freeb(ipsec_mp);
541 			mp->b_prev = NULL;
542 		}
543 		freemsg(mp);
544 	}
545 	mutex_exit(&sctp->sctp_recvq_lock);
546 }
547 
548 /*
549  * Free memory associated with the sctp/ip header template.
550  */
551 static void
552 sctp_headers_free(sctp_t *sctp)
553 {
554 	if (sctp->sctp_iphc != NULL) {
555 		kmem_free(sctp->sctp_iphc, sctp->sctp_iphc_len);
556 		sctp->sctp_iphc = NULL;
557 		sctp->sctp_ipha = NULL;
558 		sctp->sctp_hdr_len = 0;
559 		sctp->sctp_ip_hdr_len = 0;
560 		sctp->sctp_iphc_len = 0;
561 		sctp->sctp_sctph = NULL;
562 		sctp->sctp_hdr_len = 0;
563 	}
564 	if (sctp->sctp_iphc6 != NULL) {
565 		kmem_free(sctp->sctp_iphc6, sctp->sctp_iphc6_len);
566 		sctp->sctp_iphc6 = NULL;
567 		sctp->sctp_ip6h = NULL;
568 		sctp->sctp_hdr6_len = 0;
569 		sctp->sctp_ip_hdr6_len = 0;
570 		sctp->sctp_iphc6_len = 0;
571 		sctp->sctp_sctph6 = NULL;
572 		sctp->sctp_hdr6_len = 0;
573 	}
574 }
575 
576 static void
577 sctp_free_xmit_data(sctp_t *sctp)
578 {
579 	mblk_t	*ump = NULL;
580 	mblk_t	*nump;
581 	mblk_t	*mp;
582 	mblk_t	*nmp;
583 
584 	sctp->sctp_xmit_unacked = NULL;
585 	ump = sctp->sctp_xmit_head;
586 	sctp->sctp_xmit_tail = sctp->sctp_xmit_head = NULL;
587 free_unsent:
588 	for (; ump != NULL; ump = nump) {
589 		for (mp = ump->b_cont; mp != NULL; mp = nmp) {
590 			nmp = mp->b_next;
591 			mp->b_next = NULL;
592 			mp->b_prev = NULL;
593 			freemsg(mp);
594 		}
595 		ASSERT(DB_REF(ump) == 1);
596 		nump = ump->b_next;
597 		ump->b_next = NULL;
598 		ump->b_prev = NULL;
599 		ump->b_cont = NULL;
600 		freeb(ump);
601 	}
602 	if ((ump = sctp->sctp_xmit_unsent) == NULL) {
603 		ASSERT(sctp->sctp_xmit_unsent_tail == NULL);
604 		return;
605 	}
606 	sctp->sctp_xmit_unsent = sctp->sctp_xmit_unsent_tail = NULL;
607 	goto free_unsent;
608 }
609 
610 /*
611  * Cleanup all the messages in the stream queue and the reassembly lists.
612  * If 'free' is true, then delete the streams as well.
613  */
614 void
615 sctp_instream_cleanup(sctp_t *sctp, boolean_t free)
616 {
617 	int	i;
618 	mblk_t	*mp;
619 	mblk_t	*mp1;
620 
621 	if (sctp->sctp_instr != NULL) {
622 		/* walk thru and flush out anything remaining in the Q */
623 		for (i = 0; i < sctp->sctp_num_istr; i++) {
624 			mp = sctp->sctp_instr[i].istr_msgs;
625 			while (mp != NULL) {
626 				mp1 = mp->b_next;
627 				mp->b_next = mp->b_prev = NULL;
628 				freemsg(mp);
629 				mp = mp1;
630 			}
631 			sctp->sctp_instr[i].istr_msgs = NULL;
632 			sctp->sctp_instr[i].istr_nmsgs = 0;
633 			sctp_free_reass((sctp->sctp_instr) + i);
634 			sctp->sctp_instr[i].nextseq = 0;
635 		}
636 		if (free) {
637 			kmem_free(sctp->sctp_instr,
638 			    sizeof (*sctp->sctp_instr) * sctp->sctp_num_istr);
639 			sctp->sctp_instr = NULL;
640 			sctp->sctp_num_istr = 0;
641 		}
642 	}
643 	/* un-ordered fragments */
644 	if (sctp->sctp_uo_frags != NULL) {
645 		for (mp = sctp->sctp_uo_frags; mp != NULL; mp = mp1) {
646 			mp1 = mp->b_next;
647 			mp->b_next = mp->b_prev = NULL;
648 			freemsg(mp);
649 		}
650 	}
651 }
652 
653 /*
654  * Last reference to the sctp_t is gone. Free all memory associated with it.
655  * Called from SCTP_REFRELE. Called inline in sctp_close()
656  */
657 void
658 sctp_free(conn_t *connp)
659 {
660 	sctp_t *sctp = CONN2SCTP(connp);
661 	int		cnt;
662 	sctp_stack_t	*sctps = sctp->sctp_sctps;
663 
664 	ASSERT(sctps != NULL);
665 	/* Unlink it from the global list */
666 	SCTP_UNLINK(sctp, sctps);
667 
668 	ASSERT(connp->conn_ref == 0);
669 	ASSERT(connp->conn_ulp == IPPROTO_SCTP);
670 	ASSERT(!MUTEX_HELD(&sctp->sctp_reflock));
671 	ASSERT(sctp->sctp_refcnt == 0);
672 
673 	ASSERT(sctp->sctp_ptpbhn == NULL && sctp->sctp_bind_hash == NULL);
674 	ASSERT(sctp->sctp_conn_hash_next == NULL &&
675 	    sctp->sctp_conn_hash_prev == NULL);
676 
677 
678 	/* Free up all the resources. */
679 
680 	/* blow away sctp stream management */
681 	if (sctp->sctp_ostrcntrs != NULL) {
682 		kmem_free(sctp->sctp_ostrcntrs,
683 		    sizeof (uint16_t) * sctp->sctp_num_ostr);
684 		sctp->sctp_ostrcntrs = NULL;
685 	}
686 	sctp_instream_cleanup(sctp, B_TRUE);
687 
688 	/* Remove all data transfer resources. */
689 	sctp->sctp_istr_nmsgs = 0;
690 	sctp->sctp_rxqueued = 0;
691 	sctp_free_xmit_data(sctp);
692 	sctp->sctp_unacked = 0;
693 	sctp->sctp_unsent = 0;
694 	if (sctp->sctp_cxmit_list != NULL)
695 		sctp_asconf_free_cxmit(sctp, NULL);
696 
697 	sctp->sctp_lastdata = NULL;
698 
699 	/* Clear out default xmit settings */
700 	sctp->sctp_def_stream = 0;
701 	sctp->sctp_def_flags = 0;
702 	sctp->sctp_def_ppid = 0;
703 	sctp->sctp_def_context = 0;
704 	sctp->sctp_def_timetolive = 0;
705 
706 	if (sctp->sctp_sack_info != NULL) {
707 		sctp_free_set(sctp->sctp_sack_info);
708 		sctp->sctp_sack_info = NULL;
709 	}
710 	sctp->sctp_sack_gaps = 0;
711 
712 	if (sctp->sctp_cookie_mp != NULL) {
713 		freemsg(sctp->sctp_cookie_mp);
714 		sctp->sctp_cookie_mp = NULL;
715 	}
716 
717 	/* Remove all the address resources. */
718 	sctp_zap_addrs(sctp);
719 	for (cnt = 0; cnt < SCTP_IPIF_HASH; cnt++) {
720 		ASSERT(sctp->sctp_saddrs[cnt].ipif_count == 0);
721 		list_destroy(&sctp->sctp_saddrs[cnt].sctp_ipif_list);
722 	}
723 
724 	ip6_pkt_free(&sctp->sctp_sticky_ipp);
725 
726 	if (sctp->sctp_hopopts != NULL) {
727 		mi_free(sctp->sctp_hopopts);
728 		sctp->sctp_hopopts = NULL;
729 		sctp->sctp_hopoptslen = 0;
730 	}
731 	ASSERT(sctp->sctp_hopoptslen == 0);
732 	if (sctp->sctp_dstopts != NULL) {
733 		mi_free(sctp->sctp_dstopts);
734 		sctp->sctp_dstopts = NULL;
735 		sctp->sctp_dstoptslen = 0;
736 	}
737 	ASSERT(sctp->sctp_dstoptslen == 0);
738 	if (sctp->sctp_rtdstopts != NULL) {
739 		mi_free(sctp->sctp_rtdstopts);
740 		sctp->sctp_rtdstopts = NULL;
741 		sctp->sctp_rtdstoptslen = 0;
742 	}
743 	ASSERT(sctp->sctp_rtdstoptslen == 0);
744 	if (sctp->sctp_rthdr != NULL) {
745 		mi_free(sctp->sctp_rthdr);
746 		sctp->sctp_rthdr = NULL;
747 		sctp->sctp_rthdrlen = 0;
748 	}
749 	ASSERT(sctp->sctp_rthdrlen == 0);
750 	sctp_headers_free(sctp);
751 
752 	sctp->sctp_shutdown_faddr = NULL;
753 
754 	if (sctp->sctp_err_chunks != NULL) {
755 		freemsg(sctp->sctp_err_chunks);
756 		sctp->sctp_err_chunks = NULL;
757 		sctp->sctp_err_len = 0;
758 	}
759 
760 	/* Clear all the bitfields. */
761 	bzero(&sctp->sctp_bits, sizeof (sctp->sctp_bits));
762 
763 	/* It is time to update the global statistics. */
764 	UPDATE_MIB(&sctps->sctps_mib, sctpOutSCTPPkts, sctp->sctp_opkts);
765 	UPDATE_MIB(&sctps->sctps_mib, sctpOutCtrlChunks, sctp->sctp_obchunks);
766 	UPDATE_MIB(&sctps->sctps_mib, sctpOutOrderChunks, sctp->sctp_odchunks);
767 	UPDATE_MIB(&sctps->sctps_mib,
768 	    sctpOutUnorderChunks, sctp->sctp_oudchunks);
769 	UPDATE_MIB(&sctps->sctps_mib, sctpRetransChunks, sctp->sctp_rxtchunks);
770 	UPDATE_MIB(&sctps->sctps_mib, sctpInSCTPPkts, sctp->sctp_ipkts);
771 	UPDATE_MIB(&sctps->sctps_mib, sctpInCtrlChunks, sctp->sctp_ibchunks);
772 	UPDATE_MIB(&sctps->sctps_mib, sctpInOrderChunks, sctp->sctp_idchunks);
773 	UPDATE_MIB(&sctps->sctps_mib,
774 	    sctpInUnorderChunks, sctp->sctp_iudchunks);
775 	UPDATE_MIB(&sctps->sctps_mib, sctpFragUsrMsgs, sctp->sctp_fragdmsgs);
776 	UPDATE_MIB(&sctps->sctps_mib, sctpReasmUsrMsgs, sctp->sctp_reassmsgs);
777 	sctp->sctp_opkts = 0;
778 	sctp->sctp_obchunks = 0;
779 	sctp->sctp_odchunks = 0;
780 	sctp->sctp_oudchunks = 0;
781 	sctp->sctp_rxtchunks = 0;
782 	sctp->sctp_ipkts = 0;
783 	sctp->sctp_ibchunks = 0;
784 	sctp->sctp_idchunks = 0;
785 	sctp->sctp_iudchunks = 0;
786 	sctp->sctp_fragdmsgs = 0;
787 	sctp->sctp_reassmsgs = 0;
788 
789 	sctp->sctp_autoclose = 0;
790 	sctp->sctp_tx_adaptation_code = 0;
791 
792 	sctp->sctp_v6label_len = 0;
793 	sctp->sctp_v4label_len = 0;
794 
795 	/* Every sctp_t holds one reference on the default queue */
796 	sctp->sctp_sctps = NULL;
797 	SCTP_G_Q_REFRELE(sctps);
798 
799 	sctp_conn_clear(connp);
800 	kmem_cache_free(sctp_conn_cache, connp);
801 }
802 
803 /* Diagnostic routine used to return a string associated with the sctp state. */
804 char *
805 sctp_display(sctp_t *sctp, char *sup_buf)
806 {
807 	char	*buf;
808 	char	buf1[30];
809 	static char	priv_buf[INET6_ADDRSTRLEN * 2 + 80];
810 	char	*cp;
811 
812 	if (sctp == NULL)
813 		return ("NULL_SCTP");
814 
815 	buf = (sup_buf != NULL) ? sup_buf : priv_buf;
816 
817 	switch (sctp->sctp_state) {
818 	case SCTPS_IDLE:
819 		cp = "SCTP_IDLE";
820 		break;
821 	case SCTPS_BOUND:
822 		cp = "SCTP_BOUND";
823 		break;
824 	case SCTPS_LISTEN:
825 		cp = "SCTP_LISTEN";
826 		break;
827 	case SCTPS_COOKIE_WAIT:
828 		cp = "SCTP_COOKIE_WAIT";
829 		break;
830 	case SCTPS_COOKIE_ECHOED:
831 		cp = "SCTP_COOKIE_ECHOED";
832 		break;
833 	case SCTPS_ESTABLISHED:
834 		cp = "SCTP_ESTABLISHED";
835 		break;
836 	case SCTPS_SHUTDOWN_PENDING:
837 		cp = "SCTP_SHUTDOWN_PENDING";
838 		break;
839 	case SCTPS_SHUTDOWN_SENT:
840 		cp = "SCTPS_SHUTDOWN_SENT";
841 		break;
842 	case SCTPS_SHUTDOWN_RECEIVED:
843 		cp = "SCTPS_SHUTDOWN_RECEIVED";
844 		break;
845 	case SCTPS_SHUTDOWN_ACK_SENT:
846 		cp = "SCTPS_SHUTDOWN_ACK_SENT";
847 		break;
848 	default:
849 		(void) mi_sprintf(buf1, "SCTPUnkState(%d)", sctp->sctp_state);
850 		cp = buf1;
851 		break;
852 	}
853 	(void) mi_sprintf(buf, "[%u, %u] %s",
854 	    ntohs(sctp->sctp_lport), ntohs(sctp->sctp_fport), cp);
855 
856 	return (buf);
857 }
858 
859 /*
860  * Initialize protocol control block. If a parent exists, inherit
861  * all values set through setsockopt().
862  */
863 static int
864 sctp_init_values(sctp_t *sctp, sctp_t *psctp, int sleep)
865 {
866 	int	err;
867 	int	cnt;
868 	sctp_stack_t	*sctps = sctp->sctp_sctps;
869 	conn_t 	*connp, *pconnp;
870 
871 	ASSERT((sctp->sctp_family == AF_INET &&
872 	    sctp->sctp_ipversion == IPV4_VERSION) ||
873 	    (sctp->sctp_family == AF_INET6 &&
874 	    (sctp->sctp_ipversion == IPV4_VERSION ||
875 	    sctp->sctp_ipversion == IPV6_VERSION)));
876 
877 	sctp->sctp_nsaddrs = 0;
878 	for (cnt = 0; cnt < SCTP_IPIF_HASH; cnt++) {
879 		sctp->sctp_saddrs[cnt].ipif_count = 0;
880 		list_create(&sctp->sctp_saddrs[cnt].sctp_ipif_list,
881 		    sizeof (sctp_saddr_ipif_t), offsetof(sctp_saddr_ipif_t,
882 		    saddr_ipif));
883 	}
884 	sctp->sctp_ports = 0;
885 	sctp->sctp_running = B_FALSE;
886 	sctp->sctp_state = SCTPS_IDLE;
887 
888 	sctp->sctp_refcnt = 1;
889 
890 	sctp->sctp_strikes = 0;
891 
892 	sctp->sctp_last_mtu_probe = lbolt64;
893 	sctp->sctp_mtu_probe_intvl = sctps->sctps_mtu_probe_interval;
894 
895 	sctp->sctp_sack_gaps = 0;
896 	sctp->sctp_sack_toggle = 2;
897 
898 	/* Only need to do the allocation if there is no "cached" one. */
899 	if (sctp->sctp_pad_mp == NULL) {
900 		if (sleep == KM_SLEEP) {
901 			sctp->sctp_pad_mp = allocb_wait(SCTP_ALIGN, BPRI_MED,
902 			    STR_NOSIG, NULL);
903 		} else {
904 			sctp->sctp_pad_mp = allocb(SCTP_ALIGN, BPRI_MED);
905 			if (sctp->sctp_pad_mp == NULL)
906 				return (ENOMEM);
907 		}
908 		bzero(sctp->sctp_pad_mp->b_rptr, SCTP_ALIGN);
909 	}
910 
911 	if (psctp != NULL) {
912 		/*
913 		 * Inherit from parent
914 		 */
915 		sctp->sctp_iphc = kmem_zalloc(psctp->sctp_iphc_len, sleep);
916 		if (sctp->sctp_iphc == NULL) {
917 			sctp->sctp_iphc_len = 0;
918 			err = ENOMEM;
919 			goto failure;
920 		}
921 		sctp->sctp_iphc_len = psctp->sctp_iphc_len;
922 		sctp->sctp_hdr_len = psctp->sctp_hdr_len;
923 
924 		sctp->sctp_iphc6 = kmem_zalloc(psctp->sctp_iphc6_len, sleep);
925 		if (sctp->sctp_iphc6 == NULL) {
926 			sctp->sctp_iphc6_len = 0;
927 			err = ENOMEM;
928 			goto failure;
929 		}
930 		sctp->sctp_iphc6_len = psctp->sctp_iphc6_len;
931 		sctp->sctp_hdr6_len = psctp->sctp_hdr6_len;
932 
933 		sctp->sctp_ip_hdr_len = psctp->sctp_ip_hdr_len;
934 		sctp->sctp_ip_hdr6_len = psctp->sctp_ip_hdr6_len;
935 
936 		/*
937 		 * Copy the IP+SCTP header templates from listener
938 		 */
939 		bcopy(psctp->sctp_iphc, sctp->sctp_iphc,
940 		    psctp->sctp_hdr_len);
941 		sctp->sctp_ipha = (ipha_t *)sctp->sctp_iphc;
942 		sctp->sctp_sctph = (sctp_hdr_t *)(sctp->sctp_iphc +
943 		    sctp->sctp_ip_hdr_len);
944 
945 		bcopy(psctp->sctp_iphc6, sctp->sctp_iphc6,
946 		    psctp->sctp_hdr6_len);
947 		if (((ip6i_t *)(sctp->sctp_iphc6))->ip6i_nxt == IPPROTO_RAW) {
948 			sctp->sctp_ip6h = (ip6_t *)(sctp->sctp_iphc6 +
949 			    sizeof (ip6i_t));
950 		} else {
951 			sctp->sctp_ip6h = (ip6_t *)sctp->sctp_iphc6;
952 		}
953 		sctp->sctp_sctph6 = (sctp_hdr_t *)(sctp->sctp_iphc6 +
954 		    sctp->sctp_ip_hdr6_len);
955 
956 		sctp->sctp_cookie_lifetime = psctp->sctp_cookie_lifetime;
957 		sctp->sctp_xmit_lowater = psctp->sctp_xmit_lowater;
958 		sctp->sctp_xmit_hiwater = psctp->sctp_xmit_hiwater;
959 		sctp->sctp_cwnd_max = psctp->sctp_cwnd_max;
960 		sctp->sctp_rwnd = psctp->sctp_rwnd;
961 		sctp->sctp_irwnd = psctp->sctp_rwnd;
962 		sctp->sctp_pd_point = psctp->sctp_pd_point;
963 		sctp->sctp_rto_max = psctp->sctp_rto_max;
964 		sctp->sctp_init_rto_max = psctp->sctp_init_rto_max;
965 		sctp->sctp_rto_min = psctp->sctp_rto_min;
966 		sctp->sctp_rto_initial = psctp->sctp_rto_initial;
967 		sctp->sctp_pa_max_rxt = psctp->sctp_pa_max_rxt;
968 		sctp->sctp_pp_max_rxt = psctp->sctp_pp_max_rxt;
969 		sctp->sctp_max_init_rxt = psctp->sctp_max_init_rxt;
970 
971 		sctp->sctp_def_stream = psctp->sctp_def_stream;
972 		sctp->sctp_def_flags = psctp->sctp_def_flags;
973 		sctp->sctp_def_ppid = psctp->sctp_def_ppid;
974 		sctp->sctp_def_context = psctp->sctp_def_context;
975 		sctp->sctp_def_timetolive = psctp->sctp_def_timetolive;
976 
977 		sctp->sctp_num_istr = psctp->sctp_num_istr;
978 		sctp->sctp_num_ostr = psctp->sctp_num_ostr;
979 
980 		sctp->sctp_hb_interval = psctp->sctp_hb_interval;
981 		sctp->sctp_autoclose = psctp->sctp_autoclose;
982 		sctp->sctp_tx_adaptation_code = psctp->sctp_tx_adaptation_code;
983 
984 		/* xxx should be a better way to copy these flags xxx */
985 		sctp->sctp_debug = psctp->sctp_debug;
986 		sctp->sctp_bound_to_all = psctp->sctp_bound_to_all;
987 		sctp->sctp_cansleep = psctp->sctp_cansleep;
988 		sctp->sctp_send_adaptation = psctp->sctp_send_adaptation;
989 		sctp->sctp_ndelay = psctp->sctp_ndelay;
990 		sctp->sctp_events = psctp->sctp_events;
991 		sctp->sctp_ipv6_recvancillary = psctp->sctp_ipv6_recvancillary;
992 
993 		/* Copy IP-layer options */
994 		connp = sctp->sctp_connp;
995 		pconnp = psctp->sctp_connp;
996 
997 		connp->conn_broadcast = pconnp->conn_broadcast;
998 		connp->conn_loopback = pconnp->conn_loopback;
999 		connp->conn_dontroute = pconnp->conn_dontroute;
1000 		connp->conn_reuseaddr = pconnp->conn_reuseaddr;
1001 
1002 	} else {
1003 		/*
1004 		 * Initialize the header template
1005 		 */
1006 		if ((err = sctp_header_init_ipv4(sctp, sleep)) != 0) {
1007 			goto failure;
1008 		}
1009 		if ((err = sctp_header_init_ipv6(sctp, sleep)) != 0) {
1010 			goto failure;
1011 		}
1012 
1013 		/*
1014 		 * Set to system defaults
1015 		 */
1016 		sctp->sctp_cookie_lifetime =
1017 		    MSEC_TO_TICK(sctps->sctps_cookie_life);
1018 		sctp->sctp_xmit_lowater = sctps->sctps_xmit_lowat;
1019 		sctp->sctp_xmit_hiwater = sctps->sctps_xmit_hiwat;
1020 		sctp->sctp_cwnd_max = sctps->sctps_cwnd_max_;
1021 		sctp->sctp_rwnd = sctps->sctps_recv_hiwat;
1022 		sctp->sctp_irwnd = sctp->sctp_rwnd;
1023 		sctp->sctp_pd_point = sctp->sctp_rwnd;
1024 		sctp->sctp_rto_max = MSEC_TO_TICK(sctps->sctps_rto_maxg);
1025 		sctp->sctp_init_rto_max = sctp->sctp_rto_max;
1026 		sctp->sctp_rto_min = MSEC_TO_TICK(sctps->sctps_rto_ming);
1027 		sctp->sctp_rto_initial = MSEC_TO_TICK(
1028 		    sctps->sctps_rto_initialg);
1029 		sctp->sctp_pa_max_rxt = sctps->sctps_pa_max_retr;
1030 		sctp->sctp_pp_max_rxt = sctps->sctps_pp_max_retr;
1031 		sctp->sctp_max_init_rxt = sctps->sctps_max_init_retr;
1032 
1033 		sctp->sctp_num_istr = sctps->sctps_max_in_streams;
1034 		sctp->sctp_num_ostr = sctps->sctps_initial_out_streams;
1035 
1036 		sctp->sctp_hb_interval =
1037 		    MSEC_TO_TICK(sctps->sctps_heartbeat_interval);
1038 	}
1039 	sctp->sctp_understands_asconf = B_TRUE;
1040 	sctp->sctp_understands_addip = B_TRUE;
1041 	sctp->sctp_prsctp_aware = B_FALSE;
1042 
1043 	sctp->sctp_connp->conn_ref = 1;
1044 	sctp->sctp_connp->conn_fully_bound = B_FALSE;
1045 
1046 	sctp->sctp_prsctpdrop = 0;
1047 	sctp->sctp_msgcount = 0;
1048 
1049 	return (0);
1050 
1051 failure:
1052 	if (sctp->sctp_iphc != NULL) {
1053 		kmem_free(sctp->sctp_iphc, sctp->sctp_iphc_len);
1054 		sctp->sctp_iphc = NULL;
1055 	}
1056 	if (sctp->sctp_iphc6 != NULL) {
1057 		kmem_free(sctp->sctp_iphc6, sctp->sctp_iphc6_len);
1058 		sctp->sctp_iphc6 = NULL;
1059 	}
1060 	return (err);
1061 }
1062 
1063 /*
1064  * Extracts the init tag from an INIT chunk and checks if it matches
1065  * the sctp's verification tag. Returns 0 if it doesn't match, 1 if
1066  * it does.
1067  */
1068 static boolean_t
1069 sctp_icmp_verf(sctp_t *sctp, sctp_hdr_t *sh, mblk_t *mp)
1070 {
1071 	sctp_chunk_hdr_t *sch;
1072 	uint32_t verf, *vp;
1073 
1074 	sch = (sctp_chunk_hdr_t *)(sh + 1);
1075 	vp = (uint32_t *)(sch + 1);
1076 
1077 	/* Need at least the data chunk hdr and the first 4 bytes of INIT */
1078 	if ((unsigned char *)(vp + 1) > mp->b_wptr) {
1079 		return (B_FALSE);
1080 	}
1081 
1082 	bcopy(vp, &verf, sizeof (verf));
1083 
1084 	if (verf == sctp->sctp_lvtag) {
1085 		return (B_TRUE);
1086 	}
1087 	return (B_FALSE);
1088 }
1089 
1090 /*
1091  * sctp_icmp_error is called by sctp_input() to process ICMP error messages
1092  * passed up by IP.  The queue is the default queue.  We need to find a sctp_t
1093  * that corresponds to the returned datagram.  Passes the message back in on
1094  * the correct queue once it has located the connection.
1095  * Assumes that IP has pulled up everything up to and including
1096  * the ICMP header.
1097  */
1098 void
1099 sctp_icmp_error(sctp_t *sctp, mblk_t *mp)
1100 {
1101 	icmph_t *icmph;
1102 	ipha_t	*ipha;
1103 	int	iph_hdr_length;
1104 	sctp_hdr_t *sctph;
1105 	mblk_t *first_mp;
1106 	uint32_t new_mtu;
1107 	in6_addr_t dst;
1108 	sctp_faddr_t *fp;
1109 	sctp_stack_t	*sctps = sctp->sctp_sctps;
1110 
1111 	dprint(1, ("sctp_icmp_error: sctp=%p, mp=%p\n", (void *)sctp,
1112 	    (void *)mp));
1113 
1114 	first_mp = mp;
1115 
1116 	ipha = (ipha_t *)mp->b_rptr;
1117 	if (IPH_HDR_VERSION(ipha) != IPV4_VERSION) {
1118 		ASSERT(IPH_HDR_VERSION(ipha) == IPV6_VERSION);
1119 		sctp_icmp_error_ipv6(sctp, first_mp);
1120 		return;
1121 	}
1122 
1123 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1124 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
1125 	ipha = (ipha_t *)&icmph[1];
1126 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
1127 	sctph = (sctp_hdr_t *)((char *)ipha + iph_hdr_length);
1128 	if ((uchar_t *)(sctph + 1) >= mp->b_wptr) {
1129 		/* not enough data for SCTP header */
1130 		freemsg(first_mp);
1131 		return;
1132 	}
1133 
1134 	switch (icmph->icmph_type) {
1135 	case ICMP_DEST_UNREACHABLE:
1136 		switch (icmph->icmph_code) {
1137 		case ICMP_FRAGMENTATION_NEEDED:
1138 			/*
1139 			 * Reduce the MSS based on the new MTU.  This will
1140 			 * eliminate any fragmentation locally.
1141 			 * N.B.  There may well be some funny side-effects on
1142 			 * the local send policy and the remote receive policy.
1143 			 * Pending further research, we provide
1144 			 * sctp_ignore_path_mtu just in case this proves
1145 			 * disastrous somewhere.
1146 			 *
1147 			 * After updating the MSS, retransmit part of the
1148 			 * dropped segment using the new mss by calling
1149 			 * sctp_wput_slow().  Need to adjust all those
1150 			 * params to make sure sctp_wput_slow() work properly.
1151 			 */
1152 			if (sctps->sctps_ignore_path_mtu)
1153 				break;
1154 
1155 			/* find the offending faddr */
1156 			IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &dst);
1157 			fp = sctp_lookup_faddr(sctp, &dst);
1158 			if (fp == NULL) {
1159 				break;
1160 			}
1161 
1162 			new_mtu = ntohs(icmph->icmph_du_mtu);
1163 
1164 			if (new_mtu - sctp->sctp_hdr_len >= fp->sfa_pmss)
1165 				break;
1166 
1167 			/*
1168 			 * Make sure that sfa_pmss is a multiple of
1169 			 * SCTP_ALIGN.
1170 			 */
1171 			fp->sfa_pmss = (new_mtu - sctp->sctp_hdr_len) &
1172 			    ~(SCTP_ALIGN - 1);
1173 			fp->pmtu_discovered = 1;
1174 
1175 			break;
1176 		case ICMP_PORT_UNREACHABLE:
1177 		case ICMP_PROTOCOL_UNREACHABLE:
1178 			switch (sctp->sctp_state) {
1179 			case SCTPS_COOKIE_WAIT:
1180 			case SCTPS_COOKIE_ECHOED:
1181 				/* make sure the verification tag matches */
1182 				if (!sctp_icmp_verf(sctp, sctph, mp)) {
1183 					break;
1184 				}
1185 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1186 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1187 				    NULL);
1188 				sctp_clean_death(sctp, ECONNREFUSED);
1189 				break;
1190 			}
1191 			break;
1192 		case ICMP_HOST_UNREACHABLE:
1193 		case ICMP_NET_UNREACHABLE:
1194 			/* Record the error in case we finally time out. */
1195 			sctp->sctp_client_errno = (icmph->icmph_code ==
1196 			    ICMP_HOST_UNREACHABLE) ? EHOSTUNREACH : ENETUNREACH;
1197 			break;
1198 		default:
1199 			break;
1200 		}
1201 		break;
1202 	case ICMP_SOURCE_QUENCH: {
1203 		/* Reduce the sending rate as if we got a retransmit timeout */
1204 		break;
1205 	}
1206 	}
1207 	freemsg(first_mp);
1208 }
1209 
1210 /*
1211  * sctp_icmp_error_ipv6() is called by sctp_icmp_error() to process ICMPv6
1212  * error messages passed up by IP.
1213  * Assumes that IP has pulled up all the extension headers as well
1214  * as the ICMPv6 header.
1215  */
1216 static void
1217 sctp_icmp_error_ipv6(sctp_t *sctp, mblk_t *mp)
1218 {
1219 	icmp6_t *icmp6;
1220 	ip6_t	*ip6h;
1221 	uint16_t	iph_hdr_length;
1222 	sctp_hdr_t *sctpha;
1223 	uint8_t	*nexthdrp;
1224 	uint32_t new_mtu;
1225 	sctp_faddr_t *fp;
1226 	sctp_stack_t	*sctps = sctp->sctp_sctps;
1227 
1228 	ip6h = (ip6_t *)mp->b_rptr;
1229 	iph_hdr_length = (ip6h->ip6_nxt != IPPROTO_SCTP) ?
1230 	    ip_hdr_length_v6(mp, ip6h) : IPV6_HDR_LEN;
1231 
1232 	icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
1233 	ip6h = (ip6_t *)&icmp6[1];
1234 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) {
1235 		freemsg(mp);
1236 		return;
1237 	}
1238 	ASSERT(*nexthdrp == IPPROTO_SCTP);
1239 
1240 	/* XXX need ifindex to find connection */
1241 	sctpha = (sctp_hdr_t *)((char *)ip6h + iph_hdr_length);
1242 	if ((uchar_t *)sctpha >= mp->b_wptr) {
1243 		/* not enough data for SCTP header */
1244 		freemsg(mp);
1245 		return;
1246 	}
1247 	switch (icmp6->icmp6_type) {
1248 	case ICMP6_PACKET_TOO_BIG:
1249 		/*
1250 		 * Reduce the MSS based on the new MTU.  This will
1251 		 * eliminate any fragmentation locally.
1252 		 * N.B.  There may well be some funny side-effects on
1253 		 * the local send policy and the remote receive policy.
1254 		 * Pending further research, we provide
1255 		 * sctp_ignore_path_mtu just in case this proves
1256 		 * disastrous somewhere.
1257 		 *
1258 		 * After updating the MSS, retransmit part of the
1259 		 * dropped segment using the new mss by calling
1260 		 * sctp_wput_slow().  Need to adjust all those
1261 		 * params to make sure sctp_wput_slow() work properly.
1262 		 */
1263 		if (sctps->sctps_ignore_path_mtu)
1264 			break;
1265 
1266 		/* find the offending faddr */
1267 		fp = sctp_lookup_faddr(sctp, &ip6h->ip6_dst);
1268 		if (fp == NULL) {
1269 			break;
1270 		}
1271 
1272 		new_mtu = ntohs(icmp6->icmp6_mtu);
1273 
1274 		if (new_mtu - sctp->sctp_hdr6_len >= fp->sfa_pmss)
1275 			break;
1276 
1277 		/* Make sure that sfa_pmss is a multiple of SCTP_ALIGN. */
1278 		fp->sfa_pmss = (new_mtu - sctp->sctp_hdr6_len) &
1279 		    ~(SCTP_ALIGN - 1);
1280 		fp->pmtu_discovered = 1;
1281 
1282 		break;
1283 
1284 	case ICMP6_DST_UNREACH:
1285 		switch (icmp6->icmp6_code) {
1286 		case ICMP6_DST_UNREACH_NOPORT:
1287 			/* make sure the verification tag matches */
1288 			if (!sctp_icmp_verf(sctp, sctpha, mp)) {
1289 				break;
1290 			}
1291 			if (sctp->sctp_state == SCTPS_COOKIE_WAIT ||
1292 			    sctp->sctp_state == SCTPS_COOKIE_ECHOED) {
1293 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1294 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1295 				    NULL);
1296 				sctp_clean_death(sctp, ECONNREFUSED);
1297 			}
1298 			break;
1299 
1300 		case ICMP6_DST_UNREACH_ADMIN:
1301 		case ICMP6_DST_UNREACH_NOROUTE:
1302 		case ICMP6_DST_UNREACH_NOTNEIGHBOR:
1303 		case ICMP6_DST_UNREACH_ADDR:
1304 			/* Record the error in case we finally time out. */
1305 			sctp->sctp_client_errno = EHOSTUNREACH;
1306 			break;
1307 		default:
1308 			break;
1309 		}
1310 		break;
1311 
1312 	case ICMP6_PARAM_PROB:
1313 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
1314 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
1315 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
1316 		    (uchar_t *)nexthdrp) {
1317 			/* make sure the verification tag matches */
1318 			if (!sctp_icmp_verf(sctp, sctpha, mp)) {
1319 				break;
1320 			}
1321 			if (sctp->sctp_state == SCTPS_COOKIE_WAIT) {
1322 				BUMP_MIB(&sctps->sctps_mib, sctpAborted);
1323 				sctp_assoc_event(sctp, SCTP_CANT_STR_ASSOC, 0,
1324 				    NULL);
1325 				sctp_clean_death(sctp, ECONNREFUSED);
1326 			}
1327 			break;
1328 		}
1329 		break;
1330 
1331 	case ICMP6_TIME_EXCEEDED:
1332 	default:
1333 		break;
1334 	}
1335 	freemsg(mp);
1336 }
1337 
1338 /*
1339  * Called by sockfs to create a new sctp instance.
1340  *
1341  * If parent pointer is passed in, inherit settings from it.
1342  */
1343 sctp_t *
1344 sctp_create(void *ulpd, sctp_t *parent, int family, int flags,
1345     sock_upcalls_t *upcalls, sctp_sockbuf_limits_t *sbl,
1346     cred_t *credp)
1347 {
1348 	sctp_t		*sctp, *psctp;
1349 	conn_t		*sctp_connp;
1350 	mblk_t		*ack_mp, *hb_mp;
1351 	int		sleep = flags & SCTP_CAN_BLOCK ? KM_SLEEP : KM_NOSLEEP;
1352 	zoneid_t	zoneid;
1353 	sctp_stack_t	*sctps;
1354 
1355 	/* User must supply a credential. */
1356 	if (credp == NULL)
1357 		return (NULL);
1358 
1359 	psctp = (sctp_t *)parent;
1360 	if (psctp != NULL) {
1361 		sctps = psctp->sctp_sctps;
1362 		/* Increase here to have common decrease at end */
1363 		netstack_hold(sctps->sctps_netstack);
1364 	} else {
1365 		netstack_t *ns;
1366 
1367 		ns = netstack_find_by_cred(credp);
1368 		ASSERT(ns != NULL);
1369 		sctps = ns->netstack_sctp;
1370 		ASSERT(sctps != NULL);
1371 
1372 		/*
1373 		 * For exclusive stacks we set the zoneid to zero
1374 		 * to make SCTP operate as if in the global zone.
1375 		 */
1376 		if (sctps->sctps_netstack->netstack_stackid !=
1377 		    GLOBAL_NETSTACKID)
1378 			zoneid = GLOBAL_ZONEID;
1379 		else
1380 			zoneid = crgetzoneid(credp);
1381 
1382 		/*
1383 		 * For stackid zero this is done from strplumb.c, but
1384 		 * non-zero stackids are handled here.
1385 		 */
1386 		if (sctps->sctps_g_q == NULL &&
1387 		    sctps->sctps_netstack->netstack_stackid !=
1388 		    GLOBAL_NETSTACKID) {
1389 			sctp_g_q_setup(sctps);
1390 		}
1391 	}
1392 	if ((sctp_connp = ipcl_conn_create(IPCL_SCTPCONN, sleep,
1393 	    sctps->sctps_netstack)) == NULL) {
1394 		netstack_rele(sctps->sctps_netstack);
1395 		SCTP_KSTAT(sctps, sctp_conn_create);
1396 		return (NULL);
1397 	}
1398 	/*
1399 	 * ipcl_conn_create did a netstack_hold. Undo the hold that was
1400 	 * done at top of sctp_create.
1401 	 */
1402 	netstack_rele(sctps->sctps_netstack);
1403 	sctp = CONN2SCTP(sctp_connp);
1404 	sctp->sctp_sctps = sctps;
1405 
1406 	sctp_connp->conn_ulp_labeled = is_system_labeled();
1407 	if ((ack_mp = sctp_timer_alloc(sctp, sctp_ack_timer, sleep)) == NULL ||
1408 	    (hb_mp = sctp_timer_alloc(sctp, sctp_heartbeat_timer,
1409 	    sleep)) == NULL) {
1410 		if (ack_mp != NULL)
1411 			freeb(ack_mp);
1412 		sctp_conn_clear(sctp_connp);
1413 		sctp->sctp_sctps = NULL;
1414 		SCTP_G_Q_REFRELE(sctps);
1415 		kmem_cache_free(sctp_conn_cache, sctp_connp);
1416 		return (NULL);
1417 	}
1418 
1419 	sctp->sctp_ack_mp = ack_mp;
1420 	sctp->sctp_heartbeat_mp = hb_mp;
1421 
1422 	switch (family) {
1423 	case AF_INET6:
1424 		sctp_connp->conn_af_isv6 = B_TRUE;
1425 		sctp->sctp_ipversion = IPV6_VERSION;
1426 		sctp->sctp_family = AF_INET6;
1427 		break;
1428 
1429 	case AF_INET:
1430 		sctp_connp->conn_af_isv6 = B_FALSE;
1431 		sctp_connp->conn_pkt_isv6 = B_FALSE;
1432 		sctp->sctp_ipversion = IPV4_VERSION;
1433 		sctp->sctp_family = AF_INET;
1434 		break;
1435 	default:
1436 		ASSERT(0);
1437 		break;
1438 	}
1439 	if (sctp_init_values(sctp, psctp, sleep) != 0) {
1440 		freeb(ack_mp);
1441 		freeb(hb_mp);
1442 		sctp_conn_clear(sctp_connp);
1443 		sctp->sctp_sctps = NULL;
1444 		SCTP_G_Q_REFRELE(sctps);
1445 		kmem_cache_free(sctp_conn_cache, sctp_connp);
1446 		return (NULL);
1447 	}
1448 	sctp->sctp_cansleep = ((flags & SCTP_CAN_BLOCK) == SCTP_CAN_BLOCK);
1449 
1450 	sctp->sctp_mss = sctps->sctps_initial_mtu - ((family == AF_INET6) ?
1451 	    sctp->sctp_hdr6_len : sctp->sctp_hdr_len);
1452 
1453 	if (psctp != NULL) {
1454 		RUN_SCTP(psctp);
1455 		/*
1456 		 * Inherit local address list, local port. Parent is either
1457 		 * in SCTPS_BOUND, or SCTPS_LISTEN state.
1458 		 */
1459 		ASSERT((psctp->sctp_state == SCTPS_BOUND) ||
1460 		    (psctp->sctp_state == SCTPS_LISTEN));
1461 		if (sctp_dup_saddrs(psctp, sctp, sleep)) {
1462 			WAKE_SCTP(psctp);
1463 			freeb(ack_mp);
1464 			freeb(hb_mp);
1465 			sctp_headers_free(sctp);
1466 			sctp_conn_clear(sctp_connp);
1467 			sctp->sctp_sctps = NULL;
1468 			SCTP_G_Q_REFRELE(sctps);
1469 			kmem_cache_free(sctp_conn_cache, sctp_connp);
1470 			return (NULL);
1471 		}
1472 
1473 		/*
1474 		 * If the parent is specified, it'll be immediatelly
1475 		 * followed by sctp_connect(). So don't add this guy to
1476 		 * bind hash.
1477 		 */
1478 		sctp->sctp_lport = psctp->sctp_lport;
1479 		sctp->sctp_state = SCTPS_BOUND;
1480 		sctp->sctp_allzones = psctp->sctp_allzones;
1481 		sctp->sctp_zoneid = psctp->sctp_zoneid;
1482 		WAKE_SCTP(psctp);
1483 	} else {
1484 		sctp->sctp_zoneid = zoneid;
1485 	}
1486 
1487 	sctp_connp->conn_cred = credp;
1488 	crhold(credp);
1489 
1490 	/*
1491 	 * If the caller has the process-wide flag set, then default to MAC
1492 	 * exempt mode.  This allows read-down to unlabeled hosts.
1493 	 */
1494 	if (getpflags(NET_MAC_AWARE, credp) != 0)
1495 		sctp_connp->conn_mac_exempt = B_TRUE;
1496 
1497 	/* Initialize SCTP instance values,  our verf tag must never be 0 */
1498 	(void) random_get_pseudo_bytes((uint8_t *)&sctp->sctp_lvtag,
1499 	    sizeof (sctp->sctp_lvtag));
1500 	if (sctp->sctp_lvtag == 0)
1501 		sctp->sctp_lvtag = (uint32_t)gethrtime();
1502 	ASSERT(sctp->sctp_lvtag != 0);
1503 
1504 	sctp->sctp_ltsn = sctp->sctp_lvtag + 1;
1505 	sctp->sctp_lcsn = sctp->sctp_ltsn;
1506 	sctp->sctp_recovery_tsn = sctp->sctp_lastack_rxd = sctp->sctp_ltsn - 1;
1507 	sctp->sctp_adv_pap = sctp->sctp_lastack_rxd;
1508 
1509 	/* Information required by upper layer */
1510 	if (ulpd != NULL) {
1511 		sctp->sctp_ulpd = ulpd;
1512 
1513 		ASSERT(upcalls != NULL);
1514 		sctp->sctp_upcalls = upcalls;
1515 		ASSERT(sbl != NULL);
1516 		/* Fill in the socket buffer limits for sctpsockfs */
1517 		sbl->sbl_txlowat = sctp->sctp_xmit_lowater;
1518 		sbl->sbl_txbuf = sctp->sctp_xmit_hiwater;
1519 		sbl->sbl_rxbuf = sctp->sctp_rwnd;
1520 		sbl->sbl_rxlowat = SCTP_RECV_LOWATER;
1521 	}
1522 	/* If no ulpd, must be creating the default sctp */
1523 	ASSERT(ulpd != NULL || sctps->sctps_gsctp == NULL);
1524 
1525 	/* Insert this in the global list. */
1526 	SCTP_LINK(sctp, sctps);
1527 
1528 	return (sctp);
1529 }
1530 
1531 /*
1532  * Make sure we wait until the default queue is setup, yet allow
1533  * sctp_g_q_create() to open a SCTP stream.
1534  * We need to allow sctp_g_q_create() do do an open
1535  * of sctp, hence we compare curhread.
1536  * All others have to wait until the sctps_g_q has been
1537  * setup.
1538  */
1539 void
1540 sctp_g_q_setup(sctp_stack_t *sctps)
1541 {
1542 	mutex_enter(&sctps->sctps_g_q_lock);
1543 	if (sctps->sctps_g_q != NULL) {
1544 		mutex_exit(&sctps->sctps_g_q_lock);
1545 		return;
1546 	}
1547 	if (sctps->sctps_g_q_creator == NULL) {
1548 		/* This thread will set it up */
1549 		sctps->sctps_g_q_creator = curthread;
1550 		mutex_exit(&sctps->sctps_g_q_lock);
1551 		sctp_g_q_create(sctps);
1552 		mutex_enter(&sctps->sctps_g_q_lock);
1553 		ASSERT(sctps->sctps_g_q_creator == curthread);
1554 		sctps->sctps_g_q_creator = NULL;
1555 		cv_signal(&sctps->sctps_g_q_cv);
1556 		ASSERT(sctps->sctps_g_q != NULL);
1557 		mutex_exit(&sctps->sctps_g_q_lock);
1558 		return;
1559 	}
1560 	/* Everybody but the creator has to wait */
1561 	if (sctps->sctps_g_q_creator != curthread) {
1562 		while (sctps->sctps_g_q == NULL)
1563 			cv_wait(&sctps->sctps_g_q_cv, &sctps->sctps_g_q_lock);
1564 	}
1565 	mutex_exit(&sctps->sctps_g_q_lock);
1566 }
1567 
1568 #define	IP	"ip"
1569 
1570 #define	SCTP6DEV		"/devices/pseudo/sctp6@0:sctp6"
1571 
1572 /*
1573  * Create a default sctp queue here instead of in strplumb
1574  */
1575 void
1576 sctp_g_q_create(sctp_stack_t *sctps)
1577 {
1578 	int error;
1579 	ldi_handle_t	lh = NULL;
1580 	ldi_ident_t	li = NULL;
1581 	int		rval;
1582 	cred_t		*cr;
1583 	major_t IP_MAJ;
1584 
1585 #ifdef NS_DEBUG
1586 	(void) printf("sctp_g_q_create()for stack %d\n",
1587 	    sctps->sctps_netstack->netstack_stackid);
1588 #endif
1589 
1590 	IP_MAJ = ddi_name_to_major(IP);
1591 
1592 	ASSERT(sctps->sctps_g_q_creator == curthread);
1593 
1594 	error = ldi_ident_from_major(IP_MAJ, &li);
1595 	if (error) {
1596 #ifdef DEBUG
1597 		printf("sctp_g_q_create: lyr ident get failed error %d\n",
1598 		    error);
1599 #endif
1600 		return;
1601 	}
1602 
1603 	cr = zone_get_kcred(netstackid_to_zoneid(
1604 	    sctps->sctps_netstack->netstack_stackid));
1605 	ASSERT(cr != NULL);
1606 	/*
1607 	 * We set the sctp default queue to IPv6 because IPv4 falls
1608 	 * back to IPv6 when it can't find a client, but
1609 	 * IPv6 does not fall back to IPv4.
1610 	 */
1611 	error = ldi_open_by_name(SCTP6DEV, FREAD|FWRITE, cr, &lh, li);
1612 	if (error) {
1613 #ifdef DEBUG
1614 		printf("sctp_g_q_create: open of SCTP6DEV failed error %d\n",
1615 		    error);
1616 #endif
1617 		goto out;
1618 	}
1619 
1620 	/*
1621 	 * This ioctl causes the sctp framework to cache a pointer to
1622 	 * this stream, so we don't want to close the stream after
1623 	 * this operation.
1624 	 * Use the kernel credentials that are for the zone we're in.
1625 	 */
1626 	error = ldi_ioctl(lh, SCTP_IOC_DEFAULT_Q,
1627 	    (intptr_t)0, FKIOCTL, cr, &rval);
1628 	if (error) {
1629 #ifdef DEBUG
1630 		printf("sctp_g_q_create: ioctl SCTP_IOC_DEFAULT_Q failed "
1631 		    "error %d\n", error);
1632 #endif
1633 		goto out;
1634 	}
1635 	sctps->sctps_g_q_lh = lh;	/* For sctp_g_q_inactive */
1636 	lh = NULL;
1637 out:
1638 	/* Close layered handles */
1639 	if (li)
1640 		ldi_ident_release(li);
1641 	/* Keep cred around until _inactive needs it */
1642 	sctps->sctps_g_q_cr = cr;
1643 }
1644 
1645 /*
1646  * Remove the sctp_default queue so that new connections will not find it.
1647  * SCTP uses sctp_g_q for all transmission, so all sctp'ts implicitly
1648  * refer to it. Hence have each one have a reference on sctp_g_q_ref!
1649  *
1650  * We decrement the refcnt added in sctp_g_q_create. Once all the
1651  * sctp_t's which use the default go away, sctp_g_q_close will be called
1652  * and close the sctp_g_q. Once sctp_g_q is closed, sctp_close() will drop the
1653  * last reference count on the stack by calling netstack_rele().
1654  */
1655 void
1656 sctp_g_q_destroy(sctp_stack_t *sctps)
1657 {
1658 	if (sctps->sctps_g_q == NULL) {
1659 		return;	/* Nothing to cleanup */
1660 	}
1661 	/*
1662 	 * Keep sctps_g_q and sctps_gsctp until the last reference has
1663 	 * dropped, since the output is always done using those.
1664 	 * Need to decrement twice to take sctp_g_q_create and
1665 	 * the gsctp reference into account so that sctp_g_q_inactive is called
1666 	 * when all but the default queue remains.
1667 	 */
1668 #ifdef NS_DEBUG
1669 	(void) printf("sctp_g_q_destroy: ref %d\n",
1670 	    sctps->sctps_g_q_ref);
1671 #endif
1672 	SCTP_G_Q_REFRELE(sctps);
1673 }
1674 
1675 /*
1676  * Called when last user (could be sctp_g_q_destroy) drops reference count
1677  * using SCTP_G_Q_REFRELE.
1678  * Run by sctp_q_q_inactive using a taskq.
1679  */
1680 static void
1681 sctp_g_q_close(void *arg)
1682 {
1683 	sctp_stack_t *sctps = arg;
1684 	int error;
1685 	ldi_handle_t	lh = NULL;
1686 	ldi_ident_t	li = NULL;
1687 	cred_t		*cr;
1688 	major_t IP_MAJ;
1689 
1690 	IP_MAJ = ddi_name_to_major(IP);
1691 
1692 	lh = sctps->sctps_g_q_lh;
1693 	if (lh == NULL)
1694 		return;	/* Nothing to cleanup */
1695 
1696 	error = ldi_ident_from_major(IP_MAJ, &li);
1697 	if (error) {
1698 #ifdef NS_DEBUG
1699 		printf("sctp_g_q_inactive: lyr ident get failed error %d\n",
1700 		    error);
1701 #endif
1702 		return;
1703 	}
1704 
1705 	cr = sctps->sctps_g_q_cr;
1706 	sctps->sctps_g_q_cr = NULL;
1707 	ASSERT(cr != NULL);
1708 
1709 	/*
1710 	 * Make sure we can break the recursion when sctp_close decrements
1711 	 * the reference count causing g_q_inactive to be called again.
1712 	 */
1713 	sctps->sctps_g_q_lh = NULL;
1714 
1715 	/* close the default queue */
1716 	(void) ldi_close(lh, FREAD|FWRITE, cr);
1717 
1718 	/* Close layered handles */
1719 	ldi_ident_release(li);
1720 	crfree(cr);
1721 
1722 	ASSERT(sctps->sctps_g_q != NULL);
1723 	sctps->sctps_g_q = NULL;
1724 	/*
1725 	 * Now free sctps_gsctp.
1726 	 */
1727 	ASSERT(sctps->sctps_gsctp != NULL);
1728 	sctp_closei_local(sctps->sctps_gsctp);
1729 	SCTP_CONDEMNED(sctps->sctps_gsctp);
1730 	SCTP_REFRELE(sctps->sctps_gsctp);
1731 	sctps->sctps_gsctp = NULL;
1732 }
1733 
1734 /*
1735  * Called when last sctp_t drops reference count using SCTP_G_Q_REFRELE.
1736  *
1737  * Have to ensure that the ldi routines are not used by an
1738  * interrupt thread by using a taskq.
1739  */
1740 void
1741 sctp_g_q_inactive(sctp_stack_t *sctps)
1742 {
1743 	if (sctps->sctps_g_q_lh == NULL)
1744 		return;	/* Nothing to cleanup */
1745 
1746 	ASSERT(sctps->sctps_g_q_ref == 0);
1747 	SCTP_G_Q_REFHOLD(sctps); /* Compensate for what g_q_destroy did */
1748 
1749 	if (servicing_interrupt()) {
1750 		(void) taskq_dispatch(sctp_taskq, sctp_g_q_close,
1751 		    (void *) sctps, TQ_SLEEP);
1752 	} else {
1753 		sctp_g_q_close(sctps);
1754 	}
1755 }
1756 
1757 /* Run at module load time */
1758 void
1759 sctp_ddi_g_init(void)
1760 {
1761 	/* Create sctp_t/conn_t cache */
1762 	sctp_conn_cache_init();
1763 
1764 	/* Create the faddr cache */
1765 	sctp_faddr_init();
1766 
1767 	/* Create the sets cache */
1768 	sctp_sets_init();
1769 
1770 	/* Create the PR-SCTP sets cache */
1771 	sctp_ftsn_sets_init();
1772 
1773 	/* Initialize tables used for CRC calculation */
1774 	sctp_crc32_init();
1775 
1776 	sctp_taskq = taskq_create("sctp_taskq", 1, minclsyspri, 1, 1,
1777 	    TASKQ_PREPOPULATE);
1778 
1779 	/*
1780 	 * We want to be informed each time a stack is created or
1781 	 * destroyed in the kernel, so we can maintain the
1782 	 * set of sctp_stack_t's.
1783 	 */
1784 	netstack_register(NS_SCTP, sctp_stack_init, sctp_stack_shutdown,
1785 	    sctp_stack_fini);
1786 }
1787 
1788 static void *
1789 sctp_stack_init(netstackid_t stackid, netstack_t *ns)
1790 {
1791 	sctp_stack_t	*sctps;
1792 
1793 	sctps = kmem_zalloc(sizeof (*sctps), KM_SLEEP);
1794 	sctps->sctps_netstack = ns;
1795 
1796 	/* Initialize locks */
1797 	mutex_init(&sctps->sctps_g_q_lock, NULL, MUTEX_DEFAULT, NULL);
1798 	cv_init(&sctps->sctps_g_q_cv, NULL, CV_DEFAULT, NULL);
1799 	mutex_init(&sctps->sctps_g_lock, NULL, MUTEX_DEFAULT, NULL);
1800 	mutex_init(&sctps->sctps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
1801 	sctps->sctps_g_num_epriv_ports = SCTP_NUM_EPRIV_PORTS;
1802 	sctps->sctps_g_epriv_ports[0] = 2049;
1803 	sctps->sctps_g_epriv_ports[1] = 4045;
1804 
1805 	/* Initialize SCTP hash arrays. */
1806 	sctp_hash_init(sctps);
1807 
1808 	if (!sctp_nd_init(sctps)) {
1809 		sctp_nd_free(sctps);
1810 	}
1811 
1812 	/* Initialize the recvq taskq. */
1813 	sctp_rq_tq_init(sctps);
1814 
1815 	/* saddr init */
1816 	sctp_saddr_init(sctps);
1817 
1818 	/* Global SCTP PCB list. */
1819 	list_create(&sctps->sctps_g_list, sizeof (sctp_t),
1820 	    offsetof(sctp_t, sctp_list));
1821 
1822 	/* Initialize sctp kernel stats. */
1823 	sctps->sctps_mibkp = sctp_kstat_init(stackid);
1824 	sctps->sctps_kstat =
1825 	    sctp_kstat2_init(stackid, &sctps->sctps_statistics);
1826 
1827 	return (sctps);
1828 }
1829 
1830 /*
1831  * Called when the module is about to be unloaded.
1832  */
1833 void
1834 sctp_ddi_g_destroy(void)
1835 {
1836 	/* Destroy sctp_t/conn_t caches */
1837 	sctp_conn_cache_fini();
1838 
1839 	/* Destroy the faddr cache */
1840 	sctp_faddr_fini();
1841 
1842 	/* Destroy the sets cache */
1843 	sctp_sets_fini();
1844 
1845 	/* Destroy the PR-SCTP sets cache */
1846 	sctp_ftsn_sets_fini();
1847 
1848 	netstack_unregister(NS_SCTP);
1849 	taskq_destroy(sctp_taskq);
1850 }
1851 
1852 /*
1853  * Shut down the SCTP stack instance.
1854  */
1855 /* ARGSUSED */
1856 static void
1857 sctp_stack_shutdown(netstackid_t stackid, void *arg)
1858 {
1859 	sctp_stack_t *sctps = (sctp_stack_t *)arg;
1860 
1861 	sctp_g_q_destroy(sctps);
1862 }
1863 
1864 /*
1865  * Free the SCTP stack instance.
1866  */
1867 static void
1868 sctp_stack_fini(netstackid_t stackid, void *arg)
1869 {
1870 	sctp_stack_t *sctps = (sctp_stack_t *)arg;
1871 
1872 	sctp_nd_free(sctps);
1873 
1874 	/* Destroy the recvq taskqs. */
1875 	sctp_rq_tq_fini(sctps);
1876 
1877 	/* Destroy saddr  */
1878 	sctp_saddr_fini(sctps);
1879 
1880 	/* Global SCTP PCB list. */
1881 	list_destroy(&sctps->sctps_g_list);
1882 
1883 	/* Destroy SCTP hash arrays. */
1884 	sctp_hash_destroy(sctps);
1885 
1886 	/* Destroy SCTP kernel stats. */
1887 	sctp_kstat2_fini(stackid, sctps->sctps_kstat);
1888 	sctps->sctps_kstat = NULL;
1889 	bzero(&sctps->sctps_statistics, sizeof (sctps->sctps_statistics));
1890 
1891 	sctp_kstat_fini(stackid, sctps->sctps_mibkp);
1892 	sctps->sctps_mibkp = NULL;
1893 
1894 	mutex_destroy(&sctps->sctps_g_lock);
1895 	mutex_destroy(&sctps->sctps_epriv_port_lock);
1896 	mutex_destroy(&sctps->sctps_g_q_lock);
1897 	cv_destroy(&sctps->sctps_g_q_cv);
1898 
1899 	kmem_free(sctps, sizeof (*sctps));
1900 }
1901 
1902 void
1903 sctp_display_all(sctp_stack_t *sctps)
1904 {
1905 	sctp_t *sctp_walker;
1906 
1907 	mutex_enter(&sctps->sctps_g_lock);
1908 	for (sctp_walker = sctps->sctps_gsctp; sctp_walker != NULL;
1909 	    sctp_walker = (sctp_t *)list_next(&sctps->sctps_g_list,
1910 	    sctp_walker)) {
1911 		(void) sctp_display(sctp_walker, NULL);
1912 	}
1913 	mutex_exit(&sctps->sctps_g_lock);
1914 }
1915 
1916 static void
1917 sctp_rq_tq_init(sctp_stack_t *sctps)
1918 {
1919 	sctps->sctps_recvq_tq_list_max_sz = 16;
1920 	sctps->sctps_recvq_tq_list_cur_sz = 1;
1921 	/*
1922 	 * Initialize the recvq_tq_list and create the first recvq taskq.
1923 	 * What to do if it fails?
1924 	 */
1925 	sctps->sctps_recvq_tq_list =
1926 	    kmem_zalloc(sctps->sctps_recvq_tq_list_max_sz * sizeof (taskq_t *),
1927 	    KM_SLEEP);
1928 	sctps->sctps_recvq_tq_list[0] = taskq_create("sctp_def_recvq_taskq",
1929 	    MIN(sctp_recvq_tq_thr_max, MAX(sctp_recvq_tq_thr_min, ncpus)),
1930 	    minclsyspri, sctp_recvq_tq_task_min, sctp_recvq_tq_task_max,
1931 	    TASKQ_PREPOPULATE);
1932 	mutex_init(&sctps->sctps_rq_tq_lock, NULL, MUTEX_DEFAULT, NULL);
1933 }
1934 
1935 static void
1936 sctp_rq_tq_fini(sctp_stack_t *sctps)
1937 {
1938 	int i;
1939 
1940 	for (i = 0; i < sctps->sctps_recvq_tq_list_cur_sz; i++) {
1941 		ASSERT(sctps->sctps_recvq_tq_list[i] != NULL);
1942 		taskq_destroy(sctps->sctps_recvq_tq_list[i]);
1943 	}
1944 	kmem_free(sctps->sctps_recvq_tq_list,
1945 	    sctps->sctps_recvq_tq_list_max_sz * sizeof (taskq_t *));
1946 	sctps->sctps_recvq_tq_list = NULL;
1947 }
1948 
1949 /* Add another taskq for a new ill. */
1950 void
1951 sctp_inc_taskq(sctp_stack_t *sctps)
1952 {
1953 	taskq_t *tq;
1954 	char tq_name[TASKQ_NAMELEN];
1955 
1956 	mutex_enter(&sctps->sctps_rq_tq_lock);
1957 	if (sctps->sctps_recvq_tq_list_cur_sz + 1 >
1958 	    sctps->sctps_recvq_tq_list_max_sz) {
1959 		mutex_exit(&sctps->sctps_rq_tq_lock);
1960 		cmn_err(CE_NOTE, "Cannot create more SCTP recvq taskq");
1961 		return;
1962 	}
1963 
1964 	(void) snprintf(tq_name, sizeof (tq_name), "sctp_recvq_taskq_%u",
1965 	    sctps->sctps_recvq_tq_list_cur_sz);
1966 	tq = taskq_create(tq_name,
1967 	    MIN(sctp_recvq_tq_thr_max, MAX(sctp_recvq_tq_thr_min, ncpus)),
1968 	    minclsyspri, sctp_recvq_tq_task_min, sctp_recvq_tq_task_max,
1969 	    TASKQ_PREPOPULATE);
1970 	if (tq == NULL) {
1971 		mutex_exit(&sctps->sctps_rq_tq_lock);
1972 		cmn_err(CE_NOTE, "SCTP recvq taskq creation failed");
1973 		return;
1974 	}
1975 	ASSERT(sctps->sctps_recvq_tq_list[
1976 	    sctps->sctps_recvq_tq_list_cur_sz] == NULL);
1977 	sctps->sctps_recvq_tq_list[sctps->sctps_recvq_tq_list_cur_sz] = tq;
1978 	atomic_add_32(&sctps->sctps_recvq_tq_list_cur_sz, 1);
1979 	mutex_exit(&sctps->sctps_rq_tq_lock);
1980 }
1981 
1982 #ifdef DEBUG
1983 uint32_t sendq_loop_cnt = 0;
1984 uint32_t sendq_collision = 0;
1985 uint32_t sendq_empty = 0;
1986 #endif
1987 
1988 void
1989 sctp_add_sendq(sctp_t *sctp, mblk_t *mp)
1990 {
1991 	mutex_enter(&sctp->sctp_sendq_lock);
1992 	if (sctp->sctp_sendq == NULL) {
1993 		sctp->sctp_sendq = mp;
1994 		sctp->sctp_sendq_tail = mp;
1995 	} else {
1996 		sctp->sctp_sendq_tail->b_next = mp;
1997 		sctp->sctp_sendq_tail = mp;
1998 	}
1999 	mutex_exit(&sctp->sctp_sendq_lock);
2000 }
2001 
2002 void
2003 sctp_process_sendq(sctp_t *sctp)
2004 {
2005 	mblk_t *mp;
2006 #ifdef DEBUG
2007 	uint32_t loop_cnt = 0;
2008 #endif
2009 
2010 	mutex_enter(&sctp->sctp_sendq_lock);
2011 	if (sctp->sctp_sendq == NULL || sctp->sctp_sendq_sending) {
2012 #ifdef DEBUG
2013 		if (sctp->sctp_sendq == NULL)
2014 			sendq_empty++;
2015 		else
2016 			sendq_collision++;
2017 #endif
2018 		mutex_exit(&sctp->sctp_sendq_lock);
2019 		return;
2020 	}
2021 	sctp->sctp_sendq_sending = B_TRUE;
2022 
2023 	/*
2024 	 * Note that while we are in this loop, other thread can put
2025 	 * new packets in the receive queue.  We may be looping for
2026 	 * quite a while.  This is OK even for an interrupt thread.
2027 	 * The reason is that SCTP should only able to send a limited
2028 	 * number of packets out in a burst.  So the number of times
2029 	 * we go through this loop should not be many.
2030 	 */
2031 	while ((mp = sctp->sctp_sendq) != NULL) {
2032 		sctp->sctp_sendq = mp->b_next;
2033 		ASSERT(sctp->sctp_connp->conn_ref > 0);
2034 		mutex_exit(&sctp->sctp_sendq_lock);
2035 		mp->b_next = NULL;
2036 		CONN_INC_REF(sctp->sctp_connp);
2037 		mp->b_flag |= MSGHASREF;
2038 		/* If we don't have sctp_current, default to IPv4 */
2039 		IP_PUT(mp, sctp->sctp_connp, sctp->sctp_current == NULL ?
2040 		    B_TRUE : sctp->sctp_current->isv4);
2041 		BUMP_LOCAL(sctp->sctp_opkts);
2042 #ifdef DEBUG
2043 		loop_cnt++;
2044 #endif
2045 		mutex_enter(&sctp->sctp_sendq_lock);
2046 	}
2047 
2048 	sctp->sctp_sendq_tail = NULL;
2049 	sctp->sctp_sendq_sending = B_FALSE;
2050 #ifdef DEBUG
2051 	if (loop_cnt > sendq_loop_cnt)
2052 		sendq_loop_cnt = loop_cnt;
2053 #endif
2054 	mutex_exit(&sctp->sctp_sendq_lock);
2055 }
2056 
2057 #ifdef DEBUG
2058 uint32_t recvq_loop_cnt = 0;
2059 uint32_t recvq_call = 0;
2060 #endif
2061 
2062 /*
2063  * Find the next recvq_tq to use.  This routine will go thru all the
2064  * taskqs until it can dispatch a job for the sctp.  If this fails,
2065  * it will create a new taskq and try it.
2066  */
2067 static boolean_t
2068 sctp_find_next_tq(sctp_t *sctp)
2069 {
2070 	int next_tq, try;
2071 	taskq_t *tq;
2072 	sctp_stack_t	*sctps = sctp->sctp_sctps;
2073 
2074 	/*
2075 	 * Note that since we don't hold a lock on sctp_rq_tq_lock for
2076 	 * performance reason, recvq_ta_list_cur_sz can be changed during
2077 	 * this loop.  The problem this will create is that the loop may
2078 	 * not have tried all the recvq_tq.  This should be OK.
2079 	 */
2080 	next_tq = atomic_add_32_nv(&sctps->sctps_recvq_tq_list_cur, 1) %
2081 	    sctps->sctps_recvq_tq_list_cur_sz;
2082 	for (try = 0; try < sctps->sctps_recvq_tq_list_cur_sz; try++) {
2083 		tq = sctps->sctps_recvq_tq_list[next_tq];
2084 		if (taskq_dispatch(tq, sctp_process_recvq, sctp,
2085 		    TQ_NOSLEEP) != NULL) {
2086 			sctp->sctp_recvq_tq = tq;
2087 			return (B_TRUE);
2088 		}
2089 		next_tq = (next_tq + 1) % sctps->sctps_recvq_tq_list_cur_sz;
2090 	}
2091 
2092 	/*
2093 	 * Create one more taskq and try it.  Note that sctp_inc_taskq()
2094 	 * may not have created another taskq if the number of recvq
2095 	 * taskqs is at the maximum.  We are probably in a pretty bad
2096 	 * shape if this actually happens...
2097 	 */
2098 	sctp_inc_taskq(sctps);
2099 	tq = sctps->sctps_recvq_tq_list[sctps->sctps_recvq_tq_list_cur_sz - 1];
2100 	if (taskq_dispatch(tq, sctp_process_recvq, sctp, TQ_NOSLEEP) != NULL) {
2101 		sctp->sctp_recvq_tq = tq;
2102 		return (B_TRUE);
2103 	}
2104 	SCTP_KSTAT(sctps, sctp_find_next_tq);
2105 	return (B_FALSE);
2106 }
2107 
2108 /*
2109  * To add a message to the recvq.  Note that the sctp_timer_fire()
2110  * routine also uses this function to add the timer message to the
2111  * receive queue for later processing.  And it should be the only
2112  * caller of sctp_add_recvq() which sets the try_harder argument
2113  * to B_TRUE.
2114  *
2115  * If the try_harder argument is B_TRUE, this routine sctp_find_next_tq()
2116  * will try very hard to dispatch the task.  Refer to the comment
2117  * for that routine on how it does that.
2118  */
2119 boolean_t
2120 sctp_add_recvq(sctp_t *sctp, mblk_t *mp, boolean_t caller_hold_lock)
2121 {
2122 	if (!caller_hold_lock)
2123 		mutex_enter(&sctp->sctp_recvq_lock);
2124 
2125 	/* If the taskq dispatch has not been scheduled, do it now. */
2126 	if (sctp->sctp_recvq_tq == NULL) {
2127 		ASSERT(sctp->sctp_recvq == NULL);
2128 		if (!sctp_find_next_tq(sctp)) {
2129 			if (!caller_hold_lock)
2130 				mutex_exit(&sctp->sctp_recvq_lock);
2131 			return (B_FALSE);
2132 		}
2133 		/* Make sure the sctp_t will not go away. */
2134 		SCTP_REFHOLD(sctp);
2135 	}
2136 
2137 	if (sctp->sctp_recvq == NULL) {
2138 		sctp->sctp_recvq = mp;
2139 		sctp->sctp_recvq_tail = mp;
2140 	} else {
2141 		sctp->sctp_recvq_tail->b_next = mp;
2142 		sctp->sctp_recvq_tail = mp;
2143 	}
2144 
2145 	if (!caller_hold_lock)
2146 		mutex_exit(&sctp->sctp_recvq_lock);
2147 	return (B_TRUE);
2148 }
2149 
2150 static void
2151 sctp_process_recvq(void *arg)
2152 {
2153 	sctp_t		*sctp = (sctp_t *)arg;
2154 	mblk_t		*mp;
2155 	mblk_t		*ipsec_mp;
2156 #ifdef DEBUG
2157 	uint32_t	loop_cnt = 0;
2158 #endif
2159 
2160 #ifdef	_BIG_ENDIAN
2161 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 28) & 0x7)
2162 #else
2163 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 4) & 0x7)
2164 #endif
2165 
2166 	RUN_SCTP(sctp);
2167 	mutex_enter(&sctp->sctp_recvq_lock);
2168 
2169 #ifdef DEBUG
2170 	recvq_call++;
2171 #endif
2172 	/*
2173 	 * Note that while we are in this loop, other thread can put
2174 	 * new packets in the receive queue.  We may be looping for
2175 	 * quite a while.
2176 	 */
2177 	while ((mp = sctp->sctp_recvq) != NULL) {
2178 		sctp->sctp_recvq = mp->b_next;
2179 		mutex_exit(&sctp->sctp_recvq_lock);
2180 		mp->b_next = NULL;
2181 #ifdef DEBUG
2182 		loop_cnt++;
2183 #endif
2184 		ipsec_mp = mp->b_prev;
2185 		mp->b_prev = NULL;
2186 		sctp_input_data(sctp, mp, ipsec_mp);
2187 
2188 		mutex_enter(&sctp->sctp_recvq_lock);
2189 	}
2190 
2191 	sctp->sctp_recvq_tail = NULL;
2192 	sctp->sctp_recvq_tq = NULL;
2193 
2194 	mutex_exit(&sctp->sctp_recvq_lock);
2195 
2196 	WAKE_SCTP(sctp);
2197 
2198 	/* We may have sent something when processing the receive queue. */
2199 	sctp_process_sendq(sctp);
2200 #ifdef DEBUG
2201 	if (loop_cnt > recvq_loop_cnt)
2202 		recvq_loop_cnt = loop_cnt;
2203 #endif
2204 	/* Now it can go away. */
2205 	SCTP_REFRELE(sctp);
2206 }
2207 
2208 /* ARGSUSED */
2209 static int
2210 sctp_conn_cache_constructor(void *buf, void *cdrarg, int kmflags)
2211 {
2212 	conn_t	*sctp_connp = (conn_t *)buf;
2213 	sctp_t	*sctp = (sctp_t *)&sctp_connp[1];
2214 
2215 	bzero(buf, (char *)&sctp[1] - (char *)buf);
2216 
2217 	sctp->sctp_connp = sctp_connp;
2218 	mutex_init(&sctp->sctp_reflock, NULL, MUTEX_DEFAULT, NULL);
2219 	mutex_init(&sctp->sctp_lock, NULL, MUTEX_DEFAULT, NULL);
2220 	mutex_init(&sctp->sctp_recvq_lock, NULL, MUTEX_DEFAULT, NULL);
2221 	cv_init(&sctp->sctp_cv, NULL, CV_DEFAULT, NULL);
2222 	mutex_init(&sctp->sctp_sendq_lock, NULL, MUTEX_DEFAULT, NULL);
2223 
2224 	return (0);
2225 }
2226 
2227 /* ARGSUSED */
2228 static void
2229 sctp_conn_cache_destructor(void *buf, void *cdrarg)
2230 {
2231 	conn_t	*sctp_connp = (conn_t *)buf;
2232 	sctp_t	*sctp = (sctp_t *)&sctp_connp[1];
2233 
2234 	ASSERT(!MUTEX_HELD(&sctp->sctp_lock));
2235 	ASSERT(!MUTEX_HELD(&sctp->sctp_reflock));
2236 	ASSERT(!MUTEX_HELD(&sctp->sctp_recvq_lock));
2237 	ASSERT(!MUTEX_HELD(&sctp->sctp_sendq_lock));
2238 	ASSERT(!MUTEX_HELD(&sctp->sctp_connp->conn_lock));
2239 
2240 	ASSERT(sctp->sctp_conn_hash_next == NULL);
2241 	ASSERT(sctp->sctp_conn_hash_prev == NULL);
2242 	ASSERT(sctp->sctp_listen_hash_next == NULL);
2243 	ASSERT(sctp->sctp_listen_hash_prev == NULL);
2244 	ASSERT(sctp->sctp_listen_tfp == NULL);
2245 	ASSERT(sctp->sctp_conn_tfp == NULL);
2246 
2247 	ASSERT(sctp->sctp_faddrs == NULL);
2248 	ASSERT(sctp->sctp_nsaddrs == 0);
2249 
2250 	ASSERT(sctp->sctp_ulpd == NULL);
2251 
2252 	ASSERT(sctp->sctp_lastfaddr == NULL);
2253 	ASSERT(sctp->sctp_primary == NULL);
2254 	ASSERT(sctp->sctp_current == NULL);
2255 	ASSERT(sctp->sctp_lastdata == NULL);
2256 
2257 	ASSERT(sctp->sctp_xmit_head == NULL);
2258 	ASSERT(sctp->sctp_xmit_tail == NULL);
2259 	ASSERT(sctp->sctp_xmit_unsent == NULL);
2260 	ASSERT(sctp->sctp_xmit_unsent_tail == NULL);
2261 
2262 	ASSERT(sctp->sctp_ostrcntrs == NULL);
2263 
2264 	ASSERT(sctp->sctp_sack_info == NULL);
2265 	ASSERT(sctp->sctp_ack_mp == NULL);
2266 	ASSERT(sctp->sctp_instr == NULL);
2267 
2268 	ASSERT(sctp->sctp_iphc == NULL);
2269 	ASSERT(sctp->sctp_iphc6 == NULL);
2270 	ASSERT(sctp->sctp_ipha == NULL);
2271 	ASSERT(sctp->sctp_ip6h == NULL);
2272 	ASSERT(sctp->sctp_sctph == NULL);
2273 	ASSERT(sctp->sctp_sctph6 == NULL);
2274 
2275 	ASSERT(sctp->sctp_cookie_mp == NULL);
2276 
2277 	ASSERT(sctp->sctp_refcnt == 0);
2278 	ASSERT(sctp->sctp_timer_mp == NULL);
2279 	ASSERT(sctp->sctp_connp->conn_ref == 0);
2280 	ASSERT(sctp->sctp_heartbeat_mp == NULL);
2281 	ASSERT(sctp->sctp_ptpbhn == NULL && sctp->sctp_bind_hash == NULL);
2282 
2283 	ASSERT(sctp->sctp_shutdown_faddr == NULL);
2284 
2285 	ASSERT(sctp->sctp_cxmit_list == NULL);
2286 
2287 	ASSERT(sctp->sctp_recvq == NULL);
2288 	ASSERT(sctp->sctp_recvq_tail == NULL);
2289 	ASSERT(sctp->sctp_recvq_tq == NULL);
2290 
2291 	ASSERT(sctp->sctp_sendq == NULL);
2292 	ASSERT(sctp->sctp_sendq_tail == NULL);
2293 	ASSERT(sctp->sctp_sendq_sending == B_FALSE);
2294 
2295 	ASSERT(sctp->sctp_ipp_hopopts == NULL);
2296 	ASSERT(sctp->sctp_ipp_rtdstopts == NULL);
2297 	ASSERT(sctp->sctp_ipp_rthdr == NULL);
2298 	ASSERT(sctp->sctp_ipp_dstopts == NULL);
2299 	ASSERT(sctp->sctp_ipp_pathmtu == NULL);
2300 
2301 	/*
2302 	 * sctp_pad_mp can be NULL if the memory allocation fails
2303 	 * in sctp_init_values() and the conn_t is freed.
2304 	 */
2305 	if (sctp->sctp_pad_mp != NULL) {
2306 		freeb(sctp->sctp_pad_mp);
2307 		sctp->sctp_pad_mp = NULL;
2308 	}
2309 
2310 	mutex_destroy(&sctp->sctp_reflock);
2311 	mutex_destroy(&sctp->sctp_lock);
2312 	mutex_destroy(&sctp->sctp_recvq_lock);
2313 	cv_destroy(&sctp->sctp_cv);
2314 	mutex_destroy(&sctp->sctp_sendq_lock);
2315 
2316 }
2317 
2318 static void
2319 sctp_conn_cache_init()
2320 {
2321 	sctp_conn_cache = kmem_cache_create("sctp_conn_cache",
2322 	    sizeof (sctp_t) + sizeof (conn_t), 0, sctp_conn_cache_constructor,
2323 	    sctp_conn_cache_destructor, NULL, NULL, NULL, 0);
2324 }
2325 
2326 static void
2327 sctp_conn_cache_fini()
2328 {
2329 	kmem_cache_destroy(sctp_conn_cache);
2330 }
2331 
2332 void
2333 sctp_conn_init(conn_t *connp)
2334 {
2335 	connp->conn_flags = IPCL_SCTPCONN;
2336 	connp->conn_rq = connp->conn_wq = NULL;
2337 	connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
2338 	connp->conn_ulp = IPPROTO_SCTP;
2339 	connp->conn_state_flags |= CONN_INCIPIENT;
2340 	mutex_init(&connp->conn_lock, NULL, MUTEX_DEFAULT, NULL);
2341 	cv_init(&connp->conn_cv, NULL, CV_DEFAULT, NULL);
2342 }
2343 
2344 static void
2345 sctp_conn_clear(conn_t *connp)
2346 {
2347 	/* Clean up conn_t stuff */
2348 	if (connp->conn_latch != NULL)
2349 		IPLATCH_REFRELE(connp->conn_latch, connp->conn_netstack);
2350 	if (connp->conn_policy != NULL)
2351 		IPPH_REFRELE(connp->conn_policy, connp->conn_netstack);
2352 	if (connp->conn_ipsec_opt_mp != NULL)
2353 		freemsg(connp->conn_ipsec_opt_mp);
2354 	mutex_destroy(&connp->conn_lock);
2355 	cv_destroy(&connp->conn_cv);
2356 	netstack_rele(connp->conn_netstack);
2357 	bzero(connp, sizeof (struct conn_s));
2358 }
2359