xref: /titanic_52/usr/src/uts/common/inet/tcp/tcp.c (revision c70a8a3b92fb0488ef2ca1ae9e282c8b86ffa6d1)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 /* Copyright (c) 1990 Mentat Inc. */
27 
28 #pragma ident	"%Z%%M%	%I%	%E% SMI"
29 const char tcp_version[] = "%Z%%M%	%I%	%E% SMI";
30 
31 
32 #include <sys/types.h>
33 #include <sys/stream.h>
34 #include <sys/strsun.h>
35 #include <sys/strsubr.h>
36 #include <sys/stropts.h>
37 #include <sys/strlog.h>
38 #include <sys/strsun.h>
39 #define	_SUN_TPI_VERSION 2
40 #include <sys/tihdr.h>
41 #include <sys/timod.h>
42 #include <sys/ddi.h>
43 #include <sys/sunddi.h>
44 #include <sys/suntpi.h>
45 #include <sys/xti_inet.h>
46 #include <sys/cmn_err.h>
47 #include <sys/debug.h>
48 #include <sys/vtrace.h>
49 #include <sys/kmem.h>
50 #include <sys/ethernet.h>
51 #include <sys/cpuvar.h>
52 #include <sys/dlpi.h>
53 #include <sys/multidata.h>
54 #include <sys/multidata_impl.h>
55 #include <sys/pattr.h>
56 #include <sys/policy.h>
57 #include <sys/priv.h>
58 #include <sys/zone.h>
59 
60 #include <sys/errno.h>
61 #include <sys/signal.h>
62 #include <sys/socket.h>
63 #include <sys/sockio.h>
64 #include <sys/isa_defs.h>
65 #include <sys/md5.h>
66 #include <sys/random.h>
67 #include <netinet/in.h>
68 #include <netinet/tcp.h>
69 #include <netinet/ip6.h>
70 #include <netinet/icmp6.h>
71 #include <net/if.h>
72 #include <net/route.h>
73 #include <inet/ipsec_impl.h>
74 
75 #include <inet/common.h>
76 #include <inet/ip.h>
77 #include <inet/ip_impl.h>
78 #include <inet/ip6.h>
79 #include <inet/ip_ndp.h>
80 #include <inet/mi.h>
81 #include <inet/mib2.h>
82 #include <inet/nd.h>
83 #include <inet/optcom.h>
84 #include <inet/snmpcom.h>
85 #include <inet/kstatcom.h>
86 #include <inet/tcp.h>
87 #include <inet/tcp_impl.h>
88 #include <net/pfkeyv2.h>
89 #include <inet/ipsec_info.h>
90 #include <inet/ipdrop.h>
91 #include <inet/tcp_trace.h>
92 
93 #include <inet/ipclassifier.h>
94 #include <inet/ip_ire.h>
95 #include <inet/ip_ftable.h>
96 #include <inet/ip_if.h>
97 #include <inet/ipp_common.h>
98 #include <sys/squeue.h>
99 #include <inet/kssl/ksslapi.h>
100 #include <sys/tsol/label.h>
101 #include <sys/tsol/tnet.h>
102 #include <sys/sdt.h>
103 #include <rpc/pmap_prot.h>
104 
105 /*
106  * TCP Notes: aka FireEngine Phase I (PSARC 2002/433)
107  *
108  * (Read the detailed design doc in PSARC case directory)
109  *
110  * The entire tcp state is contained in tcp_t and conn_t structure
111  * which are allocated in tandem using ipcl_conn_create() and passing
112  * IPCL_CONNTCP as a flag. We use 'conn_ref' and 'conn_lock' to protect
113  * the references on the tcp_t. The tcp_t structure is never compressed
114  * and packets always land on the correct TCP perimeter from the time
115  * eager is created till the time tcp_t dies (as such the old mentat
116  * TCP global queue is not used for detached state and no IPSEC checking
117  * is required). The global queue is still allocated to send out resets
118  * for connection which have no listeners and IP directly calls
119  * tcp_xmit_listeners_reset() which does any policy check.
120  *
121  * Protection and Synchronisation mechanism:
122  *
123  * The tcp data structure does not use any kind of lock for protecting
124  * its state but instead uses 'squeues' for mutual exclusion from various
125  * read and write side threads. To access a tcp member, the thread should
126  * always be behind squeue (via squeue_enter, squeue_enter_nodrain, or
127  * squeue_fill). Since the squeues allow a direct function call, caller
128  * can pass any tcp function having prototype of edesc_t as argument
129  * (different from traditional STREAMs model where packets come in only
130  * designated entry points). The list of functions that can be directly
131  * called via squeue are listed before the usual function prototype.
132  *
133  * Referencing:
134  *
135  * TCP is MT-Hot and we use a reference based scheme to make sure that the
136  * tcp structure doesn't disappear when its needed. When the application
137  * creates an outgoing connection or accepts an incoming connection, we
138  * start out with 2 references on 'conn_ref'. One for TCP and one for IP.
139  * The IP reference is just a symbolic reference since ip_tcpclose()
140  * looks at tcp structure after tcp_close_output() returns which could
141  * have dropped the last TCP reference. So as long as the connection is
142  * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the
143  * conn_t. The classifier puts its own reference when the connection is
144  * inserted in listen or connected hash. Anytime a thread needs to enter
145  * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr
146  * on write side or by doing a classify on read side and then puts a
147  * reference on the conn before doing squeue_enter/tryenter/fill. For
148  * read side, the classifier itself puts the reference under fanout lock
149  * to make sure that tcp can't disappear before it gets processed. The
150  * squeue will drop this reference automatically so the called function
151  * doesn't have to do a DEC_REF.
152  *
153  * Opening a new connection:
154  *
155  * The outgoing connection open is pretty simple. ip_tcpopen() does the
156  * work in creating the conn/tcp structure and initializing it. The
157  * squeue assignment is done based on the CPU the application
158  * is running on. So for outbound connections, processing is always done
159  * on application CPU which might be different from the incoming CPU
160  * being interrupted by the NIC. An optimal way would be to figure out
161  * the NIC <-> CPU binding at listen time, and assign the outgoing
162  * connection to the squeue attached to the CPU that will be interrupted
163  * for incoming packets (we know the NIC based on the bind IP address).
164  * This might seem like a problem if more data is going out but the
165  * fact is that in most cases the transmit is ACK driven transmit where
166  * the outgoing data normally sits on TCP's xmit queue waiting to be
167  * transmitted.
168  *
169  * Accepting a connection:
170  *
171  * This is a more interesting case because of various races involved in
172  * establishing a eager in its own perimeter. Read the meta comment on
173  * top of tcp_conn_request(). But briefly, the squeue is picked by
174  * ip_tcp_input()/ip_fanout_tcp_v6() based on the interrupted CPU.
175  *
176  * Closing a connection:
177  *
178  * The close is fairly straight forward. tcp_close() calls tcp_close_output()
179  * via squeue to do the close and mark the tcp as detached if the connection
180  * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its
181  * reference but tcp_close() drop IP's reference always. So if tcp was
182  * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP
183  * and 1 because it is in classifier's connected hash. This is the condition
184  * we use to determine that its OK to clean up the tcp outside of squeue
185  * when time wait expires (check the ref under fanout and conn_lock and
186  * if it is 2, remove it from fanout hash and kill it).
187  *
188  * Although close just drops the necessary references and marks the
189  * tcp_detached state, tcp_close needs to know the tcp_detached has been
190  * set (under squeue) before letting the STREAM go away (because a
191  * inbound packet might attempt to go up the STREAM while the close
192  * has happened and tcp_detached is not set). So a special lock and
193  * flag is used along with a condition variable (tcp_closelock, tcp_closed,
194  * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked
195  * tcp_detached.
196  *
197  * Special provisions and fast paths:
198  *
199  * We make special provision for (AF_INET, SOCK_STREAM) sockets which
200  * can't have 'ipv6_recvpktinfo' set and for these type of sockets, IP
201  * will never send a M_CTL to TCP. As such, ip_tcp_input() which handles
202  * all TCP packets from the wire makes a IPCL_IS_TCP4_CONNECTED_NO_POLICY
203  * check to send packets directly to tcp_rput_data via squeue. Everyone
204  * else comes through tcp_input() on the read side.
205  *
206  * We also make special provisions for sockfs by marking tcp_issocket
207  * whenever we have only sockfs on top of TCP. This allows us to skip
208  * putting the tcp in acceptor hash since a sockfs listener can never
209  * become acceptor and also avoid allocating a tcp_t for acceptor STREAM
210  * since eager has already been allocated and the accept now happens
211  * on acceptor STREAM. There is a big blob of comment on top of
212  * tcp_conn_request explaining the new accept. When socket is POP'd,
213  * sockfs sends us an ioctl to mark the fact and we go back to old
214  * behaviour. Once tcp_issocket is unset, its never set for the
215  * life of that connection.
216  *
217  * IPsec notes :
218  *
219  * Since a packet is always executed on the correct TCP perimeter
220  * all IPsec processing is defered to IP including checking new
221  * connections and setting IPSEC policies for new connection. The
222  * only exception is tcp_xmit_listeners_reset() which is called
223  * directly from IP and needs to policy check to see if TH_RST
224  * can be sent out.
225  */
226 
227 extern major_t TCP6_MAJ;
228 
229 /*
230  * Values for squeue switch:
231  * 1: squeue_enter_nodrain
232  * 2: squeue_enter
233  * 3: squeue_fill
234  */
235 int tcp_squeue_close = 2;
236 int tcp_squeue_wput = 2;
237 
238 squeue_func_t tcp_squeue_close_proc;
239 squeue_func_t tcp_squeue_wput_proc;
240 
241 /*
242  * This controls how tiny a write must be before we try to copy it
243  * into the the mblk on the tail of the transmit queue.  Not much
244  * speedup is observed for values larger than sixteen.  Zero will
245  * disable the optimisation.
246  */
247 int tcp_tx_pull_len = 16;
248 
249 /*
250  * TCP Statistics.
251  *
252  * How TCP statistics work.
253  *
254  * There are two types of statistics invoked by two macros.
255  *
256  * TCP_STAT(name) does non-atomic increment of a named stat counter. It is
257  * supposed to be used in non MT-hot paths of the code.
258  *
259  * TCP_DBGSTAT(name) does atomic increment of a named stat counter. It is
260  * supposed to be used for DEBUG purposes and may be used on a hot path.
261  *
262  * Both TCP_STAT and TCP_DBGSTAT counters are available using kstat
263  * (use "kstat tcp" to get them).
264  *
265  * There is also additional debugging facility that marks tcp_clean_death()
266  * instances and saves them in tcp_t structure. It is triggered by
267  * TCP_TAG_CLEAN_DEATH define. Also, there is a global array of counters for
268  * tcp_clean_death() calls that counts the number of times each tag was hit. It
269  * is triggered by TCP_CLD_COUNTERS define.
270  *
271  * How to add new counters.
272  *
273  * 1) Add a field in the tcp_stat structure describing your counter.
274  * 2) Add a line in tcp_statistics with the name of the counter.
275  *
276  *    IMPORTANT!! - make sure that both are in sync !!
277  * 3) Use either TCP_STAT or TCP_DBGSTAT with the name.
278  *
279  * Please avoid using private counters which are not kstat-exported.
280  *
281  * TCP_TAG_CLEAN_DEATH set to 1 enables tagging of tcp_clean_death() instances
282  * in tcp_t structure.
283  *
284  * TCP_MAX_CLEAN_DEATH_TAG is the maximum number of possible clean death tags.
285  */
286 
287 #ifndef TCP_DEBUG_COUNTER
288 #ifdef DEBUG
289 #define	TCP_DEBUG_COUNTER 1
290 #else
291 #define	TCP_DEBUG_COUNTER 0
292 #endif
293 #endif
294 
295 #define	TCP_CLD_COUNTERS 0
296 
297 #define	TCP_TAG_CLEAN_DEATH 1
298 #define	TCP_MAX_CLEAN_DEATH_TAG 32
299 
300 #ifdef lint
301 static int _lint_dummy_;
302 #endif
303 
304 #if TCP_CLD_COUNTERS
305 static uint_t tcp_clean_death_stat[TCP_MAX_CLEAN_DEATH_TAG];
306 #define	TCP_CLD_STAT(x) tcp_clean_death_stat[x]++
307 #elif defined(lint)
308 #define	TCP_CLD_STAT(x) ASSERT(_lint_dummy_ == 0);
309 #else
310 #define	TCP_CLD_STAT(x)
311 #endif
312 
313 #if TCP_DEBUG_COUNTER
314 #define	TCP_DBGSTAT(x) atomic_add_64(&(tcp_statistics.x.value.ui64), 1)
315 #elif defined(lint)
316 #define	TCP_DBGSTAT(x) ASSERT(_lint_dummy_ == 0);
317 #else
318 #define	TCP_DBGSTAT(x)
319 #endif
320 
321 tcp_stat_t tcp_statistics = {
322 	{ "tcp_time_wait",		KSTAT_DATA_UINT64 },
323 	{ "tcp_time_wait_syn",		KSTAT_DATA_UINT64 },
324 	{ "tcp_time_wait_success",	KSTAT_DATA_UINT64 },
325 	{ "tcp_time_wait_fail",		KSTAT_DATA_UINT64 },
326 	{ "tcp_reinput_syn",		KSTAT_DATA_UINT64 },
327 	{ "tcp_ip_output",		KSTAT_DATA_UINT64 },
328 	{ "tcp_detach_non_time_wait",	KSTAT_DATA_UINT64 },
329 	{ "tcp_detach_time_wait",	KSTAT_DATA_UINT64 },
330 	{ "tcp_time_wait_reap",		KSTAT_DATA_UINT64 },
331 	{ "tcp_clean_death_nondetached",	KSTAT_DATA_UINT64 },
332 	{ "tcp_reinit_calls",		KSTAT_DATA_UINT64 },
333 	{ "tcp_eager_err1",		KSTAT_DATA_UINT64 },
334 	{ "tcp_eager_err2",		KSTAT_DATA_UINT64 },
335 	{ "tcp_eager_blowoff_calls",	KSTAT_DATA_UINT64 },
336 	{ "tcp_eager_blowoff_q",	KSTAT_DATA_UINT64 },
337 	{ "tcp_eager_blowoff_q0",	KSTAT_DATA_UINT64 },
338 	{ "tcp_not_hard_bound",		KSTAT_DATA_UINT64 },
339 	{ "tcp_no_listener",		KSTAT_DATA_UINT64 },
340 	{ "tcp_found_eager",		KSTAT_DATA_UINT64 },
341 	{ "tcp_wrong_queue",		KSTAT_DATA_UINT64 },
342 	{ "tcp_found_eager_binding1",	KSTAT_DATA_UINT64 },
343 	{ "tcp_found_eager_bound1",	KSTAT_DATA_UINT64 },
344 	{ "tcp_eager_has_listener1",	KSTAT_DATA_UINT64 },
345 	{ "tcp_open_alloc",		KSTAT_DATA_UINT64 },
346 	{ "tcp_open_detached_alloc",	KSTAT_DATA_UINT64 },
347 	{ "tcp_rput_time_wait",		KSTAT_DATA_UINT64 },
348 	{ "tcp_listendrop",		KSTAT_DATA_UINT64 },
349 	{ "tcp_listendropq0",		KSTAT_DATA_UINT64 },
350 	{ "tcp_wrong_rq",		KSTAT_DATA_UINT64 },
351 	{ "tcp_rsrv_calls",		KSTAT_DATA_UINT64 },
352 	{ "tcp_eagerfree2",		KSTAT_DATA_UINT64 },
353 	{ "tcp_eagerfree3",		KSTAT_DATA_UINT64 },
354 	{ "tcp_eagerfree4",		KSTAT_DATA_UINT64 },
355 	{ "tcp_eagerfree5",		KSTAT_DATA_UINT64 },
356 	{ "tcp_timewait_syn_fail",	KSTAT_DATA_UINT64 },
357 	{ "tcp_listen_badflags",	KSTAT_DATA_UINT64 },
358 	{ "tcp_timeout_calls",		KSTAT_DATA_UINT64 },
359 	{ "tcp_timeout_cached_alloc",	KSTAT_DATA_UINT64 },
360 	{ "tcp_timeout_cancel_reqs",	KSTAT_DATA_UINT64 },
361 	{ "tcp_timeout_canceled",	KSTAT_DATA_UINT64 },
362 	{ "tcp_timermp_alloced",	KSTAT_DATA_UINT64 },
363 	{ "tcp_timermp_freed",		KSTAT_DATA_UINT64 },
364 	{ "tcp_timermp_allocfail",	KSTAT_DATA_UINT64 },
365 	{ "tcp_timermp_allocdblfail",	KSTAT_DATA_UINT64 },
366 	{ "tcp_push_timer_cnt",		KSTAT_DATA_UINT64 },
367 	{ "tcp_ack_timer_cnt",		KSTAT_DATA_UINT64 },
368 	{ "tcp_ire_null1",		KSTAT_DATA_UINT64 },
369 	{ "tcp_ire_null",		KSTAT_DATA_UINT64 },
370 	{ "tcp_ip_send",		KSTAT_DATA_UINT64 },
371 	{ "tcp_ip_ire_send",		KSTAT_DATA_UINT64 },
372 	{ "tcp_wsrv_called",		KSTAT_DATA_UINT64 },
373 	{ "tcp_flwctl_on",		KSTAT_DATA_UINT64 },
374 	{ "tcp_timer_fire_early",	KSTAT_DATA_UINT64 },
375 	{ "tcp_timer_fire_miss",	KSTAT_DATA_UINT64 },
376 	{ "tcp_freelist_cleanup",	KSTAT_DATA_UINT64 },
377 	{ "tcp_rput_v6_error",		KSTAT_DATA_UINT64 },
378 	{ "tcp_out_sw_cksum",		KSTAT_DATA_UINT64 },
379 	{ "tcp_out_sw_cksum_bytes",	KSTAT_DATA_UINT64 },
380 	{ "tcp_zcopy_on",		KSTAT_DATA_UINT64 },
381 	{ "tcp_zcopy_off",		KSTAT_DATA_UINT64 },
382 	{ "tcp_zcopy_backoff",		KSTAT_DATA_UINT64 },
383 	{ "tcp_zcopy_disable",		KSTAT_DATA_UINT64 },
384 	{ "tcp_mdt_pkt_out",		KSTAT_DATA_UINT64 },
385 	{ "tcp_mdt_pkt_out_v4",		KSTAT_DATA_UINT64 },
386 	{ "tcp_mdt_pkt_out_v6",		KSTAT_DATA_UINT64 },
387 	{ "tcp_mdt_discarded",		KSTAT_DATA_UINT64 },
388 	{ "tcp_mdt_conn_halted1",	KSTAT_DATA_UINT64 },
389 	{ "tcp_mdt_conn_halted2",	KSTAT_DATA_UINT64 },
390 	{ "tcp_mdt_conn_halted3",	KSTAT_DATA_UINT64 },
391 	{ "tcp_mdt_conn_resumed1",	KSTAT_DATA_UINT64 },
392 	{ "tcp_mdt_conn_resumed2",	KSTAT_DATA_UINT64 },
393 	{ "tcp_mdt_legacy_small",	KSTAT_DATA_UINT64 },
394 	{ "tcp_mdt_legacy_all",		KSTAT_DATA_UINT64 },
395 	{ "tcp_mdt_legacy_ret",		KSTAT_DATA_UINT64 },
396 	{ "tcp_mdt_allocfail",		KSTAT_DATA_UINT64 },
397 	{ "tcp_mdt_addpdescfail",	KSTAT_DATA_UINT64 },
398 	{ "tcp_mdt_allocd",		KSTAT_DATA_UINT64 },
399 	{ "tcp_mdt_linked",		KSTAT_DATA_UINT64 },
400 	{ "tcp_fusion_flowctl",		KSTAT_DATA_UINT64 },
401 	{ "tcp_fusion_backenabled",	KSTAT_DATA_UINT64 },
402 	{ "tcp_fusion_urg",		KSTAT_DATA_UINT64 },
403 	{ "tcp_fusion_putnext",		KSTAT_DATA_UINT64 },
404 	{ "tcp_fusion_unfusable",	KSTAT_DATA_UINT64 },
405 	{ "tcp_fusion_aborted",		KSTAT_DATA_UINT64 },
406 	{ "tcp_fusion_unqualified",	KSTAT_DATA_UINT64 },
407 	{ "tcp_fusion_rrw_busy",	KSTAT_DATA_UINT64 },
408 	{ "tcp_fusion_rrw_msgcnt",	KSTAT_DATA_UINT64 },
409 	{ "tcp_fusion_rrw_plugged",	KSTAT_DATA_UINT64 },
410 	{ "tcp_in_ack_unsent_drop",	KSTAT_DATA_UINT64 },
411 	{ "tcp_sock_fallback",		KSTAT_DATA_UINT64 },
412 };
413 
414 static kstat_t *tcp_kstat;
415 
416 /*
417  * Call either ip_output or ip_output_v6. This replaces putnext() calls on the
418  * tcp write side.
419  */
420 #define	CALL_IP_WPUT(connp, q, mp) {					\
421 	ASSERT(((q)->q_flag & QREADR) == 0);				\
422 	TCP_DBGSTAT(tcp_ip_output);					\
423 	connp->conn_send(connp, (mp), (q), IP_WPUT);			\
424 }
425 
426 /* Macros for timestamp comparisons */
427 #define	TSTMP_GEQ(a, b)	((int32_t)((a)-(b)) >= 0)
428 #define	TSTMP_LT(a, b)	((int32_t)((a)-(b)) < 0)
429 
430 /*
431  * Parameters for TCP Initial Send Sequence number (ISS) generation.  When
432  * tcp_strong_iss is set to 1, which is the default, the ISS is calculated
433  * by adding three components: a time component which grows by 1 every 4096
434  * nanoseconds (versus every 4 microseconds suggested by RFC 793, page 27);
435  * a per-connection component which grows by 125000 for every new connection;
436  * and an "extra" component that grows by a random amount centered
437  * approximately on 64000.  This causes the the ISS generator to cycle every
438  * 4.89 hours if no TCP connections are made, and faster if connections are
439  * made.
440  *
441  * When tcp_strong_iss is set to 0, ISS is calculated by adding two
442  * components: a time component which grows by 250000 every second; and
443  * a per-connection component which grows by 125000 for every new connections.
444  *
445  * A third method, when tcp_strong_iss is set to 2, for generating ISS is
446  * prescribed by Steve Bellovin.  This involves adding time, the 125000 per
447  * connection, and a one-way hash (MD5) of the connection ID <sport, dport,
448  * src, dst>, a "truly" random (per RFC 1750) number, and a console-entered
449  * password.
450  */
451 #define	ISS_INCR	250000
452 #define	ISS_NSEC_SHT	12
453 
454 static uint32_t tcp_iss_incr_extra;	/* Incremented for each connection */
455 static kmutex_t tcp_iss_key_lock;
456 static MD5_CTX tcp_iss_key;
457 static sin_t	sin_null;	/* Zero address for quick clears */
458 static sin6_t	sin6_null;	/* Zero address for quick clears */
459 
460 /* Packet dropper for TCP IPsec policy drops. */
461 static ipdropper_t tcp_dropper;
462 
463 /*
464  * This implementation follows the 4.3BSD interpretation of the urgent
465  * pointer and not RFC 1122. Switching to RFC 1122 behavior would cause
466  * incompatible changes in protocols like telnet and rlogin.
467  */
468 #define	TCP_OLD_URP_INTERPRETATION	1
469 
470 #define	TCP_IS_DETACHED_NONEAGER(tcp)	\
471 	(TCP_IS_DETACHED(tcp) && \
472 	    (!(tcp)->tcp_hard_binding))
473 
474 /*
475  * TCP reassembly macros.  We hide starting and ending sequence numbers in
476  * b_next and b_prev of messages on the reassembly queue.  The messages are
477  * chained using b_cont.  These macros are used in tcp_reass() so we don't
478  * have to see the ugly casts and assignments.
479  */
480 #define	TCP_REASS_SEQ(mp)		((uint32_t)(uintptr_t)((mp)->b_next))
481 #define	TCP_REASS_SET_SEQ(mp, u)	((mp)->b_next = \
482 					(mblk_t *)(uintptr_t)(u))
483 #define	TCP_REASS_END(mp)		((uint32_t)(uintptr_t)((mp)->b_prev))
484 #define	TCP_REASS_SET_END(mp, u)	((mp)->b_prev = \
485 					(mblk_t *)(uintptr_t)(u))
486 
487 /*
488  * Implementation of TCP Timers.
489  * =============================
490  *
491  * INTERFACE:
492  *
493  * There are two basic functions dealing with tcp timers:
494  *
495  *	timeout_id_t	tcp_timeout(connp, func, time)
496  * 	clock_t		tcp_timeout_cancel(connp, timeout_id)
497  *	TCP_TIMER_RESTART(tcp, intvl)
498  *
499  * tcp_timeout() starts a timer for the 'tcp' instance arranging to call 'func'
500  * after 'time' ticks passed. The function called by timeout() must adhere to
501  * the same restrictions as a driver soft interrupt handler - it must not sleep
502  * or call other functions that might sleep. The value returned is the opaque
503  * non-zero timeout identifier that can be passed to tcp_timeout_cancel() to
504  * cancel the request. The call to tcp_timeout() may fail in which case it
505  * returns zero. This is different from the timeout(9F) function which never
506  * fails.
507  *
508  * The call-back function 'func' always receives 'connp' as its single
509  * argument. It is always executed in the squeue corresponding to the tcp
510  * structure. The tcp structure is guaranteed to be present at the time the
511  * call-back is called.
512  *
513  * NOTE: The call-back function 'func' is never called if tcp is in
514  * 	the TCPS_CLOSED state.
515  *
516  * tcp_timeout_cancel() attempts to cancel a pending tcp_timeout()
517  * request. locks acquired by the call-back routine should not be held across
518  * the call to tcp_timeout_cancel() or a deadlock may result.
519  *
520  * tcp_timeout_cancel() returns -1 if it can not cancel the timeout request.
521  * Otherwise, it returns an integer value greater than or equal to 0. In
522  * particular, if the call-back function is already placed on the squeue, it can
523  * not be canceled.
524  *
525  * NOTE: both tcp_timeout() and tcp_timeout_cancel() should always be called
526  * 	within squeue context corresponding to the tcp instance. Since the
527  *	call-back is also called via the same squeue, there are no race
528  *	conditions described in untimeout(9F) manual page since all calls are
529  *	strictly serialized.
530  *
531  *      TCP_TIMER_RESTART() is a macro that attempts to cancel a pending timeout
532  *	stored in tcp_timer_tid and starts a new one using
533  *	MSEC_TO_TICK(intvl). It always uses tcp_timer() function as a call-back
534  *	and stores the return value of tcp_timeout() in the tcp->tcp_timer_tid
535  *	field.
536  *
537  * NOTE: since the timeout cancellation is not guaranteed, the cancelled
538  *	call-back may still be called, so it is possible tcp_timer() will be
539  *	called several times. This should not be a problem since tcp_timer()
540  *	should always check the tcp instance state.
541  *
542  *
543  * IMPLEMENTATION:
544  *
545  * TCP timers are implemented using three-stage process. The call to
546  * tcp_timeout() uses timeout(9F) function to call tcp_timer_callback() function
547  * when the timer expires. The tcp_timer_callback() arranges the call of the
548  * tcp_timer_handler() function via squeue corresponding to the tcp
549  * instance. The tcp_timer_handler() calls actual requested timeout call-back
550  * and passes tcp instance as an argument to it. Information is passed between
551  * stages using the tcp_timer_t structure which contains the connp pointer, the
552  * tcp call-back to call and the timeout id returned by the timeout(9F).
553  *
554  * The tcp_timer_t structure is not used directly, it is embedded in an mblk_t -
555  * like structure that is used to enter an squeue. The mp->b_rptr of this pseudo
556  * mblk points to the beginning of tcp_timer_t structure. The tcp_timeout()
557  * returns the pointer to this mblk.
558  *
559  * The pseudo mblk is allocated from a special tcp_timer_cache kmem cache. It
560  * looks like a normal mblk without actual dblk attached to it.
561  *
562  * To optimize performance each tcp instance holds a small cache of timer
563  * mblocks. In the current implementation it caches up to two timer mblocks per
564  * tcp instance. The cache is preserved over tcp frees and is only freed when
565  * the whole tcp structure is destroyed by its kmem destructor. Since all tcp
566  * timer processing happens on a corresponding squeue, the cache manipulation
567  * does not require any locks. Experiments show that majority of timer mblocks
568  * allocations are satisfied from the tcp cache and do not involve kmem calls.
569  *
570  * The tcp_timeout() places a refhold on the connp instance which guarantees
571  * that it will be present at the time the call-back function fires. The
572  * tcp_timer_handler() drops the reference after calling the call-back, so the
573  * call-back function does not need to manipulate the references explicitly.
574  */
575 
576 typedef struct tcp_timer_s {
577 	conn_t	*connp;
578 	void 	(*tcpt_proc)(void *);
579 	timeout_id_t   tcpt_tid;
580 } tcp_timer_t;
581 
582 static kmem_cache_t *tcp_timercache;
583 kmem_cache_t	*tcp_sack_info_cache;
584 kmem_cache_t	*tcp_iphc_cache;
585 
586 /*
587  * For scalability, we must not run a timer for every TCP connection
588  * in TIME_WAIT state.  To see why, consider (for time wait interval of
589  * 4 minutes):
590  *	1000 connections/sec * 240 seconds/time wait = 240,000 active conn's
591  *
592  * This list is ordered by time, so you need only delete from the head
593  * until you get to entries which aren't old enough to delete yet.
594  * The list consists of only the detached TIME_WAIT connections.
595  *
596  * Note that the timer (tcp_time_wait_expire) is started when the tcp_t
597  * becomes detached TIME_WAIT (either by changing the state and already
598  * being detached or the other way around). This means that the TIME_WAIT
599  * state can be extended (up to doubled) if the connection doesn't become
600  * detached for a long time.
601  *
602  * The list manipulations (including tcp_time_wait_next/prev)
603  * are protected by the tcp_time_wait_lock. The content of the
604  * detached TIME_WAIT connections is protected by the normal perimeters.
605  */
606 
607 typedef struct tcp_squeue_priv_s {
608 	kmutex_t	tcp_time_wait_lock;
609 				/* Protects the next 3 globals */
610 	timeout_id_t	tcp_time_wait_tid;
611 	tcp_t		*tcp_time_wait_head;
612 	tcp_t		*tcp_time_wait_tail;
613 	tcp_t		*tcp_free_list;
614 	uint_t		tcp_free_list_cnt;
615 } tcp_squeue_priv_t;
616 
617 /*
618  * TCP_TIME_WAIT_DELAY governs how often the time_wait_collector runs.
619  * Running it every 5 seconds seems to give the best results.
620  */
621 #define	TCP_TIME_WAIT_DELAY drv_usectohz(5000000)
622 
623 /*
624  * To prevent memory hog, limit the number of entries in tcp_free_list
625  * to 1% of available memory / number of cpus
626  */
627 uint_t tcp_free_list_max_cnt = 0;
628 
629 #define	TCP_XMIT_LOWATER	4096
630 #define	TCP_XMIT_HIWATER	49152
631 #define	TCP_RECV_LOWATER	2048
632 #define	TCP_RECV_HIWATER	49152
633 
634 /*
635  *  PAWS needs a timer for 24 days.  This is the number of ticks in 24 days
636  */
637 #define	PAWS_TIMEOUT	((clock_t)(24*24*60*60*hz))
638 
639 #define	TIDUSZ	4096	/* transport interface data unit size */
640 
641 /*
642  * Bind hash list size and has function.  It has to be a power of 2 for
643  * hashing.
644  */
645 #define	TCP_BIND_FANOUT_SIZE	512
646 #define	TCP_BIND_HASH(lport) (ntohs(lport) & (TCP_BIND_FANOUT_SIZE - 1))
647 /*
648  * Size of listen and acceptor hash list.  It has to be a power of 2 for
649  * hashing.
650  */
651 #define	TCP_FANOUT_SIZE		256
652 
653 #ifdef	_ILP32
654 #define	TCP_ACCEPTOR_HASH(accid)					\
655 		(((uint_t)(accid) >> 8) & (TCP_FANOUT_SIZE - 1))
656 #else
657 #define	TCP_ACCEPTOR_HASH(accid)					\
658 		((uint_t)(accid) & (TCP_FANOUT_SIZE - 1))
659 #endif	/* _ILP32 */
660 
661 #define	IP_ADDR_CACHE_SIZE	2048
662 #define	IP_ADDR_CACHE_HASH(faddr)					\
663 	(ntohl(faddr) & (IP_ADDR_CACHE_SIZE -1))
664 
665 /* Hash for HSPs uses all 32 bits, since both networks and hosts are in table */
666 #define	TCP_HSP_HASH_SIZE 256
667 
668 #define	TCP_HSP_HASH(addr)					\
669 	(((addr>>24) ^ (addr >>16) ^			\
670 	    (addr>>8) ^ (addr)) % TCP_HSP_HASH_SIZE)
671 
672 /*
673  * TCP options struct returned from tcp_parse_options.
674  */
675 typedef struct tcp_opt_s {
676 	uint32_t	tcp_opt_mss;
677 	uint32_t	tcp_opt_wscale;
678 	uint32_t	tcp_opt_ts_val;
679 	uint32_t	tcp_opt_ts_ecr;
680 	tcp_t		*tcp;
681 } tcp_opt_t;
682 
683 /*
684  * RFC1323-recommended phrasing of TSTAMP option, for easier parsing
685  */
686 
687 #ifdef _BIG_ENDIAN
688 #define	TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
689 	(TCPOPT_TSTAMP << 8) | 10)
690 #else
691 #define	TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
692 	(TCPOPT_NOP << 8) | TCPOPT_NOP)
693 #endif
694 
695 /*
696  * Flags returned from tcp_parse_options.
697  */
698 #define	TCP_OPT_MSS_PRESENT	1
699 #define	TCP_OPT_WSCALE_PRESENT	2
700 #define	TCP_OPT_TSTAMP_PRESENT	4
701 #define	TCP_OPT_SACK_OK_PRESENT	8
702 #define	TCP_OPT_SACK_PRESENT	16
703 
704 /* TCP option length */
705 #define	TCPOPT_NOP_LEN		1
706 #define	TCPOPT_MAXSEG_LEN	4
707 #define	TCPOPT_WS_LEN		3
708 #define	TCPOPT_REAL_WS_LEN	(TCPOPT_WS_LEN+1)
709 #define	TCPOPT_TSTAMP_LEN	10
710 #define	TCPOPT_REAL_TS_LEN	(TCPOPT_TSTAMP_LEN+2)
711 #define	TCPOPT_SACK_OK_LEN	2
712 #define	TCPOPT_REAL_SACK_OK_LEN	(TCPOPT_SACK_OK_LEN+2)
713 #define	TCPOPT_REAL_SACK_LEN	4
714 #define	TCPOPT_MAX_SACK_LEN	36
715 #define	TCPOPT_HEADER_LEN	2
716 
717 /* TCP cwnd burst factor. */
718 #define	TCP_CWND_INFINITE	65535
719 #define	TCP_CWND_SS		3
720 #define	TCP_CWND_NORMAL		5
721 
722 /* Maximum TCP initial cwin (start/restart). */
723 #define	TCP_MAX_INIT_CWND	8
724 
725 /*
726  * Initialize cwnd according to RFC 3390.  def_max_init_cwnd is
727  * either tcp_slow_start_initial or tcp_slow_start_after idle
728  * depending on the caller.  If the upper layer has not used the
729  * TCP_INIT_CWND option to change the initial cwnd, tcp_init_cwnd
730  * should be 0 and we use the formula in RFC 3390 to set tcp_cwnd.
731  * If the upper layer has changed set the tcp_init_cwnd, just use
732  * it to calculate the tcp_cwnd.
733  */
734 #define	SET_TCP_INIT_CWND(tcp, mss, def_max_init_cwnd)			\
735 {									\
736 	if ((tcp)->tcp_init_cwnd == 0) {				\
737 		(tcp)->tcp_cwnd = MIN(def_max_init_cwnd * (mss),	\
738 		    MIN(4 * (mss), MAX(2 * (mss), 4380 / (mss) * (mss)))); \
739 	} else {							\
740 		(tcp)->tcp_cwnd = (tcp)->tcp_init_cwnd * (mss);		\
741 	}								\
742 	tcp->tcp_cwnd_cnt = 0;						\
743 }
744 
745 /* TCP Timer control structure */
746 typedef struct tcpt_s {
747 	pfv_t	tcpt_pfv;	/* The routine we are to call */
748 	tcp_t	*tcpt_tcp;	/* The parameter we are to pass in */
749 } tcpt_t;
750 
751 /* Host Specific Parameter structure */
752 typedef struct tcp_hsp {
753 	struct tcp_hsp	*tcp_hsp_next;
754 	in6_addr_t	tcp_hsp_addr_v6;
755 	in6_addr_t	tcp_hsp_subnet_v6;
756 	uint_t		tcp_hsp_vers;	/* IPV4_VERSION | IPV6_VERSION */
757 	int32_t		tcp_hsp_sendspace;
758 	int32_t		tcp_hsp_recvspace;
759 	int32_t		tcp_hsp_tstamp;
760 } tcp_hsp_t;
761 #define	tcp_hsp_addr	V4_PART_OF_V6(tcp_hsp_addr_v6)
762 #define	tcp_hsp_subnet	V4_PART_OF_V6(tcp_hsp_subnet_v6)
763 
764 /*
765  * Functions called directly via squeue having a prototype of edesc_t.
766  */
767 void		tcp_conn_request(void *arg, mblk_t *mp, void *arg2);
768 static void	tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2);
769 void		tcp_accept_finish(void *arg, mblk_t *mp, void *arg2);
770 static void	tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2);
771 static void	tcp_wput_proto(void *arg, mblk_t *mp, void *arg2);
772 void 		tcp_input(void *arg, mblk_t *mp, void *arg2);
773 void		tcp_rput_data(void *arg, mblk_t *mp, void *arg2);
774 static void	tcp_close_output(void *arg, mblk_t *mp, void *arg2);
775 void		tcp_output(void *arg, mblk_t *mp, void *arg2);
776 static void	tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2);
777 static void	tcp_timer_handler(void *arg, mblk_t *mp, void *arg2);
778 static void	tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2);
779 
780 
781 /* Prototype for TCP functions */
782 static void	tcp_random_init(void);
783 int		tcp_random(void);
784 static void	tcp_accept(tcp_t *tcp, mblk_t *mp);
785 static void	tcp_accept_swap(tcp_t *listener, tcp_t *acceptor,
786 		    tcp_t *eager);
787 static int	tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp);
788 static in_port_t tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr,
789     int reuseaddr, boolean_t quick_connect, boolean_t bind_to_req_port_only,
790     boolean_t user_specified);
791 static void	tcp_closei_local(tcp_t *tcp);
792 static void	tcp_close_detached(tcp_t *tcp);
793 static boolean_t tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph,
794 			mblk_t *idmp, mblk_t **defermp);
795 static void	tcp_connect(tcp_t *tcp, mblk_t *mp);
796 static void	tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp,
797 		    in_port_t dstport, uint_t srcid);
798 static void	tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp,
799 		    in_port_t dstport, uint32_t flowinfo, uint_t srcid,
800 		    uint32_t scope_id);
801 static int	tcp_clean_death(tcp_t *tcp, int err, uint8_t tag);
802 static void	tcp_def_q_set(tcp_t *tcp, mblk_t *mp);
803 static void	tcp_disconnect(tcp_t *tcp, mblk_t *mp);
804 static char	*tcp_display(tcp_t *tcp, char *, char);
805 static boolean_t tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum);
806 static void	tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only);
807 static void	tcp_eager_unlink(tcp_t *tcp);
808 static void	tcp_err_ack(tcp_t *tcp, mblk_t *mp, int tlierr,
809 		    int unixerr);
810 static void	tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive,
811 		    int tlierr, int unixerr);
812 static int	tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp,
813 		    cred_t *cr);
814 static int	tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp,
815 		    char *value, caddr_t cp, cred_t *cr);
816 static int	tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp,
817 		    char *value, caddr_t cp, cred_t *cr);
818 static int	tcp_tpistate(tcp_t *tcp);
819 static void	tcp_bind_hash_insert(tf_t *tf, tcp_t *tcp,
820     int caller_holds_lock);
821 static void	tcp_bind_hash_remove(tcp_t *tcp);
822 static tcp_t	*tcp_acceptor_hash_lookup(t_uscalar_t id);
823 void		tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp);
824 static void	tcp_acceptor_hash_remove(tcp_t *tcp);
825 static void	tcp_capability_req(tcp_t *tcp, mblk_t *mp);
826 static void	tcp_info_req(tcp_t *tcp, mblk_t *mp);
827 static void	tcp_addr_req(tcp_t *tcp, mblk_t *mp);
828 static void	tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *mp);
829 static int	tcp_header_init_ipv4(tcp_t *tcp);
830 static int	tcp_header_init_ipv6(tcp_t *tcp);
831 int		tcp_init(tcp_t *tcp, queue_t *q);
832 static int	tcp_init_values(tcp_t *tcp);
833 static mblk_t	*tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic);
834 static mblk_t	*tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim,
835 		    t_scalar_t addr_length);
836 static void	tcp_ip_ire_mark_advice(tcp_t *tcp);
837 static void	tcp_ip_notify(tcp_t *tcp);
838 static mblk_t	*tcp_ire_mp(mblk_t *mp);
839 static void	tcp_iss_init(tcp_t *tcp);
840 static void	tcp_keepalive_killer(void *arg);
841 static int	tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt);
842 static void	tcp_mss_set(tcp_t *tcp, uint32_t size);
843 static int	tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp,
844 		    int *do_disconnectp, int *t_errorp, int *sys_errorp);
845 static boolean_t tcp_allow_connopt_set(int level, int name);
846 int		tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr);
847 int		tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr);
848 int		tcp_opt_set(queue_t *q, uint_t optset_context, int level,
849 		    int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp,
850 		    uchar_t *outvalp, void *thisdg_attrs, cred_t *cr,
851 		    mblk_t *mblk);
852 static void	tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha);
853 static int	tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly,
854 		    uchar_t *ptr, uint_t len);
855 static int	tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr);
856 static boolean_t tcp_param_register(tcpparam_t *tcppa, int cnt);
857 static int	tcp_param_set(queue_t *q, mblk_t *mp, char *value,
858 		    caddr_t cp, cred_t *cr);
859 static int	tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value,
860 		    caddr_t cp, cred_t *cr);
861 static void	tcp_iss_key_init(uint8_t *phrase, int len);
862 static int	tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value,
863 		    caddr_t cp, cred_t *cr);
864 static void	tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_cnt);
865 static mblk_t	*tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start);
866 static void	tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp);
867 static void	tcp_reinit(tcp_t *tcp);
868 static void	tcp_reinit_values(tcp_t *tcp);
869 static void	tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval,
870 		    tcp_t *thisstream, cred_t *cr);
871 
872 static uint_t	tcp_rcv_drain(queue_t *q, tcp_t *tcp);
873 static void	tcp_sack_rxmit(tcp_t *tcp, uint_t *flags);
874 static boolean_t tcp_send_rst_chk(void);
875 static void	tcp_ss_rexmit(tcp_t *tcp);
876 static mblk_t	*tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp);
877 static void	tcp_process_options(tcp_t *, tcph_t *);
878 static void	tcp_rput_common(tcp_t *tcp, mblk_t *mp);
879 static void	tcp_rsrv(queue_t *q);
880 static int	tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd);
881 static int	tcp_snmp_state(tcp_t *tcp);
882 static int	tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp,
883 		    cred_t *cr);
884 static int	tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp,
885 		    cred_t *cr);
886 static int	tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp,
887 		    cred_t *cr);
888 static int	tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp,
889 		    cred_t *cr);
890 static int	tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp,
891 		    cred_t *cr);
892 static int	tcp_host_param_set(queue_t *q, mblk_t *mp, char *value,
893 		    caddr_t cp, cred_t *cr);
894 static int	tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value,
895 		    caddr_t cp, cred_t *cr);
896 static int	tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp,
897 		    cred_t *cr);
898 static void	tcp_timer(void *arg);
899 static void	tcp_timer_callback(void *);
900 static in_port_t tcp_update_next_port(in_port_t port, const tcp_t *tcp,
901     boolean_t random);
902 static in_port_t tcp_get_next_priv_port(const tcp_t *);
903 static void	tcp_wput_sock(queue_t *q, mblk_t *mp);
904 void		tcp_wput_accept(queue_t *q, mblk_t *mp);
905 static void	tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent);
906 static void	tcp_wput_flush(tcp_t *tcp, mblk_t *mp);
907 static void	tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp);
908 static int	tcp_send(queue_t *q, tcp_t *tcp, const int mss,
909 		    const int tcp_hdr_len, const int tcp_tcp_hdr_len,
910 		    const int num_sack_blk, int *usable, uint_t *snxt,
911 		    int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time,
912 		    const int mdt_thres);
913 static int	tcp_multisend(queue_t *q, tcp_t *tcp, const int mss,
914 		    const int tcp_hdr_len, const int tcp_tcp_hdr_len,
915 		    const int num_sack_blk, int *usable, uint_t *snxt,
916 		    int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time,
917 		    const int mdt_thres);
918 static void	tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now,
919 		    int num_sack_blk);
920 static void	tcp_wsrv(queue_t *q);
921 static int	tcp_xmit_end(tcp_t *tcp);
922 static mblk_t	*tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send,
923 		    int32_t *offset, mblk_t **end_mp, uint32_t seq,
924 		    boolean_t sendall, uint32_t *seg_len, boolean_t rexmit);
925 static void	tcp_ack_timer(void *arg);
926 static mblk_t	*tcp_ack_mp(tcp_t *tcp);
927 static void	tcp_xmit_early_reset(char *str, mblk_t *mp,
928 		    uint32_t seq, uint32_t ack, int ctl, uint_t ip_hdr_len,
929 		    zoneid_t zoneid);
930 static void	tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq,
931 		    uint32_t ack, int ctl);
932 static tcp_hsp_t *tcp_hsp_lookup(ipaddr_t addr);
933 static tcp_hsp_t *tcp_hsp_lookup_ipv6(in6_addr_t *addr);
934 static int	setmaxps(queue_t *q, int maxpsz);
935 static void	tcp_set_rto(tcp_t *, time_t);
936 static boolean_t tcp_check_policy(tcp_t *, mblk_t *, ipha_t *, ip6_t *,
937 		    boolean_t, boolean_t);
938 static void	tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp,
939 		    boolean_t ipsec_mctl);
940 static mblk_t	*tcp_setsockopt_mp(int level, int cmd,
941 		    char *opt, int optlen);
942 static int	tcp_build_hdrs(queue_t *, tcp_t *);
943 static void	tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp,
944 		    uint32_t seg_seq, uint32_t seg_ack, int seg_len,
945 		    tcph_t *tcph);
946 boolean_t	tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp);
947 boolean_t	tcp_reserved_port_add(int, in_port_t *, in_port_t *);
948 boolean_t	tcp_reserved_port_del(in_port_t, in_port_t);
949 boolean_t	tcp_reserved_port_check(in_port_t);
950 static tcp_t	*tcp_alloc_temp_tcp(in_port_t);
951 static int	tcp_reserved_port_list(queue_t *, mblk_t *, caddr_t, cred_t *);
952 static mblk_t	*tcp_mdt_info_mp(mblk_t *);
953 static void	tcp_mdt_update(tcp_t *, ill_mdt_capab_t *, boolean_t);
954 static int	tcp_mdt_add_attrs(multidata_t *, const mblk_t *,
955 		    const boolean_t, const uint32_t, const uint32_t,
956 		    const uint32_t, const uint32_t);
957 static void	tcp_multisend_data(tcp_t *, ire_t *, const ill_t *, mblk_t *,
958 		    const uint_t, const uint_t, boolean_t *);
959 static void	tcp_send_data(tcp_t *, queue_t *, mblk_t *);
960 extern mblk_t	*tcp_timermp_alloc(int);
961 extern void	tcp_timermp_free(tcp_t *);
962 static void	tcp_timer_free(tcp_t *tcp, mblk_t *mp);
963 static void	tcp_stop_lingering(tcp_t *tcp);
964 static void	tcp_close_linger_timeout(void *arg);
965 void		tcp_ddi_init(void);
966 void		tcp_ddi_destroy(void);
967 static void	tcp_kstat_init(void);
968 static void	tcp_kstat_fini(void);
969 static int	tcp_kstat_update(kstat_t *kp, int rw);
970 void		tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp);
971 static int	tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
972 			tcph_t *tcph, uint_t ipvers, mblk_t *idmp);
973 static int	tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha,
974 			tcph_t *tcph, mblk_t *idmp);
975 static squeue_func_t tcp_squeue_switch(int);
976 
977 static int	tcp_open(queue_t *, dev_t *, int, int, cred_t *);
978 static int	tcp_close(queue_t *, int);
979 static int	tcpclose_accept(queue_t *);
980 static int	tcp_modclose(queue_t *);
981 static void	tcp_wput_mod(queue_t *, mblk_t *);
982 
983 static void	tcp_squeue_add(squeue_t *);
984 static boolean_t tcp_zcopy_check(tcp_t *);
985 static void	tcp_zcopy_notify(tcp_t *);
986 static mblk_t	*tcp_zcopy_disable(tcp_t *, mblk_t *);
987 static mblk_t	*tcp_zcopy_backoff(tcp_t *, mblk_t *, int);
988 static void	tcp_ire_ill_check(tcp_t *, ire_t *, ill_t *, boolean_t);
989 
990 extern void	tcp_kssl_input(tcp_t *, mblk_t *);
991 
992 /*
993  * Routines related to the TCP_IOC_ABORT_CONN ioctl command.
994  *
995  * TCP_IOC_ABORT_CONN is a non-transparent ioctl command used for aborting
996  * TCP connections. To invoke this ioctl, a tcp_ioc_abort_conn_t structure
997  * (defined in tcp.h) needs to be filled in and passed into the kernel
998  * via an I_STR ioctl command (see streamio(7I)). The tcp_ioc_abort_conn_t
999  * structure contains the four-tuple of a TCP connection and a range of TCP
1000  * states (specified by ac_start and ac_end). The use of wildcard addresses
1001  * and ports is allowed. Connections with a matching four tuple and a state
1002  * within the specified range will be aborted. The valid states for the
1003  * ac_start and ac_end fields are in the range TCPS_SYN_SENT to TCPS_TIME_WAIT,
1004  * inclusive.
1005  *
1006  * An application which has its connection aborted by this ioctl will receive
1007  * an error that is dependent on the connection state at the time of the abort.
1008  * If the connection state is < TCPS_TIME_WAIT, an application should behave as
1009  * though a RST packet has been received.  If the connection state is equal to
1010  * TCPS_TIME_WAIT, the 2MSL timeout will immediately be canceled by the kernel
1011  * and all resources associated with the connection will be freed.
1012  */
1013 static mblk_t	*tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *, tcp_t *);
1014 static void	tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *);
1015 static void	tcp_ioctl_abort_handler(tcp_t *, mblk_t *);
1016 static int	tcp_ioctl_abort(tcp_ioc_abort_conn_t *);
1017 static void	tcp_ioctl_abort_conn(queue_t *, mblk_t *);
1018 static int	tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *, int, int *,
1019     boolean_t);
1020 
1021 static struct module_info tcp_rinfo =  {
1022 	TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER
1023 };
1024 
1025 static struct module_info tcp_winfo =  {
1026 	TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16
1027 };
1028 
1029 /*
1030  * Entry points for TCP as a module. It only allows SNMP requests
1031  * to pass through.
1032  */
1033 struct qinit tcp_mod_rinit = {
1034 	(pfi_t)putnext, NULL, tcp_open, ip_snmpmod_close, NULL, &tcp_rinfo,
1035 };
1036 
1037 struct qinit tcp_mod_winit = {
1038 	(pfi_t)ip_snmpmod_wput, NULL, tcp_open, ip_snmpmod_close, NULL,
1039 	&tcp_rinfo
1040 };
1041 
1042 /*
1043  * Entry points for TCP as a device. The normal case which supports
1044  * the TCP functionality.
1045  */
1046 struct qinit tcp_rinit = {
1047 	NULL, (pfi_t)tcp_rsrv, tcp_open, tcp_close, NULL, &tcp_rinfo
1048 };
1049 
1050 struct qinit tcp_winit = {
1051 	(pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
1052 };
1053 
1054 /* Initial entry point for TCP in socket mode. */
1055 struct qinit tcp_sock_winit = {
1056 	(pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
1057 };
1058 
1059 /*
1060  * Entry points for TCP as a acceptor STREAM opened by sockfs when doing
1061  * an accept. Avoid allocating data structures since eager has already
1062  * been created.
1063  */
1064 struct qinit tcp_acceptor_rinit = {
1065 	NULL, (pfi_t)tcp_rsrv, NULL, tcpclose_accept, NULL, &tcp_winfo
1066 };
1067 
1068 struct qinit tcp_acceptor_winit = {
1069 	(pfi_t)tcp_wput_accept, NULL, NULL, NULL, NULL, &tcp_winfo
1070 };
1071 
1072 /*
1073  * Entry points for TCP loopback (read side only)
1074  */
1075 struct qinit tcp_loopback_rinit = {
1076 	(pfi_t)0, (pfi_t)tcp_rsrv, tcp_open, tcp_close, (pfi_t)0,
1077 	&tcp_rinfo, NULL, tcp_fuse_rrw, tcp_fuse_rinfop, STRUIOT_STANDARD
1078 };
1079 
1080 struct streamtab tcpinfo = {
1081 	&tcp_rinit, &tcp_winit
1082 };
1083 
1084 extern squeue_func_t tcp_squeue_wput_proc;
1085 extern squeue_func_t tcp_squeue_timer_proc;
1086 
1087 /* Protected by tcp_g_q_lock */
1088 static queue_t	*tcp_g_q;	/* Default queue used during detached closes */
1089 kmutex_t tcp_g_q_lock;
1090 
1091 /* Protected by tcp_hsp_lock */
1092 /*
1093  * XXX The host param mechanism should go away and instead we should use
1094  * the metrics associated with the routes to determine the default sndspace
1095  * and rcvspace.
1096  */
1097 static tcp_hsp_t	**tcp_hsp_hash;	/* Hash table for HSPs */
1098 krwlock_t tcp_hsp_lock;
1099 
1100 /*
1101  * Extra privileged ports. In host byte order.
1102  * Protected by tcp_epriv_port_lock.
1103  */
1104 #define	TCP_NUM_EPRIV_PORTS	64
1105 static int	tcp_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS;
1106 static uint16_t	tcp_g_epriv_ports[TCP_NUM_EPRIV_PORTS] = { 2049, 4045 };
1107 kmutex_t tcp_epriv_port_lock;
1108 
1109 /*
1110  * The smallest anonymous port in the privileged port range which TCP
1111  * looks for free port.  Use in the option TCP_ANONPRIVBIND.
1112  */
1113 static in_port_t tcp_min_anonpriv_port = 512;
1114 
1115 /* Only modified during _init and _fini thus no locking is needed. */
1116 static caddr_t	tcp_g_nd;	/* Head of 'named dispatch' variable list */
1117 
1118 /* Hint not protected by any lock */
1119 static uint_t	tcp_next_port_to_try;
1120 
1121 
1122 /* TCP bind hash list - all tcp_t with state >= BOUND. */
1123 tf_t	tcp_bind_fanout[TCP_BIND_FANOUT_SIZE];
1124 
1125 /* TCP queue hash list - all tcp_t in case they will be an acceptor. */
1126 static tf_t	tcp_acceptor_fanout[TCP_FANOUT_SIZE];
1127 
1128 /*
1129  * TCP has a private interface for other kernel modules to reserve a
1130  * port range for them to use.  Once reserved, TCP will not use any ports
1131  * in the range.  This interface relies on the TCP_EXCLBIND feature.  If
1132  * the semantics of TCP_EXCLBIND is changed, implementation of this interface
1133  * has to be verified.
1134  *
1135  * There can be TCP_RESERVED_PORTS_ARRAY_MAX_SIZE port ranges.  Each port
1136  * range can cover at most TCP_RESERVED_PORTS_RANGE_MAX ports.  A port
1137  * range is [port a, port b] inclusive.  And each port range is between
1138  * TCP_LOWESET_RESERVED_PORT and TCP_LARGEST_RESERVED_PORT inclusive.
1139  *
1140  * Note that the default anonymous port range starts from 32768.  There is
1141  * no port "collision" between that and the reserved port range.  If there
1142  * is port collision (because the default smallest anonymous port is lowered
1143  * or some apps specifically bind to ports in the reserved port range), the
1144  * system may not be able to reserve a port range even there are enough
1145  * unbound ports as a reserved port range contains consecutive ports .
1146  */
1147 #define	TCP_RESERVED_PORTS_ARRAY_MAX_SIZE	5
1148 #define	TCP_RESERVED_PORTS_RANGE_MAX		1000
1149 #define	TCP_SMALLEST_RESERVED_PORT		10240
1150 #define	TCP_LARGEST_RESERVED_PORT		20480
1151 
1152 /* Structure to represent those reserved port ranges. */
1153 typedef struct tcp_rport_s {
1154 	in_port_t	lo_port;
1155 	in_port_t	hi_port;
1156 	tcp_t		**temp_tcp_array;
1157 } tcp_rport_t;
1158 
1159 /* The reserved port array. */
1160 static tcp_rport_t tcp_reserved_port[TCP_RESERVED_PORTS_ARRAY_MAX_SIZE];
1161 
1162 /* Locks to protect the tcp_reserved_ports array. */
1163 static krwlock_t tcp_reserved_port_lock;
1164 
1165 /* The number of ranges in the array. */
1166 uint32_t tcp_reserved_port_array_size = 0;
1167 
1168 /*
1169  * MIB-2 stuff for SNMP
1170  * Note: tcpInErrs {tcp 15} is accumulated in ip.c
1171  */
1172 mib2_tcp_t	tcp_mib;	/* SNMP fixed size info */
1173 kstat_t		*tcp_mibkp;	/* kstat exporting tcp_mib data */
1174 
1175 boolean_t tcp_icmp_source_quench = B_FALSE;
1176 /*
1177  * Following assumes TPI alignment requirements stay along 32 bit
1178  * boundaries
1179  */
1180 #define	ROUNDUP32(x) \
1181 	(((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1))
1182 
1183 /* Template for response to info request. */
1184 static struct T_info_ack tcp_g_t_info_ack = {
1185 	T_INFO_ACK,		/* PRIM_type */
1186 	0,			/* TSDU_size */
1187 	T_INFINITE,		/* ETSDU_size */
1188 	T_INVALID,		/* CDATA_size */
1189 	T_INVALID,		/* DDATA_size */
1190 	sizeof (sin_t),		/* ADDR_size */
1191 	0,			/* OPT_size - not initialized here */
1192 	TIDUSZ,			/* TIDU_size */
1193 	T_COTS_ORD,		/* SERV_type */
1194 	TCPS_IDLE,		/* CURRENT_state */
1195 	(XPG4_1|EXPINLINE)	/* PROVIDER_flag */
1196 };
1197 
1198 static struct T_info_ack tcp_g_t_info_ack_v6 = {
1199 	T_INFO_ACK,		/* PRIM_type */
1200 	0,			/* TSDU_size */
1201 	T_INFINITE,		/* ETSDU_size */
1202 	T_INVALID,		/* CDATA_size */
1203 	T_INVALID,		/* DDATA_size */
1204 	sizeof (sin6_t),	/* ADDR_size */
1205 	0,			/* OPT_size - not initialized here */
1206 	TIDUSZ,		/* TIDU_size */
1207 	T_COTS_ORD,		/* SERV_type */
1208 	TCPS_IDLE,		/* CURRENT_state */
1209 	(XPG4_1|EXPINLINE)	/* PROVIDER_flag */
1210 };
1211 
1212 #define	MS	1L
1213 #define	SECONDS	(1000 * MS)
1214 #define	MINUTES	(60 * SECONDS)
1215 #define	HOURS	(60 * MINUTES)
1216 #define	DAYS	(24 * HOURS)
1217 
1218 #define	PARAM_MAX (~(uint32_t)0)
1219 
1220 /* Max size IP datagram is 64k - 1 */
1221 #define	TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (ipha_t) + sizeof (tcph_t)))
1222 #define	TCP_MSS_MAX_IPV6 (IP_MAXPACKET - (sizeof (ip6_t) + sizeof (tcph_t)))
1223 /* Max of the above */
1224 #define	TCP_MSS_MAX	TCP_MSS_MAX_IPV4
1225 
1226 /* Largest TCP port number */
1227 #define	TCP_MAX_PORT	(64 * 1024 - 1)
1228 
1229 /*
1230  * tcp_wroff_xtra is the extra space in front of TCP/IP header for link
1231  * layer header.  It has to be a multiple of 4.
1232  */
1233 static tcpparam_t tcp_wroff_xtra_param = { 0, 256, 32, "tcp_wroff_xtra" };
1234 #define	tcp_wroff_xtra	tcp_wroff_xtra_param.tcp_param_val
1235 
1236 /*
1237  * All of these are alterable, within the min/max values given, at run time.
1238  * Note that the default value of "tcp_time_wait_interval" is four minutes,
1239  * per the TCP spec.
1240  */
1241 /* BEGIN CSTYLED */
1242 tcpparam_t	tcp_param_arr[] = {
1243  /*min		max		value		name */
1244  { 1*SECONDS,	10*MINUTES,	1*MINUTES,	"tcp_time_wait_interval"},
1245  { 1,		PARAM_MAX,	128,		"tcp_conn_req_max_q" },
1246  { 0,		PARAM_MAX,	1024,		"tcp_conn_req_max_q0" },
1247  { 1,		1024,		1,		"tcp_conn_req_min" },
1248  { 0*MS,	20*SECONDS,	0*MS,		"tcp_conn_grace_period" },
1249  { 128,		(1<<30),	1024*1024,	"tcp_cwnd_max" },
1250  { 0,		10,		0,		"tcp_debug" },
1251  { 1024,	(32*1024),	1024,		"tcp_smallest_nonpriv_port"},
1252  { 1*SECONDS,	PARAM_MAX,	3*MINUTES,	"tcp_ip_abort_cinterval"},
1253  { 1*SECONDS,	PARAM_MAX,	3*MINUTES,	"tcp_ip_abort_linterval"},
1254  { 500*MS,	PARAM_MAX,	8*MINUTES,	"tcp_ip_abort_interval"},
1255  { 1*SECONDS,	PARAM_MAX,	10*SECONDS,	"tcp_ip_notify_cinterval"},
1256  { 500*MS,	PARAM_MAX,	10*SECONDS,	"tcp_ip_notify_interval"},
1257  { 1,		255,		64,		"tcp_ipv4_ttl"},
1258  { 10*SECONDS,	10*DAYS,	2*HOURS,	"tcp_keepalive_interval"},
1259  { 0,		100,		10,		"tcp_maxpsz_multiplier" },
1260  { 1,		TCP_MSS_MAX_IPV4, 536,		"tcp_mss_def_ipv4"},
1261  { 1,		TCP_MSS_MAX_IPV4, TCP_MSS_MAX_IPV4, "tcp_mss_max_ipv4"},
1262  { 1,		TCP_MSS_MAX,	108,		"tcp_mss_min"},
1263  { 1,		(64*1024)-1,	(4*1024)-1,	"tcp_naglim_def"},
1264  { 1*MS,	20*SECONDS,	3*SECONDS,	"tcp_rexmit_interval_initial"},
1265  { 1*MS,	2*HOURS,	60*SECONDS,	"tcp_rexmit_interval_max"},
1266  { 1*MS,	2*HOURS,	400*MS,		"tcp_rexmit_interval_min"},
1267  { 1*MS,	1*MINUTES,	100*MS,		"tcp_deferred_ack_interval" },
1268  { 0,		16,		0,		"tcp_snd_lowat_fraction" },
1269  { 0,		128000,		0,		"tcp_sth_rcv_hiwat" },
1270  { 0,		128000,		0,		"tcp_sth_rcv_lowat" },
1271  { 1,		10000,		3,		"tcp_dupack_fast_retransmit" },
1272  { 0,		1,		0,		"tcp_ignore_path_mtu" },
1273  { 1024,	TCP_MAX_PORT,	32*1024,	"tcp_smallest_anon_port"},
1274  { 1024,	TCP_MAX_PORT,	TCP_MAX_PORT,	"tcp_largest_anon_port"},
1275  { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_HIWATER,"tcp_xmit_hiwat"},
1276  { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_LOWATER,"tcp_xmit_lowat"},
1277  { TCP_RECV_LOWATER, (1<<30), TCP_RECV_HIWATER,"tcp_recv_hiwat"},
1278  { 1,		65536,		4,		"tcp_recv_hiwat_minmss"},
1279  { 1*SECONDS,	PARAM_MAX,	675*SECONDS,	"tcp_fin_wait_2_flush_interval"},
1280  { 0,		TCP_MSS_MAX,	64,		"tcp_co_min"},
1281  { 8192,	(1<<30),	1024*1024,	"tcp_max_buf"},
1282 /*
1283  * Question:  What default value should I set for tcp_strong_iss?
1284  */
1285  { 0,		2,		1,		"tcp_strong_iss"},
1286  { 0,		65536,		20,		"tcp_rtt_updates"},
1287  { 0,		1,		1,		"tcp_wscale_always"},
1288  { 0,		1,		0,		"tcp_tstamp_always"},
1289  { 0,		1,		1,		"tcp_tstamp_if_wscale"},
1290  { 0*MS,	2*HOURS,	0*MS,		"tcp_rexmit_interval_extra"},
1291  { 0,		16,		2,		"tcp_deferred_acks_max"},
1292  { 1,		16384,		4,		"tcp_slow_start_after_idle"},
1293  { 1,		4,		4,		"tcp_slow_start_initial"},
1294  { 10*MS,	50*MS,		20*MS,		"tcp_co_timer_interval"},
1295  { 0,		2,		2,		"tcp_sack_permitted"},
1296  { 0,		1,		0,		"tcp_trace"},
1297  { 0,		1,		1,		"tcp_compression_enabled"},
1298  { 0,		IPV6_MAX_HOPS,	IPV6_DEFAULT_HOPS,	"tcp_ipv6_hoplimit"},
1299  { 1,		TCP_MSS_MAX_IPV6, 1220,		"tcp_mss_def_ipv6"},
1300  { 1,		TCP_MSS_MAX_IPV6, TCP_MSS_MAX_IPV6, "tcp_mss_max_ipv6"},
1301  { 0,		1,		0,		"tcp_rev_src_routes"},
1302  { 10*MS,	500*MS,		50*MS,		"tcp_local_dack_interval"},
1303  { 100*MS,	60*SECONDS,	1*SECONDS,	"tcp_ndd_get_info_interval"},
1304  { 0,		16,		8,		"tcp_local_dacks_max"},
1305  { 0,		2,		1,		"tcp_ecn_permitted"},
1306  { 0,		1,		1,		"tcp_rst_sent_rate_enabled"},
1307  { 0,		PARAM_MAX,	40,		"tcp_rst_sent_rate"},
1308  { 0,		100*MS,		50*MS,		"tcp_push_timer_interval"},
1309  { 0,		1,		0,		"tcp_use_smss_as_mss_opt"},
1310  { 0,		PARAM_MAX,	8*MINUTES,	"tcp_keepalive_abort_interval"},
1311 };
1312 /* END CSTYLED */
1313 
1314 /*
1315  * tcp_mdt_hdr_{head,tail}_min are the leading and trailing spaces of
1316  * each header fragment in the header buffer.  Each parameter value has
1317  * to be a multiple of 4 (32-bit aligned).
1318  */
1319 static tcpparam_t tcp_mdt_head_param = { 32, 256, 32, "tcp_mdt_hdr_head_min" };
1320 static tcpparam_t tcp_mdt_tail_param = { 0,  256, 32, "tcp_mdt_hdr_tail_min" };
1321 #define	tcp_mdt_hdr_head_min	tcp_mdt_head_param.tcp_param_val
1322 #define	tcp_mdt_hdr_tail_min	tcp_mdt_tail_param.tcp_param_val
1323 
1324 /*
1325  * tcp_mdt_max_pbufs is the upper limit value that tcp uses to figure out
1326  * the maximum number of payload buffers associated per Multidata.
1327  */
1328 static tcpparam_t tcp_mdt_max_pbufs_param =
1329 	{ 1, MULTIDATA_MAX_PBUFS, MULTIDATA_MAX_PBUFS, "tcp_mdt_max_pbufs" };
1330 #define	tcp_mdt_max_pbufs	tcp_mdt_max_pbufs_param.tcp_param_val
1331 
1332 /* Round up the value to the nearest mss. */
1333 #define	MSS_ROUNDUP(value, mss)		((((value) - 1) / (mss) + 1) * (mss))
1334 
1335 /*
1336  * Set ECN capable transport (ECT) code point in IP header.
1337  *
1338  * Note that there are 2 ECT code points '01' and '10', which are called
1339  * ECT(1) and ECT(0) respectively.  Here we follow the original ECT code
1340  * point ECT(0) for TCP as described in RFC 2481.
1341  */
1342 #define	SET_ECT(tcp, iph) \
1343 	if ((tcp)->tcp_ipversion == IPV4_VERSION) { \
1344 		/* We need to clear the code point first. */ \
1345 		((ipha_t *)(iph))->ipha_type_of_service &= 0xFC; \
1346 		((ipha_t *)(iph))->ipha_type_of_service |= IPH_ECN_ECT0; \
1347 	} else { \
1348 		((ip6_t *)(iph))->ip6_vcf &= htonl(0xFFCFFFFF); \
1349 		((ip6_t *)(iph))->ip6_vcf |= htonl(IPH_ECN_ECT0 << 20); \
1350 	}
1351 
1352 /*
1353  * The format argument to pass to tcp_display().
1354  * DISP_PORT_ONLY means that the returned string has only port info.
1355  * DISP_ADDR_AND_PORT means that the returned string also contains the
1356  * remote and local IP address.
1357  */
1358 #define	DISP_PORT_ONLY		1
1359 #define	DISP_ADDR_AND_PORT	2
1360 
1361 /*
1362  * This controls the rate some ndd info report functions can be used
1363  * by non-privileged users.  It stores the last time such info is
1364  * requested.  When those report functions are called again, this
1365  * is checked with the current time and compare with the ndd param
1366  * tcp_ndd_get_info_interval.
1367  */
1368 static clock_t tcp_last_ndd_get_info_time = 0;
1369 #define	NDD_TOO_QUICK_MSG \
1370 	"ndd get info rate too high for non-privileged users, try again " \
1371 	"later.\n"
1372 #define	NDD_OUT_OF_BUF_MSG	"<< Out of buffer >>\n"
1373 
1374 #define	IS_VMLOANED_MBLK(mp) \
1375 	(((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0)
1376 
1377 /*
1378  * These two variables control the rate for TCP to generate RSTs in
1379  * response to segments not belonging to any connections.  We limit
1380  * TCP to sent out tcp_rst_sent_rate (ndd param) number of RSTs in
1381  * each 1 second interval.  This is to protect TCP against DoS attack.
1382  */
1383 static clock_t tcp_last_rst_intrvl;
1384 static uint32_t tcp_rst_cnt;
1385 
1386 /* The number of RST not sent because of the rate limit. */
1387 static uint32_t tcp_rst_unsent;
1388 
1389 /* Enable or disable b_cont M_MULTIDATA chaining for MDT. */
1390 boolean_t tcp_mdt_chain = B_TRUE;
1391 
1392 /*
1393  * MDT threshold in the form of effective send MSS multiplier; we take
1394  * the MDT path if the amount of unsent data exceeds the threshold value
1395  * (default threshold is 1*SMSS).
1396  */
1397 uint_t tcp_mdt_smss_threshold = 1;
1398 
1399 uint32_t do_tcpzcopy = 1;		/* 0: disable, 1: enable, 2: force */
1400 
1401 /*
1402  * Forces all connections to obey the value of the tcp_maxpsz_multiplier
1403  * tunable settable via NDD.  Otherwise, the per-connection behavior is
1404  * determined dynamically during tcp_adapt_ire(), which is the default.
1405  */
1406 boolean_t tcp_static_maxpsz = B_FALSE;
1407 
1408 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */
1409 uint32_t tcp_random_anon_port = 1;
1410 
1411 /*
1412  * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
1413  * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
1414  * data, TCP will not respond with an ACK.  RFC 793 requires that
1415  * TCP responds with an ACK for such a bogus ACK.  By not following
1416  * the RFC, we prevent TCP from getting into an ACK storm if somehow
1417  * an attacker successfully spoofs an acceptable segment to our
1418  * peer; or when our peer is "confused."
1419  */
1420 uint32_t tcp_drop_ack_unsent_cnt = 10;
1421 
1422 /*
1423  * Hook functions to enable cluster networking
1424  * On non-clustered systems these vectors must always be NULL.
1425  */
1426 
1427 void (*cl_inet_listen)(uint8_t protocol, sa_family_t addr_family,
1428 			    uint8_t *laddrp, in_port_t lport) = NULL;
1429 void (*cl_inet_unlisten)(uint8_t protocol, sa_family_t addr_family,
1430 			    uint8_t *laddrp, in_port_t lport) = NULL;
1431 void (*cl_inet_connect)(uint8_t protocol, sa_family_t addr_family,
1432 			    uint8_t *laddrp, in_port_t lport,
1433 			    uint8_t *faddrp, in_port_t fport) = NULL;
1434 void (*cl_inet_disconnect)(uint8_t protocol, sa_family_t addr_family,
1435 			    uint8_t *laddrp, in_port_t lport,
1436 			    uint8_t *faddrp, in_port_t fport) = NULL;
1437 
1438 /*
1439  * The following are defined in ip.c
1440  */
1441 extern int (*cl_inet_isclusterwide)(uint8_t protocol, sa_family_t addr_family,
1442 				uint8_t *laddrp);
1443 extern uint32_t (*cl_inet_ipident)(uint8_t protocol, sa_family_t addr_family,
1444 				uint8_t *laddrp, uint8_t *faddrp);
1445 
1446 #define	CL_INET_CONNECT(tcp)		{			\
1447 	if (cl_inet_connect != NULL) {				\
1448 		/*						\
1449 		 * Running in cluster mode - register active connection	\
1450 		 * information						\
1451 		 */							\
1452 		if ((tcp)->tcp_ipversion == IPV4_VERSION) {		\
1453 			if ((tcp)->tcp_ipha->ipha_src != 0) {		\
1454 				(*cl_inet_connect)(IPPROTO_TCP, AF_INET,\
1455 				    (uint8_t *)(&((tcp)->tcp_ipha->ipha_src)),\
1456 				    (in_port_t)(tcp)->tcp_lport,	\
1457 				    (uint8_t *)(&((tcp)->tcp_ipha->ipha_dst)),\
1458 				    (in_port_t)(tcp)->tcp_fport);	\
1459 			}						\
1460 		} else {						\
1461 			if (!IN6_IS_ADDR_UNSPECIFIED(			\
1462 			    &(tcp)->tcp_ip6h->ip6_src)) {\
1463 				(*cl_inet_connect)(IPPROTO_TCP, AF_INET6,\
1464 				    (uint8_t *)(&((tcp)->tcp_ip6h->ip6_src)),\
1465 				    (in_port_t)(tcp)->tcp_lport,	\
1466 				    (uint8_t *)(&((tcp)->tcp_ip6h->ip6_dst)),\
1467 				    (in_port_t)(tcp)->tcp_fport);	\
1468 			}						\
1469 		}							\
1470 	}								\
1471 }
1472 
1473 #define	CL_INET_DISCONNECT(tcp)	{				\
1474 	if (cl_inet_disconnect != NULL) {				\
1475 		/*							\
1476 		 * Running in cluster mode - deregister active		\
1477 		 * connection information				\
1478 		 */							\
1479 		if ((tcp)->tcp_ipversion == IPV4_VERSION) {		\
1480 			if ((tcp)->tcp_ip_src != 0) {			\
1481 				(*cl_inet_disconnect)(IPPROTO_TCP,	\
1482 				    AF_INET,				\
1483 				    (uint8_t *)(&((tcp)->tcp_ip_src)),\
1484 				    (in_port_t)(tcp)->tcp_lport,	\
1485 				    (uint8_t *)				\
1486 				    (&((tcp)->tcp_ipha->ipha_dst)),\
1487 				    (in_port_t)(tcp)->tcp_fport);	\
1488 			}						\
1489 		} else {						\
1490 			if (!IN6_IS_ADDR_UNSPECIFIED(			\
1491 			    &(tcp)->tcp_ip_src_v6)) {			\
1492 				(*cl_inet_disconnect)(IPPROTO_TCP, AF_INET6,\
1493 				    (uint8_t *)(&((tcp)->tcp_ip_src_v6)),\
1494 				    (in_port_t)(tcp)->tcp_lport,	\
1495 				    (uint8_t *)				\
1496 				    (&((tcp)->tcp_ip6h->ip6_dst)),\
1497 				    (in_port_t)(tcp)->tcp_fport);	\
1498 			}						\
1499 		}							\
1500 	}								\
1501 }
1502 
1503 /*
1504  * Cluster networking hook for traversing current connection list.
1505  * This routine is used to extract the current list of live connections
1506  * which must continue to to be dispatched to this node.
1507  */
1508 int cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg);
1509 
1510 /*
1511  * Figure out the value of window scale opton.  Note that the rwnd is
1512  * ASSUMED to be rounded up to the nearest MSS before the calculation.
1513  * We cannot find the scale value and then do a round up of tcp_rwnd
1514  * because the scale value may not be correct after that.
1515  *
1516  * Set the compiler flag to make this function inline.
1517  */
1518 static void
1519 tcp_set_ws_value(tcp_t *tcp)
1520 {
1521 	int i;
1522 	uint32_t rwnd = tcp->tcp_rwnd;
1523 
1524 	for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT;
1525 	    i++, rwnd >>= 1)
1526 		;
1527 	tcp->tcp_rcv_ws = i;
1528 }
1529 
1530 /*
1531  * Remove a connection from the list of detached TIME_WAIT connections.
1532  */
1533 static void
1534 tcp_time_wait_remove(tcp_t *tcp, tcp_squeue_priv_t *tcp_time_wait)
1535 {
1536 	boolean_t	locked = B_FALSE;
1537 
1538 	if (tcp_time_wait == NULL) {
1539 		tcp_time_wait = *((tcp_squeue_priv_t **)
1540 		    squeue_getprivate(tcp->tcp_connp->conn_sqp, SQPRIVATE_TCP));
1541 		mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
1542 		locked = B_TRUE;
1543 	}
1544 
1545 	if (tcp->tcp_time_wait_expire == 0) {
1546 		ASSERT(tcp->tcp_time_wait_next == NULL);
1547 		ASSERT(tcp->tcp_time_wait_prev == NULL);
1548 		if (locked)
1549 			mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1550 		return;
1551 	}
1552 	ASSERT(TCP_IS_DETACHED(tcp));
1553 	ASSERT(tcp->tcp_state == TCPS_TIME_WAIT);
1554 
1555 	if (tcp == tcp_time_wait->tcp_time_wait_head) {
1556 		ASSERT(tcp->tcp_time_wait_prev == NULL);
1557 		tcp_time_wait->tcp_time_wait_head = tcp->tcp_time_wait_next;
1558 		if (tcp_time_wait->tcp_time_wait_head != NULL) {
1559 			tcp_time_wait->tcp_time_wait_head->tcp_time_wait_prev =
1560 			    NULL;
1561 		} else {
1562 			tcp_time_wait->tcp_time_wait_tail = NULL;
1563 		}
1564 	} else if (tcp == tcp_time_wait->tcp_time_wait_tail) {
1565 		ASSERT(tcp != tcp_time_wait->tcp_time_wait_head);
1566 		ASSERT(tcp->tcp_time_wait_next == NULL);
1567 		tcp_time_wait->tcp_time_wait_tail = tcp->tcp_time_wait_prev;
1568 		ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL);
1569 		tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = NULL;
1570 	} else {
1571 		ASSERT(tcp->tcp_time_wait_prev->tcp_time_wait_next == tcp);
1572 		ASSERT(tcp->tcp_time_wait_next->tcp_time_wait_prev == tcp);
1573 		tcp->tcp_time_wait_prev->tcp_time_wait_next =
1574 		    tcp->tcp_time_wait_next;
1575 		tcp->tcp_time_wait_next->tcp_time_wait_prev =
1576 		    tcp->tcp_time_wait_prev;
1577 	}
1578 	tcp->tcp_time_wait_next = NULL;
1579 	tcp->tcp_time_wait_prev = NULL;
1580 	tcp->tcp_time_wait_expire = 0;
1581 
1582 	if (locked)
1583 		mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1584 }
1585 
1586 /*
1587  * Add a connection to the list of detached TIME_WAIT connections
1588  * and set its time to expire.
1589  */
1590 static void
1591 tcp_time_wait_append(tcp_t *tcp)
1592 {
1593 	tcp_squeue_priv_t *tcp_time_wait =
1594 	    *((tcp_squeue_priv_t **)squeue_getprivate(tcp->tcp_connp->conn_sqp,
1595 		SQPRIVATE_TCP));
1596 
1597 	tcp_timers_stop(tcp);
1598 
1599 	/* Freed above */
1600 	ASSERT(tcp->tcp_timer_tid == 0);
1601 	ASSERT(tcp->tcp_ack_tid == 0);
1602 
1603 	/* must have happened at the time of detaching the tcp */
1604 	ASSERT(tcp->tcp_ptpahn == NULL);
1605 	ASSERT(tcp->tcp_flow_stopped == 0);
1606 	ASSERT(tcp->tcp_time_wait_next == NULL);
1607 	ASSERT(tcp->tcp_time_wait_prev == NULL);
1608 	ASSERT(tcp->tcp_time_wait_expire == NULL);
1609 	ASSERT(tcp->tcp_listener == NULL);
1610 
1611 	tcp->tcp_time_wait_expire = ddi_get_lbolt();
1612 	/*
1613 	 * The value computed below in tcp->tcp_time_wait_expire may
1614 	 * appear negative or wrap around. That is ok since our
1615 	 * interest is only in the difference between the current lbolt
1616 	 * value and tcp->tcp_time_wait_expire. But the value should not
1617 	 * be zero, since it means the tcp is not in the TIME_WAIT list.
1618 	 * The corresponding comparison in tcp_time_wait_collector() uses
1619 	 * modular arithmetic.
1620 	 */
1621 	tcp->tcp_time_wait_expire +=
1622 	    drv_usectohz(tcp_time_wait_interval * 1000);
1623 	if (tcp->tcp_time_wait_expire == 0)
1624 		tcp->tcp_time_wait_expire = 1;
1625 
1626 	ASSERT(TCP_IS_DETACHED(tcp));
1627 	ASSERT(tcp->tcp_state == TCPS_TIME_WAIT);
1628 	ASSERT(tcp->tcp_time_wait_next == NULL);
1629 	ASSERT(tcp->tcp_time_wait_prev == NULL);
1630 	TCP_DBGSTAT(tcp_time_wait);
1631 	mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
1632 	if (tcp_time_wait->tcp_time_wait_head == NULL) {
1633 		ASSERT(tcp_time_wait->tcp_time_wait_tail == NULL);
1634 		tcp_time_wait->tcp_time_wait_head = tcp;
1635 	} else {
1636 		ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL);
1637 		ASSERT(tcp_time_wait->tcp_time_wait_tail->tcp_state ==
1638 		    TCPS_TIME_WAIT);
1639 		tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = tcp;
1640 		tcp->tcp_time_wait_prev = tcp_time_wait->tcp_time_wait_tail;
1641 	}
1642 	tcp_time_wait->tcp_time_wait_tail = tcp;
1643 	mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1644 }
1645 
1646 /* ARGSUSED */
1647 void
1648 tcp_timewait_output(void *arg, mblk_t *mp, void *arg2)
1649 {
1650 	conn_t	*connp = (conn_t *)arg;
1651 	tcp_t	*tcp = connp->conn_tcp;
1652 
1653 	ASSERT(tcp != NULL);
1654 	if (tcp->tcp_state == TCPS_CLOSED) {
1655 		return;
1656 	}
1657 
1658 	ASSERT((tcp->tcp_family == AF_INET &&
1659 	    tcp->tcp_ipversion == IPV4_VERSION) ||
1660 	    (tcp->tcp_family == AF_INET6 &&
1661 	    (tcp->tcp_ipversion == IPV4_VERSION ||
1662 	    tcp->tcp_ipversion == IPV6_VERSION)));
1663 	ASSERT(!tcp->tcp_listener);
1664 
1665 	TCP_STAT(tcp_time_wait_reap);
1666 	ASSERT(TCP_IS_DETACHED(tcp));
1667 
1668 	/*
1669 	 * Because they have no upstream client to rebind or tcp_close()
1670 	 * them later, we axe the connection here and now.
1671 	 */
1672 	tcp_close_detached(tcp);
1673 }
1674 
1675 void
1676 tcp_cleanup(tcp_t *tcp)
1677 {
1678 	mblk_t		*mp;
1679 	char		*tcp_iphc;
1680 	int		tcp_iphc_len;
1681 	int		tcp_hdr_grown;
1682 	tcp_sack_info_t	*tcp_sack_info;
1683 	conn_t		*connp = tcp->tcp_connp;
1684 
1685 	tcp_bind_hash_remove(tcp);
1686 	tcp_free(tcp);
1687 
1688 	/* Release any SSL context */
1689 	if (tcp->tcp_kssl_ent != NULL) {
1690 		kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY);
1691 		tcp->tcp_kssl_ent = NULL;
1692 	}
1693 
1694 	if (tcp->tcp_kssl_ctx != NULL) {
1695 		kssl_release_ctx(tcp->tcp_kssl_ctx);
1696 		tcp->tcp_kssl_ctx = NULL;
1697 	}
1698 	tcp->tcp_kssl_pending = B_FALSE;
1699 
1700 	conn_delete_ire(connp, NULL);
1701 	if (connp->conn_flags & IPCL_TCPCONN) {
1702 		if (connp->conn_latch != NULL)
1703 			IPLATCH_REFRELE(connp->conn_latch);
1704 		if (connp->conn_policy != NULL)
1705 			IPPH_REFRELE(connp->conn_policy);
1706 	}
1707 
1708 	/*
1709 	 * Since we will bzero the entire structure, we need to
1710 	 * remove it and reinsert it in global hash list. We
1711 	 * know the walkers can't get to this conn because we
1712 	 * had set CONDEMNED flag earlier and checked reference
1713 	 * under conn_lock so walker won't pick it and when we
1714 	 * go the ipcl_globalhash_remove() below, no walker
1715 	 * can get to it.
1716 	 */
1717 	ipcl_globalhash_remove(connp);
1718 
1719 	/* Save some state */
1720 	mp = tcp->tcp_timercache;
1721 
1722 	tcp_sack_info = tcp->tcp_sack_info;
1723 	tcp_iphc = tcp->tcp_iphc;
1724 	tcp_iphc_len = tcp->tcp_iphc_len;
1725 	tcp_hdr_grown = tcp->tcp_hdr_grown;
1726 
1727 	if (connp->conn_cred != NULL)
1728 		crfree(connp->conn_cred);
1729 	if (connp->conn_peercred != NULL)
1730 		crfree(connp->conn_peercred);
1731 	bzero(connp, sizeof (conn_t));
1732 	bzero(tcp, sizeof (tcp_t));
1733 
1734 	/* restore the state */
1735 	tcp->tcp_timercache = mp;
1736 
1737 	tcp->tcp_sack_info = tcp_sack_info;
1738 	tcp->tcp_iphc = tcp_iphc;
1739 	tcp->tcp_iphc_len = tcp_iphc_len;
1740 	tcp->tcp_hdr_grown = tcp_hdr_grown;
1741 
1742 
1743 	tcp->tcp_connp = connp;
1744 
1745 	connp->conn_tcp = tcp;
1746 	connp->conn_flags = IPCL_TCPCONN;
1747 	connp->conn_state_flags = CONN_INCIPIENT;
1748 	connp->conn_ulp = IPPROTO_TCP;
1749 	connp->conn_ref = 1;
1750 
1751 	ipcl_globalhash_insert(connp);
1752 }
1753 
1754 /*
1755  * Blows away all tcps whose TIME_WAIT has expired. List traversal
1756  * is done forwards from the head.
1757  */
1758 /* ARGSUSED */
1759 void
1760 tcp_time_wait_collector(void *arg)
1761 {
1762 	tcp_t *tcp;
1763 	clock_t now;
1764 	mblk_t *mp;
1765 	conn_t *connp;
1766 	kmutex_t *lock;
1767 
1768 	squeue_t *sqp = (squeue_t *)arg;
1769 	tcp_squeue_priv_t *tcp_time_wait =
1770 	    *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP));
1771 
1772 	mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
1773 	tcp_time_wait->tcp_time_wait_tid = 0;
1774 
1775 	if (tcp_time_wait->tcp_free_list != NULL &&
1776 	    tcp_time_wait->tcp_free_list->tcp_in_free_list == B_TRUE) {
1777 		TCP_STAT(tcp_freelist_cleanup);
1778 		while ((tcp = tcp_time_wait->tcp_free_list) != NULL) {
1779 			tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next;
1780 			CONN_DEC_REF(tcp->tcp_connp);
1781 		}
1782 		tcp_time_wait->tcp_free_list_cnt = 0;
1783 	}
1784 
1785 	/*
1786 	 * In order to reap time waits reliably, we should use a
1787 	 * source of time that is not adjustable by the user -- hence
1788 	 * the call to ddi_get_lbolt().
1789 	 */
1790 	now = ddi_get_lbolt();
1791 	while ((tcp = tcp_time_wait->tcp_time_wait_head) != NULL) {
1792 		/*
1793 		 * Compare times using modular arithmetic, since
1794 		 * lbolt can wrapover.
1795 		 */
1796 		if ((now - tcp->tcp_time_wait_expire) < 0) {
1797 			break;
1798 		}
1799 
1800 		tcp_time_wait_remove(tcp, tcp_time_wait);
1801 
1802 		connp = tcp->tcp_connp;
1803 		ASSERT(connp->conn_fanout != NULL);
1804 		lock = &connp->conn_fanout->connf_lock;
1805 		/*
1806 		 * This is essentially a TW reclaim fast path optimization for
1807 		 * performance where the timewait collector checks under the
1808 		 * fanout lock (so that no one else can get access to the
1809 		 * conn_t) that the refcnt is 2 i.e. one for TCP and one for
1810 		 * the classifier hash list. If ref count is indeed 2, we can
1811 		 * just remove the conn under the fanout lock and avoid
1812 		 * cleaning up the conn under the squeue, provided that
1813 		 * clustering callbacks are not enabled. If clustering is
1814 		 * enabled, we need to make the clustering callback before
1815 		 * setting the CONDEMNED flag and after dropping all locks and
1816 		 * so we forego this optimization and fall back to the slow
1817 		 * path. Also please see the comments in tcp_closei_local
1818 		 * regarding the refcnt logic.
1819 		 *
1820 		 * Since we are holding the tcp_time_wait_lock, its better
1821 		 * not to block on the fanout_lock because other connections
1822 		 * can't add themselves to time_wait list. So we do a
1823 		 * tryenter instead of mutex_enter.
1824 		 */
1825 		if (mutex_tryenter(lock)) {
1826 			mutex_enter(&connp->conn_lock);
1827 			if ((connp->conn_ref == 2) &&
1828 			    (cl_inet_disconnect == NULL)) {
1829 				ipcl_hash_remove_locked(connp,
1830 				    connp->conn_fanout);
1831 				/*
1832 				 * Set the CONDEMNED flag now itself so that
1833 				 * the refcnt cannot increase due to any
1834 				 * walker. But we have still not cleaned up
1835 				 * conn_ire_cache. This is still ok since
1836 				 * we are going to clean it up in tcp_cleanup
1837 				 * immediately and any interface unplumb
1838 				 * thread will wait till the ire is blown away
1839 				 */
1840 				connp->conn_state_flags |= CONN_CONDEMNED;
1841 				mutex_exit(lock);
1842 				mutex_exit(&connp->conn_lock);
1843 				if (tcp_time_wait->tcp_free_list_cnt <
1844 				    tcp_free_list_max_cnt) {
1845 					/* Add to head of tcp_free_list */
1846 					mutex_exit(
1847 					    &tcp_time_wait->tcp_time_wait_lock);
1848 					tcp_cleanup(tcp);
1849 					mutex_enter(
1850 					    &tcp_time_wait->tcp_time_wait_lock);
1851 					tcp->tcp_time_wait_next =
1852 					    tcp_time_wait->tcp_free_list;
1853 					tcp_time_wait->tcp_free_list = tcp;
1854 					tcp_time_wait->tcp_free_list_cnt++;
1855 					continue;
1856 				} else {
1857 					/* Do not add to tcp_free_list */
1858 					mutex_exit(
1859 					    &tcp_time_wait->tcp_time_wait_lock);
1860 					tcp_bind_hash_remove(tcp);
1861 					conn_delete_ire(tcp->tcp_connp, NULL);
1862 					CONN_DEC_REF(tcp->tcp_connp);
1863 				}
1864 			} else {
1865 				CONN_INC_REF_LOCKED(connp);
1866 				mutex_exit(lock);
1867 				mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1868 				mutex_exit(&connp->conn_lock);
1869 				/*
1870 				 * We can reuse the closemp here since conn has
1871 				 * detached (otherwise we wouldn't even be in
1872 				 * time_wait list).
1873 				 */
1874 				mp = &tcp->tcp_closemp;
1875 				squeue_fill(connp->conn_sqp, mp,
1876 				    tcp_timewait_output, connp,
1877 				    SQTAG_TCP_TIMEWAIT);
1878 			}
1879 		} else {
1880 			mutex_enter(&connp->conn_lock);
1881 			CONN_INC_REF_LOCKED(connp);
1882 			mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1883 			mutex_exit(&connp->conn_lock);
1884 			/*
1885 			 * We can reuse the closemp here since conn has
1886 			 * detached (otherwise we wouldn't even be in
1887 			 * time_wait list).
1888 			 */
1889 			mp = &tcp->tcp_closemp;
1890 			squeue_fill(connp->conn_sqp, mp,
1891 			    tcp_timewait_output, connp, 0);
1892 		}
1893 		mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
1894 	}
1895 
1896 	if (tcp_time_wait->tcp_free_list != NULL)
1897 		tcp_time_wait->tcp_free_list->tcp_in_free_list = B_TRUE;
1898 
1899 	tcp_time_wait->tcp_time_wait_tid =
1900 	    timeout(tcp_time_wait_collector, sqp, TCP_TIME_WAIT_DELAY);
1901 	mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1902 }
1903 
1904 /*
1905  * Reply to a clients T_CONN_RES TPI message. This function
1906  * is used only for TLI/XTI listener. Sockfs sends T_CONN_RES
1907  * on the acceptor STREAM and processed in tcp_wput_accept().
1908  * Read the block comment on top of tcp_conn_request().
1909  */
1910 static void
1911 tcp_accept(tcp_t *listener, mblk_t *mp)
1912 {
1913 	tcp_t	*acceptor;
1914 	tcp_t	*eager;
1915 	tcp_t   *tcp;
1916 	struct T_conn_res	*tcr;
1917 	t_uscalar_t	acceptor_id;
1918 	t_scalar_t	seqnum;
1919 	mblk_t	*opt_mp = NULL;	/* T_OPTMGMT_REQ messages */
1920 	mblk_t	*ok_mp;
1921 	mblk_t	*mp1;
1922 
1923 	if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) {
1924 		tcp_err_ack(listener, mp, TPROTO, 0);
1925 		return;
1926 	}
1927 	tcr = (struct T_conn_res *)mp->b_rptr;
1928 
1929 	/*
1930 	 * Under ILP32 the stream head points tcr->ACCEPTOR_id at the
1931 	 * read side queue of the streams device underneath us i.e. the
1932 	 * read side queue of 'ip'. Since we can't deference QUEUE_ptr we
1933 	 * look it up in the queue_hash.  Under LP64 it sends down the
1934 	 * minor_t of the accepting endpoint.
1935 	 *
1936 	 * Once the acceptor/eager are modified (in tcp_accept_swap) the
1937 	 * fanout hash lock is held.
1938 	 * This prevents any thread from entering the acceptor queue from
1939 	 * below (since it has not been hard bound yet i.e. any inbound
1940 	 * packets will arrive on the listener or default tcp queue and
1941 	 * go through tcp_lookup).
1942 	 * The CONN_INC_REF will prevent the acceptor from closing.
1943 	 *
1944 	 * XXX It is still possible for a tli application to send down data
1945 	 * on the accepting stream while another thread calls t_accept.
1946 	 * This should not be a problem for well-behaved applications since
1947 	 * the T_OK_ACK is sent after the queue swapping is completed.
1948 	 *
1949 	 * If the accepting fd is the same as the listening fd, avoid
1950 	 * queue hash lookup since that will return an eager listener in a
1951 	 * already established state.
1952 	 */
1953 	acceptor_id = tcr->ACCEPTOR_id;
1954 	mutex_enter(&listener->tcp_eager_lock);
1955 	if (listener->tcp_acceptor_id == acceptor_id) {
1956 		eager = listener->tcp_eager_next_q;
1957 		/* only count how many T_CONN_INDs so don't count q0 */
1958 		if ((listener->tcp_conn_req_cnt_q != 1) ||
1959 		    (eager->tcp_conn_req_seqnum != tcr->SEQ_number)) {
1960 			mutex_exit(&listener->tcp_eager_lock);
1961 			tcp_err_ack(listener, mp, TBADF, 0);
1962 			return;
1963 		}
1964 		if (listener->tcp_conn_req_cnt_q0 != 0) {
1965 			/* Throw away all the eagers on q0. */
1966 			tcp_eager_cleanup(listener, 1);
1967 		}
1968 		if (listener->tcp_syn_defense) {
1969 			listener->tcp_syn_defense = B_FALSE;
1970 			if (listener->tcp_ip_addr_cache != NULL) {
1971 				kmem_free(listener->tcp_ip_addr_cache,
1972 				    IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t));
1973 				listener->tcp_ip_addr_cache = NULL;
1974 			}
1975 		}
1976 		/*
1977 		 * Transfer tcp_conn_req_max to the eager so that when
1978 		 * a disconnect occurs we can revert the endpoint to the
1979 		 * listen state.
1980 		 */
1981 		eager->tcp_conn_req_max = listener->tcp_conn_req_max;
1982 		ASSERT(listener->tcp_conn_req_cnt_q0 == 0);
1983 		/*
1984 		 * Get a reference on the acceptor just like the
1985 		 * tcp_acceptor_hash_lookup below.
1986 		 */
1987 		acceptor = listener;
1988 		CONN_INC_REF(acceptor->tcp_connp);
1989 	} else {
1990 		acceptor = tcp_acceptor_hash_lookup(acceptor_id);
1991 		if (acceptor == NULL) {
1992 			if (listener->tcp_debug) {
1993 				(void) strlog(TCP_MOD_ID, 0, 1,
1994 				    SL_ERROR|SL_TRACE,
1995 				    "tcp_accept: did not find acceptor 0x%x\n",
1996 				    acceptor_id);
1997 			}
1998 			mutex_exit(&listener->tcp_eager_lock);
1999 			tcp_err_ack(listener, mp, TPROVMISMATCH, 0);
2000 			return;
2001 		}
2002 		/*
2003 		 * Verify acceptor state. The acceptable states for an acceptor
2004 		 * include TCPS_IDLE and TCPS_BOUND.
2005 		 */
2006 		switch (acceptor->tcp_state) {
2007 		case TCPS_IDLE:
2008 			/* FALLTHRU */
2009 		case TCPS_BOUND:
2010 			break;
2011 		default:
2012 			CONN_DEC_REF(acceptor->tcp_connp);
2013 			mutex_exit(&listener->tcp_eager_lock);
2014 			tcp_err_ack(listener, mp, TOUTSTATE, 0);
2015 			return;
2016 		}
2017 	}
2018 
2019 	/* The listener must be in TCPS_LISTEN */
2020 	if (listener->tcp_state != TCPS_LISTEN) {
2021 		CONN_DEC_REF(acceptor->tcp_connp);
2022 		mutex_exit(&listener->tcp_eager_lock);
2023 		tcp_err_ack(listener, mp, TOUTSTATE, 0);
2024 		return;
2025 	}
2026 
2027 	/*
2028 	 * Rendezvous with an eager connection request packet hanging off
2029 	 * 'tcp' that has the 'seqnum' tag.  We tagged the detached open
2030 	 * tcp structure when the connection packet arrived in
2031 	 * tcp_conn_request().
2032 	 */
2033 	seqnum = tcr->SEQ_number;
2034 	eager = listener;
2035 	do {
2036 		eager = eager->tcp_eager_next_q;
2037 		if (eager == NULL) {
2038 			CONN_DEC_REF(acceptor->tcp_connp);
2039 			mutex_exit(&listener->tcp_eager_lock);
2040 			tcp_err_ack(listener, mp, TBADSEQ, 0);
2041 			return;
2042 		}
2043 	} while (eager->tcp_conn_req_seqnum != seqnum);
2044 	mutex_exit(&listener->tcp_eager_lock);
2045 
2046 	/*
2047 	 * At this point, both acceptor and listener have 2 ref
2048 	 * that they begin with. Acceptor has one additional ref
2049 	 * we placed in lookup while listener has 3 additional
2050 	 * ref for being behind the squeue (tcp_accept() is
2051 	 * done on listener's squeue); being in classifier hash;
2052 	 * and eager's ref on listener.
2053 	 */
2054 	ASSERT(listener->tcp_connp->conn_ref >= 5);
2055 	ASSERT(acceptor->tcp_connp->conn_ref >= 3);
2056 
2057 	/*
2058 	 * The eager at this point is set in its own squeue and
2059 	 * could easily have been killed (tcp_accept_finish will
2060 	 * deal with that) because of a TH_RST so we can only
2061 	 * ASSERT for a single ref.
2062 	 */
2063 	ASSERT(eager->tcp_connp->conn_ref >= 1);
2064 
2065 	/* Pre allocate the stroptions mblk also */
2066 	opt_mp = allocb(sizeof (struct stroptions), BPRI_HI);
2067 	if (opt_mp == NULL) {
2068 		CONN_DEC_REF(acceptor->tcp_connp);
2069 		CONN_DEC_REF(eager->tcp_connp);
2070 		tcp_err_ack(listener, mp, TSYSERR, ENOMEM);
2071 		return;
2072 	}
2073 	DB_TYPE(opt_mp) = M_SETOPTS;
2074 	opt_mp->b_wptr += sizeof (struct stroptions);
2075 
2076 	/*
2077 	 * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO
2078 	 * from listener to acceptor. The message is chained on opt_mp
2079 	 * which will be sent onto eager's squeue.
2080 	 */
2081 	if (listener->tcp_bound_if != 0) {
2082 		/* allocate optmgmt req */
2083 		mp1 = tcp_setsockopt_mp(IPPROTO_IPV6,
2084 		    IPV6_BOUND_IF, (char *)&listener->tcp_bound_if,
2085 		    sizeof (int));
2086 		if (mp1 != NULL)
2087 			linkb(opt_mp, mp1);
2088 	}
2089 	if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) {
2090 		uint_t on = 1;
2091 
2092 		/* allocate optmgmt req */
2093 		mp1 = tcp_setsockopt_mp(IPPROTO_IPV6,
2094 		    IPV6_RECVPKTINFO, (char *)&on, sizeof (on));
2095 		if (mp1 != NULL)
2096 			linkb(opt_mp, mp1);
2097 	}
2098 
2099 	/* Re-use mp1 to hold a copy of mp, in case reallocb fails */
2100 	if ((mp1 = copymsg(mp)) == NULL) {
2101 		CONN_DEC_REF(acceptor->tcp_connp);
2102 		CONN_DEC_REF(eager->tcp_connp);
2103 		freemsg(opt_mp);
2104 		tcp_err_ack(listener, mp, TSYSERR, ENOMEM);
2105 		return;
2106 	}
2107 
2108 	tcr = (struct T_conn_res *)mp1->b_rptr;
2109 
2110 	/*
2111 	 * This is an expanded version of mi_tpi_ok_ack_alloc()
2112 	 * which allocates a larger mblk and appends the new
2113 	 * local address to the ok_ack.  The address is copied by
2114 	 * soaccept() for getsockname().
2115 	 */
2116 	{
2117 		int extra;
2118 
2119 		extra = (eager->tcp_family == AF_INET) ?
2120 		    sizeof (sin_t) : sizeof (sin6_t);
2121 
2122 		/*
2123 		 * Try to re-use mp, if possible.  Otherwise, allocate
2124 		 * an mblk and return it as ok_mp.  In any case, mp
2125 		 * is no longer usable upon return.
2126 		 */
2127 		if ((ok_mp = mi_tpi_ok_ack_alloc_extra(mp, extra)) == NULL) {
2128 			CONN_DEC_REF(acceptor->tcp_connp);
2129 			CONN_DEC_REF(eager->tcp_connp);
2130 			freemsg(opt_mp);
2131 			/* Original mp has been freed by now, so use mp1 */
2132 			tcp_err_ack(listener, mp1, TSYSERR, ENOMEM);
2133 			return;
2134 		}
2135 
2136 		mp = NULL;	/* We should never use mp after this point */
2137 
2138 		switch (extra) {
2139 		case sizeof (sin_t): {
2140 				sin_t *sin = (sin_t *)ok_mp->b_wptr;
2141 
2142 				ok_mp->b_wptr += extra;
2143 				sin->sin_family = AF_INET;
2144 				sin->sin_port = eager->tcp_lport;
2145 				sin->sin_addr.s_addr =
2146 				    eager->tcp_ipha->ipha_src;
2147 				break;
2148 			}
2149 		case sizeof (sin6_t): {
2150 				sin6_t *sin6 = (sin6_t *)ok_mp->b_wptr;
2151 
2152 				ok_mp->b_wptr += extra;
2153 				sin6->sin6_family = AF_INET6;
2154 				sin6->sin6_port = eager->tcp_lport;
2155 				if (eager->tcp_ipversion == IPV4_VERSION) {
2156 					sin6->sin6_flowinfo = 0;
2157 					IN6_IPADDR_TO_V4MAPPED(
2158 					    eager->tcp_ipha->ipha_src,
2159 					    &sin6->sin6_addr);
2160 				} else {
2161 					ASSERT(eager->tcp_ip6h != NULL);
2162 					sin6->sin6_flowinfo =
2163 					    eager->tcp_ip6h->ip6_vcf &
2164 					    ~IPV6_VERS_AND_FLOW_MASK;
2165 					sin6->sin6_addr =
2166 					    eager->tcp_ip6h->ip6_src;
2167 				}
2168 				break;
2169 			}
2170 		default:
2171 			break;
2172 		}
2173 		ASSERT(ok_mp->b_wptr <= ok_mp->b_datap->db_lim);
2174 	}
2175 
2176 	/*
2177 	 * If there are no options we know that the T_CONN_RES will
2178 	 * succeed. However, we can't send the T_OK_ACK upstream until
2179 	 * the tcp_accept_swap is done since it would be dangerous to
2180 	 * let the application start using the new fd prior to the swap.
2181 	 */
2182 	tcp_accept_swap(listener, acceptor, eager);
2183 
2184 	/*
2185 	 * tcp_accept_swap unlinks eager from listener but does not drop
2186 	 * the eager's reference on the listener.
2187 	 */
2188 	ASSERT(eager->tcp_listener == NULL);
2189 	ASSERT(listener->tcp_connp->conn_ref >= 5);
2190 
2191 	/*
2192 	 * The eager is now associated with its own queue. Insert in
2193 	 * the hash so that the connection can be reused for a future
2194 	 * T_CONN_RES.
2195 	 */
2196 	tcp_acceptor_hash_insert(acceptor_id, eager);
2197 
2198 	/*
2199 	 * We now do the processing of options with T_CONN_RES.
2200 	 * We delay till now since we wanted to have queue to pass to
2201 	 * option processing routines that points back to the right
2202 	 * instance structure which does not happen until after
2203 	 * tcp_accept_swap().
2204 	 *
2205 	 * Note:
2206 	 * The sanity of the logic here assumes that whatever options
2207 	 * are appropriate to inherit from listner=>eager are done
2208 	 * before this point, and whatever were to be overridden (or not)
2209 	 * in transfer logic from eager=>acceptor in tcp_accept_swap().
2210 	 * [ Warning: acceptor endpoint can have T_OPTMGMT_REQ done to it
2211 	 *   before its ACCEPTOR_id comes down in T_CONN_RES ]
2212 	 * This may not be true at this point in time but can be fixed
2213 	 * independently. This option processing code starts with
2214 	 * the instantiated acceptor instance and the final queue at
2215 	 * this point.
2216 	 */
2217 
2218 	if (tcr->OPT_length != 0) {
2219 		/* Options to process */
2220 		int t_error = 0;
2221 		int sys_error = 0;
2222 		int do_disconnect = 0;
2223 
2224 		if (tcp_conprim_opt_process(eager, mp1,
2225 		    &do_disconnect, &t_error, &sys_error) < 0) {
2226 			eager->tcp_accept_error = 1;
2227 			if (do_disconnect) {
2228 				/*
2229 				 * An option failed which does not allow
2230 				 * connection to be accepted.
2231 				 *
2232 				 * We allow T_CONN_RES to succeed and
2233 				 * put a T_DISCON_IND on the eager queue.
2234 				 */
2235 				ASSERT(t_error == 0 && sys_error == 0);
2236 				eager->tcp_send_discon_ind = 1;
2237 			} else {
2238 				ASSERT(t_error != 0);
2239 				freemsg(ok_mp);
2240 				/*
2241 				 * Original mp was either freed or set
2242 				 * to ok_mp above, so use mp1 instead.
2243 				 */
2244 				tcp_err_ack(listener, mp1, t_error, sys_error);
2245 				goto finish;
2246 			}
2247 		}
2248 		/*
2249 		 * Most likely success in setting options (except if
2250 		 * eager->tcp_send_discon_ind set).
2251 		 * mp1 option buffer represented by OPT_length/offset
2252 		 * potentially modified and contains results of setting
2253 		 * options at this point
2254 		 */
2255 	}
2256 
2257 	/* We no longer need mp1, since all options processing has passed */
2258 	freemsg(mp1);
2259 
2260 	putnext(listener->tcp_rq, ok_mp);
2261 
2262 	mutex_enter(&listener->tcp_eager_lock);
2263 	if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) {
2264 		tcp_t	*tail;
2265 		mblk_t	*conn_ind;
2266 
2267 		/*
2268 		 * This path should not be executed if listener and
2269 		 * acceptor streams are the same.
2270 		 */
2271 		ASSERT(listener != acceptor);
2272 
2273 		tcp = listener->tcp_eager_prev_q0;
2274 		/*
2275 		 * listener->tcp_eager_prev_q0 points to the TAIL of the
2276 		 * deferred T_conn_ind queue. We need to get to the head of
2277 		 * the queue in order to send up T_conn_ind the same order as
2278 		 * how the 3WHS is completed.
2279 		 */
2280 		while (tcp != listener) {
2281 			if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0)
2282 				break;
2283 			else
2284 				tcp = tcp->tcp_eager_prev_q0;
2285 		}
2286 		ASSERT(tcp != listener);
2287 		conn_ind = tcp->tcp_conn.tcp_eager_conn_ind;
2288 		ASSERT(conn_ind != NULL);
2289 		tcp->tcp_conn.tcp_eager_conn_ind = NULL;
2290 
2291 		/* Move from q0 to q */
2292 		ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
2293 		listener->tcp_conn_req_cnt_q0--;
2294 		listener->tcp_conn_req_cnt_q++;
2295 		tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
2296 		    tcp->tcp_eager_prev_q0;
2297 		tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
2298 		    tcp->tcp_eager_next_q0;
2299 		tcp->tcp_eager_prev_q0 = NULL;
2300 		tcp->tcp_eager_next_q0 = NULL;
2301 		tcp->tcp_conn_def_q0 = B_FALSE;
2302 
2303 		/*
2304 		 * Insert at end of the queue because sockfs sends
2305 		 * down T_CONN_RES in chronological order. Leaving
2306 		 * the older conn indications at front of the queue
2307 		 * helps reducing search time.
2308 		 */
2309 		tail = listener->tcp_eager_last_q;
2310 		if (tail != NULL)
2311 			tail->tcp_eager_next_q = tcp;
2312 		else
2313 			listener->tcp_eager_next_q = tcp;
2314 		listener->tcp_eager_last_q = tcp;
2315 		tcp->tcp_eager_next_q = NULL;
2316 		mutex_exit(&listener->tcp_eager_lock);
2317 		putnext(tcp->tcp_rq, conn_ind);
2318 	} else {
2319 		mutex_exit(&listener->tcp_eager_lock);
2320 	}
2321 
2322 	/*
2323 	 * Done with the acceptor - free it
2324 	 *
2325 	 * Note: from this point on, no access to listener should be made
2326 	 * as listener can be equal to acceptor.
2327 	 */
2328 finish:
2329 	ASSERT(acceptor->tcp_detached);
2330 	acceptor->tcp_rq = tcp_g_q;
2331 	acceptor->tcp_wq = WR(tcp_g_q);
2332 	(void) tcp_clean_death(acceptor, 0, 2);
2333 	CONN_DEC_REF(acceptor->tcp_connp);
2334 
2335 	/*
2336 	 * In case we already received a FIN we have to make tcp_rput send
2337 	 * the ordrel_ind. This will also send up a window update if the window
2338 	 * has opened up.
2339 	 *
2340 	 * In the normal case of a successful connection acceptance
2341 	 * we give the O_T_BIND_REQ to the read side put procedure as an
2342 	 * indication that this was just accepted. This tells tcp_rput to
2343 	 * pass up any data queued in tcp_rcv_list.
2344 	 *
2345 	 * In the fringe case where options sent with T_CONN_RES failed and
2346 	 * we required, we would be indicating a T_DISCON_IND to blow
2347 	 * away this connection.
2348 	 */
2349 
2350 	/*
2351 	 * XXX: we currently have a problem if XTI application closes the
2352 	 * acceptor stream in between. This problem exists in on10-gate also
2353 	 * and is well know but nothing can be done short of major rewrite
2354 	 * to fix it. Now it is possible to take care of it by assigning TLI/XTI
2355 	 * eager same squeue as listener (we can distinguish non socket
2356 	 * listeners at the time of handling a SYN in tcp_conn_request)
2357 	 * and do most of the work that tcp_accept_finish does here itself
2358 	 * and then get behind the acceptor squeue to access the acceptor
2359 	 * queue.
2360 	 */
2361 	/*
2362 	 * We already have a ref on tcp so no need to do one before squeue_fill
2363 	 */
2364 	squeue_fill(eager->tcp_connp->conn_sqp, opt_mp,
2365 	    tcp_accept_finish, eager->tcp_connp, SQTAG_TCP_ACCEPT_FINISH);
2366 }
2367 
2368 /*
2369  * Swap information between the eager and acceptor for a TLI/XTI client.
2370  * The sockfs accept is done on the acceptor stream and control goes
2371  * through tcp_wput_accept() and tcp_accept()/tcp_accept_swap() is not
2372  * called. In either case, both the eager and listener are in their own
2373  * perimeter (squeue) and the code has to deal with potential race.
2374  *
2375  * See the block comment on top of tcp_accept() and tcp_wput_accept().
2376  */
2377 static void
2378 tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, tcp_t *eager)
2379 {
2380 	conn_t	*econnp, *aconnp;
2381 
2382 	ASSERT(eager->tcp_rq == listener->tcp_rq);
2383 	ASSERT(eager->tcp_detached && !acceptor->tcp_detached);
2384 	ASSERT(!eager->tcp_hard_bound);
2385 	ASSERT(!TCP_IS_SOCKET(acceptor));
2386 	ASSERT(!TCP_IS_SOCKET(eager));
2387 	ASSERT(!TCP_IS_SOCKET(listener));
2388 
2389 	acceptor->tcp_detached = B_TRUE;
2390 	/*
2391 	 * To permit stream re-use by TLI/XTI, the eager needs a copy of
2392 	 * the acceptor id.
2393 	 */
2394 	eager->tcp_acceptor_id = acceptor->tcp_acceptor_id;
2395 
2396 	/* remove eager from listen list... */
2397 	mutex_enter(&listener->tcp_eager_lock);
2398 	tcp_eager_unlink(eager);
2399 	ASSERT(eager->tcp_eager_next_q == NULL &&
2400 	    eager->tcp_eager_last_q == NULL);
2401 	ASSERT(eager->tcp_eager_next_q0 == NULL &&
2402 	    eager->tcp_eager_prev_q0 == NULL);
2403 	mutex_exit(&listener->tcp_eager_lock);
2404 	eager->tcp_rq = acceptor->tcp_rq;
2405 	eager->tcp_wq = acceptor->tcp_wq;
2406 
2407 	econnp = eager->tcp_connp;
2408 	aconnp = acceptor->tcp_connp;
2409 
2410 	eager->tcp_rq->q_ptr = econnp;
2411 	eager->tcp_wq->q_ptr = econnp;
2412 
2413 	/*
2414 	 * In the TLI/XTI loopback case, we are inside the listener's squeue,
2415 	 * which might be a different squeue from our peer TCP instance.
2416 	 * For TCP Fusion, the peer expects that whenever tcp_detached is
2417 	 * clear, our TCP queues point to the acceptor's queues.  Thus, use
2418 	 * membar_producer() to ensure that the assignments of tcp_rq/tcp_wq
2419 	 * above reach global visibility prior to the clearing of tcp_detached.
2420 	 */
2421 	membar_producer();
2422 	eager->tcp_detached = B_FALSE;
2423 
2424 	ASSERT(eager->tcp_ack_tid == 0);
2425 
2426 	econnp->conn_dev = aconnp->conn_dev;
2427 	if (eager->tcp_cred != NULL)
2428 		crfree(eager->tcp_cred);
2429 	eager->tcp_cred = econnp->conn_cred = aconnp->conn_cred;
2430 	aconnp->conn_cred = NULL;
2431 
2432 	econnp->conn_zoneid = aconnp->conn_zoneid;
2433 	econnp->conn_allzones = aconnp->conn_allzones;
2434 
2435 	econnp->conn_mac_exempt = aconnp->conn_mac_exempt;
2436 	aconnp->conn_mac_exempt = B_FALSE;
2437 
2438 	ASSERT(aconnp->conn_peercred == NULL);
2439 
2440 	/* Do the IPC initialization */
2441 	CONN_INC_REF(econnp);
2442 
2443 	econnp->conn_multicast_loop = aconnp->conn_multicast_loop;
2444 	econnp->conn_af_isv6 = aconnp->conn_af_isv6;
2445 	econnp->conn_pkt_isv6 = aconnp->conn_pkt_isv6;
2446 	econnp->conn_ulp = aconnp->conn_ulp;
2447 
2448 	/* Done with old IPC. Drop its ref on its connp */
2449 	CONN_DEC_REF(aconnp);
2450 }
2451 
2452 
2453 /*
2454  * Adapt to the information, such as rtt and rtt_sd, provided from the
2455  * ire cached in conn_cache_ire. If no ire cached, do a ire lookup.
2456  *
2457  * Checks for multicast and broadcast destination address.
2458  * Returns zero on failure; non-zero if ok.
2459  *
2460  * Note that the MSS calculation here is based on the info given in
2461  * the IRE.  We do not do any calculation based on TCP options.  They
2462  * will be handled in tcp_rput_other() and tcp_rput_data() when TCP
2463  * knows which options to use.
2464  *
2465  * Note on how TCP gets its parameters for a connection.
2466  *
2467  * When a tcp_t structure is allocated, it gets all the default parameters.
2468  * In tcp_adapt_ire(), it gets those metric parameters, like rtt, rtt_sd,
2469  * spipe, rpipe, ... from the route metrics.  Route metric overrides the
2470  * default.  But if there is an associated tcp_host_param, it will override
2471  * the metrics.
2472  *
2473  * An incoming SYN with a multicast or broadcast destination address, is dropped
2474  * in 1 of 2 places.
2475  *
2476  * 1. If the packet was received over the wire it is dropped in
2477  * ip_rput_process_broadcast()
2478  *
2479  * 2. If the packet was received through internal IP loopback, i.e. the packet
2480  * was generated and received on the same machine, it is dropped in
2481  * ip_wput_local()
2482  *
2483  * An incoming SYN with a multicast or broadcast source address is always
2484  * dropped in tcp_adapt_ire. The same logic in tcp_adapt_ire also serves to
2485  * reject an attempt to connect to a broadcast or multicast (destination)
2486  * address.
2487  */
2488 static int
2489 tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp)
2490 {
2491 	tcp_hsp_t	*hsp;
2492 	ire_t		*ire;
2493 	ire_t		*sire = NULL;
2494 	iulp_t		*ire_uinfo = NULL;
2495 	uint32_t	mss_max;
2496 	uint32_t	mss;
2497 	boolean_t	tcp_detached = TCP_IS_DETACHED(tcp);
2498 	conn_t		*connp = tcp->tcp_connp;
2499 	boolean_t	ire_cacheable = B_FALSE;
2500 	zoneid_t	zoneid = connp->conn_zoneid;
2501 	int		match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT |
2502 			    MATCH_IRE_SECATTR;
2503 	ts_label_t	*tsl = crgetlabel(CONN_CRED(connp));
2504 	ill_t		*ill = NULL;
2505 	boolean_t	incoming = (ire_mp == NULL);
2506 
2507 	ASSERT(connp->conn_ire_cache == NULL);
2508 
2509 	if (tcp->tcp_ipversion == IPV4_VERSION) {
2510 
2511 		if (CLASSD(tcp->tcp_connp->conn_rem)) {
2512 			BUMP_MIB(&ip_mib, ipInDiscards);
2513 			return (0);
2514 		}
2515 		/*
2516 		 * If IP_NEXTHOP is set, then look for an IRE_CACHE
2517 		 * for the destination with the nexthop as gateway.
2518 		 * ire_ctable_lookup() is used because this particular
2519 		 * ire, if it exists, will be marked private.
2520 		 * If that is not available, use the interface ire
2521 		 * for the nexthop.
2522 		 *
2523 		 * TSol: tcp_update_label will detect label mismatches based
2524 		 * only on the destination's label, but that would not
2525 		 * detect label mismatches based on the security attributes
2526 		 * of routes or next hop gateway. Hence we need to pass the
2527 		 * label to ire_ftable_lookup below in order to locate the
2528 		 * right prefix (and/or) ire cache. Similarly we also need
2529 		 * pass the label to the ire_cache_lookup below to locate
2530 		 * the right ire that also matches on the label.
2531 		 */
2532 		if (tcp->tcp_connp->conn_nexthop_set) {
2533 			ire = ire_ctable_lookup(tcp->tcp_connp->conn_rem,
2534 			    tcp->tcp_connp->conn_nexthop_v4, 0, NULL, zoneid,
2535 			    tsl, MATCH_IRE_MARK_PRIVATE_ADDR | MATCH_IRE_GW);
2536 			if (ire == NULL) {
2537 				ire = ire_ftable_lookup(
2538 				    tcp->tcp_connp->conn_nexthop_v4,
2539 				    0, 0, IRE_INTERFACE, NULL, NULL, zoneid, 0,
2540 				    tsl, match_flags);
2541 				if (ire == NULL)
2542 					return (0);
2543 			} else {
2544 				ire_uinfo = &ire->ire_uinfo;
2545 			}
2546 		} else {
2547 			ire = ire_cache_lookup(tcp->tcp_connp->conn_rem,
2548 			    zoneid, tsl);
2549 			if (ire != NULL) {
2550 				ire_cacheable = B_TRUE;
2551 				ire_uinfo = (ire_mp != NULL) ?
2552 				    &((ire_t *)ire_mp->b_rptr)->ire_uinfo:
2553 				    &ire->ire_uinfo;
2554 
2555 			} else {
2556 				if (ire_mp == NULL) {
2557 					ire = ire_ftable_lookup(
2558 					    tcp->tcp_connp->conn_rem,
2559 					    0, 0, 0, NULL, &sire, zoneid, 0,
2560 					    tsl, (MATCH_IRE_RECURSIVE |
2561 					    MATCH_IRE_DEFAULT));
2562 					if (ire == NULL)
2563 						return (0);
2564 					ire_uinfo = (sire != NULL) ?
2565 					    &sire->ire_uinfo :
2566 					    &ire->ire_uinfo;
2567 				} else {
2568 					ire = (ire_t *)ire_mp->b_rptr;
2569 					ire_uinfo =
2570 					    &((ire_t *)
2571 					    ire_mp->b_rptr)->ire_uinfo;
2572 				}
2573 			}
2574 		}
2575 		ASSERT(ire != NULL);
2576 
2577 		if ((ire->ire_src_addr == INADDR_ANY) ||
2578 		    (ire->ire_type & IRE_BROADCAST)) {
2579 			/*
2580 			 * ire->ire_mp is non null when ire_mp passed in is used
2581 			 * ire->ire_mp is set in ip_bind_insert_ire[_v6]().
2582 			 */
2583 			if (ire->ire_mp == NULL)
2584 				ire_refrele(ire);
2585 			if (sire != NULL)
2586 				ire_refrele(sire);
2587 			return (0);
2588 		}
2589 
2590 		if (tcp->tcp_ipha->ipha_src == INADDR_ANY) {
2591 			ipaddr_t src_addr;
2592 
2593 			/*
2594 			 * ip_bind_connected() has stored the correct source
2595 			 * address in conn_src.
2596 			 */
2597 			src_addr = tcp->tcp_connp->conn_src;
2598 			tcp->tcp_ipha->ipha_src = src_addr;
2599 			/*
2600 			 * Copy of the src addr. in tcp_t is needed
2601 			 * for the lookup funcs.
2602 			 */
2603 			IN6_IPADDR_TO_V4MAPPED(src_addr, &tcp->tcp_ip_src_v6);
2604 		}
2605 		/*
2606 		 * Set the fragment bit so that IP will tell us if the MTU
2607 		 * should change. IP tells us the latest setting of
2608 		 * ip_path_mtu_discovery through ire_frag_flag.
2609 		 */
2610 		if (ip_path_mtu_discovery) {
2611 			tcp->tcp_ipha->ipha_fragment_offset_and_flags =
2612 			    htons(IPH_DF);
2613 		}
2614 		/*
2615 		 * If ire_uinfo is NULL, this is the IRE_INTERFACE case
2616 		 * for IP_NEXTHOP. No cache ire has been found for the
2617 		 * destination and we are working with the nexthop's
2618 		 * interface ire. Since we need to forward all packets
2619 		 * to the nexthop first, we "blindly" set tcp_localnet
2620 		 * to false, eventhough the destination may also be
2621 		 * onlink.
2622 		 */
2623 		if (ire_uinfo == NULL)
2624 			tcp->tcp_localnet = 0;
2625 		else
2626 			tcp->tcp_localnet = (ire->ire_gateway_addr == 0);
2627 	} else {
2628 		/*
2629 		 * For incoming connection ire_mp = NULL
2630 		 * For outgoing connection ire_mp != NULL
2631 		 * Technically we should check conn_incoming_ill
2632 		 * when ire_mp is NULL and conn_outgoing_ill when
2633 		 * ire_mp is non-NULL. But this is performance
2634 		 * critical path and for IPV*_BOUND_IF, outgoing
2635 		 * and incoming ill are always set to the same value.
2636 		 */
2637 		ill_t	*dst_ill = NULL;
2638 		ipif_t  *dst_ipif = NULL;
2639 
2640 		ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill);
2641 
2642 		if (connp->conn_outgoing_ill != NULL) {
2643 			/* Outgoing or incoming path */
2644 			int   err;
2645 
2646 			dst_ill = conn_get_held_ill(connp,
2647 			    &connp->conn_outgoing_ill, &err);
2648 			if (err == ILL_LOOKUP_FAILED || dst_ill == NULL) {
2649 				ip1dbg(("tcp_adapt_ire: ill_lookup failed\n"));
2650 				return (0);
2651 			}
2652 			match_flags |= MATCH_IRE_ILL;
2653 			dst_ipif = dst_ill->ill_ipif;
2654 		}
2655 		ire = ire_ctable_lookup_v6(&tcp->tcp_connp->conn_remv6,
2656 		    0, 0, dst_ipif, zoneid, tsl, match_flags);
2657 
2658 		if (ire != NULL) {
2659 			ire_cacheable = B_TRUE;
2660 			ire_uinfo = (ire_mp != NULL) ?
2661 			    &((ire_t *)ire_mp->b_rptr)->ire_uinfo:
2662 			    &ire->ire_uinfo;
2663 		} else {
2664 			if (ire_mp == NULL) {
2665 				ire = ire_ftable_lookup_v6(
2666 				    &tcp->tcp_connp->conn_remv6,
2667 				    0, 0, 0, dst_ipif, &sire, zoneid,
2668 				    0, tsl, match_flags);
2669 				if (ire == NULL) {
2670 					if (dst_ill != NULL)
2671 						ill_refrele(dst_ill);
2672 					return (0);
2673 				}
2674 				ire_uinfo = (sire != NULL) ? &sire->ire_uinfo :
2675 				    &ire->ire_uinfo;
2676 			} else {
2677 				ire = (ire_t *)ire_mp->b_rptr;
2678 				ire_uinfo =
2679 				    &((ire_t *)ire_mp->b_rptr)->ire_uinfo;
2680 			}
2681 		}
2682 		if (dst_ill != NULL)
2683 			ill_refrele(dst_ill);
2684 
2685 		ASSERT(ire != NULL);
2686 		ASSERT(ire_uinfo != NULL);
2687 
2688 		if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6) ||
2689 		    IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) {
2690 			/*
2691 			 * ire->ire_mp is non null when ire_mp passed in is used
2692 			 * ire->ire_mp is set in ip_bind_insert_ire[_v6]().
2693 			 */
2694 			if (ire->ire_mp == NULL)
2695 				ire_refrele(ire);
2696 			if (sire != NULL)
2697 				ire_refrele(sire);
2698 			return (0);
2699 		}
2700 
2701 		if (IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) {
2702 			in6_addr_t	src_addr;
2703 
2704 			/*
2705 			 * ip_bind_connected_v6() has stored the correct source
2706 			 * address per IPv6 addr. selection policy in
2707 			 * conn_src_v6.
2708 			 */
2709 			src_addr = tcp->tcp_connp->conn_srcv6;
2710 
2711 			tcp->tcp_ip6h->ip6_src = src_addr;
2712 			/*
2713 			 * Copy of the src addr. in tcp_t is needed
2714 			 * for the lookup funcs.
2715 			 */
2716 			tcp->tcp_ip_src_v6 = src_addr;
2717 			ASSERT(IN6_ARE_ADDR_EQUAL(&tcp->tcp_ip6h->ip6_src,
2718 			    &connp->conn_srcv6));
2719 		}
2720 		tcp->tcp_localnet =
2721 		    IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6);
2722 	}
2723 
2724 	/*
2725 	 * This allows applications to fail quickly when connections are made
2726 	 * to dead hosts. Hosts can be labeled dead by adding a reject route
2727 	 * with both the RTF_REJECT and RTF_PRIVATE flags set.
2728 	 */
2729 	if ((ire->ire_flags & RTF_REJECT) &&
2730 	    (ire->ire_flags & RTF_PRIVATE))
2731 		goto error;
2732 
2733 	/*
2734 	 * Make use of the cached rtt and rtt_sd values to calculate the
2735 	 * initial RTO.  Note that they are already initialized in
2736 	 * tcp_init_values().
2737 	 * If ire_uinfo is NULL, i.e., we do not have a cache ire for
2738 	 * IP_NEXTHOP, but instead are using the interface ire for the
2739 	 * nexthop, then we do not use the ire_uinfo from that ire to
2740 	 * do any initializations.
2741 	 */
2742 	if (ire_uinfo != NULL) {
2743 		if (ire_uinfo->iulp_rtt != 0) {
2744 			clock_t	rto;
2745 
2746 			tcp->tcp_rtt_sa = ire_uinfo->iulp_rtt;
2747 			tcp->tcp_rtt_sd = ire_uinfo->iulp_rtt_sd;
2748 			rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
2749 			    tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5);
2750 
2751 			if (rto > tcp_rexmit_interval_max) {
2752 				tcp->tcp_rto = tcp_rexmit_interval_max;
2753 			} else if (rto < tcp_rexmit_interval_min) {
2754 				tcp->tcp_rto = tcp_rexmit_interval_min;
2755 			} else {
2756 				tcp->tcp_rto = rto;
2757 			}
2758 		}
2759 		if (ire_uinfo->iulp_ssthresh != 0)
2760 			tcp->tcp_cwnd_ssthresh = ire_uinfo->iulp_ssthresh;
2761 		else
2762 			tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
2763 		if (ire_uinfo->iulp_spipe > 0) {
2764 			tcp->tcp_xmit_hiwater = MIN(ire_uinfo->iulp_spipe,
2765 			    tcp_max_buf);
2766 			if (tcp_snd_lowat_fraction != 0)
2767 				tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater /
2768 				    tcp_snd_lowat_fraction;
2769 			(void) tcp_maxpsz_set(tcp, B_TRUE);
2770 		}
2771 		/*
2772 		 * Note that up till now, acceptor always inherits receive
2773 		 * window from the listener.  But if there is a metrics
2774 		 * associated with a host, we should use that instead of
2775 		 * inheriting it from listener. Thus we need to pass this
2776 		 * info back to the caller.
2777 		 */
2778 		if (ire_uinfo->iulp_rpipe > 0) {
2779 			tcp->tcp_rwnd = MIN(ire_uinfo->iulp_rpipe, tcp_max_buf);
2780 		}
2781 
2782 		if (ire_uinfo->iulp_rtomax > 0) {
2783 			tcp->tcp_second_timer_threshold =
2784 			    ire_uinfo->iulp_rtomax;
2785 		}
2786 
2787 		/*
2788 		 * Use the metric option settings, iulp_tstamp_ok and
2789 		 * iulp_wscale_ok, only for active open. What this means
2790 		 * is that if the other side uses timestamp or window
2791 		 * scale option, TCP will also use those options. That
2792 		 * is for passive open.  If the application sets a
2793 		 * large window, window scale is enabled regardless of
2794 		 * the value in iulp_wscale_ok.  This is the behavior
2795 		 * since 2.6.  So we keep it.
2796 		 * The only case left in passive open processing is the
2797 		 * check for SACK.
2798 		 * For ECN, it should probably be like SACK.  But the
2799 		 * current value is binary, so we treat it like the other
2800 		 * cases.  The metric only controls active open.For passive
2801 		 * open, the ndd param, tcp_ecn_permitted, controls the
2802 		 * behavior.
2803 		 */
2804 		if (!tcp_detached) {
2805 			/*
2806 			 * The if check means that the following can only
2807 			 * be turned on by the metrics only IRE, but not off.
2808 			 */
2809 			if (ire_uinfo->iulp_tstamp_ok)
2810 				tcp->tcp_snd_ts_ok = B_TRUE;
2811 			if (ire_uinfo->iulp_wscale_ok)
2812 				tcp->tcp_snd_ws_ok = B_TRUE;
2813 			if (ire_uinfo->iulp_sack == 2)
2814 				tcp->tcp_snd_sack_ok = B_TRUE;
2815 			if (ire_uinfo->iulp_ecn_ok)
2816 				tcp->tcp_ecn_ok = B_TRUE;
2817 		} else {
2818 			/*
2819 			 * Passive open.
2820 			 *
2821 			 * As above, the if check means that SACK can only be
2822 			 * turned on by the metric only IRE.
2823 			 */
2824 			if (ire_uinfo->iulp_sack > 0) {
2825 				tcp->tcp_snd_sack_ok = B_TRUE;
2826 			}
2827 		}
2828 	}
2829 
2830 
2831 	/*
2832 	 * XXX: Note that currently, ire_max_frag can be as small as 68
2833 	 * because of PMTUd.  So tcp_mss may go to negative if combined
2834 	 * length of all those options exceeds 28 bytes.  But because
2835 	 * of the tcp_mss_min check below, we may not have a problem if
2836 	 * tcp_mss_min is of a reasonable value.  The default is 1 so
2837 	 * the negative problem still exists.  And the check defeats PMTUd.
2838 	 * In fact, if PMTUd finds that the MSS should be smaller than
2839 	 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min
2840 	 * value.
2841 	 *
2842 	 * We do not deal with that now.  All those problems related to
2843 	 * PMTUd will be fixed later.
2844 	 */
2845 	ASSERT(ire->ire_max_frag != 0);
2846 	mss = tcp->tcp_if_mtu = ire->ire_max_frag;
2847 	if (tcp->tcp_ipp_fields & IPPF_USE_MIN_MTU) {
2848 		if (tcp->tcp_ipp_use_min_mtu == IPV6_USE_MIN_MTU_NEVER) {
2849 			mss = MIN(mss, IPV6_MIN_MTU);
2850 		}
2851 	}
2852 
2853 	/* Sanity check for MSS value. */
2854 	if (tcp->tcp_ipversion == IPV4_VERSION)
2855 		mss_max = tcp_mss_max_ipv4;
2856 	else
2857 		mss_max = tcp_mss_max_ipv6;
2858 
2859 	if (tcp->tcp_ipversion == IPV6_VERSION &&
2860 	    (ire->ire_frag_flag & IPH_FRAG_HDR)) {
2861 		/*
2862 		 * After receiving an ICMPv6 "packet too big" message with a
2863 		 * MTU < 1280, and for multirouted IPv6 packets, the IP layer
2864 		 * will insert a 8-byte fragment header in every packet; we
2865 		 * reduce the MSS by that amount here.
2866 		 */
2867 		mss -= sizeof (ip6_frag_t);
2868 	}
2869 
2870 	if (tcp->tcp_ipsec_overhead == 0)
2871 		tcp->tcp_ipsec_overhead = conn_ipsec_length(connp);
2872 
2873 	mss -= tcp->tcp_ipsec_overhead;
2874 
2875 	if (mss < tcp_mss_min)
2876 		mss = tcp_mss_min;
2877 	if (mss > mss_max)
2878 		mss = mss_max;
2879 
2880 	/* Note that this is the maximum MSS, excluding all options. */
2881 	tcp->tcp_mss = mss;
2882 
2883 	/*
2884 	 * Initialize the ISS here now that we have the full connection ID.
2885 	 * The RFC 1948 method of initial sequence number generation requires
2886 	 * knowledge of the full connection ID before setting the ISS.
2887 	 */
2888 
2889 	tcp_iss_init(tcp);
2890 
2891 	if (ire->ire_type & (IRE_LOOPBACK | IRE_LOCAL))
2892 		tcp->tcp_loopback = B_TRUE;
2893 
2894 	if (tcp->tcp_ipversion == IPV4_VERSION) {
2895 		hsp = tcp_hsp_lookup(tcp->tcp_remote);
2896 	} else {
2897 		hsp = tcp_hsp_lookup_ipv6(&tcp->tcp_remote_v6);
2898 	}
2899 
2900 	if (hsp != NULL) {
2901 		/* Only modify if we're going to make them bigger */
2902 		if (hsp->tcp_hsp_sendspace > tcp->tcp_xmit_hiwater) {
2903 			tcp->tcp_xmit_hiwater = hsp->tcp_hsp_sendspace;
2904 			if (tcp_snd_lowat_fraction != 0)
2905 				tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater /
2906 					tcp_snd_lowat_fraction;
2907 		}
2908 
2909 		if (hsp->tcp_hsp_recvspace > tcp->tcp_rwnd) {
2910 			tcp->tcp_rwnd = hsp->tcp_hsp_recvspace;
2911 		}
2912 
2913 		/* Copy timestamp flag only for active open */
2914 		if (!tcp_detached)
2915 			tcp->tcp_snd_ts_ok = hsp->tcp_hsp_tstamp;
2916 	}
2917 
2918 	if (sire != NULL)
2919 		IRE_REFRELE(sire);
2920 
2921 	/*
2922 	 * If we got an IRE_CACHE and an ILL, go through their properties;
2923 	 * otherwise, this is deferred until later when we have an IRE_CACHE.
2924 	 */
2925 	if (tcp->tcp_loopback ||
2926 	    (ire_cacheable && (ill = ire_to_ill(ire)) != NULL)) {
2927 		/*
2928 		 * For incoming, see if this tcp may be MDT-capable.  For
2929 		 * outgoing, this process has been taken care of through
2930 		 * tcp_rput_other.
2931 		 */
2932 		tcp_ire_ill_check(tcp, ire, ill, incoming);
2933 		tcp->tcp_ire_ill_check_done = B_TRUE;
2934 	}
2935 
2936 	mutex_enter(&connp->conn_lock);
2937 	/*
2938 	 * Make sure that conn is not marked incipient
2939 	 * for incoming connections. A blind
2940 	 * removal of incipient flag is cheaper than
2941 	 * check and removal.
2942 	 */
2943 	connp->conn_state_flags &= ~CONN_INCIPIENT;
2944 
2945 	/* Must not cache forwarding table routes. */
2946 	if (ire_cacheable) {
2947 		rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
2948 		if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) {
2949 			connp->conn_ire_cache = ire;
2950 			IRE_UNTRACE_REF(ire);
2951 			rw_exit(&ire->ire_bucket->irb_lock);
2952 			mutex_exit(&connp->conn_lock);
2953 			return (1);
2954 		}
2955 		rw_exit(&ire->ire_bucket->irb_lock);
2956 	}
2957 	mutex_exit(&connp->conn_lock);
2958 
2959 	if (ire->ire_mp == NULL)
2960 		ire_refrele(ire);
2961 	return (1);
2962 
2963 error:
2964 	if (ire->ire_mp == NULL)
2965 		ire_refrele(ire);
2966 	if (sire != NULL)
2967 		ire_refrele(sire);
2968 	return (0);
2969 }
2970 
2971 /*
2972  * tcp_bind is called (holding the writer lock) by tcp_wput_proto to process a
2973  * O_T_BIND_REQ/T_BIND_REQ message.
2974  */
2975 static void
2976 tcp_bind(tcp_t *tcp, mblk_t *mp)
2977 {
2978 	sin_t	*sin;
2979 	sin6_t	*sin6;
2980 	mblk_t	*mp1;
2981 	in_port_t requested_port;
2982 	in_port_t allocated_port;
2983 	struct T_bind_req *tbr;
2984 	boolean_t	bind_to_req_port_only;
2985 	boolean_t	backlog_update = B_FALSE;
2986 	boolean_t	user_specified;
2987 	in6_addr_t	v6addr;
2988 	ipaddr_t	v4addr;
2989 	uint_t	origipversion;
2990 	int	err;
2991 	queue_t *q = tcp->tcp_wq;
2992 	conn_t	*connp;
2993 	mlp_type_t addrtype, mlptype;
2994 	zone_t	*zone;
2995 	cred_t	*cr;
2996 	in_port_t mlp_port;
2997 
2998 	ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
2999 	if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) {
3000 		if (tcp->tcp_debug) {
3001 			(void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
3002 			    "tcp_bind: bad req, len %u",
3003 			    (uint_t)(mp->b_wptr - mp->b_rptr));
3004 		}
3005 		tcp_err_ack(tcp, mp, TPROTO, 0);
3006 		return;
3007 	}
3008 	/* Make sure the largest address fits */
3009 	mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t) + 1, 1);
3010 	if (mp1 == NULL) {
3011 		tcp_err_ack(tcp, mp, TSYSERR, ENOMEM);
3012 		return;
3013 	}
3014 	mp = mp1;
3015 	tbr = (struct T_bind_req *)mp->b_rptr;
3016 	if (tcp->tcp_state >= TCPS_BOUND) {
3017 		if ((tcp->tcp_state == TCPS_BOUND ||
3018 		    tcp->tcp_state == TCPS_LISTEN) &&
3019 		    tcp->tcp_conn_req_max != tbr->CONIND_number &&
3020 		    tbr->CONIND_number > 0) {
3021 			/*
3022 			 * Handle listen() increasing CONIND_number.
3023 			 * This is more "liberal" then what the TPI spec
3024 			 * requires but is needed to avoid a t_unbind
3025 			 * when handling listen() since the port number
3026 			 * might be "stolen" between the unbind and bind.
3027 			 */
3028 			backlog_update = B_TRUE;
3029 			goto do_bind;
3030 		}
3031 		if (tcp->tcp_debug) {
3032 			(void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
3033 			    "tcp_bind: bad state, %d", tcp->tcp_state);
3034 		}
3035 		tcp_err_ack(tcp, mp, TOUTSTATE, 0);
3036 		return;
3037 	}
3038 	origipversion = tcp->tcp_ipversion;
3039 
3040 	switch (tbr->ADDR_length) {
3041 	case 0:			/* request for a generic port */
3042 		tbr->ADDR_offset = sizeof (struct T_bind_req);
3043 		if (tcp->tcp_family == AF_INET) {
3044 			tbr->ADDR_length = sizeof (sin_t);
3045 			sin = (sin_t *)&tbr[1];
3046 			*sin = sin_null;
3047 			sin->sin_family = AF_INET;
3048 			mp->b_wptr = (uchar_t *)&sin[1];
3049 			tcp->tcp_ipversion = IPV4_VERSION;
3050 			IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &v6addr);
3051 		} else {
3052 			ASSERT(tcp->tcp_family == AF_INET6);
3053 			tbr->ADDR_length = sizeof (sin6_t);
3054 			sin6 = (sin6_t *)&tbr[1];
3055 			*sin6 = sin6_null;
3056 			sin6->sin6_family = AF_INET6;
3057 			mp->b_wptr = (uchar_t *)&sin6[1];
3058 			tcp->tcp_ipversion = IPV6_VERSION;
3059 			V6_SET_ZERO(v6addr);
3060 		}
3061 		requested_port = 0;
3062 		break;
3063 
3064 	case sizeof (sin_t):	/* Complete IPv4 address */
3065 		sin = (sin_t *)mi_offset_param(mp, tbr->ADDR_offset,
3066 		    sizeof (sin_t));
3067 		if (sin == NULL || !OK_32PTR((char *)sin)) {
3068 			if (tcp->tcp_debug) {
3069 				(void) strlog(TCP_MOD_ID, 0, 1,
3070 				    SL_ERROR|SL_TRACE,
3071 				    "tcp_bind: bad address parameter, "
3072 				    "offset %d, len %d",
3073 				    tbr->ADDR_offset, tbr->ADDR_length);
3074 			}
3075 			tcp_err_ack(tcp, mp, TPROTO, 0);
3076 			return;
3077 		}
3078 		/*
3079 		 * With sockets sockfs will accept bogus sin_family in
3080 		 * bind() and replace it with the family used in the socket
3081 		 * call.
3082 		 */
3083 		if (sin->sin_family != AF_INET ||
3084 		    tcp->tcp_family != AF_INET) {
3085 			tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT);
3086 			return;
3087 		}
3088 		requested_port = ntohs(sin->sin_port);
3089 		tcp->tcp_ipversion = IPV4_VERSION;
3090 		v4addr = sin->sin_addr.s_addr;
3091 		IN6_IPADDR_TO_V4MAPPED(v4addr, &v6addr);
3092 		break;
3093 
3094 	case sizeof (sin6_t): /* Complete IPv6 address */
3095 		sin6 = (sin6_t *)mi_offset_param(mp,
3096 		    tbr->ADDR_offset, sizeof (sin6_t));
3097 		if (sin6 == NULL || !OK_32PTR((char *)sin6)) {
3098 			if (tcp->tcp_debug) {
3099 				(void) strlog(TCP_MOD_ID, 0, 1,
3100 				    SL_ERROR|SL_TRACE,
3101 				    "tcp_bind: bad IPv6 address parameter, "
3102 				    "offset %d, len %d", tbr->ADDR_offset,
3103 				    tbr->ADDR_length);
3104 			}
3105 			tcp_err_ack(tcp, mp, TSYSERR, EINVAL);
3106 			return;
3107 		}
3108 		if (sin6->sin6_family != AF_INET6 ||
3109 		    tcp->tcp_family != AF_INET6) {
3110 			tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT);
3111 			return;
3112 		}
3113 		requested_port = ntohs(sin6->sin6_port);
3114 		tcp->tcp_ipversion = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr) ?
3115 		    IPV4_VERSION : IPV6_VERSION;
3116 		v6addr = sin6->sin6_addr;
3117 		break;
3118 
3119 	default:
3120 		if (tcp->tcp_debug) {
3121 			(void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
3122 			    "tcp_bind: bad address length, %d",
3123 			    tbr->ADDR_length);
3124 		}
3125 		tcp_err_ack(tcp, mp, TBADADDR, 0);
3126 		return;
3127 	}
3128 	tcp->tcp_bound_source_v6 = v6addr;
3129 
3130 	/* Check for change in ipversion */
3131 	if (origipversion != tcp->tcp_ipversion) {
3132 		ASSERT(tcp->tcp_family == AF_INET6);
3133 		err = tcp->tcp_ipversion == IPV6_VERSION ?
3134 		    tcp_header_init_ipv6(tcp) : tcp_header_init_ipv4(tcp);
3135 		if (err) {
3136 			tcp_err_ack(tcp, mp, TSYSERR, ENOMEM);
3137 			return;
3138 		}
3139 	}
3140 
3141 	/*
3142 	 * Initialize family specific fields. Copy of the src addr.
3143 	 * in tcp_t is needed for the lookup funcs.
3144 	 */
3145 	if (tcp->tcp_ipversion == IPV6_VERSION) {
3146 		tcp->tcp_ip6h->ip6_src = v6addr;
3147 	} else {
3148 		IN6_V4MAPPED_TO_IPADDR(&v6addr, tcp->tcp_ipha->ipha_src);
3149 	}
3150 	tcp->tcp_ip_src_v6 = v6addr;
3151 
3152 	/*
3153 	 * For O_T_BIND_REQ:
3154 	 * Verify that the target port/addr is available, or choose
3155 	 * another.
3156 	 * For  T_BIND_REQ:
3157 	 * Verify that the target port/addr is available or fail.
3158 	 * In both cases when it succeeds the tcp is inserted in the
3159 	 * bind hash table. This ensures that the operation is atomic
3160 	 * under the lock on the hash bucket.
3161 	 */
3162 	bind_to_req_port_only = requested_port != 0 &&
3163 	    tbr->PRIM_type != O_T_BIND_REQ;
3164 	/*
3165 	 * Get a valid port (within the anonymous range and should not
3166 	 * be a privileged one) to use if the user has not given a port.
3167 	 * If multiple threads are here, they may all start with
3168 	 * with the same initial port. But, it should be fine as long as
3169 	 * tcp_bindi will ensure that no two threads will be assigned
3170 	 * the same port.
3171 	 *
3172 	 * NOTE: XXX If a privileged process asks for an anonymous port, we
3173 	 * still check for ports only in the range > tcp_smallest_non_priv_port,
3174 	 * unless TCP_ANONPRIVBIND option is set.
3175 	 */
3176 	mlptype = mlptSingle;
3177 	mlp_port = requested_port;
3178 	if (requested_port == 0) {
3179 		requested_port = tcp->tcp_anon_priv_bind ?
3180 		    tcp_get_next_priv_port(tcp) :
3181 		    tcp_update_next_port(tcp_next_port_to_try, tcp, B_TRUE);
3182 		if (requested_port == 0) {
3183 			tcp_err_ack(tcp, mp, TNOADDR, 0);
3184 			return;
3185 		}
3186 		user_specified = B_FALSE;
3187 
3188 		/*
3189 		 * If the user went through one of the RPC interfaces to create
3190 		 * this socket and RPC is MLP in this zone, then give him an
3191 		 * anonymous MLP.
3192 		 */
3193 		cr = DB_CREDDEF(mp, tcp->tcp_cred);
3194 		connp = tcp->tcp_connp;
3195 		if (connp->conn_anon_mlp && is_system_labeled()) {
3196 			zone = crgetzone(cr);
3197 			addrtype = tsol_mlp_addr_type(zone->zone_id,
3198 			    IPV6_VERSION, &v6addr);
3199 			if (addrtype == mlptSingle) {
3200 				tcp_err_ack(tcp, mp, TNOADDR, 0);
3201 				return;
3202 			}
3203 			mlptype = tsol_mlp_port_type(zone, IPPROTO_TCP,
3204 			    PMAPPORT, addrtype);
3205 			mlp_port = PMAPPORT;
3206 		}
3207 	} else {
3208 		int i;
3209 		boolean_t priv = B_FALSE;
3210 
3211 		/*
3212 		 * If the requested_port is in the well-known privileged range,
3213 		 * verify that the stream was opened by a privileged user.
3214 		 * Note: No locks are held when inspecting tcp_g_*epriv_ports
3215 		 * but instead the code relies on:
3216 		 * - the fact that the address of the array and its size never
3217 		 *   changes
3218 		 * - the atomic assignment of the elements of the array
3219 		 */
3220 		cr = DB_CREDDEF(mp, tcp->tcp_cred);
3221 		if (requested_port < tcp_smallest_nonpriv_port) {
3222 			priv = B_TRUE;
3223 		} else {
3224 			for (i = 0; i < tcp_g_num_epriv_ports; i++) {
3225 				if (requested_port ==
3226 				    tcp_g_epriv_ports[i]) {
3227 					priv = B_TRUE;
3228 					break;
3229 				}
3230 			}
3231 		}
3232 		if (priv) {
3233 			if (secpolicy_net_privaddr(cr, requested_port) != 0) {
3234 				if (tcp->tcp_debug) {
3235 					(void) strlog(TCP_MOD_ID, 0, 1,
3236 					    SL_ERROR|SL_TRACE,
3237 					    "tcp_bind: no priv for port %d",
3238 					    requested_port);
3239 				}
3240 				tcp_err_ack(tcp, mp, TACCES, 0);
3241 				return;
3242 			}
3243 		}
3244 		user_specified = B_TRUE;
3245 
3246 		connp = tcp->tcp_connp;
3247 		if (is_system_labeled()) {
3248 			zone = crgetzone(cr);
3249 			addrtype = tsol_mlp_addr_type(zone->zone_id,
3250 			    IPV6_VERSION, &v6addr);
3251 			if (addrtype == mlptSingle) {
3252 				tcp_err_ack(tcp, mp, TNOADDR, 0);
3253 				return;
3254 			}
3255 			mlptype = tsol_mlp_port_type(zone, IPPROTO_TCP,
3256 			    requested_port, addrtype);
3257 		}
3258 	}
3259 
3260 	if (mlptype != mlptSingle) {
3261 		if (secpolicy_net_bindmlp(cr) != 0) {
3262 			if (tcp->tcp_debug) {
3263 				(void) strlog(TCP_MOD_ID, 0, 1,
3264 				    SL_ERROR|SL_TRACE,
3265 				    "tcp_bind: no priv for multilevel port %d",
3266 				    requested_port);
3267 			}
3268 			tcp_err_ack(tcp, mp, TACCES, 0);
3269 			return;
3270 		}
3271 
3272 		/*
3273 		 * If we're specifically binding a shared IP address and the
3274 		 * port is MLP on shared addresses, then check to see if this
3275 		 * zone actually owns the MLP.  Reject if not.
3276 		 */
3277 		if (mlptype == mlptShared && addrtype == mlptShared) {
3278 			zoneid_t mlpzone;
3279 
3280 			mlpzone = tsol_mlp_findzone(IPPROTO_TCP,
3281 			    htons(mlp_port));
3282 			if (connp->conn_zoneid != mlpzone) {
3283 				if (tcp->tcp_debug) {
3284 					(void) strlog(TCP_MOD_ID, 0, 1,
3285 					    SL_ERROR|SL_TRACE,
3286 					    "tcp_bind: attempt to bind port "
3287 					    "%d on shared addr in zone %d "
3288 					    "(should be %d)",
3289 					    mlp_port, connp->conn_zoneid,
3290 					    mlpzone);
3291 				}
3292 				tcp_err_ack(tcp, mp, TACCES, 0);
3293 				return;
3294 			}
3295 		}
3296 
3297 		if (!user_specified) {
3298 			err = tsol_mlp_anon(zone, mlptype, connp->conn_ulp,
3299 			    requested_port, B_TRUE);
3300 			if (err != 0) {
3301 				if (tcp->tcp_debug) {
3302 					(void) strlog(TCP_MOD_ID, 0, 1,
3303 					    SL_ERROR|SL_TRACE,
3304 					    "tcp_bind: cannot establish anon "
3305 					    "MLP for port %d",
3306 					    requested_port);
3307 				}
3308 				tcp_err_ack(tcp, mp, TSYSERR, err);
3309 				return;
3310 			}
3311 			connp->conn_anon_port = B_TRUE;
3312 		}
3313 		connp->conn_mlp_type = mlptype;
3314 	}
3315 
3316 	allocated_port = tcp_bindi(tcp, requested_port, &v6addr,
3317 	    tcp->tcp_reuseaddr, B_FALSE, bind_to_req_port_only, user_specified);
3318 
3319 	if (allocated_port == 0) {
3320 		connp->conn_mlp_type = mlptSingle;
3321 		if (connp->conn_anon_port) {
3322 			connp->conn_anon_port = B_FALSE;
3323 			(void) tsol_mlp_anon(zone, mlptype, connp->conn_ulp,
3324 			    requested_port, B_FALSE);
3325 		}
3326 		if (bind_to_req_port_only) {
3327 			if (tcp->tcp_debug) {
3328 				(void) strlog(TCP_MOD_ID, 0, 1,
3329 				    SL_ERROR|SL_TRACE,
3330 				    "tcp_bind: requested addr busy");
3331 			}
3332 			tcp_err_ack(tcp, mp, TADDRBUSY, 0);
3333 		} else {
3334 			/* If we are out of ports, fail the bind. */
3335 			if (tcp->tcp_debug) {
3336 				(void) strlog(TCP_MOD_ID, 0, 1,
3337 				    SL_ERROR|SL_TRACE,
3338 				    "tcp_bind: out of ports?");
3339 			}
3340 			tcp_err_ack(tcp, mp, TNOADDR, 0);
3341 		}
3342 		return;
3343 	}
3344 	ASSERT(tcp->tcp_state == TCPS_BOUND);
3345 do_bind:
3346 	if (!backlog_update) {
3347 		if (tcp->tcp_family == AF_INET)
3348 			sin->sin_port = htons(allocated_port);
3349 		else
3350 			sin6->sin6_port = htons(allocated_port);
3351 	}
3352 	if (tcp->tcp_family == AF_INET) {
3353 		if (tbr->CONIND_number != 0) {
3354 			mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type,
3355 			    sizeof (sin_t));
3356 		} else {
3357 			/* Just verify the local IP address */
3358 			mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, IP_ADDR_LEN);
3359 		}
3360 	} else {
3361 		if (tbr->CONIND_number != 0) {
3362 			mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type,
3363 			    sizeof (sin6_t));
3364 		} else {
3365 			/* Just verify the local IP address */
3366 			mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type,
3367 			    IPV6_ADDR_LEN);
3368 		}
3369 	}
3370 	if (mp1 == NULL) {
3371 		if (connp->conn_anon_port) {
3372 			connp->conn_anon_port = B_FALSE;
3373 			(void) tsol_mlp_anon(zone, mlptype, connp->conn_ulp,
3374 			    requested_port, B_FALSE);
3375 		}
3376 		connp->conn_mlp_type = mlptSingle;
3377 		tcp_err_ack(tcp, mp, TSYSERR, ENOMEM);
3378 		return;
3379 	}
3380 
3381 	tbr->PRIM_type = T_BIND_ACK;
3382 	mp->b_datap->db_type = M_PCPROTO;
3383 
3384 	/* Chain in the reply mp for tcp_rput() */
3385 	mp1->b_cont = mp;
3386 	mp = mp1;
3387 
3388 	tcp->tcp_conn_req_max = tbr->CONIND_number;
3389 	if (tcp->tcp_conn_req_max) {
3390 		if (tcp->tcp_conn_req_max < tcp_conn_req_min)
3391 			tcp->tcp_conn_req_max = tcp_conn_req_min;
3392 		if (tcp->tcp_conn_req_max > tcp_conn_req_max_q)
3393 			tcp->tcp_conn_req_max = tcp_conn_req_max_q;
3394 		/*
3395 		 * If this is a listener, do not reset the eager list
3396 		 * and other stuffs.  Note that we don't check if the
3397 		 * existing eager list meets the new tcp_conn_req_max
3398 		 * requirement.
3399 		 */
3400 		if (tcp->tcp_state != TCPS_LISTEN) {
3401 			tcp->tcp_state = TCPS_LISTEN;
3402 			/* Initialize the chain. Don't need the eager_lock */
3403 			tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
3404 			tcp->tcp_second_ctimer_threshold =
3405 			    tcp_ip_abort_linterval;
3406 		}
3407 	}
3408 
3409 	/*
3410 	 * We can call ip_bind directly which returns a T_BIND_ACK mp. The
3411 	 * processing continues in tcp_rput_other().
3412 	 */
3413 	if (tcp->tcp_family == AF_INET6) {
3414 		ASSERT(tcp->tcp_connp->conn_af_isv6);
3415 		mp = ip_bind_v6(q, mp, tcp->tcp_connp, &tcp->tcp_sticky_ipp);
3416 	} else {
3417 		ASSERT(!tcp->tcp_connp->conn_af_isv6);
3418 		mp = ip_bind_v4(q, mp, tcp->tcp_connp);
3419 	}
3420 	/*
3421 	 * If the bind cannot complete immediately
3422 	 * IP will arrange to call tcp_rput_other
3423 	 * when the bind completes.
3424 	 */
3425 	if (mp != NULL) {
3426 		tcp_rput_other(tcp, mp);
3427 	} else {
3428 		/*
3429 		 * Bind will be resumed later. Need to ensure
3430 		 * that conn doesn't disappear when that happens.
3431 		 * This will be decremented in ip_resume_tcp_bind().
3432 		 */
3433 		CONN_INC_REF(tcp->tcp_connp);
3434 	}
3435 }
3436 
3437 
3438 /*
3439  * If the "bind_to_req_port_only" parameter is set, if the requested port
3440  * number is available, return it, If not return 0
3441  *
3442  * If "bind_to_req_port_only" parameter is not set and
3443  * If the requested port number is available, return it.  If not, return
3444  * the first anonymous port we happen across.  If no anonymous ports are
3445  * available, return 0. addr is the requested local address, if any.
3446  *
3447  * In either case, when succeeding update the tcp_t to record the port number
3448  * and insert it in the bind hash table.
3449  *
3450  * Note that TCP over IPv4 and IPv6 sockets can use the same port number
3451  * without setting SO_REUSEADDR. This is needed so that they
3452  * can be viewed as two independent transport protocols.
3453  */
3454 static in_port_t
3455 tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr,
3456     int reuseaddr, boolean_t quick_connect,
3457     boolean_t bind_to_req_port_only, boolean_t user_specified)
3458 {
3459 	/* number of times we have run around the loop */
3460 	int count = 0;
3461 	/* maximum number of times to run around the loop */
3462 	int loopmax;
3463 	conn_t *connp = tcp->tcp_connp;
3464 	zoneid_t zoneid = connp->conn_zoneid;
3465 
3466 	/*
3467 	 * Lookup for free addresses is done in a loop and "loopmax"
3468 	 * influences how long we spin in the loop
3469 	 */
3470 	if (bind_to_req_port_only) {
3471 		/*
3472 		 * If the requested port is busy, don't bother to look
3473 		 * for a new one. Setting loop maximum count to 1 has
3474 		 * that effect.
3475 		 */
3476 		loopmax = 1;
3477 	} else {
3478 		/*
3479 		 * If the requested port is busy, look for a free one
3480 		 * in the anonymous port range.
3481 		 * Set loopmax appropriately so that one does not look
3482 		 * forever in the case all of the anonymous ports are in use.
3483 		 */
3484 		if (tcp->tcp_anon_priv_bind) {
3485 			/*
3486 			 * loopmax =
3487 			 * 	(IPPORT_RESERVED-1) - tcp_min_anonpriv_port + 1
3488 			 */
3489 			loopmax = IPPORT_RESERVED - tcp_min_anonpriv_port;
3490 		} else {
3491 			loopmax = (tcp_largest_anon_port -
3492 			    tcp_smallest_anon_port + 1);
3493 		}
3494 	}
3495 	do {
3496 		uint16_t	lport;
3497 		tf_t		*tbf;
3498 		tcp_t		*ltcp;
3499 		conn_t		*lconnp;
3500 
3501 		lport = htons(port);
3502 
3503 		/*
3504 		 * Ensure that the tcp_t is not currently in the bind hash.
3505 		 * Hold the lock on the hash bucket to ensure that
3506 		 * the duplicate check plus the insertion is an atomic
3507 		 * operation.
3508 		 *
3509 		 * This function does an inline lookup on the bind hash list
3510 		 * Make sure that we access only members of tcp_t
3511 		 * and that we don't look at tcp_tcp, since we are not
3512 		 * doing a CONN_INC_REF.
3513 		 */
3514 		tcp_bind_hash_remove(tcp);
3515 		tbf = &tcp_bind_fanout[TCP_BIND_HASH(lport)];
3516 		mutex_enter(&tbf->tf_lock);
3517 		for (ltcp = tbf->tf_tcp; ltcp != NULL;
3518 		    ltcp = ltcp->tcp_bind_hash) {
3519 			boolean_t not_socket;
3520 			boolean_t exclbind;
3521 
3522 			if (lport != ltcp->tcp_lport)
3523 				continue;
3524 
3525 			lconnp = ltcp->tcp_connp;
3526 
3527 			/*
3528 			 * On a labeled system, we must treat bindings to ports
3529 			 * on shared IP addresses by sockets with MAC exemption
3530 			 * privilege as being in all zones, as there's
3531 			 * otherwise no way to identify the right receiver.
3532 			 */
3533 			if (!IPCL_ZONE_MATCH(ltcp->tcp_connp, zoneid) &&
3534 			    !lconnp->conn_mac_exempt &&
3535 			    !connp->conn_mac_exempt)
3536 				continue;
3537 
3538 			/*
3539 			 * If TCP_EXCLBIND is set for either the bound or
3540 			 * binding endpoint, the semantics of bind
3541 			 * is changed according to the following.
3542 			 *
3543 			 * spec = specified address (v4 or v6)
3544 			 * unspec = unspecified address (v4 or v6)
3545 			 * A = specified addresses are different for endpoints
3546 			 *
3547 			 * bound	bind to		allowed
3548 			 * -------------------------------------
3549 			 * unspec	unspec		no
3550 			 * unspec	spec		no
3551 			 * spec		unspec		no
3552 			 * spec		spec		yes if A
3553 			 *
3554 			 * For labeled systems, SO_MAC_EXEMPT behaves the same
3555 			 * as TCP_EXCLBIND, except that zoneid is ignored.
3556 			 *
3557 			 * Note:
3558 			 *
3559 			 * 1. Because of TLI semantics, an endpoint can go
3560 			 * back from, say TCP_ESTABLISHED to TCPS_LISTEN or
3561 			 * TCPS_BOUND, depending on whether it is originally
3562 			 * a listener or not.  That is why we need to check
3563 			 * for states greater than or equal to TCPS_BOUND
3564 			 * here.
3565 			 *
3566 			 * 2. Ideally, we should only check for state equals
3567 			 * to TCPS_LISTEN. And the following check should be
3568 			 * added.
3569 			 *
3570 			 * if (ltcp->tcp_state == TCPS_LISTEN ||
3571 			 *	!reuseaddr || !ltcp->tcp_reuseaddr) {
3572 			 *		...
3573 			 * }
3574 			 *
3575 			 * The semantics will be changed to this.  If the
3576 			 * endpoint on the list is in state not equal to
3577 			 * TCPS_LISTEN and both endpoints have SO_REUSEADDR
3578 			 * set, let the bind succeed.
3579 			 *
3580 			 * Because of (1), we cannot do that for TLI
3581 			 * endpoints.  But we can do that for socket endpoints.
3582 			 * If in future, we can change this going back
3583 			 * semantics, we can use the above check for TLI also.
3584 			 */
3585 			not_socket = !(TCP_IS_SOCKET(ltcp) &&
3586 			    TCP_IS_SOCKET(tcp));
3587 			exclbind = ltcp->tcp_exclbind || tcp->tcp_exclbind;
3588 
3589 			if (lconnp->conn_mac_exempt || connp->conn_mac_exempt ||
3590 			    (exclbind && (not_socket ||
3591 			    ltcp->tcp_state <= TCPS_ESTABLISHED))) {
3592 				if (V6_OR_V4_INADDR_ANY(
3593 				    ltcp->tcp_bound_source_v6) ||
3594 				    V6_OR_V4_INADDR_ANY(*laddr) ||
3595 				    IN6_ARE_ADDR_EQUAL(laddr,
3596 				    &ltcp->tcp_bound_source_v6)) {
3597 					break;
3598 				}
3599 				continue;
3600 			}
3601 
3602 			/*
3603 			 * Check ipversion to allow IPv4 and IPv6 sockets to
3604 			 * have disjoint port number spaces, if *_EXCLBIND
3605 			 * is not set and only if the application binds to a
3606 			 * specific port. We use the same autoassigned port
3607 			 * number space for IPv4 and IPv6 sockets.
3608 			 */
3609 			if (tcp->tcp_ipversion != ltcp->tcp_ipversion &&
3610 			    bind_to_req_port_only)
3611 				continue;
3612 
3613 			/*
3614 			 * Ideally, we should make sure that the source
3615 			 * address, remote address, and remote port in the
3616 			 * four tuple for this tcp-connection is unique.
3617 			 * However, trying to find out the local source
3618 			 * address would require too much code duplication
3619 			 * with IP, since IP needs needs to have that code
3620 			 * to support userland TCP implementations.
3621 			 */
3622 			if (quick_connect &&
3623 			    (ltcp->tcp_state > TCPS_LISTEN) &&
3624 			    ((tcp->tcp_fport != ltcp->tcp_fport) ||
3625 				!IN6_ARE_ADDR_EQUAL(&tcp->tcp_remote_v6,
3626 				    &ltcp->tcp_remote_v6)))
3627 				continue;
3628 
3629 			if (!reuseaddr) {
3630 				/*
3631 				 * No socket option SO_REUSEADDR.
3632 				 * If existing port is bound to
3633 				 * a non-wildcard IP address
3634 				 * and the requesting stream is
3635 				 * bound to a distinct
3636 				 * different IP addresses
3637 				 * (non-wildcard, also), keep
3638 				 * going.
3639 				 */
3640 				if (!V6_OR_V4_INADDR_ANY(*laddr) &&
3641 				    !V6_OR_V4_INADDR_ANY(
3642 				    ltcp->tcp_bound_source_v6) &&
3643 				    !IN6_ARE_ADDR_EQUAL(laddr,
3644 					&ltcp->tcp_bound_source_v6))
3645 					continue;
3646 				if (ltcp->tcp_state >= TCPS_BOUND) {
3647 					/*
3648 					 * This port is being used and
3649 					 * its state is >= TCPS_BOUND,
3650 					 * so we can't bind to it.
3651 					 */
3652 					break;
3653 				}
3654 			} else {
3655 				/*
3656 				 * socket option SO_REUSEADDR is set on the
3657 				 * binding tcp_t.
3658 				 *
3659 				 * If two streams are bound to
3660 				 * same IP address or both addr
3661 				 * and bound source are wildcards
3662 				 * (INADDR_ANY), we want to stop
3663 				 * searching.
3664 				 * We have found a match of IP source
3665 				 * address and source port, which is
3666 				 * refused regardless of the
3667 				 * SO_REUSEADDR setting, so we break.
3668 				 */
3669 				if (IN6_ARE_ADDR_EQUAL(laddr,
3670 				    &ltcp->tcp_bound_source_v6) &&
3671 				    (ltcp->tcp_state == TCPS_LISTEN ||
3672 					ltcp->tcp_state == TCPS_BOUND))
3673 					break;
3674 			}
3675 		}
3676 		if (ltcp != NULL) {
3677 			/* The port number is busy */
3678 			mutex_exit(&tbf->tf_lock);
3679 		} else {
3680 			/*
3681 			 * This port is ours. Insert in fanout and mark as
3682 			 * bound to prevent others from getting the port
3683 			 * number.
3684 			 */
3685 			tcp->tcp_state = TCPS_BOUND;
3686 			tcp->tcp_lport = htons(port);
3687 			*(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport;
3688 
3689 			ASSERT(&tcp_bind_fanout[TCP_BIND_HASH(
3690 			    tcp->tcp_lport)] == tbf);
3691 			tcp_bind_hash_insert(tbf, tcp, 1);
3692 
3693 			mutex_exit(&tbf->tf_lock);
3694 
3695 			/*
3696 			 * We don't want tcp_next_port_to_try to "inherit"
3697 			 * a port number supplied by the user in a bind.
3698 			 */
3699 			if (user_specified)
3700 				return (port);
3701 
3702 			/*
3703 			 * This is the only place where tcp_next_port_to_try
3704 			 * is updated. After the update, it may or may not
3705 			 * be in the valid range.
3706 			 */
3707 			if (!tcp->tcp_anon_priv_bind)
3708 				tcp_next_port_to_try = port + 1;
3709 			return (port);
3710 		}
3711 
3712 		if (tcp->tcp_anon_priv_bind) {
3713 			port = tcp_get_next_priv_port(tcp);
3714 		} else {
3715 			if (count == 0 && user_specified) {
3716 				/*
3717 				 * We may have to return an anonymous port. So
3718 				 * get one to start with.
3719 				 */
3720 				port =
3721 				    tcp_update_next_port(tcp_next_port_to_try,
3722 					tcp, B_TRUE);
3723 				user_specified = B_FALSE;
3724 			} else {
3725 				port = tcp_update_next_port(port + 1, tcp,
3726 				    B_FALSE);
3727 			}
3728 		}
3729 		if (port == 0)
3730 			break;
3731 
3732 		/*
3733 		 * Don't let this loop run forever in the case where
3734 		 * all of the anonymous ports are in use.
3735 		 */
3736 	} while (++count < loopmax);
3737 	return (0);
3738 }
3739 
3740 /*
3741  * We are dying for some reason.  Try to do it gracefully.  (May be called
3742  * as writer.)
3743  *
3744  * Return -1 if the structure was not cleaned up (if the cleanup had to be
3745  * done by a service procedure).
3746  * TBD - Should the return value distinguish between the tcp_t being
3747  * freed and it being reinitialized?
3748  */
3749 static int
3750 tcp_clean_death(tcp_t *tcp, int err, uint8_t tag)
3751 {
3752 	mblk_t	*mp;
3753 	queue_t	*q;
3754 
3755 	TCP_CLD_STAT(tag);
3756 
3757 #if TCP_TAG_CLEAN_DEATH
3758 	tcp->tcp_cleandeathtag = tag;
3759 #endif
3760 
3761 	if (tcp->tcp_fused)
3762 		tcp_unfuse(tcp);
3763 
3764 	if (tcp->tcp_linger_tid != 0 &&
3765 	    TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
3766 		tcp_stop_lingering(tcp);
3767 	}
3768 
3769 	ASSERT(tcp != NULL);
3770 	ASSERT((tcp->tcp_family == AF_INET &&
3771 	    tcp->tcp_ipversion == IPV4_VERSION) ||
3772 	    (tcp->tcp_family == AF_INET6 &&
3773 	    (tcp->tcp_ipversion == IPV4_VERSION ||
3774 	    tcp->tcp_ipversion == IPV6_VERSION)));
3775 
3776 	if (TCP_IS_DETACHED(tcp)) {
3777 		if (tcp->tcp_hard_binding) {
3778 			/*
3779 			 * Its an eager that we are dealing with. We close the
3780 			 * eager but in case a conn_ind has already gone to the
3781 			 * listener, let tcp_accept_finish() send a discon_ind
3782 			 * to the listener and drop the last reference. If the
3783 			 * listener doesn't even know about the eager i.e. the
3784 			 * conn_ind hasn't gone up, blow away the eager and drop
3785 			 * the last reference as well. If the conn_ind has gone
3786 			 * up, state should be BOUND. tcp_accept_finish
3787 			 * will figure out that the connection has received a
3788 			 * RST and will send a DISCON_IND to the application.
3789 			 */
3790 			tcp_closei_local(tcp);
3791 			if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) {
3792 				CONN_DEC_REF(tcp->tcp_connp);
3793 			} else {
3794 				tcp->tcp_state = TCPS_BOUND;
3795 			}
3796 		} else {
3797 			tcp_close_detached(tcp);
3798 		}
3799 		return (0);
3800 	}
3801 
3802 	TCP_STAT(tcp_clean_death_nondetached);
3803 
3804 	/*
3805 	 * If T_ORDREL_IND has not been sent yet (done when service routine
3806 	 * is run) postpone cleaning up the endpoint until service routine
3807 	 * has sent up the T_ORDREL_IND. Avoid clearing out an existing
3808 	 * client_errno since tcp_close uses the client_errno field.
3809 	 */
3810 	if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) {
3811 		if (err != 0)
3812 			tcp->tcp_client_errno = err;
3813 
3814 		tcp->tcp_deferred_clean_death = B_TRUE;
3815 		return (-1);
3816 	}
3817 
3818 	q = tcp->tcp_rq;
3819 
3820 	/* Trash all inbound data */
3821 	flushq(q, FLUSHALL);
3822 
3823 	/*
3824 	 * If we are at least part way open and there is error
3825 	 * (err==0 implies no error)
3826 	 * notify our client by a T_DISCON_IND.
3827 	 */
3828 	if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) {
3829 		if (tcp->tcp_state >= TCPS_ESTABLISHED &&
3830 		    !TCP_IS_SOCKET(tcp)) {
3831 			/*
3832 			 * Send M_FLUSH according to TPI. Because sockets will
3833 			 * (and must) ignore FLUSHR we do that only for TPI
3834 			 * endpoints and sockets in STREAMS mode.
3835 			 */
3836 			(void) putnextctl1(q, M_FLUSH, FLUSHR);
3837 		}
3838 		if (tcp->tcp_debug) {
3839 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
3840 			    "tcp_clean_death: discon err %d", err);
3841 		}
3842 		mp = mi_tpi_discon_ind(NULL, err, 0);
3843 		if (mp != NULL) {
3844 			putnext(q, mp);
3845 		} else {
3846 			if (tcp->tcp_debug) {
3847 				(void) strlog(TCP_MOD_ID, 0, 1,
3848 				    SL_ERROR|SL_TRACE,
3849 				    "tcp_clean_death, sending M_ERROR");
3850 			}
3851 			(void) putnextctl1(q, M_ERROR, EPROTO);
3852 		}
3853 		if (tcp->tcp_state <= TCPS_SYN_RCVD) {
3854 			/* SYN_SENT or SYN_RCVD */
3855 			BUMP_MIB(&tcp_mib, tcpAttemptFails);
3856 		} else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) {
3857 			/* ESTABLISHED or CLOSE_WAIT */
3858 			BUMP_MIB(&tcp_mib, tcpEstabResets);
3859 		}
3860 	}
3861 
3862 	tcp_reinit(tcp);
3863 	return (-1);
3864 }
3865 
3866 /*
3867  * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout
3868  * to expire, stop the wait and finish the close.
3869  */
3870 static void
3871 tcp_stop_lingering(tcp_t *tcp)
3872 {
3873 	clock_t	delta = 0;
3874 
3875 	tcp->tcp_linger_tid = 0;
3876 	if (tcp->tcp_state > TCPS_LISTEN) {
3877 		tcp_acceptor_hash_remove(tcp);
3878 		if (tcp->tcp_flow_stopped) {
3879 			tcp_clrqfull(tcp);
3880 		}
3881 
3882 		if (tcp->tcp_timer_tid != 0) {
3883 			delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid);
3884 			tcp->tcp_timer_tid = 0;
3885 		}
3886 		/*
3887 		 * Need to cancel those timers which will not be used when
3888 		 * TCP is detached.  This has to be done before the tcp_wq
3889 		 * is set to the global queue.
3890 		 */
3891 		tcp_timers_stop(tcp);
3892 
3893 
3894 		tcp->tcp_detached = B_TRUE;
3895 		tcp->tcp_rq = tcp_g_q;
3896 		tcp->tcp_wq = WR(tcp_g_q);
3897 
3898 		if (tcp->tcp_state == TCPS_TIME_WAIT) {
3899 			tcp_time_wait_append(tcp);
3900 			TCP_DBGSTAT(tcp_detach_time_wait);
3901 			goto finish;
3902 		}
3903 
3904 		/*
3905 		 * If delta is zero the timer event wasn't executed and was
3906 		 * successfully canceled. In this case we need to restart it
3907 		 * with the minimal delta possible.
3908 		 */
3909 		if (delta >= 0) {
3910 			tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer,
3911 			    delta ? delta : 1);
3912 		}
3913 	} else {
3914 		tcp_closei_local(tcp);
3915 		CONN_DEC_REF(tcp->tcp_connp);
3916 	}
3917 finish:
3918 	/* Signal closing thread that it can complete close */
3919 	mutex_enter(&tcp->tcp_closelock);
3920 	tcp->tcp_detached = B_TRUE;
3921 	tcp->tcp_rq = tcp_g_q;
3922 	tcp->tcp_wq = WR(tcp_g_q);
3923 	tcp->tcp_closed = 1;
3924 	cv_signal(&tcp->tcp_closecv);
3925 	mutex_exit(&tcp->tcp_closelock);
3926 }
3927 
3928 /*
3929  * Handle lingering timeouts. This function is called when the SO_LINGER timeout
3930  * expires.
3931  */
3932 static void
3933 tcp_close_linger_timeout(void *arg)
3934 {
3935 	conn_t	*connp = (conn_t *)arg;
3936 	tcp_t 	*tcp = connp->conn_tcp;
3937 
3938 	tcp->tcp_client_errno = ETIMEDOUT;
3939 	tcp_stop_lingering(tcp);
3940 }
3941 
3942 static int
3943 tcp_close(queue_t *q, int flags)
3944 {
3945 	conn_t		*connp = Q_TO_CONN(q);
3946 	tcp_t		*tcp = connp->conn_tcp;
3947 	mblk_t 		*mp = &tcp->tcp_closemp;
3948 	boolean_t	conn_ioctl_cleanup_reqd = B_FALSE;
3949 	boolean_t	linger_interrupted = B_FALSE;
3950 	mblk_t		*bp;
3951 
3952 	ASSERT(WR(q)->q_next == NULL);
3953 	ASSERT(connp->conn_ref >= 2);
3954 	ASSERT((connp->conn_flags & IPCL_TCPMOD) == 0);
3955 
3956 	/*
3957 	 * We are being closed as /dev/tcp or /dev/tcp6.
3958 	 *
3959 	 * Mark the conn as closing. ill_pending_mp_add will not
3960 	 * add any mp to the pending mp list, after this conn has
3961 	 * started closing. Same for sq_pending_mp_add
3962 	 */
3963 	mutex_enter(&connp->conn_lock);
3964 	connp->conn_state_flags |= CONN_CLOSING;
3965 	if (connp->conn_oper_pending_ill != NULL)
3966 		conn_ioctl_cleanup_reqd = B_TRUE;
3967 	CONN_INC_REF_LOCKED(connp);
3968 	mutex_exit(&connp->conn_lock);
3969 	tcp->tcp_closeflags = (uint8_t)flags;
3970 	ASSERT(connp->conn_ref >= 3);
3971 
3972 	(*tcp_squeue_close_proc)(connp->conn_sqp, mp,
3973 	    tcp_close_output, connp, SQTAG_IP_TCP_CLOSE);
3974 
3975 	mutex_enter(&tcp->tcp_closelock);
3976 	while (!tcp->tcp_closed) {
3977 		if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) {
3978 			/*
3979 			 * We got interrupted. Check if we are lingering,
3980 			 * if yes, post a message to stop and wait until
3981 			 * tcp_closed is set. If we aren't lingering,
3982 			 * just go back around.
3983 			 */
3984 			if (tcp->tcp_linger &&
3985 			    tcp->tcp_lingertime > 0 &&
3986 			    !linger_interrupted) {
3987 				mutex_exit(&tcp->tcp_closelock);
3988 				/* Entering squeue, bump ref count. */
3989 				CONN_INC_REF(connp);
3990 				bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL);
3991 				squeue_enter(connp->conn_sqp, bp,
3992 				    tcp_linger_interrupted, connp,
3993 				    SQTAG_IP_TCP_CLOSE);
3994 				linger_interrupted = B_TRUE;
3995 				mutex_enter(&tcp->tcp_closelock);
3996 			}
3997 		}
3998 	}
3999 	mutex_exit(&tcp->tcp_closelock);
4000 
4001 	/*
4002 	 * In the case of listener streams that have eagers in the q or q0
4003 	 * we wait for the eagers to drop their reference to us. tcp_rq and
4004 	 * tcp_wq of the eagers point to our queues. By waiting for the
4005 	 * refcnt to drop to 1, we are sure that the eagers have cleaned
4006 	 * up their queue pointers and also dropped their references to us.
4007 	 */
4008 	if (tcp->tcp_wait_for_eagers) {
4009 		mutex_enter(&connp->conn_lock);
4010 		while (connp->conn_ref != 1) {
4011 			cv_wait(&connp->conn_cv, &connp->conn_lock);
4012 		}
4013 		mutex_exit(&connp->conn_lock);
4014 	}
4015 	/*
4016 	 * ioctl cleanup. The mp is queued in the
4017 	 * ill_pending_mp or in the sq_pending_mp.
4018 	 */
4019 	if (conn_ioctl_cleanup_reqd)
4020 		conn_ioctl_cleanup(connp);
4021 
4022 	qprocsoff(q);
4023 	inet_minor_free(ip_minor_arena, connp->conn_dev);
4024 
4025 	tcp->tcp_cpid = -1;
4026 
4027 	/*
4028 	 * Drop IP's reference on the conn. This is the last reference
4029 	 * on the connp if the state was less than established. If the
4030 	 * connection has gone into timewait state, then we will have
4031 	 * one ref for the TCP and one more ref (total of two) for the
4032 	 * classifier connected hash list (a timewait connections stays
4033 	 * in connected hash till closed).
4034 	 *
4035 	 * We can't assert the references because there might be other
4036 	 * transient reference places because of some walkers or queued
4037 	 * packets in squeue for the timewait state.
4038 	 */
4039 	CONN_DEC_REF(connp);
4040 	q->q_ptr = WR(q)->q_ptr = NULL;
4041 	return (0);
4042 }
4043 
4044 static int
4045 tcpclose_accept(queue_t *q)
4046 {
4047 	ASSERT(WR(q)->q_qinfo == &tcp_acceptor_winit);
4048 
4049 	/*
4050 	 * We had opened an acceptor STREAM for sockfs which is
4051 	 * now being closed due to some error.
4052 	 */
4053 	qprocsoff(q);
4054 	inet_minor_free(ip_minor_arena, (dev_t)q->q_ptr);
4055 	q->q_ptr = WR(q)->q_ptr = NULL;
4056 	return (0);
4057 }
4058 
4059 /*
4060  * Called by tcp_close() routine via squeue when lingering is
4061  * interrupted by a signal.
4062  */
4063 
4064 /* ARGSUSED */
4065 static void
4066 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2)
4067 {
4068 	conn_t	*connp = (conn_t *)arg;
4069 	tcp_t	*tcp = connp->conn_tcp;
4070 
4071 	freeb(mp);
4072 	if (tcp->tcp_linger_tid != 0 &&
4073 	    TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
4074 		tcp_stop_lingering(tcp);
4075 		tcp->tcp_client_errno = EINTR;
4076 	}
4077 }
4078 
4079 /*
4080  * Called by streams close routine via squeues when our client blows off her
4081  * descriptor, we take this to mean: "close the stream state NOW, close the tcp
4082  * connection politely" When SO_LINGER is set (with a non-zero linger time and
4083  * it is not a nonblocking socket) then this routine sleeps until the FIN is
4084  * acked.
4085  *
4086  * NOTE: tcp_close potentially returns error when lingering.
4087  * However, the stream head currently does not pass these errors
4088  * to the application. 4.4BSD only returns EINTR and EWOULDBLOCK
4089  * errors to the application (from tsleep()) and not errors
4090  * like ECONNRESET caused by receiving a reset packet.
4091  */
4092 
4093 /* ARGSUSED */
4094 static void
4095 tcp_close_output(void *arg, mblk_t *mp, void *arg2)
4096 {
4097 	char	*msg;
4098 	conn_t	*connp = (conn_t *)arg;
4099 	tcp_t	*tcp = connp->conn_tcp;
4100 	clock_t	delta = 0;
4101 
4102 	ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) ||
4103 	    (connp->conn_fanout == NULL && connp->conn_ref >= 3));
4104 
4105 	/* Cancel any pending timeout */
4106 	if (tcp->tcp_ordrelid != 0) {
4107 		if (tcp->tcp_timeout) {
4108 			(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ordrelid);
4109 		}
4110 		tcp->tcp_ordrelid = 0;
4111 		tcp->tcp_timeout = B_FALSE;
4112 	}
4113 
4114 	mutex_enter(&tcp->tcp_eager_lock);
4115 	if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) {
4116 		/* Cleanup for listener */
4117 		tcp_eager_cleanup(tcp, 0);
4118 		tcp->tcp_wait_for_eagers = 1;
4119 	}
4120 	mutex_exit(&tcp->tcp_eager_lock);
4121 
4122 	connp->conn_mdt_ok = B_FALSE;
4123 	tcp->tcp_mdt = B_FALSE;
4124 
4125 	msg = NULL;
4126 	switch (tcp->tcp_state) {
4127 	case TCPS_CLOSED:
4128 	case TCPS_IDLE:
4129 	case TCPS_BOUND:
4130 	case TCPS_LISTEN:
4131 		break;
4132 	case TCPS_SYN_SENT:
4133 		msg = "tcp_close, during connect";
4134 		break;
4135 	case TCPS_SYN_RCVD:
4136 		/*
4137 		 * Close during the connect 3-way handshake
4138 		 * but here there may or may not be pending data
4139 		 * already on queue. Process almost same as in
4140 		 * the ESTABLISHED state.
4141 		 */
4142 		/* FALLTHRU */
4143 	default:
4144 		if (tcp->tcp_fused)
4145 			tcp_unfuse(tcp);
4146 
4147 		/*
4148 		 * If SO_LINGER has set a zero linger time, abort the
4149 		 * connection with a reset.
4150 		 */
4151 		if (tcp->tcp_linger && tcp->tcp_lingertime == 0) {
4152 			msg = "tcp_close, zero lingertime";
4153 			break;
4154 		}
4155 
4156 		ASSERT(tcp->tcp_hard_bound || tcp->tcp_hard_binding);
4157 		/*
4158 		 * Abort connection if there is unread data queued.
4159 		 */
4160 		if (tcp->tcp_rcv_list || tcp->tcp_reass_head) {
4161 			msg = "tcp_close, unread data";
4162 			break;
4163 		}
4164 		/*
4165 		 * tcp_hard_bound is now cleared thus all packets go through
4166 		 * tcp_lookup. This fact is used by tcp_detach below.
4167 		 *
4168 		 * We have done a qwait() above which could have possibly
4169 		 * drained more messages in turn causing transition to a
4170 		 * different state. Check whether we have to do the rest
4171 		 * of the processing or not.
4172 		 */
4173 		if (tcp->tcp_state <= TCPS_LISTEN)
4174 			break;
4175 
4176 		/*
4177 		 * Transmit the FIN before detaching the tcp_t.
4178 		 * After tcp_detach returns this queue/perimeter
4179 		 * no longer owns the tcp_t thus others can modify it.
4180 		 */
4181 		(void) tcp_xmit_end(tcp);
4182 
4183 		/*
4184 		 * If lingering on close then wait until the fin is acked,
4185 		 * the SO_LINGER time passes, or a reset is sent/received.
4186 		 */
4187 		if (tcp->tcp_linger && tcp->tcp_lingertime > 0 &&
4188 		    !(tcp->tcp_fin_acked) &&
4189 		    tcp->tcp_state >= TCPS_ESTABLISHED) {
4190 			if (tcp->tcp_closeflags & (FNDELAY|FNONBLOCK)) {
4191 				tcp->tcp_client_errno = EWOULDBLOCK;
4192 			} else if (tcp->tcp_client_errno == 0) {
4193 
4194 				ASSERT(tcp->tcp_linger_tid == 0);
4195 
4196 				tcp->tcp_linger_tid = TCP_TIMER(tcp,
4197 				    tcp_close_linger_timeout,
4198 				    tcp->tcp_lingertime * hz);
4199 
4200 				/* tcp_close_linger_timeout will finish close */
4201 				if (tcp->tcp_linger_tid == 0)
4202 					tcp->tcp_client_errno = ENOSR;
4203 				else
4204 					return;
4205 			}
4206 
4207 			/*
4208 			 * Check if we need to detach or just close
4209 			 * the instance.
4210 			 */
4211 			if (tcp->tcp_state <= TCPS_LISTEN)
4212 				break;
4213 		}
4214 
4215 		/*
4216 		 * Make sure that no other thread will access the tcp_rq of
4217 		 * this instance (through lookups etc.) as tcp_rq will go
4218 		 * away shortly.
4219 		 */
4220 		tcp_acceptor_hash_remove(tcp);
4221 
4222 		if (tcp->tcp_flow_stopped) {
4223 			tcp_clrqfull(tcp);
4224 		}
4225 
4226 		if (tcp->tcp_timer_tid != 0) {
4227 			delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid);
4228 			tcp->tcp_timer_tid = 0;
4229 		}
4230 		/*
4231 		 * Need to cancel those timers which will not be used when
4232 		 * TCP is detached.  This has to be done before the tcp_wq
4233 		 * is set to the global queue.
4234 		 */
4235 		tcp_timers_stop(tcp);
4236 
4237 		tcp->tcp_detached = B_TRUE;
4238 		if (tcp->tcp_state == TCPS_TIME_WAIT) {
4239 			tcp_time_wait_append(tcp);
4240 			TCP_DBGSTAT(tcp_detach_time_wait);
4241 			ASSERT(connp->conn_ref >= 3);
4242 			goto finish;
4243 		}
4244 
4245 		/*
4246 		 * If delta is zero the timer event wasn't executed and was
4247 		 * successfully canceled. In this case we need to restart it
4248 		 * with the minimal delta possible.
4249 		 */
4250 		if (delta >= 0)
4251 			tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer,
4252 			    delta ? delta : 1);
4253 
4254 		ASSERT(connp->conn_ref >= 3);
4255 		goto finish;
4256 	}
4257 
4258 	/* Detach did not complete. Still need to remove q from stream. */
4259 	if (msg) {
4260 		if (tcp->tcp_state == TCPS_ESTABLISHED ||
4261 		    tcp->tcp_state == TCPS_CLOSE_WAIT)
4262 			BUMP_MIB(&tcp_mib, tcpEstabResets);
4263 		if (tcp->tcp_state == TCPS_SYN_SENT ||
4264 		    tcp->tcp_state == TCPS_SYN_RCVD)
4265 			BUMP_MIB(&tcp_mib, tcpAttemptFails);
4266 		tcp_xmit_ctl(msg, tcp,  tcp->tcp_snxt, 0, TH_RST);
4267 	}
4268 
4269 	tcp_closei_local(tcp);
4270 	CONN_DEC_REF(connp);
4271 	ASSERT(connp->conn_ref >= 2);
4272 
4273 finish:
4274 	/*
4275 	 * Although packets are always processed on the correct
4276 	 * tcp's perimeter and access is serialized via squeue's,
4277 	 * IP still needs a queue when sending packets in time_wait
4278 	 * state so use WR(tcp_g_q) till ip_output() can be
4279 	 * changed to deal with just connp. For read side, we
4280 	 * could have set tcp_rq to NULL but there are some cases
4281 	 * in tcp_rput_data() from early days of this code which
4282 	 * do a putnext without checking if tcp is closed. Those
4283 	 * need to be identified before both tcp_rq and tcp_wq
4284 	 * can be set to NULL and tcp_q_q can disappear forever.
4285 	 */
4286 	mutex_enter(&tcp->tcp_closelock);
4287 	/*
4288 	 * Don't change the queues in the case of a listener that has
4289 	 * eagers in its q or q0. It could surprise the eagers.
4290 	 * Instead wait for the eagers outside the squeue.
4291 	 */
4292 	if (!tcp->tcp_wait_for_eagers) {
4293 		tcp->tcp_detached = B_TRUE;
4294 		tcp->tcp_rq = tcp_g_q;
4295 		tcp->tcp_wq = WR(tcp_g_q);
4296 	}
4297 
4298 	/* Signal tcp_close() to finish closing. */
4299 	tcp->tcp_closed = 1;
4300 	cv_signal(&tcp->tcp_closecv);
4301 	mutex_exit(&tcp->tcp_closelock);
4302 }
4303 
4304 
4305 /*
4306  * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp.
4307  * Some stream heads get upset if they see these later on as anything but NULL.
4308  */
4309 static void
4310 tcp_close_mpp(mblk_t **mpp)
4311 {
4312 	mblk_t	*mp;
4313 
4314 	if ((mp = *mpp) != NULL) {
4315 		do {
4316 			mp->b_next = NULL;
4317 			mp->b_prev = NULL;
4318 		} while ((mp = mp->b_cont) != NULL);
4319 
4320 		mp = *mpp;
4321 		*mpp = NULL;
4322 		freemsg(mp);
4323 	}
4324 }
4325 
4326 /* Do detached close. */
4327 static void
4328 tcp_close_detached(tcp_t *tcp)
4329 {
4330 	if (tcp->tcp_fused)
4331 		tcp_unfuse(tcp);
4332 
4333 	/*
4334 	 * Clustering code serializes TCP disconnect callbacks and
4335 	 * cluster tcp list walks by blocking a TCP disconnect callback
4336 	 * if a cluster tcp list walk is in progress. This ensures
4337 	 * accurate accounting of TCPs in the cluster code even though
4338 	 * the TCP list walk itself is not atomic.
4339 	 */
4340 	tcp_closei_local(tcp);
4341 	CONN_DEC_REF(tcp->tcp_connp);
4342 }
4343 
4344 /*
4345  * Stop all TCP timers, and free the timer mblks if requested.
4346  */
4347 void
4348 tcp_timers_stop(tcp_t *tcp)
4349 {
4350 	if (tcp->tcp_timer_tid != 0) {
4351 		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid);
4352 		tcp->tcp_timer_tid = 0;
4353 	}
4354 	if (tcp->tcp_ka_tid != 0) {
4355 		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid);
4356 		tcp->tcp_ka_tid = 0;
4357 	}
4358 	if (tcp->tcp_ack_tid != 0) {
4359 		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
4360 		tcp->tcp_ack_tid = 0;
4361 	}
4362 	if (tcp->tcp_push_tid != 0) {
4363 		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
4364 		tcp->tcp_push_tid = 0;
4365 	}
4366 }
4367 
4368 /*
4369  * The tcp_t is going away. Remove it from all lists and set it
4370  * to TCPS_CLOSED. The freeing up of memory is deferred until
4371  * tcp_inactive. This is needed since a thread in tcp_rput might have
4372  * done a CONN_INC_REF on this structure before it was removed from the
4373  * hashes.
4374  */
4375 static void
4376 tcp_closei_local(tcp_t *tcp)
4377 {
4378 	ire_t 	*ire;
4379 	conn_t	*connp = tcp->tcp_connp;
4380 
4381 	if (!TCP_IS_SOCKET(tcp))
4382 		tcp_acceptor_hash_remove(tcp);
4383 
4384 	UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs);
4385 	tcp->tcp_ibsegs = 0;
4386 	UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs);
4387 	tcp->tcp_obsegs = 0;
4388 
4389 	/*
4390 	 * If we are an eager connection hanging off a listener that
4391 	 * hasn't formally accepted the connection yet, get off his
4392 	 * list and blow off any data that we have accumulated.
4393 	 */
4394 	if (tcp->tcp_listener != NULL) {
4395 		tcp_t	*listener = tcp->tcp_listener;
4396 		mutex_enter(&listener->tcp_eager_lock);
4397 		/*
4398 		 * tcp_eager_conn_ind == NULL means that the
4399 		 * conn_ind has already gone to listener. At
4400 		 * this point, eager will be closed but we
4401 		 * leave it in listeners eager list so that
4402 		 * if listener decides to close without doing
4403 		 * accept, we can clean this up. In tcp_wput_accept
4404 		 * we take case of the case of accept on closed
4405 		 * eager.
4406 		 */
4407 		if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) {
4408 			tcp_eager_unlink(tcp);
4409 			mutex_exit(&listener->tcp_eager_lock);
4410 			/*
4411 			 * We don't want to have any pointers to the
4412 			 * listener queue, after we have released our
4413 			 * reference on the listener
4414 			 */
4415 			tcp->tcp_rq = tcp_g_q;
4416 			tcp->tcp_wq = WR(tcp_g_q);
4417 			CONN_DEC_REF(listener->tcp_connp);
4418 		} else {
4419 			mutex_exit(&listener->tcp_eager_lock);
4420 		}
4421 	}
4422 
4423 	/* Stop all the timers */
4424 	tcp_timers_stop(tcp);
4425 
4426 	if (tcp->tcp_state == TCPS_LISTEN) {
4427 		if (tcp->tcp_ip_addr_cache) {
4428 			kmem_free((void *)tcp->tcp_ip_addr_cache,
4429 			    IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t));
4430 			tcp->tcp_ip_addr_cache = NULL;
4431 		}
4432 	}
4433 	if (tcp->tcp_flow_stopped)
4434 		tcp_clrqfull(tcp);
4435 
4436 	tcp_bind_hash_remove(tcp);
4437 	/*
4438 	 * If the tcp_time_wait_collector (which runs outside the squeue)
4439 	 * is trying to remove this tcp from the time wait list, we will
4440 	 * block in tcp_time_wait_remove while trying to acquire the
4441 	 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also
4442 	 * requires the ipcl_hash_remove to be ordered after the
4443 	 * tcp_time_wait_remove for the refcnt checks to work correctly.
4444 	 */
4445 	if (tcp->tcp_state == TCPS_TIME_WAIT)
4446 		tcp_time_wait_remove(tcp, NULL);
4447 	CL_INET_DISCONNECT(tcp);
4448 	ipcl_hash_remove(connp);
4449 
4450 	/*
4451 	 * Delete the cached ire in conn_ire_cache and also mark
4452 	 * the conn as CONDEMNED
4453 	 */
4454 	mutex_enter(&connp->conn_lock);
4455 	connp->conn_state_flags |= CONN_CONDEMNED;
4456 	ire = connp->conn_ire_cache;
4457 	connp->conn_ire_cache = NULL;
4458 	mutex_exit(&connp->conn_lock);
4459 	if (ire != NULL)
4460 		IRE_REFRELE_NOTR(ire);
4461 
4462 	/* Need to cleanup any pending ioctls */
4463 	ASSERT(tcp->tcp_time_wait_next == NULL);
4464 	ASSERT(tcp->tcp_time_wait_prev == NULL);
4465 	ASSERT(tcp->tcp_time_wait_expire == 0);
4466 	tcp->tcp_state = TCPS_CLOSED;
4467 
4468 	/* Release any SSL context */
4469 	if (tcp->tcp_kssl_ent != NULL) {
4470 		kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY);
4471 		tcp->tcp_kssl_ent = NULL;
4472 	}
4473 	if (tcp->tcp_kssl_ctx != NULL) {
4474 		kssl_release_ctx(tcp->tcp_kssl_ctx);
4475 		tcp->tcp_kssl_ctx = NULL;
4476 	}
4477 	tcp->tcp_kssl_pending = B_FALSE;
4478 }
4479 
4480 /*
4481  * tcp is dying (called from ipcl_conn_destroy and error cases).
4482  * Free the tcp_t in either case.
4483  */
4484 void
4485 tcp_free(tcp_t *tcp)
4486 {
4487 	mblk_t	*mp;
4488 	ip6_pkt_t	*ipp;
4489 
4490 	ASSERT(tcp != NULL);
4491 	ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL);
4492 
4493 	tcp->tcp_rq = NULL;
4494 	tcp->tcp_wq = NULL;
4495 
4496 	tcp_close_mpp(&tcp->tcp_xmit_head);
4497 	tcp_close_mpp(&tcp->tcp_reass_head);
4498 	if (tcp->tcp_rcv_list != NULL) {
4499 		/* Free b_next chain */
4500 		tcp_close_mpp(&tcp->tcp_rcv_list);
4501 	}
4502 	if ((mp = tcp->tcp_urp_mp) != NULL) {
4503 		freemsg(mp);
4504 	}
4505 	if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
4506 		freemsg(mp);
4507 	}
4508 
4509 	if (tcp->tcp_fused_sigurg_mp != NULL) {
4510 		freeb(tcp->tcp_fused_sigurg_mp);
4511 		tcp->tcp_fused_sigurg_mp = NULL;
4512 	}
4513 
4514 	if (tcp->tcp_sack_info != NULL) {
4515 		if (tcp->tcp_notsack_list != NULL) {
4516 			TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list);
4517 		}
4518 		bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
4519 	}
4520 
4521 	if (tcp->tcp_hopopts != NULL) {
4522 		mi_free(tcp->tcp_hopopts);
4523 		tcp->tcp_hopopts = NULL;
4524 		tcp->tcp_hopoptslen = 0;
4525 	}
4526 	ASSERT(tcp->tcp_hopoptslen == 0);
4527 	if (tcp->tcp_dstopts != NULL) {
4528 		mi_free(tcp->tcp_dstopts);
4529 		tcp->tcp_dstopts = NULL;
4530 		tcp->tcp_dstoptslen = 0;
4531 	}
4532 	ASSERT(tcp->tcp_dstoptslen == 0);
4533 	if (tcp->tcp_rtdstopts != NULL) {
4534 		mi_free(tcp->tcp_rtdstopts);
4535 		tcp->tcp_rtdstopts = NULL;
4536 		tcp->tcp_rtdstoptslen = 0;
4537 	}
4538 	ASSERT(tcp->tcp_rtdstoptslen == 0);
4539 	if (tcp->tcp_rthdr != NULL) {
4540 		mi_free(tcp->tcp_rthdr);
4541 		tcp->tcp_rthdr = NULL;
4542 		tcp->tcp_rthdrlen = 0;
4543 	}
4544 	ASSERT(tcp->tcp_rthdrlen == 0);
4545 
4546 	ipp = &tcp->tcp_sticky_ipp;
4547 	if (ipp->ipp_fields & (IPPF_HOPOPTS | IPPF_RTDSTOPTS | IPPF_DSTOPTS |
4548 	    IPPF_RTHDR))
4549 		ip6_pkt_free(ipp);
4550 
4551 	/*
4552 	 * Free memory associated with the tcp/ip header template.
4553 	 */
4554 
4555 	if (tcp->tcp_iphc != NULL)
4556 		bzero(tcp->tcp_iphc, tcp->tcp_iphc_len);
4557 
4558 	/*
4559 	 * Following is really a blowing away a union.
4560 	 * It happens to have exactly two members of identical size
4561 	 * the following code is enough.
4562 	 */
4563 	tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
4564 
4565 	if (tcp->tcp_tracebuf != NULL) {
4566 		kmem_free(tcp->tcp_tracebuf, sizeof (tcptrch_t));
4567 		tcp->tcp_tracebuf = NULL;
4568 	}
4569 }
4570 
4571 
4572 /*
4573  * Put a connection confirmation message upstream built from the
4574  * address information within 'iph' and 'tcph'.  Report our success or failure.
4575  */
4576 static boolean_t
4577 tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, mblk_t *idmp,
4578     mblk_t **defermp)
4579 {
4580 	sin_t	sin;
4581 	sin6_t	sin6;
4582 	mblk_t	*mp;
4583 	char	*optp = NULL;
4584 	int	optlen = 0;
4585 	cred_t	*cr;
4586 
4587 	if (defermp != NULL)
4588 		*defermp = NULL;
4589 
4590 	if (tcp->tcp_conn.tcp_opts_conn_req != NULL) {
4591 		/*
4592 		 * Return in T_CONN_CON results of option negotiation through
4593 		 * the T_CONN_REQ. Note: If there is an real end-to-end option
4594 		 * negotiation, then what is received from remote end needs
4595 		 * to be taken into account but there is no such thing (yet?)
4596 		 * in our TCP/IP.
4597 		 * Note: We do not use mi_offset_param() here as
4598 		 * tcp_opts_conn_req contents do not directly come from
4599 		 * an application and are either generated in kernel or
4600 		 * from user input that was already verified.
4601 		 */
4602 		mp = tcp->tcp_conn.tcp_opts_conn_req;
4603 		optp = (char *)(mp->b_rptr +
4604 		    ((struct T_conn_req *)mp->b_rptr)->OPT_offset);
4605 		optlen = (int)
4606 		    ((struct T_conn_req *)mp->b_rptr)->OPT_length;
4607 	}
4608 
4609 	if (IPH_HDR_VERSION(iphdr) == IPV4_VERSION) {
4610 		ipha_t *ipha = (ipha_t *)iphdr;
4611 
4612 		/* packet is IPv4 */
4613 		if (tcp->tcp_family == AF_INET) {
4614 			sin = sin_null;
4615 			sin.sin_addr.s_addr = ipha->ipha_src;
4616 			sin.sin_port = *(uint16_t *)tcph->th_lport;
4617 			sin.sin_family = AF_INET;
4618 			mp = mi_tpi_conn_con(NULL, (char *)&sin,
4619 			    (int)sizeof (sin_t), optp, optlen);
4620 		} else {
4621 			sin6 = sin6_null;
4622 			IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr);
4623 			sin6.sin6_port = *(uint16_t *)tcph->th_lport;
4624 			sin6.sin6_family = AF_INET6;
4625 			mp = mi_tpi_conn_con(NULL, (char *)&sin6,
4626 			    (int)sizeof (sin6_t), optp, optlen);
4627 
4628 		}
4629 	} else {
4630 		ip6_t	*ip6h = (ip6_t *)iphdr;
4631 
4632 		ASSERT(IPH_HDR_VERSION(iphdr) == IPV6_VERSION);
4633 		ASSERT(tcp->tcp_family == AF_INET6);
4634 		sin6 = sin6_null;
4635 		sin6.sin6_addr = ip6h->ip6_src;
4636 		sin6.sin6_port = *(uint16_t *)tcph->th_lport;
4637 		sin6.sin6_family = AF_INET6;
4638 		sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
4639 		mp = mi_tpi_conn_con(NULL, (char *)&sin6,
4640 		    (int)sizeof (sin6_t), optp, optlen);
4641 	}
4642 
4643 	if (!mp)
4644 		return (B_FALSE);
4645 
4646 	if ((cr = DB_CRED(idmp)) != NULL) {
4647 		mblk_setcred(mp, cr);
4648 		DB_CPID(mp) = DB_CPID(idmp);
4649 	}
4650 
4651 	if (defermp == NULL)
4652 		putnext(tcp->tcp_rq, mp);
4653 	else
4654 		*defermp = mp;
4655 
4656 	if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
4657 		tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
4658 	return (B_TRUE);
4659 }
4660 
4661 /*
4662  * Defense for the SYN attack -
4663  * 1. When q0 is full, drop from the tail (tcp_eager_prev_q0) the oldest
4664  *    one that doesn't have the dontdrop bit set.
4665  * 2. Don't drop a SYN request before its first timeout. This gives every
4666  *    request at least til the first timeout to complete its 3-way handshake.
4667  * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
4668  *    requests currently on the queue that has timed out. This will be used
4669  *    as an indicator of whether an attack is under way, so that appropriate
4670  *    actions can be taken. (It's incremented in tcp_timer() and decremented
4671  *    either when eager goes into ESTABLISHED, or gets freed up.)
4672  * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
4673  *    # of timeout drops back to <= q0len/32 => SYN alert off
4674  */
4675 static boolean_t
4676 tcp_drop_q0(tcp_t *tcp)
4677 {
4678 	tcp_t	*eager;
4679 
4680 	ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
4681 	ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
4682 	/*
4683 	 * New one is added after next_q0 so prev_q0 points to the oldest
4684 	 * Also do not drop any established connections that are deferred on
4685 	 * q0 due to q being full
4686 	 */
4687 
4688 	eager = tcp->tcp_eager_prev_q0;
4689 	while (eager->tcp_dontdrop || eager->tcp_conn_def_q0) {
4690 		eager = eager->tcp_eager_prev_q0;
4691 		if (eager == tcp) {
4692 			eager = tcp->tcp_eager_prev_q0;
4693 			break;
4694 		}
4695 	}
4696 	if (eager->tcp_syn_rcvd_timeout == 0)
4697 		return (B_FALSE);
4698 
4699 	if (tcp->tcp_debug) {
4700 		(void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
4701 		    "tcp_drop_q0: listen half-open queue (max=%d) overflow"
4702 		    " (%d pending) on %s, drop one", tcp_conn_req_max_q0,
4703 		    tcp->tcp_conn_req_cnt_q0,
4704 		    tcp_display(tcp, NULL, DISP_PORT_ONLY));
4705 	}
4706 
4707 	BUMP_MIB(&tcp_mib, tcpHalfOpenDrop);
4708 
4709 	/*
4710 	 * need to do refhold here because the selected eager could
4711 	 * be removed by someone else if we release the eager lock.
4712 	 */
4713 	CONN_INC_REF(eager->tcp_connp);
4714 	mutex_exit(&tcp->tcp_eager_lock);
4715 
4716 	/* Mark the IRE created for this SYN request temporary */
4717 	tcp_ip_ire_mark_advice(eager);
4718 	(void) tcp_clean_death(eager, ETIMEDOUT, 5);
4719 	CONN_DEC_REF(eager->tcp_connp);
4720 
4721 	mutex_enter(&tcp->tcp_eager_lock);
4722 	return (B_TRUE);
4723 }
4724 
4725 int
4726 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
4727     tcph_t *tcph, uint_t ipvers, mblk_t *idmp)
4728 {
4729 	tcp_t 		*ltcp = lconnp->conn_tcp;
4730 	tcp_t		*tcp = connp->conn_tcp;
4731 	mblk_t		*tpi_mp;
4732 	ipha_t		*ipha;
4733 	ip6_t		*ip6h;
4734 	sin6_t 		sin6;
4735 	in6_addr_t 	v6dst;
4736 	int		err;
4737 	int		ifindex = 0;
4738 	cred_t		*cr;
4739 
4740 	if (ipvers == IPV4_VERSION) {
4741 		ipha = (ipha_t *)mp->b_rptr;
4742 
4743 		connp->conn_send = ip_output;
4744 		connp->conn_recv = tcp_input;
4745 
4746 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6);
4747 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6);
4748 
4749 		sin6 = sin6_null;
4750 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr);
4751 		IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst);
4752 		sin6.sin6_port = *(uint16_t *)tcph->th_lport;
4753 		sin6.sin6_family = AF_INET6;
4754 		sin6.__sin6_src_id = ip_srcid_find_addr(&v6dst,
4755 		    lconnp->conn_zoneid);
4756 		if (tcp->tcp_recvdstaddr) {
4757 			sin6_t	sin6d;
4758 
4759 			sin6d = sin6_null;
4760 			IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst,
4761 			    &sin6d.sin6_addr);
4762 			sin6d.sin6_port = *(uint16_t *)tcph->th_fport;
4763 			sin6d.sin6_family = AF_INET;
4764 			tpi_mp = mi_tpi_extconn_ind(NULL,
4765 			    (char *)&sin6d, sizeof (sin6_t),
4766 			    (char *)&tcp,
4767 			    (t_scalar_t)sizeof (intptr_t),
4768 			    (char *)&sin6d, sizeof (sin6_t),
4769 			    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
4770 		} else {
4771 			tpi_mp = mi_tpi_conn_ind(NULL,
4772 			    (char *)&sin6, sizeof (sin6_t),
4773 			    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
4774 			    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
4775 		}
4776 	} else {
4777 		ip6h = (ip6_t *)mp->b_rptr;
4778 
4779 		connp->conn_send = ip_output_v6;
4780 		connp->conn_recv = tcp_input;
4781 
4782 		connp->conn_srcv6 = ip6h->ip6_dst;
4783 		connp->conn_remv6 = ip6h->ip6_src;
4784 
4785 		/* db_cksumstuff is set at ip_fanout_tcp_v6 */
4786 		ifindex = (int)DB_CKSUMSTUFF(mp);
4787 		DB_CKSUMSTUFF(mp) = 0;
4788 
4789 		sin6 = sin6_null;
4790 		sin6.sin6_addr = ip6h->ip6_src;
4791 		sin6.sin6_port = *(uint16_t *)tcph->th_lport;
4792 		sin6.sin6_family = AF_INET6;
4793 		sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
4794 		sin6.__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst,
4795 		    lconnp->conn_zoneid);
4796 
4797 		if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
4798 			/* Pass up the scope_id of remote addr */
4799 			sin6.sin6_scope_id = ifindex;
4800 		} else {
4801 			sin6.sin6_scope_id = 0;
4802 		}
4803 		if (tcp->tcp_recvdstaddr) {
4804 			sin6_t	sin6d;
4805 
4806 			sin6d = sin6_null;
4807 			sin6.sin6_addr = ip6h->ip6_dst;
4808 			sin6d.sin6_port = *(uint16_t *)tcph->th_fport;
4809 			sin6d.sin6_family = AF_INET;
4810 			tpi_mp = mi_tpi_extconn_ind(NULL,
4811 			    (char *)&sin6d, sizeof (sin6_t),
4812 			    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
4813 			    (char *)&sin6d, sizeof (sin6_t),
4814 			    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
4815 		} else {
4816 			tpi_mp = mi_tpi_conn_ind(NULL,
4817 			    (char *)&sin6, sizeof (sin6_t),
4818 			    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
4819 			    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
4820 		}
4821 	}
4822 
4823 	if (tpi_mp == NULL)
4824 		return (ENOMEM);
4825 
4826 	connp->conn_fport = *(uint16_t *)tcph->th_lport;
4827 	connp->conn_lport = *(uint16_t *)tcph->th_fport;
4828 	connp->conn_flags |= (IPCL_TCP6|IPCL_EAGER);
4829 	connp->conn_fully_bound = B_FALSE;
4830 
4831 	if (tcp_trace)
4832 		tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP);
4833 
4834 	/* Inherit information from the "parent" */
4835 	tcp->tcp_ipversion = ltcp->tcp_ipversion;
4836 	tcp->tcp_family = ltcp->tcp_family;
4837 	tcp->tcp_wq = ltcp->tcp_wq;
4838 	tcp->tcp_rq = ltcp->tcp_rq;
4839 	tcp->tcp_mss = tcp_mss_def_ipv6;
4840 	tcp->tcp_detached = B_TRUE;
4841 	if ((err = tcp_init_values(tcp)) != 0) {
4842 		freemsg(tpi_mp);
4843 		return (err);
4844 	}
4845 
4846 	if (ipvers == IPV4_VERSION) {
4847 		if ((err = tcp_header_init_ipv4(tcp)) != 0) {
4848 			freemsg(tpi_mp);
4849 			return (err);
4850 		}
4851 		ASSERT(tcp->tcp_ipha != NULL);
4852 	} else {
4853 		/* ifindex must be already set */
4854 		ASSERT(ifindex != 0);
4855 
4856 		if (ltcp->tcp_bound_if != 0) {
4857 			/*
4858 			 * Set newtcp's bound_if equal to
4859 			 * listener's value. If ifindex is
4860 			 * not the same as ltcp->tcp_bound_if,
4861 			 * it must be a packet for the ipmp group
4862 			 * of interfaces
4863 			 */
4864 			tcp->tcp_bound_if = ltcp->tcp_bound_if;
4865 		} else if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
4866 			tcp->tcp_bound_if = ifindex;
4867 		}
4868 
4869 		tcp->tcp_ipv6_recvancillary = ltcp->tcp_ipv6_recvancillary;
4870 		tcp->tcp_recvifindex = 0;
4871 		tcp->tcp_recvhops = 0xffffffffU;
4872 		ASSERT(tcp->tcp_ip6h != NULL);
4873 	}
4874 
4875 	tcp->tcp_lport = ltcp->tcp_lport;
4876 
4877 	if (ltcp->tcp_ipversion == tcp->tcp_ipversion) {
4878 		if (tcp->tcp_iphc_len != ltcp->tcp_iphc_len) {
4879 			/*
4880 			 * Listener had options of some sort; eager inherits.
4881 			 * Free up the eager template and allocate one
4882 			 * of the right size.
4883 			 */
4884 			if (tcp->tcp_hdr_grown) {
4885 				kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len);
4886 			} else {
4887 				bzero(tcp->tcp_iphc, tcp->tcp_iphc_len);
4888 				kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc);
4889 			}
4890 			tcp->tcp_iphc = kmem_zalloc(ltcp->tcp_iphc_len,
4891 			    KM_NOSLEEP);
4892 			if (tcp->tcp_iphc == NULL) {
4893 				tcp->tcp_iphc_len = 0;
4894 				freemsg(tpi_mp);
4895 				return (ENOMEM);
4896 			}
4897 			tcp->tcp_iphc_len = ltcp->tcp_iphc_len;
4898 			tcp->tcp_hdr_grown = B_TRUE;
4899 		}
4900 		tcp->tcp_hdr_len = ltcp->tcp_hdr_len;
4901 		tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len;
4902 		tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len;
4903 		tcp->tcp_ip6_hops = ltcp->tcp_ip6_hops;
4904 		tcp->tcp_ip6_vcf = ltcp->tcp_ip6_vcf;
4905 
4906 		/*
4907 		 * Copy the IP+TCP header template from listener to eager
4908 		 */
4909 		bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len);
4910 		if (tcp->tcp_ipversion == IPV6_VERSION) {
4911 			if (((ip6i_t *)(tcp->tcp_iphc))->ip6i_nxt ==
4912 			    IPPROTO_RAW) {
4913 				tcp->tcp_ip6h =
4914 				    (ip6_t *)(tcp->tcp_iphc +
4915 					sizeof (ip6i_t));
4916 			} else {
4917 				tcp->tcp_ip6h =
4918 				    (ip6_t *)(tcp->tcp_iphc);
4919 			}
4920 			tcp->tcp_ipha = NULL;
4921 		} else {
4922 			tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc;
4923 			tcp->tcp_ip6h = NULL;
4924 		}
4925 		tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc +
4926 		    tcp->tcp_ip_hdr_len);
4927 	} else {
4928 		/*
4929 		 * only valid case when ipversion of listener and
4930 		 * eager differ is when listener is IPv6 and
4931 		 * eager is IPv4.
4932 		 * Eager header template has been initialized to the
4933 		 * maximum v4 header sizes, which includes space for
4934 		 * TCP and IP options.
4935 		 */
4936 		ASSERT((ltcp->tcp_ipversion == IPV6_VERSION) &&
4937 		    (tcp->tcp_ipversion == IPV4_VERSION));
4938 		ASSERT(tcp->tcp_iphc_len >=
4939 		    TCP_MAX_COMBINED_HEADER_LENGTH);
4940 		tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len;
4941 		/* copy IP header fields individually */
4942 		tcp->tcp_ipha->ipha_ttl =
4943 		    ltcp->tcp_ip6h->ip6_hops;
4944 		bcopy(ltcp->tcp_tcph->th_lport,
4945 		    tcp->tcp_tcph->th_lport, sizeof (ushort_t));
4946 	}
4947 
4948 	bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t));
4949 	bcopy(tcp->tcp_tcph->th_fport, &tcp->tcp_fport,
4950 	    sizeof (in_port_t));
4951 
4952 	if (ltcp->tcp_lport == 0) {
4953 		tcp->tcp_lport = *(in_port_t *)tcph->th_fport;
4954 		bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport,
4955 		    sizeof (in_port_t));
4956 	}
4957 
4958 	if (tcp->tcp_ipversion == IPV4_VERSION) {
4959 		ASSERT(ipha != NULL);
4960 		tcp->tcp_ipha->ipha_dst = ipha->ipha_src;
4961 		tcp->tcp_ipha->ipha_src = ipha->ipha_dst;
4962 
4963 		/* Source routing option copyover (reverse it) */
4964 		if (tcp_rev_src_routes)
4965 			tcp_opt_reverse(tcp, ipha);
4966 	} else {
4967 		ASSERT(ip6h != NULL);
4968 		tcp->tcp_ip6h->ip6_dst = ip6h->ip6_src;
4969 		tcp->tcp_ip6h->ip6_src = ip6h->ip6_dst;
4970 	}
4971 
4972 	ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL);
4973 	/*
4974 	 * If the SYN contains a credential, it's a loopback packet; attach
4975 	 * the credential to the TPI message.
4976 	 */
4977 	if ((cr = DB_CRED(idmp)) != NULL) {
4978 		mblk_setcred(tpi_mp, cr);
4979 		DB_CPID(tpi_mp) = DB_CPID(idmp);
4980 	}
4981 	tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp;
4982 
4983 	/* Inherit the listener's SSL protection state */
4984 
4985 	if ((tcp->tcp_kssl_ent = ltcp->tcp_kssl_ent) != NULL) {
4986 		kssl_hold_ent(tcp->tcp_kssl_ent);
4987 		tcp->tcp_kssl_pending = B_TRUE;
4988 	}
4989 
4990 	return (0);
4991 }
4992 
4993 
4994 int
4995 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha,
4996     tcph_t *tcph, mblk_t *idmp)
4997 {
4998 	tcp_t 		*ltcp = lconnp->conn_tcp;
4999 	tcp_t		*tcp = connp->conn_tcp;
5000 	sin_t		sin;
5001 	mblk_t		*tpi_mp = NULL;
5002 	int		err;
5003 	cred_t		*cr;
5004 
5005 	sin = sin_null;
5006 	sin.sin_addr.s_addr = ipha->ipha_src;
5007 	sin.sin_port = *(uint16_t *)tcph->th_lport;
5008 	sin.sin_family = AF_INET;
5009 	if (ltcp->tcp_recvdstaddr) {
5010 		sin_t	sind;
5011 
5012 		sind = sin_null;
5013 		sind.sin_addr.s_addr = ipha->ipha_dst;
5014 		sind.sin_port = *(uint16_t *)tcph->th_fport;
5015 		sind.sin_family = AF_INET;
5016 		tpi_mp = mi_tpi_extconn_ind(NULL,
5017 		    (char *)&sind, sizeof (sin_t), (char *)&tcp,
5018 		    (t_scalar_t)sizeof (intptr_t), (char *)&sind,
5019 		    sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
5020 	} else {
5021 		tpi_mp = mi_tpi_conn_ind(NULL,
5022 		    (char *)&sin, sizeof (sin_t),
5023 		    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
5024 		    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
5025 	}
5026 
5027 	if (tpi_mp == NULL) {
5028 		return (ENOMEM);
5029 	}
5030 
5031 	connp->conn_flags |= (IPCL_TCP4|IPCL_EAGER);
5032 	connp->conn_send = ip_output;
5033 	connp->conn_recv = tcp_input;
5034 	connp->conn_fully_bound = B_FALSE;
5035 
5036 	IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6);
5037 	IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6);
5038 	connp->conn_fport = *(uint16_t *)tcph->th_lport;
5039 	connp->conn_lport = *(uint16_t *)tcph->th_fport;
5040 
5041 	if (tcp_trace) {
5042 		tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP);
5043 	}
5044 
5045 	/* Inherit information from the "parent" */
5046 	tcp->tcp_ipversion = ltcp->tcp_ipversion;
5047 	tcp->tcp_family = ltcp->tcp_family;
5048 	tcp->tcp_wq = ltcp->tcp_wq;
5049 	tcp->tcp_rq = ltcp->tcp_rq;
5050 	tcp->tcp_mss = tcp_mss_def_ipv4;
5051 	tcp->tcp_detached = B_TRUE;
5052 	if ((err = tcp_init_values(tcp)) != 0) {
5053 		freemsg(tpi_mp);
5054 		return (err);
5055 	}
5056 
5057 	/*
5058 	 * Let's make sure that eager tcp template has enough space to
5059 	 * copy IPv4 listener's tcp template. Since the conn_t structure is
5060 	 * preserved and tcp_iphc_len is also preserved, an eager conn_t may
5061 	 * have a tcp_template of total len TCP_MAX_COMBINED_HEADER_LENGTH or
5062 	 * more (in case of re-allocation of conn_t with tcp-IPv6 template with
5063 	 * extension headers or with ip6i_t struct). Note that bcopy() below
5064 	 * copies listener tcp's hdr_len which cannot be greater than TCP_MAX_
5065 	 * COMBINED_HEADER_LENGTH as this listener must be a IPv4 listener.
5066 	 */
5067 	ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH);
5068 	ASSERT(ltcp->tcp_hdr_len <= TCP_MAX_COMBINED_HEADER_LENGTH);
5069 
5070 	tcp->tcp_hdr_len = ltcp->tcp_hdr_len;
5071 	tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len;
5072 	tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len;
5073 	tcp->tcp_ttl = ltcp->tcp_ttl;
5074 	tcp->tcp_tos = ltcp->tcp_tos;
5075 
5076 	/* Copy the IP+TCP header template from listener to eager */
5077 	bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len);
5078 	tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc;
5079 	tcp->tcp_ip6h = NULL;
5080 	tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc +
5081 	    tcp->tcp_ip_hdr_len);
5082 
5083 	/* Initialize the IP addresses and Ports */
5084 	tcp->tcp_ipha->ipha_dst = ipha->ipha_src;
5085 	tcp->tcp_ipha->ipha_src = ipha->ipha_dst;
5086 	bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t));
5087 	bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, sizeof (in_port_t));
5088 
5089 	/* Source routing option copyover (reverse it) */
5090 	if (tcp_rev_src_routes)
5091 		tcp_opt_reverse(tcp, ipha);
5092 
5093 	ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL);
5094 
5095 	/*
5096 	 * If the SYN contains a credential, it's a loopback packet; attach
5097 	 * the credential to the TPI message.
5098 	 */
5099 	if ((cr = DB_CRED(idmp)) != NULL) {
5100 		mblk_setcred(tpi_mp, cr);
5101 		DB_CPID(tpi_mp) = DB_CPID(idmp);
5102 	}
5103 	tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp;
5104 
5105 	/* Inherit the listener's SSL protection state */
5106 	if ((tcp->tcp_kssl_ent = ltcp->tcp_kssl_ent) != NULL) {
5107 		kssl_hold_ent(tcp->tcp_kssl_ent);
5108 		tcp->tcp_kssl_pending = B_TRUE;
5109 	}
5110 
5111 	return (0);
5112 }
5113 
5114 /*
5115  * sets up conn for ipsec.
5116  * if the first mblk is M_CTL it is consumed and mpp is updated.
5117  * in case of error mpp is freed.
5118  */
5119 conn_t *
5120 tcp_get_ipsec_conn(tcp_t *tcp, squeue_t *sqp, mblk_t **mpp)
5121 {
5122 	conn_t 		*connp = tcp->tcp_connp;
5123 	conn_t 		*econnp;
5124 	squeue_t 	*new_sqp;
5125 	mblk_t 		*first_mp = *mpp;
5126 	mblk_t		*mp = *mpp;
5127 	boolean_t	mctl_present = B_FALSE;
5128 	uint_t		ipvers;
5129 
5130 	econnp = tcp_get_conn(sqp);
5131 	if (econnp == NULL) {
5132 		freemsg(first_mp);
5133 		return (NULL);
5134 	}
5135 	if (DB_TYPE(mp) == M_CTL) {
5136 		if (mp->b_cont == NULL ||
5137 		    mp->b_cont->b_datap->db_type != M_DATA) {
5138 			freemsg(first_mp);
5139 			return (NULL);
5140 		}
5141 		mp = mp->b_cont;
5142 		if ((mp->b_datap->db_struioflag & STRUIO_EAGER) == 0) {
5143 			freemsg(first_mp);
5144 			return (NULL);
5145 		}
5146 
5147 		mp->b_datap->db_struioflag &= ~STRUIO_EAGER;
5148 		first_mp->b_datap->db_struioflag &= ~STRUIO_POLICY;
5149 		mctl_present = B_TRUE;
5150 	} else {
5151 		ASSERT(mp->b_datap->db_struioflag & STRUIO_POLICY);
5152 		mp->b_datap->db_struioflag &= ~STRUIO_POLICY;
5153 	}
5154 
5155 	new_sqp = (squeue_t *)DB_CKSUMSTART(mp);
5156 	DB_CKSUMSTART(mp) = 0;
5157 
5158 	ASSERT(OK_32PTR(mp->b_rptr));
5159 	ipvers = IPH_HDR_VERSION(mp->b_rptr);
5160 	if (ipvers == IPV4_VERSION) {
5161 		uint16_t  	*up;
5162 		uint32_t	ports;
5163 		ipha_t		*ipha;
5164 
5165 		ipha = (ipha_t *)mp->b_rptr;
5166 		up = (uint16_t *)((uchar_t *)ipha +
5167 		    IPH_HDR_LENGTH(ipha) + TCP_PORTS_OFFSET);
5168 		ports = *(uint32_t *)up;
5169 		IPCL_TCP_EAGER_INIT(econnp, IPPROTO_TCP,
5170 		    ipha->ipha_dst, ipha->ipha_src, ports);
5171 	} else {
5172 		uint16_t  	*up;
5173 		uint32_t	ports;
5174 		uint16_t	ip_hdr_len;
5175 		uint8_t		*nexthdrp;
5176 		ip6_t 		*ip6h;
5177 		tcph_t		*tcph;
5178 
5179 		ip6h = (ip6_t *)mp->b_rptr;
5180 		if (ip6h->ip6_nxt == IPPROTO_TCP) {
5181 			ip_hdr_len = IPV6_HDR_LEN;
5182 		} else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip_hdr_len,
5183 		    &nexthdrp) || *nexthdrp != IPPROTO_TCP) {
5184 			CONN_DEC_REF(econnp);
5185 			freemsg(first_mp);
5186 			return (NULL);
5187 		}
5188 		tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len];
5189 		up = (uint16_t *)tcph->th_lport;
5190 		ports = *(uint32_t *)up;
5191 		IPCL_TCP_EAGER_INIT_V6(econnp, IPPROTO_TCP,
5192 		    ip6h->ip6_dst, ip6h->ip6_src, ports);
5193 	}
5194 
5195 	/*
5196 	 * The caller already ensured that there is a sqp present.
5197 	 */
5198 	econnp->conn_sqp = new_sqp;
5199 
5200 	if (connp->conn_policy != NULL) {
5201 		ipsec_in_t *ii;
5202 		ii = (ipsec_in_t *)(first_mp->b_rptr);
5203 		ASSERT(ii->ipsec_in_policy == NULL);
5204 		IPPH_REFHOLD(connp->conn_policy);
5205 		ii->ipsec_in_policy = connp->conn_policy;
5206 
5207 		first_mp->b_datap->db_type = IPSEC_POLICY_SET;
5208 		if (!ip_bind_ipsec_policy_set(econnp, first_mp)) {
5209 			CONN_DEC_REF(econnp);
5210 			freemsg(first_mp);
5211 			return (NULL);
5212 		}
5213 	}
5214 
5215 	if (ipsec_conn_cache_policy(econnp, ipvers == IPV4_VERSION) != 0) {
5216 		CONN_DEC_REF(econnp);
5217 		freemsg(first_mp);
5218 		return (NULL);
5219 	}
5220 
5221 	/*
5222 	 * If we know we have some policy, pass the "IPSEC"
5223 	 * options size TCP uses this adjust the MSS.
5224 	 */
5225 	econnp->conn_tcp->tcp_ipsec_overhead = conn_ipsec_length(econnp);
5226 	if (mctl_present) {
5227 		freeb(first_mp);
5228 		*mpp = mp;
5229 	}
5230 
5231 	return (econnp);
5232 }
5233 
5234 /*
5235  * tcp_get_conn/tcp_free_conn
5236  *
5237  * tcp_get_conn is used to get a clean tcp connection structure.
5238  * It tries to reuse the connections put on the freelist by the
5239  * time_wait_collector failing which it goes to kmem_cache. This
5240  * way has two benefits compared to just allocating from and
5241  * freeing to kmem_cache.
5242  * 1) The time_wait_collector can free (which includes the cleanup)
5243  * outside the squeue. So when the interrupt comes, we have a clean
5244  * connection sitting in the freelist. Obviously, this buys us
5245  * performance.
5246  *
5247  * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_conn_request
5248  * has multiple disadvantages - tying up the squeue during alloc, and the
5249  * fact that IPSec policy initialization has to happen here which
5250  * requires us sending a M_CTL and checking for it i.e. real ugliness.
5251  * But allocating the conn/tcp in IP land is also not the best since
5252  * we can't check the 'q' and 'q0' which are protected by squeue and
5253  * blindly allocate memory which might have to be freed here if we are
5254  * not allowed to accept the connection. By using the freelist and
5255  * putting the conn/tcp back in freelist, we don't pay a penalty for
5256  * allocating memory without checking 'q/q0' and freeing it if we can't
5257  * accept the connection.
5258  *
5259  * Care should be taken to put the conn back in the same squeue's freelist
5260  * from which it was allocated. Best results are obtained if conn is
5261  * allocated from listener's squeue and freed to the same. Time wait
5262  * collector will free up the freelist is the connection ends up sitting
5263  * there for too long.
5264  */
5265 void *
5266 tcp_get_conn(void *arg)
5267 {
5268 	tcp_t			*tcp = NULL;
5269 	conn_t			*connp = NULL;
5270 	squeue_t		*sqp = (squeue_t *)arg;
5271 	tcp_squeue_priv_t 	*tcp_time_wait;
5272 
5273 	tcp_time_wait =
5274 	    *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP));
5275 
5276 	mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
5277 	tcp = tcp_time_wait->tcp_free_list;
5278 	ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0));
5279 	if (tcp != NULL) {
5280 		tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next;
5281 		tcp_time_wait->tcp_free_list_cnt--;
5282 		mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
5283 		tcp->tcp_time_wait_next = NULL;
5284 		connp = tcp->tcp_connp;
5285 		connp->conn_flags |= IPCL_REUSED;
5286 		return ((void *)connp);
5287 	}
5288 	mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
5289 	if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL)
5290 		return (NULL);
5291 	return ((void *)connp);
5292 }
5293 
5294 /*
5295  * Update the cached label for the given tcp_t.  This should be called once per
5296  * connection, and before any packets are sent or tcp_process_options is
5297  * invoked.  Returns B_FALSE if the correct label could not be constructed.
5298  */
5299 static boolean_t
5300 tcp_update_label(tcp_t *tcp, const cred_t *cr)
5301 {
5302 	conn_t *connp = tcp->tcp_connp;
5303 
5304 	if (tcp->tcp_ipversion == IPV4_VERSION) {
5305 		uchar_t optbuf[IP_MAX_OPT_LENGTH];
5306 		int added;
5307 
5308 		if (tsol_compute_label(cr, tcp->tcp_remote, optbuf,
5309 		    connp->conn_mac_exempt) != 0)
5310 			return (B_FALSE);
5311 
5312 		added = tsol_remove_secopt(tcp->tcp_ipha, tcp->tcp_hdr_len);
5313 		if (added == -1)
5314 			return (B_FALSE);
5315 		tcp->tcp_hdr_len += added;
5316 		tcp->tcp_tcph = (tcph_t *)((uchar_t *)tcp->tcp_tcph + added);
5317 		tcp->tcp_ip_hdr_len += added;
5318 		if ((tcp->tcp_label_len = optbuf[IPOPT_OLEN]) != 0) {
5319 			tcp->tcp_label_len = (tcp->tcp_label_len + 3) & ~3;
5320 			added = tsol_prepend_option(optbuf, tcp->tcp_ipha,
5321 			    tcp->tcp_hdr_len);
5322 			if (added == -1)
5323 				return (B_FALSE);
5324 			tcp->tcp_hdr_len += added;
5325 			tcp->tcp_tcph = (tcph_t *)
5326 			    ((uchar_t *)tcp->tcp_tcph + added);
5327 			tcp->tcp_ip_hdr_len += added;
5328 		}
5329 	} else {
5330 		uchar_t optbuf[TSOL_MAX_IPV6_OPTION];
5331 
5332 		if (tsol_compute_label_v6(cr, &tcp->tcp_remote_v6, optbuf,
5333 		    connp->conn_mac_exempt) != 0)
5334 			return (B_FALSE);
5335 		if (tsol_update_sticky(&tcp->tcp_sticky_ipp,
5336 		    &tcp->tcp_label_len, optbuf) != 0)
5337 			return (B_FALSE);
5338 		if (tcp_build_hdrs(tcp->tcp_rq, tcp) != 0)
5339 			return (B_FALSE);
5340 	}
5341 
5342 	connp->conn_ulp_labeled = 1;
5343 
5344 	return (B_TRUE);
5345 }
5346 
5347 /* BEGIN CSTYLED */
5348 /*
5349  *
5350  * The sockfs ACCEPT path:
5351  * =======================
5352  *
5353  * The eager is now established in its own perimeter as soon as SYN is
5354  * received in tcp_conn_request(). When sockfs receives conn_ind, it
5355  * completes the accept processing on the acceptor STREAM. The sending
5356  * of conn_ind part is common for both sockfs listener and a TLI/XTI
5357  * listener but a TLI/XTI listener completes the accept processing
5358  * on the listener perimeter.
5359  *
5360  * Common control flow for 3 way handshake:
5361  * ----------------------------------------
5362  *
5363  * incoming SYN (listener perimeter) 	-> tcp_rput_data()
5364  *					-> tcp_conn_request()
5365  *
5366  * incoming SYN-ACK-ACK (eager perim) 	-> tcp_rput_data()
5367  * send T_CONN_IND (listener perim)	-> tcp_send_conn_ind()
5368  *
5369  * Sockfs ACCEPT Path:
5370  * -------------------
5371  *
5372  * open acceptor stream (ip_tcpopen allocates tcp_wput_accept()
5373  * as STREAM entry point)
5374  *
5375  * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_wput_accept()
5376  *
5377  * tcp_wput_accept() extracts the eager and makes the q->q_ptr <-> eager
5378  * association (we are not behind eager's squeue but sockfs is protecting us
5379  * and no one knows about this stream yet. The STREAMS entry point q->q_info
5380  * is changed to point at tcp_wput().
5381  *
5382  * tcp_wput_accept() sends any deferred eagers via tcp_send_pending() to
5383  * listener (done on listener's perimeter).
5384  *
5385  * tcp_wput_accept() calls tcp_accept_finish() on eagers perimeter to finish
5386  * accept.
5387  *
5388  * TLI/XTI client ACCEPT path:
5389  * ---------------------------
5390  *
5391  * soaccept() sends T_CONN_RES on the listener STREAM.
5392  *
5393  * tcp_accept() -> tcp_accept_swap() complete the processing and send
5394  * the bind_mp to eager perimeter to finish accept (tcp_rput_other()).
5395  *
5396  * Locks:
5397  * ======
5398  *
5399  * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
5400  * and listeners->tcp_eager_next_q.
5401  *
5402  * Referencing:
5403  * ============
5404  *
5405  * 1) We start out in tcp_conn_request by eager placing a ref on
5406  * listener and listener adding eager to listeners->tcp_eager_next_q0.
5407  *
5408  * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
5409  * doing so we place a ref on the eager. This ref is finally dropped at the
5410  * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
5411  * reference is dropped by the squeue framework.
5412  *
5413  * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
5414  *
5415  * The reference must be released by the same entity that added the reference
5416  * In the above scheme, the eager is the entity that adds and releases the
5417  * references. Note that tcp_accept_finish executes in the squeue of the eager
5418  * (albeit after it is attached to the acceptor stream). Though 1. executes
5419  * in the listener's squeue, the eager is nascent at this point and the
5420  * reference can be considered to have been added on behalf of the eager.
5421  *
5422  * Eager getting a Reset or listener closing:
5423  * ==========================================
5424  *
5425  * Once the listener and eager are linked, the listener never does the unlink.
5426  * If the listener needs to close, tcp_eager_cleanup() is called which queues
5427  * a message on all eager perimeter. The eager then does the unlink, clears
5428  * any pointers to the listener's queue and drops the reference to the
5429  * listener. The listener waits in tcp_close outside the squeue until its
5430  * refcount has dropped to 1. This ensures that the listener has waited for
5431  * all eagers to clear their association with the listener.
5432  *
5433  * Similarly, if eager decides to go away, it can unlink itself and close.
5434  * When the T_CONN_RES comes down, we check if eager has closed. Note that
5435  * the reference to eager is still valid because of the extra ref we put
5436  * in tcp_send_conn_ind.
5437  *
5438  * Listener can always locate the eager under the protection
5439  * of the listener->tcp_eager_lock, and then do a refhold
5440  * on the eager during the accept processing.
5441  *
5442  * The acceptor stream accesses the eager in the accept processing
5443  * based on the ref placed on eager before sending T_conn_ind.
5444  * The only entity that can negate this refhold is a listener close
5445  * which is mutually exclusive with an active acceptor stream.
5446  *
5447  * Eager's reference on the listener
5448  * ===================================
5449  *
5450  * If the accept happens (even on a closed eager) the eager drops its
5451  * reference on the listener at the start of tcp_accept_finish. If the
5452  * eager is killed due to an incoming RST before the T_conn_ind is sent up,
5453  * the reference is dropped in tcp_closei_local. If the listener closes,
5454  * the reference is dropped in tcp_eager_kill. In all cases the reference
5455  * is dropped while executing in the eager's context (squeue).
5456  */
5457 /* END CSTYLED */
5458 
5459 /* Process the SYN packet, mp, directed at the listener 'tcp' */
5460 
5461 /*
5462  * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
5463  * tcp_rput_data will not see any SYN packets.
5464  */
5465 /* ARGSUSED */
5466 void
5467 tcp_conn_request(void *arg, mblk_t *mp, void *arg2)
5468 {
5469 	tcph_t		*tcph;
5470 	uint32_t	seg_seq;
5471 	tcp_t		*eager;
5472 	uint_t		ipvers;
5473 	ipha_t		*ipha;
5474 	ip6_t		*ip6h;
5475 	int		err;
5476 	conn_t		*econnp = NULL;
5477 	squeue_t	*new_sqp;
5478 	mblk_t		*mp1;
5479 	uint_t 		ip_hdr_len;
5480 	conn_t		*connp = (conn_t *)arg;
5481 	tcp_t		*tcp = connp->conn_tcp;
5482 	ire_t		*ire;
5483 	cred_t		*credp;
5484 
5485 	if (tcp->tcp_state != TCPS_LISTEN)
5486 		goto error2;
5487 
5488 	ASSERT((tcp->tcp_connp->conn_flags & IPCL_BOUND) != 0);
5489 
5490 	mutex_enter(&tcp->tcp_eager_lock);
5491 	if (tcp->tcp_conn_req_cnt_q >= tcp->tcp_conn_req_max) {
5492 		mutex_exit(&tcp->tcp_eager_lock);
5493 		TCP_STAT(tcp_listendrop);
5494 		BUMP_MIB(&tcp_mib, tcpListenDrop);
5495 		if (tcp->tcp_debug) {
5496 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
5497 			    "tcp_conn_request: listen backlog (max=%d) "
5498 			    "overflow (%d pending) on %s",
5499 			    tcp->tcp_conn_req_max, tcp->tcp_conn_req_cnt_q,
5500 			    tcp_display(tcp, NULL, DISP_PORT_ONLY));
5501 		}
5502 		goto error2;
5503 	}
5504 
5505 	if (tcp->tcp_conn_req_cnt_q0 >=
5506 	    tcp->tcp_conn_req_max + tcp_conn_req_max_q0) {
5507 		/*
5508 		 * Q0 is full. Drop a pending half-open req from the queue
5509 		 * to make room for the new SYN req. Also mark the time we
5510 		 * drop a SYN.
5511 		 *
5512 		 * A more aggressive defense against SYN attack will
5513 		 * be to set the "tcp_syn_defense" flag now.
5514 		 */
5515 		TCP_STAT(tcp_listendropq0);
5516 		tcp->tcp_last_rcv_lbolt = lbolt64;
5517 		if (!tcp_drop_q0(tcp)) {
5518 			mutex_exit(&tcp->tcp_eager_lock);
5519 			BUMP_MIB(&tcp_mib, tcpListenDropQ0);
5520 			if (tcp->tcp_debug) {
5521 				(void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
5522 				    "tcp_conn_request: listen half-open queue "
5523 				    "(max=%d) full (%d pending) on %s",
5524 				    tcp_conn_req_max_q0,
5525 				    tcp->tcp_conn_req_cnt_q0,
5526 				    tcp_display(tcp, NULL,
5527 				    DISP_PORT_ONLY));
5528 			}
5529 			goto error2;
5530 		}
5531 	}
5532 	mutex_exit(&tcp->tcp_eager_lock);
5533 
5534 	/*
5535 	 * IP adds STRUIO_EAGER and ensures that the received packet is
5536 	 * M_DATA even if conn_ipv6_recvpktinfo is enabled or for ip6
5537 	 * link local address.  If IPSec is enabled, db_struioflag has
5538 	 * STRUIO_POLICY set (mutually exclusive from STRUIO_EAGER);
5539 	 * otherwise an error case if neither of them is set.
5540 	 */
5541 	if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) {
5542 		new_sqp = (squeue_t *)DB_CKSUMSTART(mp);
5543 		DB_CKSUMSTART(mp) = 0;
5544 		mp->b_datap->db_struioflag &= ~STRUIO_EAGER;
5545 		econnp = (conn_t *)tcp_get_conn(arg2);
5546 		if (econnp == NULL)
5547 			goto error2;
5548 		econnp->conn_sqp = new_sqp;
5549 	} else if ((mp->b_datap->db_struioflag & STRUIO_POLICY) != 0) {
5550 		/*
5551 		 * mp is updated in tcp_get_ipsec_conn().
5552 		 */
5553 		econnp = tcp_get_ipsec_conn(tcp, arg2, &mp);
5554 		if (econnp == NULL) {
5555 			/*
5556 			 * mp freed by tcp_get_ipsec_conn.
5557 			 */
5558 			return;
5559 		}
5560 	} else {
5561 		goto error2;
5562 	}
5563 
5564 	ASSERT(DB_TYPE(mp) == M_DATA);
5565 
5566 	ipvers = IPH_HDR_VERSION(mp->b_rptr);
5567 	ASSERT(ipvers == IPV6_VERSION || ipvers == IPV4_VERSION);
5568 	ASSERT(OK_32PTR(mp->b_rptr));
5569 	if (ipvers == IPV4_VERSION) {
5570 		ipha = (ipha_t *)mp->b_rptr;
5571 		ip_hdr_len = IPH_HDR_LENGTH(ipha);
5572 		tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len];
5573 	} else {
5574 		ip6h = (ip6_t *)mp->b_rptr;
5575 		ip_hdr_len = ip_hdr_length_v6(mp, ip6h);
5576 		tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len];
5577 	}
5578 
5579 	if (tcp->tcp_family == AF_INET) {
5580 		ASSERT(ipvers == IPV4_VERSION);
5581 		err = tcp_conn_create_v4(connp, econnp, ipha, tcph, mp);
5582 	} else {
5583 		err = tcp_conn_create_v6(connp, econnp, mp, tcph, ipvers, mp);
5584 	}
5585 
5586 	if (err)
5587 		goto error3;
5588 
5589 	eager = econnp->conn_tcp;
5590 
5591 	/* Inherit various TCP parameters from the listener */
5592 	eager->tcp_naglim = tcp->tcp_naglim;
5593 	eager->tcp_first_timer_threshold =
5594 	    tcp->tcp_first_timer_threshold;
5595 	eager->tcp_second_timer_threshold =
5596 	    tcp->tcp_second_timer_threshold;
5597 
5598 	eager->tcp_first_ctimer_threshold =
5599 	    tcp->tcp_first_ctimer_threshold;
5600 	eager->tcp_second_ctimer_threshold =
5601 	    tcp->tcp_second_ctimer_threshold;
5602 
5603 	/*
5604 	 * tcp_adapt_ire() may change tcp_rwnd according to the ire metrics.
5605 	 * If it does not, the eager's receive window will be set to the
5606 	 * listener's receive window later in this function.
5607 	 */
5608 	eager->tcp_rwnd = 0;
5609 
5610 	/*
5611 	 * Inherit listener's tcp_init_cwnd.  Need to do this before
5612 	 * calling tcp_process_options() where tcp_mss_set() is called
5613 	 * to set the initial cwnd.
5614 	 */
5615 	eager->tcp_init_cwnd = tcp->tcp_init_cwnd;
5616 
5617 	/*
5618 	 * Zones: tcp_adapt_ire() and tcp_send_data() both need the
5619 	 * zone id before the accept is completed in tcp_wput_accept().
5620 	 */
5621 	econnp->conn_zoneid = connp->conn_zoneid;
5622 	econnp->conn_allzones = connp->conn_allzones;
5623 
5624 	/* Copy nexthop information from listener to eager */
5625 	if (connp->conn_nexthop_set) {
5626 		econnp->conn_nexthop_set = connp->conn_nexthop_set;
5627 		econnp->conn_nexthop_v4 = connp->conn_nexthop_v4;
5628 	}
5629 
5630 	/*
5631 	 * TSOL: tsol_input_proc() needs the eager's cred before the
5632 	 * eager is accepted
5633 	 */
5634 	econnp->conn_cred = eager->tcp_cred = credp = connp->conn_cred;
5635 	crhold(credp);
5636 
5637 	/*
5638 	 * If the caller has the process-wide flag set, then default to MAC
5639 	 * exempt mode.  This allows read-down to unlabeled hosts.
5640 	 */
5641 	if (getpflags(NET_MAC_AWARE, credp) != 0)
5642 		econnp->conn_mac_exempt = B_TRUE;
5643 
5644 	if (is_system_labeled()) {
5645 		cred_t *cr;
5646 
5647 		if (connp->conn_mlp_type != mlptSingle) {
5648 			cr = econnp->conn_peercred = DB_CRED(mp);
5649 			if (cr != NULL)
5650 				crhold(cr);
5651 			else
5652 				cr = econnp->conn_cred;
5653 			DTRACE_PROBE2(mlp_syn_accept, conn_t *,
5654 			    econnp, cred_t *, cr)
5655 		} else {
5656 			cr = econnp->conn_cred;
5657 			DTRACE_PROBE2(syn_accept, conn_t *,
5658 			    econnp, cred_t *, cr)
5659 		}
5660 
5661 		if (!tcp_update_label(eager, cr)) {
5662 			DTRACE_PROBE3(
5663 			    tx__ip__log__error__connrequest__tcp,
5664 			    char *, "eager connp(1) label on SYN mp(2) failed",
5665 			    conn_t *, econnp, mblk_t *, mp);
5666 			goto error3;
5667 		}
5668 	}
5669 
5670 	eager->tcp_hard_binding = B_TRUE;
5671 
5672 	tcp_bind_hash_insert(&tcp_bind_fanout[
5673 	    TCP_BIND_HASH(eager->tcp_lport)], eager, 0);
5674 
5675 	CL_INET_CONNECT(eager);
5676 
5677 	/*
5678 	 * No need to check for multicast destination since ip will only pass
5679 	 * up multicasts to those that have expressed interest
5680 	 * TODO: what about rejecting broadcasts?
5681 	 * Also check that source is not a multicast or broadcast address.
5682 	 */
5683 	eager->tcp_state = TCPS_SYN_RCVD;
5684 
5685 
5686 	/*
5687 	 * There should be no ire in the mp as we are being called after
5688 	 * receiving the SYN.
5689 	 */
5690 	ASSERT(tcp_ire_mp(mp) == NULL);
5691 
5692 	/*
5693 	 * Adapt our mss, ttl, ... according to information provided in IRE.
5694 	 */
5695 
5696 	if (tcp_adapt_ire(eager, NULL) == 0) {
5697 		/* Undo the bind_hash_insert */
5698 		tcp_bind_hash_remove(eager);
5699 		goto error3;
5700 	}
5701 
5702 	/* Process all TCP options. */
5703 	tcp_process_options(eager, tcph);
5704 
5705 	/* Is the other end ECN capable? */
5706 	if (tcp_ecn_permitted >= 1 &&
5707 	    (tcph->th_flags[0] & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
5708 		eager->tcp_ecn_ok = B_TRUE;
5709 	}
5710 
5711 	/*
5712 	 * listener->tcp_rq->q_hiwat should be the default window size or a
5713 	 * window size changed via SO_RCVBUF option.  First round up the
5714 	 * eager's tcp_rwnd to the nearest MSS.  Then find out the window
5715 	 * scale option value if needed.  Call tcp_rwnd_set() to finish the
5716 	 * setting.
5717 	 *
5718 	 * Note if there is a rpipe metric associated with the remote host,
5719 	 * we should not inherit receive window size from listener.
5720 	 */
5721 	eager->tcp_rwnd = MSS_ROUNDUP(
5722 	    (eager->tcp_rwnd == 0 ? tcp->tcp_rq->q_hiwat :
5723 	    eager->tcp_rwnd), eager->tcp_mss);
5724 	if (eager->tcp_snd_ws_ok)
5725 		tcp_set_ws_value(eager);
5726 	/*
5727 	 * Note that this is the only place tcp_rwnd_set() is called for
5728 	 * accepting a connection.  We need to call it here instead of
5729 	 * after the 3-way handshake because we need to tell the other
5730 	 * side our rwnd in the SYN-ACK segment.
5731 	 */
5732 	(void) tcp_rwnd_set(eager, eager->tcp_rwnd);
5733 
5734 	/*
5735 	 * We eliminate the need for sockfs to send down a T_SVR4_OPTMGMT_REQ
5736 	 * via soaccept()->soinheritoptions() which essentially applies
5737 	 * all the listener options to the new STREAM. The options that we
5738 	 * need to take care of are:
5739 	 * SO_DEBUG, SO_REUSEADDR, SO_KEEPALIVE, SO_DONTROUTE, SO_BROADCAST,
5740 	 * SO_USELOOPBACK, SO_OOBINLINE, SO_DGRAM_ERRIND, SO_LINGER,
5741 	 * SO_SNDBUF, SO_RCVBUF.
5742 	 *
5743 	 * SO_RCVBUF:	tcp_rwnd_set() above takes care of it.
5744 	 * SO_SNDBUF:	Set the tcp_xmit_hiwater for the eager. When
5745 	 *		tcp_maxpsz_set() gets called later from
5746 	 *		tcp_accept_finish(), the option takes effect.
5747 	 *
5748 	 */
5749 	/* Set the TCP options */
5750 	eager->tcp_xmit_hiwater = tcp->tcp_xmit_hiwater;
5751 	eager->tcp_dgram_errind = tcp->tcp_dgram_errind;
5752 	eager->tcp_oobinline = tcp->tcp_oobinline;
5753 	eager->tcp_reuseaddr = tcp->tcp_reuseaddr;
5754 	eager->tcp_broadcast = tcp->tcp_broadcast;
5755 	eager->tcp_useloopback = tcp->tcp_useloopback;
5756 	eager->tcp_dontroute = tcp->tcp_dontroute;
5757 	eager->tcp_linger = tcp->tcp_linger;
5758 	eager->tcp_lingertime = tcp->tcp_lingertime;
5759 	if (tcp->tcp_ka_enabled)
5760 		eager->tcp_ka_enabled = 1;
5761 
5762 	/* Set the IP options */
5763 	econnp->conn_broadcast = connp->conn_broadcast;
5764 	econnp->conn_loopback = connp->conn_loopback;
5765 	econnp->conn_dontroute = connp->conn_dontroute;
5766 	econnp->conn_reuseaddr = connp->conn_reuseaddr;
5767 
5768 	/* Put a ref on the listener for the eager. */
5769 	CONN_INC_REF(connp);
5770 	mutex_enter(&tcp->tcp_eager_lock);
5771 	tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
5772 	eager->tcp_eager_next_q0 = tcp->tcp_eager_next_q0;
5773 	tcp->tcp_eager_next_q0 = eager;
5774 	eager->tcp_eager_prev_q0 = tcp;
5775 
5776 	/* Set tcp_listener before adding it to tcp_conn_fanout */
5777 	eager->tcp_listener = tcp;
5778 	eager->tcp_saved_listener = tcp;
5779 
5780 	/*
5781 	 * Tag this detached tcp vector for later retrieval
5782 	 * by our listener client in tcp_accept().
5783 	 */
5784 	eager->tcp_conn_req_seqnum = tcp->tcp_conn_req_seqnum;
5785 	tcp->tcp_conn_req_cnt_q0++;
5786 	if (++tcp->tcp_conn_req_seqnum == -1) {
5787 		/*
5788 		 * -1 is "special" and defined in TPI as something
5789 		 * that should never be used in T_CONN_IND
5790 		 */
5791 		++tcp->tcp_conn_req_seqnum;
5792 	}
5793 	mutex_exit(&tcp->tcp_eager_lock);
5794 
5795 	if (tcp->tcp_syn_defense) {
5796 		/* Don't drop the SYN that comes from a good IP source */
5797 		ipaddr_t *addr_cache = (ipaddr_t *)(tcp->tcp_ip_addr_cache);
5798 		if (addr_cache != NULL && eager->tcp_remote ==
5799 		    addr_cache[IP_ADDR_CACHE_HASH(eager->tcp_remote)]) {
5800 			eager->tcp_dontdrop = B_TRUE;
5801 		}
5802 	}
5803 
5804 	/*
5805 	 * We need to insert the eager in its own perimeter but as soon
5806 	 * as we do that, we expose the eager to the classifier and
5807 	 * should not touch any field outside the eager's perimeter.
5808 	 * So do all the work necessary before inserting the eager
5809 	 * in its own perimeter. Be optimistic that ipcl_conn_insert()
5810 	 * will succeed but undo everything if it fails.
5811 	 */
5812 	seg_seq = ABE32_TO_U32(tcph->th_seq);
5813 	eager->tcp_irs = seg_seq;
5814 	eager->tcp_rack = seg_seq;
5815 	eager->tcp_rnxt = seg_seq + 1;
5816 	U32_TO_ABE32(eager->tcp_rnxt, eager->tcp_tcph->th_ack);
5817 	BUMP_MIB(&tcp_mib, tcpPassiveOpens);
5818 	eager->tcp_state = TCPS_SYN_RCVD;
5819 	mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
5820 	    NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
5821 	if (mp1 == NULL)
5822 		goto error1;
5823 	DB_CPID(mp1) = tcp->tcp_cpid;
5824 
5825 	/*
5826 	 * We need to start the rto timer. In normal case, we start
5827 	 * the timer after sending the packet on the wire (or at
5828 	 * least believing that packet was sent by waiting for
5829 	 * CALL_IP_WPUT() to return). Since this is the first packet
5830 	 * being sent on the wire for the eager, our initial tcp_rto
5831 	 * is at least tcp_rexmit_interval_min which is a fairly
5832 	 * large value to allow the algorithm to adjust slowly to large
5833 	 * fluctuations of RTT during first few transmissions.
5834 	 *
5835 	 * Starting the timer first and then sending the packet in this
5836 	 * case shouldn't make much difference since tcp_rexmit_interval_min
5837 	 * is of the order of several 100ms and starting the timer
5838 	 * first and then sending the packet will result in difference
5839 	 * of few micro seconds.
5840 	 *
5841 	 * Without this optimization, we are forced to hold the fanout
5842 	 * lock across the ipcl_bind_insert() and sending the packet
5843 	 * so that we don't race against an incoming packet (maybe RST)
5844 	 * for this eager.
5845 	 */
5846 
5847 	TCP_RECORD_TRACE(eager, mp1, TCP_TRACE_SEND_PKT);
5848 	TCP_TIMER_RESTART(eager, eager->tcp_rto);
5849 
5850 
5851 	/*
5852 	 * Insert the eager in its own perimeter now. We are ready to deal
5853 	 * with any packets on eager.
5854 	 */
5855 	if (eager->tcp_ipversion == IPV4_VERSION) {
5856 		if (ipcl_conn_insert(econnp, IPPROTO_TCP, 0, 0, 0) != 0) {
5857 			goto error;
5858 		}
5859 	} else {
5860 		if (ipcl_conn_insert_v6(econnp, IPPROTO_TCP, 0, 0, 0, 0) != 0) {
5861 			goto error;
5862 		}
5863 	}
5864 
5865 	/* mark conn as fully-bound */
5866 	econnp->conn_fully_bound = B_TRUE;
5867 
5868 	/* Send the SYN-ACK */
5869 	tcp_send_data(eager, eager->tcp_wq, mp1);
5870 	freemsg(mp);
5871 
5872 	return;
5873 error:
5874 	(void) TCP_TIMER_CANCEL(eager, eager->tcp_timer_tid);
5875 	freemsg(mp1);
5876 error1:
5877 	/* Undo what we did above */
5878 	mutex_enter(&tcp->tcp_eager_lock);
5879 	tcp_eager_unlink(eager);
5880 	mutex_exit(&tcp->tcp_eager_lock);
5881 	/* Drop eager's reference on the listener */
5882 	CONN_DEC_REF(connp);
5883 
5884 	/*
5885 	 * Delete the cached ire in conn_ire_cache and also mark
5886 	 * the conn as CONDEMNED
5887 	 */
5888 	mutex_enter(&econnp->conn_lock);
5889 	econnp->conn_state_flags |= CONN_CONDEMNED;
5890 	ire = econnp->conn_ire_cache;
5891 	econnp->conn_ire_cache = NULL;
5892 	mutex_exit(&econnp->conn_lock);
5893 	if (ire != NULL)
5894 		IRE_REFRELE_NOTR(ire);
5895 
5896 	/*
5897 	 * tcp_accept_comm inserts the eager to the bind_hash
5898 	 * we need to remove it from the hash if ipcl_conn_insert
5899 	 * fails.
5900 	 */
5901 	tcp_bind_hash_remove(eager);
5902 	/* Drop the eager ref placed in tcp_open_detached */
5903 	CONN_DEC_REF(econnp);
5904 
5905 	/*
5906 	 * If a connection already exists, send the mp to that connections so
5907 	 * that it can be appropriately dealt with.
5908 	 */
5909 	if ((econnp = ipcl_classify(mp, connp->conn_zoneid)) != NULL) {
5910 		if (!IPCL_IS_CONNECTED(econnp)) {
5911 			/*
5912 			 * Something bad happened. ipcl_conn_insert()
5913 			 * failed because a connection already existed
5914 			 * in connected hash but we can't find it
5915 			 * anymore (someone blew it away). Just
5916 			 * free this message and hopefully remote
5917 			 * will retransmit at which time the SYN can be
5918 			 * treated as a new connection or dealth with
5919 			 * a TH_RST if a connection already exists.
5920 			 */
5921 			freemsg(mp);
5922 		} else {
5923 			squeue_fill(econnp->conn_sqp, mp, tcp_input,
5924 			    econnp, SQTAG_TCP_CONN_REQ);
5925 		}
5926 	} else {
5927 		/* Nobody wants this packet */
5928 		freemsg(mp);
5929 	}
5930 	return;
5931 error2:
5932 	freemsg(mp);
5933 	return;
5934 error3:
5935 	CONN_DEC_REF(econnp);
5936 	freemsg(mp);
5937 }
5938 
5939 /*
5940  * In an ideal case of vertical partition in NUMA architecture, its
5941  * beneficial to have the listener and all the incoming connections
5942  * tied to the same squeue. The other constraint is that incoming
5943  * connections should be tied to the squeue attached to interrupted
5944  * CPU for obvious locality reason so this leaves the listener to
5945  * be tied to the same squeue. Our only problem is that when listener
5946  * is binding, the CPU that will get interrupted by the NIC whose
5947  * IP address the listener is binding to is not even known. So
5948  * the code below allows us to change that binding at the time the
5949  * CPU is interrupted by virtue of incoming connection's squeue.
5950  *
5951  * This is usefull only in case of a listener bound to a specific IP
5952  * address. For other kind of listeners, they get bound the
5953  * very first time and there is no attempt to rebind them.
5954  */
5955 void
5956 tcp_conn_request_unbound(void *arg, mblk_t *mp, void *arg2)
5957 {
5958 	conn_t		*connp = (conn_t *)arg;
5959 	squeue_t	*sqp = (squeue_t *)arg2;
5960 	squeue_t	*new_sqp;
5961 	uint32_t	conn_flags;
5962 
5963 	if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) {
5964 		new_sqp = (squeue_t *)DB_CKSUMSTART(mp);
5965 	} else {
5966 		goto done;
5967 	}
5968 
5969 	if (connp->conn_fanout == NULL)
5970 		goto done;
5971 
5972 	if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
5973 		mutex_enter(&connp->conn_fanout->connf_lock);
5974 		mutex_enter(&connp->conn_lock);
5975 		/*
5976 		 * No one from read or write side can access us now
5977 		 * except for already queued packets on this squeue.
5978 		 * But since we haven't changed the squeue yet, they
5979 		 * can't execute. If they are processed after we have
5980 		 * changed the squeue, they are sent back to the
5981 		 * correct squeue down below.
5982 		 */
5983 		if (connp->conn_sqp != new_sqp) {
5984 			while (connp->conn_sqp != new_sqp)
5985 				(void) casptr(&connp->conn_sqp, sqp, new_sqp);
5986 		}
5987 
5988 		do {
5989 			conn_flags = connp->conn_flags;
5990 			conn_flags |= IPCL_FULLY_BOUND;
5991 			(void) cas32(&connp->conn_flags, connp->conn_flags,
5992 			    conn_flags);
5993 		} while (!(connp->conn_flags & IPCL_FULLY_BOUND));
5994 
5995 		mutex_exit(&connp->conn_fanout->connf_lock);
5996 		mutex_exit(&connp->conn_lock);
5997 	}
5998 
5999 done:
6000 	if (connp->conn_sqp != sqp) {
6001 		CONN_INC_REF(connp);
6002 		squeue_fill(connp->conn_sqp, mp,
6003 		    connp->conn_recv, connp, SQTAG_TCP_CONN_REQ_UNBOUND);
6004 	} else {
6005 		tcp_conn_request(connp, mp, sqp);
6006 	}
6007 }
6008 
6009 /*
6010  * Successful connect request processing begins when our client passes
6011  * a T_CONN_REQ message into tcp_wput() and ends when tcp_rput() passes
6012  * our T_OK_ACK reply message upstream.  The control flow looks like this:
6013  *   upstream -> tcp_wput() -> tcp_wput_proto() -> tcp_connect() -> IP
6014  *   upstream <- tcp_rput()                <- IP
6015  * After various error checks are completed, tcp_connect() lays
6016  * the target address and port into the composite header template,
6017  * preallocates the T_OK_ACK reply message, construct a full 12 byte bind
6018  * request followed by an IRE request, and passes the three mblk message
6019  * down to IP looking like this:
6020  *   O_T_BIND_REQ for IP  --> IRE req --> T_OK_ACK for our client
6021  * Processing continues in tcp_rput() when we receive the following message:
6022  *   T_BIND_ACK from IP --> IRE ack --> T_OK_ACK for our client
6023  * After consuming the first two mblks, tcp_rput() calls tcp_timer(),
6024  * to fire off the connection request, and then passes the T_OK_ACK mblk
6025  * upstream that we filled in below.  There are, of course, numerous
6026  * error conditions along the way which truncate the processing described
6027  * above.
6028  */
6029 static void
6030 tcp_connect(tcp_t *tcp, mblk_t *mp)
6031 {
6032 	sin_t		*sin;
6033 	sin6_t		*sin6;
6034 	queue_t		*q = tcp->tcp_wq;
6035 	struct T_conn_req	*tcr;
6036 	ipaddr_t	*dstaddrp;
6037 	in_port_t	dstport;
6038 	uint_t		srcid;
6039 
6040 	tcr = (struct T_conn_req *)mp->b_rptr;
6041 
6042 	ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
6043 	if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) {
6044 		tcp_err_ack(tcp, mp, TPROTO, 0);
6045 		return;
6046 	}
6047 
6048 	/*
6049 	 * Determine packet type based on type of address passed in
6050 	 * the request should contain an IPv4 or IPv6 address.
6051 	 * Make sure that address family matches the type of
6052 	 * family of the the address passed down
6053 	 */
6054 	switch (tcr->DEST_length) {
6055 	default:
6056 		tcp_err_ack(tcp, mp, TBADADDR, 0);
6057 		return;
6058 
6059 	case (sizeof (sin_t) - sizeof (sin->sin_zero)): {
6060 		/*
6061 		 * XXX: The check for valid DEST_length was not there
6062 		 * in earlier releases and some buggy
6063 		 * TLI apps (e.g Sybase) got away with not feeding
6064 		 * in sin_zero part of address.
6065 		 * We allow that bug to keep those buggy apps humming.
6066 		 * Test suites require the check on DEST_length.
6067 		 * We construct a new mblk with valid DEST_length
6068 		 * free the original so the rest of the code does
6069 		 * not have to keep track of this special shorter
6070 		 * length address case.
6071 		 */
6072 		mblk_t *nmp;
6073 		struct T_conn_req *ntcr;
6074 		sin_t *nsin;
6075 
6076 		nmp = allocb(sizeof (struct T_conn_req) + sizeof (sin_t) +
6077 		    tcr->OPT_length, BPRI_HI);
6078 		if (nmp == NULL) {
6079 			tcp_err_ack(tcp, mp, TSYSERR, ENOMEM);
6080 			return;
6081 		}
6082 		ntcr = (struct T_conn_req *)nmp->b_rptr;
6083 		bzero(ntcr, sizeof (struct T_conn_req)); /* zero fill */
6084 		ntcr->PRIM_type = T_CONN_REQ;
6085 		ntcr->DEST_length = sizeof (sin_t);
6086 		ntcr->DEST_offset = sizeof (struct T_conn_req);
6087 
6088 		nsin = (sin_t *)((uchar_t *)ntcr + ntcr->DEST_offset);
6089 		*nsin = sin_null;
6090 		/* Get pointer to shorter address to copy from original mp */
6091 		sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset,
6092 		    tcr->DEST_length); /* extract DEST_length worth of sin_t */
6093 		if (sin == NULL || !OK_32PTR((char *)sin)) {
6094 			freemsg(nmp);
6095 			tcp_err_ack(tcp, mp, TSYSERR, EINVAL);
6096 			return;
6097 		}
6098 		nsin->sin_family = sin->sin_family;
6099 		nsin->sin_port = sin->sin_port;
6100 		nsin->sin_addr = sin->sin_addr;
6101 		/* Note:nsin->sin_zero zero-fill with sin_null assign above */
6102 		nmp->b_wptr = (uchar_t *)&nsin[1];
6103 		if (tcr->OPT_length != 0) {
6104 			ntcr->OPT_length = tcr->OPT_length;
6105 			ntcr->OPT_offset = nmp->b_wptr - nmp->b_rptr;
6106 			bcopy((uchar_t *)tcr + tcr->OPT_offset,
6107 			    (uchar_t *)ntcr + ntcr->OPT_offset,
6108 			    tcr->OPT_length);
6109 			nmp->b_wptr += tcr->OPT_length;
6110 		}
6111 		freemsg(mp);	/* original mp freed */
6112 		mp = nmp;	/* re-initialize original variables */
6113 		tcr = ntcr;
6114 	}
6115 	/* FALLTHRU */
6116 
6117 	case sizeof (sin_t):
6118 		sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset,
6119 		    sizeof (sin_t));
6120 		if (sin == NULL || !OK_32PTR((char *)sin)) {
6121 			tcp_err_ack(tcp, mp, TSYSERR, EINVAL);
6122 			return;
6123 		}
6124 		if (tcp->tcp_family != AF_INET ||
6125 		    sin->sin_family != AF_INET) {
6126 			tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT);
6127 			return;
6128 		}
6129 		if (sin->sin_port == 0) {
6130 			tcp_err_ack(tcp, mp, TBADADDR, 0);
6131 			return;
6132 		}
6133 		if (tcp->tcp_connp && tcp->tcp_connp->conn_ipv6_v6only) {
6134 			tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT);
6135 			return;
6136 		}
6137 
6138 		break;
6139 
6140 	case sizeof (sin6_t):
6141 		sin6 = (sin6_t *)mi_offset_param(mp, tcr->DEST_offset,
6142 		    sizeof (sin6_t));
6143 		if (sin6 == NULL || !OK_32PTR((char *)sin6)) {
6144 			tcp_err_ack(tcp, mp, TSYSERR, EINVAL);
6145 			return;
6146 		}
6147 		if (tcp->tcp_family != AF_INET6 ||
6148 		    sin6->sin6_family != AF_INET6) {
6149 			tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT);
6150 			return;
6151 		}
6152 		if (sin6->sin6_port == 0) {
6153 			tcp_err_ack(tcp, mp, TBADADDR, 0);
6154 			return;
6155 		}
6156 		break;
6157 	}
6158 	/*
6159 	 * TODO: If someone in TCPS_TIME_WAIT has this dst/port we
6160 	 * should key on their sequence number and cut them loose.
6161 	 */
6162 
6163 	/*
6164 	 * If options passed in, feed it for verification and handling
6165 	 */
6166 	if (tcr->OPT_length != 0) {
6167 		mblk_t	*ok_mp;
6168 		mblk_t	*discon_mp;
6169 		mblk_t  *conn_opts_mp;
6170 		int t_error, sys_error, do_disconnect;
6171 
6172 		conn_opts_mp = NULL;
6173 
6174 		if (tcp_conprim_opt_process(tcp, mp,
6175 			&do_disconnect, &t_error, &sys_error) < 0) {
6176 			if (do_disconnect) {
6177 				ASSERT(t_error == 0 && sys_error == 0);
6178 				discon_mp = mi_tpi_discon_ind(NULL,
6179 				    ECONNREFUSED, 0);
6180 				if (!discon_mp) {
6181 					tcp_err_ack_prim(tcp, mp, T_CONN_REQ,
6182 					    TSYSERR, ENOMEM);
6183 					return;
6184 				}
6185 				ok_mp = mi_tpi_ok_ack_alloc(mp);
6186 				if (!ok_mp) {
6187 					tcp_err_ack_prim(tcp, NULL, T_CONN_REQ,
6188 					    TSYSERR, ENOMEM);
6189 					return;
6190 				}
6191 				qreply(q, ok_mp);
6192 				qreply(q, discon_mp); /* no flush! */
6193 			} else {
6194 				ASSERT(t_error != 0);
6195 				tcp_err_ack_prim(tcp, mp, T_CONN_REQ, t_error,
6196 				    sys_error);
6197 			}
6198 			return;
6199 		}
6200 		/*
6201 		 * Success in setting options, the mp option buffer represented
6202 		 * by OPT_length/offset has been potentially modified and
6203 		 * contains results of option processing. We copy it in
6204 		 * another mp to save it for potentially influencing returning
6205 		 * it in T_CONN_CONN.
6206 		 */
6207 		if (tcr->OPT_length != 0) { /* there are resulting options */
6208 			conn_opts_mp = copyb(mp);
6209 			if (!conn_opts_mp) {
6210 				tcp_err_ack_prim(tcp, mp, T_CONN_REQ,
6211 				    TSYSERR, ENOMEM);
6212 				return;
6213 			}
6214 			ASSERT(tcp->tcp_conn.tcp_opts_conn_req == NULL);
6215 			tcp->tcp_conn.tcp_opts_conn_req = conn_opts_mp;
6216 			/*
6217 			 * Note:
6218 			 * These resulting option negotiation can include any
6219 			 * end-to-end negotiation options but there no such
6220 			 * thing (yet?) in our TCP/IP.
6221 			 */
6222 		}
6223 	}
6224 
6225 	/*
6226 	 * If we're connecting to an IPv4-mapped IPv6 address, we need to
6227 	 * make sure that the template IP header in the tcp structure is an
6228 	 * IPv4 header, and that the tcp_ipversion is IPV4_VERSION.  We
6229 	 * need to this before we call tcp_bindi() so that the port lookup
6230 	 * code will look for ports in the correct port space (IPv4 and
6231 	 * IPv6 have separate port spaces).
6232 	 */
6233 	if (tcp->tcp_family == AF_INET6 && tcp->tcp_ipversion == IPV6_VERSION &&
6234 	    IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6235 		int err = 0;
6236 
6237 		err = tcp_header_init_ipv4(tcp);
6238 		if (err != 0) {
6239 			mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM);
6240 			goto connect_failed;
6241 		}
6242 		if (tcp->tcp_lport != 0)
6243 			*(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport;
6244 	}
6245 
6246 	switch (tcp->tcp_state) {
6247 	case TCPS_IDLE:
6248 		/*
6249 		 * We support quick connect, refer to comments in
6250 		 * tcp_connect_*()
6251 		 */
6252 		/* FALLTHRU */
6253 	case TCPS_BOUND:
6254 	case TCPS_LISTEN:
6255 		if (tcp->tcp_family == AF_INET6) {
6256 			if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6257 				tcp_connect_ipv6(tcp, mp,
6258 				    &sin6->sin6_addr,
6259 				    sin6->sin6_port, sin6->sin6_flowinfo,
6260 				    sin6->__sin6_src_id, sin6->sin6_scope_id);
6261 				return;
6262 			}
6263 			/*
6264 			 * Destination adress is mapped IPv6 address.
6265 			 * Source bound address should be unspecified or
6266 			 * IPv6 mapped address as well.
6267 			 */
6268 			if (!IN6_IS_ADDR_UNSPECIFIED(
6269 			    &tcp->tcp_bound_source_v6) &&
6270 			    !IN6_IS_ADDR_V4MAPPED(&tcp->tcp_bound_source_v6)) {
6271 				mp = mi_tpi_err_ack_alloc(mp, TSYSERR,
6272 				    EADDRNOTAVAIL);
6273 				break;
6274 			}
6275 			dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr));
6276 			dstport = sin6->sin6_port;
6277 			srcid = sin6->__sin6_src_id;
6278 		} else {
6279 			dstaddrp = &sin->sin_addr.s_addr;
6280 			dstport = sin->sin_port;
6281 			srcid = 0;
6282 		}
6283 
6284 		tcp_connect_ipv4(tcp, mp, dstaddrp, dstport, srcid);
6285 		return;
6286 	default:
6287 		mp = mi_tpi_err_ack_alloc(mp, TOUTSTATE, 0);
6288 		break;
6289 	}
6290 	/*
6291 	 * Note: Code below is the "failure" case
6292 	 */
6293 	/* return error ack and blow away saved option results if any */
6294 connect_failed:
6295 	if (mp != NULL)
6296 		putnext(tcp->tcp_rq, mp);
6297 	else {
6298 		tcp_err_ack_prim(tcp, NULL, T_CONN_REQ,
6299 		    TSYSERR, ENOMEM);
6300 	}
6301 	if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
6302 		tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
6303 }
6304 
6305 /*
6306  * Handle connect to IPv4 destinations, including connections for AF_INET6
6307  * sockets connecting to IPv4 mapped IPv6 destinations.
6308  */
6309 static void
6310 tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, in_port_t dstport,
6311     uint_t srcid)
6312 {
6313 	tcph_t	*tcph;
6314 	mblk_t	*mp1;
6315 	ipaddr_t dstaddr = *dstaddrp;
6316 	int32_t	oldstate;
6317 	uint16_t lport;
6318 
6319 	ASSERT(tcp->tcp_ipversion == IPV4_VERSION);
6320 
6321 	/* Check for attempt to connect to INADDR_ANY */
6322 	if (dstaddr == INADDR_ANY)  {
6323 		/*
6324 		 * SunOS 4.x and 4.3 BSD allow an application
6325 		 * to connect a TCP socket to INADDR_ANY.
6326 		 * When they do this, the kernel picks the
6327 		 * address of one interface and uses it
6328 		 * instead.  The kernel usually ends up
6329 		 * picking the address of the loopback
6330 		 * interface.  This is an undocumented feature.
6331 		 * However, we provide the same thing here
6332 		 * in order to have source and binary
6333 		 * compatibility with SunOS 4.x.
6334 		 * Update the T_CONN_REQ (sin/sin6) since it is used to
6335 		 * generate the T_CONN_CON.
6336 		 */
6337 		dstaddr = htonl(INADDR_LOOPBACK);
6338 		*dstaddrp = dstaddr;
6339 	}
6340 
6341 	/* Handle __sin6_src_id if socket not bound to an IP address */
6342 	if (srcid != 0 && tcp->tcp_ipha->ipha_src == INADDR_ANY) {
6343 		ip_srcid_find_id(srcid, &tcp->tcp_ip_src_v6,
6344 		    tcp->tcp_connp->conn_zoneid);
6345 		IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_ip_src_v6,
6346 		    tcp->tcp_ipha->ipha_src);
6347 	}
6348 
6349 	/*
6350 	 * Don't let an endpoint connect to itself.  Note that
6351 	 * the test here does not catch the case where the
6352 	 * source IP addr was left unspecified by the user. In
6353 	 * this case, the source addr is set in tcp_adapt_ire()
6354 	 * using the reply to the T_BIND message that we send
6355 	 * down to IP here and the check is repeated in tcp_rput_other.
6356 	 */
6357 	if (dstaddr == tcp->tcp_ipha->ipha_src &&
6358 	    dstport == tcp->tcp_lport) {
6359 		mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0);
6360 		goto failed;
6361 	}
6362 
6363 	tcp->tcp_ipha->ipha_dst = dstaddr;
6364 	IN6_IPADDR_TO_V4MAPPED(dstaddr, &tcp->tcp_remote_v6);
6365 
6366 	/*
6367 	 * Massage a source route if any putting the first hop
6368 	 * in iph_dst. Compute a starting value for the checksum which
6369 	 * takes into account that the original iph_dst should be
6370 	 * included in the checksum but that ip will include the
6371 	 * first hop in the source route in the tcp checksum.
6372 	 */
6373 	tcp->tcp_sum = ip_massage_options(tcp->tcp_ipha);
6374 	tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16);
6375 	tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) +
6376 	    (tcp->tcp_ipha->ipha_dst & 0xffff));
6377 	if ((int)tcp->tcp_sum < 0)
6378 		tcp->tcp_sum--;
6379 	tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16);
6380 	tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) +
6381 	    (tcp->tcp_sum >> 16));
6382 	tcph = tcp->tcp_tcph;
6383 	*(uint16_t *)tcph->th_fport = dstport;
6384 	tcp->tcp_fport = dstport;
6385 
6386 	oldstate = tcp->tcp_state;
6387 	/*
6388 	 * At this point the remote destination address and remote port fields
6389 	 * in the tcp-four-tuple have been filled in the tcp structure. Now we
6390 	 * have to see which state tcp was in so we can take apropriate action.
6391 	 */
6392 	if (oldstate == TCPS_IDLE) {
6393 		/*
6394 		 * We support a quick connect capability here, allowing
6395 		 * clients to transition directly from IDLE to SYN_SENT
6396 		 * tcp_bindi will pick an unused port, insert the connection
6397 		 * in the bind hash and transition to BOUND state.
6398 		 */
6399 		lport = tcp_update_next_port(tcp_next_port_to_try, tcp, B_TRUE);
6400 		lport = tcp_bindi(tcp, lport, &tcp->tcp_ip_src_v6, 0, B_TRUE,
6401 		    B_FALSE, B_FALSE);
6402 		if (lport == 0) {
6403 			mp = mi_tpi_err_ack_alloc(mp, TNOADDR, 0);
6404 			goto failed;
6405 		}
6406 	}
6407 	tcp->tcp_state = TCPS_SYN_SENT;
6408 
6409 	/*
6410 	 * TODO: allow data with connect requests
6411 	 * by unlinking M_DATA trailers here and
6412 	 * linking them in behind the T_OK_ACK mblk.
6413 	 * The tcp_rput() bind ack handler would then
6414 	 * feed them to tcp_wput_data() rather than call
6415 	 * tcp_timer().
6416 	 */
6417 	mp = mi_tpi_ok_ack_alloc(mp);
6418 	if (!mp) {
6419 		tcp->tcp_state = oldstate;
6420 		goto failed;
6421 	}
6422 	if (tcp->tcp_family == AF_INET) {
6423 		mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ,
6424 		    sizeof (ipa_conn_t));
6425 	} else {
6426 		mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ,
6427 		    sizeof (ipa6_conn_t));
6428 	}
6429 	if (mp1) {
6430 		/* Hang onto the T_OK_ACK for later. */
6431 		linkb(mp1, mp);
6432 		mblk_setcred(mp1, tcp->tcp_cred);
6433 		if (tcp->tcp_family == AF_INET)
6434 			mp1 = ip_bind_v4(tcp->tcp_wq, mp1, tcp->tcp_connp);
6435 		else {
6436 			mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp,
6437 			    &tcp->tcp_sticky_ipp);
6438 		}
6439 		BUMP_MIB(&tcp_mib, tcpActiveOpens);
6440 		tcp->tcp_active_open = 1;
6441 		/*
6442 		 * If the bind cannot complete immediately
6443 		 * IP will arrange to call tcp_rput_other
6444 		 * when the bind completes.
6445 		 */
6446 		if (mp1 != NULL)
6447 			tcp_rput_other(tcp, mp1);
6448 		return;
6449 	}
6450 	/* Error case */
6451 	tcp->tcp_state = oldstate;
6452 	mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM);
6453 
6454 failed:
6455 	/* return error ack and blow away saved option results if any */
6456 	if (mp != NULL)
6457 		putnext(tcp->tcp_rq, mp);
6458 	else {
6459 		tcp_err_ack_prim(tcp, NULL, T_CONN_REQ,
6460 		    TSYSERR, ENOMEM);
6461 	}
6462 	if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
6463 		tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
6464 
6465 }
6466 
6467 /*
6468  * Handle connect to IPv6 destinations.
6469  */
6470 static void
6471 tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp,
6472     in_port_t dstport, uint32_t flowinfo, uint_t srcid, uint32_t scope_id)
6473 {
6474 	tcph_t	*tcph;
6475 	mblk_t	*mp1;
6476 	ip6_rthdr_t *rth;
6477 	int32_t  oldstate;
6478 	uint16_t lport;
6479 
6480 	ASSERT(tcp->tcp_family == AF_INET6);
6481 
6482 	/*
6483 	 * If we're here, it means that the destination address is a native
6484 	 * IPv6 address.  Return an error if tcp_ipversion is not IPv6.  A
6485 	 * reason why it might not be IPv6 is if the socket was bound to an
6486 	 * IPv4-mapped IPv6 address.
6487 	 */
6488 	if (tcp->tcp_ipversion != IPV6_VERSION) {
6489 		mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0);
6490 		goto failed;
6491 	}
6492 
6493 	/*
6494 	 * Interpret a zero destination to mean loopback.
6495 	 * Update the T_CONN_REQ (sin/sin6) since it is used to
6496 	 * generate the T_CONN_CON.
6497 	 */
6498 	if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) {
6499 		*dstaddrp = ipv6_loopback;
6500 	}
6501 
6502 	/* Handle __sin6_src_id if socket not bound to an IP address */
6503 	if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) {
6504 		ip_srcid_find_id(srcid, &tcp->tcp_ip6h->ip6_src,
6505 		    tcp->tcp_connp->conn_zoneid);
6506 		tcp->tcp_ip_src_v6 = tcp->tcp_ip6h->ip6_src;
6507 	}
6508 
6509 	/*
6510 	 * Take care of the scope_id now and add ip6i_t
6511 	 * if ip6i_t is not already allocated through TCP
6512 	 * sticky options. At this point tcp_ip6h does not
6513 	 * have dst info, thus use dstaddrp.
6514 	 */
6515 	if (scope_id != 0 &&
6516 	    IN6_IS_ADDR_LINKSCOPE(dstaddrp)) {
6517 		ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp;
6518 		ip6i_t  *ip6i;
6519 
6520 		ipp->ipp_ifindex = scope_id;
6521 		ip6i = (ip6i_t *)tcp->tcp_iphc;
6522 
6523 		if ((ipp->ipp_fields & IPPF_HAS_IP6I) &&
6524 		    ip6i != NULL && (ip6i->ip6i_nxt == IPPROTO_RAW)) {
6525 			/* Already allocated */
6526 			ip6i->ip6i_flags |= IP6I_IFINDEX;
6527 			ip6i->ip6i_ifindex = ipp->ipp_ifindex;
6528 			ipp->ipp_fields |= IPPF_SCOPE_ID;
6529 		} else {
6530 			int reterr;
6531 
6532 			ipp->ipp_fields |= IPPF_SCOPE_ID;
6533 			if (ipp->ipp_fields & IPPF_HAS_IP6I)
6534 				ip2dbg(("tcp_connect_v6: SCOPE_ID set\n"));
6535 			reterr = tcp_build_hdrs(tcp->tcp_rq, tcp);
6536 			if (reterr != 0)
6537 				goto failed;
6538 			ip1dbg(("tcp_connect_ipv6: tcp_bld_hdrs returned\n"));
6539 		}
6540 	}
6541 
6542 	/*
6543 	 * Don't let an endpoint connect to itself.  Note that
6544 	 * the test here does not catch the case where the
6545 	 * source IP addr was left unspecified by the user. In
6546 	 * this case, the source addr is set in tcp_adapt_ire()
6547 	 * using the reply to the T_BIND message that we send
6548 	 * down to IP here and the check is repeated in tcp_rput_other.
6549 	 */
6550 	if (IN6_ARE_ADDR_EQUAL(dstaddrp, &tcp->tcp_ip6h->ip6_src) &&
6551 	    (dstport == tcp->tcp_lport)) {
6552 		mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0);
6553 		goto failed;
6554 	}
6555 
6556 	tcp->tcp_ip6h->ip6_dst = *dstaddrp;
6557 	tcp->tcp_remote_v6 = *dstaddrp;
6558 	tcp->tcp_ip6h->ip6_vcf =
6559 	    (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) |
6560 	    (flowinfo & ~IPV6_VERS_AND_FLOW_MASK);
6561 
6562 
6563 	/*
6564 	 * Massage a routing header (if present) putting the first hop
6565 	 * in ip6_dst. Compute a starting value for the checksum which
6566 	 * takes into account that the original ip6_dst should be
6567 	 * included in the checksum but that ip will include the
6568 	 * first hop in the source route in the tcp checksum.
6569 	 */
6570 	rth = ip_find_rthdr_v6(tcp->tcp_ip6h, (uint8_t *)tcp->tcp_tcph);
6571 	if (rth != NULL) {
6572 
6573 		tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, rth);
6574 		tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) +
6575 		    (tcp->tcp_sum >> 16));
6576 	} else {
6577 		tcp->tcp_sum = 0;
6578 	}
6579 
6580 	tcph = tcp->tcp_tcph;
6581 	*(uint16_t *)tcph->th_fport = dstport;
6582 	tcp->tcp_fport = dstport;
6583 
6584 	oldstate = tcp->tcp_state;
6585 	/*
6586 	 * At this point the remote destination address and remote port fields
6587 	 * in the tcp-four-tuple have been filled in the tcp structure. Now we
6588 	 * have to see which state tcp was in so we can take apropriate action.
6589 	 */
6590 	if (oldstate == TCPS_IDLE) {
6591 		/*
6592 		 * We support a quick connect capability here, allowing
6593 		 * clients to transition directly from IDLE to SYN_SENT
6594 		 * tcp_bindi will pick an unused port, insert the connection
6595 		 * in the bind hash and transition to BOUND state.
6596 		 */
6597 		lport = tcp_update_next_port(tcp_next_port_to_try, tcp, B_TRUE);
6598 		lport = tcp_bindi(tcp, lport, &tcp->tcp_ip_src_v6, 0, B_TRUE,
6599 		    B_FALSE, B_FALSE);
6600 		if (lport == 0) {
6601 			mp = mi_tpi_err_ack_alloc(mp, TNOADDR, 0);
6602 			goto failed;
6603 		}
6604 	}
6605 	tcp->tcp_state = TCPS_SYN_SENT;
6606 	/*
6607 	 * TODO: allow data with connect requests
6608 	 * by unlinking M_DATA trailers here and
6609 	 * linking them in behind the T_OK_ACK mblk.
6610 	 * The tcp_rput() bind ack handler would then
6611 	 * feed them to tcp_wput_data() rather than call
6612 	 * tcp_timer().
6613 	 */
6614 	mp = mi_tpi_ok_ack_alloc(mp);
6615 	if (!mp) {
6616 		tcp->tcp_state = oldstate;
6617 		goto failed;
6618 	}
6619 	mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, sizeof (ipa6_conn_t));
6620 	if (mp1) {
6621 		/* Hang onto the T_OK_ACK for later. */
6622 		linkb(mp1, mp);
6623 		mblk_setcred(mp1, tcp->tcp_cred);
6624 		mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp,
6625 		    &tcp->tcp_sticky_ipp);
6626 		BUMP_MIB(&tcp_mib, tcpActiveOpens);
6627 		tcp->tcp_active_open = 1;
6628 		/* ip_bind_v6() may return ACK or ERROR */
6629 		if (mp1 != NULL)
6630 			tcp_rput_other(tcp, mp1);
6631 		return;
6632 	}
6633 	/* Error case */
6634 	tcp->tcp_state = oldstate;
6635 	mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM);
6636 
6637 failed:
6638 	/* return error ack and blow away saved option results if any */
6639 	if (mp != NULL)
6640 		putnext(tcp->tcp_rq, mp);
6641 	else {
6642 		tcp_err_ack_prim(tcp, NULL, T_CONN_REQ,
6643 		    TSYSERR, ENOMEM);
6644 	}
6645 	if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
6646 		tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
6647 }
6648 
6649 /*
6650  * We need a stream q for detached closing tcp connections
6651  * to use.  Our client hereby indicates that this q is the
6652  * one to use.
6653  */
6654 static void
6655 tcp_def_q_set(tcp_t *tcp, mblk_t *mp)
6656 {
6657 	struct iocblk *iocp = (struct iocblk *)mp->b_rptr;
6658 	queue_t	*q = tcp->tcp_wq;
6659 
6660 	mp->b_datap->db_type = M_IOCACK;
6661 	iocp->ioc_count = 0;
6662 	mutex_enter(&tcp_g_q_lock);
6663 	if (tcp_g_q != NULL) {
6664 		mutex_exit(&tcp_g_q_lock);
6665 		iocp->ioc_error = EALREADY;
6666 	} else {
6667 		mblk_t *mp1;
6668 
6669 		mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 0);
6670 		if (mp1 == NULL) {
6671 			mutex_exit(&tcp_g_q_lock);
6672 			iocp->ioc_error = ENOMEM;
6673 		} else {
6674 			tcp_g_q = tcp->tcp_rq;
6675 			mutex_exit(&tcp_g_q_lock);
6676 			iocp->ioc_error = 0;
6677 			iocp->ioc_rval = 0;
6678 			/*
6679 			 * We are passing tcp_sticky_ipp as NULL
6680 			 * as it is not useful for tcp_default queue
6681 			 */
6682 			mp1 = ip_bind_v6(q, mp1, tcp->tcp_connp, NULL);
6683 			if (mp1 != NULL)
6684 				tcp_rput_other(tcp, mp1);
6685 		}
6686 	}
6687 	qreply(q, mp);
6688 }
6689 
6690 /*
6691  * Our client hereby directs us to reject the connection request
6692  * that tcp_conn_request() marked with 'seqnum'.  Rejection consists
6693  * of sending the appropriate RST, not an ICMP error.
6694  */
6695 static void
6696 tcp_disconnect(tcp_t *tcp, mblk_t *mp)
6697 {
6698 	tcp_t	*ltcp = NULL;
6699 	t_scalar_t seqnum;
6700 	conn_t	*connp;
6701 
6702 	ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
6703 	if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) {
6704 		tcp_err_ack(tcp, mp, TPROTO, 0);
6705 		return;
6706 	}
6707 
6708 	/*
6709 	 * Right now, upper modules pass down a T_DISCON_REQ to TCP,
6710 	 * when the stream is in BOUND state. Do not send a reset,
6711 	 * since the destination IP address is not valid, and it can
6712 	 * be the initialized value of all zeros (broadcast address).
6713 	 *
6714 	 * If TCP has sent down a bind request to IP and has not
6715 	 * received the reply, reject the request.  Otherwise, TCP
6716 	 * will be confused.
6717 	 */
6718 	if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_hard_binding) {
6719 		if (tcp->tcp_debug) {
6720 			(void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
6721 			    "tcp_disconnect: bad state, %d", tcp->tcp_state);
6722 		}
6723 		tcp_err_ack(tcp, mp, TOUTSTATE, 0);
6724 		return;
6725 	}
6726 
6727 	seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number;
6728 
6729 	if (seqnum == -1 || tcp->tcp_conn_req_max == 0) {
6730 
6731 		/*
6732 		 * According to TPI, for non-listeners, ignore seqnum
6733 		 * and disconnect.
6734 		 * Following interpretation of -1 seqnum is historical
6735 		 * and implied TPI ? (TPI only states that for T_CONN_IND,
6736 		 * a valid seqnum should not be -1).
6737 		 *
6738 		 *	-1 means disconnect everything
6739 		 *	regardless even on a listener.
6740 		 */
6741 
6742 		int old_state = tcp->tcp_state;
6743 
6744 		/*
6745 		 * The connection can't be on the tcp_time_wait_head list
6746 		 * since it is not detached.
6747 		 */
6748 		ASSERT(tcp->tcp_time_wait_next == NULL);
6749 		ASSERT(tcp->tcp_time_wait_prev == NULL);
6750 		ASSERT(tcp->tcp_time_wait_expire == 0);
6751 		ltcp = NULL;
6752 		/*
6753 		 * If it used to be a listener, check to make sure no one else
6754 		 * has taken the port before switching back to LISTEN state.
6755 		 */
6756 		if (tcp->tcp_ipversion == IPV4_VERSION) {
6757 			connp = ipcl_lookup_listener_v4(tcp->tcp_lport,
6758 			    tcp->tcp_ipha->ipha_src,
6759 			    tcp->tcp_connp->conn_zoneid);
6760 			if (connp != NULL)
6761 				ltcp = connp->conn_tcp;
6762 		} else {
6763 			/* Allow tcp_bound_if listeners? */
6764 			connp = ipcl_lookup_listener_v6(tcp->tcp_lport,
6765 			    &tcp->tcp_ip6h->ip6_src, 0,
6766 			    tcp->tcp_connp->conn_zoneid);
6767 			if (connp != NULL)
6768 				ltcp = connp->conn_tcp;
6769 		}
6770 		if (tcp->tcp_conn_req_max && ltcp == NULL) {
6771 			tcp->tcp_state = TCPS_LISTEN;
6772 		} else if (old_state > TCPS_BOUND) {
6773 			tcp->tcp_conn_req_max = 0;
6774 			tcp->tcp_state = TCPS_BOUND;
6775 		}
6776 		if (ltcp != NULL)
6777 			CONN_DEC_REF(ltcp->tcp_connp);
6778 		if (old_state == TCPS_SYN_SENT || old_state == TCPS_SYN_RCVD) {
6779 			BUMP_MIB(&tcp_mib, tcpAttemptFails);
6780 		} else if (old_state == TCPS_ESTABLISHED ||
6781 		    old_state == TCPS_CLOSE_WAIT) {
6782 			BUMP_MIB(&tcp_mib, tcpEstabResets);
6783 		}
6784 
6785 		if (tcp->tcp_fused)
6786 			tcp_unfuse(tcp);
6787 
6788 		mutex_enter(&tcp->tcp_eager_lock);
6789 		if ((tcp->tcp_conn_req_cnt_q0 != 0) ||
6790 		    (tcp->tcp_conn_req_cnt_q != 0)) {
6791 			tcp_eager_cleanup(tcp, 0);
6792 		}
6793 		mutex_exit(&tcp->tcp_eager_lock);
6794 
6795 		tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt,
6796 		    tcp->tcp_rnxt, TH_RST | TH_ACK);
6797 
6798 		tcp_reinit(tcp);
6799 
6800 		if (old_state >= TCPS_ESTABLISHED) {
6801 			/* Send M_FLUSH according to TPI */
6802 			(void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW);
6803 		}
6804 		mp = mi_tpi_ok_ack_alloc(mp);
6805 		if (mp)
6806 			putnext(tcp->tcp_rq, mp);
6807 		return;
6808 	} else if (!tcp_eager_blowoff(tcp, seqnum)) {
6809 		tcp_err_ack(tcp, mp, TBADSEQ, 0);
6810 		return;
6811 	}
6812 	if (tcp->tcp_state >= TCPS_ESTABLISHED) {
6813 		/* Send M_FLUSH according to TPI */
6814 		(void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW);
6815 	}
6816 	mp = mi_tpi_ok_ack_alloc(mp);
6817 	if (mp)
6818 		putnext(tcp->tcp_rq, mp);
6819 }
6820 
6821 /*
6822  * Diagnostic routine used to return a string associated with the tcp state.
6823  * Note that if the caller does not supply a buffer, it will use an internal
6824  * static string.  This means that if multiple threads call this function at
6825  * the same time, output can be corrupted...  Note also that this function
6826  * does not check the size of the supplied buffer.  The caller has to make
6827  * sure that it is big enough.
6828  */
6829 static char *
6830 tcp_display(tcp_t *tcp, char *sup_buf, char format)
6831 {
6832 	char		buf1[30];
6833 	static char	priv_buf[INET6_ADDRSTRLEN * 2 + 80];
6834 	char		*buf;
6835 	char		*cp;
6836 	in6_addr_t	local, remote;
6837 	char		local_addrbuf[INET6_ADDRSTRLEN];
6838 	char		remote_addrbuf[INET6_ADDRSTRLEN];
6839 
6840 	if (sup_buf != NULL)
6841 		buf = sup_buf;
6842 	else
6843 		buf = priv_buf;
6844 
6845 	if (tcp == NULL)
6846 		return ("NULL_TCP");
6847 	switch (tcp->tcp_state) {
6848 	case TCPS_CLOSED:
6849 		cp = "TCP_CLOSED";
6850 		break;
6851 	case TCPS_IDLE:
6852 		cp = "TCP_IDLE";
6853 		break;
6854 	case TCPS_BOUND:
6855 		cp = "TCP_BOUND";
6856 		break;
6857 	case TCPS_LISTEN:
6858 		cp = "TCP_LISTEN";
6859 		break;
6860 	case TCPS_SYN_SENT:
6861 		cp = "TCP_SYN_SENT";
6862 		break;
6863 	case TCPS_SYN_RCVD:
6864 		cp = "TCP_SYN_RCVD";
6865 		break;
6866 	case TCPS_ESTABLISHED:
6867 		cp = "TCP_ESTABLISHED";
6868 		break;
6869 	case TCPS_CLOSE_WAIT:
6870 		cp = "TCP_CLOSE_WAIT";
6871 		break;
6872 	case TCPS_FIN_WAIT_1:
6873 		cp = "TCP_FIN_WAIT_1";
6874 		break;
6875 	case TCPS_CLOSING:
6876 		cp = "TCP_CLOSING";
6877 		break;
6878 	case TCPS_LAST_ACK:
6879 		cp = "TCP_LAST_ACK";
6880 		break;
6881 	case TCPS_FIN_WAIT_2:
6882 		cp = "TCP_FIN_WAIT_2";
6883 		break;
6884 	case TCPS_TIME_WAIT:
6885 		cp = "TCP_TIME_WAIT";
6886 		break;
6887 	default:
6888 		(void) mi_sprintf(buf1, "TCPUnkState(%d)", tcp->tcp_state);
6889 		cp = buf1;
6890 		break;
6891 	}
6892 	switch (format) {
6893 	case DISP_ADDR_AND_PORT:
6894 		if (tcp->tcp_ipversion == IPV4_VERSION) {
6895 			/*
6896 			 * Note that we use the remote address in the tcp_b
6897 			 * structure.  This means that it will print out
6898 			 * the real destination address, not the next hop's
6899 			 * address if source routing is used.
6900 			 */
6901 			IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ip_src, &local);
6902 			IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &remote);
6903 
6904 		} else {
6905 			local = tcp->tcp_ip_src_v6;
6906 			remote = tcp->tcp_remote_v6;
6907 		}
6908 		(void) inet_ntop(AF_INET6, &local, local_addrbuf,
6909 		    sizeof (local_addrbuf));
6910 		(void) inet_ntop(AF_INET6, &remote, remote_addrbuf,
6911 		    sizeof (remote_addrbuf));
6912 		(void) mi_sprintf(buf, "[%s.%u, %s.%u] %s",
6913 		    local_addrbuf, ntohs(tcp->tcp_lport), remote_addrbuf,
6914 		    ntohs(tcp->tcp_fport), cp);
6915 		break;
6916 	case DISP_PORT_ONLY:
6917 	default:
6918 		(void) mi_sprintf(buf, "[%u, %u] %s",
6919 		    ntohs(tcp->tcp_lport), ntohs(tcp->tcp_fport), cp);
6920 		break;
6921 	}
6922 
6923 	return (buf);
6924 }
6925 
6926 /*
6927  * Called via squeue to get on to eager's perimeter to send a
6928  * TH_RST. The listener wants the eager to disappear either
6929  * by means of tcp_eager_blowoff() or tcp_eager_cleanup()
6930  * being called.
6931  */
6932 /* ARGSUSED */
6933 void
6934 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2)
6935 {
6936 	conn_t	*econnp = (conn_t *)arg;
6937 	tcp_t	*eager = econnp->conn_tcp;
6938 	tcp_t	*listener = eager->tcp_listener;
6939 
6940 	/*
6941 	 * We could be called because listener is closing. Since
6942 	 * the eager is using listener's queue's, its not safe.
6943 	 * Better use the default queue just to send the TH_RST
6944 	 * out.
6945 	 */
6946 	eager->tcp_rq = tcp_g_q;
6947 	eager->tcp_wq = WR(tcp_g_q);
6948 
6949 	if (eager->tcp_state > TCPS_LISTEN) {
6950 		tcp_xmit_ctl("tcp_eager_kill, can't wait",
6951 		    eager, eager->tcp_snxt, 0, TH_RST);
6952 	}
6953 
6954 	/* We are here because listener wants this eager gone */
6955 	if (listener != NULL) {
6956 		mutex_enter(&listener->tcp_eager_lock);
6957 		tcp_eager_unlink(eager);
6958 		if (eager->tcp_conn.tcp_eager_conn_ind == NULL) {
6959 			/*
6960 			 * The eager has sent a conn_ind up to the
6961 			 * listener but listener decides to close
6962 			 * instead. We need to drop the extra ref
6963 			 * placed on eager in tcp_rput_data() before
6964 			 * sending the conn_ind to listener.
6965 			 */
6966 			CONN_DEC_REF(econnp);
6967 		}
6968 		mutex_exit(&listener->tcp_eager_lock);
6969 		CONN_DEC_REF(listener->tcp_connp);
6970 	}
6971 
6972 	if (eager->tcp_state > TCPS_BOUND)
6973 		tcp_close_detached(eager);
6974 }
6975 
6976 /*
6977  * Reset any eager connection hanging off this listener marked
6978  * with 'seqnum' and then reclaim it's resources.
6979  */
6980 static boolean_t
6981 tcp_eager_blowoff(tcp_t	*listener, t_scalar_t seqnum)
6982 {
6983 	tcp_t	*eager;
6984 	mblk_t 	*mp;
6985 
6986 	TCP_STAT(tcp_eager_blowoff_calls);
6987 	eager = listener;
6988 	mutex_enter(&listener->tcp_eager_lock);
6989 	do {
6990 		eager = eager->tcp_eager_next_q;
6991 		if (eager == NULL) {
6992 			mutex_exit(&listener->tcp_eager_lock);
6993 			return (B_FALSE);
6994 		}
6995 	} while (eager->tcp_conn_req_seqnum != seqnum);
6996 	CONN_INC_REF(eager->tcp_connp);
6997 	mutex_exit(&listener->tcp_eager_lock);
6998 	mp = &eager->tcp_closemp;
6999 	squeue_fill(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
7000 	    eager->tcp_connp, SQTAG_TCP_EAGER_BLOWOFF);
7001 	return (B_TRUE);
7002 }
7003 
7004 /*
7005  * Reset any eager connection hanging off this listener
7006  * and then reclaim it's resources.
7007  */
7008 static void
7009 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
7010 {
7011 	tcp_t	*eager;
7012 	mblk_t	*mp;
7013 
7014 	ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
7015 
7016 	if (!q0_only) {
7017 		/* First cleanup q */
7018 		TCP_STAT(tcp_eager_blowoff_q);
7019 		eager = listener->tcp_eager_next_q;
7020 		while (eager != NULL) {
7021 			CONN_INC_REF(eager->tcp_connp);
7022 			mp = &eager->tcp_closemp;
7023 			squeue_fill(eager->tcp_connp->conn_sqp, mp,
7024 			    tcp_eager_kill, eager->tcp_connp,
7025 			    SQTAG_TCP_EAGER_CLEANUP);
7026 			eager = eager->tcp_eager_next_q;
7027 		}
7028 	}
7029 	/* Then cleanup q0 */
7030 	TCP_STAT(tcp_eager_blowoff_q0);
7031 	eager = listener->tcp_eager_next_q0;
7032 	while (eager != listener) {
7033 		CONN_INC_REF(eager->tcp_connp);
7034 		mp = &eager->tcp_closemp;
7035 		squeue_fill(eager->tcp_connp->conn_sqp, mp,
7036 		    tcp_eager_kill, eager->tcp_connp,
7037 		    SQTAG_TCP_EAGER_CLEANUP_Q0);
7038 		eager = eager->tcp_eager_next_q0;
7039 	}
7040 }
7041 
7042 /*
7043  * If we are an eager connection hanging off a listener that hasn't
7044  * formally accepted the connection yet, get off his list and blow off
7045  * any data that we have accumulated.
7046  */
7047 static void
7048 tcp_eager_unlink(tcp_t *tcp)
7049 {
7050 	tcp_t	*listener = tcp->tcp_listener;
7051 
7052 	ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
7053 	ASSERT(listener != NULL);
7054 	if (tcp->tcp_eager_next_q0 != NULL) {
7055 		ASSERT(tcp->tcp_eager_prev_q0 != NULL);
7056 
7057 		/* Remove the eager tcp from q0 */
7058 		tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
7059 		    tcp->tcp_eager_prev_q0;
7060 		tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
7061 		    tcp->tcp_eager_next_q0;
7062 		ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
7063 		listener->tcp_conn_req_cnt_q0--;
7064 
7065 		tcp->tcp_eager_next_q0 = NULL;
7066 		tcp->tcp_eager_prev_q0 = NULL;
7067 
7068 		if (tcp->tcp_syn_rcvd_timeout != 0) {
7069 			/* we have timed out before */
7070 			ASSERT(listener->tcp_syn_rcvd_timeout > 0);
7071 			listener->tcp_syn_rcvd_timeout--;
7072 		}
7073 	} else {
7074 		tcp_t   **tcpp = &listener->tcp_eager_next_q;
7075 		tcp_t	*prev = NULL;
7076 
7077 		for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
7078 			if (tcpp[0] == tcp) {
7079 				if (listener->tcp_eager_last_q == tcp) {
7080 					/*
7081 					 * If we are unlinking the last
7082 					 * element on the list, adjust
7083 					 * tail pointer. Set tail pointer
7084 					 * to nil when list is empty.
7085 					 */
7086 					ASSERT(tcp->tcp_eager_next_q == NULL);
7087 					if (listener->tcp_eager_last_q ==
7088 					    listener->tcp_eager_next_q) {
7089 						listener->tcp_eager_last_q =
7090 						NULL;
7091 					} else {
7092 						/*
7093 						 * We won't get here if there
7094 						 * is only one eager in the
7095 						 * list.
7096 						 */
7097 						ASSERT(prev != NULL);
7098 						listener->tcp_eager_last_q =
7099 						    prev;
7100 					}
7101 				}
7102 				tcpp[0] = tcp->tcp_eager_next_q;
7103 				tcp->tcp_eager_next_q = NULL;
7104 				tcp->tcp_eager_last_q = NULL;
7105 				ASSERT(listener->tcp_conn_req_cnt_q > 0);
7106 				listener->tcp_conn_req_cnt_q--;
7107 				break;
7108 			}
7109 			prev = tcpp[0];
7110 		}
7111 	}
7112 	tcp->tcp_listener = NULL;
7113 }
7114 
7115 /* Shorthand to generate and send TPI error acks to our client */
7116 static void
7117 tcp_err_ack(tcp_t *tcp, mblk_t *mp, int t_error, int sys_error)
7118 {
7119 	if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL)
7120 		putnext(tcp->tcp_rq, mp);
7121 }
7122 
7123 /* Shorthand to generate and send TPI error acks to our client */
7124 static void
7125 tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive,
7126     int t_error, int sys_error)
7127 {
7128 	struct T_error_ack	*teackp;
7129 
7130 	if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack),
7131 	    M_PCPROTO, T_ERROR_ACK)) != NULL) {
7132 		teackp = (struct T_error_ack *)mp->b_rptr;
7133 		teackp->ERROR_prim = primitive;
7134 		teackp->TLI_error = t_error;
7135 		teackp->UNIX_error = sys_error;
7136 		putnext(tcp->tcp_rq, mp);
7137 	}
7138 }
7139 
7140 /*
7141  * Note: No locks are held when inspecting tcp_g_*epriv_ports
7142  * but instead the code relies on:
7143  * - the fact that the address of the array and its size never changes
7144  * - the atomic assignment of the elements of the array
7145  */
7146 /* ARGSUSED */
7147 static int
7148 tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
7149 {
7150 	int i;
7151 
7152 	for (i = 0; i < tcp_g_num_epriv_ports; i++) {
7153 		if (tcp_g_epriv_ports[i] != 0)
7154 			(void) mi_mpprintf(mp, "%d ", tcp_g_epriv_ports[i]);
7155 	}
7156 	return (0);
7157 }
7158 
7159 /*
7160  * Hold a lock while changing tcp_g_epriv_ports to prevent multiple
7161  * threads from changing it at the same time.
7162  */
7163 /* ARGSUSED */
7164 static int
7165 tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
7166     cred_t *cr)
7167 {
7168 	long	new_value;
7169 	int	i;
7170 
7171 	/*
7172 	 * Fail the request if the new value does not lie within the
7173 	 * port number limits.
7174 	 */
7175 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
7176 	    new_value <= 0 || new_value >= 65536) {
7177 		return (EINVAL);
7178 	}
7179 
7180 	mutex_enter(&tcp_epriv_port_lock);
7181 	/* Check if the value is already in the list */
7182 	for (i = 0; i < tcp_g_num_epriv_ports; i++) {
7183 		if (new_value == tcp_g_epriv_ports[i]) {
7184 			mutex_exit(&tcp_epriv_port_lock);
7185 			return (EEXIST);
7186 		}
7187 	}
7188 	/* Find an empty slot */
7189 	for (i = 0; i < tcp_g_num_epriv_ports; i++) {
7190 		if (tcp_g_epriv_ports[i] == 0)
7191 			break;
7192 	}
7193 	if (i == tcp_g_num_epriv_ports) {
7194 		mutex_exit(&tcp_epriv_port_lock);
7195 		return (EOVERFLOW);
7196 	}
7197 	/* Set the new value */
7198 	tcp_g_epriv_ports[i] = (uint16_t)new_value;
7199 	mutex_exit(&tcp_epriv_port_lock);
7200 	return (0);
7201 }
7202 
7203 /*
7204  * Hold a lock while changing tcp_g_epriv_ports to prevent multiple
7205  * threads from changing it at the same time.
7206  */
7207 /* ARGSUSED */
7208 static int
7209 tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
7210     cred_t *cr)
7211 {
7212 	long	new_value;
7213 	int	i;
7214 
7215 	/*
7216 	 * Fail the request if the new value does not lie within the
7217 	 * port number limits.
7218 	 */
7219 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 ||
7220 	    new_value >= 65536) {
7221 		return (EINVAL);
7222 	}
7223 
7224 	mutex_enter(&tcp_epriv_port_lock);
7225 	/* Check that the value is already in the list */
7226 	for (i = 0; i < tcp_g_num_epriv_ports; i++) {
7227 		if (tcp_g_epriv_ports[i] == new_value)
7228 			break;
7229 	}
7230 	if (i == tcp_g_num_epriv_ports) {
7231 		mutex_exit(&tcp_epriv_port_lock);
7232 		return (ESRCH);
7233 	}
7234 	/* Clear the value */
7235 	tcp_g_epriv_ports[i] = 0;
7236 	mutex_exit(&tcp_epriv_port_lock);
7237 	return (0);
7238 }
7239 
7240 /* Return the TPI/TLI equivalent of our current tcp_state */
7241 static int
7242 tcp_tpistate(tcp_t *tcp)
7243 {
7244 	switch (tcp->tcp_state) {
7245 	case TCPS_IDLE:
7246 		return (TS_UNBND);
7247 	case TCPS_LISTEN:
7248 		/*
7249 		 * Return whether there are outstanding T_CONN_IND waiting
7250 		 * for the matching T_CONN_RES. Therefore don't count q0.
7251 		 */
7252 		if (tcp->tcp_conn_req_cnt_q > 0)
7253 			return (TS_WRES_CIND);
7254 		else
7255 			return (TS_IDLE);
7256 	case TCPS_BOUND:
7257 		return (TS_IDLE);
7258 	case TCPS_SYN_SENT:
7259 		return (TS_WCON_CREQ);
7260 	case TCPS_SYN_RCVD:
7261 		/*
7262 		 * Note: assumption: this has to the active open SYN_RCVD.
7263 		 * The passive instance is detached in SYN_RCVD stage of
7264 		 * incoming connection processing so we cannot get request
7265 		 * for T_info_ack on it.
7266 		 */
7267 		return (TS_WACK_CRES);
7268 	case TCPS_ESTABLISHED:
7269 		return (TS_DATA_XFER);
7270 	case TCPS_CLOSE_WAIT:
7271 		return (TS_WREQ_ORDREL);
7272 	case TCPS_FIN_WAIT_1:
7273 		return (TS_WIND_ORDREL);
7274 	case TCPS_FIN_WAIT_2:
7275 		return (TS_WIND_ORDREL);
7276 
7277 	case TCPS_CLOSING:
7278 	case TCPS_LAST_ACK:
7279 	case TCPS_TIME_WAIT:
7280 	case TCPS_CLOSED:
7281 		/*
7282 		 * Following TS_WACK_DREQ7 is a rendition of "not
7283 		 * yet TS_IDLE" TPI state. There is no best match to any
7284 		 * TPI state for TCPS_{CLOSING, LAST_ACK, TIME_WAIT} but we
7285 		 * choose a value chosen that will map to TLI/XTI level
7286 		 * state of TSTATECHNG (state is process of changing) which
7287 		 * captures what this dummy state represents.
7288 		 */
7289 		return (TS_WACK_DREQ7);
7290 	default:
7291 		cmn_err(CE_WARN, "tcp_tpistate: strange state (%d) %s",
7292 		    tcp->tcp_state, tcp_display(tcp, NULL,
7293 		    DISP_PORT_ONLY));
7294 		return (TS_UNBND);
7295 	}
7296 }
7297 
7298 static void
7299 tcp_copy_info(struct T_info_ack *tia, tcp_t *tcp)
7300 {
7301 	if (tcp->tcp_family == AF_INET6)
7302 		*tia = tcp_g_t_info_ack_v6;
7303 	else
7304 		*tia = tcp_g_t_info_ack;
7305 	tia->CURRENT_state = tcp_tpistate(tcp);
7306 	tia->OPT_size = tcp_max_optsize;
7307 	if (tcp->tcp_mss == 0) {
7308 		/* Not yet set - tcp_open does not set mss */
7309 		if (tcp->tcp_ipversion == IPV4_VERSION)
7310 			tia->TIDU_size = tcp_mss_def_ipv4;
7311 		else
7312 			tia->TIDU_size = tcp_mss_def_ipv6;
7313 	} else {
7314 		tia->TIDU_size = tcp->tcp_mss;
7315 	}
7316 	/* TODO: Default ETSDU is 1.  Is that correct for tcp? */
7317 }
7318 
7319 /*
7320  * This routine responds to T_CAPABILITY_REQ messages.  It is called by
7321  * tcp_wput.  Much of the T_CAPABILITY_ACK information is copied from
7322  * tcp_g_t_info_ack.  The current state of the stream is copied from
7323  * tcp_state.
7324  */
7325 static void
7326 tcp_capability_req(tcp_t *tcp, mblk_t *mp)
7327 {
7328 	t_uscalar_t		cap_bits1;
7329 	struct T_capability_ack	*tcap;
7330 
7331 	if (MBLKL(mp) < sizeof (struct T_capability_req)) {
7332 		freemsg(mp);
7333 		return;
7334 	}
7335 
7336 	cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1;
7337 
7338 	mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack),
7339 	    mp->b_datap->db_type, T_CAPABILITY_ACK);
7340 	if (mp == NULL)
7341 		return;
7342 
7343 	tcap = (struct T_capability_ack *)mp->b_rptr;
7344 	tcap->CAP_bits1 = 0;
7345 
7346 	if (cap_bits1 & TC1_INFO) {
7347 		tcp_copy_info(&tcap->INFO_ack, tcp);
7348 		tcap->CAP_bits1 |= TC1_INFO;
7349 	}
7350 
7351 	if (cap_bits1 & TC1_ACCEPTOR_ID) {
7352 		tcap->ACCEPTOR_id = tcp->tcp_acceptor_id;
7353 		tcap->CAP_bits1 |= TC1_ACCEPTOR_ID;
7354 	}
7355 
7356 	putnext(tcp->tcp_rq, mp);
7357 }
7358 
7359 /*
7360  * This routine responds to T_INFO_REQ messages.  It is called by tcp_wput.
7361  * Most of the T_INFO_ACK information is copied from tcp_g_t_info_ack.
7362  * The current state of the stream is copied from tcp_state.
7363  */
7364 static void
7365 tcp_info_req(tcp_t *tcp, mblk_t *mp)
7366 {
7367 	mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO,
7368 	    T_INFO_ACK);
7369 	if (!mp) {
7370 		tcp_err_ack(tcp, mp, TSYSERR, ENOMEM);
7371 		return;
7372 	}
7373 	tcp_copy_info((struct T_info_ack *)mp->b_rptr, tcp);
7374 	putnext(tcp->tcp_rq, mp);
7375 }
7376 
7377 /* Respond to the TPI addr request */
7378 static void
7379 tcp_addr_req(tcp_t *tcp, mblk_t *mp)
7380 {
7381 	sin_t	*sin;
7382 	mblk_t	*ackmp;
7383 	struct T_addr_ack *taa;
7384 
7385 	/* Make it large enough for worst case */
7386 	ackmp = reallocb(mp, sizeof (struct T_addr_ack) +
7387 	    2 * sizeof (sin6_t), 1);
7388 	if (ackmp == NULL) {
7389 		tcp_err_ack(tcp, mp, TSYSERR, ENOMEM);
7390 		return;
7391 	}
7392 
7393 	if (tcp->tcp_ipversion == IPV6_VERSION) {
7394 		tcp_addr_req_ipv6(tcp, ackmp);
7395 		return;
7396 	}
7397 	taa = (struct T_addr_ack *)ackmp->b_rptr;
7398 
7399 	bzero(taa, sizeof (struct T_addr_ack));
7400 	ackmp->b_wptr = (uchar_t *)&taa[1];
7401 
7402 	taa->PRIM_type = T_ADDR_ACK;
7403 	ackmp->b_datap->db_type = M_PCPROTO;
7404 
7405 	/*
7406 	 * Note: Following code assumes 32 bit alignment of basic
7407 	 * data structures like sin_t and struct T_addr_ack.
7408 	 */
7409 	if (tcp->tcp_state >= TCPS_BOUND) {
7410 		/*
7411 		 * Fill in local address
7412 		 */
7413 		taa->LOCADDR_length = sizeof (sin_t);
7414 		taa->LOCADDR_offset = sizeof (*taa);
7415 
7416 		sin = (sin_t *)&taa[1];
7417 
7418 		/* Fill zeroes and then intialize non-zero fields */
7419 		*sin = sin_null;
7420 
7421 		sin->sin_family = AF_INET;
7422 
7423 		sin->sin_addr.s_addr = tcp->tcp_ipha->ipha_src;
7424 		sin->sin_port = *(uint16_t *)tcp->tcp_tcph->th_lport;
7425 
7426 		ackmp->b_wptr = (uchar_t *)&sin[1];
7427 
7428 		if (tcp->tcp_state >= TCPS_SYN_RCVD) {
7429 			/*
7430 			 * Fill in Remote address
7431 			 */
7432 			taa->REMADDR_length = sizeof (sin_t);
7433 			taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset +
7434 						taa->LOCADDR_length);
7435 
7436 			sin = (sin_t *)(ackmp->b_rptr + taa->REMADDR_offset);
7437 			*sin = sin_null;
7438 			sin->sin_family = AF_INET;
7439 			sin->sin_addr.s_addr = tcp->tcp_remote;
7440 			sin->sin_port = tcp->tcp_fport;
7441 
7442 			ackmp->b_wptr = (uchar_t *)&sin[1];
7443 		}
7444 	}
7445 	putnext(tcp->tcp_rq, ackmp);
7446 }
7447 
7448 /* Assumes that tcp_addr_req gets enough space and alignment */
7449 static void
7450 tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *ackmp)
7451 {
7452 	sin6_t	*sin6;
7453 	struct T_addr_ack *taa;
7454 
7455 	ASSERT(tcp->tcp_ipversion == IPV6_VERSION);
7456 	ASSERT(OK_32PTR(ackmp->b_rptr));
7457 	ASSERT(ackmp->b_wptr - ackmp->b_rptr >= sizeof (struct T_addr_ack) +
7458 	    2 * sizeof (sin6_t));
7459 
7460 	taa = (struct T_addr_ack *)ackmp->b_rptr;
7461 
7462 	bzero(taa, sizeof (struct T_addr_ack));
7463 	ackmp->b_wptr = (uchar_t *)&taa[1];
7464 
7465 	taa->PRIM_type = T_ADDR_ACK;
7466 	ackmp->b_datap->db_type = M_PCPROTO;
7467 
7468 	/*
7469 	 * Note: Following code assumes 32 bit alignment of basic
7470 	 * data structures like sin6_t and struct T_addr_ack.
7471 	 */
7472 	if (tcp->tcp_state >= TCPS_BOUND) {
7473 		/*
7474 		 * Fill in local address
7475 		 */
7476 		taa->LOCADDR_length = sizeof (sin6_t);
7477 		taa->LOCADDR_offset = sizeof (*taa);
7478 
7479 		sin6 = (sin6_t *)&taa[1];
7480 		*sin6 = sin6_null;
7481 
7482 		sin6->sin6_family = AF_INET6;
7483 		sin6->sin6_addr = tcp->tcp_ip6h->ip6_src;
7484 		sin6->sin6_port = tcp->tcp_lport;
7485 
7486 		ackmp->b_wptr = (uchar_t *)&sin6[1];
7487 
7488 		if (tcp->tcp_state >= TCPS_SYN_RCVD) {
7489 			/*
7490 			 * Fill in Remote address
7491 			 */
7492 			taa->REMADDR_length = sizeof (sin6_t);
7493 			taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset +
7494 						taa->LOCADDR_length);
7495 
7496 			sin6 = (sin6_t *)(ackmp->b_rptr + taa->REMADDR_offset);
7497 			*sin6 = sin6_null;
7498 			sin6->sin6_family = AF_INET6;
7499 			sin6->sin6_flowinfo =
7500 			    tcp->tcp_ip6h->ip6_vcf &
7501 			    ~IPV6_VERS_AND_FLOW_MASK;
7502 			sin6->sin6_addr = tcp->tcp_remote_v6;
7503 			sin6->sin6_port = tcp->tcp_fport;
7504 
7505 			ackmp->b_wptr = (uchar_t *)&sin6[1];
7506 		}
7507 	}
7508 	putnext(tcp->tcp_rq, ackmp);
7509 }
7510 
7511 /*
7512  * Handle reinitialization of a tcp structure.
7513  * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE.
7514  */
7515 static void
7516 tcp_reinit(tcp_t *tcp)
7517 {
7518 	mblk_t	*mp;
7519 	int 	err;
7520 
7521 	TCP_STAT(tcp_reinit_calls);
7522 
7523 	/* tcp_reinit should never be called for detached tcp_t's */
7524 	ASSERT(tcp->tcp_listener == NULL);
7525 	ASSERT((tcp->tcp_family == AF_INET &&
7526 	    tcp->tcp_ipversion == IPV4_VERSION) ||
7527 	    (tcp->tcp_family == AF_INET6 &&
7528 	    (tcp->tcp_ipversion == IPV4_VERSION ||
7529 	    tcp->tcp_ipversion == IPV6_VERSION)));
7530 
7531 	/* Cancel outstanding timers */
7532 	tcp_timers_stop(tcp);
7533 
7534 	/*
7535 	 * Reset everything in the state vector, after updating global
7536 	 * MIB data from instance counters.
7537 	 */
7538 	UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs);
7539 	tcp->tcp_ibsegs = 0;
7540 	UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs);
7541 	tcp->tcp_obsegs = 0;
7542 
7543 	tcp_close_mpp(&tcp->tcp_xmit_head);
7544 	if (tcp->tcp_snd_zcopy_aware)
7545 		tcp_zcopy_notify(tcp);
7546 	tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL;
7547 	tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0;
7548 	if (tcp->tcp_flow_stopped &&
7549 	    TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) {
7550 		tcp_clrqfull(tcp);
7551 	}
7552 	tcp_close_mpp(&tcp->tcp_reass_head);
7553 	tcp->tcp_reass_tail = NULL;
7554 	if (tcp->tcp_rcv_list != NULL) {
7555 		/* Free b_next chain */
7556 		tcp_close_mpp(&tcp->tcp_rcv_list);
7557 		tcp->tcp_rcv_last_head = NULL;
7558 		tcp->tcp_rcv_last_tail = NULL;
7559 		tcp->tcp_rcv_cnt = 0;
7560 	}
7561 	tcp->tcp_rcv_last_tail = NULL;
7562 
7563 	if ((mp = tcp->tcp_urp_mp) != NULL) {
7564 		freemsg(mp);
7565 		tcp->tcp_urp_mp = NULL;
7566 	}
7567 	if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
7568 		freemsg(mp);
7569 		tcp->tcp_urp_mark_mp = NULL;
7570 	}
7571 	if (tcp->tcp_fused_sigurg_mp != NULL) {
7572 		freeb(tcp->tcp_fused_sigurg_mp);
7573 		tcp->tcp_fused_sigurg_mp = NULL;
7574 	}
7575 
7576 	/*
7577 	 * Following is a union with two members which are
7578 	 * identical types and size so the following cleanup
7579 	 * is enough.
7580 	 */
7581 	tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
7582 
7583 	CL_INET_DISCONNECT(tcp);
7584 
7585 	/*
7586 	 * The connection can't be on the tcp_time_wait_head list
7587 	 * since it is not detached.
7588 	 */
7589 	ASSERT(tcp->tcp_time_wait_next == NULL);
7590 	ASSERT(tcp->tcp_time_wait_prev == NULL);
7591 	ASSERT(tcp->tcp_time_wait_expire == 0);
7592 
7593 	if (tcp->tcp_kssl_pending) {
7594 		tcp->tcp_kssl_pending = B_FALSE;
7595 
7596 		/* Don't reset if the initialized by bind. */
7597 		if (tcp->tcp_kssl_ent != NULL) {
7598 			kssl_release_ent(tcp->tcp_kssl_ent, NULL,
7599 			    KSSL_NO_PROXY);
7600 		}
7601 	}
7602 	if (tcp->tcp_kssl_ctx != NULL) {
7603 		kssl_release_ctx(tcp->tcp_kssl_ctx);
7604 		tcp->tcp_kssl_ctx = NULL;
7605 	}
7606 
7607 	/*
7608 	 * Reset/preserve other values
7609 	 */
7610 	tcp_reinit_values(tcp);
7611 	ipcl_hash_remove(tcp->tcp_connp);
7612 	conn_delete_ire(tcp->tcp_connp, NULL);
7613 
7614 	if (tcp->tcp_conn_req_max != 0) {
7615 		/*
7616 		 * This is the case when a TLI program uses the same
7617 		 * transport end point to accept a connection.  This
7618 		 * makes the TCP both a listener and acceptor.  When
7619 		 * this connection is closed, we need to set the state
7620 		 * back to TCPS_LISTEN.  Make sure that the eager list
7621 		 * is reinitialized.
7622 		 *
7623 		 * Note that this stream is still bound to the four
7624 		 * tuples of the previous connection in IP.  If a new
7625 		 * SYN with different foreign address comes in, IP will
7626 		 * not find it and will send it to the global queue.  In
7627 		 * the global queue, TCP will do a tcp_lookup_listener()
7628 		 * to find this stream.  This works because this stream
7629 		 * is only removed from connected hash.
7630 		 *
7631 		 */
7632 		tcp->tcp_state = TCPS_LISTEN;
7633 		tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
7634 		tcp->tcp_connp->conn_recv = tcp_conn_request;
7635 		if (tcp->tcp_family == AF_INET6) {
7636 			ASSERT(tcp->tcp_connp->conn_af_isv6);
7637 			(void) ipcl_bind_insert_v6(tcp->tcp_connp, IPPROTO_TCP,
7638 			    &tcp->tcp_ip6h->ip6_src, tcp->tcp_lport);
7639 		} else {
7640 			ASSERT(!tcp->tcp_connp->conn_af_isv6);
7641 			(void) ipcl_bind_insert(tcp->tcp_connp, IPPROTO_TCP,
7642 			    tcp->tcp_ipha->ipha_src, tcp->tcp_lport);
7643 		}
7644 	} else {
7645 		tcp->tcp_state = TCPS_BOUND;
7646 	}
7647 
7648 	/*
7649 	 * Initialize to default values
7650 	 * Can't fail since enough header template space already allocated
7651 	 * at open().
7652 	 */
7653 	err = tcp_init_values(tcp);
7654 	ASSERT(err == 0);
7655 	/* Restore state in tcp_tcph */
7656 	bcopy(&tcp->tcp_lport, tcp->tcp_tcph->th_lport, TCP_PORT_LEN);
7657 	if (tcp->tcp_ipversion == IPV4_VERSION)
7658 		tcp->tcp_ipha->ipha_src = tcp->tcp_bound_source;
7659 	else
7660 		tcp->tcp_ip6h->ip6_src = tcp->tcp_bound_source_v6;
7661 	/*
7662 	 * Copy of the src addr. in tcp_t is needed in tcp_t
7663 	 * since the lookup funcs can only lookup on tcp_t
7664 	 */
7665 	tcp->tcp_ip_src_v6 = tcp->tcp_bound_source_v6;
7666 
7667 	ASSERT(tcp->tcp_ptpbhn != NULL);
7668 	tcp->tcp_rq->q_hiwat = tcp_recv_hiwat;
7669 	tcp->tcp_rwnd = tcp_recv_hiwat;
7670 	tcp->tcp_mss = tcp->tcp_ipversion != IPV4_VERSION ?
7671 	    tcp_mss_def_ipv6 : tcp_mss_def_ipv4;
7672 }
7673 
7674 /*
7675  * Force values to zero that need be zero.
7676  * Do not touch values asociated with the BOUND or LISTEN state
7677  * since the connection will end up in that state after the reinit.
7678  * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t
7679  * structure!
7680  */
7681 static void
7682 tcp_reinit_values(tcp)
7683 	tcp_t *tcp;
7684 {
7685 #ifndef	lint
7686 #define	DONTCARE(x)
7687 #define	PRESERVE(x)
7688 #else
7689 #define	DONTCARE(x)	((x) = (x))
7690 #define	PRESERVE(x)	((x) = (x))
7691 #endif	/* lint */
7692 
7693 	PRESERVE(tcp->tcp_bind_hash);
7694 	PRESERVE(tcp->tcp_ptpbhn);
7695 	PRESERVE(tcp->tcp_acceptor_hash);
7696 	PRESERVE(tcp->tcp_ptpahn);
7697 
7698 	/* Should be ASSERT NULL on these with new code! */
7699 	ASSERT(tcp->tcp_time_wait_next == NULL);
7700 	ASSERT(tcp->tcp_time_wait_prev == NULL);
7701 	ASSERT(tcp->tcp_time_wait_expire == 0);
7702 	PRESERVE(tcp->tcp_state);
7703 	PRESERVE(tcp->tcp_rq);
7704 	PRESERVE(tcp->tcp_wq);
7705 
7706 	ASSERT(tcp->tcp_xmit_head == NULL);
7707 	ASSERT(tcp->tcp_xmit_last == NULL);
7708 	ASSERT(tcp->tcp_unsent == 0);
7709 	ASSERT(tcp->tcp_xmit_tail == NULL);
7710 	ASSERT(tcp->tcp_xmit_tail_unsent == 0);
7711 
7712 	tcp->tcp_snxt = 0;			/* Displayed in mib */
7713 	tcp->tcp_suna = 0;			/* Displayed in mib */
7714 	tcp->tcp_swnd = 0;
7715 	DONTCARE(tcp->tcp_cwnd);		/* Init in tcp_mss_set */
7716 
7717 	ASSERT(tcp->tcp_ibsegs == 0);
7718 	ASSERT(tcp->tcp_obsegs == 0);
7719 
7720 	if (tcp->tcp_iphc != NULL) {
7721 		ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH);
7722 		bzero(tcp->tcp_iphc, tcp->tcp_iphc_len);
7723 	}
7724 
7725 	DONTCARE(tcp->tcp_naglim);		/* Init in tcp_init_values */
7726 	DONTCARE(tcp->tcp_hdr_len);		/* Init in tcp_init_values */
7727 	DONTCARE(tcp->tcp_ipha);
7728 	DONTCARE(tcp->tcp_ip6h);
7729 	DONTCARE(tcp->tcp_ip_hdr_len);
7730 	DONTCARE(tcp->tcp_tcph);
7731 	DONTCARE(tcp->tcp_tcp_hdr_len);		/* Init in tcp_init_values */
7732 	tcp->tcp_valid_bits = 0;
7733 
7734 	DONTCARE(tcp->tcp_xmit_hiwater);	/* Init in tcp_init_values */
7735 	DONTCARE(tcp->tcp_timer_backoff);	/* Init in tcp_init_values */
7736 	DONTCARE(tcp->tcp_last_recv_time);	/* Init in tcp_init_values */
7737 	tcp->tcp_last_rcv_lbolt = 0;
7738 
7739 	tcp->tcp_init_cwnd = 0;
7740 
7741 	tcp->tcp_urp_last_valid = 0;
7742 	tcp->tcp_hard_binding = 0;
7743 	tcp->tcp_hard_bound = 0;
7744 	PRESERVE(tcp->tcp_cred);
7745 	PRESERVE(tcp->tcp_cpid);
7746 	PRESERVE(tcp->tcp_exclbind);
7747 
7748 	tcp->tcp_fin_acked = 0;
7749 	tcp->tcp_fin_rcvd = 0;
7750 	tcp->tcp_fin_sent = 0;
7751 	tcp->tcp_ordrel_done = 0;
7752 
7753 	tcp->tcp_debug = 0;
7754 	tcp->tcp_dontroute = 0;
7755 	tcp->tcp_broadcast = 0;
7756 
7757 	tcp->tcp_useloopback = 0;
7758 	tcp->tcp_reuseaddr = 0;
7759 	tcp->tcp_oobinline = 0;
7760 	tcp->tcp_dgram_errind = 0;
7761 
7762 	tcp->tcp_detached = 0;
7763 	tcp->tcp_bind_pending = 0;
7764 	tcp->tcp_unbind_pending = 0;
7765 	tcp->tcp_deferred_clean_death = 0;
7766 
7767 	tcp->tcp_snd_ws_ok = B_FALSE;
7768 	tcp->tcp_snd_ts_ok = B_FALSE;
7769 	tcp->tcp_linger = 0;
7770 	tcp->tcp_ka_enabled = 0;
7771 	tcp->tcp_zero_win_probe = 0;
7772 
7773 	tcp->tcp_loopback = 0;
7774 	tcp->tcp_localnet = 0;
7775 	tcp->tcp_syn_defense = 0;
7776 	tcp->tcp_set_timer = 0;
7777 
7778 	tcp->tcp_active_open = 0;
7779 	ASSERT(tcp->tcp_timeout == B_FALSE);
7780 	tcp->tcp_rexmit = B_FALSE;
7781 	tcp->tcp_xmit_zc_clean = B_FALSE;
7782 
7783 	tcp->tcp_snd_sack_ok = B_FALSE;
7784 	PRESERVE(tcp->tcp_recvdstaddr);
7785 	tcp->tcp_hwcksum = B_FALSE;
7786 
7787 	tcp->tcp_ire_ill_check_done = B_FALSE;
7788 	DONTCARE(tcp->tcp_maxpsz);		/* Init in tcp_init_values */
7789 
7790 	tcp->tcp_mdt = B_FALSE;
7791 	tcp->tcp_mdt_hdr_head = 0;
7792 	tcp->tcp_mdt_hdr_tail = 0;
7793 
7794 	tcp->tcp_conn_def_q0 = 0;
7795 	tcp->tcp_ip_forward_progress = B_FALSE;
7796 	tcp->tcp_anon_priv_bind = 0;
7797 	tcp->tcp_ecn_ok = B_FALSE;
7798 
7799 	tcp->tcp_cwr = B_FALSE;
7800 	tcp->tcp_ecn_echo_on = B_FALSE;
7801 
7802 	if (tcp->tcp_sack_info != NULL) {
7803 		if (tcp->tcp_notsack_list != NULL) {
7804 			TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list);
7805 		}
7806 		kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info);
7807 		tcp->tcp_sack_info = NULL;
7808 	}
7809 
7810 	tcp->tcp_rcv_ws = 0;
7811 	tcp->tcp_snd_ws = 0;
7812 	tcp->tcp_ts_recent = 0;
7813 	tcp->tcp_rnxt = 0;			/* Displayed in mib */
7814 	DONTCARE(tcp->tcp_rwnd);		/* Set in tcp_reinit() */
7815 	tcp->tcp_if_mtu = 0;
7816 
7817 	ASSERT(tcp->tcp_reass_head == NULL);
7818 	ASSERT(tcp->tcp_reass_tail == NULL);
7819 
7820 	tcp->tcp_cwnd_cnt = 0;
7821 
7822 	ASSERT(tcp->tcp_rcv_list == NULL);
7823 	ASSERT(tcp->tcp_rcv_last_head == NULL);
7824 	ASSERT(tcp->tcp_rcv_last_tail == NULL);
7825 	ASSERT(tcp->tcp_rcv_cnt == 0);
7826 
7827 	DONTCARE(tcp->tcp_cwnd_ssthresh);	/* Init in tcp_adapt_ire */
7828 	DONTCARE(tcp->tcp_cwnd_max);		/* Init in tcp_init_values */
7829 	tcp->tcp_csuna = 0;
7830 
7831 	tcp->tcp_rto = 0;			/* Displayed in MIB */
7832 	DONTCARE(tcp->tcp_rtt_sa);		/* Init in tcp_init_values */
7833 	DONTCARE(tcp->tcp_rtt_sd);		/* Init in tcp_init_values */
7834 	tcp->tcp_rtt_update = 0;
7835 
7836 	DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
7837 	DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
7838 
7839 	tcp->tcp_rack = 0;			/* Displayed in mib */
7840 	tcp->tcp_rack_cnt = 0;
7841 	tcp->tcp_rack_cur_max = 0;
7842 	tcp->tcp_rack_abs_max = 0;
7843 
7844 	tcp->tcp_max_swnd = 0;
7845 
7846 	ASSERT(tcp->tcp_listener == NULL);
7847 
7848 	DONTCARE(tcp->tcp_xmit_lowater);	/* Init in tcp_init_values */
7849 
7850 	DONTCARE(tcp->tcp_irs);			/* tcp_valid_bits cleared */
7851 	DONTCARE(tcp->tcp_iss);			/* tcp_valid_bits cleared */
7852 	DONTCARE(tcp->tcp_fss);			/* tcp_valid_bits cleared */
7853 	DONTCARE(tcp->tcp_urg);			/* tcp_valid_bits cleared */
7854 
7855 	ASSERT(tcp->tcp_conn_req_cnt_q == 0);
7856 	ASSERT(tcp->tcp_conn_req_cnt_q0 == 0);
7857 	PRESERVE(tcp->tcp_conn_req_max);
7858 	PRESERVE(tcp->tcp_conn_req_seqnum);
7859 
7860 	DONTCARE(tcp->tcp_ip_hdr_len);		/* Init in tcp_init_values */
7861 	DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */
7862 	DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */
7863 	DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */
7864 	DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */
7865 
7866 	tcp->tcp_lingertime = 0;
7867 
7868 	DONTCARE(tcp->tcp_urp_last);	/* tcp_urp_last_valid is cleared */
7869 	ASSERT(tcp->tcp_urp_mp == NULL);
7870 	ASSERT(tcp->tcp_urp_mark_mp == NULL);
7871 	ASSERT(tcp->tcp_fused_sigurg_mp == NULL);
7872 
7873 	ASSERT(tcp->tcp_eager_next_q == NULL);
7874 	ASSERT(tcp->tcp_eager_last_q == NULL);
7875 	ASSERT((tcp->tcp_eager_next_q0 == NULL &&
7876 	    tcp->tcp_eager_prev_q0 == NULL) ||
7877 	    tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0);
7878 	ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL);
7879 
7880 	tcp->tcp_client_errno = 0;
7881 
7882 	DONTCARE(tcp->tcp_sum);			/* Init in tcp_init_values */
7883 
7884 	tcp->tcp_remote_v6 = ipv6_all_zeros;	/* Displayed in MIB */
7885 
7886 	PRESERVE(tcp->tcp_bound_source_v6);
7887 	tcp->tcp_last_sent_len = 0;
7888 	tcp->tcp_dupack_cnt = 0;
7889 
7890 	tcp->tcp_fport = 0;			/* Displayed in MIB */
7891 	PRESERVE(tcp->tcp_lport);
7892 
7893 	PRESERVE(tcp->tcp_acceptor_lockp);
7894 
7895 	ASSERT(tcp->tcp_ordrelid == 0);
7896 	PRESERVE(tcp->tcp_acceptor_id);
7897 	DONTCARE(tcp->tcp_ipsec_overhead);
7898 
7899 	/*
7900 	 * If tcp_tracing flag is ON (i.e. We have a trace buffer
7901 	 * in tcp structure and now tracing), Re-initialize all
7902 	 * members of tcp_traceinfo.
7903 	 */
7904 	if (tcp->tcp_tracebuf != NULL) {
7905 		bzero(tcp->tcp_tracebuf, sizeof (tcptrch_t));
7906 	}
7907 
7908 	PRESERVE(tcp->tcp_family);
7909 	if (tcp->tcp_family == AF_INET6) {
7910 		tcp->tcp_ipversion = IPV6_VERSION;
7911 		tcp->tcp_mss = tcp_mss_def_ipv6;
7912 	} else {
7913 		tcp->tcp_ipversion = IPV4_VERSION;
7914 		tcp->tcp_mss = tcp_mss_def_ipv4;
7915 	}
7916 
7917 	tcp->tcp_bound_if = 0;
7918 	tcp->tcp_ipv6_recvancillary = 0;
7919 	tcp->tcp_recvifindex = 0;
7920 	tcp->tcp_recvhops = 0;
7921 	tcp->tcp_closed = 0;
7922 	tcp->tcp_cleandeathtag = 0;
7923 	if (tcp->tcp_hopopts != NULL) {
7924 		mi_free(tcp->tcp_hopopts);
7925 		tcp->tcp_hopopts = NULL;
7926 		tcp->tcp_hopoptslen = 0;
7927 	}
7928 	ASSERT(tcp->tcp_hopoptslen == 0);
7929 	if (tcp->tcp_dstopts != NULL) {
7930 		mi_free(tcp->tcp_dstopts);
7931 		tcp->tcp_dstopts = NULL;
7932 		tcp->tcp_dstoptslen = 0;
7933 	}
7934 	ASSERT(tcp->tcp_dstoptslen == 0);
7935 	if (tcp->tcp_rtdstopts != NULL) {
7936 		mi_free(tcp->tcp_rtdstopts);
7937 		tcp->tcp_rtdstopts = NULL;
7938 		tcp->tcp_rtdstoptslen = 0;
7939 	}
7940 	ASSERT(tcp->tcp_rtdstoptslen == 0);
7941 	if (tcp->tcp_rthdr != NULL) {
7942 		mi_free(tcp->tcp_rthdr);
7943 		tcp->tcp_rthdr = NULL;
7944 		tcp->tcp_rthdrlen = 0;
7945 	}
7946 	ASSERT(tcp->tcp_rthdrlen == 0);
7947 	PRESERVE(tcp->tcp_drop_opt_ack_cnt);
7948 
7949 	/* Reset fusion-related fields */
7950 	tcp->tcp_fused = B_FALSE;
7951 	tcp->tcp_unfusable = B_FALSE;
7952 	tcp->tcp_fused_sigurg = B_FALSE;
7953 	tcp->tcp_direct_sockfs = B_FALSE;
7954 	tcp->tcp_fuse_syncstr_stopped = B_FALSE;
7955 	tcp->tcp_fuse_syncstr_plugged = B_FALSE;
7956 	tcp->tcp_loopback_peer = NULL;
7957 	tcp->tcp_fuse_rcv_hiwater = 0;
7958 	tcp->tcp_fuse_rcv_unread_hiwater = 0;
7959 	tcp->tcp_fuse_rcv_unread_cnt = 0;
7960 
7961 	tcp->tcp_in_ack_unsent = 0;
7962 	tcp->tcp_cork = B_FALSE;
7963 
7964 	PRESERVE(tcp->tcp_squeue_bytes);
7965 
7966 	ASSERT(tcp->tcp_kssl_ctx == NULL);
7967 	ASSERT(!tcp->tcp_kssl_pending);
7968 	PRESERVE(tcp->tcp_kssl_ent);
7969 
7970 #undef	DONTCARE
7971 #undef	PRESERVE
7972 }
7973 
7974 /*
7975  * Allocate necessary resources and initialize state vector.
7976  * Guaranteed not to fail so that when an error is returned,
7977  * the caller doesn't need to do any additional cleanup.
7978  */
7979 int
7980 tcp_init(tcp_t *tcp, queue_t *q)
7981 {
7982 	int	err;
7983 
7984 	tcp->tcp_rq = q;
7985 	tcp->tcp_wq = WR(q);
7986 	tcp->tcp_state = TCPS_IDLE;
7987 	if ((err = tcp_init_values(tcp)) != 0)
7988 		tcp_timers_stop(tcp);
7989 	return (err);
7990 }
7991 
7992 static int
7993 tcp_init_values(tcp_t *tcp)
7994 {
7995 	int	err;
7996 
7997 	ASSERT((tcp->tcp_family == AF_INET &&
7998 	    tcp->tcp_ipversion == IPV4_VERSION) ||
7999 	    (tcp->tcp_family == AF_INET6 &&
8000 	    (tcp->tcp_ipversion == IPV4_VERSION ||
8001 	    tcp->tcp_ipversion == IPV6_VERSION)));
8002 
8003 	/*
8004 	 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO
8005 	 * will be close to tcp_rexmit_interval_initial.  By doing this, we
8006 	 * allow the algorithm to adjust slowly to large fluctuations of RTT
8007 	 * during first few transmissions of a connection as seen in slow
8008 	 * links.
8009 	 */
8010 	tcp->tcp_rtt_sa = tcp_rexmit_interval_initial << 2;
8011 	tcp->tcp_rtt_sd = tcp_rexmit_interval_initial >> 1;
8012 	tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
8013 	    tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) +
8014 	    tcp_conn_grace_period;
8015 	if (tcp->tcp_rto < tcp_rexmit_interval_min)
8016 		tcp->tcp_rto = tcp_rexmit_interval_min;
8017 	tcp->tcp_timer_backoff = 0;
8018 	tcp->tcp_ms_we_have_waited = 0;
8019 	tcp->tcp_last_recv_time = lbolt;
8020 	tcp->tcp_cwnd_max = tcp_cwnd_max_;
8021 	tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
8022 	tcp->tcp_snd_burst = TCP_CWND_INFINITE;
8023 
8024 	tcp->tcp_maxpsz = tcp_maxpsz_multiplier;
8025 
8026 	tcp->tcp_first_timer_threshold = tcp_ip_notify_interval;
8027 	tcp->tcp_first_ctimer_threshold = tcp_ip_notify_cinterval;
8028 	tcp->tcp_second_timer_threshold = tcp_ip_abort_interval;
8029 	/*
8030 	 * Fix it to tcp_ip_abort_linterval later if it turns out to be a
8031 	 * passive open.
8032 	 */
8033 	tcp->tcp_second_ctimer_threshold = tcp_ip_abort_cinterval;
8034 
8035 	tcp->tcp_naglim = tcp_naglim_def;
8036 
8037 	/* NOTE:  ISS is now set in tcp_adapt_ire(). */
8038 
8039 	tcp->tcp_mdt_hdr_head = 0;
8040 	tcp->tcp_mdt_hdr_tail = 0;
8041 
8042 	/* Reset fusion-related fields */
8043 	tcp->tcp_fused = B_FALSE;
8044 	tcp->tcp_unfusable = B_FALSE;
8045 	tcp->tcp_fused_sigurg = B_FALSE;
8046 	tcp->tcp_direct_sockfs = B_FALSE;
8047 	tcp->tcp_fuse_syncstr_stopped = B_FALSE;
8048 	tcp->tcp_fuse_syncstr_plugged = B_FALSE;
8049 	tcp->tcp_loopback_peer = NULL;
8050 	tcp->tcp_fuse_rcv_hiwater = 0;
8051 	tcp->tcp_fuse_rcv_unread_hiwater = 0;
8052 	tcp->tcp_fuse_rcv_unread_cnt = 0;
8053 
8054 	/* Initialize the header template */
8055 	if (tcp->tcp_ipversion == IPV4_VERSION) {
8056 		err = tcp_header_init_ipv4(tcp);
8057 	} else {
8058 		err = tcp_header_init_ipv6(tcp);
8059 	}
8060 	if (err)
8061 		return (err);
8062 
8063 	/*
8064 	 * Init the window scale to the max so tcp_rwnd_set() won't pare
8065 	 * down tcp_rwnd. tcp_adapt_ire() will set the right value later.
8066 	 */
8067 	tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT;
8068 	tcp->tcp_xmit_lowater = tcp_xmit_lowat;
8069 	tcp->tcp_xmit_hiwater = tcp_xmit_hiwat;
8070 
8071 	tcp->tcp_cork = B_FALSE;
8072 	/*
8073 	 * Init the tcp_debug option.  This value determines whether TCP
8074 	 * calls strlog() to print out debug messages.  Doing this
8075 	 * initialization here means that this value is not inherited thru
8076 	 * tcp_reinit().
8077 	 */
8078 	tcp->tcp_debug = tcp_dbg;
8079 
8080 	tcp->tcp_ka_interval = tcp_keepalive_interval;
8081 	tcp->tcp_ka_abort_thres = tcp_keepalive_abort_interval;
8082 
8083 	return (0);
8084 }
8085 
8086 /*
8087  * Initialize the IPv4 header. Loses any record of any IP options.
8088  */
8089 static int
8090 tcp_header_init_ipv4(tcp_t *tcp)
8091 {
8092 	tcph_t		*tcph;
8093 	uint32_t	sum;
8094 	conn_t		*connp;
8095 
8096 	/*
8097 	 * This is a simple initialization. If there's
8098 	 * already a template, it should never be too small,
8099 	 * so reuse it.  Otherwise, allocate space for the new one.
8100 	 */
8101 	if (tcp->tcp_iphc == NULL) {
8102 		ASSERT(tcp->tcp_iphc_len == 0);
8103 		tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH;
8104 		tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP);
8105 		if (tcp->tcp_iphc == NULL) {
8106 			tcp->tcp_iphc_len = 0;
8107 			return (ENOMEM);
8108 		}
8109 	}
8110 
8111 	/* options are gone; may need a new label */
8112 	connp = tcp->tcp_connp;
8113 	connp->conn_mlp_type = mlptSingle;
8114 	connp->conn_ulp_labeled = !is_system_labeled();
8115 	ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH);
8116 	tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc;
8117 	tcp->tcp_ip6h = NULL;
8118 	tcp->tcp_ipversion = IPV4_VERSION;
8119 	tcp->tcp_hdr_len = sizeof (ipha_t) + sizeof (tcph_t);
8120 	tcp->tcp_tcp_hdr_len = sizeof (tcph_t);
8121 	tcp->tcp_ip_hdr_len = sizeof (ipha_t);
8122 	tcp->tcp_ipha->ipha_length = htons(sizeof (ipha_t) + sizeof (tcph_t));
8123 	tcp->tcp_ipha->ipha_version_and_hdr_length
8124 		= (IP_VERSION << 4) | IP_SIMPLE_HDR_LENGTH_IN_WORDS;
8125 	tcp->tcp_ipha->ipha_ident = 0;
8126 
8127 	tcp->tcp_ttl = (uchar_t)tcp_ipv4_ttl;
8128 	tcp->tcp_tos = 0;
8129 	tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0;
8130 	tcp->tcp_ipha->ipha_ttl = (uchar_t)tcp_ipv4_ttl;
8131 	tcp->tcp_ipha->ipha_protocol = IPPROTO_TCP;
8132 
8133 	tcph = (tcph_t *)(tcp->tcp_iphc + sizeof (ipha_t));
8134 	tcp->tcp_tcph = tcph;
8135 	tcph->th_offset_and_rsrvd[0] = (5 << 4);
8136 	/*
8137 	 * IP wants our header length in the checksum field to
8138 	 * allow it to perform a single pseudo-header+checksum
8139 	 * calculation on behalf of TCP.
8140 	 * Include the adjustment for a source route once IP_OPTIONS is set.
8141 	 */
8142 	sum = sizeof (tcph_t) + tcp->tcp_sum;
8143 	sum = (sum >> 16) + (sum & 0xFFFF);
8144 	U16_TO_ABE16(sum, tcph->th_sum);
8145 	return (0);
8146 }
8147 
8148 /*
8149  * Initialize the IPv6 header. Loses any record of any IPv6 extension headers.
8150  */
8151 static int
8152 tcp_header_init_ipv6(tcp_t *tcp)
8153 {
8154 	tcph_t	*tcph;
8155 	uint32_t	sum;
8156 	conn_t	*connp;
8157 
8158 	/*
8159 	 * This is a simple initialization. If there's
8160 	 * already a template, it should never be too small,
8161 	 * so reuse it. Otherwise, allocate space for the new one.
8162 	 * Ensure that there is enough space to "downgrade" the tcp_t
8163 	 * to an IPv4 tcp_t. This requires having space for a full load
8164 	 * of IPv4 options, as well as a full load of TCP options
8165 	 * (TCP_MAX_COMBINED_HEADER_LENGTH, 120 bytes); this is more space
8166 	 * than a v6 header and a TCP header with a full load of TCP options
8167 	 * (IPV6_HDR_LEN is 40 bytes; TCP_MAX_HDR_LENGTH is 60 bytes).
8168 	 * We want to avoid reallocation in the "downgraded" case when
8169 	 * processing outbound IPv4 options.
8170 	 */
8171 	if (tcp->tcp_iphc == NULL) {
8172 		ASSERT(tcp->tcp_iphc_len == 0);
8173 		tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH;
8174 		tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP);
8175 		if (tcp->tcp_iphc == NULL) {
8176 			tcp->tcp_iphc_len = 0;
8177 			return (ENOMEM);
8178 		}
8179 	}
8180 
8181 	/* options are gone; may need a new label */
8182 	connp = tcp->tcp_connp;
8183 	connp->conn_mlp_type = mlptSingle;
8184 	connp->conn_ulp_labeled = !is_system_labeled();
8185 
8186 	ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH);
8187 	tcp->tcp_ipversion = IPV6_VERSION;
8188 	tcp->tcp_hdr_len = IPV6_HDR_LEN + sizeof (tcph_t);
8189 	tcp->tcp_tcp_hdr_len = sizeof (tcph_t);
8190 	tcp->tcp_ip_hdr_len = IPV6_HDR_LEN;
8191 	tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc;
8192 	tcp->tcp_ipha = NULL;
8193 
8194 	/* Initialize the header template */
8195 
8196 	tcp->tcp_ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW;
8197 	tcp->tcp_ip6h->ip6_plen = ntohs(sizeof (tcph_t));
8198 	tcp->tcp_ip6h->ip6_nxt = IPPROTO_TCP;
8199 	tcp->tcp_ip6h->ip6_hops = (uint8_t)tcp_ipv6_hoplimit;
8200 
8201 	tcph = (tcph_t *)(tcp->tcp_iphc + IPV6_HDR_LEN);
8202 	tcp->tcp_tcph = tcph;
8203 	tcph->th_offset_and_rsrvd[0] = (5 << 4);
8204 	/*
8205 	 * IP wants our header length in the checksum field to
8206 	 * allow it to perform a single psuedo-header+checksum
8207 	 * calculation on behalf of TCP.
8208 	 * Include the adjustment for a source route when IPV6_RTHDR is set.
8209 	 */
8210 	sum = sizeof (tcph_t) + tcp->tcp_sum;
8211 	sum = (sum >> 16) + (sum & 0xFFFF);
8212 	U16_TO_ABE16(sum, tcph->th_sum);
8213 	return (0);
8214 }
8215 
8216 /* At minimum we need 4 bytes in the TCP header for the lookup */
8217 #define	ICMP_MIN_TCP_HDR	12
8218 
8219 /*
8220  * tcp_icmp_error is called by tcp_rput_other to process ICMP error messages
8221  * passed up by IP. The message is always received on the correct tcp_t.
8222  * Assumes that IP has pulled up everything up to and including the ICMP header.
8223  */
8224 void
8225 tcp_icmp_error(tcp_t *tcp, mblk_t *mp)
8226 {
8227 	icmph_t *icmph;
8228 	ipha_t	*ipha;
8229 	int	iph_hdr_length;
8230 	tcph_t	*tcph;
8231 	boolean_t ipsec_mctl = B_FALSE;
8232 	boolean_t secure;
8233 	mblk_t *first_mp = mp;
8234 	uint32_t new_mss;
8235 	uint32_t ratio;
8236 	size_t mp_size = MBLKL(mp);
8237 	uint32_t seg_ack;
8238 	uint32_t seg_seq;
8239 
8240 	/* Assume IP provides aligned packets - otherwise toss */
8241 	if (!OK_32PTR(mp->b_rptr)) {
8242 		freemsg(mp);
8243 		return;
8244 	}
8245 
8246 	/*
8247 	 * Since ICMP errors are normal data marked with M_CTL when sent
8248 	 * to TCP or UDP, we have to look for a IPSEC_IN value to identify
8249 	 * packets starting with an ipsec_info_t, see ipsec_info.h.
8250 	 */
8251 	if ((mp_size == sizeof (ipsec_info_t)) &&
8252 	    (((ipsec_info_t *)mp->b_rptr)->ipsec_info_type == IPSEC_IN)) {
8253 		ASSERT(mp->b_cont != NULL);
8254 		mp = mp->b_cont;
8255 		/* IP should have done this */
8256 		ASSERT(OK_32PTR(mp->b_rptr));
8257 		mp_size = MBLKL(mp);
8258 		ipsec_mctl = B_TRUE;
8259 	}
8260 
8261 	/*
8262 	 * Verify that we have a complete outer IP header. If not, drop it.
8263 	 */
8264 	if (mp_size < sizeof (ipha_t)) {
8265 noticmpv4:
8266 		freemsg(first_mp);
8267 		return;
8268 	}
8269 
8270 	ipha = (ipha_t *)mp->b_rptr;
8271 	/*
8272 	 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
8273 	 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
8274 	 */
8275 	switch (IPH_HDR_VERSION(ipha)) {
8276 	case IPV6_VERSION:
8277 		tcp_icmp_error_ipv6(tcp, first_mp, ipsec_mctl);
8278 		return;
8279 	case IPV4_VERSION:
8280 		break;
8281 	default:
8282 		goto noticmpv4;
8283 	}
8284 
8285 	/* Skip past the outer IP and ICMP headers */
8286 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
8287 	icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
8288 	/*
8289 	 * If we don't have the correct outer IP header length or if the ULP
8290 	 * is not IPPROTO_ICMP or if we don't have a complete inner IP header
8291 	 * send it upstream.
8292 	 */
8293 	if (iph_hdr_length < sizeof (ipha_t) ||
8294 	    ipha->ipha_protocol != IPPROTO_ICMP ||
8295 	    (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
8296 		goto noticmpv4;
8297 	}
8298 	ipha = (ipha_t *)&icmph[1];
8299 
8300 	/* Skip past the inner IP and find the ULP header */
8301 	iph_hdr_length = IPH_HDR_LENGTH(ipha);
8302 	tcph = (tcph_t *)((char *)ipha + iph_hdr_length);
8303 	/*
8304 	 * If we don't have the correct inner IP header length or if the ULP
8305 	 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
8306 	 * bytes of TCP header, drop it.
8307 	 */
8308 	if (iph_hdr_length < sizeof (ipha_t) ||
8309 	    ipha->ipha_protocol != IPPROTO_TCP ||
8310 	    (uchar_t *)tcph + ICMP_MIN_TCP_HDR > mp->b_wptr) {
8311 		goto noticmpv4;
8312 	}
8313 
8314 	if (TCP_IS_DETACHED_NONEAGER(tcp)) {
8315 		if (ipsec_mctl) {
8316 			secure = ipsec_in_is_secure(first_mp);
8317 		} else {
8318 			secure = B_FALSE;
8319 		}
8320 		if (secure) {
8321 			/*
8322 			 * If we are willing to accept this in clear
8323 			 * we don't have to verify policy.
8324 			 */
8325 			if (!ipsec_inbound_accept_clear(mp, ipha, NULL)) {
8326 				if (!tcp_check_policy(tcp, first_mp,
8327 				    ipha, NULL, secure, ipsec_mctl)) {
8328 					/*
8329 					 * tcp_check_policy called
8330 					 * ip_drop_packet() on failure.
8331 					 */
8332 					return;
8333 				}
8334 			}
8335 		}
8336 	} else if (ipsec_mctl) {
8337 		/*
8338 		 * This is a hard_bound connection. IP has already
8339 		 * verified policy. We don't have to do it again.
8340 		 */
8341 		freeb(first_mp);
8342 		first_mp = mp;
8343 		ipsec_mctl = B_FALSE;
8344 	}
8345 
8346 	seg_ack = ABE32_TO_U32(tcph->th_ack);
8347 	seg_seq = ABE32_TO_U32(tcph->th_seq);
8348 	/*
8349 	 * TCP SHOULD check that the TCP sequence number contained in
8350 	 * payload of the ICMP error message is within the range
8351 	 * SND.UNA <= SEG.SEQ < SND.NXT. and also SEG.ACK <= RECV.NXT
8352 	 */
8353 	if (SEQ_LT(seg_seq, tcp->tcp_suna) ||
8354 		SEQ_GEQ(seg_seq, tcp->tcp_snxt) ||
8355 		SEQ_GT(seg_ack, tcp->tcp_rnxt)) {
8356 		/*
8357 		 * If the ICMP message is bogus, should we kill the
8358 		 * connection, or should we just drop the bogus ICMP
8359 		 * message? It would probably make more sense to just
8360 		 * drop the message so that if this one managed to get
8361 		 * in, the real connection should not suffer.
8362 		 */
8363 		goto noticmpv4;
8364 	}
8365 
8366 	switch (icmph->icmph_type) {
8367 	case ICMP_DEST_UNREACHABLE:
8368 		switch (icmph->icmph_code) {
8369 		case ICMP_FRAGMENTATION_NEEDED:
8370 			/*
8371 			 * Reduce the MSS based on the new MTU.  This will
8372 			 * eliminate any fragmentation locally.
8373 			 * N.B.  There may well be some funny side-effects on
8374 			 * the local send policy and the remote receive policy.
8375 			 * Pending further research, we provide
8376 			 * tcp_ignore_path_mtu just in case this proves
8377 			 * disastrous somewhere.
8378 			 *
8379 			 * After updating the MSS, retransmit part of the
8380 			 * dropped segment using the new mss by calling
8381 			 * tcp_wput_data().  Need to adjust all those
8382 			 * params to make sure tcp_wput_data() work properly.
8383 			 */
8384 			if (tcp_ignore_path_mtu)
8385 				break;
8386 
8387 			/*
8388 			 * Decrease the MSS by time stamp options
8389 			 * IP options and IPSEC options. tcp_hdr_len
8390 			 * includes time stamp option and IP option
8391 			 * length.
8392 			 */
8393 
8394 			new_mss = ntohs(icmph->icmph_du_mtu) -
8395 			    tcp->tcp_hdr_len - tcp->tcp_ipsec_overhead;
8396 
8397 			/*
8398 			 * Only update the MSS if the new one is
8399 			 * smaller than the previous one.  This is
8400 			 * to avoid problems when getting multiple
8401 			 * ICMP errors for the same MTU.
8402 			 */
8403 			if (new_mss >= tcp->tcp_mss)
8404 				break;
8405 
8406 			/*
8407 			 * Stop doing PMTU if new_mss is less than 68
8408 			 * or less than tcp_mss_min.
8409 			 * The value 68 comes from rfc 1191.
8410 			 */
8411 			if (new_mss < MAX(68, tcp_mss_min))
8412 				tcp->tcp_ipha->ipha_fragment_offset_and_flags =
8413 				    0;
8414 
8415 			ratio = tcp->tcp_cwnd / tcp->tcp_mss;
8416 			ASSERT(ratio >= 1);
8417 			tcp_mss_set(tcp, new_mss);
8418 
8419 			/*
8420 			 * Make sure we have something to
8421 			 * send.
8422 			 */
8423 			if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) &&
8424 			    (tcp->tcp_xmit_head != NULL)) {
8425 				/*
8426 				 * Shrink tcp_cwnd in
8427 				 * proportion to the old MSS/new MSS.
8428 				 */
8429 				tcp->tcp_cwnd = ratio * tcp->tcp_mss;
8430 				if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
8431 				    (tcp->tcp_unsent == 0)) {
8432 					tcp->tcp_rexmit_max = tcp->tcp_fss;
8433 				} else {
8434 					tcp->tcp_rexmit_max = tcp->tcp_snxt;
8435 				}
8436 				tcp->tcp_rexmit_nxt = tcp->tcp_suna;
8437 				tcp->tcp_rexmit = B_TRUE;
8438 				tcp->tcp_dupack_cnt = 0;
8439 				tcp->tcp_snd_burst = TCP_CWND_SS;
8440 				tcp_ss_rexmit(tcp);
8441 			}
8442 			break;
8443 		case ICMP_PORT_UNREACHABLE:
8444 		case ICMP_PROTOCOL_UNREACHABLE:
8445 			switch (tcp->tcp_state) {
8446 			case TCPS_SYN_SENT:
8447 			case TCPS_SYN_RCVD:
8448 				/*
8449 				 * ICMP can snipe away incipient
8450 				 * TCP connections as long as
8451 				 * seq number is same as initial
8452 				 * send seq number.
8453 				 */
8454 				if (seg_seq == tcp->tcp_iss) {
8455 					(void) tcp_clean_death(tcp,
8456 					    ECONNREFUSED, 6);
8457 				}
8458 				break;
8459 			}
8460 			break;
8461 		case ICMP_HOST_UNREACHABLE:
8462 		case ICMP_NET_UNREACHABLE:
8463 			/* Record the error in case we finally time out. */
8464 			if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
8465 				tcp->tcp_client_errno = EHOSTUNREACH;
8466 			else
8467 				tcp->tcp_client_errno = ENETUNREACH;
8468 			if (tcp->tcp_state == TCPS_SYN_RCVD) {
8469 				if (tcp->tcp_listener != NULL &&
8470 				    tcp->tcp_listener->tcp_syn_defense) {
8471 					/*
8472 					 * Ditch the half-open connection if we
8473 					 * suspect a SYN attack is under way.
8474 					 */
8475 					tcp_ip_ire_mark_advice(tcp);
8476 					(void) tcp_clean_death(tcp,
8477 					    tcp->tcp_client_errno, 7);
8478 				}
8479 			}
8480 			break;
8481 		default:
8482 			break;
8483 		}
8484 		break;
8485 	case ICMP_SOURCE_QUENCH: {
8486 		/*
8487 		 * use a global boolean to control
8488 		 * whether TCP should respond to ICMP_SOURCE_QUENCH.
8489 		 * The default is false.
8490 		 */
8491 		if (tcp_icmp_source_quench) {
8492 			/*
8493 			 * Reduce the sending rate as if we got a
8494 			 * retransmit timeout
8495 			 */
8496 			uint32_t npkt;
8497 
8498 			npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
8499 			    tcp->tcp_mss;
8500 			tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
8501 			tcp->tcp_cwnd = tcp->tcp_mss;
8502 			tcp->tcp_cwnd_cnt = 0;
8503 		}
8504 		break;
8505 	}
8506 	}
8507 	freemsg(first_mp);
8508 }
8509 
8510 /*
8511  * tcp_icmp_error_ipv6 is called by tcp_rput_other to process ICMPv6
8512  * error messages passed up by IP.
8513  * Assumes that IP has pulled up all the extension headers as well
8514  * as the ICMPv6 header.
8515  */
8516 static void
8517 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, boolean_t ipsec_mctl)
8518 {
8519 	icmp6_t *icmp6;
8520 	ip6_t	*ip6h;
8521 	uint16_t	iph_hdr_length;
8522 	tcpha_t	*tcpha;
8523 	uint8_t	*nexthdrp;
8524 	uint32_t new_mss;
8525 	uint32_t ratio;
8526 	boolean_t secure;
8527 	mblk_t *first_mp = mp;
8528 	size_t mp_size;
8529 	uint32_t seg_ack;
8530 	uint32_t seg_seq;
8531 
8532 	/*
8533 	 * The caller has determined if this is an IPSEC_IN packet and
8534 	 * set ipsec_mctl appropriately (see tcp_icmp_error).
8535 	 */
8536 	if (ipsec_mctl)
8537 		mp = mp->b_cont;
8538 
8539 	mp_size = MBLKL(mp);
8540 
8541 	/*
8542 	 * Verify that we have a complete IP header. If not, send it upstream.
8543 	 */
8544 	if (mp_size < sizeof (ip6_t)) {
8545 noticmpv6:
8546 		freemsg(first_mp);
8547 		return;
8548 	}
8549 
8550 	/*
8551 	 * Verify this is an ICMPV6 packet, else send it upstream.
8552 	 */
8553 	ip6h = (ip6_t *)mp->b_rptr;
8554 	if (ip6h->ip6_nxt == IPPROTO_ICMPV6) {
8555 		iph_hdr_length = IPV6_HDR_LEN;
8556 	} else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length,
8557 	    &nexthdrp) ||
8558 	    *nexthdrp != IPPROTO_ICMPV6) {
8559 		goto noticmpv6;
8560 	}
8561 	icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
8562 	ip6h = (ip6_t *)&icmp6[1];
8563 	/*
8564 	 * Verify if we have a complete ICMP and inner IP header.
8565 	 */
8566 	if ((uchar_t *)&ip6h[1] > mp->b_wptr)
8567 		goto noticmpv6;
8568 
8569 	if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
8570 		goto noticmpv6;
8571 	tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
8572 	/*
8573 	 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
8574 	 * have at least ICMP_MIN_TCP_HDR bytes of  TCP header drop the
8575 	 * packet.
8576 	 */
8577 	if ((*nexthdrp != IPPROTO_TCP) ||
8578 	    ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
8579 		goto noticmpv6;
8580 	}
8581 
8582 	/*
8583 	 * ICMP errors come on the right queue or come on
8584 	 * listener/global queue for detached connections and
8585 	 * get switched to the right queue. If it comes on the
8586 	 * right queue, policy check has already been done by IP
8587 	 * and thus free the first_mp without verifying the policy.
8588 	 * If it has come for a non-hard bound connection, we need
8589 	 * to verify policy as IP may not have done it.
8590 	 */
8591 	if (!tcp->tcp_hard_bound) {
8592 		if (ipsec_mctl) {
8593 			secure = ipsec_in_is_secure(first_mp);
8594 		} else {
8595 			secure = B_FALSE;
8596 		}
8597 		if (secure) {
8598 			/*
8599 			 * If we are willing to accept this in clear
8600 			 * we don't have to verify policy.
8601 			 */
8602 			if (!ipsec_inbound_accept_clear(mp, NULL, ip6h)) {
8603 				if (!tcp_check_policy(tcp, first_mp,
8604 				    NULL, ip6h, secure, ipsec_mctl)) {
8605 					/*
8606 					 * tcp_check_policy called
8607 					 * ip_drop_packet() on failure.
8608 					 */
8609 					return;
8610 				}
8611 			}
8612 		}
8613 	} else if (ipsec_mctl) {
8614 		/*
8615 		 * This is a hard_bound connection. IP has already
8616 		 * verified policy. We don't have to do it again.
8617 		 */
8618 		freeb(first_mp);
8619 		first_mp = mp;
8620 		ipsec_mctl = B_FALSE;
8621 	}
8622 
8623 	seg_ack = ntohl(tcpha->tha_ack);
8624 	seg_seq = ntohl(tcpha->tha_seq);
8625 	/*
8626 	 * TCP SHOULD check that the TCP sequence number contained in
8627 	 * payload of the ICMP error message is within the range
8628 	 * SND.UNA <= SEG.SEQ < SND.NXT. and also SEG.ACK <= RECV.NXT
8629 	 */
8630 	if (SEQ_LT(seg_seq, tcp->tcp_suna) || SEQ_GEQ(seg_seq, tcp->tcp_snxt) ||
8631 	    SEQ_GT(seg_ack, tcp->tcp_rnxt)) {
8632 		/*
8633 		 * If the ICMP message is bogus, should we kill the
8634 		 * connection, or should we just drop the bogus ICMP
8635 		 * message? It would probably make more sense to just
8636 		 * drop the message so that if this one managed to get
8637 		 * in, the real connection should not suffer.
8638 		 */
8639 		goto noticmpv6;
8640 	}
8641 
8642 	switch (icmp6->icmp6_type) {
8643 	case ICMP6_PACKET_TOO_BIG:
8644 		/*
8645 		 * Reduce the MSS based on the new MTU.  This will
8646 		 * eliminate any fragmentation locally.
8647 		 * N.B.  There may well be some funny side-effects on
8648 		 * the local send policy and the remote receive policy.
8649 		 * Pending further research, we provide
8650 		 * tcp_ignore_path_mtu just in case this proves
8651 		 * disastrous somewhere.
8652 		 *
8653 		 * After updating the MSS, retransmit part of the
8654 		 * dropped segment using the new mss by calling
8655 		 * tcp_wput_data().  Need to adjust all those
8656 		 * params to make sure tcp_wput_data() work properly.
8657 		 */
8658 		if (tcp_ignore_path_mtu)
8659 			break;
8660 
8661 		/*
8662 		 * Decrease the MSS by time stamp options
8663 		 * IP options and IPSEC options. tcp_hdr_len
8664 		 * includes time stamp option and IP option
8665 		 * length.
8666 		 */
8667 		new_mss = ntohs(icmp6->icmp6_mtu) - tcp->tcp_hdr_len -
8668 			    tcp->tcp_ipsec_overhead;
8669 
8670 		/*
8671 		 * Only update the MSS if the new one is
8672 		 * smaller than the previous one.  This is
8673 		 * to avoid problems when getting multiple
8674 		 * ICMP errors for the same MTU.
8675 		 */
8676 		if (new_mss >= tcp->tcp_mss)
8677 			break;
8678 
8679 		ratio = tcp->tcp_cwnd / tcp->tcp_mss;
8680 		ASSERT(ratio >= 1);
8681 		tcp_mss_set(tcp, new_mss);
8682 
8683 		/*
8684 		 * Make sure we have something to
8685 		 * send.
8686 		 */
8687 		if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) &&
8688 		    (tcp->tcp_xmit_head != NULL)) {
8689 			/*
8690 			 * Shrink tcp_cwnd in
8691 			 * proportion to the old MSS/new MSS.
8692 			 */
8693 			tcp->tcp_cwnd = ratio * tcp->tcp_mss;
8694 			if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
8695 			    (tcp->tcp_unsent == 0)) {
8696 				tcp->tcp_rexmit_max = tcp->tcp_fss;
8697 			} else {
8698 				tcp->tcp_rexmit_max = tcp->tcp_snxt;
8699 			}
8700 			tcp->tcp_rexmit_nxt = tcp->tcp_suna;
8701 			tcp->tcp_rexmit = B_TRUE;
8702 			tcp->tcp_dupack_cnt = 0;
8703 			tcp->tcp_snd_burst = TCP_CWND_SS;
8704 			tcp_ss_rexmit(tcp);
8705 		}
8706 		break;
8707 
8708 	case ICMP6_DST_UNREACH:
8709 		switch (icmp6->icmp6_code) {
8710 		case ICMP6_DST_UNREACH_NOPORT:
8711 			if (((tcp->tcp_state == TCPS_SYN_SENT) ||
8712 			    (tcp->tcp_state == TCPS_SYN_RCVD)) &&
8713 			    (seg_seq == tcp->tcp_iss)) {
8714 				(void) tcp_clean_death(tcp,
8715 				    ECONNREFUSED, 8);
8716 			}
8717 			break;
8718 
8719 		case ICMP6_DST_UNREACH_ADMIN:
8720 		case ICMP6_DST_UNREACH_NOROUTE:
8721 		case ICMP6_DST_UNREACH_BEYONDSCOPE:
8722 		case ICMP6_DST_UNREACH_ADDR:
8723 			/* Record the error in case we finally time out. */
8724 			tcp->tcp_client_errno = EHOSTUNREACH;
8725 			if (((tcp->tcp_state == TCPS_SYN_SENT) ||
8726 			    (tcp->tcp_state == TCPS_SYN_RCVD)) &&
8727 			    (seg_seq == tcp->tcp_iss)) {
8728 				if (tcp->tcp_listener != NULL &&
8729 				    tcp->tcp_listener->tcp_syn_defense) {
8730 					/*
8731 					 * Ditch the half-open connection if we
8732 					 * suspect a SYN attack is under way.
8733 					 */
8734 					tcp_ip_ire_mark_advice(tcp);
8735 					(void) tcp_clean_death(tcp,
8736 					    tcp->tcp_client_errno, 9);
8737 				}
8738 			}
8739 
8740 
8741 			break;
8742 		default:
8743 			break;
8744 		}
8745 		break;
8746 
8747 	case ICMP6_PARAM_PROB:
8748 		/* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
8749 		if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
8750 		    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
8751 		    (uchar_t *)nexthdrp) {
8752 			if (tcp->tcp_state == TCPS_SYN_SENT ||
8753 			    tcp->tcp_state == TCPS_SYN_RCVD) {
8754 				(void) tcp_clean_death(tcp,
8755 				    ECONNREFUSED, 10);
8756 			}
8757 			break;
8758 		}
8759 		break;
8760 
8761 	case ICMP6_TIME_EXCEEDED:
8762 	default:
8763 		break;
8764 	}
8765 	freemsg(first_mp);
8766 }
8767 
8768 /*
8769  * IP recognizes seven kinds of bind requests:
8770  *
8771  * - A zero-length address binds only to the protocol number.
8772  *
8773  * - A 4-byte address is treated as a request to
8774  * validate that the address is a valid local IPv4
8775  * address, appropriate for an application to bind to.
8776  * IP does the verification, but does not make any note
8777  * of the address at this time.
8778  *
8779  * - A 16-byte address contains is treated as a request
8780  * to validate a local IPv6 address, as the 4-byte
8781  * address case above.
8782  *
8783  * - A 16-byte sockaddr_in to validate the local IPv4 address and also
8784  * use it for the inbound fanout of packets.
8785  *
8786  * - A 24-byte sockaddr_in6 to validate the local IPv6 address and also
8787  * use it for the inbound fanout of packets.
8788  *
8789  * - A 12-byte address (ipa_conn_t) containing complete IPv4 fanout
8790  * information consisting of local and remote addresses
8791  * and ports.  In this case, the addresses are both
8792  * validated as appropriate for this operation, and, if
8793  * so, the information is retained for use in the
8794  * inbound fanout.
8795  *
8796  * - A 36-byte address address (ipa6_conn_t) containing complete IPv6
8797  * fanout information, like the 12-byte case above.
8798  *
8799  * IP will also fill in the IRE request mblk with information
8800  * regarding our peer.  In all cases, we notify IP of our protocol
8801  * type by appending a single protocol byte to the bind request.
8802  */
8803 static mblk_t *
8804 tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, t_scalar_t addr_length)
8805 {
8806 	char	*cp;
8807 	mblk_t	*mp;
8808 	struct T_bind_req *tbr;
8809 	ipa_conn_t	*ac;
8810 	ipa6_conn_t	*ac6;
8811 	sin_t		*sin;
8812 	sin6_t		*sin6;
8813 
8814 	ASSERT(bind_prim == O_T_BIND_REQ || bind_prim == T_BIND_REQ);
8815 	ASSERT((tcp->tcp_family == AF_INET &&
8816 	    tcp->tcp_ipversion == IPV4_VERSION) ||
8817 	    (tcp->tcp_family == AF_INET6 &&
8818 	    (tcp->tcp_ipversion == IPV4_VERSION ||
8819 	    tcp->tcp_ipversion == IPV6_VERSION)));
8820 
8821 	mp = allocb(sizeof (*tbr) + addr_length + 1, BPRI_HI);
8822 	if (!mp)
8823 		return (mp);
8824 	mp->b_datap->db_type = M_PROTO;
8825 	tbr = (struct T_bind_req *)mp->b_rptr;
8826 	tbr->PRIM_type = bind_prim;
8827 	tbr->ADDR_offset = sizeof (*tbr);
8828 	tbr->CONIND_number = 0;
8829 	tbr->ADDR_length = addr_length;
8830 	cp = (char *)&tbr[1];
8831 	switch (addr_length) {
8832 	case sizeof (ipa_conn_t):
8833 		ASSERT(tcp->tcp_family == AF_INET);
8834 		ASSERT(tcp->tcp_ipversion == IPV4_VERSION);
8835 
8836 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
8837 		if (mp->b_cont == NULL) {
8838 			freemsg(mp);
8839 			return (NULL);
8840 		}
8841 		mp->b_cont->b_wptr += sizeof (ire_t);
8842 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
8843 
8844 		/* cp known to be 32 bit aligned */
8845 		ac = (ipa_conn_t *)cp;
8846 		ac->ac_laddr = tcp->tcp_ipha->ipha_src;
8847 		ac->ac_faddr = tcp->tcp_remote;
8848 		ac->ac_fport = tcp->tcp_fport;
8849 		ac->ac_lport = tcp->tcp_lport;
8850 		tcp->tcp_hard_binding = 1;
8851 		break;
8852 
8853 	case sizeof (ipa6_conn_t):
8854 		ASSERT(tcp->tcp_family == AF_INET6);
8855 
8856 		mp->b_cont = allocb(sizeof (ire_t), BPRI_HI);
8857 		if (mp->b_cont == NULL) {
8858 			freemsg(mp);
8859 			return (NULL);
8860 		}
8861 		mp->b_cont->b_wptr += sizeof (ire_t);
8862 		mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE;
8863 
8864 		/* cp known to be 32 bit aligned */
8865 		ac6 = (ipa6_conn_t *)cp;
8866 		if (tcp->tcp_ipversion == IPV4_VERSION) {
8867 			IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src,
8868 			    &ac6->ac6_laddr);
8869 		} else {
8870 			ac6->ac6_laddr = tcp->tcp_ip6h->ip6_src;
8871 		}
8872 		ac6->ac6_faddr = tcp->tcp_remote_v6;
8873 		ac6->ac6_fport = tcp->tcp_fport;
8874 		ac6->ac6_lport = tcp->tcp_lport;
8875 		tcp->tcp_hard_binding = 1;
8876 		break;
8877 
8878 	case sizeof (sin_t):
8879 		/*
8880 		 * NOTE: IPV6_ADDR_LEN also has same size.
8881 		 * Use family to discriminate.
8882 		 */
8883 		if (tcp->tcp_family == AF_INET) {
8884 			sin = (sin_t *)cp;
8885 
8886 			*sin = sin_null;
8887 			sin->sin_family = AF_INET;
8888 			sin->sin_addr.s_addr = tcp->tcp_bound_source;
8889 			sin->sin_port = tcp->tcp_lport;
8890 			break;
8891 		} else {
8892 			*(in6_addr_t *)cp = tcp->tcp_bound_source_v6;
8893 		}
8894 		break;
8895 
8896 	case sizeof (sin6_t):
8897 		ASSERT(tcp->tcp_family == AF_INET6);
8898 		sin6 = (sin6_t *)cp;
8899 
8900 		*sin6 = sin6_null;
8901 		sin6->sin6_family = AF_INET6;
8902 		sin6->sin6_addr = tcp->tcp_bound_source_v6;
8903 		sin6->sin6_port = tcp->tcp_lport;
8904 		break;
8905 
8906 	case IP_ADDR_LEN:
8907 		ASSERT(tcp->tcp_ipversion == IPV4_VERSION);
8908 		*(uint32_t *)cp = tcp->tcp_ipha->ipha_src;
8909 		break;
8910 
8911 	}
8912 	/* Add protocol number to end */
8913 	cp[addr_length] = (char)IPPROTO_TCP;
8914 	mp->b_wptr = (uchar_t *)&cp[addr_length + 1];
8915 	return (mp);
8916 }
8917 
8918 /*
8919  * Notify IP that we are having trouble with this connection.  IP should
8920  * blow the IRE away and start over.
8921  */
8922 static void
8923 tcp_ip_notify(tcp_t *tcp)
8924 {
8925 	struct iocblk	*iocp;
8926 	ipid_t	*ipid;
8927 	mblk_t	*mp;
8928 
8929 	/* IPv6 has NUD thus notification to delete the IRE is not needed */
8930 	if (tcp->tcp_ipversion == IPV6_VERSION)
8931 		return;
8932 
8933 	mp = mkiocb(IP_IOCTL);
8934 	if (mp == NULL)
8935 		return;
8936 
8937 	iocp = (struct iocblk *)mp->b_rptr;
8938 	iocp->ioc_count = sizeof (ipid_t) + sizeof (tcp->tcp_ipha->ipha_dst);
8939 
8940 	mp->b_cont = allocb(iocp->ioc_count, BPRI_HI);
8941 	if (!mp->b_cont) {
8942 		freeb(mp);
8943 		return;
8944 	}
8945 
8946 	ipid = (ipid_t *)mp->b_cont->b_rptr;
8947 	mp->b_cont->b_wptr += iocp->ioc_count;
8948 	bzero(ipid, sizeof (*ipid));
8949 	ipid->ipid_cmd = IP_IOC_IRE_DELETE_NO_REPLY;
8950 	ipid->ipid_ire_type = IRE_CACHE;
8951 	ipid->ipid_addr_offset = sizeof (ipid_t);
8952 	ipid->ipid_addr_length = sizeof (tcp->tcp_ipha->ipha_dst);
8953 	/*
8954 	 * Note: in the case of source routing we want to blow away the
8955 	 * route to the first source route hop.
8956 	 */
8957 	bcopy(&tcp->tcp_ipha->ipha_dst, &ipid[1],
8958 	    sizeof (tcp->tcp_ipha->ipha_dst));
8959 
8960 	CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp);
8961 }
8962 
8963 /* Unlink and return any mblk that looks like it contains an ire */
8964 static mblk_t *
8965 tcp_ire_mp(mblk_t *mp)
8966 {
8967 	mblk_t	*prev_mp;
8968 
8969 	for (;;) {
8970 		prev_mp = mp;
8971 		mp = mp->b_cont;
8972 		if (mp == NULL)
8973 			break;
8974 		switch (DB_TYPE(mp)) {
8975 		case IRE_DB_TYPE:
8976 		case IRE_DB_REQ_TYPE:
8977 			if (prev_mp != NULL)
8978 				prev_mp->b_cont = mp->b_cont;
8979 			mp->b_cont = NULL;
8980 			return (mp);
8981 		default:
8982 			break;
8983 		}
8984 	}
8985 	return (mp);
8986 }
8987 
8988 /*
8989  * Timer callback routine for keepalive probe.  We do a fake resend of
8990  * last ACKed byte.  Then set a timer using RTO.  When the timer expires,
8991  * check to see if we have heard anything from the other end for the last
8992  * RTO period.  If we have, set the timer to expire for another
8993  * tcp_keepalive_intrvl and check again.  If we have not, set a timer using
8994  * RTO << 1 and check again when it expires.  Keep exponentially increasing
8995  * the timeout if we have not heard from the other side.  If for more than
8996  * (tcp_ka_interval + tcp_ka_abort_thres) we have not heard anything,
8997  * kill the connection unless the keepalive abort threshold is 0.  In
8998  * that case, we will probe "forever."
8999  */
9000 static void
9001 tcp_keepalive_killer(void *arg)
9002 {
9003 	mblk_t	*mp;
9004 	conn_t	*connp = (conn_t *)arg;
9005 	tcp_t  	*tcp = connp->conn_tcp;
9006 	int32_t	firetime;
9007 	int32_t	idletime;
9008 	int32_t	ka_intrvl;
9009 
9010 	tcp->tcp_ka_tid = 0;
9011 
9012 	if (tcp->tcp_fused)
9013 		return;
9014 
9015 	BUMP_MIB(&tcp_mib, tcpTimKeepalive);
9016 	ka_intrvl = tcp->tcp_ka_interval;
9017 
9018 	/*
9019 	 * Keepalive probe should only be sent if the application has not
9020 	 * done a close on the connection.
9021 	 */
9022 	if (tcp->tcp_state > TCPS_CLOSE_WAIT) {
9023 		return;
9024 	}
9025 	/* Timer fired too early, restart it. */
9026 	if (tcp->tcp_state < TCPS_ESTABLISHED) {
9027 		tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer,
9028 		    MSEC_TO_TICK(ka_intrvl));
9029 		return;
9030 	}
9031 
9032 	idletime = TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time);
9033 	/*
9034 	 * If we have not heard from the other side for a long
9035 	 * time, kill the connection unless the keepalive abort
9036 	 * threshold is 0.  In that case, we will probe "forever."
9037 	 */
9038 	if (tcp->tcp_ka_abort_thres != 0 &&
9039 	    idletime > (ka_intrvl + tcp->tcp_ka_abort_thres)) {
9040 		BUMP_MIB(&tcp_mib, tcpTimKeepaliveDrop);
9041 		(void) tcp_clean_death(tcp, tcp->tcp_client_errno ?
9042 		    tcp->tcp_client_errno : ETIMEDOUT, 11);
9043 		return;
9044 	}
9045 
9046 	if (tcp->tcp_snxt == tcp->tcp_suna &&
9047 	    idletime >= ka_intrvl) {
9048 		/* Fake resend of last ACKed byte. */
9049 		mblk_t	*mp1 = allocb(1, BPRI_LO);
9050 
9051 		if (mp1 != NULL) {
9052 			*mp1->b_wptr++ = '\0';
9053 			mp = tcp_xmit_mp(tcp, mp1, 1, NULL, NULL,
9054 			    tcp->tcp_suna - 1, B_FALSE, NULL, B_TRUE);
9055 			freeb(mp1);
9056 			/*
9057 			 * if allocation failed, fall through to start the
9058 			 * timer back.
9059 			 */
9060 			if (mp != NULL) {
9061 				TCP_RECORD_TRACE(tcp, mp,
9062 				    TCP_TRACE_SEND_PKT);
9063 				tcp_send_data(tcp, tcp->tcp_wq, mp);
9064 				BUMP_MIB(&tcp_mib, tcpTimKeepaliveProbe);
9065 				if (tcp->tcp_ka_last_intrvl != 0) {
9066 					/*
9067 					 * We should probe again at least
9068 					 * in ka_intrvl, but not more than
9069 					 * tcp_rexmit_interval_max.
9070 					 */
9071 					firetime = MIN(ka_intrvl - 1,
9072 					    tcp->tcp_ka_last_intrvl << 1);
9073 					if (firetime > tcp_rexmit_interval_max)
9074 						firetime =
9075 						    tcp_rexmit_interval_max;
9076 				} else {
9077 					firetime = tcp->tcp_rto;
9078 				}
9079 				tcp->tcp_ka_tid = TCP_TIMER(tcp,
9080 				    tcp_keepalive_killer,
9081 				    MSEC_TO_TICK(firetime));
9082 				tcp->tcp_ka_last_intrvl = firetime;
9083 				return;
9084 			}
9085 		}
9086 	} else {
9087 		tcp->tcp_ka_last_intrvl = 0;
9088 	}
9089 
9090 	/* firetime can be negative if (mp1 == NULL || mp == NULL) */
9091 	if ((firetime = ka_intrvl - idletime) < 0) {
9092 		firetime = ka_intrvl;
9093 	}
9094 	tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer,
9095 	    MSEC_TO_TICK(firetime));
9096 }
9097 
9098 int
9099 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk)
9100 {
9101 	queue_t	*q = tcp->tcp_rq;
9102 	int32_t	mss = tcp->tcp_mss;
9103 	int	maxpsz;
9104 
9105 	if (TCP_IS_DETACHED(tcp))
9106 		return (mss);
9107 
9108 	if (tcp->tcp_fused) {
9109 		maxpsz = tcp_fuse_maxpsz_set(tcp);
9110 		mss = INFPSZ;
9111 	} else if (tcp->tcp_mdt || tcp->tcp_maxpsz == 0) {
9112 		/*
9113 		 * Set the sd_qn_maxpsz according to the socket send buffer
9114 		 * size, and sd_maxblk to INFPSZ (-1).  This will essentially
9115 		 * instruct the stream head to copyin user data into contiguous
9116 		 * kernel-allocated buffers without breaking it up into smaller
9117 		 * chunks.  We round up the buffer size to the nearest SMSS.
9118 		 */
9119 		maxpsz = MSS_ROUNDUP(tcp->tcp_xmit_hiwater, mss);
9120 		if (tcp->tcp_kssl_ctx == NULL)
9121 			mss = INFPSZ;
9122 		else
9123 			mss = SSL3_MAX_RECORD_LEN;
9124 	} else {
9125 		/*
9126 		 * Set sd_qn_maxpsz to approx half the (receivers) buffer
9127 		 * (and a multiple of the mss).  This instructs the stream
9128 		 * head to break down larger than SMSS writes into SMSS-
9129 		 * size mblks, up to tcp_maxpsz_multiplier mblks at a time.
9130 		 */
9131 		maxpsz = tcp->tcp_maxpsz * mss;
9132 		if (maxpsz > tcp->tcp_xmit_hiwater/2) {
9133 			maxpsz = tcp->tcp_xmit_hiwater/2;
9134 			/* Round up to nearest mss */
9135 			maxpsz = MSS_ROUNDUP(maxpsz, mss);
9136 		}
9137 	}
9138 	(void) setmaxps(q, maxpsz);
9139 	tcp->tcp_wq->q_maxpsz = maxpsz;
9140 
9141 	if (set_maxblk)
9142 		(void) mi_set_sth_maxblk(q, mss);
9143 
9144 	return (mss);
9145 }
9146 
9147 /*
9148  * Extract option values from a tcp header.  We put any found values into the
9149  * tcpopt struct and return a bitmask saying which options were found.
9150  */
9151 static int
9152 tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt)
9153 {
9154 	uchar_t		*endp;
9155 	int		len;
9156 	uint32_t	mss;
9157 	uchar_t		*up = (uchar_t *)tcph;
9158 	int		found = 0;
9159 	int32_t		sack_len;
9160 	tcp_seq		sack_begin, sack_end;
9161 	tcp_t		*tcp;
9162 
9163 	endp = up + TCP_HDR_LENGTH(tcph);
9164 	up += TCP_MIN_HEADER_LENGTH;
9165 	while (up < endp) {
9166 		len = endp - up;
9167 		switch (*up) {
9168 		case TCPOPT_EOL:
9169 			break;
9170 
9171 		case TCPOPT_NOP:
9172 			up++;
9173 			continue;
9174 
9175 		case TCPOPT_MAXSEG:
9176 			if (len < TCPOPT_MAXSEG_LEN ||
9177 			    up[1] != TCPOPT_MAXSEG_LEN)
9178 				break;
9179 
9180 			mss = BE16_TO_U16(up+2);
9181 			/* Caller must handle tcp_mss_min and tcp_mss_max_* */
9182 			tcpopt->tcp_opt_mss = mss;
9183 			found |= TCP_OPT_MSS_PRESENT;
9184 
9185 			up += TCPOPT_MAXSEG_LEN;
9186 			continue;
9187 
9188 		case TCPOPT_WSCALE:
9189 			if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
9190 				break;
9191 
9192 			if (up[2] > TCP_MAX_WINSHIFT)
9193 				tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
9194 			else
9195 				tcpopt->tcp_opt_wscale = up[2];
9196 			found |= TCP_OPT_WSCALE_PRESENT;
9197 
9198 			up += TCPOPT_WS_LEN;
9199 			continue;
9200 
9201 		case TCPOPT_SACK_PERMITTED:
9202 			if (len < TCPOPT_SACK_OK_LEN ||
9203 			    up[1] != TCPOPT_SACK_OK_LEN)
9204 				break;
9205 			found |= TCP_OPT_SACK_OK_PRESENT;
9206 			up += TCPOPT_SACK_OK_LEN;
9207 			continue;
9208 
9209 		case TCPOPT_SACK:
9210 			if (len <= 2 || up[1] <= 2 || len < up[1])
9211 				break;
9212 
9213 			/* If TCP is not interested in SACK blks... */
9214 			if ((tcp = tcpopt->tcp) == NULL) {
9215 				up += up[1];
9216 				continue;
9217 			}
9218 			sack_len = up[1] - TCPOPT_HEADER_LEN;
9219 			up += TCPOPT_HEADER_LEN;
9220 
9221 			/*
9222 			 * If the list is empty, allocate one and assume
9223 			 * nothing is sack'ed.
9224 			 */
9225 			ASSERT(tcp->tcp_sack_info != NULL);
9226 			if (tcp->tcp_notsack_list == NULL) {
9227 				tcp_notsack_update(&(tcp->tcp_notsack_list),
9228 				    tcp->tcp_suna, tcp->tcp_snxt,
9229 				    &(tcp->tcp_num_notsack_blk),
9230 				    &(tcp->tcp_cnt_notsack_list));
9231 
9232 				/*
9233 				 * Make sure tcp_notsack_list is not NULL.
9234 				 * This happens when kmem_alloc(KM_NOSLEEP)
9235 				 * returns NULL.
9236 				 */
9237 				if (tcp->tcp_notsack_list == NULL) {
9238 					up += sack_len;
9239 					continue;
9240 				}
9241 				tcp->tcp_fack = tcp->tcp_suna;
9242 			}
9243 
9244 			while (sack_len > 0) {
9245 				if (up + 8 > endp) {
9246 					up = endp;
9247 					break;
9248 				}
9249 				sack_begin = BE32_TO_U32(up);
9250 				up += 4;
9251 				sack_end = BE32_TO_U32(up);
9252 				up += 4;
9253 				sack_len -= 8;
9254 				/*
9255 				 * Bounds checking.  Make sure the SACK
9256 				 * info is within tcp_suna and tcp_snxt.
9257 				 * If this SACK blk is out of bound, ignore
9258 				 * it but continue to parse the following
9259 				 * blks.
9260 				 */
9261 				if (SEQ_LEQ(sack_end, sack_begin) ||
9262 				    SEQ_LT(sack_begin, tcp->tcp_suna) ||
9263 				    SEQ_GT(sack_end, tcp->tcp_snxt)) {
9264 					continue;
9265 				}
9266 				tcp_notsack_insert(&(tcp->tcp_notsack_list),
9267 				    sack_begin, sack_end,
9268 				    &(tcp->tcp_num_notsack_blk),
9269 				    &(tcp->tcp_cnt_notsack_list));
9270 				if (SEQ_GT(sack_end, tcp->tcp_fack)) {
9271 					tcp->tcp_fack = sack_end;
9272 				}
9273 			}
9274 			found |= TCP_OPT_SACK_PRESENT;
9275 			continue;
9276 
9277 		case TCPOPT_TSTAMP:
9278 			if (len < TCPOPT_TSTAMP_LEN ||
9279 			    up[1] != TCPOPT_TSTAMP_LEN)
9280 				break;
9281 
9282 			tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
9283 			tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
9284 
9285 			found |= TCP_OPT_TSTAMP_PRESENT;
9286 
9287 			up += TCPOPT_TSTAMP_LEN;
9288 			continue;
9289 
9290 		default:
9291 			if (len <= 1 || len < (int)up[1] || up[1] == 0)
9292 				break;
9293 			up += up[1];
9294 			continue;
9295 		}
9296 		break;
9297 	}
9298 	return (found);
9299 }
9300 
9301 /*
9302  * Set the mss associated with a particular tcp based on its current value,
9303  * and a new one passed in. Observe minimums and maximums, and reset
9304  * other state variables that we want to view as multiples of mss.
9305  *
9306  * This function is called in various places mainly because
9307  * 1) Various stuffs, tcp_mss, tcp_cwnd, ... need to be adjusted when the
9308  *    other side's SYN/SYN-ACK packet arrives.
9309  * 2) PMTUd may get us a new MSS.
9310  * 3) If the other side stops sending us timestamp option, we need to
9311  *    increase the MSS size to use the extra bytes available.
9312  */
9313 static void
9314 tcp_mss_set(tcp_t *tcp, uint32_t mss)
9315 {
9316 	uint32_t	mss_max;
9317 
9318 	if (tcp->tcp_ipversion == IPV4_VERSION)
9319 		mss_max = tcp_mss_max_ipv4;
9320 	else
9321 		mss_max = tcp_mss_max_ipv6;
9322 
9323 	if (mss < tcp_mss_min)
9324 		mss = tcp_mss_min;
9325 	if (mss > mss_max)
9326 		mss = mss_max;
9327 	/*
9328 	 * Unless naglim has been set by our client to
9329 	 * a non-mss value, force naglim to track mss.
9330 	 * This can help to aggregate small writes.
9331 	 */
9332 	if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
9333 		tcp->tcp_naglim = mss;
9334 	/*
9335 	 * TCP should be able to buffer at least 4 MSS data for obvious
9336 	 * performance reason.
9337 	 */
9338 	if ((mss << 2) > tcp->tcp_xmit_hiwater)
9339 		tcp->tcp_xmit_hiwater = mss << 2;
9340 
9341 	/*
9342 	 * Check if we need to apply the tcp_init_cwnd here.  If
9343 	 * it is set and the MSS gets bigger (should not happen
9344 	 * normally), we need to adjust the resulting tcp_cwnd properly.
9345 	 * The new tcp_cwnd should not get bigger.
9346 	 */
9347 	if (tcp->tcp_init_cwnd == 0) {
9348 		tcp->tcp_cwnd = MIN(tcp_slow_start_initial * mss,
9349 		    MIN(4 * mss, MAX(2 * mss, 4380 / mss * mss)));
9350 	} else {
9351 		if (tcp->tcp_mss < mss) {
9352 			tcp->tcp_cwnd = MAX(1,
9353 			    (tcp->tcp_init_cwnd * tcp->tcp_mss / mss)) * mss;
9354 		} else {
9355 			tcp->tcp_cwnd = tcp->tcp_init_cwnd * mss;
9356 		}
9357 	}
9358 	tcp->tcp_mss = mss;
9359 	tcp->tcp_cwnd_cnt = 0;
9360 	(void) tcp_maxpsz_set(tcp, B_TRUE);
9361 }
9362 
9363 static int
9364 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
9365 {
9366 	tcp_t		*tcp = NULL;
9367 	conn_t		*connp;
9368 	int		err;
9369 	dev_t		conn_dev;
9370 	zoneid_t	zoneid = getzoneid();
9371 
9372 	/*
9373 	 * Special case for install: miniroot needs to be able to access files
9374 	 * via NFS as though it were always in the global zone.
9375 	 */
9376 	if (credp == kcred && nfs_global_client_only != 0)
9377 		zoneid = GLOBAL_ZONEID;
9378 
9379 	if (q->q_ptr != NULL)
9380 		return (0);
9381 
9382 	if (sflag == MODOPEN) {
9383 		/*
9384 		 * This is a special case. The purpose of a modopen
9385 		 * is to allow just the T_SVR4_OPTMGMT_REQ to pass
9386 		 * through for MIB browsers. Everything else is failed.
9387 		 */
9388 		connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt));
9389 
9390 		if (connp == NULL)
9391 			return (ENOMEM);
9392 
9393 		connp->conn_flags |= IPCL_TCPMOD;
9394 		connp->conn_cred = credp;
9395 		connp->conn_zoneid = zoneid;
9396 		q->q_ptr = WR(q)->q_ptr = connp;
9397 		crhold(credp);
9398 		q->q_qinfo = &tcp_mod_rinit;
9399 		WR(q)->q_qinfo = &tcp_mod_winit;
9400 		qprocson(q);
9401 		return (0);
9402 	}
9403 
9404 	if ((conn_dev = inet_minor_alloc(ip_minor_arena)) == 0)
9405 		return (EBUSY);
9406 
9407 	*devp = makedevice(getemajor(*devp), (minor_t)conn_dev);
9408 
9409 	if (flag & SO_ACCEPTOR) {
9410 		q->q_qinfo = &tcp_acceptor_rinit;
9411 		q->q_ptr = (void *)conn_dev;
9412 		WR(q)->q_qinfo = &tcp_acceptor_winit;
9413 		WR(q)->q_ptr = (void *)conn_dev;
9414 		qprocson(q);
9415 		return (0);
9416 	}
9417 
9418 	connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt));
9419 	if (connp == NULL) {
9420 		inet_minor_free(ip_minor_arena, conn_dev);
9421 		q->q_ptr = NULL;
9422 		return (ENOSR);
9423 	}
9424 	connp->conn_sqp = IP_SQUEUE_GET(lbolt);
9425 	tcp = connp->conn_tcp;
9426 
9427 	q->q_ptr = WR(q)->q_ptr = connp;
9428 	if (getmajor(*devp) == TCP6_MAJ) {
9429 		connp->conn_flags |= (IPCL_TCP6|IPCL_ISV6);
9430 		connp->conn_send = ip_output_v6;
9431 		connp->conn_af_isv6 = B_TRUE;
9432 		connp->conn_pkt_isv6 = B_TRUE;
9433 		connp->conn_src_preferences = IPV6_PREFER_SRC_DEFAULT;
9434 		tcp->tcp_ipversion = IPV6_VERSION;
9435 		tcp->tcp_family = AF_INET6;
9436 		tcp->tcp_mss = tcp_mss_def_ipv6;
9437 	} else {
9438 		connp->conn_flags |= IPCL_TCP4;
9439 		connp->conn_send = ip_output;
9440 		connp->conn_af_isv6 = B_FALSE;
9441 		connp->conn_pkt_isv6 = B_FALSE;
9442 		tcp->tcp_ipversion = IPV4_VERSION;
9443 		tcp->tcp_family = AF_INET;
9444 		tcp->tcp_mss = tcp_mss_def_ipv4;
9445 	}
9446 
9447 	/*
9448 	 * TCP keeps a copy of cred for cache locality reasons but
9449 	 * we put a reference only once. If connp->conn_cred
9450 	 * becomes invalid, tcp_cred should also be set to NULL.
9451 	 */
9452 	tcp->tcp_cred = connp->conn_cred = credp;
9453 	crhold(connp->conn_cred);
9454 	tcp->tcp_cpid = curproc->p_pid;
9455 	connp->conn_zoneid = zoneid;
9456 	connp->conn_mlp_type = mlptSingle;
9457 	connp->conn_ulp_labeled = !is_system_labeled();
9458 
9459 	/*
9460 	 * If the caller has the process-wide flag set, then default to MAC
9461 	 * exempt mode.  This allows read-down to unlabeled hosts.
9462 	 */
9463 	if (getpflags(NET_MAC_AWARE, credp) != 0)
9464 		connp->conn_mac_exempt = B_TRUE;
9465 
9466 	connp->conn_dev = conn_dev;
9467 
9468 	ASSERT(q->q_qinfo == &tcp_rinit);
9469 	ASSERT(WR(q)->q_qinfo == &tcp_winit);
9470 
9471 	if (flag & SO_SOCKSTR) {
9472 		/*
9473 		 * No need to insert a socket in tcp acceptor hash.
9474 		 * If it was a socket acceptor stream, we dealt with
9475 		 * it above. A socket listener can never accept a
9476 		 * connection and doesn't need acceptor_id.
9477 		 */
9478 		connp->conn_flags |= IPCL_SOCKET;
9479 		tcp->tcp_issocket = 1;
9480 		WR(q)->q_qinfo = &tcp_sock_winit;
9481 	} else {
9482 #ifdef	_ILP32
9483 		tcp->tcp_acceptor_id = (t_uscalar_t)RD(q);
9484 #else
9485 		tcp->tcp_acceptor_id = conn_dev;
9486 #endif	/* _ILP32 */
9487 		tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp);
9488 	}
9489 
9490 	if (tcp_trace)
9491 		tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_SLEEP);
9492 
9493 	err = tcp_init(tcp, q);
9494 	if (err != 0) {
9495 		inet_minor_free(ip_minor_arena, connp->conn_dev);
9496 		tcp_acceptor_hash_remove(tcp);
9497 		CONN_DEC_REF(connp);
9498 		q->q_ptr = WR(q)->q_ptr = NULL;
9499 		return (err);
9500 	}
9501 
9502 	RD(q)->q_hiwat = tcp_recv_hiwat;
9503 	tcp->tcp_rwnd = tcp_recv_hiwat;
9504 
9505 	/* Non-zero default values */
9506 	connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP;
9507 	/*
9508 	 * Put the ref for TCP. Ref for IP was already put
9509 	 * by ipcl_conn_create. Also Make the conn_t globally
9510 	 * visible to walkers
9511 	 */
9512 	mutex_enter(&connp->conn_lock);
9513 	CONN_INC_REF_LOCKED(connp);
9514 	ASSERT(connp->conn_ref == 2);
9515 	connp->conn_state_flags &= ~CONN_INCIPIENT;
9516 	mutex_exit(&connp->conn_lock);
9517 
9518 	qprocson(q);
9519 	return (0);
9520 }
9521 
9522 /*
9523  * Some TCP options can be "set" by requesting them in the option
9524  * buffer. This is needed for XTI feature test though we do not
9525  * allow it in general. We interpret that this mechanism is more
9526  * applicable to OSI protocols and need not be allowed in general.
9527  * This routine filters out options for which it is not allowed (most)
9528  * and lets through those (few) for which it is. [ The XTI interface
9529  * test suite specifics will imply that any XTI_GENERIC level XTI_* if
9530  * ever implemented will have to be allowed here ].
9531  */
9532 static boolean_t
9533 tcp_allow_connopt_set(int level, int name)
9534 {
9535 
9536 	switch (level) {
9537 	case IPPROTO_TCP:
9538 		switch (name) {
9539 		case TCP_NODELAY:
9540 			return (B_TRUE);
9541 		default:
9542 			return (B_FALSE);
9543 		}
9544 		/*NOTREACHED*/
9545 	default:
9546 		return (B_FALSE);
9547 	}
9548 	/*NOTREACHED*/
9549 }
9550 
9551 /*
9552  * This routine gets default values of certain options whose default
9553  * values are maintained by protocol specific code
9554  */
9555 /* ARGSUSED */
9556 int
9557 tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr)
9558 {
9559 	int32_t	*i1 = (int32_t *)ptr;
9560 
9561 	switch (level) {
9562 	case IPPROTO_TCP:
9563 		switch (name) {
9564 		case TCP_NOTIFY_THRESHOLD:
9565 			*i1 = tcp_ip_notify_interval;
9566 			break;
9567 		case TCP_ABORT_THRESHOLD:
9568 			*i1 = tcp_ip_abort_interval;
9569 			break;
9570 		case TCP_CONN_NOTIFY_THRESHOLD:
9571 			*i1 = tcp_ip_notify_cinterval;
9572 			break;
9573 		case TCP_CONN_ABORT_THRESHOLD:
9574 			*i1 = tcp_ip_abort_cinterval;
9575 			break;
9576 		default:
9577 			return (-1);
9578 		}
9579 		break;
9580 	case IPPROTO_IP:
9581 		switch (name) {
9582 		case IP_TTL:
9583 			*i1 = tcp_ipv4_ttl;
9584 			break;
9585 		default:
9586 			return (-1);
9587 		}
9588 		break;
9589 	case IPPROTO_IPV6:
9590 		switch (name) {
9591 		case IPV6_UNICAST_HOPS:
9592 			*i1 = tcp_ipv6_hoplimit;
9593 			break;
9594 		default:
9595 			return (-1);
9596 		}
9597 		break;
9598 	default:
9599 		return (-1);
9600 	}
9601 	return (sizeof (int));
9602 }
9603 
9604 
9605 /*
9606  * TCP routine to get the values of options.
9607  */
9608 int
9609 tcp_opt_get(queue_t *q, int level, int	name, uchar_t *ptr)
9610 {
9611 	int		*i1 = (int *)ptr;
9612 	conn_t		*connp = Q_TO_CONN(q);
9613 	tcp_t		*tcp = connp->conn_tcp;
9614 	ip6_pkt_t	*ipp = &tcp->tcp_sticky_ipp;
9615 
9616 	switch (level) {
9617 	case SOL_SOCKET:
9618 		switch (name) {
9619 		case SO_LINGER:	{
9620 			struct linger *lgr = (struct linger *)ptr;
9621 
9622 			lgr->l_onoff = tcp->tcp_linger ? SO_LINGER : 0;
9623 			lgr->l_linger = tcp->tcp_lingertime;
9624 			}
9625 			return (sizeof (struct linger));
9626 		case SO_DEBUG:
9627 			*i1 = tcp->tcp_debug ? SO_DEBUG : 0;
9628 			break;
9629 		case SO_KEEPALIVE:
9630 			*i1 = tcp->tcp_ka_enabled ? SO_KEEPALIVE : 0;
9631 			break;
9632 		case SO_DONTROUTE:
9633 			*i1 = tcp->tcp_dontroute ? SO_DONTROUTE : 0;
9634 			break;
9635 		case SO_USELOOPBACK:
9636 			*i1 = tcp->tcp_useloopback ? SO_USELOOPBACK : 0;
9637 			break;
9638 		case SO_BROADCAST:
9639 			*i1 = tcp->tcp_broadcast ? SO_BROADCAST : 0;
9640 			break;
9641 		case SO_REUSEADDR:
9642 			*i1 = tcp->tcp_reuseaddr ? SO_REUSEADDR : 0;
9643 			break;
9644 		case SO_OOBINLINE:
9645 			*i1 = tcp->tcp_oobinline ? SO_OOBINLINE : 0;
9646 			break;
9647 		case SO_DGRAM_ERRIND:
9648 			*i1 = tcp->tcp_dgram_errind ? SO_DGRAM_ERRIND : 0;
9649 			break;
9650 		case SO_TYPE:
9651 			*i1 = SOCK_STREAM;
9652 			break;
9653 		case SO_SNDBUF:
9654 			*i1 = tcp->tcp_xmit_hiwater;
9655 			break;
9656 		case SO_RCVBUF:
9657 			*i1 = RD(q)->q_hiwat;
9658 			break;
9659 		case SO_SND_COPYAVOID:
9660 			*i1 = tcp->tcp_snd_zcopy_on ?
9661 			    SO_SND_COPYAVOID : 0;
9662 			break;
9663 		case SO_ALLZONES:
9664 			*i1 = connp->conn_allzones ? 1 : 0;
9665 			break;
9666 		case SO_ANON_MLP:
9667 			*i1 = connp->conn_anon_mlp;
9668 			break;
9669 		case SO_MAC_EXEMPT:
9670 			*i1 = connp->conn_mac_exempt;
9671 			break;
9672 		case SO_EXCLBIND:
9673 			*i1 = tcp->tcp_exclbind ? SO_EXCLBIND : 0;
9674 			break;
9675 		default:
9676 			return (-1);
9677 		}
9678 		break;
9679 	case IPPROTO_TCP:
9680 		switch (name) {
9681 		case TCP_NODELAY:
9682 			*i1 = (tcp->tcp_naglim == 1) ? TCP_NODELAY : 0;
9683 			break;
9684 		case TCP_MAXSEG:
9685 			*i1 = tcp->tcp_mss;
9686 			break;
9687 		case TCP_NOTIFY_THRESHOLD:
9688 			*i1 = (int)tcp->tcp_first_timer_threshold;
9689 			break;
9690 		case TCP_ABORT_THRESHOLD:
9691 			*i1 = tcp->tcp_second_timer_threshold;
9692 			break;
9693 		case TCP_CONN_NOTIFY_THRESHOLD:
9694 			*i1 = tcp->tcp_first_ctimer_threshold;
9695 			break;
9696 		case TCP_CONN_ABORT_THRESHOLD:
9697 			*i1 = tcp->tcp_second_ctimer_threshold;
9698 			break;
9699 		case TCP_RECVDSTADDR:
9700 			*i1 = tcp->tcp_recvdstaddr;
9701 			break;
9702 		case TCP_ANONPRIVBIND:
9703 			*i1 = tcp->tcp_anon_priv_bind;
9704 			break;
9705 		case TCP_EXCLBIND:
9706 			*i1 = tcp->tcp_exclbind ? TCP_EXCLBIND : 0;
9707 			break;
9708 		case TCP_INIT_CWND:
9709 			*i1 = tcp->tcp_init_cwnd;
9710 			break;
9711 		case TCP_KEEPALIVE_THRESHOLD:
9712 			*i1 = tcp->tcp_ka_interval;
9713 			break;
9714 		case TCP_KEEPALIVE_ABORT_THRESHOLD:
9715 			*i1 = tcp->tcp_ka_abort_thres;
9716 			break;
9717 		case TCP_CORK:
9718 			*i1 = tcp->tcp_cork;
9719 			break;
9720 		default:
9721 			return (-1);
9722 		}
9723 		break;
9724 	case IPPROTO_IP:
9725 		if (tcp->tcp_family != AF_INET)
9726 			return (-1);
9727 		switch (name) {
9728 		case IP_OPTIONS:
9729 		case T_IP_OPTIONS: {
9730 			/*
9731 			 * This is compatible with BSD in that in only return
9732 			 * the reverse source route with the final destination
9733 			 * as the last entry. The first 4 bytes of the option
9734 			 * will contain the final destination.
9735 			 */
9736 			int	opt_len;
9737 
9738 			opt_len = (char *)tcp->tcp_tcph - (char *)tcp->tcp_ipha;
9739 			opt_len -= tcp->tcp_label_len + IP_SIMPLE_HDR_LENGTH;
9740 			ASSERT(opt_len >= 0);
9741 			/* Caller ensures enough space */
9742 			if (opt_len > 0) {
9743 				/*
9744 				 * TODO: Do we have to handle getsockopt on an
9745 				 * initiator as well?
9746 				 */
9747 				return (ip_opt_get_user(tcp->tcp_ipha, ptr));
9748 			}
9749 			return (0);
9750 			}
9751 		case IP_TOS:
9752 		case T_IP_TOS:
9753 			*i1 = (int)tcp->tcp_ipha->ipha_type_of_service;
9754 			break;
9755 		case IP_TTL:
9756 			*i1 = (int)tcp->tcp_ipha->ipha_ttl;
9757 			break;
9758 		case IP_NEXTHOP:
9759 			/* Handled at IP level */
9760 			return (-EINVAL);
9761 		default:
9762 			return (-1);
9763 		}
9764 		break;
9765 	case IPPROTO_IPV6:
9766 		/*
9767 		 * IPPROTO_IPV6 options are only supported for sockets
9768 		 * that are using IPv6 on the wire.
9769 		 */
9770 		if (tcp->tcp_ipversion != IPV6_VERSION) {
9771 			return (-1);
9772 		}
9773 		switch (name) {
9774 		case IPV6_UNICAST_HOPS:
9775 			*i1 = (unsigned int) tcp->tcp_ip6h->ip6_hops;
9776 			break;	/* goto sizeof (int) option return */
9777 		case IPV6_BOUND_IF:
9778 			/* Zero if not set */
9779 			*i1 = tcp->tcp_bound_if;
9780 			break;	/* goto sizeof (int) option return */
9781 		case IPV6_RECVPKTINFO:
9782 			if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO)
9783 				*i1 = 1;
9784 			else
9785 				*i1 = 0;
9786 			break;	/* goto sizeof (int) option return */
9787 		case IPV6_RECVTCLASS:
9788 			if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS)
9789 				*i1 = 1;
9790 			else
9791 				*i1 = 0;
9792 			break;	/* goto sizeof (int) option return */
9793 		case IPV6_RECVHOPLIMIT:
9794 			if (tcp->tcp_ipv6_recvancillary &
9795 			    TCP_IPV6_RECVHOPLIMIT)
9796 				*i1 = 1;
9797 			else
9798 				*i1 = 0;
9799 			break;	/* goto sizeof (int) option return */
9800 		case IPV6_RECVHOPOPTS:
9801 			if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS)
9802 				*i1 = 1;
9803 			else
9804 				*i1 = 0;
9805 			break;	/* goto sizeof (int) option return */
9806 		case IPV6_RECVDSTOPTS:
9807 			if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVDSTOPTS)
9808 				*i1 = 1;
9809 			else
9810 				*i1 = 0;
9811 			break;	/* goto sizeof (int) option return */
9812 		case _OLD_IPV6_RECVDSTOPTS:
9813 			if (tcp->tcp_ipv6_recvancillary &
9814 			    TCP_OLD_IPV6_RECVDSTOPTS)
9815 				*i1 = 1;
9816 			else
9817 				*i1 = 0;
9818 			break;	/* goto sizeof (int) option return */
9819 		case IPV6_RECVRTHDR:
9820 			if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR)
9821 				*i1 = 1;
9822 			else
9823 				*i1 = 0;
9824 			break;	/* goto sizeof (int) option return */
9825 		case IPV6_RECVRTHDRDSTOPTS:
9826 			if (tcp->tcp_ipv6_recvancillary &
9827 			    TCP_IPV6_RECVRTDSTOPTS)
9828 				*i1 = 1;
9829 			else
9830 				*i1 = 0;
9831 			break;	/* goto sizeof (int) option return */
9832 		case IPV6_PKTINFO: {
9833 			/* XXX assumes that caller has room for max size! */
9834 			struct in6_pktinfo *pkti;
9835 
9836 			pkti = (struct in6_pktinfo *)ptr;
9837 			if (ipp->ipp_fields & IPPF_IFINDEX)
9838 				pkti->ipi6_ifindex = ipp->ipp_ifindex;
9839 			else
9840 				pkti->ipi6_ifindex = 0;
9841 			if (ipp->ipp_fields & IPPF_ADDR)
9842 				pkti->ipi6_addr = ipp->ipp_addr;
9843 			else
9844 				pkti->ipi6_addr = ipv6_all_zeros;
9845 			return (sizeof (struct in6_pktinfo));
9846 		}
9847 		case IPV6_TCLASS:
9848 			if (ipp->ipp_fields & IPPF_TCLASS)
9849 				*i1 = ipp->ipp_tclass;
9850 			else
9851 				*i1 = IPV6_FLOW_TCLASS(
9852 				    IPV6_DEFAULT_VERS_AND_FLOW);
9853 			break;	/* goto sizeof (int) option return */
9854 		case IPV6_NEXTHOP: {
9855 			sin6_t *sin6 = (sin6_t *)ptr;
9856 
9857 			if (!(ipp->ipp_fields & IPPF_NEXTHOP))
9858 				return (0);
9859 			*sin6 = sin6_null;
9860 			sin6->sin6_family = AF_INET6;
9861 			sin6->sin6_addr = ipp->ipp_nexthop;
9862 			return (sizeof (sin6_t));
9863 		}
9864 		case IPV6_HOPOPTS:
9865 			if (!(ipp->ipp_fields & IPPF_HOPOPTS))
9866 				return (0);
9867 			if (ipp->ipp_hopoptslen <= tcp->tcp_label_len)
9868 				return (0);
9869 			bcopy((char *)ipp->ipp_hopopts + tcp->tcp_label_len,
9870 			    ptr, ipp->ipp_hopoptslen - tcp->tcp_label_len);
9871 			if (tcp->tcp_label_len > 0) {
9872 				ptr[0] = ((char *)ipp->ipp_hopopts)[0];
9873 				ptr[1] = (ipp->ipp_hopoptslen -
9874 				    tcp->tcp_label_len + 7) / 8 - 1;
9875 			}
9876 			return (ipp->ipp_hopoptslen - tcp->tcp_label_len);
9877 		case IPV6_RTHDRDSTOPTS:
9878 			if (!(ipp->ipp_fields & IPPF_RTDSTOPTS))
9879 				return (0);
9880 			bcopy(ipp->ipp_rtdstopts, ptr, ipp->ipp_rtdstoptslen);
9881 			return (ipp->ipp_rtdstoptslen);
9882 		case IPV6_RTHDR:
9883 			if (!(ipp->ipp_fields & IPPF_RTHDR))
9884 				return (0);
9885 			bcopy(ipp->ipp_rthdr, ptr, ipp->ipp_rthdrlen);
9886 			return (ipp->ipp_rthdrlen);
9887 		case IPV6_DSTOPTS:
9888 			if (!(ipp->ipp_fields & IPPF_DSTOPTS))
9889 				return (0);
9890 			bcopy(ipp->ipp_dstopts, ptr, ipp->ipp_dstoptslen);
9891 			return (ipp->ipp_dstoptslen);
9892 		case IPV6_SRC_PREFERENCES:
9893 			return (ip6_get_src_preferences(connp,
9894 			    (uint32_t *)ptr));
9895 		case IPV6_PATHMTU: {
9896 			struct ip6_mtuinfo *mtuinfo = (struct ip6_mtuinfo *)ptr;
9897 
9898 			if (tcp->tcp_state < TCPS_ESTABLISHED)
9899 				return (-1);
9900 
9901 			return (ip_fill_mtuinfo(&connp->conn_remv6,
9902 				connp->conn_fport, mtuinfo));
9903 		}
9904 		default:
9905 			return (-1);
9906 		}
9907 		break;
9908 	default:
9909 		return (-1);
9910 	}
9911 	return (sizeof (int));
9912 }
9913 
9914 /*
9915  * We declare as 'int' rather than 'void' to satisfy pfi_t arg requirements.
9916  * Parameters are assumed to be verified by the caller.
9917  */
9918 /* ARGSUSED */
9919 int
9920 tcp_opt_set(queue_t *q, uint_t optset_context, int level, int name,
9921     uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp,
9922     void *thisdg_attrs, cred_t *cr, mblk_t *mblk)
9923 {
9924 	conn_t	*connp = Q_TO_CONN(q);
9925 	tcp_t	*tcp = connp->conn_tcp;
9926 	int	*i1 = (int *)invalp;
9927 	boolean_t onoff = (*i1 == 0) ? 0 : 1;
9928 	boolean_t checkonly;
9929 	int	reterr;
9930 
9931 	switch (optset_context) {
9932 	case SETFN_OPTCOM_CHECKONLY:
9933 		checkonly = B_TRUE;
9934 		/*
9935 		 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ
9936 		 * inlen != 0 implies value supplied and
9937 		 * 	we have to "pretend" to set it.
9938 		 * inlen == 0 implies that there is no
9939 		 * 	value part in T_CHECK request and just validation
9940 		 * done elsewhere should be enough, we just return here.
9941 		 */
9942 		if (inlen == 0) {
9943 			*outlenp = 0;
9944 			return (0);
9945 		}
9946 		break;
9947 	case SETFN_OPTCOM_NEGOTIATE:
9948 		checkonly = B_FALSE;
9949 		break;
9950 	case SETFN_UD_NEGOTIATE: /* error on conn-oriented transports ? */
9951 	case SETFN_CONN_NEGOTIATE:
9952 		checkonly = B_FALSE;
9953 		/*
9954 		 * Negotiating local and "association-related" options
9955 		 * from other (T_CONN_REQ, T_CONN_RES,T_UNITDATA_REQ)
9956 		 * primitives is allowed by XTI, but we choose
9957 		 * to not implement this style negotiation for Internet
9958 		 * protocols (We interpret it is a must for OSI world but
9959 		 * optional for Internet protocols) for all options.
9960 		 * [ Will do only for the few options that enable test
9961 		 * suites that our XTI implementation of this feature
9962 		 * works for transports that do allow it ]
9963 		 */
9964 		if (!tcp_allow_connopt_set(level, name)) {
9965 			*outlenp = 0;
9966 			return (EINVAL);
9967 		}
9968 		break;
9969 	default:
9970 		/*
9971 		 * We should never get here
9972 		 */
9973 		*outlenp = 0;
9974 		return (EINVAL);
9975 	}
9976 
9977 	ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) ||
9978 	    (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0));
9979 
9980 	/*
9981 	 * For TCP, we should have no ancillary data sent down
9982 	 * (sendmsg isn't supported for SOCK_STREAM), so thisdg_attrs
9983 	 * has to be zero.
9984 	 */
9985 	ASSERT(thisdg_attrs == NULL);
9986 
9987 	/*
9988 	 * For fixed length options, no sanity check
9989 	 * of passed in length is done. It is assumed *_optcom_req()
9990 	 * routines do the right thing.
9991 	 */
9992 
9993 	switch (level) {
9994 	case SOL_SOCKET:
9995 		switch (name) {
9996 		case SO_LINGER: {
9997 			struct linger *lgr = (struct linger *)invalp;
9998 
9999 			if (!checkonly) {
10000 				if (lgr->l_onoff) {
10001 					tcp->tcp_linger = 1;
10002 					tcp->tcp_lingertime = lgr->l_linger;
10003 				} else {
10004 					tcp->tcp_linger = 0;
10005 					tcp->tcp_lingertime = 0;
10006 				}
10007 				/* struct copy */
10008 				*(struct linger *)outvalp = *lgr;
10009 			} else {
10010 				if (!lgr->l_onoff) {
10011 				    ((struct linger *)outvalp)->l_onoff = 0;
10012 				    ((struct linger *)outvalp)->l_linger = 0;
10013 				} else {
10014 				    /* struct copy */
10015 				    *(struct linger *)outvalp = *lgr;
10016 				}
10017 			}
10018 			*outlenp = sizeof (struct linger);
10019 			return (0);
10020 		}
10021 		case SO_DEBUG:
10022 			if (!checkonly)
10023 				tcp->tcp_debug = onoff;
10024 			break;
10025 		case SO_KEEPALIVE:
10026 			if (checkonly) {
10027 				/* T_CHECK case */
10028 				break;
10029 			}
10030 
10031 			if (!onoff) {
10032 				if (tcp->tcp_ka_enabled) {
10033 					if (tcp->tcp_ka_tid != 0) {
10034 						(void) TCP_TIMER_CANCEL(tcp,
10035 						    tcp->tcp_ka_tid);
10036 						tcp->tcp_ka_tid = 0;
10037 					}
10038 					tcp->tcp_ka_enabled = 0;
10039 				}
10040 				break;
10041 			}
10042 			if (!tcp->tcp_ka_enabled) {
10043 				/* Crank up the keepalive timer */
10044 				tcp->tcp_ka_last_intrvl = 0;
10045 				tcp->tcp_ka_tid = TCP_TIMER(tcp,
10046 				    tcp_keepalive_killer,
10047 				    MSEC_TO_TICK(tcp->tcp_ka_interval));
10048 				tcp->tcp_ka_enabled = 1;
10049 			}
10050 			break;
10051 		case SO_DONTROUTE:
10052 			/*
10053 			 * SO_DONTROUTE, SO_USELOOPBACK, and SO_BROADCAST are
10054 			 * only of interest to IP.  We track them here only so
10055 			 * that we can report their current value.
10056 			 */
10057 			if (!checkonly) {
10058 				tcp->tcp_dontroute = onoff;
10059 				tcp->tcp_connp->conn_dontroute = onoff;
10060 			}
10061 			break;
10062 		case SO_USELOOPBACK:
10063 			if (!checkonly) {
10064 				tcp->tcp_useloopback = onoff;
10065 				tcp->tcp_connp->conn_loopback = onoff;
10066 			}
10067 			break;
10068 		case SO_BROADCAST:
10069 			if (!checkonly) {
10070 				tcp->tcp_broadcast = onoff;
10071 				tcp->tcp_connp->conn_broadcast = onoff;
10072 			}
10073 			break;
10074 		case SO_REUSEADDR:
10075 			if (!checkonly) {
10076 				tcp->tcp_reuseaddr = onoff;
10077 				tcp->tcp_connp->conn_reuseaddr = onoff;
10078 			}
10079 			break;
10080 		case SO_OOBINLINE:
10081 			if (!checkonly)
10082 				tcp->tcp_oobinline = onoff;
10083 			break;
10084 		case SO_DGRAM_ERRIND:
10085 			if (!checkonly)
10086 				tcp->tcp_dgram_errind = onoff;
10087 			break;
10088 		case SO_SNDBUF: {
10089 			tcp_t *peer_tcp;
10090 
10091 			if (*i1 > tcp_max_buf) {
10092 				*outlenp = 0;
10093 				return (ENOBUFS);
10094 			}
10095 			if (checkonly)
10096 				break;
10097 
10098 			tcp->tcp_xmit_hiwater = *i1;
10099 			if (tcp_snd_lowat_fraction != 0)
10100 				tcp->tcp_xmit_lowater =
10101 				    tcp->tcp_xmit_hiwater /
10102 				    tcp_snd_lowat_fraction;
10103 			(void) tcp_maxpsz_set(tcp, B_TRUE);
10104 			/*
10105 			 * If we are flow-controlled, recheck the condition.
10106 			 * There are apps that increase SO_SNDBUF size when
10107 			 * flow-controlled (EWOULDBLOCK), and expect the flow
10108 			 * control condition to be lifted right away.
10109 			 *
10110 			 * For the fused tcp loopback case, in order to avoid
10111 			 * a race with the peer's tcp_fuse_rrw() we need to
10112 			 * hold its fuse_lock while accessing tcp_flow_stopped.
10113 			 */
10114 			peer_tcp = tcp->tcp_loopback_peer;
10115 			ASSERT(!tcp->tcp_fused || peer_tcp != NULL);
10116 			if (tcp->tcp_fused)
10117 				mutex_enter(&peer_tcp->tcp_fuse_lock);
10118 
10119 			if (tcp->tcp_flow_stopped &&
10120 			    TCP_UNSENT_BYTES(tcp) < tcp->tcp_xmit_hiwater) {
10121 				tcp_clrqfull(tcp);
10122 			}
10123 			if (tcp->tcp_fused)
10124 				mutex_exit(&peer_tcp->tcp_fuse_lock);
10125 			break;
10126 		}
10127 		case SO_RCVBUF:
10128 			if (*i1 > tcp_max_buf) {
10129 				*outlenp = 0;
10130 				return (ENOBUFS);
10131 			}
10132 			/* Silently ignore zero */
10133 			if (!checkonly && *i1 != 0) {
10134 				*i1 = MSS_ROUNDUP(*i1, tcp->tcp_mss);
10135 				(void) tcp_rwnd_set(tcp, *i1);
10136 			}
10137 			/*
10138 			 * XXX should we return the rwnd here
10139 			 * and tcp_opt_get ?
10140 			 */
10141 			break;
10142 		case SO_SND_COPYAVOID:
10143 			if (!checkonly) {
10144 				/* we only allow enable at most once for now */
10145 				if (tcp->tcp_loopback ||
10146 				    (!tcp->tcp_snd_zcopy_aware &&
10147 				    (onoff != 1 || !tcp_zcopy_check(tcp)))) {
10148 					*outlenp = 0;
10149 					return (EOPNOTSUPP);
10150 				}
10151 				tcp->tcp_snd_zcopy_aware = 1;
10152 			}
10153 			break;
10154 		case SO_ALLZONES:
10155 			/* Handled at the IP level */
10156 			return (-EINVAL);
10157 		case SO_ANON_MLP:
10158 			if (!checkonly) {
10159 				mutex_enter(&connp->conn_lock);
10160 				connp->conn_anon_mlp = onoff;
10161 				mutex_exit(&connp->conn_lock);
10162 			}
10163 			break;
10164 		case SO_MAC_EXEMPT:
10165 			if (secpolicy_net_mac_aware(cr) != 0 ||
10166 			    IPCL_IS_BOUND(connp))
10167 				return (EACCES);
10168 			if (!checkonly) {
10169 				mutex_enter(&connp->conn_lock);
10170 				connp->conn_mac_exempt = onoff;
10171 				mutex_exit(&connp->conn_lock);
10172 			}
10173 			break;
10174 		case SO_EXCLBIND:
10175 			if (!checkonly)
10176 				tcp->tcp_exclbind = onoff;
10177 			break;
10178 		default:
10179 			*outlenp = 0;
10180 			return (EINVAL);
10181 		}
10182 		break;
10183 	case IPPROTO_TCP:
10184 		switch (name) {
10185 		case TCP_NODELAY:
10186 			if (!checkonly)
10187 				tcp->tcp_naglim = *i1 ? 1 : tcp->tcp_mss;
10188 			break;
10189 		case TCP_NOTIFY_THRESHOLD:
10190 			if (!checkonly)
10191 				tcp->tcp_first_timer_threshold = *i1;
10192 			break;
10193 		case TCP_ABORT_THRESHOLD:
10194 			if (!checkonly)
10195 				tcp->tcp_second_timer_threshold = *i1;
10196 			break;
10197 		case TCP_CONN_NOTIFY_THRESHOLD:
10198 			if (!checkonly)
10199 				tcp->tcp_first_ctimer_threshold = *i1;
10200 			break;
10201 		case TCP_CONN_ABORT_THRESHOLD:
10202 			if (!checkonly)
10203 				tcp->tcp_second_ctimer_threshold = *i1;
10204 			break;
10205 		case TCP_RECVDSTADDR:
10206 			if (tcp->tcp_state > TCPS_LISTEN)
10207 				return (EOPNOTSUPP);
10208 			if (!checkonly)
10209 				tcp->tcp_recvdstaddr = onoff;
10210 			break;
10211 		case TCP_ANONPRIVBIND:
10212 			if ((reterr = secpolicy_net_privaddr(cr, 0)) != 0) {
10213 				*outlenp = 0;
10214 				return (reterr);
10215 			}
10216 			if (!checkonly) {
10217 				tcp->tcp_anon_priv_bind = onoff;
10218 			}
10219 			break;
10220 		case TCP_EXCLBIND:
10221 			if (!checkonly)
10222 				tcp->tcp_exclbind = onoff;
10223 			break;	/* goto sizeof (int) option return */
10224 		case TCP_INIT_CWND: {
10225 			uint32_t init_cwnd = *((uint32_t *)invalp);
10226 
10227 			if (checkonly)
10228 				break;
10229 
10230 			/*
10231 			 * Only allow socket with network configuration
10232 			 * privilege to set the initial cwnd to be larger
10233 			 * than allowed by RFC 3390.
10234 			 */
10235 			if (init_cwnd <= MIN(4, MAX(2, 4380 / tcp->tcp_mss))) {
10236 				tcp->tcp_init_cwnd = init_cwnd;
10237 				break;
10238 			}
10239 			if ((reterr = secpolicy_net_config(cr, B_TRUE)) != 0) {
10240 				*outlenp = 0;
10241 				return (reterr);
10242 			}
10243 			if (init_cwnd > TCP_MAX_INIT_CWND) {
10244 				*outlenp = 0;
10245 				return (EINVAL);
10246 			}
10247 			tcp->tcp_init_cwnd = init_cwnd;
10248 			break;
10249 		}
10250 		case TCP_KEEPALIVE_THRESHOLD:
10251 			if (checkonly)
10252 				break;
10253 
10254 			if (*i1 < tcp_keepalive_interval_low ||
10255 			    *i1 > tcp_keepalive_interval_high) {
10256 				*outlenp = 0;
10257 				return (EINVAL);
10258 			}
10259 			if (*i1 != tcp->tcp_ka_interval) {
10260 				tcp->tcp_ka_interval = *i1;
10261 				/*
10262 				 * Check if we need to restart the
10263 				 * keepalive timer.
10264 				 */
10265 				if (tcp->tcp_ka_tid != 0) {
10266 					ASSERT(tcp->tcp_ka_enabled);
10267 					(void) TCP_TIMER_CANCEL(tcp,
10268 					    tcp->tcp_ka_tid);
10269 					tcp->tcp_ka_last_intrvl = 0;
10270 					tcp->tcp_ka_tid = TCP_TIMER(tcp,
10271 					    tcp_keepalive_killer,
10272 					    MSEC_TO_TICK(tcp->tcp_ka_interval));
10273 				}
10274 			}
10275 			break;
10276 		case TCP_KEEPALIVE_ABORT_THRESHOLD:
10277 			if (!checkonly) {
10278 				if (*i1 < tcp_keepalive_abort_interval_low ||
10279 				    *i1 > tcp_keepalive_abort_interval_high) {
10280 					*outlenp = 0;
10281 					return (EINVAL);
10282 				}
10283 				tcp->tcp_ka_abort_thres = *i1;
10284 			}
10285 			break;
10286 		case TCP_CORK:
10287 			if (!checkonly) {
10288 				/*
10289 				 * if tcp->tcp_cork was set and is now
10290 				 * being unset, we have to make sure that
10291 				 * the remaining data gets sent out. Also
10292 				 * unset tcp->tcp_cork so that tcp_wput_data()
10293 				 * can send data even if it is less than mss
10294 				 */
10295 				if (tcp->tcp_cork && onoff == 0 &&
10296 				    tcp->tcp_unsent > 0) {
10297 					tcp->tcp_cork = B_FALSE;
10298 					tcp_wput_data(tcp, NULL, B_FALSE);
10299 				}
10300 				tcp->tcp_cork = onoff;
10301 			}
10302 			break;
10303 		default:
10304 			*outlenp = 0;
10305 			return (EINVAL);
10306 		}
10307 		break;
10308 	case IPPROTO_IP:
10309 		if (tcp->tcp_family != AF_INET) {
10310 			*outlenp = 0;
10311 			return (ENOPROTOOPT);
10312 		}
10313 		switch (name) {
10314 		case IP_OPTIONS:
10315 		case T_IP_OPTIONS:
10316 			reterr = tcp_opt_set_header(tcp, checkonly,
10317 			    invalp, inlen);
10318 			if (reterr) {
10319 				*outlenp = 0;
10320 				return (reterr);
10321 			}
10322 			/* OK return - copy input buffer into output buffer */
10323 			if (invalp != outvalp) {
10324 				/* don't trust bcopy for identical src/dst */
10325 				bcopy(invalp, outvalp, inlen);
10326 			}
10327 			*outlenp = inlen;
10328 			return (0);
10329 		case IP_TOS:
10330 		case T_IP_TOS:
10331 			if (!checkonly) {
10332 				tcp->tcp_ipha->ipha_type_of_service =
10333 				    (uchar_t)*i1;
10334 				tcp->tcp_tos = (uchar_t)*i1;
10335 			}
10336 			break;
10337 		case IP_TTL:
10338 			if (!checkonly) {
10339 				tcp->tcp_ipha->ipha_ttl = (uchar_t)*i1;
10340 				tcp->tcp_ttl = (uchar_t)*i1;
10341 			}
10342 			break;
10343 		case IP_BOUND_IF:
10344 		case IP_NEXTHOP:
10345 			/* Handled at the IP level */
10346 			return (-EINVAL);
10347 		case IP_SEC_OPT:
10348 			/*
10349 			 * We should not allow policy setting after
10350 			 * we start listening for connections.
10351 			 */
10352 			if (tcp->tcp_state == TCPS_LISTEN) {
10353 				return (EINVAL);
10354 			} else {
10355 				/* Handled at the IP level */
10356 				return (-EINVAL);
10357 			}
10358 		default:
10359 			*outlenp = 0;
10360 			return (EINVAL);
10361 		}
10362 		break;
10363 	case IPPROTO_IPV6: {
10364 		ip6_pkt_t		*ipp;
10365 
10366 		/*
10367 		 * IPPROTO_IPV6 options are only supported for sockets
10368 		 * that are using IPv6 on the wire.
10369 		 */
10370 		if (tcp->tcp_ipversion != IPV6_VERSION) {
10371 			*outlenp = 0;
10372 			return (ENOPROTOOPT);
10373 		}
10374 		/*
10375 		 * Only sticky options; no ancillary data
10376 		 */
10377 		ASSERT(thisdg_attrs == NULL);
10378 		ipp = &tcp->tcp_sticky_ipp;
10379 
10380 		switch (name) {
10381 		case IPV6_UNICAST_HOPS:
10382 			/* -1 means use default */
10383 			if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) {
10384 				*outlenp = 0;
10385 				return (EINVAL);
10386 			}
10387 			if (!checkonly) {
10388 				if (*i1 == -1) {
10389 					tcp->tcp_ip6h->ip6_hops =
10390 					    ipp->ipp_unicast_hops =
10391 					    (uint8_t)tcp_ipv6_hoplimit;
10392 					ipp->ipp_fields &= ~IPPF_UNICAST_HOPS;
10393 					/* Pass modified value to IP. */
10394 					*i1 = tcp->tcp_ip6h->ip6_hops;
10395 				} else {
10396 					tcp->tcp_ip6h->ip6_hops =
10397 					    ipp->ipp_unicast_hops =
10398 					    (uint8_t)*i1;
10399 					ipp->ipp_fields |= IPPF_UNICAST_HOPS;
10400 				}
10401 				reterr = tcp_build_hdrs(q, tcp);
10402 				if (reterr != 0)
10403 					return (reterr);
10404 			}
10405 			break;
10406 		case IPV6_BOUND_IF:
10407 			if (!checkonly) {
10408 				int error = 0;
10409 
10410 				tcp->tcp_bound_if = *i1;
10411 				error = ip_opt_set_ill(tcp->tcp_connp, *i1,
10412 				    B_TRUE, checkonly, level, name, mblk);
10413 				if (error != 0) {
10414 					*outlenp = 0;
10415 					return (error);
10416 				}
10417 			}
10418 			break;
10419 		/*
10420 		 * Set boolean switches for ancillary data delivery
10421 		 */
10422 		case IPV6_RECVPKTINFO:
10423 			if (!checkonly) {
10424 				if (onoff)
10425 					tcp->tcp_ipv6_recvancillary |=
10426 					    TCP_IPV6_RECVPKTINFO;
10427 				else
10428 					tcp->tcp_ipv6_recvancillary &=
10429 					    ~TCP_IPV6_RECVPKTINFO;
10430 				/* Force it to be sent up with the next msg */
10431 				tcp->tcp_recvifindex = 0;
10432 			}
10433 			break;
10434 		case IPV6_RECVTCLASS:
10435 			if (!checkonly) {
10436 				if (onoff)
10437 					tcp->tcp_ipv6_recvancillary |=
10438 					    TCP_IPV6_RECVTCLASS;
10439 				else
10440 					tcp->tcp_ipv6_recvancillary &=
10441 					    ~TCP_IPV6_RECVTCLASS;
10442 			}
10443 			break;
10444 		case IPV6_RECVHOPLIMIT:
10445 			if (!checkonly) {
10446 				if (onoff)
10447 					tcp->tcp_ipv6_recvancillary |=
10448 					    TCP_IPV6_RECVHOPLIMIT;
10449 				else
10450 					tcp->tcp_ipv6_recvancillary &=
10451 					    ~TCP_IPV6_RECVHOPLIMIT;
10452 				/* Force it to be sent up with the next msg */
10453 				tcp->tcp_recvhops = 0xffffffffU;
10454 			}
10455 			break;
10456 		case IPV6_RECVHOPOPTS:
10457 			if (!checkonly) {
10458 				if (onoff)
10459 					tcp->tcp_ipv6_recvancillary |=
10460 					    TCP_IPV6_RECVHOPOPTS;
10461 				else
10462 					tcp->tcp_ipv6_recvancillary &=
10463 					    ~TCP_IPV6_RECVHOPOPTS;
10464 			}
10465 			break;
10466 		case IPV6_RECVDSTOPTS:
10467 			if (!checkonly) {
10468 				if (onoff)
10469 					tcp->tcp_ipv6_recvancillary |=
10470 					    TCP_IPV6_RECVDSTOPTS;
10471 				else
10472 					tcp->tcp_ipv6_recvancillary &=
10473 					    ~TCP_IPV6_RECVDSTOPTS;
10474 			}
10475 			break;
10476 		case _OLD_IPV6_RECVDSTOPTS:
10477 			if (!checkonly) {
10478 				if (onoff)
10479 					tcp->tcp_ipv6_recvancillary |=
10480 					    TCP_OLD_IPV6_RECVDSTOPTS;
10481 				else
10482 					tcp->tcp_ipv6_recvancillary &=
10483 					    ~TCP_OLD_IPV6_RECVDSTOPTS;
10484 			}
10485 			break;
10486 		case IPV6_RECVRTHDR:
10487 			if (!checkonly) {
10488 				if (onoff)
10489 					tcp->tcp_ipv6_recvancillary |=
10490 					    TCP_IPV6_RECVRTHDR;
10491 				else
10492 					tcp->tcp_ipv6_recvancillary &=
10493 					    ~TCP_IPV6_RECVRTHDR;
10494 			}
10495 			break;
10496 		case IPV6_RECVRTHDRDSTOPTS:
10497 			if (!checkonly) {
10498 				if (onoff)
10499 					tcp->tcp_ipv6_recvancillary |=
10500 					    TCP_IPV6_RECVRTDSTOPTS;
10501 				else
10502 					tcp->tcp_ipv6_recvancillary &=
10503 					    ~TCP_IPV6_RECVRTDSTOPTS;
10504 			}
10505 			break;
10506 		case IPV6_PKTINFO:
10507 			if (inlen != 0 && inlen != sizeof (struct in6_pktinfo))
10508 				return (EINVAL);
10509 			if (checkonly)
10510 				break;
10511 
10512 			if (inlen == 0) {
10513 				ipp->ipp_fields &= ~(IPPF_IFINDEX|IPPF_ADDR);
10514 			} else {
10515 				struct in6_pktinfo *pkti;
10516 
10517 				pkti = (struct in6_pktinfo *)invalp;
10518 				/*
10519 				 * RFC 3542 states that ipi6_addr must be
10520 				 * the unspecified address when setting the
10521 				 * IPV6_PKTINFO sticky socket option on a
10522 				 * TCP socket.
10523 				 */
10524 				if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr))
10525 					return (EINVAL);
10526 				/*
10527 				 * ip6_set_pktinfo() validates the source
10528 				 * address and interface index.
10529 				 */
10530 				reterr = ip6_set_pktinfo(cr, tcp->tcp_connp,
10531 				    pkti, mblk);
10532 				if (reterr != 0)
10533 					return (reterr);
10534 				ipp->ipp_ifindex = pkti->ipi6_ifindex;
10535 				ipp->ipp_addr = pkti->ipi6_addr;
10536 				if (ipp->ipp_ifindex != 0)
10537 					ipp->ipp_fields |= IPPF_IFINDEX;
10538 				else
10539 					ipp->ipp_fields &= ~IPPF_IFINDEX;
10540 				if (!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr))
10541 					ipp->ipp_fields |= IPPF_ADDR;
10542 				else
10543 					ipp->ipp_fields &= ~IPPF_ADDR;
10544 			}
10545 			reterr = tcp_build_hdrs(q, tcp);
10546 			if (reterr != 0)
10547 				return (reterr);
10548 			break;
10549 		case IPV6_TCLASS:
10550 			if (inlen != 0 && inlen != sizeof (int))
10551 				return (EINVAL);
10552 			if (checkonly)
10553 				break;
10554 
10555 			if (inlen == 0) {
10556 				ipp->ipp_fields &= ~IPPF_TCLASS;
10557 			} else {
10558 				if (*i1 > 255 || *i1 < -1)
10559 					return (EINVAL);
10560 				if (*i1 == -1) {
10561 					ipp->ipp_tclass = 0;
10562 					*i1 = 0;
10563 				} else {
10564 					ipp->ipp_tclass = *i1;
10565 				}
10566 				ipp->ipp_fields |= IPPF_TCLASS;
10567 			}
10568 			reterr = tcp_build_hdrs(q, tcp);
10569 			if (reterr != 0)
10570 				return (reterr);
10571 			break;
10572 		case IPV6_NEXTHOP:
10573 			/*
10574 			 * IP will verify that the nexthop is reachable
10575 			 * and fail for sticky options.
10576 			 */
10577 			if (inlen != 0 && inlen != sizeof (sin6_t))
10578 				return (EINVAL);
10579 			if (checkonly)
10580 				break;
10581 
10582 			if (inlen == 0) {
10583 				ipp->ipp_fields &= ~IPPF_NEXTHOP;
10584 			} else {
10585 				sin6_t *sin6 = (sin6_t *)invalp;
10586 
10587 				if (sin6->sin6_family != AF_INET6)
10588 					return (EAFNOSUPPORT);
10589 				if (IN6_IS_ADDR_V4MAPPED(
10590 				    &sin6->sin6_addr))
10591 					return (EADDRNOTAVAIL);
10592 				ipp->ipp_nexthop = sin6->sin6_addr;
10593 				if (!IN6_IS_ADDR_UNSPECIFIED(
10594 				    &ipp->ipp_nexthop))
10595 					ipp->ipp_fields |= IPPF_NEXTHOP;
10596 				else
10597 					ipp->ipp_fields &= ~IPPF_NEXTHOP;
10598 			}
10599 			reterr = tcp_build_hdrs(q, tcp);
10600 			if (reterr != 0)
10601 				return (reterr);
10602 			break;
10603 		case IPV6_HOPOPTS: {
10604 			ip6_hbh_t *hopts = (ip6_hbh_t *)invalp;
10605 
10606 			/*
10607 			 * Sanity checks - minimum size, size a multiple of
10608 			 * eight bytes, and matching size passed in.
10609 			 */
10610 			if (inlen != 0 &&
10611 			    inlen != (8 * (hopts->ip6h_len + 1)))
10612 				return (EINVAL);
10613 
10614 			if (checkonly)
10615 				break;
10616 
10617 			reterr = optcom_pkt_set(invalp, inlen, B_TRUE,
10618 			    (uchar_t **)&ipp->ipp_hopopts,
10619 			    &ipp->ipp_hopoptslen, tcp->tcp_label_len);
10620 			if (reterr != 0)
10621 				return (reterr);
10622 			if (ipp->ipp_hopoptslen == 0)
10623 				ipp->ipp_fields &= ~IPPF_HOPOPTS;
10624 			else
10625 				ipp->ipp_fields |= IPPF_HOPOPTS;
10626 			reterr = tcp_build_hdrs(q, tcp);
10627 			if (reterr != 0)
10628 				return (reterr);
10629 			break;
10630 		}
10631 		case IPV6_RTHDRDSTOPTS: {
10632 			ip6_dest_t *dopts = (ip6_dest_t *)invalp;
10633 
10634 			/*
10635 			 * Sanity checks - minimum size, size a multiple of
10636 			 * eight bytes, and matching size passed in.
10637 			 */
10638 			if (inlen != 0 &&
10639 			    inlen != (8 * (dopts->ip6d_len + 1)))
10640 				return (EINVAL);
10641 
10642 			if (checkonly)
10643 				break;
10644 
10645 			reterr = optcom_pkt_set(invalp, inlen, B_TRUE,
10646 			    (uchar_t **)&ipp->ipp_rtdstopts,
10647 			    &ipp->ipp_rtdstoptslen, 0);
10648 			if (reterr != 0)
10649 				return (reterr);
10650 			if (ipp->ipp_rtdstoptslen == 0)
10651 				ipp->ipp_fields &= ~IPPF_RTDSTOPTS;
10652 			else
10653 				ipp->ipp_fields |= IPPF_RTDSTOPTS;
10654 			reterr = tcp_build_hdrs(q, tcp);
10655 			if (reterr != 0)
10656 				return (reterr);
10657 			break;
10658 		}
10659 		case IPV6_DSTOPTS: {
10660 			ip6_dest_t *dopts = (ip6_dest_t *)invalp;
10661 
10662 			/*
10663 			 * Sanity checks - minimum size, size a multiple of
10664 			 * eight bytes, and matching size passed in.
10665 			 */
10666 			if (inlen != 0 &&
10667 			    inlen != (8 * (dopts->ip6d_len + 1)))
10668 				return (EINVAL);
10669 
10670 			if (checkonly)
10671 				break;
10672 
10673 			reterr = optcom_pkt_set(invalp, inlen, B_TRUE,
10674 			    (uchar_t **)&ipp->ipp_dstopts,
10675 			    &ipp->ipp_dstoptslen, 0);
10676 			if (reterr != 0)
10677 				return (reterr);
10678 			if (ipp->ipp_dstoptslen == 0)
10679 				ipp->ipp_fields &= ~IPPF_DSTOPTS;
10680 			else
10681 				ipp->ipp_fields |= IPPF_DSTOPTS;
10682 			reterr = tcp_build_hdrs(q, tcp);
10683 			if (reterr != 0)
10684 				return (reterr);
10685 			break;
10686 		}
10687 		case IPV6_RTHDR: {
10688 			ip6_rthdr_t *rt = (ip6_rthdr_t *)invalp;
10689 
10690 			/*
10691 			 * Sanity checks - minimum size, size a multiple of
10692 			 * eight bytes, and matching size passed in.
10693 			 */
10694 			if (inlen != 0 &&
10695 			    inlen != (8 * (rt->ip6r_len + 1)))
10696 				return (EINVAL);
10697 
10698 			if (checkonly)
10699 				break;
10700 
10701 			reterr = optcom_pkt_set(invalp, inlen, B_TRUE,
10702 			    (uchar_t **)&ipp->ipp_rthdr,
10703 			    &ipp->ipp_rthdrlen, 0);
10704 			if (reterr != 0)
10705 				return (reterr);
10706 			if (ipp->ipp_rthdrlen == 0)
10707 				ipp->ipp_fields &= ~IPPF_RTHDR;
10708 			else
10709 				ipp->ipp_fields |= IPPF_RTHDR;
10710 			reterr = tcp_build_hdrs(q, tcp);
10711 			if (reterr != 0)
10712 				return (reterr);
10713 			break;
10714 		}
10715 		case IPV6_V6ONLY:
10716 			if (!checkonly)
10717 				tcp->tcp_connp->conn_ipv6_v6only = onoff;
10718 			break;
10719 		case IPV6_USE_MIN_MTU:
10720 			if (inlen != sizeof (int))
10721 				return (EINVAL);
10722 
10723 			if (*i1 < -1 || *i1 > 1)
10724 				return (EINVAL);
10725 
10726 			if (checkonly)
10727 				break;
10728 
10729 			ipp->ipp_fields |= IPPF_USE_MIN_MTU;
10730 			ipp->ipp_use_min_mtu = *i1;
10731 			break;
10732 		case IPV6_BOUND_PIF:
10733 			/* Handled at the IP level */
10734 			return (-EINVAL);
10735 		case IPV6_SEC_OPT:
10736 			/*
10737 			 * We should not allow policy setting after
10738 			 * we start listening for connections.
10739 			 */
10740 			if (tcp->tcp_state == TCPS_LISTEN) {
10741 				return (EINVAL);
10742 			} else {
10743 				/* Handled at the IP level */
10744 				return (-EINVAL);
10745 			}
10746 		case IPV6_SRC_PREFERENCES:
10747 			if (inlen != sizeof (uint32_t))
10748 				return (EINVAL);
10749 			reterr = ip6_set_src_preferences(tcp->tcp_connp,
10750 			    *(uint32_t *)invalp);
10751 			if (reterr != 0) {
10752 				*outlenp = 0;
10753 				return (reterr);
10754 			}
10755 			break;
10756 		default:
10757 			*outlenp = 0;
10758 			return (EINVAL);
10759 		}
10760 		break;
10761 	}		/* end IPPROTO_IPV6 */
10762 	default:
10763 		*outlenp = 0;
10764 		return (EINVAL);
10765 	}
10766 	/*
10767 	 * Common case of OK return with outval same as inval
10768 	 */
10769 	if (invalp != outvalp) {
10770 		/* don't trust bcopy for identical src/dst */
10771 		(void) bcopy(invalp, outvalp, inlen);
10772 	}
10773 	*outlenp = inlen;
10774 	return (0);
10775 }
10776 
10777 /*
10778  * Update tcp_sticky_hdrs based on tcp_sticky_ipp.
10779  * The headers include ip6i_t (if needed), ip6_t, any sticky extension
10780  * headers, and the maximum size tcp header (to avoid reallocation
10781  * on the fly for additional tcp options).
10782  * Returns failure if can't allocate memory.
10783  */
10784 static int
10785 tcp_build_hdrs(queue_t *q, tcp_t *tcp)
10786 {
10787 	char	*hdrs;
10788 	uint_t	hdrs_len;
10789 	ip6i_t	*ip6i;
10790 	char	buf[TCP_MAX_HDR_LENGTH];
10791 	ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp;
10792 	in6_addr_t src, dst;
10793 
10794 	/*
10795 	 * save the existing tcp header and source/dest IP addresses
10796 	 */
10797 	bcopy(tcp->tcp_tcph, buf, tcp->tcp_tcp_hdr_len);
10798 	src = tcp->tcp_ip6h->ip6_src;
10799 	dst = tcp->tcp_ip6h->ip6_dst;
10800 	hdrs_len = ip_total_hdrs_len_v6(ipp) + TCP_MAX_HDR_LENGTH;
10801 	ASSERT(hdrs_len != 0);
10802 	if (hdrs_len > tcp->tcp_iphc_len) {
10803 		/* Need to reallocate */
10804 		hdrs = kmem_zalloc(hdrs_len, KM_NOSLEEP);
10805 		if (hdrs == NULL)
10806 			return (ENOMEM);
10807 		if (tcp->tcp_iphc != NULL) {
10808 			if (tcp->tcp_hdr_grown) {
10809 				kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len);
10810 			} else {
10811 				bzero(tcp->tcp_iphc, tcp->tcp_iphc_len);
10812 				kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc);
10813 			}
10814 			tcp->tcp_iphc_len = 0;
10815 		}
10816 		ASSERT(tcp->tcp_iphc_len == 0);
10817 		tcp->tcp_iphc = hdrs;
10818 		tcp->tcp_iphc_len = hdrs_len;
10819 		tcp->tcp_hdr_grown = B_TRUE;
10820 	}
10821 	ip_build_hdrs_v6((uchar_t *)tcp->tcp_iphc,
10822 	    hdrs_len - TCP_MAX_HDR_LENGTH, ipp, IPPROTO_TCP);
10823 
10824 	/* Set header fields not in ipp */
10825 	if (ipp->ipp_fields & IPPF_HAS_IP6I) {
10826 		ip6i = (ip6i_t *)tcp->tcp_iphc;
10827 		tcp->tcp_ip6h = (ip6_t *)&ip6i[1];
10828 	} else {
10829 		tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc;
10830 	}
10831 	/*
10832 	 * tcp->tcp_ip_hdr_len will include ip6i_t if there is one.
10833 	 *
10834 	 * tcp->tcp_tcp_hdr_len doesn't change here.
10835 	 */
10836 	tcp->tcp_ip_hdr_len = hdrs_len - TCP_MAX_HDR_LENGTH;
10837 	tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + tcp->tcp_ip_hdr_len);
10838 	tcp->tcp_hdr_len = tcp->tcp_ip_hdr_len + tcp->tcp_tcp_hdr_len;
10839 
10840 	bcopy(buf, tcp->tcp_tcph, tcp->tcp_tcp_hdr_len);
10841 
10842 	tcp->tcp_ip6h->ip6_src = src;
10843 	tcp->tcp_ip6h->ip6_dst = dst;
10844 
10845 	/*
10846 	 * If the hop limit was not set by ip_build_hdrs_v6(), set it to
10847 	 * the default value for TCP.
10848 	 */
10849 	if (!(ipp->ipp_fields & IPPF_UNICAST_HOPS))
10850 		tcp->tcp_ip6h->ip6_hops = tcp_ipv6_hoplimit;
10851 
10852 	/*
10853 	 * If we're setting extension headers after a connection
10854 	 * has been established, and if we have a routing header
10855 	 * among the extension headers, call ip_massage_options_v6 to
10856 	 * manipulate the routing header/ip6_dst set the checksum
10857 	 * difference in the tcp header template.
10858 	 * (This happens in tcp_connect_ipv6 if the routing header
10859 	 * is set prior to the connect.)
10860 	 * Set the tcp_sum to zero first in case we've cleared a
10861 	 * routing header or don't have one at all.
10862 	 */
10863 	tcp->tcp_sum = 0;
10864 	if ((tcp->tcp_state >= TCPS_SYN_SENT) &&
10865 	    (tcp->tcp_ipp_fields & IPPF_RTHDR)) {
10866 		ip6_rthdr_t *rth = ip_find_rthdr_v6(tcp->tcp_ip6h,
10867 		    (uint8_t *)tcp->tcp_tcph);
10868 		if (rth != NULL) {
10869 			tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h,
10870 			    rth);
10871 			tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) +
10872 			    (tcp->tcp_sum >> 16));
10873 		}
10874 	}
10875 
10876 	/* Try to get everything in a single mblk */
10877 	(void) mi_set_sth_wroff(RD(q), hdrs_len + tcp_wroff_xtra);
10878 	return (0);
10879 }
10880 
10881 /*
10882  * Transfer any source route option from ipha to buf/dst in reversed form.
10883  */
10884 static int
10885 tcp_opt_rev_src_route(ipha_t *ipha, char *buf, uchar_t *dst)
10886 {
10887 	ipoptp_t	opts;
10888 	uchar_t		*opt;
10889 	uint8_t		optval;
10890 	uint8_t		optlen;
10891 	uint32_t	len = 0;
10892 
10893 	for (optval = ipoptp_first(&opts, ipha);
10894 	    optval != IPOPT_EOL;
10895 	    optval = ipoptp_next(&opts)) {
10896 		opt = opts.ipoptp_cur;
10897 		optlen = opts.ipoptp_len;
10898 		switch (optval) {
10899 			int	off1, off2;
10900 		case IPOPT_SSRR:
10901 		case IPOPT_LSRR:
10902 
10903 			/* Reverse source route */
10904 			/*
10905 			 * First entry should be the next to last one in the
10906 			 * current source route (the last entry is our
10907 			 * address.)
10908 			 * The last entry should be the final destination.
10909 			 */
10910 			buf[IPOPT_OPTVAL] = (uint8_t)optval;
10911 			buf[IPOPT_OLEN] = (uint8_t)optlen;
10912 			off1 = IPOPT_MINOFF_SR - 1;
10913 			off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1;
10914 			if (off2 < 0) {
10915 				/* No entries in source route */
10916 				break;
10917 			}
10918 			bcopy(opt + off2, dst, IP_ADDR_LEN);
10919 			/*
10920 			 * Note: use src since ipha has not had its src
10921 			 * and dst reversed (it is in the state it was
10922 			 * received.
10923 			 */
10924 			bcopy(&ipha->ipha_src, buf + off2,
10925 			    IP_ADDR_LEN);
10926 			off2 -= IP_ADDR_LEN;
10927 
10928 			while (off2 > 0) {
10929 				bcopy(opt + off2, buf + off1,
10930 				    IP_ADDR_LEN);
10931 				off1 += IP_ADDR_LEN;
10932 				off2 -= IP_ADDR_LEN;
10933 			}
10934 			buf[IPOPT_OFFSET] = IPOPT_MINOFF_SR;
10935 			buf += optlen;
10936 			len += optlen;
10937 			break;
10938 		}
10939 	}
10940 done:
10941 	/* Pad the resulting options */
10942 	while (len & 0x3) {
10943 		*buf++ = IPOPT_EOL;
10944 		len++;
10945 	}
10946 	return (len);
10947 }
10948 
10949 
10950 /*
10951  * Extract and revert a source route from ipha (if any)
10952  * and then update the relevant fields in both tcp_t and the standard header.
10953  */
10954 static void
10955 tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha)
10956 {
10957 	char	buf[TCP_MAX_HDR_LENGTH];
10958 	uint_t	tcph_len;
10959 	int	len;
10960 
10961 	ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION);
10962 	len = IPH_HDR_LENGTH(ipha);
10963 	if (len == IP_SIMPLE_HDR_LENGTH)
10964 		/* Nothing to do */
10965 		return;
10966 	if (len > IP_SIMPLE_HDR_LENGTH + TCP_MAX_IP_OPTIONS_LENGTH ||
10967 	    (len & 0x3))
10968 		return;
10969 
10970 	tcph_len = tcp->tcp_tcp_hdr_len;
10971 	bcopy(tcp->tcp_tcph, buf, tcph_len);
10972 	tcp->tcp_sum = (tcp->tcp_ipha->ipha_dst >> 16) +
10973 		(tcp->tcp_ipha->ipha_dst & 0xffff);
10974 	len = tcp_opt_rev_src_route(ipha, (char *)tcp->tcp_ipha +
10975 	    IP_SIMPLE_HDR_LENGTH, (uchar_t *)&tcp->tcp_ipha->ipha_dst);
10976 	len += IP_SIMPLE_HDR_LENGTH;
10977 	tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) +
10978 	    (tcp->tcp_ipha->ipha_dst & 0xffff));
10979 	if ((int)tcp->tcp_sum < 0)
10980 		tcp->tcp_sum--;
10981 	tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16);
10982 	tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16));
10983 	tcp->tcp_tcph = (tcph_t *)((char *)tcp->tcp_ipha + len);
10984 	bcopy(buf, tcp->tcp_tcph, tcph_len);
10985 	tcp->tcp_ip_hdr_len = len;
10986 	tcp->tcp_ipha->ipha_version_and_hdr_length =
10987 	    (IP_VERSION << 4) | (len >> 2);
10988 	len += tcph_len;
10989 	tcp->tcp_hdr_len = len;
10990 }
10991 
10992 /*
10993  * Copy the standard header into its new location,
10994  * lay in the new options and then update the relevant
10995  * fields in both tcp_t and the standard header.
10996  */
10997 static int
10998 tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, uchar_t *ptr, uint_t len)
10999 {
11000 	uint_t	tcph_len;
11001 	uint8_t	*ip_optp;
11002 	tcph_t	*new_tcph;
11003 
11004 	if ((len > TCP_MAX_IP_OPTIONS_LENGTH) || (len & 0x3))
11005 		return (EINVAL);
11006 
11007 	if (len > IP_MAX_OPT_LENGTH - tcp->tcp_label_len)
11008 		return (EINVAL);
11009 
11010 	if (checkonly) {
11011 		/*
11012 		 * do not really set, just pretend to - T_CHECK
11013 		 */
11014 		return (0);
11015 	}
11016 
11017 	ip_optp = (uint8_t *)tcp->tcp_ipha + IP_SIMPLE_HDR_LENGTH;
11018 	if (tcp->tcp_label_len > 0) {
11019 		int padlen;
11020 		uint8_t opt;
11021 
11022 		/* convert list termination to no-ops */
11023 		padlen = tcp->tcp_label_len - ip_optp[IPOPT_OLEN];
11024 		ip_optp += ip_optp[IPOPT_OLEN];
11025 		opt = len > 0 ? IPOPT_NOP : IPOPT_EOL;
11026 		while (--padlen >= 0)
11027 			*ip_optp++ = opt;
11028 	}
11029 	tcph_len = tcp->tcp_tcp_hdr_len;
11030 	new_tcph = (tcph_t *)(ip_optp + len);
11031 	ovbcopy(tcp->tcp_tcph, new_tcph, tcph_len);
11032 	tcp->tcp_tcph = new_tcph;
11033 	bcopy(ptr, ip_optp, len);
11034 
11035 	len += IP_SIMPLE_HDR_LENGTH + tcp->tcp_label_len;
11036 
11037 	tcp->tcp_ip_hdr_len = len;
11038 	tcp->tcp_ipha->ipha_version_and_hdr_length =
11039 	    (IP_VERSION << 4) | (len >> 2);
11040 	tcp->tcp_hdr_len = len + tcph_len;
11041 	if (!TCP_IS_DETACHED(tcp)) {
11042 		/* Always allocate room for all options. */
11043 		(void) mi_set_sth_wroff(tcp->tcp_rq,
11044 		    TCP_MAX_COMBINED_HEADER_LENGTH + tcp_wroff_xtra);
11045 	}
11046 	return (0);
11047 }
11048 
11049 /* Get callback routine passed to nd_load by tcp_param_register */
11050 /* ARGSUSED */
11051 static int
11052 tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
11053 {
11054 	tcpparam_t	*tcppa = (tcpparam_t *)cp;
11055 
11056 	(void) mi_mpprintf(mp, "%u", tcppa->tcp_param_val);
11057 	return (0);
11058 }
11059 
11060 /*
11061  * Walk through the param array specified registering each element with the
11062  * named dispatch handler.
11063  */
11064 static boolean_t
11065 tcp_param_register(tcpparam_t *tcppa, int cnt)
11066 {
11067 	for (; cnt-- > 0; tcppa++) {
11068 		if (tcppa->tcp_param_name && tcppa->tcp_param_name[0]) {
11069 			if (!nd_load(&tcp_g_nd, tcppa->tcp_param_name,
11070 			    tcp_param_get, tcp_param_set,
11071 			    (caddr_t)tcppa)) {
11072 				nd_free(&tcp_g_nd);
11073 				return (B_FALSE);
11074 			}
11075 		}
11076 	}
11077 	if (!nd_load(&tcp_g_nd, tcp_wroff_xtra_param.tcp_param_name,
11078 	    tcp_param_get, tcp_param_set_aligned,
11079 	    (caddr_t)&tcp_wroff_xtra_param)) {
11080 		nd_free(&tcp_g_nd);
11081 		return (B_FALSE);
11082 	}
11083 	if (!nd_load(&tcp_g_nd, tcp_mdt_head_param.tcp_param_name,
11084 	    tcp_param_get, tcp_param_set_aligned,
11085 	    (caddr_t)&tcp_mdt_head_param)) {
11086 		nd_free(&tcp_g_nd);
11087 		return (B_FALSE);
11088 	}
11089 	if (!nd_load(&tcp_g_nd, tcp_mdt_tail_param.tcp_param_name,
11090 	    tcp_param_get, tcp_param_set_aligned,
11091 	    (caddr_t)&tcp_mdt_tail_param)) {
11092 		nd_free(&tcp_g_nd);
11093 		return (B_FALSE);
11094 	}
11095 	if (!nd_load(&tcp_g_nd, tcp_mdt_max_pbufs_param.tcp_param_name,
11096 	    tcp_param_get, tcp_param_set,
11097 	    (caddr_t)&tcp_mdt_max_pbufs_param)) {
11098 		nd_free(&tcp_g_nd);
11099 		return (B_FALSE);
11100 	}
11101 	if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports",
11102 	    tcp_extra_priv_ports_get, NULL, NULL)) {
11103 		nd_free(&tcp_g_nd);
11104 		return (B_FALSE);
11105 	}
11106 	if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports_add",
11107 	    NULL, tcp_extra_priv_ports_add, NULL)) {
11108 		nd_free(&tcp_g_nd);
11109 		return (B_FALSE);
11110 	}
11111 	if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports_del",
11112 	    NULL, tcp_extra_priv_ports_del, NULL)) {
11113 		nd_free(&tcp_g_nd);
11114 		return (B_FALSE);
11115 	}
11116 	if (!nd_load(&tcp_g_nd, "tcp_status", tcp_status_report, NULL,
11117 	    NULL)) {
11118 		nd_free(&tcp_g_nd);
11119 		return (B_FALSE);
11120 	}
11121 	if (!nd_load(&tcp_g_nd, "tcp_bind_hash", tcp_bind_hash_report,
11122 	    NULL, NULL)) {
11123 		nd_free(&tcp_g_nd);
11124 		return (B_FALSE);
11125 	}
11126 	if (!nd_load(&tcp_g_nd, "tcp_listen_hash", tcp_listen_hash_report,
11127 	    NULL, NULL)) {
11128 		nd_free(&tcp_g_nd);
11129 		return (B_FALSE);
11130 	}
11131 	if (!nd_load(&tcp_g_nd, "tcp_conn_hash", tcp_conn_hash_report,
11132 	    NULL, NULL)) {
11133 		nd_free(&tcp_g_nd);
11134 		return (B_FALSE);
11135 	}
11136 	if (!nd_load(&tcp_g_nd, "tcp_acceptor_hash", tcp_acceptor_hash_report,
11137 	    NULL, NULL)) {
11138 		nd_free(&tcp_g_nd);
11139 		return (B_FALSE);
11140 	}
11141 	if (!nd_load(&tcp_g_nd, "tcp_host_param", tcp_host_param_report,
11142 	    tcp_host_param_set, NULL)) {
11143 		nd_free(&tcp_g_nd);
11144 		return (B_FALSE);
11145 	}
11146 	if (!nd_load(&tcp_g_nd, "tcp_host_param_ipv6", tcp_host_param_report,
11147 	    tcp_host_param_set_ipv6, NULL)) {
11148 		nd_free(&tcp_g_nd);
11149 		return (B_FALSE);
11150 	}
11151 	if (!nd_load(&tcp_g_nd, "tcp_1948_phrase", NULL, tcp_1948_phrase_set,
11152 	    NULL)) {
11153 		nd_free(&tcp_g_nd);
11154 		return (B_FALSE);
11155 	}
11156 	if (!nd_load(&tcp_g_nd, "tcp_reserved_port_list",
11157 	    tcp_reserved_port_list, NULL, NULL)) {
11158 		nd_free(&tcp_g_nd);
11159 		return (B_FALSE);
11160 	}
11161 	/*
11162 	 * Dummy ndd variables - only to convey obsolescence information
11163 	 * through printing of their name (no get or set routines)
11164 	 * XXX Remove in future releases ?
11165 	 */
11166 	if (!nd_load(&tcp_g_nd,
11167 	    "tcp_close_wait_interval(obsoleted - "
11168 	    "use tcp_time_wait_interval)", NULL, NULL, NULL)) {
11169 		nd_free(&tcp_g_nd);
11170 		return (B_FALSE);
11171 	}
11172 	return (B_TRUE);
11173 }
11174 
11175 /* ndd set routine for tcp_wroff_xtra, tcp_mdt_hdr_{head,tail}_min. */
11176 /* ARGSUSED */
11177 static int
11178 tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
11179     cred_t *cr)
11180 {
11181 	long new_value;
11182 	tcpparam_t *tcppa = (tcpparam_t *)cp;
11183 
11184 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
11185 	    new_value < tcppa->tcp_param_min ||
11186 	    new_value > tcppa->tcp_param_max) {
11187 		return (EINVAL);
11188 	}
11189 	/*
11190 	 * Need to make sure new_value is a multiple of 4.  If it is not,
11191 	 * round it up.  For future 64 bit requirement, we actually make it
11192 	 * a multiple of 8.
11193 	 */
11194 	if (new_value & 0x7) {
11195 		new_value = (new_value & ~0x7) + 0x8;
11196 	}
11197 	tcppa->tcp_param_val = new_value;
11198 	return (0);
11199 }
11200 
11201 /* Set callback routine passed to nd_load by tcp_param_register */
11202 /* ARGSUSED */
11203 static int
11204 tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr)
11205 {
11206 	long	new_value;
11207 	tcpparam_t	*tcppa = (tcpparam_t *)cp;
11208 
11209 	if (ddi_strtol(value, NULL, 10, &new_value) != 0 ||
11210 	    new_value < tcppa->tcp_param_min ||
11211 	    new_value > tcppa->tcp_param_max) {
11212 		return (EINVAL);
11213 	}
11214 	tcppa->tcp_param_val = new_value;
11215 	return (0);
11216 }
11217 
11218 /*
11219  * Add a new piece to the tcp reassembly queue.  If the gap at the beginning
11220  * is filled, return as much as we can.  The message passed in may be
11221  * multi-part, chained using b_cont.  "start" is the starting sequence
11222  * number for this piece.
11223  */
11224 static mblk_t *
11225 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
11226 {
11227 	uint32_t	end;
11228 	mblk_t		*mp1;
11229 	mblk_t		*mp2;
11230 	mblk_t		*next_mp;
11231 	uint32_t	u1;
11232 
11233 	/* Walk through all the new pieces. */
11234 	do {
11235 		ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
11236 		    (uintptr_t)INT_MAX);
11237 		end = start + (int)(mp->b_wptr - mp->b_rptr);
11238 		next_mp = mp->b_cont;
11239 		if (start == end) {
11240 			/* Empty.  Blast it. */
11241 			freeb(mp);
11242 			continue;
11243 		}
11244 		mp->b_cont = NULL;
11245 		TCP_REASS_SET_SEQ(mp, start);
11246 		TCP_REASS_SET_END(mp, end);
11247 		mp1 = tcp->tcp_reass_tail;
11248 		if (!mp1) {
11249 			tcp->tcp_reass_tail = mp;
11250 			tcp->tcp_reass_head = mp;
11251 			BUMP_MIB(&tcp_mib, tcpInDataUnorderSegs);
11252 			UPDATE_MIB(&tcp_mib,
11253 			    tcpInDataUnorderBytes, end - start);
11254 			continue;
11255 		}
11256 		/* New stuff completely beyond tail? */
11257 		if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
11258 			/* Link it on end. */
11259 			mp1->b_cont = mp;
11260 			tcp->tcp_reass_tail = mp;
11261 			BUMP_MIB(&tcp_mib, tcpInDataUnorderSegs);
11262 			UPDATE_MIB(&tcp_mib,
11263 			    tcpInDataUnorderBytes, end - start);
11264 			continue;
11265 		}
11266 		mp1 = tcp->tcp_reass_head;
11267 		u1 = TCP_REASS_SEQ(mp1);
11268 		/* New stuff at the front? */
11269 		if (SEQ_LT(start, u1)) {
11270 			/* Yes... Check for overlap. */
11271 			mp->b_cont = mp1;
11272 			tcp->tcp_reass_head = mp;
11273 			tcp_reass_elim_overlap(tcp, mp);
11274 			continue;
11275 		}
11276 		/*
11277 		 * The new piece fits somewhere between the head and tail.
11278 		 * We find our slot, where mp1 precedes us and mp2 trails.
11279 		 */
11280 		for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
11281 			u1 = TCP_REASS_SEQ(mp2);
11282 			if (SEQ_LEQ(start, u1))
11283 				break;
11284 		}
11285 		/* Link ourselves in */
11286 		mp->b_cont = mp2;
11287 		mp1->b_cont = mp;
11288 
11289 		/* Trim overlap with following mblk(s) first */
11290 		tcp_reass_elim_overlap(tcp, mp);
11291 
11292 		/* Trim overlap with preceding mblk */
11293 		tcp_reass_elim_overlap(tcp, mp1);
11294 
11295 	} while (start = end, mp = next_mp);
11296 	mp1 = tcp->tcp_reass_head;
11297 	/* Anything ready to go? */
11298 	if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
11299 		return (NULL);
11300 	/* Eat what we can off the queue */
11301 	for (;;) {
11302 		mp = mp1->b_cont;
11303 		end = TCP_REASS_END(mp1);
11304 		TCP_REASS_SET_SEQ(mp1, 0);
11305 		TCP_REASS_SET_END(mp1, 0);
11306 		if (!mp) {
11307 			tcp->tcp_reass_tail = NULL;
11308 			break;
11309 		}
11310 		if (end != TCP_REASS_SEQ(mp)) {
11311 			mp1->b_cont = NULL;
11312 			break;
11313 		}
11314 		mp1 = mp;
11315 	}
11316 	mp1 = tcp->tcp_reass_head;
11317 	tcp->tcp_reass_head = mp;
11318 	return (mp1);
11319 }
11320 
11321 /* Eliminate any overlap that mp may have over later mblks */
11322 static void
11323 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
11324 {
11325 	uint32_t	end;
11326 	mblk_t		*mp1;
11327 	uint32_t	u1;
11328 
11329 	end = TCP_REASS_END(mp);
11330 	while ((mp1 = mp->b_cont) != NULL) {
11331 		u1 = TCP_REASS_SEQ(mp1);
11332 		if (!SEQ_GT(end, u1))
11333 			break;
11334 		if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
11335 			mp->b_wptr -= end - u1;
11336 			TCP_REASS_SET_END(mp, u1);
11337 			BUMP_MIB(&tcp_mib, tcpInDataPartDupSegs);
11338 			UPDATE_MIB(&tcp_mib, tcpInDataPartDupBytes, end - u1);
11339 			break;
11340 		}
11341 		mp->b_cont = mp1->b_cont;
11342 		TCP_REASS_SET_SEQ(mp1, 0);
11343 		TCP_REASS_SET_END(mp1, 0);
11344 		freeb(mp1);
11345 		BUMP_MIB(&tcp_mib, tcpInDataDupSegs);
11346 		UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, end - u1);
11347 	}
11348 	if (!mp1)
11349 		tcp->tcp_reass_tail = mp;
11350 }
11351 
11352 /*
11353  * Send up all messages queued on tcp_rcv_list.
11354  */
11355 static uint_t
11356 tcp_rcv_drain(queue_t *q, tcp_t *tcp)
11357 {
11358 	mblk_t *mp;
11359 	uint_t ret = 0;
11360 	uint_t thwin;
11361 #ifdef DEBUG
11362 	uint_t cnt = 0;
11363 #endif
11364 	/* Can't drain on an eager connection */
11365 	if (tcp->tcp_listener != NULL)
11366 		return (ret);
11367 
11368 	/*
11369 	 * Handle two cases here: we are currently fused or we were
11370 	 * previously fused and have some urgent data to be delivered
11371 	 * upstream.  The latter happens because we either ran out of
11372 	 * memory or were detached and therefore sending the SIGURG was
11373 	 * deferred until this point.  In either case we pass control
11374 	 * over to tcp_fuse_rcv_drain() since it may need to complete
11375 	 * some work.
11376 	 */
11377 	if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
11378 		ASSERT(tcp->tcp_fused_sigurg_mp != NULL);
11379 		if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
11380 		    &tcp->tcp_fused_sigurg_mp))
11381 			return (ret);
11382 	}
11383 
11384 	while ((mp = tcp->tcp_rcv_list) != NULL) {
11385 		tcp->tcp_rcv_list = mp->b_next;
11386 		mp->b_next = NULL;
11387 #ifdef DEBUG
11388 		cnt += msgdsize(mp);
11389 #endif
11390 		/* Does this need SSL processing first? */
11391 		if ((tcp->tcp_kssl_ctx  != NULL) && (DB_TYPE(mp) == M_DATA)) {
11392 			tcp_kssl_input(tcp, mp);
11393 			continue;
11394 		}
11395 		putnext(q, mp);
11396 	}
11397 	ASSERT(cnt == tcp->tcp_rcv_cnt);
11398 	tcp->tcp_rcv_last_head = NULL;
11399 	tcp->tcp_rcv_last_tail = NULL;
11400 	tcp->tcp_rcv_cnt = 0;
11401 
11402 	/* Learn the latest rwnd information that we sent to the other side. */
11403 	thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win))
11404 	    << tcp->tcp_rcv_ws;
11405 	/* This is peer's calculated send window (our receive window). */
11406 	thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
11407 	/*
11408 	 * Increase the receive window to max.  But we need to do receiver
11409 	 * SWS avoidance.  This means that we need to check the increase of
11410 	 * of receive window is at least 1 MSS.
11411 	 */
11412 	if (canputnext(q) && (q->q_hiwat - thwin >= tcp->tcp_mss)) {
11413 		/*
11414 		 * If the window that the other side knows is less than max
11415 		 * deferred acks segments, send an update immediately.
11416 		 */
11417 		if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
11418 			BUMP_MIB(&tcp_mib, tcpOutWinUpdate);
11419 			ret = TH_ACK_NEEDED;
11420 		}
11421 		tcp->tcp_rwnd = q->q_hiwat;
11422 	}
11423 	/* No need for the push timer now. */
11424 	if (tcp->tcp_push_tid != 0) {
11425 		(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
11426 		tcp->tcp_push_tid = 0;
11427 	}
11428 	return (ret);
11429 }
11430 
11431 /*
11432  * Queue data on tcp_rcv_list which is a b_next chain.
11433  * tcp_rcv_last_head/tail is the last element of this chain.
11434  * Each element of the chain is a b_cont chain.
11435  *
11436  * M_DATA messages are added to the current element.
11437  * Other messages are added as new (b_next) elements.
11438  */
11439 void
11440 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len)
11441 {
11442 	ASSERT(seg_len == msgdsize(mp));
11443 	ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
11444 
11445 	if (tcp->tcp_rcv_list == NULL) {
11446 		ASSERT(tcp->tcp_rcv_last_head == NULL);
11447 		tcp->tcp_rcv_list = mp;
11448 		tcp->tcp_rcv_last_head = mp;
11449 	} else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
11450 		tcp->tcp_rcv_last_tail->b_cont = mp;
11451 	} else {
11452 		tcp->tcp_rcv_last_head->b_next = mp;
11453 		tcp->tcp_rcv_last_head = mp;
11454 	}
11455 
11456 	while (mp->b_cont)
11457 		mp = mp->b_cont;
11458 
11459 	tcp->tcp_rcv_last_tail = mp;
11460 	tcp->tcp_rcv_cnt += seg_len;
11461 	tcp->tcp_rwnd -= seg_len;
11462 }
11463 
11464 /*
11465  * DEFAULT TCP ENTRY POINT via squeue on READ side.
11466  *
11467  * This is the default entry function into TCP on the read side. TCP is
11468  * always entered via squeue i.e. using squeue's for mutual exclusion.
11469  * When classifier does a lookup to find the tcp, it also puts a reference
11470  * on the conn structure associated so the tcp is guaranteed to exist
11471  * when we come here. We still need to check the state because it might
11472  * as well has been closed. The squeue processing function i.e. squeue_enter,
11473  * squeue_enter_nodrain, or squeue_drain is responsible for doing the
11474  * CONN_DEC_REF.
11475  *
11476  * Apart from the default entry point, IP also sends packets directly to
11477  * tcp_rput_data for AF_INET fast path and tcp_conn_request for incoming
11478  * connections.
11479  */
11480 void
11481 tcp_input(void *arg, mblk_t *mp, void *arg2)
11482 {
11483 	conn_t	*connp = (conn_t *)arg;
11484 	tcp_t	*tcp = (tcp_t *)connp->conn_tcp;
11485 
11486 	/* arg2 is the sqp */
11487 	ASSERT(arg2 != NULL);
11488 	ASSERT(mp != NULL);
11489 
11490 	/*
11491 	 * Don't accept any input on a closed tcp as this TCP logically does
11492 	 * not exist on the system. Don't proceed further with this TCP.
11493 	 * For eg. this packet could trigger another close of this tcp
11494 	 * which would be disastrous for tcp_refcnt. tcp_close_detached /
11495 	 * tcp_clean_death / tcp_closei_local must be called at most once
11496 	 * on a TCP. In this case we need to refeed the packet into the
11497 	 * classifier and figure out where the packet should go. Need to
11498 	 * preserve the recv_ill somehow. Until we figure that out, for
11499 	 * now just drop the packet if we can't classify the packet.
11500 	 */
11501 	if (tcp->tcp_state == TCPS_CLOSED ||
11502 	    tcp->tcp_state == TCPS_BOUND) {
11503 		conn_t	*new_connp;
11504 
11505 		new_connp = ipcl_classify(mp, connp->conn_zoneid);
11506 		if (new_connp != NULL) {
11507 			tcp_reinput(new_connp, mp, arg2);
11508 			return;
11509 		}
11510 		/* We failed to classify. For now just drop the packet */
11511 		freemsg(mp);
11512 		return;
11513 	}
11514 
11515 	if (DB_TYPE(mp) == M_DATA)
11516 		tcp_rput_data(connp, mp, arg2);
11517 	else
11518 		tcp_rput_common(tcp, mp);
11519 }
11520 
11521 /*
11522  * The read side put procedure.
11523  * The packets passed up by ip are assume to be aligned according to
11524  * OK_32PTR and the IP+TCP headers fitting in the first mblk.
11525  */
11526 static void
11527 tcp_rput_common(tcp_t *tcp, mblk_t *mp)
11528 {
11529 	/*
11530 	 * tcp_rput_data() does not expect M_CTL except for the case
11531 	 * where tcp_ipv6_recvancillary is set and we get a IN_PKTINFO
11532 	 * type. Need to make sure that any other M_CTLs don't make
11533 	 * it to tcp_rput_data since it is not expecting any and doesn't
11534 	 * check for it.
11535 	 */
11536 	if (DB_TYPE(mp) == M_CTL) {
11537 		switch (*(uint32_t *)(mp->b_rptr)) {
11538 		case TCP_IOC_ABORT_CONN:
11539 			/*
11540 			 * Handle connection abort request.
11541 			 */
11542 			tcp_ioctl_abort_handler(tcp, mp);
11543 			return;
11544 		case IPSEC_IN:
11545 			/*
11546 			 * Only secure icmp arrive in TCP and they
11547 			 * don't go through data path.
11548 			 */
11549 			tcp_icmp_error(tcp, mp);
11550 			return;
11551 		case IN_PKTINFO:
11552 			/*
11553 			 * Handle IPV6_RECVPKTINFO socket option on AF_INET6
11554 			 * sockets that are receiving IPv4 traffic. tcp
11555 			 */
11556 			ASSERT(tcp->tcp_family == AF_INET6);
11557 			ASSERT(tcp->tcp_ipv6_recvancillary &
11558 			    TCP_IPV6_RECVPKTINFO);
11559 			tcp_rput_data(tcp->tcp_connp, mp,
11560 			    tcp->tcp_connp->conn_sqp);
11561 			return;
11562 		case MDT_IOC_INFO_UPDATE:
11563 			/*
11564 			 * Handle Multidata information update; the
11565 			 * following routine will free the message.
11566 			 */
11567 			if (tcp->tcp_connp->conn_mdt_ok) {
11568 				tcp_mdt_update(tcp,
11569 				    &((ip_mdt_info_t *)mp->b_rptr)->mdt_capab,
11570 				    B_FALSE);
11571 			}
11572 			freemsg(mp);
11573 			return;
11574 		default:
11575 			break;
11576 		}
11577 	}
11578 
11579 	/* No point processing the message if tcp is already closed */
11580 	if (TCP_IS_DETACHED_NONEAGER(tcp)) {
11581 		freemsg(mp);
11582 		return;
11583 	}
11584 
11585 	tcp_rput_other(tcp, mp);
11586 }
11587 
11588 
11589 /* The minimum of smoothed mean deviation in RTO calculation. */
11590 #define	TCP_SD_MIN	400
11591 
11592 /*
11593  * Set RTO for this connection.  The formula is from Jacobson and Karels'
11594  * "Congestion Avoidance and Control" in SIGCOMM '88.  The variable names
11595  * are the same as those in Appendix A.2 of that paper.
11596  *
11597  * m = new measurement
11598  * sa = smoothed RTT average (8 * average estimates).
11599  * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
11600  */
11601 static void
11602 tcp_set_rto(tcp_t *tcp, clock_t rtt)
11603 {
11604 	long m = TICK_TO_MSEC(rtt);
11605 	clock_t sa = tcp->tcp_rtt_sa;
11606 	clock_t sv = tcp->tcp_rtt_sd;
11607 	clock_t rto;
11608 
11609 	BUMP_MIB(&tcp_mib, tcpRttUpdate);
11610 	tcp->tcp_rtt_update++;
11611 
11612 	/* tcp_rtt_sa is not 0 means this is a new sample. */
11613 	if (sa != 0) {
11614 		/*
11615 		 * Update average estimator:
11616 		 *	new rtt = 7/8 old rtt + 1/8 Error
11617 		 */
11618 
11619 		/* m is now Error in estimate. */
11620 		m -= sa >> 3;
11621 		if ((sa += m) <= 0) {
11622 			/*
11623 			 * Don't allow the smoothed average to be negative.
11624 			 * We use 0 to denote reinitialization of the
11625 			 * variables.
11626 			 */
11627 			sa = 1;
11628 		}
11629 
11630 		/*
11631 		 * Update deviation estimator:
11632 		 *	new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
11633 		 */
11634 		if (m < 0)
11635 			m = -m;
11636 		m -= sv >> 2;
11637 		sv += m;
11638 	} else {
11639 		/*
11640 		 * This follows BSD's implementation.  So the reinitialized
11641 		 * RTO is 3 * m.  We cannot go less than 2 because if the
11642 		 * link is bandwidth dominated, doubling the window size
11643 		 * during slow start means doubling the RTT.  We want to be
11644 		 * more conservative when we reinitialize our estimates.  3
11645 		 * is just a convenient number.
11646 		 */
11647 		sa = m << 3;
11648 		sv = m << 1;
11649 	}
11650 	if (sv < TCP_SD_MIN) {
11651 		/*
11652 		 * We do not know that if sa captures the delay ACK
11653 		 * effect as in a long train of segments, a receiver
11654 		 * does not delay its ACKs.  So set the minimum of sv
11655 		 * to be TCP_SD_MIN, which is default to 400 ms, twice
11656 		 * of BSD DATO.  That means the minimum of mean
11657 		 * deviation is 100 ms.
11658 		 *
11659 		 */
11660 		sv = TCP_SD_MIN;
11661 	}
11662 	tcp->tcp_rtt_sa = sa;
11663 	tcp->tcp_rtt_sd = sv;
11664 	/*
11665 	 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
11666 	 *
11667 	 * Add tcp_rexmit_interval extra in case of extreme environment
11668 	 * where the algorithm fails to work.  The default value of
11669 	 * tcp_rexmit_interval_extra should be 0.
11670 	 *
11671 	 * As we use a finer grained clock than BSD and update
11672 	 * RTO for every ACKs, add in another .25 of RTT to the
11673 	 * deviation of RTO to accomodate burstiness of 1/4 of
11674 	 * window size.
11675 	 */
11676 	rto = (sa >> 3) + sv + tcp_rexmit_interval_extra + (sa >> 5);
11677 
11678 	if (rto > tcp_rexmit_interval_max) {
11679 		tcp->tcp_rto = tcp_rexmit_interval_max;
11680 	} else if (rto < tcp_rexmit_interval_min) {
11681 		tcp->tcp_rto = tcp_rexmit_interval_min;
11682 	} else {
11683 		tcp->tcp_rto = rto;
11684 	}
11685 
11686 	/* Now, we can reset tcp_timer_backoff to use the new RTO... */
11687 	tcp->tcp_timer_backoff = 0;
11688 }
11689 
11690 /*
11691  * tcp_get_seg_mp() is called to get the pointer to a segment in the
11692  * send queue which starts at the given seq. no.
11693  *
11694  * Parameters:
11695  *	tcp_t *tcp: the tcp instance pointer.
11696  *	uint32_t seq: the starting seq. no of the requested segment.
11697  *	int32_t *off: after the execution, *off will be the offset to
11698  *		the returned mblk which points to the requested seq no.
11699  *		It is the caller's responsibility to send in a non-null off.
11700  *
11701  * Return:
11702  *	A mblk_t pointer pointing to the requested segment in send queue.
11703  */
11704 static mblk_t *
11705 tcp_get_seg_mp(tcp_t *tcp, uint32_t seq, int32_t *off)
11706 {
11707 	int32_t	cnt;
11708 	mblk_t	*mp;
11709 
11710 	/* Defensive coding.  Make sure we don't send incorrect data. */
11711 	if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
11712 		return (NULL);
11713 
11714 	cnt = seq - tcp->tcp_suna;
11715 	mp = tcp->tcp_xmit_head;
11716 	while (cnt > 0 && mp != NULL) {
11717 		cnt -= mp->b_wptr - mp->b_rptr;
11718 		if (cnt < 0) {
11719 			cnt += mp->b_wptr - mp->b_rptr;
11720 			break;
11721 		}
11722 		mp = mp->b_cont;
11723 	}
11724 	ASSERT(mp != NULL);
11725 	*off = cnt;
11726 	return (mp);
11727 }
11728 
11729 /*
11730  * This function handles all retransmissions if SACK is enabled for this
11731  * connection.  First it calculates how many segments can be retransmitted
11732  * based on tcp_pipe.  Then it goes thru the notsack list to find eligible
11733  * segments.  A segment is eligible if sack_cnt for that segment is greater
11734  * than or equal tcp_dupack_fast_retransmit.  After it has retransmitted
11735  * all eligible segments, it checks to see if TCP can send some new segments
11736  * (fast recovery).  If it can, set the appropriate flag for tcp_rput_data().
11737  *
11738  * Parameters:
11739  *	tcp_t *tcp: the tcp structure of the connection.
11740  *	uint_t *flags: in return, appropriate value will be set for
11741  *	tcp_rput_data().
11742  */
11743 static void
11744 tcp_sack_rxmit(tcp_t *tcp, uint_t *flags)
11745 {
11746 	notsack_blk_t	*notsack_blk;
11747 	int32_t		usable_swnd;
11748 	int32_t		mss;
11749 	uint32_t	seg_len;
11750 	mblk_t		*xmit_mp;
11751 
11752 	ASSERT(tcp->tcp_sack_info != NULL);
11753 	ASSERT(tcp->tcp_notsack_list != NULL);
11754 	ASSERT(tcp->tcp_rexmit == B_FALSE);
11755 
11756 	/* Defensive coding in case there is a bug... */
11757 	if (tcp->tcp_notsack_list == NULL) {
11758 		return;
11759 	}
11760 	notsack_blk = tcp->tcp_notsack_list;
11761 	mss = tcp->tcp_mss;
11762 
11763 	/*
11764 	 * Limit the num of outstanding data in the network to be
11765 	 * tcp_cwnd_ssthresh, which is half of the original congestion wnd.
11766 	 */
11767 	usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe;
11768 
11769 	/* At least retransmit 1 MSS of data. */
11770 	if (usable_swnd <= 0) {
11771 		usable_swnd = mss;
11772 	}
11773 
11774 	/* Make sure no new RTT samples will be taken. */
11775 	tcp->tcp_csuna = tcp->tcp_snxt;
11776 
11777 	notsack_blk = tcp->tcp_notsack_list;
11778 	while (usable_swnd > 0) {
11779 		mblk_t		*snxt_mp, *tmp_mp;
11780 		tcp_seq		begin = tcp->tcp_sack_snxt;
11781 		tcp_seq		end;
11782 		int32_t		off;
11783 
11784 		for (; notsack_blk != NULL; notsack_blk = notsack_blk->next) {
11785 			if (SEQ_GT(notsack_blk->end, begin) &&
11786 			    (notsack_blk->sack_cnt >=
11787 			    tcp_dupack_fast_retransmit)) {
11788 				end = notsack_blk->end;
11789 				if (SEQ_LT(begin, notsack_blk->begin)) {
11790 					begin = notsack_blk->begin;
11791 				}
11792 				break;
11793 			}
11794 		}
11795 		/*
11796 		 * All holes are filled.  Manipulate tcp_cwnd to send more
11797 		 * if we can.  Note that after the SACK recovery, tcp_cwnd is
11798 		 * set to tcp_cwnd_ssthresh.
11799 		 */
11800 		if (notsack_blk == NULL) {
11801 			usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe;
11802 			if (usable_swnd <= 0 || tcp->tcp_unsent == 0) {
11803 				tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna;
11804 				ASSERT(tcp->tcp_cwnd > 0);
11805 				return;
11806 			} else {
11807 				usable_swnd = usable_swnd / mss;
11808 				tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna +
11809 				    MAX(usable_swnd * mss, mss);
11810 				*flags |= TH_XMIT_NEEDED;
11811 				return;
11812 			}
11813 		}
11814 
11815 		/*
11816 		 * Note that we may send more than usable_swnd allows here
11817 		 * because of round off, but no more than 1 MSS of data.
11818 		 */
11819 		seg_len = end - begin;
11820 		if (seg_len > mss)
11821 			seg_len = mss;
11822 		snxt_mp = tcp_get_seg_mp(tcp, begin, &off);
11823 		ASSERT(snxt_mp != NULL);
11824 		/* This should not happen.  Defensive coding again... */
11825 		if (snxt_mp == NULL) {
11826 			return;
11827 		}
11828 
11829 		xmit_mp = tcp_xmit_mp(tcp, snxt_mp, seg_len, &off,
11830 		    &tmp_mp, begin, B_TRUE, &seg_len, B_TRUE);
11831 		if (xmit_mp == NULL)
11832 			return;
11833 
11834 		usable_swnd -= seg_len;
11835 		tcp->tcp_pipe += seg_len;
11836 		tcp->tcp_sack_snxt = begin + seg_len;
11837 		TCP_RECORD_TRACE(tcp, xmit_mp, TCP_TRACE_SEND_PKT);
11838 		tcp_send_data(tcp, tcp->tcp_wq, xmit_mp);
11839 
11840 		/*
11841 		 * Update the send timestamp to avoid false retransmission.
11842 		 */
11843 		snxt_mp->b_prev = (mblk_t *)lbolt;
11844 
11845 		BUMP_MIB(&tcp_mib, tcpRetransSegs);
11846 		UPDATE_MIB(&tcp_mib, tcpRetransBytes, seg_len);
11847 		BUMP_MIB(&tcp_mib, tcpOutSackRetransSegs);
11848 		/*
11849 		 * Update tcp_rexmit_max to extend this SACK recovery phase.
11850 		 * This happens when new data sent during fast recovery is
11851 		 * also lost.  If TCP retransmits those new data, it needs
11852 		 * to extend SACK recover phase to avoid starting another
11853 		 * fast retransmit/recovery unnecessarily.
11854 		 */
11855 		if (SEQ_GT(tcp->tcp_sack_snxt, tcp->tcp_rexmit_max)) {
11856 			tcp->tcp_rexmit_max = tcp->tcp_sack_snxt;
11857 		}
11858 	}
11859 }
11860 
11861 /*
11862  * This function handles policy checking at TCP level for non-hard_bound/
11863  * detached connections.
11864  */
11865 static boolean_t
11866 tcp_check_policy(tcp_t *tcp, mblk_t *first_mp, ipha_t *ipha, ip6_t *ip6h,
11867     boolean_t secure, boolean_t mctl_present)
11868 {
11869 	ipsec_latch_t *ipl = NULL;
11870 	ipsec_action_t *act = NULL;
11871 	mblk_t *data_mp;
11872 	ipsec_in_t *ii;
11873 	const char *reason;
11874 	kstat_named_t *counter;
11875 
11876 	ASSERT(mctl_present || !secure);
11877 
11878 	ASSERT((ipha == NULL && ip6h != NULL) ||
11879 	    (ip6h == NULL && ipha != NULL));
11880 
11881 	/*
11882 	 * We don't necessarily have an ipsec_in_act action to verify
11883 	 * policy because of assymetrical policy where we have only
11884 	 * outbound policy and no inbound policy (possible with global
11885 	 * policy).
11886 	 */
11887 	if (!secure) {
11888 		if (act == NULL || act->ipa_act.ipa_type == IPSEC_ACT_BYPASS ||
11889 		    act->ipa_act.ipa_type == IPSEC_ACT_CLEAR)
11890 			return (B_TRUE);
11891 		ipsec_log_policy_failure(tcp->tcp_wq, IPSEC_POLICY_MISMATCH,
11892 		    "tcp_check_policy", ipha, ip6h, secure);
11893 		ip_drop_packet(first_mp, B_TRUE, NULL, NULL,
11894 		    &ipdrops_tcp_clear, &tcp_dropper);
11895 		return (B_FALSE);
11896 	}
11897 
11898 	/*
11899 	 * We have a secure packet.
11900 	 */
11901 	if (act == NULL) {
11902 		ipsec_log_policy_failure(tcp->tcp_wq,
11903 		    IPSEC_POLICY_NOT_NEEDED, "tcp_check_policy", ipha, ip6h,
11904 		    secure);
11905 		ip_drop_packet(first_mp, B_TRUE, NULL, NULL,
11906 		    &ipdrops_tcp_secure, &tcp_dropper);
11907 		return (B_FALSE);
11908 	}
11909 
11910 	/*
11911 	 * XXX This whole routine is currently incorrect.  ipl should
11912 	 * be set to the latch pointer, but is currently not set, so
11913 	 * we initialize it to NULL to avoid picking up random garbage.
11914 	 */
11915 	if (ipl == NULL)
11916 		return (B_TRUE);
11917 
11918 	data_mp = first_mp->b_cont;
11919 
11920 	ii = (ipsec_in_t *)first_mp->b_rptr;
11921 
11922 	if (ipsec_check_ipsecin_latch(ii, data_mp, ipl, ipha, ip6h, &reason,
11923 	    &counter)) {
11924 		BUMP_MIB(&ip_mib, ipsecInSucceeded);
11925 		return (B_TRUE);
11926 	}
11927 	(void) strlog(TCP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE,
11928 	    "tcp inbound policy mismatch: %s, packet dropped\n",
11929 	    reason);
11930 	BUMP_MIB(&ip_mib, ipsecInFailed);
11931 
11932 	ip_drop_packet(first_mp, B_TRUE, NULL, NULL, counter, &tcp_dropper);
11933 	return (B_FALSE);
11934 }
11935 
11936 /*
11937  * tcp_ss_rexmit() is called in tcp_rput_data() to do slow start
11938  * retransmission after a timeout.
11939  *
11940  * To limit the number of duplicate segments, we limit the number of segment
11941  * to be sent in one time to tcp_snd_burst, the burst variable.
11942  */
11943 static void
11944 tcp_ss_rexmit(tcp_t *tcp)
11945 {
11946 	uint32_t	snxt;
11947 	uint32_t	smax;
11948 	int32_t		win;
11949 	int32_t		mss;
11950 	int32_t		off;
11951 	int32_t		burst = tcp->tcp_snd_burst;
11952 	mblk_t		*snxt_mp;
11953 
11954 	/*
11955 	 * Note that tcp_rexmit can be set even though TCP has retransmitted
11956 	 * all unack'ed segments.
11957 	 */
11958 	if (SEQ_LT(tcp->tcp_rexmit_nxt, tcp->tcp_rexmit_max)) {
11959 		smax = tcp->tcp_rexmit_max;
11960 		snxt = tcp->tcp_rexmit_nxt;
11961 		if (SEQ_LT(snxt, tcp->tcp_suna)) {
11962 			snxt = tcp->tcp_suna;
11963 		}
11964 		win = MIN(tcp->tcp_cwnd, tcp->tcp_swnd);
11965 		win -= snxt - tcp->tcp_suna;
11966 		mss = tcp->tcp_mss;
11967 		snxt_mp = tcp_get_seg_mp(tcp, snxt, &off);
11968 
11969 		while (SEQ_LT(snxt, smax) && (win > 0) &&
11970 		    (burst > 0) && (snxt_mp != NULL)) {
11971 			mblk_t	*xmit_mp;
11972 			mblk_t	*old_snxt_mp = snxt_mp;
11973 			uint32_t cnt = mss;
11974 
11975 			if (win < cnt) {
11976 				cnt = win;
11977 			}
11978 			if (SEQ_GT(snxt + cnt, smax)) {
11979 				cnt = smax - snxt;
11980 			}
11981 			xmit_mp = tcp_xmit_mp(tcp, snxt_mp, cnt, &off,
11982 			    &snxt_mp, snxt, B_TRUE, &cnt, B_TRUE);
11983 			if (xmit_mp == NULL)
11984 				return;
11985 
11986 			tcp_send_data(tcp, tcp->tcp_wq, xmit_mp);
11987 
11988 			snxt += cnt;
11989 			win -= cnt;
11990 			/*
11991 			 * Update the send timestamp to avoid false
11992 			 * retransmission.
11993 			 */
11994 			old_snxt_mp->b_prev = (mblk_t *)lbolt;
11995 			BUMP_MIB(&tcp_mib, tcpRetransSegs);
11996 			UPDATE_MIB(&tcp_mib, tcpRetransBytes, cnt);
11997 
11998 			tcp->tcp_rexmit_nxt = snxt;
11999 			burst--;
12000 		}
12001 		/*
12002 		 * If we have transmitted all we have at the time
12003 		 * we started the retranmission, we can leave
12004 		 * the rest of the job to tcp_wput_data().  But we
12005 		 * need to check the send window first.  If the
12006 		 * win is not 0, go on with tcp_wput_data().
12007 		 */
12008 		if (SEQ_LT(snxt, smax) || win == 0) {
12009 			return;
12010 		}
12011 	}
12012 	/* Only call tcp_wput_data() if there is data to be sent. */
12013 	if (tcp->tcp_unsent) {
12014 		tcp_wput_data(tcp, NULL, B_FALSE);
12015 	}
12016 }
12017 
12018 /*
12019  * Process all TCP option in SYN segment.  Note that this function should
12020  * be called after tcp_adapt_ire() is called so that the necessary info
12021  * from IRE is already set in the tcp structure.
12022  *
12023  * This function sets up the correct tcp_mss value according to the
12024  * MSS option value and our header size.  It also sets up the window scale
12025  * and timestamp values, and initialize SACK info blocks.  But it does not
12026  * change receive window size after setting the tcp_mss value.  The caller
12027  * should do the appropriate change.
12028  */
12029 void
12030 tcp_process_options(tcp_t *tcp, tcph_t *tcph)
12031 {
12032 	int options;
12033 	tcp_opt_t tcpopt;
12034 	uint32_t mss_max;
12035 	char *tmp_tcph;
12036 
12037 	tcpopt.tcp = NULL;
12038 	options = tcp_parse_options(tcph, &tcpopt);
12039 
12040 	/*
12041 	 * Process MSS option.  Note that MSS option value does not account
12042 	 * for IP or TCP options.  This means that it is equal to MTU - minimum
12043 	 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
12044 	 * IPv6.
12045 	 */
12046 	if (!(options & TCP_OPT_MSS_PRESENT)) {
12047 		if (tcp->tcp_ipversion == IPV4_VERSION)
12048 			tcpopt.tcp_opt_mss = tcp_mss_def_ipv4;
12049 		else
12050 			tcpopt.tcp_opt_mss = tcp_mss_def_ipv6;
12051 	} else {
12052 		if (tcp->tcp_ipversion == IPV4_VERSION)
12053 			mss_max = tcp_mss_max_ipv4;
12054 		else
12055 			mss_max = tcp_mss_max_ipv6;
12056 		if (tcpopt.tcp_opt_mss < tcp_mss_min)
12057 			tcpopt.tcp_opt_mss = tcp_mss_min;
12058 		else if (tcpopt.tcp_opt_mss > mss_max)
12059 			tcpopt.tcp_opt_mss = mss_max;
12060 	}
12061 
12062 	/* Process Window Scale option. */
12063 	if (options & TCP_OPT_WSCALE_PRESENT) {
12064 		tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
12065 		tcp->tcp_snd_ws_ok = B_TRUE;
12066 	} else {
12067 		tcp->tcp_snd_ws = B_FALSE;
12068 		tcp->tcp_snd_ws_ok = B_FALSE;
12069 		tcp->tcp_rcv_ws = B_FALSE;
12070 	}
12071 
12072 	/* Process Timestamp option. */
12073 	if ((options & TCP_OPT_TSTAMP_PRESENT) &&
12074 	    (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
12075 		tmp_tcph = (char *)tcp->tcp_tcph;
12076 
12077 		tcp->tcp_snd_ts_ok = B_TRUE;
12078 		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
12079 		tcp->tcp_last_rcv_lbolt = lbolt64;
12080 		ASSERT(OK_32PTR(tmp_tcph));
12081 		ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH);
12082 
12083 		/* Fill in our template header with basic timestamp option. */
12084 		tmp_tcph += tcp->tcp_tcp_hdr_len;
12085 		tmp_tcph[0] = TCPOPT_NOP;
12086 		tmp_tcph[1] = TCPOPT_NOP;
12087 		tmp_tcph[2] = TCPOPT_TSTAMP;
12088 		tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
12089 		tcp->tcp_hdr_len += TCPOPT_REAL_TS_LEN;
12090 		tcp->tcp_tcp_hdr_len += TCPOPT_REAL_TS_LEN;
12091 		tcp->tcp_tcph->th_offset_and_rsrvd[0] += (3 << 4);
12092 	} else {
12093 		tcp->tcp_snd_ts_ok = B_FALSE;
12094 	}
12095 
12096 	/*
12097 	 * Process SACK options.  If SACK is enabled for this connection,
12098 	 * then allocate the SACK info structure.  Note the following ways
12099 	 * when tcp_snd_sack_ok is set to true.
12100 	 *
12101 	 * For active connection: in tcp_adapt_ire() called in
12102 	 * tcp_rput_other(), or in tcp_rput_other() when tcp_sack_permitted
12103 	 * is checked.
12104 	 *
12105 	 * For passive connection: in tcp_adapt_ire() called in
12106 	 * tcp_accept_comm().
12107 	 *
12108 	 * That's the reason why the extra TCP_IS_DETACHED() check is there.
12109 	 * That check makes sure that if we did not send a SACK OK option,
12110 	 * we will not enable SACK for this connection even though the other
12111 	 * side sends us SACK OK option.  For active connection, the SACK
12112 	 * info structure has already been allocated.  So we need to free
12113 	 * it if SACK is disabled.
12114 	 */
12115 	if ((options & TCP_OPT_SACK_OK_PRESENT) &&
12116 	    (tcp->tcp_snd_sack_ok ||
12117 	    (tcp_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
12118 		/* This should be true only in the passive case. */
12119 		if (tcp->tcp_sack_info == NULL) {
12120 			ASSERT(TCP_IS_DETACHED(tcp));
12121 			tcp->tcp_sack_info =
12122 			    kmem_cache_alloc(tcp_sack_info_cache, KM_NOSLEEP);
12123 		}
12124 		if (tcp->tcp_sack_info == NULL) {
12125 			tcp->tcp_snd_sack_ok = B_FALSE;
12126 		} else {
12127 			tcp->tcp_snd_sack_ok = B_TRUE;
12128 			if (tcp->tcp_snd_ts_ok) {
12129 				tcp->tcp_max_sack_blk = 3;
12130 			} else {
12131 				tcp->tcp_max_sack_blk = 4;
12132 			}
12133 		}
12134 	} else {
12135 		/*
12136 		 * Resetting tcp_snd_sack_ok to B_FALSE so that
12137 		 * no SACK info will be used for this
12138 		 * connection.  This assumes that SACK usage
12139 		 * permission is negotiated.  This may need
12140 		 * to be changed once this is clarified.
12141 		 */
12142 		if (tcp->tcp_sack_info != NULL) {
12143 			ASSERT(tcp->tcp_notsack_list == NULL);
12144 			kmem_cache_free(tcp_sack_info_cache,
12145 			    tcp->tcp_sack_info);
12146 			tcp->tcp_sack_info = NULL;
12147 		}
12148 		tcp->tcp_snd_sack_ok = B_FALSE;
12149 	}
12150 
12151 	/*
12152 	 * Now we know the exact TCP/IP header length, subtract
12153 	 * that from tcp_mss to get our side's MSS.
12154 	 */
12155 	tcp->tcp_mss -= tcp->tcp_hdr_len;
12156 	/*
12157 	 * Here we assume that the other side's header size will be equal to
12158 	 * our header size.  We calculate the real MSS accordingly.  Need to
12159 	 * take into additional stuffs IPsec puts in.
12160 	 *
12161 	 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
12162 	 */
12163 	tcpopt.tcp_opt_mss -= tcp->tcp_hdr_len + tcp->tcp_ipsec_overhead -
12164 	    ((tcp->tcp_ipversion == IPV4_VERSION ?
12165 	    IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
12166 
12167 	/*
12168 	 * Set MSS to the smaller one of both ends of the connection.
12169 	 * We should not have called tcp_mss_set() before, but our
12170 	 * side of the MSS should have been set to a proper value
12171 	 * by tcp_adapt_ire().  tcp_mss_set() will also set up the
12172 	 * STREAM head parameters properly.
12173 	 *
12174 	 * If we have a larger-than-16-bit window but the other side
12175 	 * didn't want to do window scale, tcp_rwnd_set() will take
12176 	 * care of that.
12177 	 */
12178 	tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
12179 }
12180 
12181 /*
12182  * Sends the T_CONN_IND to the listener. The caller calls this
12183  * functions via squeue to get inside the listener's perimeter
12184  * once the 3 way hand shake is done a T_CONN_IND needs to be
12185  * sent. As an optimization, the caller can call this directly
12186  * if listener's perimeter is same as eager's.
12187  */
12188 /* ARGSUSED */
12189 void
12190 tcp_send_conn_ind(void *arg, mblk_t *mp, void *arg2)
12191 {
12192 	conn_t			*lconnp = (conn_t *)arg;
12193 	tcp_t			*listener = lconnp->conn_tcp;
12194 	tcp_t			*tcp;
12195 	struct T_conn_ind	*conn_ind;
12196 	ipaddr_t 		*addr_cache;
12197 	boolean_t		need_send_conn_ind = B_FALSE;
12198 
12199 	/* retrieve the eager */
12200 	conn_ind = (struct T_conn_ind *)mp->b_rptr;
12201 	ASSERT(conn_ind->OPT_offset != 0 &&
12202 	    conn_ind->OPT_length == sizeof (intptr_t));
12203 	bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp,
12204 		conn_ind->OPT_length);
12205 
12206 	/*
12207 	 * TLI/XTI applications will get confused by
12208 	 * sending eager as an option since it violates
12209 	 * the option semantics. So remove the eager as
12210 	 * option since TLI/XTI app doesn't need it anyway.
12211 	 */
12212 	if (!TCP_IS_SOCKET(listener)) {
12213 		conn_ind->OPT_length = 0;
12214 		conn_ind->OPT_offset = 0;
12215 	}
12216 	if (listener->tcp_state == TCPS_CLOSED ||
12217 	    TCP_IS_DETACHED(listener)) {
12218 		/*
12219 		 * If listener has closed, it would have caused a
12220 		 * a cleanup/blowoff to happen for the eager. We
12221 		 * just need to return.
12222 		 */
12223 		freemsg(mp);
12224 		return;
12225 	}
12226 
12227 
12228 	/*
12229 	 * if the conn_req_q is full defer passing up the
12230 	 * T_CONN_IND until space is availabe after t_accept()
12231 	 * processing
12232 	 */
12233 	mutex_enter(&listener->tcp_eager_lock);
12234 	if (listener->tcp_conn_req_cnt_q < listener->tcp_conn_req_max) {
12235 		tcp_t *tail;
12236 
12237 		/*
12238 		 * The eager already has an extra ref put in tcp_rput_data
12239 		 * so that it stays till accept comes back even though it
12240 		 * might get into TCPS_CLOSED as a result of a TH_RST etc.
12241 		 */
12242 		ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
12243 		listener->tcp_conn_req_cnt_q0--;
12244 		listener->tcp_conn_req_cnt_q++;
12245 
12246 		/* Move from SYN_RCVD to ESTABLISHED list  */
12247 		tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
12248 		    tcp->tcp_eager_prev_q0;
12249 		tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
12250 		    tcp->tcp_eager_next_q0;
12251 		tcp->tcp_eager_prev_q0 = NULL;
12252 		tcp->tcp_eager_next_q0 = NULL;
12253 
12254 		/*
12255 		 * Insert at end of the queue because sockfs
12256 		 * sends down T_CONN_RES in chronological
12257 		 * order. Leaving the older conn indications
12258 		 * at front of the queue helps reducing search
12259 		 * time.
12260 		 */
12261 		tail = listener->tcp_eager_last_q;
12262 		if (tail != NULL)
12263 			tail->tcp_eager_next_q = tcp;
12264 		else
12265 			listener->tcp_eager_next_q = tcp;
12266 		listener->tcp_eager_last_q = tcp;
12267 		tcp->tcp_eager_next_q = NULL;
12268 		/*
12269 		 * Delay sending up the T_conn_ind until we are
12270 		 * done with the eager. Once we have have sent up
12271 		 * the T_conn_ind, the accept can potentially complete
12272 		 * any time and release the refhold we have on the eager.
12273 		 */
12274 		need_send_conn_ind = B_TRUE;
12275 	} else {
12276 		/*
12277 		 * Defer connection on q0 and set deferred
12278 		 * connection bit true
12279 		 */
12280 		tcp->tcp_conn_def_q0 = B_TRUE;
12281 
12282 		/* take tcp out of q0 ... */
12283 		tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
12284 		    tcp->tcp_eager_next_q0;
12285 		tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
12286 		    tcp->tcp_eager_prev_q0;
12287 
12288 		/* ... and place it at the end of q0 */
12289 		tcp->tcp_eager_prev_q0 = listener->tcp_eager_prev_q0;
12290 		tcp->tcp_eager_next_q0 = listener;
12291 		listener->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp;
12292 		listener->tcp_eager_prev_q0 = tcp;
12293 		tcp->tcp_conn.tcp_eager_conn_ind = mp;
12294 	}
12295 
12296 	/* we have timed out before */
12297 	if (tcp->tcp_syn_rcvd_timeout != 0) {
12298 		tcp->tcp_syn_rcvd_timeout = 0;
12299 		listener->tcp_syn_rcvd_timeout--;
12300 		if (listener->tcp_syn_defense &&
12301 		    listener->tcp_syn_rcvd_timeout <=
12302 		    (tcp_conn_req_max_q0 >> 5) &&
12303 		    10*MINUTES < TICK_TO_MSEC(lbolt64 -
12304 			listener->tcp_last_rcv_lbolt)) {
12305 			/*
12306 			 * Turn off the defense mode if we
12307 			 * believe the SYN attack is over.
12308 			 */
12309 			listener->tcp_syn_defense = B_FALSE;
12310 			if (listener->tcp_ip_addr_cache) {
12311 				kmem_free((void *)listener->tcp_ip_addr_cache,
12312 				    IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t));
12313 				listener->tcp_ip_addr_cache = NULL;
12314 			}
12315 		}
12316 	}
12317 	addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
12318 	if (addr_cache != NULL) {
12319 		/*
12320 		 * We have finished a 3-way handshake with this
12321 		 * remote host. This proves the IP addr is good.
12322 		 * Cache it!
12323 		 */
12324 		addr_cache[IP_ADDR_CACHE_HASH(
12325 			tcp->tcp_remote)] = tcp->tcp_remote;
12326 	}
12327 	mutex_exit(&listener->tcp_eager_lock);
12328 	if (need_send_conn_ind)
12329 		putnext(listener->tcp_rq, mp);
12330 }
12331 
12332 mblk_t *
12333 tcp_find_pktinfo(tcp_t *tcp, mblk_t *mp, uint_t *ipversp, uint_t *ip_hdr_lenp,
12334     uint_t *ifindexp, ip6_pkt_t *ippp)
12335 {
12336 	in_pktinfo_t	*pinfo;
12337 	ip6_t		*ip6h;
12338 	uchar_t		*rptr;
12339 	mblk_t		*first_mp = mp;
12340 	boolean_t	mctl_present = B_FALSE;
12341 	uint_t 		ifindex = 0;
12342 	ip6_pkt_t	ipp;
12343 	uint_t		ipvers;
12344 	uint_t		ip_hdr_len;
12345 
12346 	rptr = mp->b_rptr;
12347 	ASSERT(OK_32PTR(rptr));
12348 	ASSERT(tcp != NULL);
12349 	ipp.ipp_fields = 0;
12350 
12351 	switch DB_TYPE(mp) {
12352 	case M_CTL:
12353 		mp = mp->b_cont;
12354 		if (mp == NULL) {
12355 			freemsg(first_mp);
12356 			return (NULL);
12357 		}
12358 		if (DB_TYPE(mp) != M_DATA) {
12359 			freemsg(first_mp);
12360 			return (NULL);
12361 		}
12362 		mctl_present = B_TRUE;
12363 		break;
12364 	case M_DATA:
12365 		break;
12366 	default:
12367 		cmn_err(CE_NOTE, "tcp_find_pktinfo: unknown db_type");
12368 		freemsg(mp);
12369 		return (NULL);
12370 	}
12371 	ipvers = IPH_HDR_VERSION(rptr);
12372 	if (ipvers == IPV4_VERSION) {
12373 		if (tcp == NULL) {
12374 			ip_hdr_len = IPH_HDR_LENGTH(rptr);
12375 			goto done;
12376 		}
12377 
12378 		ipp.ipp_fields |= IPPF_HOPLIMIT;
12379 		ipp.ipp_hoplimit = ((ipha_t *)rptr)->ipha_ttl;
12380 
12381 		/*
12382 		 * If we have IN_PKTINFO in an M_CTL and tcp_ipv6_recvancillary
12383 		 * has TCP_IPV6_RECVPKTINFO set, pass I/F index along in ipp.
12384 		 */
12385 		if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) &&
12386 		    mctl_present) {
12387 			pinfo = (in_pktinfo_t *)first_mp->b_rptr;
12388 			if ((MBLKL(first_mp) == sizeof (in_pktinfo_t)) &&
12389 			    (pinfo->in_pkt_ulp_type == IN_PKTINFO) &&
12390 			    (pinfo->in_pkt_flags & IPF_RECVIF)) {
12391 				ipp.ipp_fields |= IPPF_IFINDEX;
12392 				ipp.ipp_ifindex = pinfo->in_pkt_ifindex;
12393 				ifindex = pinfo->in_pkt_ifindex;
12394 			}
12395 			freeb(first_mp);
12396 			mctl_present = B_FALSE;
12397 		}
12398 		ip_hdr_len = IPH_HDR_LENGTH(rptr);
12399 	} else {
12400 		ip6h = (ip6_t *)rptr;
12401 
12402 		ASSERT(ipvers == IPV6_VERSION);
12403 		ipp.ipp_fields = IPPF_HOPLIMIT | IPPF_TCLASS;
12404 		ipp.ipp_tclass = (ip6h->ip6_flow & 0x0FF00000) >> 20;
12405 		ipp.ipp_hoplimit = ip6h->ip6_hops;
12406 
12407 		if (ip6h->ip6_nxt != IPPROTO_TCP) {
12408 			uint8_t	nexthdrp;
12409 
12410 			/* Look for ifindex information */
12411 			if (ip6h->ip6_nxt == IPPROTO_RAW) {
12412 				ip6i_t *ip6i = (ip6i_t *)ip6h;
12413 				if ((uchar_t *)&ip6i[1] > mp->b_wptr) {
12414 					BUMP_MIB(&ip_mib, tcpInErrs);
12415 					freemsg(first_mp);
12416 					return (NULL);
12417 				}
12418 
12419 				if (ip6i->ip6i_flags & IP6I_IFINDEX) {
12420 					ASSERT(ip6i->ip6i_ifindex != 0);
12421 					ipp.ipp_fields |= IPPF_IFINDEX;
12422 					ipp.ipp_ifindex = ip6i->ip6i_ifindex;
12423 					ifindex = ip6i->ip6i_ifindex;
12424 				}
12425 				rptr = (uchar_t *)&ip6i[1];
12426 				mp->b_rptr = rptr;
12427 				if (rptr == mp->b_wptr) {
12428 					mblk_t *mp1;
12429 					mp1 = mp->b_cont;
12430 					freeb(mp);
12431 					mp = mp1;
12432 					rptr = mp->b_rptr;
12433 				}
12434 				if (MBLKL(mp) < IPV6_HDR_LEN +
12435 				    sizeof (tcph_t)) {
12436 					BUMP_MIB(&ip_mib, tcpInErrs);
12437 					freemsg(first_mp);
12438 					return (NULL);
12439 				}
12440 				ip6h = (ip6_t *)rptr;
12441 			}
12442 
12443 			/*
12444 			 * Find any potentially interesting extension headers
12445 			 * as well as the length of the IPv6 + extension
12446 			 * headers.
12447 			 */
12448 			ip_hdr_len = ip_find_hdr_v6(mp, ip6h, &ipp, &nexthdrp);
12449 			/* Verify if this is a TCP packet */
12450 			if (nexthdrp != IPPROTO_TCP) {
12451 				BUMP_MIB(&ip_mib, tcpInErrs);
12452 				freemsg(first_mp);
12453 				return (NULL);
12454 			}
12455 		} else {
12456 			ip_hdr_len = IPV6_HDR_LEN;
12457 		}
12458 	}
12459 
12460 done:
12461 	if (ipversp != NULL)
12462 		*ipversp = ipvers;
12463 	if (ip_hdr_lenp != NULL)
12464 		*ip_hdr_lenp = ip_hdr_len;
12465 	if (ippp != NULL)
12466 		*ippp = ipp;
12467 	if (ifindexp != NULL)
12468 		*ifindexp = ifindex;
12469 	if (mctl_present) {
12470 		freeb(first_mp);
12471 	}
12472 	return (mp);
12473 }
12474 
12475 /*
12476  * Handle M_DATA messages from IP. Its called directly from IP via
12477  * squeue for AF_INET type sockets fast path. No M_CTL are expected
12478  * in this path.
12479  *
12480  * For everything else (including AF_INET6 sockets with 'tcp_ipversion'
12481  * v4 and v6), we are called through tcp_input() and a M_CTL can
12482  * be present for options but tcp_find_pktinfo() deals with it. We
12483  * only expect M_DATA packets after tcp_find_pktinfo() is done.
12484  *
12485  * The first argument is always the connp/tcp to which the mp belongs.
12486  * There are no exceptions to this rule. The caller has already put
12487  * a reference on this connp/tcp and once tcp_rput_data() returns,
12488  * the squeue will do the refrele.
12489  *
12490  * The TH_SYN for the listener directly go to tcp_conn_request via
12491  * squeue.
12492  *
12493  * sqp: NULL = recursive, sqp != NULL means called from squeue
12494  */
12495 void
12496 tcp_rput_data(void *arg, mblk_t *mp, void *arg2)
12497 {
12498 	int32_t		bytes_acked;
12499 	int32_t		gap;
12500 	mblk_t		*mp1;
12501 	uint_t		flags;
12502 	uint32_t	new_swnd = 0;
12503 	uchar_t		*iphdr;
12504 	uchar_t		*rptr;
12505 	int32_t		rgap;
12506 	uint32_t	seg_ack;
12507 	int		seg_len;
12508 	uint_t		ip_hdr_len;
12509 	uint32_t	seg_seq;
12510 	tcph_t		*tcph;
12511 	int		urp;
12512 	tcp_opt_t	tcpopt;
12513 	uint_t		ipvers;
12514 	ip6_pkt_t	ipp;
12515 	boolean_t	ofo_seg = B_FALSE; /* Out of order segment */
12516 	uint32_t	cwnd;
12517 	uint32_t	add;
12518 	int		npkt;
12519 	int		mss;
12520 	conn_t		*connp = (conn_t *)arg;
12521 	squeue_t	*sqp = (squeue_t *)arg2;
12522 	tcp_t		*tcp = connp->conn_tcp;
12523 
12524 	/*
12525 	 * RST from fused tcp loopback peer should trigger an unfuse.
12526 	 */
12527 	if (tcp->tcp_fused) {
12528 		TCP_STAT(tcp_fusion_aborted);
12529 		tcp_unfuse(tcp);
12530 	}
12531 
12532 	iphdr = mp->b_rptr;
12533 	rptr = mp->b_rptr;
12534 	ASSERT(OK_32PTR(rptr));
12535 
12536 	/*
12537 	 * An AF_INET socket is not capable of receiving any pktinfo. Do inline
12538 	 * processing here. For rest call tcp_find_pktinfo to fill up the
12539 	 * necessary information.
12540 	 */
12541 	if (IPCL_IS_TCP4(connp)) {
12542 		ipvers = IPV4_VERSION;
12543 		ip_hdr_len = IPH_HDR_LENGTH(rptr);
12544 	} else {
12545 		mp = tcp_find_pktinfo(tcp, mp, &ipvers, &ip_hdr_len,
12546 		    NULL, &ipp);
12547 		if (mp == NULL) {
12548 			TCP_STAT(tcp_rput_v6_error);
12549 			return;
12550 		}
12551 		iphdr = mp->b_rptr;
12552 		rptr = mp->b_rptr;
12553 	}
12554 	ASSERT(DB_TYPE(mp) == M_DATA);
12555 
12556 	tcph = (tcph_t *)&rptr[ip_hdr_len];
12557 	seg_seq = ABE32_TO_U32(tcph->th_seq);
12558 	seg_ack = ABE32_TO_U32(tcph->th_ack);
12559 	ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
12560 	seg_len = (int)(mp->b_wptr - rptr) -
12561 	    (ip_hdr_len + TCP_HDR_LENGTH(tcph));
12562 	if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
12563 		do {
12564 			ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
12565 			    (uintptr_t)INT_MAX);
12566 			seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
12567 		} while ((mp1 = mp1->b_cont) != NULL &&
12568 		    mp1->b_datap->db_type == M_DATA);
12569 	}
12570 
12571 	if (tcp->tcp_state == TCPS_TIME_WAIT) {
12572 		tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
12573 		    seg_len, tcph);
12574 		return;
12575 	}
12576 
12577 	if (sqp != NULL) {
12578 		/*
12579 		 * This is the correct place to update tcp_last_recv_time. Note
12580 		 * that it is also updated for tcp structure that belongs to
12581 		 * global and listener queues which do not really need updating.
12582 		 * But that should not cause any harm.  And it is updated for
12583 		 * all kinds of incoming segments, not only for data segments.
12584 		 */
12585 		tcp->tcp_last_recv_time = lbolt;
12586 	}
12587 
12588 	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
12589 
12590 	BUMP_LOCAL(tcp->tcp_ibsegs);
12591 	TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT);
12592 
12593 	if ((flags & TH_URG) && sqp != NULL) {
12594 		/*
12595 		 * TCP can't handle urgent pointers that arrive before
12596 		 * the connection has been accept()ed since it can't
12597 		 * buffer OOB data.  Discard segment if this happens.
12598 		 *
12599 		 * Nor can it reassemble urgent pointers, so discard
12600 		 * if it's not the next segment expected.
12601 		 *
12602 		 * Otherwise, collapse chain into one mblk (discard if
12603 		 * that fails).  This makes sure the headers, retransmitted
12604 		 * data, and new data all are in the same mblk.
12605 		 */
12606 		ASSERT(mp != NULL);
12607 		if (tcp->tcp_listener || !pullupmsg(mp, -1)) {
12608 			freemsg(mp);
12609 			return;
12610 		}
12611 		/* Update pointers into message */
12612 		iphdr = rptr = mp->b_rptr;
12613 		tcph = (tcph_t *)&rptr[ip_hdr_len];
12614 		if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
12615 			/*
12616 			 * Since we can't handle any data with this urgent
12617 			 * pointer that is out of sequence, we expunge
12618 			 * the data.  This allows us to still register
12619 			 * the urgent mark and generate the M_PCSIG,
12620 			 * which we can do.
12621 			 */
12622 			mp->b_wptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph);
12623 			seg_len = 0;
12624 		}
12625 	}
12626 
12627 	switch (tcp->tcp_state) {
12628 	case TCPS_SYN_SENT:
12629 		if (flags & TH_ACK) {
12630 			/*
12631 			 * Note that our stack cannot send data before a
12632 			 * connection is established, therefore the
12633 			 * following check is valid.  Otherwise, it has
12634 			 * to be changed.
12635 			 */
12636 			if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
12637 			    SEQ_GT(seg_ack, tcp->tcp_snxt)) {
12638 				freemsg(mp);
12639 				if (flags & TH_RST)
12640 					return;
12641 				tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
12642 				    tcp, seg_ack, 0, TH_RST);
12643 				return;
12644 			}
12645 			ASSERT(tcp->tcp_suna + 1 == seg_ack);
12646 		}
12647 		if (flags & TH_RST) {
12648 			freemsg(mp);
12649 			if (flags & TH_ACK)
12650 				(void) tcp_clean_death(tcp,
12651 				    ECONNREFUSED, 13);
12652 			return;
12653 		}
12654 		if (!(flags & TH_SYN)) {
12655 			freemsg(mp);
12656 			return;
12657 		}
12658 
12659 		/* Process all TCP options. */
12660 		tcp_process_options(tcp, tcph);
12661 		/*
12662 		 * The following changes our rwnd to be a multiple of the
12663 		 * MIN(peer MSS, our MSS) for performance reason.
12664 		 */
12665 		(void) tcp_rwnd_set(tcp, MSS_ROUNDUP(tcp->tcp_rq->q_hiwat,
12666 		    tcp->tcp_mss));
12667 
12668 		/* Is the other end ECN capable? */
12669 		if (tcp->tcp_ecn_ok) {
12670 			if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
12671 				tcp->tcp_ecn_ok = B_FALSE;
12672 			}
12673 		}
12674 		/*
12675 		 * Clear ECN flags because it may interfere with later
12676 		 * processing.
12677 		 */
12678 		flags &= ~(TH_ECE|TH_CWR);
12679 
12680 		tcp->tcp_irs = seg_seq;
12681 		tcp->tcp_rack = seg_seq;
12682 		tcp->tcp_rnxt = seg_seq + 1;
12683 		U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack);
12684 		if (!TCP_IS_DETACHED(tcp)) {
12685 			/* Allocate room for SACK options if needed. */
12686 			if (tcp->tcp_snd_sack_ok) {
12687 				(void) mi_set_sth_wroff(tcp->tcp_rq,
12688 				    tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN +
12689 				    (tcp->tcp_loopback ? 0 : tcp_wroff_xtra));
12690 			} else {
12691 				(void) mi_set_sth_wroff(tcp->tcp_rq,
12692 				    tcp->tcp_hdr_len +
12693 				    (tcp->tcp_loopback ? 0 : tcp_wroff_xtra));
12694 			}
12695 		}
12696 		if (flags & TH_ACK) {
12697 			/*
12698 			 * If we can't get the confirmation upstream, pretend
12699 			 * we didn't even see this one.
12700 			 *
12701 			 * XXX: how can we pretend we didn't see it if we
12702 			 * have updated rnxt et. al.
12703 			 *
12704 			 * For loopback we defer sending up the T_CONN_CON
12705 			 * until after some checks below.
12706 			 */
12707 			mp1 = NULL;
12708 			if (!tcp_conn_con(tcp, iphdr, tcph, mp,
12709 			    tcp->tcp_loopback ? &mp1 : NULL)) {
12710 				freemsg(mp);
12711 				return;
12712 			}
12713 			/* SYN was acked - making progress */
12714 			if (tcp->tcp_ipversion == IPV6_VERSION)
12715 				tcp->tcp_ip_forward_progress = B_TRUE;
12716 
12717 			/* One for the SYN */
12718 			tcp->tcp_suna = tcp->tcp_iss + 1;
12719 			tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
12720 			tcp->tcp_state = TCPS_ESTABLISHED;
12721 
12722 			/*
12723 			 * If SYN was retransmitted, need to reset all
12724 			 * retransmission info.  This is because this
12725 			 * segment will be treated as a dup ACK.
12726 			 */
12727 			if (tcp->tcp_rexmit) {
12728 				tcp->tcp_rexmit = B_FALSE;
12729 				tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
12730 				tcp->tcp_rexmit_max = tcp->tcp_snxt;
12731 				tcp->tcp_snd_burst = tcp->tcp_localnet ?
12732 				    TCP_CWND_INFINITE : TCP_CWND_NORMAL;
12733 				tcp->tcp_ms_we_have_waited = 0;
12734 
12735 				/*
12736 				 * Set tcp_cwnd back to 1 MSS, per
12737 				 * recommendation from
12738 				 * draft-floyd-incr-init-win-01.txt,
12739 				 * Increasing TCP's Initial Window.
12740 				 */
12741 				tcp->tcp_cwnd = tcp->tcp_mss;
12742 			}
12743 
12744 			tcp->tcp_swl1 = seg_seq;
12745 			tcp->tcp_swl2 = seg_ack;
12746 
12747 			new_swnd = BE16_TO_U16(tcph->th_win);
12748 			tcp->tcp_swnd = new_swnd;
12749 			if (new_swnd > tcp->tcp_max_swnd)
12750 				tcp->tcp_max_swnd = new_swnd;
12751 
12752 			/*
12753 			 * Always send the three-way handshake ack immediately
12754 			 * in order to make the connection complete as soon as
12755 			 * possible on the accepting host.
12756 			 */
12757 			flags |= TH_ACK_NEEDED;
12758 
12759 			/*
12760 			 * Special case for loopback.  At this point we have
12761 			 * received SYN-ACK from the remote endpoint.  In
12762 			 * order to ensure that both endpoints reach the
12763 			 * fused state prior to any data exchange, the final
12764 			 * ACK needs to be sent before we indicate T_CONN_CON
12765 			 * to the module upstream.
12766 			 */
12767 			if (tcp->tcp_loopback) {
12768 				mblk_t *ack_mp;
12769 
12770 				ASSERT(!tcp->tcp_unfusable);
12771 				ASSERT(mp1 != NULL);
12772 				/*
12773 				 * For loopback, we always get a pure SYN-ACK
12774 				 * and only need to send back the final ACK
12775 				 * with no data (this is because the other
12776 				 * tcp is ours and we don't do T/TCP).  This
12777 				 * final ACK triggers the passive side to
12778 				 * perform fusion in ESTABLISHED state.
12779 				 */
12780 				if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
12781 					if (tcp->tcp_ack_tid != 0) {
12782 						(void) TCP_TIMER_CANCEL(tcp,
12783 						    tcp->tcp_ack_tid);
12784 						tcp->tcp_ack_tid = 0;
12785 					}
12786 					TCP_RECORD_TRACE(tcp, ack_mp,
12787 					    TCP_TRACE_SEND_PKT);
12788 					tcp_send_data(tcp, tcp->tcp_wq, ack_mp);
12789 					BUMP_LOCAL(tcp->tcp_obsegs);
12790 					BUMP_MIB(&tcp_mib, tcpOutAck);
12791 
12792 					/* Send up T_CONN_CON */
12793 					putnext(tcp->tcp_rq, mp1);
12794 
12795 					freemsg(mp);
12796 					return;
12797 				}
12798 				/*
12799 				 * Forget fusion; we need to handle more
12800 				 * complex cases below.  Send the deferred
12801 				 * T_CONN_CON message upstream and proceed
12802 				 * as usual.  Mark this tcp as not capable
12803 				 * of fusion.
12804 				 */
12805 				TCP_STAT(tcp_fusion_unfusable);
12806 				tcp->tcp_unfusable = B_TRUE;
12807 				putnext(tcp->tcp_rq, mp1);
12808 			}
12809 
12810 			/*
12811 			 * Check to see if there is data to be sent.  If
12812 			 * yes, set the transmit flag.  Then check to see
12813 			 * if received data processing needs to be done.
12814 			 * If not, go straight to xmit_check.  This short
12815 			 * cut is OK as we don't support T/TCP.
12816 			 */
12817 			if (tcp->tcp_unsent)
12818 				flags |= TH_XMIT_NEEDED;
12819 
12820 			if (seg_len == 0 && !(flags & TH_URG)) {
12821 				freemsg(mp);
12822 				goto xmit_check;
12823 			}
12824 
12825 			flags &= ~TH_SYN;
12826 			seg_seq++;
12827 			break;
12828 		}
12829 		tcp->tcp_state = TCPS_SYN_RCVD;
12830 		mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
12831 		    NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
12832 		if (mp1) {
12833 			DB_CPID(mp1) = tcp->tcp_cpid;
12834 			TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT);
12835 			tcp_send_data(tcp, tcp->tcp_wq, mp1);
12836 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
12837 		}
12838 		freemsg(mp);
12839 		return;
12840 	case TCPS_SYN_RCVD:
12841 		if (flags & TH_ACK) {
12842 			/*
12843 			 * In this state, a SYN|ACK packet is either bogus
12844 			 * because the other side must be ACKing our SYN which
12845 			 * indicates it has seen the ACK for their SYN and
12846 			 * shouldn't retransmit it or we're crossing SYNs
12847 			 * on active open.
12848 			 */
12849 			if ((flags & TH_SYN) && !tcp->tcp_active_open) {
12850 				freemsg(mp);
12851 				tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
12852 				    tcp, seg_ack, 0, TH_RST);
12853 				return;
12854 			}
12855 			/*
12856 			 * NOTE: RFC 793 pg. 72 says this should be
12857 			 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
12858 			 * but that would mean we have an ack that ignored
12859 			 * our SYN.
12860 			 */
12861 			if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
12862 			    SEQ_GT(seg_ack, tcp->tcp_snxt)) {
12863 				freemsg(mp);
12864 				tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
12865 				    tcp, seg_ack, 0, TH_RST);
12866 				return;
12867 			}
12868 		}
12869 		break;
12870 	case TCPS_LISTEN:
12871 		/*
12872 		 * Only a TLI listener can come through this path when a
12873 		 * acceptor is going back to be a listener and a packet
12874 		 * for the acceptor hits the classifier. For a socket
12875 		 * listener, this can never happen because a listener
12876 		 * can never accept connection on itself and hence a
12877 		 * socket acceptor can not go back to being a listener.
12878 		 */
12879 		ASSERT(!TCP_IS_SOCKET(tcp));
12880 		/*FALLTHRU*/
12881 	case TCPS_CLOSED:
12882 	case TCPS_BOUND: {
12883 		conn_t	*new_connp;
12884 
12885 		new_connp = ipcl_classify(mp, connp->conn_zoneid);
12886 		if (new_connp != NULL) {
12887 			tcp_reinput(new_connp, mp, connp->conn_sqp);
12888 			return;
12889 		}
12890 		/* We failed to classify. For now just drop the packet */
12891 		freemsg(mp);
12892 		return;
12893 	}
12894 	case TCPS_IDLE:
12895 		/*
12896 		 * Handle the case where the tcp_clean_death() has happened
12897 		 * on a connection (application hasn't closed yet) but a packet
12898 		 * was already queued on squeue before tcp_clean_death()
12899 		 * was processed. Calling tcp_clean_death() twice on same
12900 		 * connection can result in weird behaviour.
12901 		 */
12902 		freemsg(mp);
12903 		return;
12904 	default:
12905 		break;
12906 	}
12907 
12908 	/*
12909 	 * Already on the correct queue/perimeter.
12910 	 * If this is a detached connection and not an eager
12911 	 * connection hanging off a listener then new data
12912 	 * (past the FIN) will cause a reset.
12913 	 * We do a special check here where it
12914 	 * is out of the main line, rather than check
12915 	 * if we are detached every time we see new
12916 	 * data down below.
12917 	 */
12918 	if (TCP_IS_DETACHED_NONEAGER(tcp) &&
12919 	    (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
12920 		BUMP_MIB(&tcp_mib, tcpInClosed);
12921 		TCP_RECORD_TRACE(tcp,
12922 		    mp, TCP_TRACE_RECV_PKT);
12923 
12924 		freemsg(mp);
12925 		/*
12926 		 * This could be an SSL closure alert. We're detached so just
12927 		 * acknowledge it this last time.
12928 		 */
12929 		if (tcp->tcp_kssl_ctx != NULL) {
12930 			kssl_release_ctx(tcp->tcp_kssl_ctx);
12931 			tcp->tcp_kssl_ctx = NULL;
12932 
12933 			tcp->tcp_rnxt += seg_len;
12934 			U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack);
12935 			flags |= TH_ACK_NEEDED;
12936 			goto ack_check;
12937 		}
12938 
12939 		tcp_xmit_ctl("new data when detached", tcp,
12940 		    tcp->tcp_snxt, 0, TH_RST);
12941 		(void) tcp_clean_death(tcp, EPROTO, 12);
12942 		return;
12943 	}
12944 
12945 	mp->b_rptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph);
12946 	urp = BE16_TO_U16(tcph->th_urp) - TCP_OLD_URP_INTERPRETATION;
12947 	new_swnd = BE16_TO_U16(tcph->th_win) <<
12948 	    ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws);
12949 	mss = tcp->tcp_mss;
12950 
12951 	if (tcp->tcp_snd_ts_ok) {
12952 		if (!tcp_paws_check(tcp, tcph, &tcpopt)) {
12953 			/*
12954 			 * This segment is not acceptable.
12955 			 * Drop it and send back an ACK.
12956 			 */
12957 			freemsg(mp);
12958 			flags |= TH_ACK_NEEDED;
12959 			goto ack_check;
12960 		}
12961 	} else if (tcp->tcp_snd_sack_ok) {
12962 		ASSERT(tcp->tcp_sack_info != NULL);
12963 		tcpopt.tcp = tcp;
12964 		/*
12965 		 * SACK info in already updated in tcp_parse_options.  Ignore
12966 		 * all other TCP options...
12967 		 */
12968 		(void) tcp_parse_options(tcph, &tcpopt);
12969 	}
12970 try_again:;
12971 	gap = seg_seq - tcp->tcp_rnxt;
12972 	rgap = tcp->tcp_rwnd - (gap + seg_len);
12973 	/*
12974 	 * gap is the amount of sequence space between what we expect to see
12975 	 * and what we got for seg_seq.  A positive value for gap means
12976 	 * something got lost.  A negative value means we got some old stuff.
12977 	 */
12978 	if (gap < 0) {
12979 		/* Old stuff present.  Is the SYN in there? */
12980 		if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
12981 		    (seg_len != 0)) {
12982 			flags &= ~TH_SYN;
12983 			seg_seq++;
12984 			urp--;
12985 			/* Recompute the gaps after noting the SYN. */
12986 			goto try_again;
12987 		}
12988 		BUMP_MIB(&tcp_mib, tcpInDataDupSegs);
12989 		UPDATE_MIB(&tcp_mib, tcpInDataDupBytes,
12990 		    (seg_len > -gap ? -gap : seg_len));
12991 		/* Remove the old stuff from seg_len. */
12992 		seg_len += gap;
12993 		/*
12994 		 * Anything left?
12995 		 * Make sure to check for unack'd FIN when rest of data
12996 		 * has been previously ack'd.
12997 		 */
12998 		if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
12999 			/*
13000 			 * Resets are only valid if they lie within our offered
13001 			 * window.  If the RST bit is set, we just ignore this
13002 			 * segment.
13003 			 */
13004 			if (flags & TH_RST) {
13005 				freemsg(mp);
13006 				return;
13007 			}
13008 
13009 			/*
13010 			 * The arriving of dup data packets indicate that we
13011 			 * may have postponed an ack for too long, or the other
13012 			 * side's RTT estimate is out of shape. Start acking
13013 			 * more often.
13014 			 */
13015 			if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
13016 			    tcp->tcp_rack_cnt >= 1 &&
13017 			    tcp->tcp_rack_abs_max > 2) {
13018 				tcp->tcp_rack_abs_max--;
13019 			}
13020 			tcp->tcp_rack_cur_max = 1;
13021 
13022 			/*
13023 			 * This segment is "unacceptable".  None of its
13024 			 * sequence space lies within our advertized window.
13025 			 *
13026 			 * Adjust seg_len to the original value for tracing.
13027 			 */
13028 			seg_len -= gap;
13029 			if (tcp->tcp_debug) {
13030 				(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
13031 				    "tcp_rput: unacceptable, gap %d, rgap %d, "
13032 				    "flags 0x%x, seg_seq %u, seg_ack %u, "
13033 				    "seg_len %d, rnxt %u, snxt %u, %s",
13034 				    gap, rgap, flags, seg_seq, seg_ack,
13035 				    seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
13036 				    tcp_display(tcp, NULL,
13037 				    DISP_ADDR_AND_PORT));
13038 			}
13039 
13040 			/*
13041 			 * Arrange to send an ACK in response to the
13042 			 * unacceptable segment per RFC 793 page 69. There
13043 			 * is only one small difference between ours and the
13044 			 * acceptability test in the RFC - we accept ACK-only
13045 			 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
13046 			 * will be generated.
13047 			 *
13048 			 * Note that we have to ACK an ACK-only packet at least
13049 			 * for stacks that send 0-length keep-alives with
13050 			 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
13051 			 * section 4.2.3.6. As long as we don't ever generate
13052 			 * an unacceptable packet in response to an incoming
13053 			 * packet that is unacceptable, it should not cause
13054 			 * "ACK wars".
13055 			 */
13056 			flags |=  TH_ACK_NEEDED;
13057 
13058 			/*
13059 			 * Continue processing this segment in order to use the
13060 			 * ACK information it contains, but skip all other
13061 			 * sequence-number processing.	Processing the ACK
13062 			 * information is necessary in order to
13063 			 * re-synchronize connections that may have lost
13064 			 * synchronization.
13065 			 *
13066 			 * We clear seg_len and flag fields related to
13067 			 * sequence number processing as they are not
13068 			 * to be trusted for an unacceptable segment.
13069 			 */
13070 			seg_len = 0;
13071 			flags &= ~(TH_SYN | TH_FIN | TH_URG);
13072 			goto process_ack;
13073 		}
13074 
13075 		/* Fix seg_seq, and chew the gap off the front. */
13076 		seg_seq = tcp->tcp_rnxt;
13077 		urp += gap;
13078 		do {
13079 			mblk_t	*mp2;
13080 			ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
13081 			    (uintptr_t)UINT_MAX);
13082 			gap += (uint_t)(mp->b_wptr - mp->b_rptr);
13083 			if (gap > 0) {
13084 				mp->b_rptr = mp->b_wptr - gap;
13085 				break;
13086 			}
13087 			mp2 = mp;
13088 			mp = mp->b_cont;
13089 			freeb(mp2);
13090 		} while (gap < 0);
13091 		/*
13092 		 * If the urgent data has already been acknowledged, we
13093 		 * should ignore TH_URG below
13094 		 */
13095 		if (urp < 0)
13096 			flags &= ~TH_URG;
13097 	}
13098 	/*
13099 	 * rgap is the amount of stuff received out of window.  A negative
13100 	 * value is the amount out of window.
13101 	 */
13102 	if (rgap < 0) {
13103 		mblk_t	*mp2;
13104 
13105 		if (tcp->tcp_rwnd == 0) {
13106 			BUMP_MIB(&tcp_mib, tcpInWinProbe);
13107 		} else {
13108 			BUMP_MIB(&tcp_mib, tcpInDataPastWinSegs);
13109 			UPDATE_MIB(&tcp_mib, tcpInDataPastWinBytes, -rgap);
13110 		}
13111 
13112 		/*
13113 		 * seg_len does not include the FIN, so if more than
13114 		 * just the FIN is out of window, we act like we don't
13115 		 * see it.  (If just the FIN is out of window, rgap
13116 		 * will be zero and we will go ahead and acknowledge
13117 		 * the FIN.)
13118 		 */
13119 		flags &= ~TH_FIN;
13120 
13121 		/* Fix seg_len and make sure there is something left. */
13122 		seg_len += rgap;
13123 		if (seg_len <= 0) {
13124 			/*
13125 			 * Resets are only valid if they lie within our offered
13126 			 * window.  If the RST bit is set, we just ignore this
13127 			 * segment.
13128 			 */
13129 			if (flags & TH_RST) {
13130 				freemsg(mp);
13131 				return;
13132 			}
13133 
13134 			/* Per RFC 793, we need to send back an ACK. */
13135 			flags |= TH_ACK_NEEDED;
13136 
13137 			/*
13138 			 * Send SIGURG as soon as possible i.e. even
13139 			 * if the TH_URG was delivered in a window probe
13140 			 * packet (which will be unacceptable).
13141 			 *
13142 			 * We generate a signal if none has been generated
13143 			 * for this connection or if this is a new urgent
13144 			 * byte. Also send a zero-length "unmarked" message
13145 			 * to inform SIOCATMARK that this is not the mark.
13146 			 *
13147 			 * tcp_urp_last_valid is cleared when the T_exdata_ind
13148 			 * is sent up. This plus the check for old data
13149 			 * (gap >= 0) handles the wraparound of the sequence
13150 			 * number space without having to always track the
13151 			 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
13152 			 * this max in its rcv_up variable).
13153 			 *
13154 			 * This prevents duplicate SIGURGS due to a "late"
13155 			 * zero-window probe when the T_EXDATA_IND has already
13156 			 * been sent up.
13157 			 */
13158 			if ((flags & TH_URG) &&
13159 			    (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
13160 			    tcp->tcp_urp_last))) {
13161 				mp1 = allocb(0, BPRI_MED);
13162 				if (mp1 == NULL) {
13163 					freemsg(mp);
13164 					return;
13165 				}
13166 				if (!TCP_IS_DETACHED(tcp) &&
13167 				    !putnextctl1(tcp->tcp_rq, M_PCSIG,
13168 				    SIGURG)) {
13169 					/* Try again on the rexmit. */
13170 					freemsg(mp1);
13171 					freemsg(mp);
13172 					return;
13173 				}
13174 				/*
13175 				 * If the next byte would be the mark
13176 				 * then mark with MARKNEXT else mark
13177 				 * with NOTMARKNEXT.
13178 				 */
13179 				if (gap == 0 && urp == 0)
13180 					mp1->b_flag |= MSGMARKNEXT;
13181 				else
13182 					mp1->b_flag |= MSGNOTMARKNEXT;
13183 				freemsg(tcp->tcp_urp_mark_mp);
13184 				tcp->tcp_urp_mark_mp = mp1;
13185 				flags |= TH_SEND_URP_MARK;
13186 				tcp->tcp_urp_last_valid = B_TRUE;
13187 				tcp->tcp_urp_last = urp + seg_seq;
13188 			}
13189 			/*
13190 			 * If this is a zero window probe, continue to
13191 			 * process the ACK part.  But we need to set seg_len
13192 			 * to 0 to avoid data processing.  Otherwise just
13193 			 * drop the segment and send back an ACK.
13194 			 */
13195 			if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
13196 				flags &= ~(TH_SYN | TH_URG);
13197 				seg_len = 0;
13198 				goto process_ack;
13199 			} else {
13200 				freemsg(mp);
13201 				goto ack_check;
13202 			}
13203 		}
13204 		/* Pitch out of window stuff off the end. */
13205 		rgap = seg_len;
13206 		mp2 = mp;
13207 		do {
13208 			ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
13209 			    (uintptr_t)INT_MAX);
13210 			rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
13211 			if (rgap < 0) {
13212 				mp2->b_wptr += rgap;
13213 				if ((mp1 = mp2->b_cont) != NULL) {
13214 					mp2->b_cont = NULL;
13215 					freemsg(mp1);
13216 				}
13217 				break;
13218 			}
13219 		} while ((mp2 = mp2->b_cont) != NULL);
13220 	}
13221 ok:;
13222 	/*
13223 	 * TCP should check ECN info for segments inside the window only.
13224 	 * Therefore the check should be done here.
13225 	 */
13226 	if (tcp->tcp_ecn_ok) {
13227 		if (flags & TH_CWR) {
13228 			tcp->tcp_ecn_echo_on = B_FALSE;
13229 		}
13230 		/*
13231 		 * Note that both ECN_CE and CWR can be set in the
13232 		 * same segment.  In this case, we once again turn
13233 		 * on ECN_ECHO.
13234 		 */
13235 		if (tcp->tcp_ipversion == IPV4_VERSION) {
13236 			uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
13237 
13238 			if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
13239 				tcp->tcp_ecn_echo_on = B_TRUE;
13240 			}
13241 		} else {
13242 			uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
13243 
13244 			if ((vcf & htonl(IPH_ECN_CE << 20)) ==
13245 			    htonl(IPH_ECN_CE << 20)) {
13246 				tcp->tcp_ecn_echo_on = B_TRUE;
13247 			}
13248 		}
13249 	}
13250 
13251 	/*
13252 	 * Check whether we can update tcp_ts_recent.  This test is
13253 	 * NOT the one in RFC 1323 3.4.  It is from Braden, 1993, "TCP
13254 	 * Extensions for High Performance: An Update", Internet Draft.
13255 	 */
13256 	if (tcp->tcp_snd_ts_ok &&
13257 	    TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
13258 	    SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
13259 		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
13260 		tcp->tcp_last_rcv_lbolt = lbolt64;
13261 	}
13262 
13263 	if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
13264 		/*
13265 		 * FIN in an out of order segment.  We record this in
13266 		 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
13267 		 * Clear the FIN so that any check on FIN flag will fail.
13268 		 * Remember that FIN also counts in the sequence number
13269 		 * space.  So we need to ack out of order FIN only segments.
13270 		 */
13271 		if (flags & TH_FIN) {
13272 			tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
13273 			tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
13274 			flags &= ~TH_FIN;
13275 			flags |= TH_ACK_NEEDED;
13276 		}
13277 		if (seg_len > 0) {
13278 			/* Fill in the SACK blk list. */
13279 			if (tcp->tcp_snd_sack_ok) {
13280 				ASSERT(tcp->tcp_sack_info != NULL);
13281 				tcp_sack_insert(tcp->tcp_sack_list,
13282 				    seg_seq, seg_seq + seg_len,
13283 				    &(tcp->tcp_num_sack_blk));
13284 			}
13285 
13286 			/*
13287 			 * Attempt reassembly and see if we have something
13288 			 * ready to go.
13289 			 */
13290 			mp = tcp_reass(tcp, mp, seg_seq);
13291 			/* Always ack out of order packets */
13292 			flags |= TH_ACK_NEEDED | TH_PUSH;
13293 			if (mp) {
13294 				ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
13295 				    (uintptr_t)INT_MAX);
13296 				seg_len = mp->b_cont ? msgdsize(mp) :
13297 					(int)(mp->b_wptr - mp->b_rptr);
13298 				seg_seq = tcp->tcp_rnxt;
13299 				/*
13300 				 * A gap is filled and the seq num and len
13301 				 * of the gap match that of a previously
13302 				 * received FIN, put the FIN flag back in.
13303 				 */
13304 				if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
13305 				    seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
13306 					flags |= TH_FIN;
13307 					tcp->tcp_valid_bits &=
13308 					    ~TCP_OFO_FIN_VALID;
13309 				}
13310 			} else {
13311 				/*
13312 				 * Keep going even with NULL mp.
13313 				 * There may be a useful ACK or something else
13314 				 * we don't want to miss.
13315 				 *
13316 				 * But TCP should not perform fast retransmit
13317 				 * because of the ack number.  TCP uses
13318 				 * seg_len == 0 to determine if it is a pure
13319 				 * ACK.  And this is not a pure ACK.
13320 				 */
13321 				seg_len = 0;
13322 				ofo_seg = B_TRUE;
13323 			}
13324 		}
13325 	} else if (seg_len > 0) {
13326 		BUMP_MIB(&tcp_mib, tcpInDataInorderSegs);
13327 		UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, seg_len);
13328 		/*
13329 		 * If an out of order FIN was received before, and the seq
13330 		 * num and len of the new segment match that of the FIN,
13331 		 * put the FIN flag back in.
13332 		 */
13333 		if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
13334 		    seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
13335 			flags |= TH_FIN;
13336 			tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
13337 		}
13338 	}
13339 	if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
13340 	if (flags & TH_RST) {
13341 		freemsg(mp);
13342 		switch (tcp->tcp_state) {
13343 		case TCPS_SYN_RCVD:
13344 			(void) tcp_clean_death(tcp, ECONNREFUSED, 14);
13345 			break;
13346 		case TCPS_ESTABLISHED:
13347 		case TCPS_FIN_WAIT_1:
13348 		case TCPS_FIN_WAIT_2:
13349 		case TCPS_CLOSE_WAIT:
13350 			(void) tcp_clean_death(tcp, ECONNRESET, 15);
13351 			break;
13352 		case TCPS_CLOSING:
13353 		case TCPS_LAST_ACK:
13354 			(void) tcp_clean_death(tcp, 0, 16);
13355 			break;
13356 		default:
13357 			ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
13358 			(void) tcp_clean_death(tcp, ENXIO, 17);
13359 			break;
13360 		}
13361 		return;
13362 	}
13363 	if (flags & TH_SYN) {
13364 		/*
13365 		 * See RFC 793, Page 71
13366 		 *
13367 		 * The seq number must be in the window as it should
13368 		 * be "fixed" above.  If it is outside window, it should
13369 		 * be already rejected.  Note that we allow seg_seq to be
13370 		 * rnxt + rwnd because we want to accept 0 window probe.
13371 		 */
13372 		ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
13373 		    SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
13374 		freemsg(mp);
13375 		/*
13376 		 * If the ACK flag is not set, just use our snxt as the
13377 		 * seq number of the RST segment.
13378 		 */
13379 		if (!(flags & TH_ACK)) {
13380 			seg_ack = tcp->tcp_snxt;
13381 		}
13382 		tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
13383 		    TH_RST|TH_ACK);
13384 		ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
13385 		(void) tcp_clean_death(tcp, ECONNRESET, 18);
13386 		return;
13387 	}
13388 	/*
13389 	 * urp could be -1 when the urp field in the packet is 0
13390 	 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
13391 	 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
13392 	 */
13393 	if (flags & TH_URG && urp >= 0) {
13394 		if (!tcp->tcp_urp_last_valid ||
13395 		    SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
13396 			/*
13397 			 * If we haven't generated the signal yet for this
13398 			 * urgent pointer value, do it now.  Also, send up a
13399 			 * zero-length M_DATA indicating whether or not this is
13400 			 * the mark. The latter is not needed when a
13401 			 * T_EXDATA_IND is sent up. However, if there are
13402 			 * allocation failures this code relies on the sender
13403 			 * retransmitting and the socket code for determining
13404 			 * the mark should not block waiting for the peer to
13405 			 * transmit. Thus, for simplicity we always send up the
13406 			 * mark indication.
13407 			 */
13408 			mp1 = allocb(0, BPRI_MED);
13409 			if (mp1 == NULL) {
13410 				freemsg(mp);
13411 				return;
13412 			}
13413 			if (!TCP_IS_DETACHED(tcp) &&
13414 			    !putnextctl1(tcp->tcp_rq, M_PCSIG, SIGURG)) {
13415 				/* Try again on the rexmit. */
13416 				freemsg(mp1);
13417 				freemsg(mp);
13418 				return;
13419 			}
13420 			/*
13421 			 * Mark with NOTMARKNEXT for now.
13422 			 * The code below will change this to MARKNEXT
13423 			 * if we are at the mark.
13424 			 *
13425 			 * If there are allocation failures (e.g. in dupmsg
13426 			 * below) the next time tcp_rput_data sees the urgent
13427 			 * segment it will send up the MSG*MARKNEXT message.
13428 			 */
13429 			mp1->b_flag |= MSGNOTMARKNEXT;
13430 			freemsg(tcp->tcp_urp_mark_mp);
13431 			tcp->tcp_urp_mark_mp = mp1;
13432 			flags |= TH_SEND_URP_MARK;
13433 #ifdef DEBUG
13434 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
13435 			    "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
13436 			    "last %x, %s",
13437 			    seg_seq, urp, tcp->tcp_urp_last,
13438 			    tcp_display(tcp, NULL, DISP_PORT_ONLY));
13439 #endif /* DEBUG */
13440 			tcp->tcp_urp_last_valid = B_TRUE;
13441 			tcp->tcp_urp_last = urp + seg_seq;
13442 		} else if (tcp->tcp_urp_mark_mp != NULL) {
13443 			/*
13444 			 * An allocation failure prevented the previous
13445 			 * tcp_rput_data from sending up the allocated
13446 			 * MSG*MARKNEXT message - send it up this time
13447 			 * around.
13448 			 */
13449 			flags |= TH_SEND_URP_MARK;
13450 		}
13451 
13452 		/*
13453 		 * If the urgent byte is in this segment, make sure that it is
13454 		 * all by itself.  This makes it much easier to deal with the
13455 		 * possibility of an allocation failure on the T_exdata_ind.
13456 		 * Note that seg_len is the number of bytes in the segment, and
13457 		 * urp is the offset into the segment of the urgent byte.
13458 		 * urp < seg_len means that the urgent byte is in this segment.
13459 		 */
13460 		if (urp < seg_len) {
13461 			if (seg_len != 1) {
13462 				uint32_t  tmp_rnxt;
13463 				/*
13464 				 * Break it up and feed it back in.
13465 				 * Re-attach the IP header.
13466 				 */
13467 				mp->b_rptr = iphdr;
13468 				if (urp > 0) {
13469 					/*
13470 					 * There is stuff before the urgent
13471 					 * byte.
13472 					 */
13473 					mp1 = dupmsg(mp);
13474 					if (!mp1) {
13475 						/*
13476 						 * Trim from urgent byte on.
13477 						 * The rest will come back.
13478 						 */
13479 						(void) adjmsg(mp,
13480 						    urp - seg_len);
13481 						tcp_rput_data(connp,
13482 						    mp, NULL);
13483 						return;
13484 					}
13485 					(void) adjmsg(mp1, urp - seg_len);
13486 					/* Feed this piece back in. */
13487 					tmp_rnxt = tcp->tcp_rnxt;
13488 					tcp_rput_data(connp, mp1, NULL);
13489 					/*
13490 					 * If the data passed back in was not
13491 					 * processed (ie: bad ACK) sending
13492 					 * the remainder back in will cause a
13493 					 * loop. In this case, drop the
13494 					 * packet and let the sender try
13495 					 * sending a good packet.
13496 					 */
13497 					if (tmp_rnxt == tcp->tcp_rnxt) {
13498 						freemsg(mp);
13499 						return;
13500 					}
13501 				}
13502 				if (urp != seg_len - 1) {
13503 					uint32_t  tmp_rnxt;
13504 					/*
13505 					 * There is stuff after the urgent
13506 					 * byte.
13507 					 */
13508 					mp1 = dupmsg(mp);
13509 					if (!mp1) {
13510 						/*
13511 						 * Trim everything beyond the
13512 						 * urgent byte.  The rest will
13513 						 * come back.
13514 						 */
13515 						(void) adjmsg(mp,
13516 						    urp + 1 - seg_len);
13517 						tcp_rput_data(connp,
13518 						    mp, NULL);
13519 						return;
13520 					}
13521 					(void) adjmsg(mp1, urp + 1 - seg_len);
13522 					tmp_rnxt = tcp->tcp_rnxt;
13523 					tcp_rput_data(connp, mp1, NULL);
13524 					/*
13525 					 * If the data passed back in was not
13526 					 * processed (ie: bad ACK) sending
13527 					 * the remainder back in will cause a
13528 					 * loop. In this case, drop the
13529 					 * packet and let the sender try
13530 					 * sending a good packet.
13531 					 */
13532 					if (tmp_rnxt == tcp->tcp_rnxt) {
13533 						freemsg(mp);
13534 						return;
13535 					}
13536 				}
13537 				tcp_rput_data(connp, mp, NULL);
13538 				return;
13539 			}
13540 			/*
13541 			 * This segment contains only the urgent byte.  We
13542 			 * have to allocate the T_exdata_ind, if we can.
13543 			 */
13544 			if (!tcp->tcp_urp_mp) {
13545 				struct T_exdata_ind *tei;
13546 				mp1 = allocb(sizeof (struct T_exdata_ind),
13547 				    BPRI_MED);
13548 				if (!mp1) {
13549 					/*
13550 					 * Sigh... It'll be back.
13551 					 * Generate any MSG*MARK message now.
13552 					 */
13553 					freemsg(mp);
13554 					seg_len = 0;
13555 					if (flags & TH_SEND_URP_MARK) {
13556 
13557 
13558 						ASSERT(tcp->tcp_urp_mark_mp);
13559 						tcp->tcp_urp_mark_mp->b_flag &=
13560 							~MSGNOTMARKNEXT;
13561 						tcp->tcp_urp_mark_mp->b_flag |=
13562 							MSGMARKNEXT;
13563 					}
13564 					goto ack_check;
13565 				}
13566 				mp1->b_datap->db_type = M_PROTO;
13567 				tei = (struct T_exdata_ind *)mp1->b_rptr;
13568 				tei->PRIM_type = T_EXDATA_IND;
13569 				tei->MORE_flag = 0;
13570 				mp1->b_wptr = (uchar_t *)&tei[1];
13571 				tcp->tcp_urp_mp = mp1;
13572 #ifdef DEBUG
13573 				(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
13574 				    "tcp_rput: allocated exdata_ind %s",
13575 				    tcp_display(tcp, NULL,
13576 				    DISP_PORT_ONLY));
13577 #endif /* DEBUG */
13578 				/*
13579 				 * There is no need to send a separate MSG*MARK
13580 				 * message since the T_EXDATA_IND will be sent
13581 				 * now.
13582 				 */
13583 				flags &= ~TH_SEND_URP_MARK;
13584 				freemsg(tcp->tcp_urp_mark_mp);
13585 				tcp->tcp_urp_mark_mp = NULL;
13586 			}
13587 			/*
13588 			 * Now we are all set.  On the next putnext upstream,
13589 			 * tcp_urp_mp will be non-NULL and will get prepended
13590 			 * to what has to be this piece containing the urgent
13591 			 * byte.  If for any reason we abort this segment below,
13592 			 * if it comes back, we will have this ready, or it
13593 			 * will get blown off in close.
13594 			 */
13595 		} else if (urp == seg_len) {
13596 			/*
13597 			 * The urgent byte is the next byte after this sequence
13598 			 * number. If there is data it is marked with
13599 			 * MSGMARKNEXT and any tcp_urp_mark_mp is discarded
13600 			 * since it is not needed. Otherwise, if the code
13601 			 * above just allocated a zero-length tcp_urp_mark_mp
13602 			 * message, that message is tagged with MSGMARKNEXT.
13603 			 * Sending up these MSGMARKNEXT messages makes
13604 			 * SIOCATMARK work correctly even though
13605 			 * the T_EXDATA_IND will not be sent up until the
13606 			 * urgent byte arrives.
13607 			 */
13608 			if (seg_len != 0) {
13609 				flags |= TH_MARKNEXT_NEEDED;
13610 				freemsg(tcp->tcp_urp_mark_mp);
13611 				tcp->tcp_urp_mark_mp = NULL;
13612 				flags &= ~TH_SEND_URP_MARK;
13613 			} else if (tcp->tcp_urp_mark_mp != NULL) {
13614 				flags |= TH_SEND_URP_MARK;
13615 				tcp->tcp_urp_mark_mp->b_flag &=
13616 					~MSGNOTMARKNEXT;
13617 				tcp->tcp_urp_mark_mp->b_flag |= MSGMARKNEXT;
13618 			}
13619 #ifdef DEBUG
13620 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
13621 			    "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
13622 			    seg_len, flags,
13623 			    tcp_display(tcp, NULL, DISP_PORT_ONLY));
13624 #endif /* DEBUG */
13625 		} else {
13626 			/* Data left until we hit mark */
13627 #ifdef DEBUG
13628 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
13629 			    "tcp_rput: URP %d bytes left, %s",
13630 			    urp - seg_len, tcp_display(tcp, NULL,
13631 			    DISP_PORT_ONLY));
13632 #endif /* DEBUG */
13633 		}
13634 	}
13635 
13636 process_ack:
13637 	if (!(flags & TH_ACK)) {
13638 		freemsg(mp);
13639 		goto xmit_check;
13640 	}
13641 	}
13642 	bytes_acked = (int)(seg_ack - tcp->tcp_suna);
13643 
13644 	if (tcp->tcp_ipversion == IPV6_VERSION && bytes_acked > 0)
13645 		tcp->tcp_ip_forward_progress = B_TRUE;
13646 	if (tcp->tcp_state == TCPS_SYN_RCVD) {
13647 		if ((tcp->tcp_conn.tcp_eager_conn_ind != NULL) &&
13648 		    ((tcp->tcp_kssl_ent == NULL) || !tcp->tcp_kssl_pending)) {
13649 			/* 3-way handshake complete - pass up the T_CONN_IND */
13650 			tcp_t	*listener = tcp->tcp_listener;
13651 			mblk_t	*mp = tcp->tcp_conn.tcp_eager_conn_ind;
13652 
13653 			tcp->tcp_conn.tcp_eager_conn_ind = NULL;
13654 			/*
13655 			 * We are here means eager is fine but it can
13656 			 * get a TH_RST at any point between now and till
13657 			 * accept completes and disappear. We need to
13658 			 * ensure that reference to eager is valid after
13659 			 * we get out of eager's perimeter. So we do
13660 			 * an extra refhold.
13661 			 */
13662 			CONN_INC_REF(connp);
13663 
13664 			/*
13665 			 * The listener also exists because of the refhold
13666 			 * done in tcp_conn_request. Its possible that it
13667 			 * might have closed. We will check that once we
13668 			 * get inside listeners context.
13669 			 */
13670 			CONN_INC_REF(listener->tcp_connp);
13671 			if (listener->tcp_connp->conn_sqp ==
13672 			    connp->conn_sqp) {
13673 				tcp_send_conn_ind(listener->tcp_connp, mp,
13674 				    listener->tcp_connp->conn_sqp);
13675 				CONN_DEC_REF(listener->tcp_connp);
13676 			} else if (!tcp->tcp_loopback) {
13677 				squeue_fill(listener->tcp_connp->conn_sqp, mp,
13678 				    tcp_send_conn_ind,
13679 				    listener->tcp_connp, SQTAG_TCP_CONN_IND);
13680 			} else {
13681 				squeue_enter(listener->tcp_connp->conn_sqp, mp,
13682 				    tcp_send_conn_ind, listener->tcp_connp,
13683 				    SQTAG_TCP_CONN_IND);
13684 			}
13685 		}
13686 
13687 		if (tcp->tcp_active_open) {
13688 			/*
13689 			 * We are seeing the final ack in the three way
13690 			 * hand shake of a active open'ed connection
13691 			 * so we must send up a T_CONN_CON
13692 			 */
13693 			if (!tcp_conn_con(tcp, iphdr, tcph, mp, NULL)) {
13694 				freemsg(mp);
13695 				return;
13696 			}
13697 			/*
13698 			 * Don't fuse the loopback endpoints for
13699 			 * simultaneous active opens.
13700 			 */
13701 			if (tcp->tcp_loopback) {
13702 				TCP_STAT(tcp_fusion_unfusable);
13703 				tcp->tcp_unfusable = B_TRUE;
13704 			}
13705 		}
13706 
13707 		tcp->tcp_suna = tcp->tcp_iss + 1;	/* One for the SYN */
13708 		bytes_acked--;
13709 		/* SYN was acked - making progress */
13710 		if (tcp->tcp_ipversion == IPV6_VERSION)
13711 			tcp->tcp_ip_forward_progress = B_TRUE;
13712 
13713 		/*
13714 		 * If SYN was retransmitted, need to reset all
13715 		 * retransmission info as this segment will be
13716 		 * treated as a dup ACK.
13717 		 */
13718 		if (tcp->tcp_rexmit) {
13719 			tcp->tcp_rexmit = B_FALSE;
13720 			tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
13721 			tcp->tcp_rexmit_max = tcp->tcp_snxt;
13722 			tcp->tcp_snd_burst = tcp->tcp_localnet ?
13723 			    TCP_CWND_INFINITE : TCP_CWND_NORMAL;
13724 			tcp->tcp_ms_we_have_waited = 0;
13725 			tcp->tcp_cwnd = mss;
13726 		}
13727 
13728 		/*
13729 		 * We set the send window to zero here.
13730 		 * This is needed if there is data to be
13731 		 * processed already on the queue.
13732 		 * Later (at swnd_update label), the
13733 		 * "new_swnd > tcp_swnd" condition is satisfied
13734 		 * the XMIT_NEEDED flag is set in the current
13735 		 * (SYN_RCVD) state. This ensures tcp_wput_data() is
13736 		 * called if there is already data on queue in
13737 		 * this state.
13738 		 */
13739 		tcp->tcp_swnd = 0;
13740 
13741 		if (new_swnd > tcp->tcp_max_swnd)
13742 			tcp->tcp_max_swnd = new_swnd;
13743 		tcp->tcp_swl1 = seg_seq;
13744 		tcp->tcp_swl2 = seg_ack;
13745 		tcp->tcp_state = TCPS_ESTABLISHED;
13746 		tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
13747 
13748 		/* Fuse when both sides are in ESTABLISHED state */
13749 		if (tcp->tcp_loopback && do_tcp_fusion)
13750 			tcp_fuse(tcp, iphdr, tcph);
13751 
13752 	}
13753 	/* This code follows 4.4BSD-Lite2 mostly. */
13754 	if (bytes_acked < 0)
13755 		goto est;
13756 
13757 	/*
13758 	 * If TCP is ECN capable and the congestion experience bit is
13759 	 * set, reduce tcp_cwnd and tcp_ssthresh.  But this should only be
13760 	 * done once per window (or more loosely, per RTT).
13761 	 */
13762 	if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
13763 		tcp->tcp_cwr = B_FALSE;
13764 	if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
13765 		if (!tcp->tcp_cwr) {
13766 			npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
13767 			tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
13768 			tcp->tcp_cwnd = npkt * mss;
13769 			/*
13770 			 * If the cwnd is 0, use the timer to clock out
13771 			 * new segments.  This is required by the ECN spec.
13772 			 */
13773 			if (npkt == 0) {
13774 				TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
13775 				/*
13776 				 * This makes sure that when the ACK comes
13777 				 * back, we will increase tcp_cwnd by 1 MSS.
13778 				 */
13779 				tcp->tcp_cwnd_cnt = 0;
13780 			}
13781 			tcp->tcp_cwr = B_TRUE;
13782 			/*
13783 			 * This marks the end of the current window of in
13784 			 * flight data.  That is why we don't use
13785 			 * tcp_suna + tcp_swnd.  Only data in flight can
13786 			 * provide ECN info.
13787 			 */
13788 			tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
13789 			tcp->tcp_ecn_cwr_sent = B_FALSE;
13790 		}
13791 	}
13792 
13793 	mp1 = tcp->tcp_xmit_head;
13794 	if (bytes_acked == 0) {
13795 		if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
13796 			int dupack_cnt;
13797 
13798 			BUMP_MIB(&tcp_mib, tcpInDupAck);
13799 			/*
13800 			 * Fast retransmit.  When we have seen exactly three
13801 			 * identical ACKs while we have unacked data
13802 			 * outstanding we take it as a hint that our peer
13803 			 * dropped something.
13804 			 *
13805 			 * If TCP is retransmitting, don't do fast retransmit.
13806 			 */
13807 			if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
13808 			    ! tcp->tcp_rexmit) {
13809 				/* Do Limited Transmit */
13810 				if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
13811 				    tcp_dupack_fast_retransmit) {
13812 					/*
13813 					 * RFC 3042
13814 					 *
13815 					 * What we need to do is temporarily
13816 					 * increase tcp_cwnd so that new
13817 					 * data can be sent if it is allowed
13818 					 * by the receive window (tcp_rwnd).
13819 					 * tcp_wput_data() will take care of
13820 					 * the rest.
13821 					 *
13822 					 * If the connection is SACK capable,
13823 					 * only do limited xmit when there
13824 					 * is SACK info.
13825 					 *
13826 					 * Note how tcp_cwnd is incremented.
13827 					 * The first dup ACK will increase
13828 					 * it by 1 MSS.  The second dup ACK
13829 					 * will increase it by 2 MSS.  This
13830 					 * means that only 1 new segment will
13831 					 * be sent for each dup ACK.
13832 					 */
13833 					if (tcp->tcp_unsent > 0 &&
13834 					    (!tcp->tcp_snd_sack_ok ||
13835 					    (tcp->tcp_snd_sack_ok &&
13836 					    tcp->tcp_notsack_list != NULL))) {
13837 						tcp->tcp_cwnd += mss <<
13838 						    (tcp->tcp_dupack_cnt - 1);
13839 						flags |= TH_LIMIT_XMIT;
13840 					}
13841 				} else if (dupack_cnt ==
13842 				    tcp_dupack_fast_retransmit) {
13843 
13844 				/*
13845 				 * If we have reduced tcp_ssthresh
13846 				 * because of ECN, do not reduce it again
13847 				 * unless it is already one window of data
13848 				 * away.  After one window of data, tcp_cwr
13849 				 * should then be cleared.  Note that
13850 				 * for non ECN capable connection, tcp_cwr
13851 				 * should always be false.
13852 				 *
13853 				 * Adjust cwnd since the duplicate
13854 				 * ack indicates that a packet was
13855 				 * dropped (due to congestion.)
13856 				 */
13857 				if (!tcp->tcp_cwr) {
13858 					npkt = ((tcp->tcp_snxt -
13859 					    tcp->tcp_suna) >> 1) / mss;
13860 					tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
13861 					    mss;
13862 					tcp->tcp_cwnd = (npkt +
13863 					    tcp->tcp_dupack_cnt) * mss;
13864 				}
13865 				if (tcp->tcp_ecn_ok) {
13866 					tcp->tcp_cwr = B_TRUE;
13867 					tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
13868 					tcp->tcp_ecn_cwr_sent = B_FALSE;
13869 				}
13870 
13871 				/*
13872 				 * We do Hoe's algorithm.  Refer to her
13873 				 * paper "Improving the Start-up Behavior
13874 				 * of a Congestion Control Scheme for TCP,"
13875 				 * appeared in SIGCOMM'96.
13876 				 *
13877 				 * Save highest seq no we have sent so far.
13878 				 * Be careful about the invisible FIN byte.
13879 				 */
13880 				if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
13881 				    (tcp->tcp_unsent == 0)) {
13882 					tcp->tcp_rexmit_max = tcp->tcp_fss;
13883 				} else {
13884 					tcp->tcp_rexmit_max = tcp->tcp_snxt;
13885 				}
13886 
13887 				/*
13888 				 * Do not allow bursty traffic during.
13889 				 * fast recovery.  Refer to Fall and Floyd's
13890 				 * paper "Simulation-based Comparisons of
13891 				 * Tahoe, Reno and SACK TCP" (in CCR?)
13892 				 * This is a best current practise.
13893 				 */
13894 				tcp->tcp_snd_burst = TCP_CWND_SS;
13895 
13896 				/*
13897 				 * For SACK:
13898 				 * Calculate tcp_pipe, which is the
13899 				 * estimated number of bytes in
13900 				 * network.
13901 				 *
13902 				 * tcp_fack is the highest sack'ed seq num
13903 				 * TCP has received.
13904 				 *
13905 				 * tcp_pipe is explained in the above quoted
13906 				 * Fall and Floyd's paper.  tcp_fack is
13907 				 * explained in Mathis and Mahdavi's
13908 				 * "Forward Acknowledgment: Refining TCP
13909 				 * Congestion Control" in SIGCOMM '96.
13910 				 */
13911 				if (tcp->tcp_snd_sack_ok) {
13912 					ASSERT(tcp->tcp_sack_info != NULL);
13913 					if (tcp->tcp_notsack_list != NULL) {
13914 						tcp->tcp_pipe = tcp->tcp_snxt -
13915 						    tcp->tcp_fack;
13916 						tcp->tcp_sack_snxt = seg_ack;
13917 						flags |= TH_NEED_SACK_REXMIT;
13918 					} else {
13919 						/*
13920 						 * Always initialize tcp_pipe
13921 						 * even though we don't have
13922 						 * any SACK info.  If later
13923 						 * we get SACK info and
13924 						 * tcp_pipe is not initialized,
13925 						 * funny things will happen.
13926 						 */
13927 						tcp->tcp_pipe =
13928 						    tcp->tcp_cwnd_ssthresh;
13929 					}
13930 				} else {
13931 					flags |= TH_REXMIT_NEEDED;
13932 				} /* tcp_snd_sack_ok */
13933 
13934 				} else {
13935 					/*
13936 					 * Here we perform congestion
13937 					 * avoidance, but NOT slow start.
13938 					 * This is known as the Fast
13939 					 * Recovery Algorithm.
13940 					 */
13941 					if (tcp->tcp_snd_sack_ok &&
13942 					    tcp->tcp_notsack_list != NULL) {
13943 						flags |= TH_NEED_SACK_REXMIT;
13944 						tcp->tcp_pipe -= mss;
13945 						if (tcp->tcp_pipe < 0)
13946 							tcp->tcp_pipe = 0;
13947 					} else {
13948 					/*
13949 					 * We know that one more packet has
13950 					 * left the pipe thus we can update
13951 					 * cwnd.
13952 					 */
13953 					cwnd = tcp->tcp_cwnd + mss;
13954 					if (cwnd > tcp->tcp_cwnd_max)
13955 						cwnd = tcp->tcp_cwnd_max;
13956 					tcp->tcp_cwnd = cwnd;
13957 					if (tcp->tcp_unsent > 0)
13958 						flags |= TH_XMIT_NEEDED;
13959 					}
13960 				}
13961 			}
13962 		} else if (tcp->tcp_zero_win_probe) {
13963 			/*
13964 			 * If the window has opened, need to arrange
13965 			 * to send additional data.
13966 			 */
13967 			if (new_swnd != 0) {
13968 				/* tcp_suna != tcp_snxt */
13969 				/* Packet contains a window update */
13970 				BUMP_MIB(&tcp_mib, tcpInWinUpdate);
13971 				tcp->tcp_zero_win_probe = 0;
13972 				tcp->tcp_timer_backoff = 0;
13973 				tcp->tcp_ms_we_have_waited = 0;
13974 
13975 				/*
13976 				 * Transmit starting with tcp_suna since
13977 				 * the one byte probe is not ack'ed.
13978 				 * If TCP has sent more than one identical
13979 				 * probe, tcp_rexmit will be set.  That means
13980 				 * tcp_ss_rexmit() will send out the one
13981 				 * byte along with new data.  Otherwise,
13982 				 * fake the retransmission.
13983 				 */
13984 				flags |= TH_XMIT_NEEDED;
13985 				if (!tcp->tcp_rexmit) {
13986 					tcp->tcp_rexmit = B_TRUE;
13987 					tcp->tcp_dupack_cnt = 0;
13988 					tcp->tcp_rexmit_nxt = tcp->tcp_suna;
13989 					tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
13990 				}
13991 			}
13992 		}
13993 		goto swnd_update;
13994 	}
13995 
13996 	/*
13997 	 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
13998 	 * If the ACK value acks something that we have not yet sent, it might
13999 	 * be an old duplicate segment.  Send an ACK to re-synchronize the
14000 	 * other side.
14001 	 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
14002 	 * state is handled above, so we can always just drop the segment and
14003 	 * send an ACK here.
14004 	 *
14005 	 * Should we send ACKs in response to ACK only segments?
14006 	 */
14007 	if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
14008 		BUMP_MIB(&tcp_mib, tcpInAckUnsent);
14009 		/* drop the received segment */
14010 		freemsg(mp);
14011 
14012 		/*
14013 		 * Send back an ACK.  If tcp_drop_ack_unsent_cnt is
14014 		 * greater than 0, check if the number of such
14015 		 * bogus ACks is greater than that count.  If yes,
14016 		 * don't send back any ACK.  This prevents TCP from
14017 		 * getting into an ACK storm if somehow an attacker
14018 		 * successfully spoofs an acceptable segment to our
14019 		 * peer.
14020 		 */
14021 		if (tcp_drop_ack_unsent_cnt > 0 &&
14022 		    ++tcp->tcp_in_ack_unsent > tcp_drop_ack_unsent_cnt) {
14023 			TCP_STAT(tcp_in_ack_unsent_drop);
14024 			return;
14025 		}
14026 		mp = tcp_ack_mp(tcp);
14027 		if (mp != NULL) {
14028 			TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT);
14029 			BUMP_LOCAL(tcp->tcp_obsegs);
14030 			BUMP_MIB(&tcp_mib, tcpOutAck);
14031 			tcp_send_data(tcp, tcp->tcp_wq, mp);
14032 		}
14033 		return;
14034 	}
14035 
14036 	/*
14037 	 * TCP gets a new ACK, update the notsack'ed list to delete those
14038 	 * blocks that are covered by this ACK.
14039 	 */
14040 	if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
14041 		tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
14042 		    &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
14043 	}
14044 
14045 	/*
14046 	 * If we got an ACK after fast retransmit, check to see
14047 	 * if it is a partial ACK.  If it is not and the congestion
14048 	 * window was inflated to account for the other side's
14049 	 * cached packets, retract it.  If it is, do Hoe's algorithm.
14050 	 */
14051 	if (tcp->tcp_dupack_cnt >= tcp_dupack_fast_retransmit) {
14052 		ASSERT(tcp->tcp_rexmit == B_FALSE);
14053 		if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
14054 			tcp->tcp_dupack_cnt = 0;
14055 			/*
14056 			 * Restore the orig tcp_cwnd_ssthresh after
14057 			 * fast retransmit phase.
14058 			 */
14059 			if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
14060 				tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
14061 			}
14062 			tcp->tcp_rexmit_max = seg_ack;
14063 			tcp->tcp_cwnd_cnt = 0;
14064 			tcp->tcp_snd_burst = tcp->tcp_localnet ?
14065 			    TCP_CWND_INFINITE : TCP_CWND_NORMAL;
14066 
14067 			/*
14068 			 * Remove all notsack info to avoid confusion with
14069 			 * the next fast retrasnmit/recovery phase.
14070 			 */
14071 			if (tcp->tcp_snd_sack_ok &&
14072 			    tcp->tcp_notsack_list != NULL) {
14073 				TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list);
14074 			}
14075 		} else {
14076 			if (tcp->tcp_snd_sack_ok &&
14077 			    tcp->tcp_notsack_list != NULL) {
14078 				flags |= TH_NEED_SACK_REXMIT;
14079 				tcp->tcp_pipe -= mss;
14080 				if (tcp->tcp_pipe < 0)
14081 					tcp->tcp_pipe = 0;
14082 			} else {
14083 				/*
14084 				 * Hoe's algorithm:
14085 				 *
14086 				 * Retransmit the unack'ed segment and
14087 				 * restart fast recovery.  Note that we
14088 				 * need to scale back tcp_cwnd to the
14089 				 * original value when we started fast
14090 				 * recovery.  This is to prevent overly
14091 				 * aggressive behaviour in sending new
14092 				 * segments.
14093 				 */
14094 				tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
14095 					tcp_dupack_fast_retransmit * mss;
14096 				tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
14097 				flags |= TH_REXMIT_NEEDED;
14098 			}
14099 		}
14100 	} else {
14101 		tcp->tcp_dupack_cnt = 0;
14102 		if (tcp->tcp_rexmit) {
14103 			/*
14104 			 * TCP is retranmitting.  If the ACK ack's all
14105 			 * outstanding data, update tcp_rexmit_max and
14106 			 * tcp_rexmit_nxt.  Otherwise, update tcp_rexmit_nxt
14107 			 * to the correct value.
14108 			 *
14109 			 * Note that SEQ_LEQ() is used.  This is to avoid
14110 			 * unnecessary fast retransmit caused by dup ACKs
14111 			 * received when TCP does slow start retransmission
14112 			 * after a time out.  During this phase, TCP may
14113 			 * send out segments which are already received.
14114 			 * This causes dup ACKs to be sent back.
14115 			 */
14116 			if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
14117 				if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
14118 					tcp->tcp_rexmit_nxt = seg_ack;
14119 				}
14120 				if (seg_ack != tcp->tcp_rexmit_max) {
14121 					flags |= TH_XMIT_NEEDED;
14122 				}
14123 			} else {
14124 				tcp->tcp_rexmit = B_FALSE;
14125 				tcp->tcp_xmit_zc_clean = B_FALSE;
14126 				tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
14127 				tcp->tcp_snd_burst = tcp->tcp_localnet ?
14128 				    TCP_CWND_INFINITE : TCP_CWND_NORMAL;
14129 			}
14130 			tcp->tcp_ms_we_have_waited = 0;
14131 		}
14132 	}
14133 
14134 	BUMP_MIB(&tcp_mib, tcpInAckSegs);
14135 	UPDATE_MIB(&tcp_mib, tcpInAckBytes, bytes_acked);
14136 	tcp->tcp_suna = seg_ack;
14137 	if (tcp->tcp_zero_win_probe != 0) {
14138 		tcp->tcp_zero_win_probe = 0;
14139 		tcp->tcp_timer_backoff = 0;
14140 	}
14141 
14142 	/*
14143 	 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
14144 	 * Note that it cannot be the SYN being ack'ed.  The code flow
14145 	 * will not reach here.
14146 	 */
14147 	if (mp1 == NULL) {
14148 		goto fin_acked;
14149 	}
14150 
14151 	/*
14152 	 * Update the congestion window.
14153 	 *
14154 	 * If TCP is not ECN capable or TCP is ECN capable but the
14155 	 * congestion experience bit is not set, increase the tcp_cwnd as
14156 	 * usual.
14157 	 */
14158 	if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
14159 		cwnd = tcp->tcp_cwnd;
14160 		add = mss;
14161 
14162 		if (cwnd >= tcp->tcp_cwnd_ssthresh) {
14163 			/*
14164 			 * This is to prevent an increase of less than 1 MSS of
14165 			 * tcp_cwnd.  With partial increase, tcp_wput_data()
14166 			 * may send out tinygrams in order to preserve mblk
14167 			 * boundaries.
14168 			 *
14169 			 * By initializing tcp_cwnd_cnt to new tcp_cwnd and
14170 			 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
14171 			 * increased by 1 MSS for every RTTs.
14172 			 */
14173 			if (tcp->tcp_cwnd_cnt <= 0) {
14174 				tcp->tcp_cwnd_cnt = cwnd + add;
14175 			} else {
14176 				tcp->tcp_cwnd_cnt -= add;
14177 				add = 0;
14178 			}
14179 		}
14180 		tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
14181 	}
14182 
14183 	/* See if the latest urgent data has been acknowledged */
14184 	if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
14185 	    SEQ_GT(seg_ack, tcp->tcp_urg))
14186 		tcp->tcp_valid_bits &= ~TCP_URG_VALID;
14187 
14188 	/* Can we update the RTT estimates? */
14189 	if (tcp->tcp_snd_ts_ok) {
14190 		/* Ignore zero timestamp echo-reply. */
14191 		if (tcpopt.tcp_opt_ts_ecr != 0) {
14192 			tcp_set_rto(tcp, (int32_t)lbolt -
14193 			    (int32_t)tcpopt.tcp_opt_ts_ecr);
14194 		}
14195 
14196 		/* If needed, restart the timer. */
14197 		if (tcp->tcp_set_timer == 1) {
14198 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
14199 			tcp->tcp_set_timer = 0;
14200 		}
14201 		/*
14202 		 * Update tcp_csuna in case the other side stops sending
14203 		 * us timestamps.
14204 		 */
14205 		tcp->tcp_csuna = tcp->tcp_snxt;
14206 	} else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
14207 		/*
14208 		 * An ACK sequence we haven't seen before, so get the RTT
14209 		 * and update the RTO. But first check if the timestamp is
14210 		 * valid to use.
14211 		 */
14212 		if ((mp1->b_next != NULL) &&
14213 		    SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next)))
14214 			tcp_set_rto(tcp, (int32_t)lbolt -
14215 			    (int32_t)(intptr_t)mp1->b_prev);
14216 		else
14217 			BUMP_MIB(&tcp_mib, tcpRttNoUpdate);
14218 
14219 		/* Remeber the last sequence to be ACKed */
14220 		tcp->tcp_csuna = seg_ack;
14221 		if (tcp->tcp_set_timer == 1) {
14222 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
14223 			tcp->tcp_set_timer = 0;
14224 		}
14225 	} else {
14226 		BUMP_MIB(&tcp_mib, tcpRttNoUpdate);
14227 	}
14228 
14229 	/* Eat acknowledged bytes off the xmit queue. */
14230 	for (;;) {
14231 		mblk_t	*mp2;
14232 		uchar_t	*wptr;
14233 
14234 		wptr = mp1->b_wptr;
14235 		ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
14236 		bytes_acked -= (int)(wptr - mp1->b_rptr);
14237 		if (bytes_acked < 0) {
14238 			mp1->b_rptr = wptr + bytes_acked;
14239 			/*
14240 			 * Set a new timestamp if all the bytes timed by the
14241 			 * old timestamp have been ack'ed.
14242 			 */
14243 			if (SEQ_GT(seg_ack,
14244 			    (uint32_t)(uintptr_t)(mp1->b_next))) {
14245 				mp1->b_prev = (mblk_t *)(uintptr_t)lbolt;
14246 				mp1->b_next = NULL;
14247 			}
14248 			break;
14249 		}
14250 		mp1->b_next = NULL;
14251 		mp1->b_prev = NULL;
14252 		mp2 = mp1;
14253 		mp1 = mp1->b_cont;
14254 
14255 		/*
14256 		 * This notification is required for some zero-copy
14257 		 * clients to maintain a copy semantic. After the data
14258 		 * is ack'ed, client is safe to modify or reuse the buffer.
14259 		 */
14260 		if (tcp->tcp_snd_zcopy_aware &&
14261 		    (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
14262 			tcp_zcopy_notify(tcp);
14263 		freeb(mp2);
14264 		if (bytes_acked == 0) {
14265 			if (mp1 == NULL) {
14266 				/* Everything is ack'ed, clear the tail. */
14267 				tcp->tcp_xmit_tail = NULL;
14268 				/*
14269 				 * Cancel the timer unless we are still
14270 				 * waiting for an ACK for the FIN packet.
14271 				 */
14272 				if (tcp->tcp_timer_tid != 0 &&
14273 				    tcp->tcp_snxt == tcp->tcp_suna) {
14274 					(void) TCP_TIMER_CANCEL(tcp,
14275 					    tcp->tcp_timer_tid);
14276 					tcp->tcp_timer_tid = 0;
14277 				}
14278 				goto pre_swnd_update;
14279 			}
14280 			if (mp2 != tcp->tcp_xmit_tail)
14281 				break;
14282 			tcp->tcp_xmit_tail = mp1;
14283 			ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
14284 			    (uintptr_t)INT_MAX);
14285 			tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
14286 			    mp1->b_rptr);
14287 			break;
14288 		}
14289 		if (mp1 == NULL) {
14290 			/*
14291 			 * More was acked but there is nothing more
14292 			 * outstanding.  This means that the FIN was
14293 			 * just acked or that we're talking to a clown.
14294 			 */
14295 fin_acked:
14296 			ASSERT(tcp->tcp_fin_sent);
14297 			tcp->tcp_xmit_tail = NULL;
14298 			if (tcp->tcp_fin_sent) {
14299 				/* FIN was acked - making progress */
14300 				if (tcp->tcp_ipversion == IPV6_VERSION &&
14301 				    !tcp->tcp_fin_acked)
14302 					tcp->tcp_ip_forward_progress = B_TRUE;
14303 				tcp->tcp_fin_acked = B_TRUE;
14304 				if (tcp->tcp_linger_tid != 0 &&
14305 				    TCP_TIMER_CANCEL(tcp,
14306 					tcp->tcp_linger_tid) >= 0) {
14307 					tcp_stop_lingering(tcp);
14308 				}
14309 			} else {
14310 				/*
14311 				 * We should never get here because
14312 				 * we have already checked that the
14313 				 * number of bytes ack'ed should be
14314 				 * smaller than or equal to what we
14315 				 * have sent so far (it is the
14316 				 * acceptability check of the ACK).
14317 				 * We can only get here if the send
14318 				 * queue is corrupted.
14319 				 *
14320 				 * Terminate the connection and
14321 				 * panic the system.  It is better
14322 				 * for us to panic instead of
14323 				 * continuing to avoid other disaster.
14324 				 */
14325 				tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
14326 				    tcp->tcp_rnxt, TH_RST|TH_ACK);
14327 				panic("Memory corruption "
14328 				    "detected for connection %s.",
14329 				    tcp_display(tcp, NULL,
14330 					DISP_ADDR_AND_PORT));
14331 				/*NOTREACHED*/
14332 			}
14333 			goto pre_swnd_update;
14334 		}
14335 		ASSERT(mp2 != tcp->tcp_xmit_tail);
14336 	}
14337 	if (tcp->tcp_unsent) {
14338 		flags |= TH_XMIT_NEEDED;
14339 	}
14340 pre_swnd_update:
14341 	tcp->tcp_xmit_head = mp1;
14342 swnd_update:
14343 	/*
14344 	 * The following check is different from most other implementations.
14345 	 * For bi-directional transfer, when segments are dropped, the
14346 	 * "normal" check will not accept a window update in those
14347 	 * retransmitted segemnts.  Failing to do that, TCP may send out
14348 	 * segments which are outside receiver's window.  As TCP accepts
14349 	 * the ack in those retransmitted segments, if the window update in
14350 	 * the same segment is not accepted, TCP will incorrectly calculates
14351 	 * that it can send more segments.  This can create a deadlock
14352 	 * with the receiver if its window becomes zero.
14353 	 */
14354 	if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
14355 	    SEQ_LT(tcp->tcp_swl1, seg_seq) ||
14356 	    (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
14357 		/*
14358 		 * The criteria for update is:
14359 		 *
14360 		 * 1. the segment acknowledges some data.  Or
14361 		 * 2. the segment is new, i.e. it has a higher seq num. Or
14362 		 * 3. the segment is not old and the advertised window is
14363 		 * larger than the previous advertised window.
14364 		 */
14365 		if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
14366 			flags |= TH_XMIT_NEEDED;
14367 		tcp->tcp_swnd = new_swnd;
14368 		if (new_swnd > tcp->tcp_max_swnd)
14369 			tcp->tcp_max_swnd = new_swnd;
14370 		tcp->tcp_swl1 = seg_seq;
14371 		tcp->tcp_swl2 = seg_ack;
14372 	}
14373 est:
14374 	if (tcp->tcp_state > TCPS_ESTABLISHED) {
14375 
14376 		switch (tcp->tcp_state) {
14377 		case TCPS_FIN_WAIT_1:
14378 			if (tcp->tcp_fin_acked) {
14379 				tcp->tcp_state = TCPS_FIN_WAIT_2;
14380 				/*
14381 				 * We implement the non-standard BSD/SunOS
14382 				 * FIN_WAIT_2 flushing algorithm.
14383 				 * If there is no user attached to this
14384 				 * TCP endpoint, then this TCP struct
14385 				 * could hang around forever in FIN_WAIT_2
14386 				 * state if the peer forgets to send us
14387 				 * a FIN.  To prevent this, we wait only
14388 				 * 2*MSL (a convenient time value) for
14389 				 * the FIN to arrive.  If it doesn't show up,
14390 				 * we flush the TCP endpoint.  This algorithm,
14391 				 * though a violation of RFC-793, has worked
14392 				 * for over 10 years in BSD systems.
14393 				 * Note: SunOS 4.x waits 675 seconds before
14394 				 * flushing the FIN_WAIT_2 connection.
14395 				 */
14396 				TCP_TIMER_RESTART(tcp,
14397 				    tcp_fin_wait_2_flush_interval);
14398 			}
14399 			break;
14400 		case TCPS_FIN_WAIT_2:
14401 			break;	/* Shutdown hook? */
14402 		case TCPS_LAST_ACK:
14403 			freemsg(mp);
14404 			if (tcp->tcp_fin_acked) {
14405 				(void) tcp_clean_death(tcp, 0, 19);
14406 				return;
14407 			}
14408 			goto xmit_check;
14409 		case TCPS_CLOSING:
14410 			if (tcp->tcp_fin_acked) {
14411 				tcp->tcp_state = TCPS_TIME_WAIT;
14412 				/*
14413 				 * Unconditionally clear the exclusive binding
14414 				 * bit so this TIME-WAIT connection won't
14415 				 * interfere with new ones.
14416 				 */
14417 				tcp->tcp_exclbind = 0;
14418 				if (!TCP_IS_DETACHED(tcp)) {
14419 					TCP_TIMER_RESTART(tcp,
14420 					    tcp_time_wait_interval);
14421 				} else {
14422 					tcp_time_wait_append(tcp);
14423 					TCP_DBGSTAT(tcp_rput_time_wait);
14424 				}
14425 			}
14426 			/*FALLTHRU*/
14427 		case TCPS_CLOSE_WAIT:
14428 			freemsg(mp);
14429 			goto xmit_check;
14430 		default:
14431 			ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
14432 			break;
14433 		}
14434 	}
14435 	if (flags & TH_FIN) {
14436 		/* Make sure we ack the fin */
14437 		flags |= TH_ACK_NEEDED;
14438 		if (!tcp->tcp_fin_rcvd) {
14439 			tcp->tcp_fin_rcvd = B_TRUE;
14440 			tcp->tcp_rnxt++;
14441 			tcph = tcp->tcp_tcph;
14442 			U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack);
14443 
14444 			/*
14445 			 * Generate the ordrel_ind at the end unless we
14446 			 * are an eager guy.
14447 			 * In the eager case tcp_rsrv will do this when run
14448 			 * after tcp_accept is done.
14449 			 */
14450 			if (tcp->tcp_listener == NULL &&
14451 			    !TCP_IS_DETACHED(tcp) && (!tcp->tcp_hard_binding))
14452 				flags |= TH_ORDREL_NEEDED;
14453 			switch (tcp->tcp_state) {
14454 			case TCPS_SYN_RCVD:
14455 			case TCPS_ESTABLISHED:
14456 				tcp->tcp_state = TCPS_CLOSE_WAIT;
14457 				/* Keepalive? */
14458 				break;
14459 			case TCPS_FIN_WAIT_1:
14460 				if (!tcp->tcp_fin_acked) {
14461 					tcp->tcp_state = TCPS_CLOSING;
14462 					break;
14463 				}
14464 				/* FALLTHRU */
14465 			case TCPS_FIN_WAIT_2:
14466 				tcp->tcp_state = TCPS_TIME_WAIT;
14467 				/*
14468 				 * Unconditionally clear the exclusive binding
14469 				 * bit so this TIME-WAIT connection won't
14470 				 * interfere with new ones.
14471 				 */
14472 				tcp->tcp_exclbind = 0;
14473 				if (!TCP_IS_DETACHED(tcp)) {
14474 					TCP_TIMER_RESTART(tcp,
14475 					    tcp_time_wait_interval);
14476 				} else {
14477 					tcp_time_wait_append(tcp);
14478 					TCP_DBGSTAT(tcp_rput_time_wait);
14479 				}
14480 				if (seg_len) {
14481 					/*
14482 					 * implies data piggybacked on FIN.
14483 					 * break to handle data.
14484 					 */
14485 					break;
14486 				}
14487 				freemsg(mp);
14488 				goto ack_check;
14489 			}
14490 		}
14491 	}
14492 	if (mp == NULL)
14493 		goto xmit_check;
14494 	if (seg_len == 0) {
14495 		freemsg(mp);
14496 		goto xmit_check;
14497 	}
14498 	if (mp->b_rptr == mp->b_wptr) {
14499 		/*
14500 		 * The header has been consumed, so we remove the
14501 		 * zero-length mblk here.
14502 		 */
14503 		mp1 = mp;
14504 		mp = mp->b_cont;
14505 		freeb(mp1);
14506 	}
14507 	tcph = tcp->tcp_tcph;
14508 	tcp->tcp_rack_cnt++;
14509 	{
14510 		uint32_t cur_max;
14511 
14512 		cur_max = tcp->tcp_rack_cur_max;
14513 		if (tcp->tcp_rack_cnt >= cur_max) {
14514 			/*
14515 			 * We have more unacked data than we should - send
14516 			 * an ACK now.
14517 			 */
14518 			flags |= TH_ACK_NEEDED;
14519 			cur_max++;
14520 			if (cur_max > tcp->tcp_rack_abs_max)
14521 				tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
14522 			else
14523 				tcp->tcp_rack_cur_max = cur_max;
14524 		} else if (TCP_IS_DETACHED(tcp)) {
14525 			/* We don't have an ACK timer for detached TCP. */
14526 			flags |= TH_ACK_NEEDED;
14527 		} else if (seg_len < mss) {
14528 			/*
14529 			 * If we get a segment that is less than an mss, and we
14530 			 * already have unacknowledged data, and the amount
14531 			 * unacknowledged is not a multiple of mss, then we
14532 			 * better generate an ACK now.  Otherwise, this may be
14533 			 * the tail piece of a transaction, and we would rather
14534 			 * wait for the response.
14535 			 */
14536 			uint32_t udif;
14537 			ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
14538 			    (uintptr_t)INT_MAX);
14539 			udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
14540 			if (udif && (udif % mss))
14541 				flags |= TH_ACK_NEEDED;
14542 			else
14543 				flags |= TH_ACK_TIMER_NEEDED;
14544 		} else {
14545 			/* Start delayed ack timer */
14546 			flags |= TH_ACK_TIMER_NEEDED;
14547 		}
14548 	}
14549 	tcp->tcp_rnxt += seg_len;
14550 	U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack);
14551 
14552 	/* Update SACK list */
14553 	if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
14554 		tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
14555 		    &(tcp->tcp_num_sack_blk));
14556 	}
14557 
14558 	if (tcp->tcp_urp_mp) {
14559 		tcp->tcp_urp_mp->b_cont = mp;
14560 		mp = tcp->tcp_urp_mp;
14561 		tcp->tcp_urp_mp = NULL;
14562 		/* Ready for a new signal. */
14563 		tcp->tcp_urp_last_valid = B_FALSE;
14564 #ifdef DEBUG
14565 		(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
14566 		    "tcp_rput: sending exdata_ind %s",
14567 		    tcp_display(tcp, NULL, DISP_PORT_ONLY));
14568 #endif /* DEBUG */
14569 	}
14570 
14571 	/*
14572 	 * Check for ancillary data changes compared to last segment.
14573 	 */
14574 	if (tcp->tcp_ipv6_recvancillary != 0) {
14575 		mp = tcp_rput_add_ancillary(tcp, mp, &ipp);
14576 		if (mp == NULL)
14577 			return;
14578 	}
14579 
14580 	if (tcp->tcp_listener || tcp->tcp_hard_binding) {
14581 		/*
14582 		 * Side queue inbound data until the accept happens.
14583 		 * tcp_accept/tcp_rput drains this when the accept happens.
14584 		 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
14585 		 * T_EXDATA_IND) it is queued on b_next.
14586 		 * XXX Make urgent data use this. Requires:
14587 		 *	Removing tcp_listener check for TH_URG
14588 		 *	Making M_PCPROTO and MARK messages skip the eager case
14589 		 */
14590 
14591 		if (tcp->tcp_kssl_pending) {
14592 			tcp_kssl_input(tcp, mp);
14593 		} else {
14594 			tcp_rcv_enqueue(tcp, mp, seg_len);
14595 		}
14596 	} else {
14597 		if (mp->b_datap->db_type != M_DATA ||
14598 		    (flags & TH_MARKNEXT_NEEDED)) {
14599 			if (tcp->tcp_rcv_list != NULL) {
14600 				flags |= tcp_rcv_drain(tcp->tcp_rq, tcp);
14601 			}
14602 			ASSERT(tcp->tcp_rcv_list == NULL ||
14603 			    tcp->tcp_fused_sigurg);
14604 			if (flags & TH_MARKNEXT_NEEDED) {
14605 #ifdef DEBUG
14606 				(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
14607 				    "tcp_rput: sending MSGMARKNEXT %s",
14608 				    tcp_display(tcp, NULL,
14609 				    DISP_PORT_ONLY));
14610 #endif /* DEBUG */
14611 				mp->b_flag |= MSGMARKNEXT;
14612 				flags &= ~TH_MARKNEXT_NEEDED;
14613 			}
14614 
14615 			/* Does this need SSL processing first? */
14616 			if ((tcp->tcp_kssl_ctx  != NULL) &&
14617 			    (DB_TYPE(mp) == M_DATA)) {
14618 				tcp_kssl_input(tcp, mp);
14619 			} else {
14620 				putnext(tcp->tcp_rq, mp);
14621 				if (!canputnext(tcp->tcp_rq))
14622 					tcp->tcp_rwnd -= seg_len;
14623 			}
14624 		} else if ((flags & (TH_PUSH|TH_FIN)) ||
14625 		    tcp->tcp_rcv_cnt + seg_len >= tcp->tcp_rq->q_hiwat >> 3) {
14626 			if (tcp->tcp_rcv_list != NULL) {
14627 				/*
14628 				 * Enqueue the new segment first and then
14629 				 * call tcp_rcv_drain() to send all data
14630 				 * up.  The other way to do this is to
14631 				 * send all queued data up and then call
14632 				 * putnext() to send the new segment up.
14633 				 * This way can remove the else part later
14634 				 * on.
14635 				 *
14636 				 * We don't this to avoid one more call to
14637 				 * canputnext() as tcp_rcv_drain() needs to
14638 				 * call canputnext().
14639 				 */
14640 				tcp_rcv_enqueue(tcp, mp, seg_len);
14641 				flags |= tcp_rcv_drain(tcp->tcp_rq, tcp);
14642 			} else {
14643 				/* Does this need SSL processing first? */
14644 				if ((tcp->tcp_kssl_ctx  != NULL) &&
14645 				    (DB_TYPE(mp) == M_DATA)) {
14646 					tcp_kssl_input(tcp, mp);
14647 				} else {
14648 					putnext(tcp->tcp_rq, mp);
14649 					if (!canputnext(tcp->tcp_rq))
14650 						tcp->tcp_rwnd -= seg_len;
14651 				}
14652 			}
14653 		} else {
14654 			/*
14655 			 * Enqueue all packets when processing an mblk
14656 			 * from the co queue and also enqueue normal packets.
14657 			 */
14658 			tcp_rcv_enqueue(tcp, mp, seg_len);
14659 		}
14660 		/*
14661 		 * Make sure the timer is running if we have data waiting
14662 		 * for a push bit. This provides resiliency against
14663 		 * implementations that do not correctly generate push bits.
14664 		 */
14665 		if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
14666 			/*
14667 			 * The connection may be closed at this point, so don't
14668 			 * do anything for a detached tcp.
14669 			 */
14670 			if (!TCP_IS_DETACHED(tcp))
14671 				tcp->tcp_push_tid = TCP_TIMER(tcp,
14672 				    tcp_push_timer,
14673 				    MSEC_TO_TICK(tcp_push_timer_interval));
14674 		}
14675 	}
14676 xmit_check:
14677 	/* Is there anything left to do? */
14678 	ASSERT(!(flags & TH_MARKNEXT_NEEDED));
14679 	if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
14680 	    TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
14681 	    TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
14682 		goto done;
14683 
14684 	/* Any transmit work to do and a non-zero window? */
14685 	if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
14686 	    TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
14687 		if (flags & TH_REXMIT_NEEDED) {
14688 			uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
14689 
14690 			BUMP_MIB(&tcp_mib, tcpOutFastRetrans);
14691 			if (snd_size > mss)
14692 				snd_size = mss;
14693 			if (snd_size > tcp->tcp_swnd)
14694 				snd_size = tcp->tcp_swnd;
14695 			mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
14696 			    NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
14697 			    B_TRUE);
14698 
14699 			if (mp1 != NULL) {
14700 				tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt;
14701 				tcp->tcp_csuna = tcp->tcp_snxt;
14702 				BUMP_MIB(&tcp_mib, tcpRetransSegs);
14703 				UPDATE_MIB(&tcp_mib, tcpRetransBytes, snd_size);
14704 				TCP_RECORD_TRACE(tcp, mp1,
14705 				    TCP_TRACE_SEND_PKT);
14706 				tcp_send_data(tcp, tcp->tcp_wq, mp1);
14707 			}
14708 		}
14709 		if (flags & TH_NEED_SACK_REXMIT) {
14710 			tcp_sack_rxmit(tcp, &flags);
14711 		}
14712 		/*
14713 		 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
14714 		 * out new segment.  Note that tcp_rexmit should not be
14715 		 * set, otherwise TH_LIMIT_XMIT should not be set.
14716 		 */
14717 		if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
14718 			if (!tcp->tcp_rexmit) {
14719 				tcp_wput_data(tcp, NULL, B_FALSE);
14720 			} else {
14721 				tcp_ss_rexmit(tcp);
14722 			}
14723 		}
14724 		/*
14725 		 * Adjust tcp_cwnd back to normal value after sending
14726 		 * new data segments.
14727 		 */
14728 		if (flags & TH_LIMIT_XMIT) {
14729 			tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
14730 			/*
14731 			 * This will restart the timer.  Restarting the
14732 			 * timer is used to avoid a timeout before the
14733 			 * limited transmitted segment's ACK gets back.
14734 			 */
14735 			if (tcp->tcp_xmit_head != NULL)
14736 				tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt;
14737 		}
14738 
14739 		/* Anything more to do? */
14740 		if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
14741 		    TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
14742 			goto done;
14743 	}
14744 ack_check:
14745 	if (flags & TH_SEND_URP_MARK) {
14746 		ASSERT(tcp->tcp_urp_mark_mp);
14747 		/*
14748 		 * Send up any queued data and then send the mark message
14749 		 */
14750 		if (tcp->tcp_rcv_list != NULL) {
14751 			flags |= tcp_rcv_drain(tcp->tcp_rq, tcp);
14752 		}
14753 		ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
14754 
14755 		mp1 = tcp->tcp_urp_mark_mp;
14756 		tcp->tcp_urp_mark_mp = NULL;
14757 #ifdef DEBUG
14758 		(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
14759 		    "tcp_rput: sending zero-length %s %s",
14760 		    ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
14761 		    "MSGNOTMARKNEXT"),
14762 		    tcp_display(tcp, NULL, DISP_PORT_ONLY));
14763 #endif /* DEBUG */
14764 		putnext(tcp->tcp_rq, mp1);
14765 		flags &= ~TH_SEND_URP_MARK;
14766 	}
14767 	if (flags & TH_ACK_NEEDED) {
14768 		/*
14769 		 * Time to send an ack for some reason.
14770 		 */
14771 		mp1 = tcp_ack_mp(tcp);
14772 
14773 		if (mp1 != NULL) {
14774 			TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT);
14775 			tcp_send_data(tcp, tcp->tcp_wq, mp1);
14776 			BUMP_LOCAL(tcp->tcp_obsegs);
14777 			BUMP_MIB(&tcp_mib, tcpOutAck);
14778 		}
14779 		if (tcp->tcp_ack_tid != 0) {
14780 			(void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
14781 			tcp->tcp_ack_tid = 0;
14782 		}
14783 	}
14784 	if (flags & TH_ACK_TIMER_NEEDED) {
14785 		/*
14786 		 * Arrange for deferred ACK or push wait timeout.
14787 		 * Start timer if it is not already running.
14788 		 */
14789 		if (tcp->tcp_ack_tid == 0) {
14790 			tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
14791 			    MSEC_TO_TICK(tcp->tcp_localnet ?
14792 			    (clock_t)tcp_local_dack_interval :
14793 			    (clock_t)tcp_deferred_ack_interval));
14794 		}
14795 	}
14796 	if (flags & TH_ORDREL_NEEDED) {
14797 		/*
14798 		 * Send up the ordrel_ind unless we are an eager guy.
14799 		 * In the eager case tcp_rsrv will do this when run
14800 		 * after tcp_accept is done.
14801 		 */
14802 		ASSERT(tcp->tcp_listener == NULL);
14803 		if (tcp->tcp_rcv_list != NULL) {
14804 			/*
14805 			 * Push any mblk(s) enqueued from co processing.
14806 			 */
14807 			flags |= tcp_rcv_drain(tcp->tcp_rq, tcp);
14808 		}
14809 		ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
14810 		if ((mp1 = mi_tpi_ordrel_ind()) != NULL) {
14811 			tcp->tcp_ordrel_done = B_TRUE;
14812 			putnext(tcp->tcp_rq, mp1);
14813 			if (tcp->tcp_deferred_clean_death) {
14814 				/*
14815 				 * tcp_clean_death was deferred
14816 				 * for T_ORDREL_IND - do it now
14817 				 */
14818 				(void) tcp_clean_death(tcp,
14819 				    tcp->tcp_client_errno, 20);
14820 				tcp->tcp_deferred_clean_death =	B_FALSE;
14821 			}
14822 		} else {
14823 			/*
14824 			 * Run the orderly release in the
14825 			 * service routine.
14826 			 */
14827 			qenable(tcp->tcp_rq);
14828 			/*
14829 			 * Caveat(XXX): The machine may be so
14830 			 * overloaded that tcp_rsrv() is not scheduled
14831 			 * until after the endpoint has transitioned
14832 			 * to TCPS_TIME_WAIT
14833 			 * and tcp_time_wait_interval expires. Then
14834 			 * tcp_timer() will blow away state in tcp_t
14835 			 * and T_ORDREL_IND will never be delivered
14836 			 * upstream. Unlikely but potentially
14837 			 * a problem.
14838 			 */
14839 		}
14840 	}
14841 done:
14842 	ASSERT(!(flags & TH_MARKNEXT_NEEDED));
14843 }
14844 
14845 /*
14846  * This function does PAWS protection check. Returns B_TRUE if the
14847  * segment passes the PAWS test, else returns B_FALSE.
14848  */
14849 boolean_t
14850 tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp)
14851 {
14852 	uint8_t	flags;
14853 	int	options;
14854 	uint8_t *up;
14855 
14856 	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
14857 	/*
14858 	 * If timestamp option is aligned nicely, get values inline,
14859 	 * otherwise call general routine to parse.  Only do that
14860 	 * if timestamp is the only option.
14861 	 */
14862 	if (TCP_HDR_LENGTH(tcph) == (uint32_t)TCP_MIN_HEADER_LENGTH +
14863 	    TCPOPT_REAL_TS_LEN &&
14864 	    OK_32PTR((up = ((uint8_t *)tcph) +
14865 	    TCP_MIN_HEADER_LENGTH)) &&
14866 	    *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
14867 		tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4));
14868 		tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
14869 
14870 		options = TCP_OPT_TSTAMP_PRESENT;
14871 	} else {
14872 		if (tcp->tcp_snd_sack_ok) {
14873 			tcpoptp->tcp = tcp;
14874 		} else {
14875 			tcpoptp->tcp = NULL;
14876 		}
14877 		options = tcp_parse_options(tcph, tcpoptp);
14878 	}
14879 
14880 	if (options & TCP_OPT_TSTAMP_PRESENT) {
14881 		/*
14882 		 * Do PAWS per RFC 1323 section 4.2.  Accept RST
14883 		 * regardless of the timestamp, page 18 RFC 1323.bis.
14884 		 */
14885 		if ((flags & TH_RST) == 0 &&
14886 		    TSTMP_LT(tcpoptp->tcp_opt_ts_val,
14887 		    tcp->tcp_ts_recent)) {
14888 			if (TSTMP_LT(lbolt64, tcp->tcp_last_rcv_lbolt +
14889 			    PAWS_TIMEOUT)) {
14890 				/* This segment is not acceptable. */
14891 				return (B_FALSE);
14892 			} else {
14893 				/*
14894 				 * Connection has been idle for
14895 				 * too long.  Reset the timestamp
14896 				 * and assume the segment is valid.
14897 				 */
14898 				tcp->tcp_ts_recent =
14899 				    tcpoptp->tcp_opt_ts_val;
14900 			}
14901 		}
14902 	} else {
14903 		/*
14904 		 * If we don't get a timestamp on every packet, we
14905 		 * figure we can't really trust 'em, so we stop sending
14906 		 * and parsing them.
14907 		 */
14908 		tcp->tcp_snd_ts_ok = B_FALSE;
14909 
14910 		tcp->tcp_hdr_len -= TCPOPT_REAL_TS_LEN;
14911 		tcp->tcp_tcp_hdr_len -= TCPOPT_REAL_TS_LEN;
14912 		tcp->tcp_tcph->th_offset_and_rsrvd[0] -= (3 << 4);
14913 		tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN);
14914 		if (tcp->tcp_snd_sack_ok) {
14915 			ASSERT(tcp->tcp_sack_info != NULL);
14916 			tcp->tcp_max_sack_blk = 4;
14917 		}
14918 	}
14919 	return (B_TRUE);
14920 }
14921 
14922 /*
14923  * Attach ancillary data to a received TCP segments for the
14924  * ancillary pieces requested by the application that are
14925  * different than they were in the previous data segment.
14926  *
14927  * Save the "current" values once memory allocation is ok so that
14928  * when memory allocation fails we can just wait for the next data segment.
14929  */
14930 static mblk_t *
14931 tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp)
14932 {
14933 	struct T_optdata_ind *todi;
14934 	int optlen;
14935 	uchar_t *optptr;
14936 	struct T_opthdr *toh;
14937 	uint_t addflag;	/* Which pieces to add */
14938 	mblk_t *mp1;
14939 
14940 	optlen = 0;
14941 	addflag = 0;
14942 	/* If app asked for pktinfo and the index has changed ... */
14943 	if ((ipp->ipp_fields & IPPF_IFINDEX) &&
14944 	    ipp->ipp_ifindex != tcp->tcp_recvifindex &&
14945 	    (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO)) {
14946 		optlen += sizeof (struct T_opthdr) +
14947 		    sizeof (struct in6_pktinfo);
14948 		addflag |= TCP_IPV6_RECVPKTINFO;
14949 	}
14950 	/* If app asked for hoplimit and it has changed ... */
14951 	if ((ipp->ipp_fields & IPPF_HOPLIMIT) &&
14952 	    ipp->ipp_hoplimit != tcp->tcp_recvhops &&
14953 	    (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPLIMIT)) {
14954 		optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
14955 		addflag |= TCP_IPV6_RECVHOPLIMIT;
14956 	}
14957 	/* If app asked for tclass and it has changed ... */
14958 	if ((ipp->ipp_fields & IPPF_TCLASS) &&
14959 	    ipp->ipp_tclass != tcp->tcp_recvtclass &&
14960 	    (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS)) {
14961 		optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
14962 		addflag |= TCP_IPV6_RECVTCLASS;
14963 	}
14964 	/*
14965 	 * If app asked for hopbyhop headers and it has changed ...
14966 	 * For security labels, note that (1) security labels can't change on
14967 	 * a connected socket at all, (2) we're connected to at most one peer,
14968 	 * (3) if anything changes, then it must be some other extra option.
14969 	 */
14970 	if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) &&
14971 	    ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
14972 	    (ipp->ipp_fields & IPPF_HOPOPTS),
14973 	    ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
14974 		optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen -
14975 		    tcp->tcp_label_len;
14976 		addflag |= TCP_IPV6_RECVHOPOPTS;
14977 		if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
14978 		    &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
14979 		    ipp->ipp_hopopts, ipp->ipp_hopoptslen))
14980 			return (mp);
14981 	}
14982 	/* If app asked for dst headers before routing headers ... */
14983 	if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTDSTOPTS) &&
14984 	    ip_cmpbuf(tcp->tcp_rtdstopts, tcp->tcp_rtdstoptslen,
14985 		(ipp->ipp_fields & IPPF_RTDSTOPTS),
14986 		ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) {
14987 		optlen += sizeof (struct T_opthdr) +
14988 		    ipp->ipp_rtdstoptslen;
14989 		addflag |= TCP_IPV6_RECVRTDSTOPTS;
14990 		if (!ip_allocbuf((void **)&tcp->tcp_rtdstopts,
14991 		    &tcp->tcp_rtdstoptslen, (ipp->ipp_fields & IPPF_RTDSTOPTS),
14992 		    ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen))
14993 			return (mp);
14994 	}
14995 	/* If app asked for routing headers and it has changed ... */
14996 	if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) &&
14997 	    ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
14998 	    (ipp->ipp_fields & IPPF_RTHDR),
14999 	    ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
15000 		optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
15001 		addflag |= TCP_IPV6_RECVRTHDR;
15002 		if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
15003 		    &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
15004 		    ipp->ipp_rthdr, ipp->ipp_rthdrlen))
15005 			return (mp);
15006 	}
15007 	/* If app asked for dest headers and it has changed ... */
15008 	if ((tcp->tcp_ipv6_recvancillary &
15009 	    (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) &&
15010 	    ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
15011 	    (ipp->ipp_fields & IPPF_DSTOPTS),
15012 	    ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
15013 		optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
15014 		addflag |= TCP_IPV6_RECVDSTOPTS;
15015 		if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
15016 		    &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
15017 		    ipp->ipp_dstopts, ipp->ipp_dstoptslen))
15018 			return (mp);
15019 	}
15020 
15021 	if (optlen == 0) {
15022 		/* Nothing to add */
15023 		return (mp);
15024 	}
15025 	mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
15026 	if (mp1 == NULL) {
15027 		/*
15028 		 * Defer sending ancillary data until the next TCP segment
15029 		 * arrives.
15030 		 */
15031 		return (mp);
15032 	}
15033 	mp1->b_cont = mp;
15034 	mp = mp1;
15035 	mp->b_wptr += sizeof (*todi) + optlen;
15036 	mp->b_datap->db_type = M_PROTO;
15037 	todi = (struct T_optdata_ind *)mp->b_rptr;
15038 	todi->PRIM_type = T_OPTDATA_IND;
15039 	todi->DATA_flag = 1;	/* MORE data */
15040 	todi->OPT_length = optlen;
15041 	todi->OPT_offset = sizeof (*todi);
15042 	optptr = (uchar_t *)&todi[1];
15043 	/*
15044 	 * If app asked for pktinfo and the index has changed ...
15045 	 * Note that the local address never changes for the connection.
15046 	 */
15047 	if (addflag & TCP_IPV6_RECVPKTINFO) {
15048 		struct in6_pktinfo *pkti;
15049 
15050 		toh = (struct T_opthdr *)optptr;
15051 		toh->level = IPPROTO_IPV6;
15052 		toh->name = IPV6_PKTINFO;
15053 		toh->len = sizeof (*toh) + sizeof (*pkti);
15054 		toh->status = 0;
15055 		optptr += sizeof (*toh);
15056 		pkti = (struct in6_pktinfo *)optptr;
15057 		if (tcp->tcp_ipversion == IPV6_VERSION)
15058 			pkti->ipi6_addr = tcp->tcp_ip6h->ip6_src;
15059 		else
15060 			IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src,
15061 			    &pkti->ipi6_addr);
15062 		pkti->ipi6_ifindex = ipp->ipp_ifindex;
15063 		optptr += sizeof (*pkti);
15064 		ASSERT(OK_32PTR(optptr));
15065 		/* Save as "last" value */
15066 		tcp->tcp_recvifindex = ipp->ipp_ifindex;
15067 	}
15068 	/* If app asked for hoplimit and it has changed ... */
15069 	if (addflag & TCP_IPV6_RECVHOPLIMIT) {
15070 		toh = (struct T_opthdr *)optptr;
15071 		toh->level = IPPROTO_IPV6;
15072 		toh->name = IPV6_HOPLIMIT;
15073 		toh->len = sizeof (*toh) + sizeof (uint_t);
15074 		toh->status = 0;
15075 		optptr += sizeof (*toh);
15076 		*(uint_t *)optptr = ipp->ipp_hoplimit;
15077 		optptr += sizeof (uint_t);
15078 		ASSERT(OK_32PTR(optptr));
15079 		/* Save as "last" value */
15080 		tcp->tcp_recvhops = ipp->ipp_hoplimit;
15081 	}
15082 	/* If app asked for tclass and it has changed ... */
15083 	if (addflag & TCP_IPV6_RECVTCLASS) {
15084 		toh = (struct T_opthdr *)optptr;
15085 		toh->level = IPPROTO_IPV6;
15086 		toh->name = IPV6_TCLASS;
15087 		toh->len = sizeof (*toh) + sizeof (uint_t);
15088 		toh->status = 0;
15089 		optptr += sizeof (*toh);
15090 		*(uint_t *)optptr = ipp->ipp_tclass;
15091 		optptr += sizeof (uint_t);
15092 		ASSERT(OK_32PTR(optptr));
15093 		/* Save as "last" value */
15094 		tcp->tcp_recvtclass = ipp->ipp_tclass;
15095 	}
15096 	if (addflag & TCP_IPV6_RECVHOPOPTS) {
15097 		toh = (struct T_opthdr *)optptr;
15098 		toh->level = IPPROTO_IPV6;
15099 		toh->name = IPV6_HOPOPTS;
15100 		toh->len = sizeof (*toh) + ipp->ipp_hopoptslen -
15101 		    tcp->tcp_label_len;
15102 		toh->status = 0;
15103 		optptr += sizeof (*toh);
15104 		bcopy((uchar_t *)ipp->ipp_hopopts + tcp->tcp_label_len, optptr,
15105 		    ipp->ipp_hopoptslen - tcp->tcp_label_len);
15106 		optptr += ipp->ipp_hopoptslen - tcp->tcp_label_len;
15107 		ASSERT(OK_32PTR(optptr));
15108 		/* Save as last value */
15109 		ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
15110 		    (ipp->ipp_fields & IPPF_HOPOPTS),
15111 		    ipp->ipp_hopopts, ipp->ipp_hopoptslen);
15112 	}
15113 	if (addflag & TCP_IPV6_RECVRTDSTOPTS) {
15114 		toh = (struct T_opthdr *)optptr;
15115 		toh->level = IPPROTO_IPV6;
15116 		toh->name = IPV6_RTHDRDSTOPTS;
15117 		toh->len = sizeof (*toh) + ipp->ipp_rtdstoptslen;
15118 		toh->status = 0;
15119 		optptr += sizeof (*toh);
15120 		bcopy(ipp->ipp_rtdstopts, optptr, ipp->ipp_rtdstoptslen);
15121 		optptr += ipp->ipp_rtdstoptslen;
15122 		ASSERT(OK_32PTR(optptr));
15123 		/* Save as last value */
15124 		ip_savebuf((void **)&tcp->tcp_rtdstopts,
15125 		    &tcp->tcp_rtdstoptslen,
15126 		    (ipp->ipp_fields & IPPF_RTDSTOPTS),
15127 		    ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen);
15128 	}
15129 	if (addflag & TCP_IPV6_RECVRTHDR) {
15130 		toh = (struct T_opthdr *)optptr;
15131 		toh->level = IPPROTO_IPV6;
15132 		toh->name = IPV6_RTHDR;
15133 		toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
15134 		toh->status = 0;
15135 		optptr += sizeof (*toh);
15136 		bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
15137 		optptr += ipp->ipp_rthdrlen;
15138 		ASSERT(OK_32PTR(optptr));
15139 		/* Save as last value */
15140 		ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
15141 		    (ipp->ipp_fields & IPPF_RTHDR),
15142 		    ipp->ipp_rthdr, ipp->ipp_rthdrlen);
15143 	}
15144 	if (addflag & (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) {
15145 		toh = (struct T_opthdr *)optptr;
15146 		toh->level = IPPROTO_IPV6;
15147 		toh->name = IPV6_DSTOPTS;
15148 		toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
15149 		toh->status = 0;
15150 		optptr += sizeof (*toh);
15151 		bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
15152 		optptr += ipp->ipp_dstoptslen;
15153 		ASSERT(OK_32PTR(optptr));
15154 		/* Save as last value */
15155 		ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
15156 		    (ipp->ipp_fields & IPPF_DSTOPTS),
15157 		    ipp->ipp_dstopts, ipp->ipp_dstoptslen);
15158 	}
15159 	ASSERT(optptr == mp->b_wptr);
15160 	return (mp);
15161 }
15162 
15163 
15164 /*
15165  * Handle a *T_BIND_REQ that has failed either due to a T_ERROR_ACK
15166  * or a "bad" IRE detected by tcp_adapt_ire.
15167  * We can't tell if the failure was due to the laddr or the faddr
15168  * thus we clear out all addresses and ports.
15169  */
15170 static void
15171 tcp_bind_failed(tcp_t *tcp, mblk_t *mp, int error)
15172 {
15173 	queue_t	*q = tcp->tcp_rq;
15174 	tcph_t	*tcph;
15175 	struct T_error_ack *tea;
15176 	conn_t	*connp = tcp->tcp_connp;
15177 
15178 
15179 	ASSERT(mp->b_datap->db_type == M_PCPROTO);
15180 
15181 	if (mp->b_cont) {
15182 		freemsg(mp->b_cont);
15183 		mp->b_cont = NULL;
15184 	}
15185 	tea = (struct T_error_ack *)mp->b_rptr;
15186 	switch (tea->PRIM_type) {
15187 	case T_BIND_ACK:
15188 		/*
15189 		 * Need to unbind with classifier since we were just told that
15190 		 * our bind succeeded.
15191 		 */
15192 		tcp->tcp_hard_bound = B_FALSE;
15193 		tcp->tcp_hard_binding = B_FALSE;
15194 
15195 		ipcl_hash_remove(connp);
15196 		/* Reuse the mblk if possible */
15197 		ASSERT(mp->b_datap->db_lim - mp->b_datap->db_base >=
15198 			sizeof (*tea));
15199 		mp->b_rptr = mp->b_datap->db_base;
15200 		mp->b_wptr = mp->b_rptr + sizeof (*tea);
15201 		tea = (struct T_error_ack *)mp->b_rptr;
15202 		tea->PRIM_type = T_ERROR_ACK;
15203 		tea->TLI_error = TSYSERR;
15204 		tea->UNIX_error = error;
15205 		if (tcp->tcp_state >= TCPS_SYN_SENT) {
15206 			tea->ERROR_prim = T_CONN_REQ;
15207 		} else {
15208 			tea->ERROR_prim = O_T_BIND_REQ;
15209 		}
15210 		break;
15211 
15212 	case T_ERROR_ACK:
15213 		if (tcp->tcp_state >= TCPS_SYN_SENT)
15214 			tea->ERROR_prim = T_CONN_REQ;
15215 		break;
15216 	default:
15217 		panic("tcp_bind_failed: unexpected TPI type");
15218 		/*NOTREACHED*/
15219 	}
15220 
15221 	tcp->tcp_state = TCPS_IDLE;
15222 	if (tcp->tcp_ipversion == IPV4_VERSION)
15223 		tcp->tcp_ipha->ipha_src = 0;
15224 	else
15225 		V6_SET_ZERO(tcp->tcp_ip6h->ip6_src);
15226 	/*
15227 	 * Copy of the src addr. in tcp_t is needed since
15228 	 * the lookup funcs. can only look at tcp_t
15229 	 */
15230 	V6_SET_ZERO(tcp->tcp_ip_src_v6);
15231 
15232 	tcph = tcp->tcp_tcph;
15233 	tcph->th_lport[0] = 0;
15234 	tcph->th_lport[1] = 0;
15235 	tcp_bind_hash_remove(tcp);
15236 	bzero(&connp->u_port, sizeof (connp->u_port));
15237 	/* blow away saved option results if any */
15238 	if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
15239 		tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
15240 
15241 	conn_delete_ire(tcp->tcp_connp, NULL);
15242 	putnext(q, mp);
15243 }
15244 
15245 /*
15246  * tcp_rput_other is called by tcp_rput to handle everything other than M_DATA
15247  * messages.
15248  */
15249 void
15250 tcp_rput_other(tcp_t *tcp, mblk_t *mp)
15251 {
15252 	mblk_t	*mp1;
15253 	uchar_t	*rptr = mp->b_rptr;
15254 	queue_t	*q = tcp->tcp_rq;
15255 	struct T_error_ack *tea;
15256 	uint32_t mss;
15257 	mblk_t *syn_mp;
15258 	mblk_t *mdti;
15259 	int	retval;
15260 	mblk_t *ire_mp;
15261 
15262 	switch (mp->b_datap->db_type) {
15263 	case M_PROTO:
15264 	case M_PCPROTO:
15265 		ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
15266 		if ((mp->b_wptr - rptr) < sizeof (t_scalar_t))
15267 			break;
15268 		tea = (struct T_error_ack *)rptr;
15269 		switch (tea->PRIM_type) {
15270 		case T_BIND_ACK:
15271 			/*
15272 			 * Adapt Multidata information, if any.  The
15273 			 * following tcp_mdt_update routine will free
15274 			 * the message.
15275 			 */
15276 			if ((mdti = tcp_mdt_info_mp(mp)) != NULL) {
15277 				tcp_mdt_update(tcp, &((ip_mdt_info_t *)mdti->
15278 				    b_rptr)->mdt_capab, B_TRUE);
15279 				freemsg(mdti);
15280 			}
15281 
15282 			/* Get the IRE, if we had requested for it */
15283 			ire_mp = tcp_ire_mp(mp);
15284 
15285 			if (tcp->tcp_hard_binding) {
15286 				tcp->tcp_hard_binding = B_FALSE;
15287 				tcp->tcp_hard_bound = B_TRUE;
15288 				CL_INET_CONNECT(tcp);
15289 			} else {
15290 				if (ire_mp != NULL)
15291 					freeb(ire_mp);
15292 				goto after_syn_sent;
15293 			}
15294 
15295 			retval = tcp_adapt_ire(tcp, ire_mp);
15296 			if (ire_mp != NULL)
15297 				freeb(ire_mp);
15298 			if (retval == 0) {
15299 				tcp_bind_failed(tcp, mp,
15300 				    (int)((tcp->tcp_state >= TCPS_SYN_SENT) ?
15301 				    ENETUNREACH : EADDRNOTAVAIL));
15302 				return;
15303 			}
15304 			/*
15305 			 * Don't let an endpoint connect to itself.
15306 			 * Also checked in tcp_connect() but that
15307 			 * check can't handle the case when the
15308 			 * local IP address is INADDR_ANY.
15309 			 */
15310 			if (tcp->tcp_ipversion == IPV4_VERSION) {
15311 				if ((tcp->tcp_ipha->ipha_dst ==
15312 				    tcp->tcp_ipha->ipha_src) &&
15313 				    (BE16_EQL(tcp->tcp_tcph->th_lport,
15314 				    tcp->tcp_tcph->th_fport))) {
15315 					tcp_bind_failed(tcp, mp, EADDRNOTAVAIL);
15316 					return;
15317 				}
15318 			} else {
15319 				if (IN6_ARE_ADDR_EQUAL(
15320 				    &tcp->tcp_ip6h->ip6_dst,
15321 				    &tcp->tcp_ip6h->ip6_src) &&
15322 				    (BE16_EQL(tcp->tcp_tcph->th_lport,
15323 				    tcp->tcp_tcph->th_fport))) {
15324 					tcp_bind_failed(tcp, mp, EADDRNOTAVAIL);
15325 					return;
15326 				}
15327 			}
15328 			ASSERT(tcp->tcp_state == TCPS_SYN_SENT);
15329 			/*
15330 			 * This should not be possible!  Just for
15331 			 * defensive coding...
15332 			 */
15333 			if (tcp->tcp_state != TCPS_SYN_SENT)
15334 				goto after_syn_sent;
15335 
15336 			if (is_system_labeled() &&
15337 			    !tcp_update_label(tcp, CONN_CRED(tcp->tcp_connp))) {
15338 				tcp_bind_failed(tcp, mp, EHOSTUNREACH);
15339 				return;
15340 			}
15341 
15342 			ASSERT(q == tcp->tcp_rq);
15343 			/*
15344 			 * tcp_adapt_ire() does not adjust
15345 			 * for TCP/IP header length.
15346 			 */
15347 			mss = tcp->tcp_mss - tcp->tcp_hdr_len;
15348 
15349 			/*
15350 			 * Just make sure our rwnd is at
15351 			 * least tcp_recv_hiwat_mss * MSS
15352 			 * large, and round up to the nearest
15353 			 * MSS.
15354 			 *
15355 			 * We do the round up here because
15356 			 * we need to get the interface
15357 			 * MTU first before we can do the
15358 			 * round up.
15359 			 */
15360 			tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss),
15361 			    tcp_recv_hiwat_minmss * mss);
15362 			q->q_hiwat = tcp->tcp_rwnd;
15363 			tcp_set_ws_value(tcp);
15364 			U32_TO_ABE16((tcp->tcp_rwnd >> tcp->tcp_rcv_ws),
15365 			    tcp->tcp_tcph->th_win);
15366 			if (tcp->tcp_rcv_ws > 0 || tcp_wscale_always)
15367 				tcp->tcp_snd_ws_ok = B_TRUE;
15368 
15369 			/*
15370 			 * Set tcp_snd_ts_ok to true
15371 			 * so that tcp_xmit_mp will
15372 			 * include the timestamp
15373 			 * option in the SYN segment.
15374 			 */
15375 			if (tcp_tstamp_always ||
15376 			    (tcp->tcp_rcv_ws && tcp_tstamp_if_wscale)) {
15377 				tcp->tcp_snd_ts_ok = B_TRUE;
15378 			}
15379 
15380 			/*
15381 			 * tcp_snd_sack_ok can be set in
15382 			 * tcp_adapt_ire() if the sack metric
15383 			 * is set.  So check it here also.
15384 			 */
15385 			if (tcp_sack_permitted == 2 ||
15386 			    tcp->tcp_snd_sack_ok) {
15387 				if (tcp->tcp_sack_info == NULL) {
15388 					tcp->tcp_sack_info =
15389 					kmem_cache_alloc(tcp_sack_info_cache,
15390 					    KM_SLEEP);
15391 				}
15392 				tcp->tcp_snd_sack_ok = B_TRUE;
15393 			}
15394 
15395 			/*
15396 			 * Should we use ECN?  Note that the current
15397 			 * default value (SunOS 5.9) of tcp_ecn_permitted
15398 			 * is 1.  The reason for doing this is that there
15399 			 * are equipments out there that will drop ECN
15400 			 * enabled IP packets.  Setting it to 1 avoids
15401 			 * compatibility problems.
15402 			 */
15403 			if (tcp_ecn_permitted == 2)
15404 				tcp->tcp_ecn_ok = B_TRUE;
15405 
15406 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
15407 			syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL,
15408 			    tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
15409 			if (syn_mp) {
15410 				cred_t *cr;
15411 				pid_t pid;
15412 
15413 				/*
15414 				 * Obtain the credential from the
15415 				 * thread calling connect(); the credential
15416 				 * lives on in the second mblk which
15417 				 * originated from T_CONN_REQ and is echoed
15418 				 * with the T_BIND_ACK from ip.  If none
15419 				 * can be found, default to the creator
15420 				 * of the socket.
15421 				 */
15422 				if (mp->b_cont == NULL ||
15423 				    (cr = DB_CRED(mp->b_cont)) == NULL) {
15424 					cr = tcp->tcp_cred;
15425 					pid = tcp->tcp_cpid;
15426 				} else {
15427 					pid = DB_CPID(mp->b_cont);
15428 				}
15429 
15430 				TCP_RECORD_TRACE(tcp, syn_mp,
15431 				    TCP_TRACE_SEND_PKT);
15432 				mblk_setcred(syn_mp, cr);
15433 				DB_CPID(syn_mp) = pid;
15434 				tcp_send_data(tcp, tcp->tcp_wq, syn_mp);
15435 			}
15436 		after_syn_sent:
15437 			/*
15438 			 * A trailer mblk indicates a waiting client upstream.
15439 			 * We complete here the processing begun in
15440 			 * either tcp_bind() or tcp_connect() by passing
15441 			 * upstream the reply message they supplied.
15442 			 */
15443 			mp1 = mp;
15444 			mp = mp->b_cont;
15445 			freeb(mp1);
15446 			if (mp)
15447 				break;
15448 			return;
15449 		case T_ERROR_ACK:
15450 			if (tcp->tcp_debug) {
15451 				(void) strlog(TCP_MOD_ID, 0, 1,
15452 				    SL_TRACE|SL_ERROR,
15453 				    "tcp_rput_other: case T_ERROR_ACK, "
15454 				    "ERROR_prim == %d",
15455 				    tea->ERROR_prim);
15456 			}
15457 			switch (tea->ERROR_prim) {
15458 			case O_T_BIND_REQ:
15459 			case T_BIND_REQ:
15460 				tcp_bind_failed(tcp, mp,
15461 				    (int)((tcp->tcp_state >= TCPS_SYN_SENT) ?
15462 				    ENETUNREACH : EADDRNOTAVAIL));
15463 				return;
15464 			case T_UNBIND_REQ:
15465 				tcp->tcp_hard_binding = B_FALSE;
15466 				tcp->tcp_hard_bound = B_FALSE;
15467 				if (mp->b_cont) {
15468 					freemsg(mp->b_cont);
15469 					mp->b_cont = NULL;
15470 				}
15471 				if (tcp->tcp_unbind_pending)
15472 					tcp->tcp_unbind_pending = 0;
15473 				else {
15474 					/* From tcp_ip_unbind() - free */
15475 					freemsg(mp);
15476 					return;
15477 				}
15478 				break;
15479 			case T_SVR4_OPTMGMT_REQ:
15480 				if (tcp->tcp_drop_opt_ack_cnt > 0) {
15481 					/* T_OPTMGMT_REQ generated by TCP */
15482 					printf("T_SVR4_OPTMGMT_REQ failed "
15483 					    "%d/%d - dropped (cnt %d)\n",
15484 					    tea->TLI_error, tea->UNIX_error,
15485 					    tcp->tcp_drop_opt_ack_cnt);
15486 					freemsg(mp);
15487 					tcp->tcp_drop_opt_ack_cnt--;
15488 					return;
15489 				}
15490 				break;
15491 			}
15492 			if (tea->ERROR_prim == T_SVR4_OPTMGMT_REQ &&
15493 			    tcp->tcp_drop_opt_ack_cnt > 0) {
15494 				printf("T_SVR4_OPTMGMT_REQ failed %d/%d "
15495 				    "- dropped (cnt %d)\n",
15496 				    tea->TLI_error, tea->UNIX_error,
15497 				    tcp->tcp_drop_opt_ack_cnt);
15498 				freemsg(mp);
15499 				tcp->tcp_drop_opt_ack_cnt--;
15500 				return;
15501 			}
15502 			break;
15503 		case T_OPTMGMT_ACK:
15504 			if (tcp->tcp_drop_opt_ack_cnt > 0) {
15505 				/* T_OPTMGMT_REQ generated by TCP */
15506 				freemsg(mp);
15507 				tcp->tcp_drop_opt_ack_cnt--;
15508 				return;
15509 			}
15510 			break;
15511 		default:
15512 			break;
15513 		}
15514 		break;
15515 	case M_CTL:
15516 		/*
15517 		 * ICMP messages.
15518 		 */
15519 		tcp_icmp_error(tcp, mp);
15520 		return;
15521 	case M_FLUSH:
15522 		if (*rptr & FLUSHR)
15523 			flushq(q, FLUSHDATA);
15524 		break;
15525 	default:
15526 		break;
15527 	}
15528 	/*
15529 	 * Make sure we set this bit before sending the ACK for
15530 	 * bind. Otherwise accept could possibly run and free
15531 	 * this tcp struct.
15532 	 */
15533 	putnext(q, mp);
15534 }
15535 
15536 /*
15537  * Called as the result of a qbufcall or a qtimeout to remedy a failure
15538  * to allocate a T_ordrel_ind in tcp_rsrv().  qenable(q) will make
15539  * tcp_rsrv() try again.
15540  */
15541 static void
15542 tcp_ordrel_kick(void *arg)
15543 {
15544 	conn_t 	*connp = (conn_t *)arg;
15545 	tcp_t	*tcp = connp->conn_tcp;
15546 
15547 	tcp->tcp_ordrelid = 0;
15548 	tcp->tcp_timeout = B_FALSE;
15549 	if (!TCP_IS_DETACHED(tcp) && tcp->tcp_rq != NULL &&
15550 	    tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) {
15551 		qenable(tcp->tcp_rq);
15552 	}
15553 }
15554 
15555 /* ARGSUSED */
15556 static void
15557 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2)
15558 {
15559 	conn_t	*connp = (conn_t *)arg;
15560 	tcp_t	*tcp = connp->conn_tcp;
15561 	queue_t	*q = tcp->tcp_rq;
15562 	uint_t	thwin;
15563 
15564 	freeb(mp);
15565 
15566 	TCP_STAT(tcp_rsrv_calls);
15567 
15568 	if (TCP_IS_DETACHED(tcp) || q == NULL) {
15569 		return;
15570 	}
15571 
15572 	if (tcp->tcp_fused) {
15573 		tcp_t *peer_tcp = tcp->tcp_loopback_peer;
15574 
15575 		ASSERT(tcp->tcp_fused);
15576 		ASSERT(peer_tcp != NULL && peer_tcp->tcp_fused);
15577 		ASSERT(peer_tcp->tcp_loopback_peer == tcp);
15578 		ASSERT(!TCP_IS_DETACHED(tcp));
15579 		ASSERT(tcp->tcp_connp->conn_sqp ==
15580 		    peer_tcp->tcp_connp->conn_sqp);
15581 
15582 		/*
15583 		 * Normally we would not get backenabled in synchronous
15584 		 * streams mode, but in case this happens, we need to plug
15585 		 * synchronous streams during our drain to prevent a race
15586 		 * with tcp_fuse_rrw() or tcp_fuse_rinfop().
15587 		 */
15588 		TCP_FUSE_SYNCSTR_PLUG_DRAIN(tcp);
15589 		if (tcp->tcp_rcv_list != NULL)
15590 			(void) tcp_rcv_drain(tcp->tcp_rq, tcp);
15591 
15592 		tcp_clrqfull(peer_tcp);
15593 		TCP_FUSE_SYNCSTR_UNPLUG_DRAIN(tcp);
15594 		TCP_STAT(tcp_fusion_backenabled);
15595 		return;
15596 	}
15597 
15598 	if (canputnext(q)) {
15599 		tcp->tcp_rwnd = q->q_hiwat;
15600 		thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win))
15601 		    << tcp->tcp_rcv_ws;
15602 		thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
15603 		/*
15604 		 * Send back a window update immediately if TCP is above
15605 		 * ESTABLISHED state and the increase of the rcv window
15606 		 * that the other side knows is at least 1 MSS after flow
15607 		 * control is lifted.
15608 		 */
15609 		if (tcp->tcp_state >= TCPS_ESTABLISHED &&
15610 		    (q->q_hiwat - thwin >= tcp->tcp_mss)) {
15611 			tcp_xmit_ctl(NULL, tcp,
15612 			    (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
15613 			    tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
15614 			BUMP_MIB(&tcp_mib, tcpOutWinUpdate);
15615 		}
15616 	}
15617 	/* Handle a failure to allocate a T_ORDREL_IND here */
15618 	if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) {
15619 		ASSERT(tcp->tcp_listener == NULL);
15620 		if (tcp->tcp_rcv_list != NULL) {
15621 			(void) tcp_rcv_drain(q, tcp);
15622 		}
15623 		ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
15624 		mp = mi_tpi_ordrel_ind();
15625 		if (mp) {
15626 			tcp->tcp_ordrel_done = B_TRUE;
15627 			putnext(q, mp);
15628 			if (tcp->tcp_deferred_clean_death) {
15629 				/*
15630 				 * tcp_clean_death was deferred for
15631 				 * T_ORDREL_IND - do it now
15632 				 */
15633 				tcp->tcp_deferred_clean_death = B_FALSE;
15634 				(void) tcp_clean_death(tcp,
15635 				    tcp->tcp_client_errno, 22);
15636 			}
15637 		} else if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) {
15638 			/*
15639 			 * If there isn't already a timer running
15640 			 * start one.  Use a 4 second
15641 			 * timer as a fallback since it can't fail.
15642 			 */
15643 			tcp->tcp_timeout = B_TRUE;
15644 			tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick,
15645 			    MSEC_TO_TICK(4000));
15646 		}
15647 	}
15648 }
15649 
15650 /*
15651  * The read side service routine is called mostly when we get back-enabled as a
15652  * result of flow control relief.  Since we don't actually queue anything in
15653  * TCP, we have no data to send out of here.  What we do is clear the receive
15654  * window, and send out a window update.
15655  * This routine is also called to drive an orderly release message upstream
15656  * if the attempt in tcp_rput failed.
15657  */
15658 static void
15659 tcp_rsrv(queue_t *q)
15660 {
15661 	conn_t *connp = Q_TO_CONN(q);
15662 	tcp_t	*tcp = connp->conn_tcp;
15663 	mblk_t	*mp;
15664 
15665 	/* No code does a putq on the read side */
15666 	ASSERT(q->q_first == NULL);
15667 
15668 	/* Nothing to do for the default queue */
15669 	if (q == tcp_g_q) {
15670 		return;
15671 	}
15672 
15673 	mp = allocb(0, BPRI_HI);
15674 	if (mp == NULL) {
15675 		/*
15676 		 * We are under memory pressure. Return for now and we
15677 		 * we will be called again later.
15678 		 */
15679 		if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) {
15680 			/*
15681 			 * If there isn't already a timer running
15682 			 * start one.  Use a 4 second
15683 			 * timer as a fallback since it can't fail.
15684 			 */
15685 			tcp->tcp_timeout = B_TRUE;
15686 			tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick,
15687 			    MSEC_TO_TICK(4000));
15688 		}
15689 		return;
15690 	}
15691 	CONN_INC_REF(connp);
15692 	squeue_enter(connp->conn_sqp, mp, tcp_rsrv_input, connp,
15693 	    SQTAG_TCP_RSRV);
15694 }
15695 
15696 /*
15697  * tcp_rwnd_set() is called to adjust the receive window to a desired value.
15698  * We do not allow the receive window to shrink.  After setting rwnd,
15699  * set the flow control hiwat of the stream.
15700  *
15701  * This function is called in 2 cases:
15702  *
15703  * 1) Before data transfer begins, in tcp_accept_comm() for accepting a
15704  *    connection (passive open) and in tcp_rput_data() for active connect.
15705  *    This is called after tcp_mss_set() when the desired MSS value is known.
15706  *    This makes sure that our window size is a mutiple of the other side's
15707  *    MSS.
15708  * 2) Handling SO_RCVBUF option.
15709  *
15710  * It is ASSUMED that the requested size is a multiple of the current MSS.
15711  *
15712  * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the
15713  * user requests so.
15714  */
15715 static int
15716 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd)
15717 {
15718 	uint32_t	mss = tcp->tcp_mss;
15719 	uint32_t	old_max_rwnd;
15720 	uint32_t	max_transmittable_rwnd;
15721 	boolean_t	tcp_detached = TCP_IS_DETACHED(tcp);
15722 
15723 	if (tcp->tcp_fused) {
15724 		size_t sth_hiwat;
15725 		tcp_t *peer_tcp = tcp->tcp_loopback_peer;
15726 
15727 		ASSERT(peer_tcp != NULL);
15728 		/*
15729 		 * Record the stream head's high water mark for
15730 		 * this endpoint; this is used for flow-control
15731 		 * purposes in tcp_fuse_output().
15732 		 */
15733 		sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd);
15734 		if (!tcp_detached)
15735 			(void) mi_set_sth_hiwat(tcp->tcp_rq, sth_hiwat);
15736 
15737 		/*
15738 		 * In the fusion case, the maxpsz stream head value of
15739 		 * our peer is set according to its send buffer size
15740 		 * and our receive buffer size; since the latter may
15741 		 * have changed we need to update the peer's maxpsz.
15742 		 */
15743 		(void) tcp_maxpsz_set(peer_tcp, B_TRUE);
15744 		return (rwnd);
15745 	}
15746 
15747 	if (tcp_detached)
15748 		old_max_rwnd = tcp->tcp_rwnd;
15749 	else
15750 		old_max_rwnd = tcp->tcp_rq->q_hiwat;
15751 
15752 	/*
15753 	 * Insist on a receive window that is at least
15754 	 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid
15755 	 * funny TCP interactions of Nagle algorithm, SWS avoidance
15756 	 * and delayed acknowledgement.
15757 	 */
15758 	rwnd = MAX(rwnd, tcp_recv_hiwat_minmss * mss);
15759 
15760 	/*
15761 	 * If window size info has already been exchanged, TCP should not
15762 	 * shrink the window.  Shrinking window is doable if done carefully.
15763 	 * We may add that support later.  But so far there is not a real
15764 	 * need to do that.
15765 	 */
15766 	if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) {
15767 		/* MSS may have changed, do a round up again. */
15768 		rwnd = MSS_ROUNDUP(old_max_rwnd, mss);
15769 	}
15770 
15771 	/*
15772 	 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check
15773 	 * can be applied even before the window scale option is decided.
15774 	 */
15775 	max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws;
15776 	if (rwnd > max_transmittable_rwnd) {
15777 		rwnd = max_transmittable_rwnd -
15778 		    (max_transmittable_rwnd % mss);
15779 		if (rwnd < mss)
15780 			rwnd = max_transmittable_rwnd;
15781 		/*
15782 		 * If we're over the limit we may have to back down tcp_rwnd.
15783 		 * The increment below won't work for us. So we set all three
15784 		 * here and the increment below will have no effect.
15785 		 */
15786 		tcp->tcp_rwnd = old_max_rwnd = rwnd;
15787 	}
15788 	if (tcp->tcp_localnet) {
15789 		tcp->tcp_rack_abs_max =
15790 		    MIN(tcp_local_dacks_max, rwnd / mss / 2);
15791 	} else {
15792 		/*
15793 		 * For a remote host on a different subnet (through a router),
15794 		 * we ack every other packet to be conforming to RFC1122.
15795 		 * tcp_deferred_acks_max is default to 2.
15796 		 */
15797 		tcp->tcp_rack_abs_max =
15798 		    MIN(tcp_deferred_acks_max, rwnd / mss / 2);
15799 	}
15800 	if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max)
15801 		tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
15802 	else
15803 		tcp->tcp_rack_cur_max = 0;
15804 	/*
15805 	 * Increment the current rwnd by the amount the maximum grew (we
15806 	 * can not overwrite it since we might be in the middle of a
15807 	 * connection.)
15808 	 */
15809 	tcp->tcp_rwnd += rwnd - old_max_rwnd;
15810 	U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, tcp->tcp_tcph->th_win);
15811 	if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
15812 		tcp->tcp_cwnd_max = rwnd;
15813 
15814 	if (tcp_detached)
15815 		return (rwnd);
15816 	/*
15817 	 * We set the maximum receive window into rq->q_hiwat.
15818 	 * This is not actually used for flow control.
15819 	 */
15820 	tcp->tcp_rq->q_hiwat = rwnd;
15821 	/*
15822 	 * Set the Stream head high water mark. This doesn't have to be
15823 	 * here, since we are simply using default values, but we would
15824 	 * prefer to choose these values algorithmically, with a likely
15825 	 * relationship to rwnd.
15826 	 */
15827 	(void) mi_set_sth_hiwat(tcp->tcp_rq, MAX(rwnd, tcp_sth_rcv_hiwat));
15828 	return (rwnd);
15829 }
15830 
15831 /*
15832  * Return SNMP stuff in buffer in mpdata.
15833  */
15834 int
15835 tcp_snmp_get(queue_t *q, mblk_t *mpctl)
15836 {
15837 	mblk_t			*mpdata;
15838 	mblk_t			*mp_conn_ctl = NULL;
15839 	mblk_t			*mp_conn_tail;
15840 	mblk_t			*mp_attr_ctl = NULL;
15841 	mblk_t			*mp_attr_tail;
15842 	mblk_t			*mp6_conn_ctl = NULL;
15843 	mblk_t			*mp6_conn_tail;
15844 	mblk_t			*mp6_attr_ctl = NULL;
15845 	mblk_t			*mp6_attr_tail;
15846 	struct opthdr		*optp;
15847 	mib2_tcpConnEntry_t	tce;
15848 	mib2_tcp6ConnEntry_t	tce6;
15849 	mib2_transportMLPEntry_t mlp;
15850 	connf_t			*connfp;
15851 	conn_t			*connp;
15852 	int			i;
15853 	boolean_t 		ispriv;
15854 	zoneid_t 		zoneid;
15855 	int			v4_conn_idx;
15856 	int			v6_conn_idx;
15857 
15858 	if (mpctl == NULL ||
15859 	    (mpdata = mpctl->b_cont) == NULL ||
15860 	    (mp_conn_ctl = copymsg(mpctl)) == NULL ||
15861 	    (mp_attr_ctl = copymsg(mpctl)) == NULL ||
15862 	    (mp6_conn_ctl = copymsg(mpctl)) == NULL ||
15863 	    (mp6_attr_ctl = copymsg(mpctl)) == NULL) {
15864 		freemsg(mp_conn_ctl);
15865 		freemsg(mp_attr_ctl);
15866 		freemsg(mp6_conn_ctl);
15867 		freemsg(mp6_attr_ctl);
15868 		return (0);
15869 	}
15870 
15871 	/* build table of connections -- need count in fixed part */
15872 	SET_MIB(tcp_mib.tcpRtoAlgorithm, 4);   /* vanj */
15873 	SET_MIB(tcp_mib.tcpRtoMin, tcp_rexmit_interval_min);
15874 	SET_MIB(tcp_mib.tcpRtoMax, tcp_rexmit_interval_max);
15875 	SET_MIB(tcp_mib.tcpMaxConn, -1);
15876 	SET_MIB(tcp_mib.tcpCurrEstab, 0);
15877 
15878 	ispriv =
15879 	    secpolicy_net_config((Q_TO_CONN(q))->conn_cred, B_TRUE) == 0;
15880 	zoneid = Q_TO_CONN(q)->conn_zoneid;
15881 
15882 	v4_conn_idx = v6_conn_idx = 0;
15883 	mp_conn_tail = mp_attr_tail = mp6_conn_tail = mp6_attr_tail = NULL;
15884 
15885 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
15886 
15887 		connfp = &ipcl_globalhash_fanout[i];
15888 
15889 		connp = NULL;
15890 
15891 		while ((connp =
15892 		    ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) {
15893 			tcp_t *tcp;
15894 			boolean_t needattr;
15895 
15896 			if (connp->conn_zoneid != zoneid)
15897 				continue;	/* not in this zone */
15898 
15899 			tcp = connp->conn_tcp;
15900 			UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs);
15901 			tcp->tcp_ibsegs = 0;
15902 			UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs);
15903 			tcp->tcp_obsegs = 0;
15904 
15905 			tce6.tcp6ConnState = tce.tcpConnState =
15906 			    tcp_snmp_state(tcp);
15907 			if (tce.tcpConnState == MIB2_TCP_established ||
15908 			    tce.tcpConnState == MIB2_TCP_closeWait)
15909 				BUMP_MIB(&tcp_mib, tcpCurrEstab);
15910 
15911 			needattr = B_FALSE;
15912 			bzero(&mlp, sizeof (mlp));
15913 			if (connp->conn_mlp_type != mlptSingle) {
15914 				if (connp->conn_mlp_type == mlptShared ||
15915 				    connp->conn_mlp_type == mlptBoth)
15916 					mlp.tme_flags |= MIB2_TMEF_SHARED;
15917 				if (connp->conn_mlp_type == mlptPrivate ||
15918 				    connp->conn_mlp_type == mlptBoth)
15919 					mlp.tme_flags |= MIB2_TMEF_PRIVATE;
15920 				needattr = B_TRUE;
15921 			}
15922 			if (connp->conn_peercred != NULL) {
15923 				ts_label_t *tsl;
15924 
15925 				tsl = crgetlabel(connp->conn_peercred);
15926 				mlp.tme_doi = label2doi(tsl);
15927 				mlp.tme_label = *label2bslabel(tsl);
15928 				needattr = B_TRUE;
15929 			}
15930 
15931 			/* Create a message to report on IPv6 entries */
15932 			if (tcp->tcp_ipversion == IPV6_VERSION) {
15933 			tce6.tcp6ConnLocalAddress = tcp->tcp_ip_src_v6;
15934 			tce6.tcp6ConnRemAddress = tcp->tcp_remote_v6;
15935 			tce6.tcp6ConnLocalPort = ntohs(tcp->tcp_lport);
15936 			tce6.tcp6ConnRemPort = ntohs(tcp->tcp_fport);
15937 			tce6.tcp6ConnIfIndex = tcp->tcp_bound_if;
15938 			/* Don't want just anybody seeing these... */
15939 			if (ispriv) {
15940 				tce6.tcp6ConnEntryInfo.ce_snxt =
15941 				    tcp->tcp_snxt;
15942 				tce6.tcp6ConnEntryInfo.ce_suna =
15943 				    tcp->tcp_suna;
15944 				tce6.tcp6ConnEntryInfo.ce_rnxt =
15945 				    tcp->tcp_rnxt;
15946 				tce6.tcp6ConnEntryInfo.ce_rack =
15947 				    tcp->tcp_rack;
15948 			} else {
15949 				/*
15950 				 * Netstat, unfortunately, uses this to
15951 				 * get send/receive queue sizes.  How to fix?
15952 				 * Why not compute the difference only?
15953 				 */
15954 				tce6.tcp6ConnEntryInfo.ce_snxt =
15955 				    tcp->tcp_snxt - tcp->tcp_suna;
15956 				tce6.tcp6ConnEntryInfo.ce_suna = 0;
15957 				tce6.tcp6ConnEntryInfo.ce_rnxt =
15958 				    tcp->tcp_rnxt - tcp->tcp_rack;
15959 				tce6.tcp6ConnEntryInfo.ce_rack = 0;
15960 			}
15961 
15962 			tce6.tcp6ConnEntryInfo.ce_swnd = tcp->tcp_swnd;
15963 			tce6.tcp6ConnEntryInfo.ce_rwnd = tcp->tcp_rwnd;
15964 			tce6.tcp6ConnEntryInfo.ce_rto =  tcp->tcp_rto;
15965 			tce6.tcp6ConnEntryInfo.ce_mss =  tcp->tcp_mss;
15966 			tce6.tcp6ConnEntryInfo.ce_state = tcp->tcp_state;
15967 
15968 			(void) snmp_append_data2(mp6_conn_ctl->b_cont,
15969 			    &mp6_conn_tail, (char *)&tce6, sizeof (tce6));
15970 
15971 			mlp.tme_connidx = v6_conn_idx++;
15972 			if (needattr)
15973 				(void) snmp_append_data2(mp6_attr_ctl->b_cont,
15974 				    &mp6_attr_tail, (char *)&mlp, sizeof (mlp));
15975 			}
15976 			/*
15977 			 * Create an IPv4 table entry for IPv4 entries and also
15978 			 * for IPv6 entries which are bound to in6addr_any
15979 			 * but don't have IPV6_V6ONLY set.
15980 			 * (i.e. anything an IPv4 peer could connect to)
15981 			 */
15982 			if (tcp->tcp_ipversion == IPV4_VERSION ||
15983 			    (tcp->tcp_state <= TCPS_LISTEN &&
15984 			    !tcp->tcp_connp->conn_ipv6_v6only &&
15985 			    IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip_src_v6))) {
15986 				if (tcp->tcp_ipversion == IPV6_VERSION) {
15987 					tce.tcpConnRemAddress = INADDR_ANY;
15988 					tce.tcpConnLocalAddress = INADDR_ANY;
15989 				} else {
15990 					tce.tcpConnRemAddress =
15991 					    tcp->tcp_remote;
15992 					tce.tcpConnLocalAddress =
15993 					    tcp->tcp_ip_src;
15994 				}
15995 				tce.tcpConnLocalPort = ntohs(tcp->tcp_lport);
15996 				tce.tcpConnRemPort = ntohs(tcp->tcp_fport);
15997 				/* Don't want just anybody seeing these... */
15998 				if (ispriv) {
15999 					tce.tcpConnEntryInfo.ce_snxt =
16000 					    tcp->tcp_snxt;
16001 					tce.tcpConnEntryInfo.ce_suna =
16002 					    tcp->tcp_suna;
16003 					tce.tcpConnEntryInfo.ce_rnxt =
16004 					    tcp->tcp_rnxt;
16005 					tce.tcpConnEntryInfo.ce_rack =
16006 					    tcp->tcp_rack;
16007 				} else {
16008 					/*
16009 					 * Netstat, unfortunately, uses this to
16010 					 * get send/receive queue sizes.  How
16011 					 * to fix?
16012 					 * Why not compute the difference only?
16013 					 */
16014 					tce.tcpConnEntryInfo.ce_snxt =
16015 					    tcp->tcp_snxt - tcp->tcp_suna;
16016 					tce.tcpConnEntryInfo.ce_suna = 0;
16017 					tce.tcpConnEntryInfo.ce_rnxt =
16018 					    tcp->tcp_rnxt - tcp->tcp_rack;
16019 					tce.tcpConnEntryInfo.ce_rack = 0;
16020 				}
16021 
16022 				tce.tcpConnEntryInfo.ce_swnd = tcp->tcp_swnd;
16023 				tce.tcpConnEntryInfo.ce_rwnd = tcp->tcp_rwnd;
16024 				tce.tcpConnEntryInfo.ce_rto =  tcp->tcp_rto;
16025 				tce.tcpConnEntryInfo.ce_mss =  tcp->tcp_mss;
16026 				tce.tcpConnEntryInfo.ce_state =
16027 				    tcp->tcp_state;
16028 
16029 				(void) snmp_append_data2(mp_conn_ctl->b_cont,
16030 				    &mp_conn_tail, (char *)&tce, sizeof (tce));
16031 
16032 				mlp.tme_connidx = v4_conn_idx++;
16033 				if (needattr)
16034 					(void) snmp_append_data2(
16035 					    mp_attr_ctl->b_cont,
16036 					    &mp_attr_tail, (char *)&mlp,
16037 					    sizeof (mlp));
16038 			}
16039 		}
16040 	}
16041 
16042 	/* fixed length structure for IPv4 and IPv6 counters */
16043 	SET_MIB(tcp_mib.tcpConnTableSize, sizeof (mib2_tcpConnEntry_t));
16044 	SET_MIB(tcp_mib.tcp6ConnTableSize, sizeof (mib2_tcp6ConnEntry_t));
16045 	optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)];
16046 	optp->level = MIB2_TCP;
16047 	optp->name = 0;
16048 	(void) snmp_append_data(mpdata, (char *)&tcp_mib, sizeof (tcp_mib));
16049 	optp->len = msgdsize(mpdata);
16050 	qreply(q, mpctl);
16051 
16052 	/* table of connections... */
16053 	optp = (struct opthdr *)&mp_conn_ctl->b_rptr[
16054 	    sizeof (struct T_optmgmt_ack)];
16055 	optp->level = MIB2_TCP;
16056 	optp->name = MIB2_TCP_CONN;
16057 	optp->len = msgdsize(mp_conn_ctl->b_cont);
16058 	qreply(q, mp_conn_ctl);
16059 
16060 	/* table of MLP attributes... */
16061 	optp = (struct opthdr *)&mp_attr_ctl->b_rptr[
16062 	    sizeof (struct T_optmgmt_ack)];
16063 	optp->level = MIB2_TCP;
16064 	optp->name = EXPER_XPORT_MLP;
16065 	optp->len = msgdsize(mp_attr_ctl->b_cont);
16066 	if (optp->len == 0)
16067 		freemsg(mp_attr_ctl);
16068 	else
16069 		qreply(q, mp_attr_ctl);
16070 
16071 	/* table of IPv6 connections... */
16072 	optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[
16073 	    sizeof (struct T_optmgmt_ack)];
16074 	optp->level = MIB2_TCP6;
16075 	optp->name = MIB2_TCP6_CONN;
16076 	optp->len = msgdsize(mp6_conn_ctl->b_cont);
16077 	qreply(q, mp6_conn_ctl);
16078 
16079 	/* table of IPv6 MLP attributes... */
16080 	optp = (struct opthdr *)&mp6_attr_ctl->b_rptr[
16081 	    sizeof (struct T_optmgmt_ack)];
16082 	optp->level = MIB2_TCP6;
16083 	optp->name = EXPER_XPORT_MLP;
16084 	optp->len = msgdsize(mp6_attr_ctl->b_cont);
16085 	if (optp->len == 0)
16086 		freemsg(mp6_attr_ctl);
16087 	else
16088 		qreply(q, mp6_attr_ctl);
16089 	return (1);
16090 }
16091 
16092 /* Return 0 if invalid set request, 1 otherwise, including non-tcp requests  */
16093 /* ARGSUSED */
16094 int
16095 tcp_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len)
16096 {
16097 	mib2_tcpConnEntry_t	*tce = (mib2_tcpConnEntry_t *)ptr;
16098 
16099 	switch (level) {
16100 	case MIB2_TCP:
16101 		switch (name) {
16102 		case 13:
16103 			if (tce->tcpConnState != MIB2_TCP_deleteTCB)
16104 				return (0);
16105 			/* TODO: delete entry defined by tce */
16106 			return (1);
16107 		default:
16108 			return (0);
16109 		}
16110 	default:
16111 		return (1);
16112 	}
16113 }
16114 
16115 /* Translate TCP state to MIB2 TCP state. */
16116 static int
16117 tcp_snmp_state(tcp_t *tcp)
16118 {
16119 	if (tcp == NULL)
16120 		return (0);
16121 
16122 	switch (tcp->tcp_state) {
16123 	case TCPS_CLOSED:
16124 	case TCPS_IDLE:	/* RFC1213 doesn't have analogue for IDLE & BOUND */
16125 	case TCPS_BOUND:
16126 		return (MIB2_TCP_closed);
16127 	case TCPS_LISTEN:
16128 		return (MIB2_TCP_listen);
16129 	case TCPS_SYN_SENT:
16130 		return (MIB2_TCP_synSent);
16131 	case TCPS_SYN_RCVD:
16132 		return (MIB2_TCP_synReceived);
16133 	case TCPS_ESTABLISHED:
16134 		return (MIB2_TCP_established);
16135 	case TCPS_CLOSE_WAIT:
16136 		return (MIB2_TCP_closeWait);
16137 	case TCPS_FIN_WAIT_1:
16138 		return (MIB2_TCP_finWait1);
16139 	case TCPS_CLOSING:
16140 		return (MIB2_TCP_closing);
16141 	case TCPS_LAST_ACK:
16142 		return (MIB2_TCP_lastAck);
16143 	case TCPS_FIN_WAIT_2:
16144 		return (MIB2_TCP_finWait2);
16145 	case TCPS_TIME_WAIT:
16146 		return (MIB2_TCP_timeWait);
16147 	default:
16148 		return (0);
16149 	}
16150 }
16151 
16152 static char tcp_report_header[] =
16153 	"TCP     " MI_COL_HDRPAD_STR
16154 	"zone dest            snxt     suna     "
16155 	"swnd       rnxt     rack     rwnd       rto   mss   w sw rw t "
16156 	"recent   [lport,fport] state";
16157 
16158 /*
16159  * TCP status report triggered via the Named Dispatch mechanism.
16160  */
16161 /* ARGSUSED */
16162 static void
16163 tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, tcp_t *thisstream,
16164     cred_t *cr)
16165 {
16166 	char hash[10], addrbuf[INET6_ADDRSTRLEN];
16167 	boolean_t ispriv = secpolicy_net_config(cr, B_TRUE) == 0;
16168 	char cflag;
16169 	in6_addr_t	v6dst;
16170 	char buf[80];
16171 	uint_t print_len, buf_len;
16172 
16173 	buf_len = mp->b_datap->db_lim - mp->b_wptr;
16174 	if (buf_len <= 0)
16175 		return;
16176 
16177 	if (hashval >= 0)
16178 		(void) sprintf(hash, "%03d ", hashval);
16179 	else
16180 		hash[0] = '\0';
16181 
16182 	/*
16183 	 * Note that we use the remote address in the tcp_b  structure.
16184 	 * This means that it will print out the real destination address,
16185 	 * not the next hop's address if source routing is used.  This
16186 	 * avoid the confusion on the output because user may not
16187 	 * know that source routing is used for a connection.
16188 	 */
16189 	if (tcp->tcp_ipversion == IPV4_VERSION) {
16190 		IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &v6dst);
16191 	} else {
16192 		v6dst = tcp->tcp_remote_v6;
16193 	}
16194 	(void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf));
16195 	/*
16196 	 * the ispriv checks are so that normal users cannot determine
16197 	 * sequence number information using NDD.
16198 	 */
16199 
16200 	if (TCP_IS_DETACHED(tcp))
16201 		cflag = '*';
16202 	else
16203 		cflag = ' ';
16204 	print_len = snprintf((char *)mp->b_wptr, buf_len,
16205 	    "%s " MI_COL_PTRFMT_STR "%d %s %08x %08x %010d %08x %08x "
16206 	    "%010d %05ld %05d %1d %02d %02d %1d %08x %s%c\n",
16207 	    hash,
16208 	    (void *)tcp,
16209 	    tcp->tcp_connp->conn_zoneid,
16210 	    addrbuf,
16211 	    (ispriv) ? tcp->tcp_snxt : 0,
16212 	    (ispriv) ? tcp->tcp_suna : 0,
16213 	    tcp->tcp_swnd,
16214 	    (ispriv) ? tcp->tcp_rnxt : 0,
16215 	    (ispriv) ? tcp->tcp_rack : 0,
16216 	    tcp->tcp_rwnd,
16217 	    tcp->tcp_rto,
16218 	    tcp->tcp_mss,
16219 	    tcp->tcp_snd_ws_ok,
16220 	    tcp->tcp_snd_ws,
16221 	    tcp->tcp_rcv_ws,
16222 	    tcp->tcp_snd_ts_ok,
16223 	    tcp->tcp_ts_recent,
16224 	    tcp_display(tcp, buf, DISP_PORT_ONLY), cflag);
16225 	if (print_len < buf_len) {
16226 		((mblk_t *)mp)->b_wptr += print_len;
16227 	} else {
16228 		((mblk_t *)mp)->b_wptr += buf_len;
16229 	}
16230 }
16231 
16232 /*
16233  * TCP status report (for listeners only) triggered via the Named Dispatch
16234  * mechanism.
16235  */
16236 /* ARGSUSED */
16237 static void
16238 tcp_report_listener(mblk_t *mp, tcp_t *tcp, int hashval)
16239 {
16240 	char addrbuf[INET6_ADDRSTRLEN];
16241 	in6_addr_t	v6dst;
16242 	uint_t print_len, buf_len;
16243 
16244 	buf_len = mp->b_datap->db_lim - mp->b_wptr;
16245 	if (buf_len <= 0)
16246 		return;
16247 
16248 	if (tcp->tcp_ipversion == IPV4_VERSION) {
16249 		IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, &v6dst);
16250 		(void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf));
16251 	} else {
16252 		(void) inet_ntop(AF_INET6, &tcp->tcp_ip6h->ip6_src,
16253 		    addrbuf, sizeof (addrbuf));
16254 	}
16255 	print_len = snprintf((char *)mp->b_wptr, buf_len,
16256 	    "%03d "
16257 	    MI_COL_PTRFMT_STR
16258 	    "%d %s %05u %08u %d/%d/%d%c\n",
16259 	    hashval, (void *)tcp,
16260 	    tcp->tcp_connp->conn_zoneid,
16261 	    addrbuf,
16262 	    (uint_t)BE16_TO_U16(tcp->tcp_tcph->th_lport),
16263 	    tcp->tcp_conn_req_seqnum,
16264 	    tcp->tcp_conn_req_cnt_q0, tcp->tcp_conn_req_cnt_q,
16265 	    tcp->tcp_conn_req_max,
16266 	    tcp->tcp_syn_defense ? '*' : ' ');
16267 	if (print_len < buf_len) {
16268 		((mblk_t *)mp)->b_wptr += print_len;
16269 	} else {
16270 		((mblk_t *)mp)->b_wptr += buf_len;
16271 	}
16272 }
16273 
16274 /* TCP status report triggered via the Named Dispatch mechanism. */
16275 /* ARGSUSED */
16276 static int
16277 tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
16278 {
16279 	tcp_t	*tcp;
16280 	int	i;
16281 	conn_t	*connp;
16282 	connf_t	*connfp;
16283 	zoneid_t zoneid;
16284 
16285 	/*
16286 	 * Because of the ndd constraint, at most we can have 64K buffer
16287 	 * to put in all TCP info.  So to be more efficient, just
16288 	 * allocate a 64K buffer here, assuming we need that large buffer.
16289 	 * This may be a problem as any user can read tcp_status.  Therefore
16290 	 * we limit the rate of doing this using tcp_ndd_get_info_interval.
16291 	 * This should be OK as normal users should not do this too often.
16292 	 */
16293 	if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) {
16294 		if (ddi_get_lbolt() - tcp_last_ndd_get_info_time <
16295 		    drv_usectohz(tcp_ndd_get_info_interval * 1000)) {
16296 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
16297 			return (0);
16298 		}
16299 	}
16300 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
16301 		/* The following may work even if we cannot get a large buf. */
16302 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
16303 		return (0);
16304 	}
16305 
16306 	(void) mi_mpprintf(mp, "%s", tcp_report_header);
16307 
16308 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16309 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
16310 
16311 		connfp = &ipcl_globalhash_fanout[i];
16312 
16313 		connp = NULL;
16314 
16315 		while ((connp =
16316 		    ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) {
16317 			tcp = connp->conn_tcp;
16318 			if (zoneid != GLOBAL_ZONEID &&
16319 			    zoneid != connp->conn_zoneid)
16320 				continue;
16321 			tcp_report_item(mp->b_cont, tcp, -1, tcp,
16322 			    cr);
16323 		}
16324 
16325 	}
16326 
16327 	tcp_last_ndd_get_info_time = ddi_get_lbolt();
16328 	return (0);
16329 }
16330 
16331 /* TCP status report triggered via the Named Dispatch mechanism. */
16332 /* ARGSUSED */
16333 static int
16334 tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
16335 {
16336 	tf_t	*tbf;
16337 	tcp_t	*tcp;
16338 	int	i;
16339 	zoneid_t zoneid;
16340 
16341 	/* Refer to comments in tcp_status_report(). */
16342 	if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) {
16343 		if (ddi_get_lbolt() - tcp_last_ndd_get_info_time <
16344 		    drv_usectohz(tcp_ndd_get_info_interval * 1000)) {
16345 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
16346 			return (0);
16347 		}
16348 	}
16349 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
16350 		/* The following may work even if we cannot get a large buf. */
16351 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
16352 		return (0);
16353 	}
16354 
16355 	(void) mi_mpprintf(mp, "    %s", tcp_report_header);
16356 
16357 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16358 
16359 	for (i = 0; i < A_CNT(tcp_bind_fanout); i++) {
16360 		tbf = &tcp_bind_fanout[i];
16361 		mutex_enter(&tbf->tf_lock);
16362 		for (tcp = tbf->tf_tcp; tcp != NULL;
16363 		    tcp = tcp->tcp_bind_hash) {
16364 			if (zoneid != GLOBAL_ZONEID &&
16365 			    zoneid != tcp->tcp_connp->conn_zoneid)
16366 				continue;
16367 			CONN_INC_REF(tcp->tcp_connp);
16368 			tcp_report_item(mp->b_cont, tcp, i,
16369 			    Q_TO_TCP(q), cr);
16370 			CONN_DEC_REF(tcp->tcp_connp);
16371 		}
16372 		mutex_exit(&tbf->tf_lock);
16373 	}
16374 	tcp_last_ndd_get_info_time = ddi_get_lbolt();
16375 	return (0);
16376 }
16377 
16378 /* TCP status report triggered via the Named Dispatch mechanism. */
16379 /* ARGSUSED */
16380 static int
16381 tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
16382 {
16383 	connf_t	*connfp;
16384 	conn_t	*connp;
16385 	tcp_t	*tcp;
16386 	int	i;
16387 	zoneid_t zoneid;
16388 
16389 	/* Refer to comments in tcp_status_report(). */
16390 	if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) {
16391 		if (ddi_get_lbolt() - tcp_last_ndd_get_info_time <
16392 		    drv_usectohz(tcp_ndd_get_info_interval * 1000)) {
16393 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
16394 			return (0);
16395 		}
16396 	}
16397 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
16398 		/* The following may work even if we cannot get a large buf. */
16399 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
16400 		return (0);
16401 	}
16402 
16403 	(void) mi_mpprintf(mp,
16404 	    "    TCP    " MI_COL_HDRPAD_STR
16405 	    "zone IP addr         port  seqnum   backlog (q0/q/max)");
16406 
16407 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16408 
16409 	for (i = 0; i < ipcl_bind_fanout_size; i++) {
16410 		connfp =  &ipcl_bind_fanout[i];
16411 		connp = NULL;
16412 		while ((connp =
16413 		    ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) {
16414 			tcp = connp->conn_tcp;
16415 			if (zoneid != GLOBAL_ZONEID &&
16416 			    zoneid != connp->conn_zoneid)
16417 				continue;
16418 			tcp_report_listener(mp->b_cont, tcp, i);
16419 		}
16420 	}
16421 
16422 	tcp_last_ndd_get_info_time = ddi_get_lbolt();
16423 	return (0);
16424 }
16425 
16426 /* TCP status report triggered via the Named Dispatch mechanism. */
16427 /* ARGSUSED */
16428 static int
16429 tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
16430 {
16431 	connf_t	*connfp;
16432 	conn_t	*connp;
16433 	tcp_t	*tcp;
16434 	int	i;
16435 	zoneid_t zoneid;
16436 
16437 	/* Refer to comments in tcp_status_report(). */
16438 	if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) {
16439 		if (ddi_get_lbolt() - tcp_last_ndd_get_info_time <
16440 		    drv_usectohz(tcp_ndd_get_info_interval * 1000)) {
16441 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
16442 			return (0);
16443 		}
16444 	}
16445 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
16446 		/* The following may work even if we cannot get a large buf. */
16447 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
16448 		return (0);
16449 	}
16450 
16451 	(void) mi_mpprintf(mp, "tcp_conn_hash_size = %d",
16452 	    ipcl_conn_fanout_size);
16453 	(void) mi_mpprintf(mp, "    %s", tcp_report_header);
16454 
16455 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16456 
16457 	for (i = 0; i < ipcl_conn_fanout_size; i++) {
16458 		connfp =  &ipcl_conn_fanout[i];
16459 		connp = NULL;
16460 		while ((connp =
16461 		    ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) {
16462 			tcp = connp->conn_tcp;
16463 			if (zoneid != GLOBAL_ZONEID &&
16464 			    zoneid != connp->conn_zoneid)
16465 				continue;
16466 			tcp_report_item(mp->b_cont, tcp, i,
16467 			    Q_TO_TCP(q), cr);
16468 		}
16469 	}
16470 
16471 	tcp_last_ndd_get_info_time = ddi_get_lbolt();
16472 	return (0);
16473 }
16474 
16475 /* TCP status report triggered via the Named Dispatch mechanism. */
16476 /* ARGSUSED */
16477 static int
16478 tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
16479 {
16480 	tf_t	*tf;
16481 	tcp_t	*tcp;
16482 	int	i;
16483 	zoneid_t zoneid;
16484 
16485 	/* Refer to comments in tcp_status_report(). */
16486 	if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) {
16487 		if (ddi_get_lbolt() - tcp_last_ndd_get_info_time <
16488 		    drv_usectohz(tcp_ndd_get_info_interval * 1000)) {
16489 			(void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG);
16490 			return (0);
16491 		}
16492 	}
16493 	if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) {
16494 		/* The following may work even if we cannot get a large buf. */
16495 		(void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG);
16496 		return (0);
16497 	}
16498 
16499 	(void) mi_mpprintf(mp, "    %s", tcp_report_header);
16500 
16501 	zoneid = Q_TO_CONN(q)->conn_zoneid;
16502 
16503 	for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) {
16504 		tf = &tcp_acceptor_fanout[i];
16505 		mutex_enter(&tf->tf_lock);
16506 		for (tcp = tf->tf_tcp; tcp != NULL;
16507 		    tcp = tcp->tcp_acceptor_hash) {
16508 			if (zoneid != GLOBAL_ZONEID &&
16509 			    zoneid != tcp->tcp_connp->conn_zoneid)
16510 				continue;
16511 			tcp_report_item(mp->b_cont, tcp, i,
16512 			    Q_TO_TCP(q), cr);
16513 		}
16514 		mutex_exit(&tf->tf_lock);
16515 	}
16516 	tcp_last_ndd_get_info_time = ddi_get_lbolt();
16517 	return (0);
16518 }
16519 
16520 /*
16521  * tcp_timer is the timer service routine.  It handles the retransmission,
16522  * FIN_WAIT_2 flush, and zero window probe timeout events.  It figures out
16523  * from the state of the tcp instance what kind of action needs to be done
16524  * at the time it is called.
16525  */
16526 static void
16527 tcp_timer(void *arg)
16528 {
16529 	mblk_t		*mp;
16530 	clock_t		first_threshold;
16531 	clock_t		second_threshold;
16532 	clock_t		ms;
16533 	uint32_t	mss;
16534 	conn_t		*connp = (conn_t *)arg;
16535 	tcp_t		*tcp = connp->conn_tcp;
16536 
16537 	tcp->tcp_timer_tid = 0;
16538 
16539 	if (tcp->tcp_fused)
16540 		return;
16541 
16542 	first_threshold =  tcp->tcp_first_timer_threshold;
16543 	second_threshold = tcp->tcp_second_timer_threshold;
16544 	switch (tcp->tcp_state) {
16545 	case TCPS_IDLE:
16546 	case TCPS_BOUND:
16547 	case TCPS_LISTEN:
16548 		return;
16549 	case TCPS_SYN_RCVD: {
16550 		tcp_t	*listener = tcp->tcp_listener;
16551 
16552 		if (tcp->tcp_syn_rcvd_timeout == 0 && (listener != NULL)) {
16553 			ASSERT(tcp->tcp_rq == listener->tcp_rq);
16554 			/* it's our first timeout */
16555 			tcp->tcp_syn_rcvd_timeout = 1;
16556 			mutex_enter(&listener->tcp_eager_lock);
16557 			listener->tcp_syn_rcvd_timeout++;
16558 			if (!listener->tcp_syn_defense &&
16559 			    (listener->tcp_syn_rcvd_timeout >
16560 			    (tcp_conn_req_max_q0 >> 2)) &&
16561 			    (tcp_conn_req_max_q0 > 200)) {
16562 				/* We may be under attack. Put on a defense. */
16563 				listener->tcp_syn_defense = B_TRUE;
16564 				cmn_err(CE_WARN, "High TCP connect timeout "
16565 				    "rate! System (port %d) may be under a "
16566 				    "SYN flood attack!",
16567 				    BE16_TO_U16(listener->tcp_tcph->th_lport));
16568 
16569 				listener->tcp_ip_addr_cache = kmem_zalloc(
16570 				    IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t),
16571 				    KM_NOSLEEP);
16572 			}
16573 			mutex_exit(&listener->tcp_eager_lock);
16574 		}
16575 	}
16576 		/* FALLTHRU */
16577 	case TCPS_SYN_SENT:
16578 		first_threshold =  tcp->tcp_first_ctimer_threshold;
16579 		second_threshold = tcp->tcp_second_ctimer_threshold;
16580 		break;
16581 	case TCPS_ESTABLISHED:
16582 	case TCPS_FIN_WAIT_1:
16583 	case TCPS_CLOSING:
16584 	case TCPS_CLOSE_WAIT:
16585 	case TCPS_LAST_ACK:
16586 		/* If we have data to rexmit */
16587 		if (tcp->tcp_suna != tcp->tcp_snxt) {
16588 			clock_t	time_to_wait;
16589 
16590 			BUMP_MIB(&tcp_mib, tcpTimRetrans);
16591 			if (!tcp->tcp_xmit_head)
16592 				break;
16593 			time_to_wait = lbolt -
16594 			    (clock_t)tcp->tcp_xmit_head->b_prev;
16595 			time_to_wait = tcp->tcp_rto -
16596 			    TICK_TO_MSEC(time_to_wait);
16597 			/*
16598 			 * If the timer fires too early, 1 clock tick earlier,
16599 			 * restart the timer.
16600 			 */
16601 			if (time_to_wait > msec_per_tick) {
16602 				TCP_STAT(tcp_timer_fire_early);
16603 				TCP_TIMER_RESTART(tcp, time_to_wait);
16604 				return;
16605 			}
16606 			/*
16607 			 * When we probe zero windows, we force the swnd open.
16608 			 * If our peer acks with a closed window swnd will be
16609 			 * set to zero by tcp_rput(). As long as we are
16610 			 * receiving acks tcp_rput will
16611 			 * reset 'tcp_ms_we_have_waited' so as not to trip the
16612 			 * first and second interval actions.  NOTE: the timer
16613 			 * interval is allowed to continue its exponential
16614 			 * backoff.
16615 			 */
16616 			if (tcp->tcp_swnd == 0 || tcp->tcp_zero_win_probe) {
16617 				if (tcp->tcp_debug) {
16618 					(void) strlog(TCP_MOD_ID, 0, 1,
16619 					    SL_TRACE, "tcp_timer: zero win");
16620 				}
16621 			} else {
16622 				/*
16623 				 * After retransmission, we need to do
16624 				 * slow start.  Set the ssthresh to one
16625 				 * half of current effective window and
16626 				 * cwnd to one MSS.  Also reset
16627 				 * tcp_cwnd_cnt.
16628 				 *
16629 				 * Note that if tcp_ssthresh is reduced because
16630 				 * of ECN, do not reduce it again unless it is
16631 				 * already one window of data away (tcp_cwr
16632 				 * should then be cleared) or this is a
16633 				 * timeout for a retransmitted segment.
16634 				 */
16635 				uint32_t npkt;
16636 
16637 				if (!tcp->tcp_cwr || tcp->tcp_rexmit) {
16638 					npkt = ((tcp->tcp_timer_backoff ?
16639 					    tcp->tcp_cwnd_ssthresh :
16640 					    tcp->tcp_snxt -
16641 					    tcp->tcp_suna) >> 1) / tcp->tcp_mss;
16642 					tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
16643 					    tcp->tcp_mss;
16644 				}
16645 				tcp->tcp_cwnd = tcp->tcp_mss;
16646 				tcp->tcp_cwnd_cnt = 0;
16647 				if (tcp->tcp_ecn_ok) {
16648 					tcp->tcp_cwr = B_TRUE;
16649 					tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
16650 					tcp->tcp_ecn_cwr_sent = B_FALSE;
16651 				}
16652 			}
16653 			break;
16654 		}
16655 		/*
16656 		 * We have something to send yet we cannot send.  The
16657 		 * reason can be:
16658 		 *
16659 		 * 1. Zero send window: we need to do zero window probe.
16660 		 * 2. Zero cwnd: because of ECN, we need to "clock out
16661 		 * segments.
16662 		 * 3. SWS avoidance: receiver may have shrunk window,
16663 		 * reset our knowledge.
16664 		 *
16665 		 * Note that condition 2 can happen with either 1 or
16666 		 * 3.  But 1 and 3 are exclusive.
16667 		 */
16668 		if (tcp->tcp_unsent != 0) {
16669 			if (tcp->tcp_cwnd == 0) {
16670 				/*
16671 				 * Set tcp_cwnd to 1 MSS so that a
16672 				 * new segment can be sent out.  We
16673 				 * are "clocking out" new data when
16674 				 * the network is really congested.
16675 				 */
16676 				ASSERT(tcp->tcp_ecn_ok);
16677 				tcp->tcp_cwnd = tcp->tcp_mss;
16678 			}
16679 			if (tcp->tcp_swnd == 0) {
16680 				/* Extend window for zero window probe */
16681 				tcp->tcp_swnd++;
16682 				tcp->tcp_zero_win_probe = B_TRUE;
16683 				BUMP_MIB(&tcp_mib, tcpOutWinProbe);
16684 			} else {
16685 				/*
16686 				 * Handle timeout from sender SWS avoidance.
16687 				 * Reset our knowledge of the max send window
16688 				 * since the receiver might have reduced its
16689 				 * receive buffer.  Avoid setting tcp_max_swnd
16690 				 * to one since that will essentially disable
16691 				 * the SWS checks.
16692 				 *
16693 				 * Note that since we don't have a SWS
16694 				 * state variable, if the timeout is set
16695 				 * for ECN but not for SWS, this
16696 				 * code will also be executed.  This is
16697 				 * fine as tcp_max_swnd is updated
16698 				 * constantly and it will not affect
16699 				 * anything.
16700 				 */
16701 				tcp->tcp_max_swnd = MAX(tcp->tcp_swnd, 2);
16702 			}
16703 			tcp_wput_data(tcp, NULL, B_FALSE);
16704 			return;
16705 		}
16706 		/* Is there a FIN that needs to be to re retransmitted? */
16707 		if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
16708 		    !tcp->tcp_fin_acked)
16709 			break;
16710 		/* Nothing to do, return without restarting timer. */
16711 		TCP_STAT(tcp_timer_fire_miss);
16712 		return;
16713 	case TCPS_FIN_WAIT_2:
16714 		/*
16715 		 * User closed the TCP endpoint and peer ACK'ed our FIN.
16716 		 * We waited some time for for peer's FIN, but it hasn't
16717 		 * arrived.  We flush the connection now to avoid
16718 		 * case where the peer has rebooted.
16719 		 */
16720 		if (TCP_IS_DETACHED(tcp)) {
16721 			(void) tcp_clean_death(tcp, 0, 23);
16722 		} else {
16723 			TCP_TIMER_RESTART(tcp, tcp_fin_wait_2_flush_interval);
16724 		}
16725 		return;
16726 	case TCPS_TIME_WAIT:
16727 		(void) tcp_clean_death(tcp, 0, 24);
16728 		return;
16729 	default:
16730 		if (tcp->tcp_debug) {
16731 			(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
16732 			    "tcp_timer: strange state (%d) %s",
16733 			    tcp->tcp_state, tcp_display(tcp, NULL,
16734 			    DISP_PORT_ONLY));
16735 		}
16736 		return;
16737 	}
16738 	if ((ms = tcp->tcp_ms_we_have_waited) > second_threshold) {
16739 		/*
16740 		 * For zero window probe, we need to send indefinitely,
16741 		 * unless we have not heard from the other side for some
16742 		 * time...
16743 		 */
16744 		if ((tcp->tcp_zero_win_probe == 0) ||
16745 		    (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >
16746 		    second_threshold)) {
16747 			BUMP_MIB(&tcp_mib, tcpTimRetransDrop);
16748 			/*
16749 			 * If TCP is in SYN_RCVD state, send back a
16750 			 * RST|ACK as BSD does.  Note that tcp_zero_win_probe
16751 			 * should be zero in TCPS_SYN_RCVD state.
16752 			 */
16753 			if (tcp->tcp_state == TCPS_SYN_RCVD) {
16754 				tcp_xmit_ctl("tcp_timer: RST sent on timeout "
16755 				    "in SYN_RCVD",
16756 				    tcp, tcp->tcp_snxt,
16757 				    tcp->tcp_rnxt, TH_RST | TH_ACK);
16758 			}
16759 			(void) tcp_clean_death(tcp,
16760 			    tcp->tcp_client_errno ?
16761 			    tcp->tcp_client_errno : ETIMEDOUT, 25);
16762 			return;
16763 		} else {
16764 			/*
16765 			 * Set tcp_ms_we_have_waited to second_threshold
16766 			 * so that in next timeout, we will do the above
16767 			 * check (lbolt - tcp_last_recv_time).  This is
16768 			 * also to avoid overflow.
16769 			 *
16770 			 * We don't need to decrement tcp_timer_backoff
16771 			 * to avoid overflow because it will be decremented
16772 			 * later if new timeout value is greater than
16773 			 * tcp_rexmit_interval_max.  In the case when
16774 			 * tcp_rexmit_interval_max is greater than
16775 			 * second_threshold, it means that we will wait
16776 			 * longer than second_threshold to send the next
16777 			 * window probe.
16778 			 */
16779 			tcp->tcp_ms_we_have_waited = second_threshold;
16780 		}
16781 	} else if (ms > first_threshold) {
16782 		if (tcp->tcp_snd_zcopy_aware && (!tcp->tcp_xmit_zc_clean) &&
16783 		    tcp->tcp_xmit_head != NULL) {
16784 			tcp->tcp_xmit_head =
16785 			    tcp_zcopy_backoff(tcp, tcp->tcp_xmit_head, 1);
16786 		}
16787 		/*
16788 		 * We have been retransmitting for too long...  The RTT
16789 		 * we calculated is probably incorrect.  Reinitialize it.
16790 		 * Need to compensate for 0 tcp_rtt_sa.  Reset
16791 		 * tcp_rtt_update so that we won't accidentally cache a
16792 		 * bad value.  But only do this if this is not a zero
16793 		 * window probe.
16794 		 */
16795 		if (tcp->tcp_rtt_sa != 0 && tcp->tcp_zero_win_probe == 0) {
16796 			tcp->tcp_rtt_sd += (tcp->tcp_rtt_sa >> 3) +
16797 			    (tcp->tcp_rtt_sa >> 5);
16798 			tcp->tcp_rtt_sa = 0;
16799 			tcp_ip_notify(tcp);
16800 			tcp->tcp_rtt_update = 0;
16801 		}
16802 	}
16803 	tcp->tcp_timer_backoff++;
16804 	if ((ms = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
16805 	    tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5)) <
16806 	    tcp_rexmit_interval_min) {
16807 		/*
16808 		 * This means the original RTO is tcp_rexmit_interval_min.
16809 		 * So we will use tcp_rexmit_interval_min as the RTO value
16810 		 * and do the backoff.
16811 		 */
16812 		ms = tcp_rexmit_interval_min << tcp->tcp_timer_backoff;
16813 	} else {
16814 		ms <<= tcp->tcp_timer_backoff;
16815 	}
16816 	if (ms > tcp_rexmit_interval_max) {
16817 		ms = tcp_rexmit_interval_max;
16818 		/*
16819 		 * ms is at max, decrement tcp_timer_backoff to avoid
16820 		 * overflow.
16821 		 */
16822 		tcp->tcp_timer_backoff--;
16823 	}
16824 	tcp->tcp_ms_we_have_waited += ms;
16825 	if (tcp->tcp_zero_win_probe == 0) {
16826 		tcp->tcp_rto = ms;
16827 	}
16828 	TCP_TIMER_RESTART(tcp, ms);
16829 	/*
16830 	 * This is after a timeout and tcp_rto is backed off.  Set
16831 	 * tcp_set_timer to 1 so that next time RTO is updated, we will
16832 	 * restart the timer with a correct value.
16833 	 */
16834 	tcp->tcp_set_timer = 1;
16835 	mss = tcp->tcp_snxt - tcp->tcp_suna;
16836 	if (mss > tcp->tcp_mss)
16837 		mss = tcp->tcp_mss;
16838 	if (mss > tcp->tcp_swnd && tcp->tcp_swnd != 0)
16839 		mss = tcp->tcp_swnd;
16840 
16841 	if ((mp = tcp->tcp_xmit_head) != NULL)
16842 		mp->b_prev = (mblk_t *)lbolt;
16843 	mp = tcp_xmit_mp(tcp, mp, mss, NULL, NULL, tcp->tcp_suna, B_TRUE, &mss,
16844 	    B_TRUE);
16845 
16846 	/*
16847 	 * When slow start after retransmission begins, start with
16848 	 * this seq no.  tcp_rexmit_max marks the end of special slow
16849 	 * start phase.  tcp_snd_burst controls how many segments
16850 	 * can be sent because of an ack.
16851 	 */
16852 	tcp->tcp_rexmit_nxt = tcp->tcp_suna;
16853 	tcp->tcp_snd_burst = TCP_CWND_SS;
16854 	if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
16855 	    (tcp->tcp_unsent == 0)) {
16856 		tcp->tcp_rexmit_max = tcp->tcp_fss;
16857 	} else {
16858 		tcp->tcp_rexmit_max = tcp->tcp_snxt;
16859 	}
16860 	tcp->tcp_rexmit = B_TRUE;
16861 	tcp->tcp_dupack_cnt = 0;
16862 
16863 	/*
16864 	 * Remove all rexmit SACK blk to start from fresh.
16865 	 */
16866 	if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
16867 		TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list);
16868 		tcp->tcp_num_notsack_blk = 0;
16869 		tcp->tcp_cnt_notsack_list = 0;
16870 	}
16871 	if (mp == NULL) {
16872 		return;
16873 	}
16874 	/* Attach credentials to retransmitted initial SYNs. */
16875 	if (tcp->tcp_state == TCPS_SYN_SENT) {
16876 		mblk_setcred(mp, tcp->tcp_cred);
16877 		DB_CPID(mp) = tcp->tcp_cpid;
16878 	}
16879 
16880 	tcp->tcp_csuna = tcp->tcp_snxt;
16881 	BUMP_MIB(&tcp_mib, tcpRetransSegs);
16882 	UPDATE_MIB(&tcp_mib, tcpRetransBytes, mss);
16883 	TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT);
16884 	tcp_send_data(tcp, tcp->tcp_wq, mp);
16885 
16886 }
16887 
16888 /* tcp_unbind is called by tcp_wput_proto to handle T_UNBIND_REQ messages. */
16889 static void
16890 tcp_unbind(tcp_t *tcp, mblk_t *mp)
16891 {
16892 	conn_t	*connp;
16893 
16894 	switch (tcp->tcp_state) {
16895 	case TCPS_BOUND:
16896 	case TCPS_LISTEN:
16897 		break;
16898 	default:
16899 		tcp_err_ack(tcp, mp, TOUTSTATE, 0);
16900 		return;
16901 	}
16902 
16903 	/*
16904 	 * Need to clean up all the eagers since after the unbind, segments
16905 	 * will no longer be delivered to this listener stream.
16906 	 */
16907 	mutex_enter(&tcp->tcp_eager_lock);
16908 	if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) {
16909 		tcp_eager_cleanup(tcp, 0);
16910 	}
16911 	mutex_exit(&tcp->tcp_eager_lock);
16912 
16913 	if (tcp->tcp_ipversion == IPV4_VERSION) {
16914 		tcp->tcp_ipha->ipha_src = 0;
16915 	} else {
16916 		V6_SET_ZERO(tcp->tcp_ip6h->ip6_src);
16917 	}
16918 	V6_SET_ZERO(tcp->tcp_ip_src_v6);
16919 	bzero(tcp->tcp_tcph->th_lport, sizeof (tcp->tcp_tcph->th_lport));
16920 	tcp_bind_hash_remove(tcp);
16921 	tcp->tcp_state = TCPS_IDLE;
16922 	tcp->tcp_mdt = B_FALSE;
16923 	/* Send M_FLUSH according to TPI */
16924 	(void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW);
16925 	connp = tcp->tcp_connp;
16926 	connp->conn_mdt_ok = B_FALSE;
16927 	ipcl_hash_remove(connp);
16928 	bzero(&connp->conn_ports, sizeof (connp->conn_ports));
16929 	mp = mi_tpi_ok_ack_alloc(mp);
16930 	putnext(tcp->tcp_rq, mp);
16931 }
16932 
16933 /*
16934  * Don't let port fall into the privileged range.
16935  * Since the extra privileged ports can be arbitrary we also
16936  * ensure that we exclude those from consideration.
16937  * tcp_g_epriv_ports is not sorted thus we loop over it until
16938  * there are no changes.
16939  *
16940  * Note: No locks are held when inspecting tcp_g_*epriv_ports
16941  * but instead the code relies on:
16942  * - the fact that the address of the array and its size never changes
16943  * - the atomic assignment of the elements of the array
16944  *
16945  * Returns 0 if there are no more ports available.
16946  *
16947  * TS note: skip multilevel ports.
16948  */
16949 static in_port_t
16950 tcp_update_next_port(in_port_t port, const tcp_t *tcp, boolean_t random)
16951 {
16952 	int i;
16953 	boolean_t restart = B_FALSE;
16954 
16955 	if (random && tcp_random_anon_port != 0) {
16956 		(void) random_get_pseudo_bytes((uint8_t *)&port,
16957 		    sizeof (in_port_t));
16958 		/*
16959 		 * Unless changed by a sys admin, the smallest anon port
16960 		 * is 32768 and the largest anon port is 65535.  It is
16961 		 * very likely (50%) for the random port to be smaller
16962 		 * than the smallest anon port.  When that happens,
16963 		 * add port % (anon port range) to the smallest anon
16964 		 * port to get the random port.  It should fall into the
16965 		 * valid anon port range.
16966 		 */
16967 		if (port < tcp_smallest_anon_port) {
16968 			port = tcp_smallest_anon_port +
16969 			    port % (tcp_largest_anon_port -
16970 				tcp_smallest_anon_port);
16971 		}
16972 	}
16973 
16974 retry:
16975 	if (port < tcp_smallest_anon_port)
16976 		port = (in_port_t)tcp_smallest_anon_port;
16977 
16978 	if (port > tcp_largest_anon_port) {
16979 		if (restart)
16980 			return (0);
16981 		restart = B_TRUE;
16982 		port = (in_port_t)tcp_smallest_anon_port;
16983 	}
16984 
16985 	if (port < tcp_smallest_nonpriv_port)
16986 		port = (in_port_t)tcp_smallest_nonpriv_port;
16987 
16988 	for (i = 0; i < tcp_g_num_epriv_ports; i++) {
16989 		if (port == tcp_g_epriv_ports[i]) {
16990 			port++;
16991 			/*
16992 			 * Make sure whether the port is in the
16993 			 * valid range.
16994 			 */
16995 			goto retry;
16996 		}
16997 	}
16998 	if (is_system_labeled() &&
16999 	    (i = tsol_next_port(crgetzone(tcp->tcp_cred), port,
17000 	    IPPROTO_TCP, B_TRUE)) != 0) {
17001 		port = i;
17002 		goto retry;
17003 	}
17004 	return (port);
17005 }
17006 
17007 /*
17008  * Return the next anonymous port in the privileged port range for
17009  * bind checking.  It starts at IPPORT_RESERVED - 1 and goes
17010  * downwards.  This is the same behavior as documented in the userland
17011  * library call rresvport(3N).
17012  *
17013  * TS note: skip multilevel ports.
17014  */
17015 static in_port_t
17016 tcp_get_next_priv_port(const tcp_t *tcp)
17017 {
17018 	static in_port_t next_priv_port = IPPORT_RESERVED - 1;
17019 	in_port_t nextport;
17020 	boolean_t restart = B_FALSE;
17021 
17022 retry:
17023 	if (next_priv_port < tcp_min_anonpriv_port ||
17024 	    next_priv_port >= IPPORT_RESERVED) {
17025 		next_priv_port = IPPORT_RESERVED - 1;
17026 		if (restart)
17027 			return (0);
17028 		restart = B_TRUE;
17029 	}
17030 	if (is_system_labeled() &&
17031 	    (nextport = tsol_next_port(crgetzone(tcp->tcp_cred),
17032 	    next_priv_port, IPPROTO_TCP, B_FALSE)) != 0) {
17033 		next_priv_port = nextport;
17034 		goto retry;
17035 	}
17036 	return (next_priv_port--);
17037 }
17038 
17039 /* The write side r/w procedure. */
17040 
17041 #if CCS_STATS
17042 struct {
17043 	struct {
17044 		int64_t count, bytes;
17045 	} tot, hit;
17046 } wrw_stats;
17047 #endif
17048 
17049 /*
17050  * Call by tcp_wput() to handle all non data, except M_PROTO and M_PCPROTO,
17051  * messages.
17052  */
17053 /* ARGSUSED */
17054 static void
17055 tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2)
17056 {
17057 	conn_t	*connp = (conn_t *)arg;
17058 	tcp_t	*tcp = connp->conn_tcp;
17059 	queue_t	*q = tcp->tcp_wq;
17060 
17061 	ASSERT(DB_TYPE(mp) != M_IOCTL);
17062 	/*
17063 	 * TCP is D_MP and qprocsoff() is done towards the end of the tcp_close.
17064 	 * Once the close starts, streamhead and sockfs will not let any data
17065 	 * packets come down (close ensures that there are no threads using the
17066 	 * queue and no new threads will come down) but since qprocsoff()
17067 	 * hasn't happened yet, a M_FLUSH or some non data message might
17068 	 * get reflected back (in response to our own FLUSHRW) and get
17069 	 * processed after tcp_close() is done. The conn would still be valid
17070 	 * because a ref would have added but we need to check the state
17071 	 * before actually processing the packet.
17072 	 */
17073 	if (TCP_IS_DETACHED(tcp) || (tcp->tcp_state == TCPS_CLOSED)) {
17074 		freemsg(mp);
17075 		return;
17076 	}
17077 
17078 	switch (DB_TYPE(mp)) {
17079 	case M_IOCDATA:
17080 		tcp_wput_iocdata(tcp, mp);
17081 		break;
17082 	case M_FLUSH:
17083 		tcp_wput_flush(tcp, mp);
17084 		break;
17085 	default:
17086 		CALL_IP_WPUT(connp, q, mp);
17087 		break;
17088 	}
17089 }
17090 
17091 /*
17092  * The TCP fast path write put procedure.
17093  * NOTE: the logic of the fast path is duplicated from tcp_wput_data()
17094  */
17095 /* ARGSUSED */
17096 void
17097 tcp_output(void *arg, mblk_t *mp, void *arg2)
17098 {
17099 	int		len;
17100 	int		hdrlen;
17101 	int		plen;
17102 	mblk_t		*mp1;
17103 	uchar_t		*rptr;
17104 	uint32_t	snxt;
17105 	tcph_t		*tcph;
17106 	struct datab	*db;
17107 	uint32_t	suna;
17108 	uint32_t	mss;
17109 	ipaddr_t	*dst;
17110 	ipaddr_t	*src;
17111 	uint32_t	sum;
17112 	int		usable;
17113 	conn_t		*connp = (conn_t *)arg;
17114 	tcp_t		*tcp = connp->conn_tcp;
17115 	uint32_t	msize;
17116 
17117 	/*
17118 	 * Try and ASSERT the minimum possible references on the
17119 	 * conn early enough. Since we are executing on write side,
17120 	 * the connection is obviously not detached and that means
17121 	 * there is a ref each for TCP and IP. Since we are behind
17122 	 * the squeue, the minimum references needed are 3. If the
17123 	 * conn is in classifier hash list, there should be an
17124 	 * extra ref for that (we check both the possibilities).
17125 	 */
17126 	ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) ||
17127 	    (connp->conn_fanout == NULL && connp->conn_ref >= 3));
17128 
17129 	ASSERT(DB_TYPE(mp) == M_DATA);
17130 	msize = (mp->b_cont == NULL) ? MBLKL(mp) : msgdsize(mp);
17131 
17132 	mutex_enter(&connp->conn_lock);
17133 	tcp->tcp_squeue_bytes -= msize;
17134 	mutex_exit(&connp->conn_lock);
17135 
17136 	/* Bypass tcp protocol for fused tcp loopback */
17137 	if (tcp->tcp_fused && tcp_fuse_output(tcp, mp, msize))
17138 		return;
17139 
17140 	mss = tcp->tcp_mss;
17141 	if (tcp->tcp_xmit_zc_clean)
17142 		mp = tcp_zcopy_backoff(tcp, mp, 0);
17143 
17144 	ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
17145 	len = (int)(mp->b_wptr - mp->b_rptr);
17146 
17147 	/*
17148 	 * Criteria for fast path:
17149 	 *
17150 	 *   1. no unsent data
17151 	 *   2. single mblk in request
17152 	 *   3. connection established
17153 	 *   4. data in mblk
17154 	 *   5. len <= mss
17155 	 *   6. no tcp_valid bits
17156 	 */
17157 	if ((tcp->tcp_unsent != 0) ||
17158 	    (tcp->tcp_cork) ||
17159 	    (mp->b_cont != NULL) ||
17160 	    (tcp->tcp_state != TCPS_ESTABLISHED) ||
17161 	    (len == 0) ||
17162 	    (len > mss) ||
17163 	    (tcp->tcp_valid_bits != 0)) {
17164 		tcp_wput_data(tcp, mp, B_FALSE);
17165 		return;
17166 	}
17167 
17168 	ASSERT(tcp->tcp_xmit_tail_unsent == 0);
17169 	ASSERT(tcp->tcp_fin_sent == 0);
17170 
17171 	/* queue new packet onto retransmission queue */
17172 	if (tcp->tcp_xmit_head == NULL) {
17173 		tcp->tcp_xmit_head = mp;
17174 	} else {
17175 		tcp->tcp_xmit_last->b_cont = mp;
17176 	}
17177 	tcp->tcp_xmit_last = mp;
17178 	tcp->tcp_xmit_tail = mp;
17179 
17180 	/* find out how much we can send */
17181 	/* BEGIN CSTYLED */
17182 	/*
17183 	 *    un-acked           usable
17184 	 *  |--------------|-----------------|
17185 	 *  tcp_suna       tcp_snxt          tcp_suna+tcp_swnd
17186 	 */
17187 	/* END CSTYLED */
17188 
17189 	/* start sending from tcp_snxt */
17190 	snxt = tcp->tcp_snxt;
17191 
17192 	/*
17193 	 * Check to see if this connection has been idled for some
17194 	 * time and no ACK is expected.  If it is, we need to slow
17195 	 * start again to get back the connection's "self-clock" as
17196 	 * described in VJ's paper.
17197 	 *
17198 	 * Refer to the comment in tcp_mss_set() for the calculation
17199 	 * of tcp_cwnd after idle.
17200 	 */
17201 	if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet &&
17202 	    (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >= tcp->tcp_rto)) {
17203 		SET_TCP_INIT_CWND(tcp, mss, tcp_slow_start_after_idle);
17204 	}
17205 
17206 	usable = tcp->tcp_swnd;		/* tcp window size */
17207 	if (usable > tcp->tcp_cwnd)
17208 		usable = tcp->tcp_cwnd;	/* congestion window smaller */
17209 	usable -= snxt;		/* subtract stuff already sent */
17210 	suna = tcp->tcp_suna;
17211 	usable += suna;
17212 	/* usable can be < 0 if the congestion window is smaller */
17213 	if (len > usable) {
17214 		/* Can't send complete M_DATA in one shot */
17215 		goto slow;
17216 	}
17217 
17218 	if (tcp->tcp_flow_stopped &&
17219 	    TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) {
17220 		tcp_clrqfull(tcp);
17221 	}
17222 
17223 	/*
17224 	 * determine if anything to send (Nagle).
17225 	 *
17226 	 *   1. len < tcp_mss (i.e. small)
17227 	 *   2. unacknowledged data present
17228 	 *   3. len < nagle limit
17229 	 *   4. last packet sent < nagle limit (previous packet sent)
17230 	 */
17231 	if ((len < mss) && (snxt != suna) &&
17232 	    (len < (int)tcp->tcp_naglim) &&
17233 	    (tcp->tcp_last_sent_len < tcp->tcp_naglim)) {
17234 		/*
17235 		 * This was the first unsent packet and normally
17236 		 * mss < xmit_hiwater so there is no need to worry
17237 		 * about flow control. The next packet will go
17238 		 * through the flow control check in tcp_wput_data().
17239 		 */
17240 		/* leftover work from above */
17241 		tcp->tcp_unsent = len;
17242 		tcp->tcp_xmit_tail_unsent = len;
17243 
17244 		return;
17245 	}
17246 
17247 	/* len <= tcp->tcp_mss && len == unsent so no silly window */
17248 
17249 	if (snxt == suna) {
17250 		TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
17251 	}
17252 
17253 	/* we have always sent something */
17254 	tcp->tcp_rack_cnt = 0;
17255 
17256 	tcp->tcp_snxt = snxt + len;
17257 	tcp->tcp_rack = tcp->tcp_rnxt;
17258 
17259 	if ((mp1 = dupb(mp)) == 0)
17260 		goto no_memory;
17261 	mp->b_prev = (mblk_t *)(uintptr_t)lbolt;
17262 	mp->b_next = (mblk_t *)(uintptr_t)snxt;
17263 
17264 	/* adjust tcp header information */
17265 	tcph = tcp->tcp_tcph;
17266 	tcph->th_flags[0] = (TH_ACK|TH_PUSH);
17267 
17268 	sum = len + tcp->tcp_tcp_hdr_len + tcp->tcp_sum;
17269 	sum = (sum >> 16) + (sum & 0xFFFF);
17270 	U16_TO_ABE16(sum, tcph->th_sum);
17271 
17272 	U32_TO_ABE32(snxt, tcph->th_seq);
17273 
17274 	BUMP_MIB(&tcp_mib, tcpOutDataSegs);
17275 	UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len);
17276 	BUMP_LOCAL(tcp->tcp_obsegs);
17277 
17278 	/* Update the latest receive window size in TCP header. */
17279 	U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws,
17280 	    tcph->th_win);
17281 
17282 	tcp->tcp_last_sent_len = (ushort_t)len;
17283 
17284 	plen = len + tcp->tcp_hdr_len;
17285 
17286 	if (tcp->tcp_ipversion == IPV4_VERSION) {
17287 		tcp->tcp_ipha->ipha_length = htons(plen);
17288 	} else {
17289 		tcp->tcp_ip6h->ip6_plen = htons(plen -
17290 		    ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc));
17291 	}
17292 
17293 	/* see if we need to allocate a mblk for the headers */
17294 	hdrlen = tcp->tcp_hdr_len;
17295 	rptr = mp1->b_rptr - hdrlen;
17296 	db = mp1->b_datap;
17297 	if ((db->db_ref != 2) || rptr < db->db_base ||
17298 	    (!OK_32PTR(rptr))) {
17299 		/* NOTE: we assume allocb returns an OK_32PTR */
17300 		mp = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH +
17301 		    tcp_wroff_xtra, BPRI_MED);
17302 		if (!mp) {
17303 			freemsg(mp1);
17304 			goto no_memory;
17305 		}
17306 		mp->b_cont = mp1;
17307 		mp1 = mp;
17308 		/* Leave room for Link Level header */
17309 		/* hdrlen = tcp->tcp_hdr_len; */
17310 		rptr = &mp1->b_rptr[tcp_wroff_xtra];
17311 		mp1->b_wptr = &rptr[hdrlen];
17312 	}
17313 	mp1->b_rptr = rptr;
17314 
17315 	/* Fill in the timestamp option. */
17316 	if (tcp->tcp_snd_ts_ok) {
17317 		U32_TO_BE32((uint32_t)lbolt,
17318 		    (char *)tcph+TCP_MIN_HEADER_LENGTH+4);
17319 		U32_TO_BE32(tcp->tcp_ts_recent,
17320 		    (char *)tcph+TCP_MIN_HEADER_LENGTH+8);
17321 	} else {
17322 		ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH);
17323 	}
17324 
17325 	/* copy header into outgoing packet */
17326 	dst = (ipaddr_t *)rptr;
17327 	src = (ipaddr_t *)tcp->tcp_iphc;
17328 	dst[0] = src[0];
17329 	dst[1] = src[1];
17330 	dst[2] = src[2];
17331 	dst[3] = src[3];
17332 	dst[4] = src[4];
17333 	dst[5] = src[5];
17334 	dst[6] = src[6];
17335 	dst[7] = src[7];
17336 	dst[8] = src[8];
17337 	dst[9] = src[9];
17338 	if (hdrlen -= 40) {
17339 		hdrlen >>= 2;
17340 		dst += 10;
17341 		src += 10;
17342 		do {
17343 			*dst++ = *src++;
17344 		} while (--hdrlen);
17345 	}
17346 
17347 	/*
17348 	 * Set the ECN info in the TCP header.  Note that this
17349 	 * is not the template header.
17350 	 */
17351 	if (tcp->tcp_ecn_ok) {
17352 		SET_ECT(tcp, rptr);
17353 
17354 		tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len);
17355 		if (tcp->tcp_ecn_echo_on)
17356 			tcph->th_flags[0] |= TH_ECE;
17357 		if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) {
17358 			tcph->th_flags[0] |= TH_CWR;
17359 			tcp->tcp_ecn_cwr_sent = B_TRUE;
17360 		}
17361 	}
17362 
17363 	if (tcp->tcp_ip_forward_progress) {
17364 		ASSERT(tcp->tcp_ipversion == IPV6_VERSION);
17365 		*(uint32_t *)mp1->b_rptr  |= IP_FORWARD_PROG;
17366 		tcp->tcp_ip_forward_progress = B_FALSE;
17367 	}
17368 	TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT);
17369 	tcp_send_data(tcp, tcp->tcp_wq, mp1);
17370 	return;
17371 
17372 	/*
17373 	 * If we ran out of memory, we pretend to have sent the packet
17374 	 * and that it was lost on the wire.
17375 	 */
17376 no_memory:
17377 	return;
17378 
17379 slow:
17380 	/* leftover work from above */
17381 	tcp->tcp_unsent = len;
17382 	tcp->tcp_xmit_tail_unsent = len;
17383 	tcp_wput_data(tcp, NULL, B_FALSE);
17384 }
17385 
17386 /*
17387  * The function called through squeue to get behind eager's perimeter to
17388  * finish the accept processing.
17389  */
17390 /* ARGSUSED */
17391 void
17392 tcp_accept_finish(void *arg, mblk_t *mp, void *arg2)
17393 {
17394 	conn_t			*connp = (conn_t *)arg;
17395 	tcp_t			*tcp = connp->conn_tcp;
17396 	queue_t			*q = tcp->tcp_rq;
17397 	mblk_t			*mp1;
17398 	mblk_t			*stropt_mp = mp;
17399 	struct  stroptions	*stropt;
17400 	uint_t			thwin;
17401 
17402 	/*
17403 	 * Drop the eager's ref on the listener, that was placed when
17404 	 * this eager began life in tcp_conn_request.
17405 	 */
17406 	CONN_DEC_REF(tcp->tcp_saved_listener->tcp_connp);
17407 
17408 	if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_accept_error) {
17409 		/*
17410 		 * Someone blewoff the eager before we could finish
17411 		 * the accept.
17412 		 *
17413 		 * The only reason eager exists it because we put in
17414 		 * a ref on it when conn ind went up. We need to send
17415 		 * a disconnect indication up while the last reference
17416 		 * on the eager will be dropped by the squeue when we
17417 		 * return.
17418 		 */
17419 		ASSERT(tcp->tcp_listener == NULL);
17420 		if (tcp->tcp_issocket || tcp->tcp_send_discon_ind) {
17421 			struct	T_discon_ind	*tdi;
17422 
17423 			(void) putnextctl1(q, M_FLUSH, FLUSHRW);
17424 			/*
17425 			 * Let us reuse the incoming mblk to avoid memory
17426 			 * allocation failure problems. We know that the
17427 			 * size of the incoming mblk i.e. stroptions is greater
17428 			 * than sizeof T_discon_ind. So the reallocb below
17429 			 * can't fail.
17430 			 */
17431 			freemsg(mp->b_cont);
17432 			mp->b_cont = NULL;
17433 			ASSERT(DB_REF(mp) == 1);
17434 			mp = reallocb(mp, sizeof (struct T_discon_ind),
17435 			    B_FALSE);
17436 			ASSERT(mp != NULL);
17437 			DB_TYPE(mp) = M_PROTO;
17438 			((union T_primitives *)mp->b_rptr)->type = T_DISCON_IND;
17439 			tdi = (struct T_discon_ind *)mp->b_rptr;
17440 			if (tcp->tcp_issocket) {
17441 				tdi->DISCON_reason = ECONNREFUSED;
17442 				tdi->SEQ_number = 0;
17443 			} else {
17444 				tdi->DISCON_reason = ENOPROTOOPT;
17445 				tdi->SEQ_number =
17446 				    tcp->tcp_conn_req_seqnum;
17447 			}
17448 			mp->b_wptr = mp->b_rptr + sizeof (struct T_discon_ind);
17449 			putnext(q, mp);
17450 		} else {
17451 			freemsg(mp);
17452 		}
17453 		if (tcp->tcp_hard_binding) {
17454 			tcp->tcp_hard_binding = B_FALSE;
17455 			tcp->tcp_hard_bound = B_TRUE;
17456 		}
17457 		tcp->tcp_detached = B_FALSE;
17458 		return;
17459 	}
17460 
17461 	mp1 = stropt_mp->b_cont;
17462 	stropt_mp->b_cont = NULL;
17463 	ASSERT(DB_TYPE(stropt_mp) == M_SETOPTS);
17464 	stropt = (struct stroptions *)stropt_mp->b_rptr;
17465 
17466 	while (mp1 != NULL) {
17467 		mp = mp1;
17468 		mp1 = mp1->b_cont;
17469 		mp->b_cont = NULL;
17470 		tcp->tcp_drop_opt_ack_cnt++;
17471 		CALL_IP_WPUT(connp, tcp->tcp_wq, mp);
17472 	}
17473 	mp = NULL;
17474 
17475 	/*
17476 	 * For a loopback connection with tcp_direct_sockfs on, note that
17477 	 * we don't have to protect tcp_rcv_list yet because synchronous
17478 	 * streams has not yet been enabled and tcp_fuse_rrw() cannot
17479 	 * possibly race with us.
17480 	 */
17481 
17482 	/*
17483 	 * Set the max window size (tcp_rq->q_hiwat) of the acceptor
17484 	 * properly.  This is the first time we know of the acceptor'
17485 	 * queue.  So we do it here.
17486 	 */
17487 	if (tcp->tcp_rcv_list == NULL) {
17488 		/*
17489 		 * Recv queue is empty, tcp_rwnd should not have changed.
17490 		 * That means it should be equal to the listener's tcp_rwnd.
17491 		 */
17492 		tcp->tcp_rq->q_hiwat = tcp->tcp_rwnd;
17493 	} else {
17494 #ifdef DEBUG
17495 		uint_t cnt = 0;
17496 
17497 		mp1 = tcp->tcp_rcv_list;
17498 		while ((mp = mp1) != NULL) {
17499 			mp1 = mp->b_next;
17500 			cnt += msgdsize(mp);
17501 		}
17502 		ASSERT(cnt != 0 && tcp->tcp_rcv_cnt == cnt);
17503 #endif
17504 		/* There is some data, add them back to get the max. */
17505 		tcp->tcp_rq->q_hiwat = tcp->tcp_rwnd + tcp->tcp_rcv_cnt;
17506 	}
17507 
17508 	stropt->so_flags = SO_HIWAT;
17509 	stropt->so_hiwat = MAX(q->q_hiwat, tcp_sth_rcv_hiwat);
17510 
17511 	stropt->so_flags |= SO_MAXBLK;
17512 	stropt->so_maxblk = tcp_maxpsz_set(tcp, B_FALSE);
17513 
17514 	/*
17515 	 * This is the first time we run on the correct
17516 	 * queue after tcp_accept. So fix all the q parameters
17517 	 * here.
17518 	 */
17519 	/* Allocate room for SACK options if needed. */
17520 	stropt->so_flags |= SO_WROFF;
17521 	if (tcp->tcp_fused) {
17522 		ASSERT(tcp->tcp_loopback);
17523 		ASSERT(tcp->tcp_loopback_peer != NULL);
17524 		/*
17525 		 * For fused tcp loopback, set the stream head's write
17526 		 * offset value to zero since we won't be needing any room
17527 		 * for TCP/IP headers.  This would also improve performance
17528 		 * since it would reduce the amount of work done by kmem.
17529 		 * Non-fused tcp loopback case is handled separately below.
17530 		 */
17531 		stropt->so_wroff = 0;
17532 		/*
17533 		 * Record the stream head's high water mark for this endpoint;
17534 		 * this is used for flow-control purposes in tcp_fuse_output().
17535 		 */
17536 		stropt->so_hiwat = tcp_fuse_set_rcv_hiwat(tcp, q->q_hiwat);
17537 		/*
17538 		 * Update the peer's transmit parameters according to
17539 		 * our recently calculated high water mark value.
17540 		 */
17541 		(void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE);
17542 	} else if (tcp->tcp_snd_sack_ok) {
17543 		stropt->so_wroff = tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN +
17544 		    (tcp->tcp_loopback ? 0 : tcp_wroff_xtra);
17545 	} else {
17546 		stropt->so_wroff = tcp->tcp_hdr_len + (tcp->tcp_loopback ? 0 :
17547 		    tcp_wroff_xtra);
17548 	}
17549 
17550 	/*
17551 	 * If this is endpoint is handling SSL, then reserve extra
17552 	 * offset and space at the end.
17553 	 * Also have the stream head allocate SSL3_MAX_RECORD_LEN packets,
17554 	 * overriding the previous setting. The extra cost of signing and
17555 	 * encrypting multiple MSS-size records (12 of them with Ethernet),
17556 	 * instead of a single contiguous one by the stream head
17557 	 * largely outweighs the statistical reduction of ACKs, when
17558 	 * applicable. The peer will also save on decyption and verification
17559 	 * costs.
17560 	 */
17561 	if (tcp->tcp_kssl_ctx != NULL) {
17562 		stropt->so_wroff += SSL3_WROFFSET;
17563 
17564 		stropt->so_flags |= SO_TAIL;
17565 		stropt->so_tail = SSL3_MAX_TAIL_LEN;
17566 
17567 		stropt->so_maxblk = SSL3_MAX_RECORD_LEN;
17568 	}
17569 
17570 	/* Send the options up */
17571 	putnext(q, stropt_mp);
17572 
17573 	/*
17574 	 * Pass up any data and/or a fin that has been received.
17575 	 *
17576 	 * Adjust receive window in case it had decreased
17577 	 * (because there is data <=> tcp_rcv_list != NULL)
17578 	 * while the connection was detached. Note that
17579 	 * in case the eager was flow-controlled, w/o this
17580 	 * code, the rwnd may never open up again!
17581 	 */
17582 	if (tcp->tcp_rcv_list != NULL) {
17583 		/* We drain directly in case of fused tcp loopback */
17584 		if (!tcp->tcp_fused && canputnext(q)) {
17585 			tcp->tcp_rwnd = q->q_hiwat;
17586 			thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win))
17587 			    << tcp->tcp_rcv_ws;
17588 			thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
17589 			if (tcp->tcp_state >= TCPS_ESTABLISHED &&
17590 			    (q->q_hiwat - thwin >= tcp->tcp_mss)) {
17591 				tcp_xmit_ctl(NULL,
17592 				    tcp, (tcp->tcp_swnd == 0) ?
17593 				    tcp->tcp_suna : tcp->tcp_snxt,
17594 				    tcp->tcp_rnxt, TH_ACK);
17595 				BUMP_MIB(&tcp_mib, tcpOutWinUpdate);
17596 			}
17597 
17598 		}
17599 		(void) tcp_rcv_drain(q, tcp);
17600 
17601 		/*
17602 		 * For fused tcp loopback, back-enable peer endpoint
17603 		 * if it's currently flow-controlled.
17604 		 */
17605 		if (tcp->tcp_fused &&
17606 		    tcp->tcp_loopback_peer->tcp_flow_stopped) {
17607 			tcp_t *peer_tcp = tcp->tcp_loopback_peer;
17608 
17609 			ASSERT(peer_tcp != NULL);
17610 			ASSERT(peer_tcp->tcp_fused);
17611 
17612 			tcp_clrqfull(peer_tcp);
17613 			TCP_STAT(tcp_fusion_backenabled);
17614 		}
17615 	}
17616 	ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
17617 	if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) {
17618 		mp = mi_tpi_ordrel_ind();
17619 		if (mp) {
17620 			tcp->tcp_ordrel_done = B_TRUE;
17621 			putnext(q, mp);
17622 			if (tcp->tcp_deferred_clean_death) {
17623 				/*
17624 				 * tcp_clean_death was deferred
17625 				 * for T_ORDREL_IND - do it now
17626 				 */
17627 				(void) tcp_clean_death(tcp,
17628 				    tcp->tcp_client_errno, 21);
17629 				tcp->tcp_deferred_clean_death = B_FALSE;
17630 			}
17631 		} else {
17632 			/*
17633 			 * Run the orderly release in the
17634 			 * service routine.
17635 			 */
17636 			qenable(q);
17637 		}
17638 	}
17639 	if (tcp->tcp_hard_binding) {
17640 		tcp->tcp_hard_binding = B_FALSE;
17641 		tcp->tcp_hard_bound = B_TRUE;
17642 	}
17643 
17644 	tcp->tcp_detached = B_FALSE;
17645 
17646 	/* We can enable synchronous streams now */
17647 	if (tcp->tcp_fused) {
17648 		tcp_fuse_syncstr_enable_pair(tcp);
17649 	}
17650 
17651 	if (tcp->tcp_ka_enabled) {
17652 		tcp->tcp_ka_last_intrvl = 0;
17653 		tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer,
17654 		    MSEC_TO_TICK(tcp->tcp_ka_interval));
17655 	}
17656 
17657 	/*
17658 	 * At this point, eager is fully established and will
17659 	 * have the following references -
17660 	 *
17661 	 * 2 references for connection to exist (1 for TCP and 1 for IP).
17662 	 * 1 reference for the squeue which will be dropped by the squeue as
17663 	 *	soon as this function returns.
17664 	 * There will be 1 additonal reference for being in classifier
17665 	 *	hash list provided something bad hasn't happened.
17666 	 */
17667 	ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) ||
17668 	    (connp->conn_fanout == NULL && connp->conn_ref >= 3));
17669 }
17670 
17671 /*
17672  * The function called through squeue to get behind listener's perimeter to
17673  * send a deffered conn_ind.
17674  */
17675 /* ARGSUSED */
17676 void
17677 tcp_send_pending(void *arg, mblk_t *mp, void *arg2)
17678 {
17679 	conn_t	*connp = (conn_t *)arg;
17680 	tcp_t *listener = connp->conn_tcp;
17681 
17682 	if (listener->tcp_state == TCPS_CLOSED ||
17683 	    TCP_IS_DETACHED(listener)) {
17684 		/*
17685 		 * If listener has closed, it would have caused a
17686 		 * a cleanup/blowoff to happen for the eager.
17687 		 */
17688 		tcp_t *tcp;
17689 		struct T_conn_ind	*conn_ind;
17690 
17691 		conn_ind = (struct T_conn_ind *)mp->b_rptr;
17692 		bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp,
17693 		    conn_ind->OPT_length);
17694 		/*
17695 		 * We need to drop the ref on eager that was put
17696 		 * tcp_rput_data() before trying to send the conn_ind
17697 		 * to listener. The conn_ind was deferred in tcp_send_conn_ind
17698 		 * and tcp_wput_accept() is sending this deferred conn_ind but
17699 		 * listener is closed so we drop the ref.
17700 		 */
17701 		CONN_DEC_REF(tcp->tcp_connp);
17702 		freemsg(mp);
17703 		return;
17704 	}
17705 	putnext(listener->tcp_rq, mp);
17706 }
17707 
17708 
17709 /*
17710  * This is the STREAMS entry point for T_CONN_RES coming down on
17711  * Acceptor STREAM when  sockfs listener does accept processing.
17712  * Read the block comment on top pf tcp_conn_request().
17713  */
17714 void
17715 tcp_wput_accept(queue_t *q, mblk_t *mp)
17716 {
17717 	queue_t *rq = RD(q);
17718 	struct T_conn_res *conn_res;
17719 	tcp_t *eager;
17720 	tcp_t *listener;
17721 	struct T_ok_ack *ok;
17722 	t_scalar_t PRIM_type;
17723 	mblk_t *opt_mp;
17724 	conn_t *econnp;
17725 
17726 	ASSERT(DB_TYPE(mp) == M_PROTO);
17727 
17728 	conn_res = (struct T_conn_res *)mp->b_rptr;
17729 	ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
17730 	if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_res)) {
17731 		mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0);
17732 		if (mp != NULL)
17733 			putnext(rq, mp);
17734 		return;
17735 	}
17736 	switch (conn_res->PRIM_type) {
17737 	case O_T_CONN_RES:
17738 	case T_CONN_RES:
17739 		/*
17740 		 * We pass up an err ack if allocb fails. This will
17741 		 * cause sockfs to issue a T_DISCON_REQ which will cause
17742 		 * tcp_eager_blowoff to be called. sockfs will then call
17743 		 * rq->q_qinfo->qi_qclose to cleanup the acceptor stream.
17744 		 * we need to do the allocb up here because we have to
17745 		 * make sure rq->q_qinfo->qi_qclose still points to the
17746 		 * correct function (tcpclose_accept) in case allocb
17747 		 * fails.
17748 		 */
17749 		opt_mp = allocb(sizeof (struct stroptions), BPRI_HI);
17750 		if (opt_mp == NULL) {
17751 			mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0);
17752 			if (mp != NULL)
17753 				putnext(rq, mp);
17754 			return;
17755 		}
17756 
17757 		bcopy(mp->b_rptr + conn_res->OPT_offset,
17758 		    &eager, conn_res->OPT_length);
17759 		PRIM_type = conn_res->PRIM_type;
17760 		mp->b_datap->db_type = M_PCPROTO;
17761 		mp->b_wptr = mp->b_rptr + sizeof (struct T_ok_ack);
17762 		ok = (struct T_ok_ack *)mp->b_rptr;
17763 		ok->PRIM_type = T_OK_ACK;
17764 		ok->CORRECT_prim = PRIM_type;
17765 		econnp = eager->tcp_connp;
17766 		econnp->conn_dev = (dev_t)q->q_ptr;
17767 		eager->tcp_rq = rq;
17768 		eager->tcp_wq = q;
17769 		rq->q_ptr = econnp;
17770 		rq->q_qinfo = &tcp_rinit;
17771 		q->q_ptr = econnp;
17772 		q->q_qinfo = &tcp_winit;
17773 		listener = eager->tcp_listener;
17774 		eager->tcp_issocket = B_TRUE;
17775 
17776 		econnp->conn_zoneid = listener->tcp_connp->conn_zoneid;
17777 		econnp->conn_allzones = listener->tcp_connp->conn_allzones;
17778 
17779 		/* Put the ref for IP */
17780 		CONN_INC_REF(econnp);
17781 
17782 		/*
17783 		 * We should have minimum of 3 references on the conn
17784 		 * at this point. One each for TCP and IP and one for
17785 		 * the T_conn_ind that was sent up when the 3-way handshake
17786 		 * completed. In the normal case we would also have another
17787 		 * reference (making a total of 4) for the conn being in the
17788 		 * classifier hash list. However the eager could have received
17789 		 * an RST subsequently and tcp_closei_local could have removed
17790 		 * the eager from the classifier hash list, hence we can't
17791 		 * assert that reference.
17792 		 */
17793 		ASSERT(econnp->conn_ref >= 3);
17794 
17795 		/*
17796 		 * Send the new local address also up to sockfs. There
17797 		 * should already be enough space in the mp that came
17798 		 * down from soaccept().
17799 		 */
17800 		if (eager->tcp_family == AF_INET) {
17801 			sin_t *sin;
17802 
17803 			ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >=
17804 			    (sizeof (struct T_ok_ack) + sizeof (sin_t)));
17805 			sin = (sin_t *)mp->b_wptr;
17806 			mp->b_wptr += sizeof (sin_t);
17807 			sin->sin_family = AF_INET;
17808 			sin->sin_port = eager->tcp_lport;
17809 			sin->sin_addr.s_addr = eager->tcp_ipha->ipha_src;
17810 		} else {
17811 			sin6_t *sin6;
17812 
17813 			ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >=
17814 			    sizeof (struct T_ok_ack) + sizeof (sin6_t));
17815 			sin6 = (sin6_t *)mp->b_wptr;
17816 			mp->b_wptr += sizeof (sin6_t);
17817 			sin6->sin6_family = AF_INET6;
17818 			sin6->sin6_port = eager->tcp_lport;
17819 			if (eager->tcp_ipversion == IPV4_VERSION) {
17820 				sin6->sin6_flowinfo = 0;
17821 				IN6_IPADDR_TO_V4MAPPED(
17822 					eager->tcp_ipha->ipha_src,
17823 					    &sin6->sin6_addr);
17824 			} else {
17825 				ASSERT(eager->tcp_ip6h != NULL);
17826 				sin6->sin6_flowinfo =
17827 				    eager->tcp_ip6h->ip6_vcf &
17828 				    ~IPV6_VERS_AND_FLOW_MASK;
17829 				sin6->sin6_addr = eager->tcp_ip6h->ip6_src;
17830 			}
17831 			sin6->sin6_scope_id = 0;
17832 			sin6->__sin6_src_id = 0;
17833 		}
17834 
17835 		putnext(rq, mp);
17836 
17837 		opt_mp->b_datap->db_type = M_SETOPTS;
17838 		opt_mp->b_wptr += sizeof (struct stroptions);
17839 
17840 		/*
17841 		 * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO
17842 		 * from listener to acceptor. The message is chained on the
17843 		 * bind_mp which tcp_rput_other will send down to IP.
17844 		 */
17845 		if (listener->tcp_bound_if != 0) {
17846 			/* allocate optmgmt req */
17847 			mp = tcp_setsockopt_mp(IPPROTO_IPV6,
17848 			    IPV6_BOUND_IF, (char *)&listener->tcp_bound_if,
17849 			    sizeof (int));
17850 			if (mp != NULL)
17851 				linkb(opt_mp, mp);
17852 		}
17853 		if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) {
17854 			uint_t on = 1;
17855 
17856 			/* allocate optmgmt req */
17857 			mp = tcp_setsockopt_mp(IPPROTO_IPV6,
17858 			    IPV6_RECVPKTINFO, (char *)&on, sizeof (on));
17859 			if (mp != NULL)
17860 				linkb(opt_mp, mp);
17861 		}
17862 
17863 
17864 		mutex_enter(&listener->tcp_eager_lock);
17865 
17866 		if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) {
17867 
17868 			tcp_t *tail;
17869 			tcp_t *tcp;
17870 			mblk_t *mp1;
17871 
17872 			tcp = listener->tcp_eager_prev_q0;
17873 			/*
17874 			 * listener->tcp_eager_prev_q0 points to the TAIL of the
17875 			 * deferred T_conn_ind queue. We need to get to the head
17876 			 * of the queue in order to send up T_conn_ind the same
17877 			 * order as how the 3WHS is completed.
17878 			 */
17879 			while (tcp != listener) {
17880 				if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0 &&
17881 				    !tcp->tcp_kssl_pending)
17882 					break;
17883 				else
17884 					tcp = tcp->tcp_eager_prev_q0;
17885 			}
17886 			/* None of the pending eagers can be sent up now */
17887 			if (tcp == listener)
17888 				goto no_more_eagers;
17889 
17890 			mp1 = tcp->tcp_conn.tcp_eager_conn_ind;
17891 			tcp->tcp_conn.tcp_eager_conn_ind = NULL;
17892 			/* Move from q0 to q */
17893 			ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
17894 			listener->tcp_conn_req_cnt_q0--;
17895 			listener->tcp_conn_req_cnt_q++;
17896 			tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
17897 			    tcp->tcp_eager_prev_q0;
17898 			tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
17899 			    tcp->tcp_eager_next_q0;
17900 			tcp->tcp_eager_prev_q0 = NULL;
17901 			tcp->tcp_eager_next_q0 = NULL;
17902 			tcp->tcp_conn_def_q0 = B_FALSE;
17903 
17904 			/*
17905 			 * Insert at end of the queue because sockfs sends
17906 			 * down T_CONN_RES in chronological order. Leaving
17907 			 * the older conn indications at front of the queue
17908 			 * helps reducing search time.
17909 			 */
17910 			tail = listener->tcp_eager_last_q;
17911 			if (tail != NULL) {
17912 				tail->tcp_eager_next_q = tcp;
17913 			} else {
17914 				listener->tcp_eager_next_q = tcp;
17915 			}
17916 			listener->tcp_eager_last_q = tcp;
17917 			tcp->tcp_eager_next_q = NULL;
17918 
17919 			/* Need to get inside the listener perimeter */
17920 			CONN_INC_REF(listener->tcp_connp);
17921 			squeue_fill(listener->tcp_connp->conn_sqp, mp1,
17922 			    tcp_send_pending, listener->tcp_connp,
17923 			    SQTAG_TCP_SEND_PENDING);
17924 		}
17925 no_more_eagers:
17926 		tcp_eager_unlink(eager);
17927 		mutex_exit(&listener->tcp_eager_lock);
17928 
17929 		/*
17930 		 * At this point, the eager is detached from the listener
17931 		 * but we still have an extra refs on eager (apart from the
17932 		 * usual tcp references). The ref was placed in tcp_rput_data
17933 		 * before sending the conn_ind in tcp_send_conn_ind.
17934 		 * The ref will be dropped in tcp_accept_finish().
17935 		 */
17936 		squeue_enter_nodrain(econnp->conn_sqp, opt_mp,
17937 		    tcp_accept_finish, econnp, SQTAG_TCP_ACCEPT_FINISH_Q0);
17938 		return;
17939 	default:
17940 		mp = mi_tpi_err_ack_alloc(mp, TNOTSUPPORT, 0);
17941 		if (mp != NULL)
17942 			putnext(rq, mp);
17943 		return;
17944 	}
17945 }
17946 
17947 void
17948 tcp_wput(queue_t *q, mblk_t *mp)
17949 {
17950 	conn_t	*connp = Q_TO_CONN(q);
17951 	tcp_t	*tcp;
17952 	void (*output_proc)();
17953 	t_scalar_t type;
17954 	uchar_t *rptr;
17955 	struct iocblk	*iocp;
17956 	uint32_t	msize;
17957 
17958 	ASSERT(connp->conn_ref >= 2);
17959 
17960 	switch (DB_TYPE(mp)) {
17961 	case M_DATA:
17962 		tcp = connp->conn_tcp;
17963 		ASSERT(tcp != NULL);
17964 
17965 		msize = msgdsize(mp);
17966 
17967 		mutex_enter(&connp->conn_lock);
17968 		CONN_INC_REF_LOCKED(connp);
17969 
17970 		tcp->tcp_squeue_bytes += msize;
17971 		if (TCP_UNSENT_BYTES(tcp) > tcp->tcp_xmit_hiwater) {
17972 			mutex_exit(&connp->conn_lock);
17973 			tcp_setqfull(tcp);
17974 		} else
17975 			mutex_exit(&connp->conn_lock);
17976 
17977 		(*tcp_squeue_wput_proc)(connp->conn_sqp, mp,
17978 		    tcp_output, connp, SQTAG_TCP_OUTPUT);
17979 		return;
17980 	case M_PROTO:
17981 	case M_PCPROTO:
17982 		/*
17983 		 * if it is a snmp message, don't get behind the squeue
17984 		 */
17985 		tcp = connp->conn_tcp;
17986 		rptr = mp->b_rptr;
17987 		if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) {
17988 			type = ((union T_primitives *)rptr)->type;
17989 		} else {
17990 			if (tcp->tcp_debug) {
17991 				(void) strlog(TCP_MOD_ID, 0, 1,
17992 				    SL_ERROR|SL_TRACE,
17993 				    "tcp_wput_proto, dropping one...");
17994 			}
17995 			freemsg(mp);
17996 			return;
17997 		}
17998 		if (type == T_SVR4_OPTMGMT_REQ) {
17999 			cred_t	*cr = DB_CREDDEF(mp, tcp->tcp_cred);
18000 			if (snmpcom_req(q, mp, tcp_snmp_set, tcp_snmp_get,
18001 			    cr)) {
18002 				/*
18003 				 * This was a SNMP request
18004 				 */
18005 				return;
18006 			} else {
18007 				output_proc = tcp_wput_proto;
18008 			}
18009 		} else {
18010 			output_proc = tcp_wput_proto;
18011 		}
18012 		break;
18013 	case M_IOCTL:
18014 		/*
18015 		 * Most ioctls can be processed right away without going via
18016 		 * squeues - process them right here. Those that do require
18017 		 * squeue (currently TCP_IOC_DEFAULT_Q and _SIOCSOCKFALLBACK)
18018 		 * are processed by tcp_wput_ioctl().
18019 		 */
18020 		iocp = (struct iocblk *)mp->b_rptr;
18021 		tcp = connp->conn_tcp;
18022 
18023 		switch (iocp->ioc_cmd) {
18024 		case TCP_IOC_ABORT_CONN:
18025 			tcp_ioctl_abort_conn(q, mp);
18026 			return;
18027 		case TI_GETPEERNAME:
18028 			if (tcp->tcp_state < TCPS_SYN_RCVD) {
18029 				iocp->ioc_error = ENOTCONN;
18030 				iocp->ioc_count = 0;
18031 				mp->b_datap->db_type = M_IOCACK;
18032 				qreply(q, mp);
18033 				return;
18034 			}
18035 			/* FALLTHRU */
18036 		case TI_GETMYNAME:
18037 			mi_copyin(q, mp, NULL,
18038 			    SIZEOF_STRUCT(strbuf, iocp->ioc_flag));
18039 			return;
18040 		case ND_SET:
18041 			/* nd_getset does the necessary checks */
18042 		case ND_GET:
18043 			if (!nd_getset(q, tcp_g_nd, mp)) {
18044 				CALL_IP_WPUT(connp, q, mp);
18045 				return;
18046 			}
18047 			qreply(q, mp);
18048 			return;
18049 		case TCP_IOC_DEFAULT_Q:
18050 			/*
18051 			 * Wants to be the default wq. Check the credentials
18052 			 * first, the rest is executed via squeue.
18053 			 */
18054 			if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) {
18055 				iocp->ioc_error = EPERM;
18056 				iocp->ioc_count = 0;
18057 				mp->b_datap->db_type = M_IOCACK;
18058 				qreply(q, mp);
18059 				return;
18060 			}
18061 			output_proc = tcp_wput_ioctl;
18062 			break;
18063 		default:
18064 			output_proc = tcp_wput_ioctl;
18065 			break;
18066 		}
18067 		break;
18068 	default:
18069 		output_proc = tcp_wput_nondata;
18070 		break;
18071 	}
18072 
18073 	CONN_INC_REF(connp);
18074 	(*tcp_squeue_wput_proc)(connp->conn_sqp, mp,
18075 	    output_proc, connp, SQTAG_TCP_WPUT_OTHER);
18076 }
18077 
18078 /*
18079  * Initial STREAMS write side put() procedure for sockets. It tries to
18080  * handle the T_CAPABILITY_REQ which sockfs sends down while setting
18081  * up the socket without using the squeue. Non T_CAPABILITY_REQ messages
18082  * are handled by tcp_wput() as usual.
18083  *
18084  * All further messages will also be handled by tcp_wput() because we cannot
18085  * be sure that the above short cut is safe later.
18086  */
18087 static void
18088 tcp_wput_sock(queue_t *wq, mblk_t *mp)
18089 {
18090 	conn_t			*connp = Q_TO_CONN(wq);
18091 	tcp_t			*tcp = connp->conn_tcp;
18092 	struct T_capability_req	*car = (struct T_capability_req *)mp->b_rptr;
18093 
18094 	ASSERT(wq->q_qinfo == &tcp_sock_winit);
18095 	wq->q_qinfo = &tcp_winit;
18096 
18097 	ASSERT(IPCL_IS_TCP(connp));
18098 	ASSERT(TCP_IS_SOCKET(tcp));
18099 
18100 	if (DB_TYPE(mp) == M_PCPROTO &&
18101 	    MBLKL(mp) == sizeof (struct T_capability_req) &&
18102 	    car->PRIM_type == T_CAPABILITY_REQ) {
18103 		tcp_capability_req(tcp, mp);
18104 		return;
18105 	}
18106 
18107 	tcp_wput(wq, mp);
18108 }
18109 
18110 static boolean_t
18111 tcp_zcopy_check(tcp_t *tcp)
18112 {
18113 	conn_t	*connp = tcp->tcp_connp;
18114 	ire_t	*ire;
18115 	boolean_t	zc_enabled = B_FALSE;
18116 
18117 	if (do_tcpzcopy == 2)
18118 		zc_enabled = B_TRUE;
18119 	else if (tcp->tcp_ipversion == IPV4_VERSION &&
18120 	    IPCL_IS_CONNECTED(connp) &&
18121 	    (connp->conn_flags & IPCL_CHECK_POLICY) == 0 &&
18122 	    connp->conn_dontroute == 0 &&
18123 	    !connp->conn_nexthop_set &&
18124 	    connp->conn_xmit_if_ill == NULL &&
18125 	    connp->conn_nofailover_ill == NULL &&
18126 	    do_tcpzcopy == 1) {
18127 		/*
18128 		 * the checks above  closely resemble the fast path checks
18129 		 * in tcp_send_data().
18130 		 */
18131 		mutex_enter(&connp->conn_lock);
18132 		ire = connp->conn_ire_cache;
18133 		ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT));
18134 		if (ire != NULL && !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
18135 			IRE_REFHOLD(ire);
18136 			if (ire->ire_stq != NULL) {
18137 				ill_t	*ill = (ill_t *)ire->ire_stq->q_ptr;
18138 
18139 				zc_enabled = ill && (ill->ill_capabilities &
18140 				    ILL_CAPAB_ZEROCOPY) &&
18141 				    (ill->ill_zerocopy_capab->
18142 				    ill_zerocopy_flags != 0);
18143 			}
18144 			IRE_REFRELE(ire);
18145 		}
18146 		mutex_exit(&connp->conn_lock);
18147 	}
18148 	tcp->tcp_snd_zcopy_on = zc_enabled;
18149 	if (!TCP_IS_DETACHED(tcp)) {
18150 		if (zc_enabled) {
18151 			(void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMSAFE);
18152 			TCP_STAT(tcp_zcopy_on);
18153 		} else {
18154 			(void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMUNSAFE);
18155 			TCP_STAT(tcp_zcopy_off);
18156 		}
18157 	}
18158 	return (zc_enabled);
18159 }
18160 
18161 static mblk_t *
18162 tcp_zcopy_disable(tcp_t *tcp, mblk_t *bp)
18163 {
18164 	if (do_tcpzcopy == 2)
18165 		return (bp);
18166 	else if (tcp->tcp_snd_zcopy_on) {
18167 		tcp->tcp_snd_zcopy_on = B_FALSE;
18168 		if (!TCP_IS_DETACHED(tcp)) {
18169 			(void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMUNSAFE);
18170 			TCP_STAT(tcp_zcopy_disable);
18171 		}
18172 	}
18173 	return (tcp_zcopy_backoff(tcp, bp, 0));
18174 }
18175 
18176 /*
18177  * Backoff from a zero-copy mblk by copying data to a new mblk and freeing
18178  * the original desballoca'ed segmapped mblk.
18179  */
18180 static mblk_t *
18181 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, int fix_xmitlist)
18182 {
18183 	mblk_t *head, *tail, *nbp;
18184 	if (IS_VMLOANED_MBLK(bp)) {
18185 		TCP_STAT(tcp_zcopy_backoff);
18186 		if ((head = copyb(bp)) == NULL) {
18187 			/* fail to backoff; leave it for the next backoff */
18188 			tcp->tcp_xmit_zc_clean = B_FALSE;
18189 			return (bp);
18190 		}
18191 		if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) {
18192 			if (fix_xmitlist)
18193 				tcp_zcopy_notify(tcp);
18194 			else
18195 				head->b_datap->db_struioflag |= STRUIO_ZCNOTIFY;
18196 		}
18197 		nbp = bp->b_cont;
18198 		if (fix_xmitlist) {
18199 			head->b_prev = bp->b_prev;
18200 			head->b_next = bp->b_next;
18201 			if (tcp->tcp_xmit_tail == bp)
18202 				tcp->tcp_xmit_tail = head;
18203 		}
18204 		bp->b_next = NULL;
18205 		bp->b_prev = NULL;
18206 		freeb(bp);
18207 	} else {
18208 		head = bp;
18209 		nbp = bp->b_cont;
18210 	}
18211 	tail = head;
18212 	while (nbp) {
18213 		if (IS_VMLOANED_MBLK(nbp)) {
18214 			TCP_STAT(tcp_zcopy_backoff);
18215 			if ((tail->b_cont = copyb(nbp)) == NULL) {
18216 				tcp->tcp_xmit_zc_clean = B_FALSE;
18217 				tail->b_cont = nbp;
18218 				return (head);
18219 			}
18220 			tail = tail->b_cont;
18221 			if (nbp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) {
18222 				if (fix_xmitlist)
18223 					tcp_zcopy_notify(tcp);
18224 				else
18225 					tail->b_datap->db_struioflag |=
18226 					    STRUIO_ZCNOTIFY;
18227 			}
18228 			bp = nbp;
18229 			nbp = nbp->b_cont;
18230 			if (fix_xmitlist) {
18231 				tail->b_prev = bp->b_prev;
18232 				tail->b_next = bp->b_next;
18233 				if (tcp->tcp_xmit_tail == bp)
18234 					tcp->tcp_xmit_tail = tail;
18235 			}
18236 			bp->b_next = NULL;
18237 			bp->b_prev = NULL;
18238 			freeb(bp);
18239 		} else {
18240 			tail->b_cont = nbp;
18241 			tail = nbp;
18242 			nbp = nbp->b_cont;
18243 		}
18244 	}
18245 	if (fix_xmitlist) {
18246 		tcp->tcp_xmit_last = tail;
18247 		tcp->tcp_xmit_zc_clean = B_TRUE;
18248 	}
18249 	return (head);
18250 }
18251 
18252 static void
18253 tcp_zcopy_notify(tcp_t *tcp)
18254 {
18255 	struct stdata	*stp;
18256 
18257 	if (tcp->tcp_detached)
18258 		return;
18259 	stp = STREAM(tcp->tcp_rq);
18260 	mutex_enter(&stp->sd_lock);
18261 	stp->sd_flag |= STZCNOTIFY;
18262 	cv_broadcast(&stp->sd_zcopy_wait);
18263 	mutex_exit(&stp->sd_lock);
18264 }
18265 
18266 static void
18267 tcp_send_data(tcp_t *tcp, queue_t *q, mblk_t *mp)
18268 {
18269 	ipha_t		*ipha;
18270 	ipaddr_t	src;
18271 	ipaddr_t	dst;
18272 	uint32_t	cksum;
18273 	ire_t		*ire;
18274 	uint16_t	*up;
18275 	ill_t		*ill;
18276 	conn_t		*connp = tcp->tcp_connp;
18277 	uint32_t	hcksum_txflags = 0;
18278 	mblk_t		*ire_fp_mp;
18279 	uint_t		ire_fp_mp_len;
18280 
18281 	ASSERT(DB_TYPE(mp) == M_DATA);
18282 
18283 	if (DB_CRED(mp) == NULL)
18284 		mblk_setcred(mp, CONN_CRED(connp));
18285 
18286 	ipha = (ipha_t *)mp->b_rptr;
18287 	src = ipha->ipha_src;
18288 	dst = ipha->ipha_dst;
18289 
18290 	/*
18291 	 * Drop off fast path for IPv6 and also if options are present or
18292 	 * we need to resolve a TS label.
18293 	 */
18294 	if (tcp->tcp_ipversion != IPV4_VERSION ||
18295 	    !IPCL_IS_CONNECTED(connp) ||
18296 	    (connp->conn_flags & IPCL_CHECK_POLICY) != 0 ||
18297 	    connp->conn_dontroute ||
18298 	    connp->conn_nexthop_set ||
18299 	    connp->conn_xmit_if_ill != NULL ||
18300 	    connp->conn_nofailover_ill != NULL ||
18301 	    !connp->conn_ulp_labeled ||
18302 	    ipha->ipha_ident == IP_HDR_INCLUDED ||
18303 	    ipha->ipha_version_and_hdr_length != IP_SIMPLE_HDR_VERSION ||
18304 	    IPP_ENABLED(IPP_LOCAL_OUT)) {
18305 		if (tcp->tcp_snd_zcopy_aware)
18306 			mp = tcp_zcopy_disable(tcp, mp);
18307 		TCP_STAT(tcp_ip_send);
18308 		CALL_IP_WPUT(connp, q, mp);
18309 		return;
18310 	}
18311 
18312 	mutex_enter(&connp->conn_lock);
18313 	ire = connp->conn_ire_cache;
18314 	ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT));
18315 	if (ire != NULL && ire->ire_addr == dst &&
18316 	    !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
18317 		IRE_REFHOLD(ire);
18318 		mutex_exit(&connp->conn_lock);
18319 	} else {
18320 		boolean_t cached = B_FALSE;
18321 
18322 		/* force a recheck later on */
18323 		tcp->tcp_ire_ill_check_done = B_FALSE;
18324 
18325 		TCP_DBGSTAT(tcp_ire_null1);
18326 		connp->conn_ire_cache = NULL;
18327 		mutex_exit(&connp->conn_lock);
18328 		if (ire != NULL)
18329 			IRE_REFRELE_NOTR(ire);
18330 		ire = ire_cache_lookup(dst, connp->conn_zoneid,
18331 		    MBLK_GETLABEL(mp));
18332 		if (ire == NULL) {
18333 			if (tcp->tcp_snd_zcopy_aware)
18334 				mp = tcp_zcopy_backoff(tcp, mp, 0);
18335 			TCP_STAT(tcp_ire_null);
18336 			CALL_IP_WPUT(connp, q, mp);
18337 			return;
18338 		}
18339 		IRE_REFHOLD_NOTR(ire);
18340 		/*
18341 		 * Since we are inside the squeue, there cannot be another
18342 		 * thread in TCP trying to set the conn_ire_cache now.  The
18343 		 * check for IRE_MARK_CONDEMNED ensures that an interface
18344 		 * unplumb thread has not yet started cleaning up the conns.
18345 		 * Hence we don't need to grab the conn lock.
18346 		 */
18347 		if (!(connp->conn_state_flags & CONN_CLOSING)) {
18348 			rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
18349 			if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) {
18350 				connp->conn_ire_cache = ire;
18351 				cached = B_TRUE;
18352 			}
18353 			rw_exit(&ire->ire_bucket->irb_lock);
18354 		}
18355 
18356 		/*
18357 		 * We can continue to use the ire but since it was
18358 		 * not cached, we should drop the extra reference.
18359 		 */
18360 		if (!cached)
18361 			IRE_REFRELE_NOTR(ire);
18362 
18363 		/*
18364 		 * Rampart note: no need to select a new label here, since
18365 		 * labels are not allowed to change during the life of a TCP
18366 		 * connection.
18367 		 */
18368 	}
18369 
18370 	/*
18371 	 * The following if case identifies whether or not
18372 	 * we are forced to take the slowpath.
18373 	 */
18374 	if (ire->ire_flags & RTF_MULTIRT ||
18375 	    ire->ire_stq == NULL ||
18376 	    ire->ire_max_frag < ntohs(ipha->ipha_length) ||
18377 	    (ire->ire_nce != NULL &&
18378 	    (ire_fp_mp = ire->ire_nce->nce_fp_mp) == NULL) ||
18379 	    (ire_fp_mp_len = MBLKL(ire_fp_mp)) > MBLKHEAD(mp)) {
18380 		if (tcp->tcp_snd_zcopy_aware)
18381 			mp = tcp_zcopy_disable(tcp, mp);
18382 		TCP_STAT(tcp_ip_ire_send);
18383 		IRE_REFRELE(ire);
18384 		CALL_IP_WPUT(connp, q, mp);
18385 		return;
18386 	}
18387 
18388 	ill = ire_to_ill(ire);
18389 	if (connp->conn_outgoing_ill != NULL) {
18390 		ill_t *conn_outgoing_ill = NULL;
18391 		/*
18392 		 * Choose a good ill in the group to send the packets on.
18393 		 */
18394 		ire = conn_set_outgoing_ill(connp, ire, &conn_outgoing_ill);
18395 		ill = ire_to_ill(ire);
18396 	}
18397 	ASSERT(ill != NULL);
18398 
18399 	if (!tcp->tcp_ire_ill_check_done) {
18400 		tcp_ire_ill_check(tcp, ire, ill, B_TRUE);
18401 		tcp->tcp_ire_ill_check_done = B_TRUE;
18402 	}
18403 
18404 	ASSERT(ipha->ipha_ident == 0 || ipha->ipha_ident == IP_HDR_INCLUDED);
18405 	ipha->ipha_ident = (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1);
18406 #ifndef _BIG_ENDIAN
18407 	ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8);
18408 #endif
18409 
18410 	/*
18411 	 * Check to see if we need to re-enable MDT for this connection
18412 	 * because it was previously disabled due to changes in the ill;
18413 	 * note that by doing it here, this re-enabling only applies when
18414 	 * the packet is not dispatched through CALL_IP_WPUT().
18415 	 *
18416 	 * That means for IPv4, it is worth re-enabling MDT for the fastpath
18417 	 * case, since that's how we ended up here.  For IPv6, we do the
18418 	 * re-enabling work in ip_xmit_v6(), albeit indirectly via squeue.
18419 	 */
18420 	if (connp->conn_mdt_ok && !tcp->tcp_mdt && ILL_MDT_USABLE(ill)) {
18421 		/*
18422 		 * Restore MDT for this connection, so that next time around
18423 		 * it is eligible to go through tcp_multisend() path again.
18424 		 */
18425 		TCP_STAT(tcp_mdt_conn_resumed1);
18426 		tcp->tcp_mdt = B_TRUE;
18427 		ip1dbg(("tcp_send_data: reenabling MDT for connp %p on "
18428 		    "interface %s\n", (void *)connp, ill->ill_name));
18429 	}
18430 
18431 	if (tcp->tcp_snd_zcopy_aware) {
18432 		if ((ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) == 0 ||
18433 		    (ill->ill_zerocopy_capab->ill_zerocopy_flags == 0))
18434 			mp = tcp_zcopy_disable(tcp, mp);
18435 		/*
18436 		 * we shouldn't need to reset ipha as the mp containing
18437 		 * ipha should never be a zero-copy mp.
18438 		 */
18439 	}
18440 
18441 	if (ILL_HCKSUM_CAPABLE(ill) && dohwcksum) {
18442 		ASSERT(ill->ill_hcksum_capab != NULL);
18443 		hcksum_txflags = ill->ill_hcksum_capab->ill_hcksum_txflags;
18444 	}
18445 
18446 	/* pseudo-header checksum (do it in parts for IP header checksum) */
18447 	cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF);
18448 
18449 	ASSERT(ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION);
18450 	up = IPH_TCPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH);
18451 
18452 	IP_CKSUM_XMIT_FAST(ire->ire_ipversion, hcksum_txflags, mp, ipha, up,
18453 	    IPPROTO_TCP, IP_SIMPLE_HDR_LENGTH, ntohs(ipha->ipha_length), cksum);
18454 
18455 	/* Software checksum? */
18456 	if (DB_CKSUMFLAGS(mp) == 0) {
18457 		TCP_STAT(tcp_out_sw_cksum);
18458 		TCP_STAT_UPDATE(tcp_out_sw_cksum_bytes,
18459 		    ntohs(ipha->ipha_length) - IP_SIMPLE_HDR_LENGTH);
18460 	}
18461 
18462 	ipha->ipha_fragment_offset_and_flags |=
18463 	    (uint32_t)htons(ire->ire_frag_flag);
18464 
18465 	/* Calculate IP header checksum if hardware isn't capable */
18466 	if (!(DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM)) {
18467 		IP_HDR_CKSUM(ipha, cksum, ((uint32_t *)ipha)[0],
18468 		    ((uint16_t *)ipha)[4]);
18469 	}
18470 
18471 	ASSERT(DB_TYPE(ire_fp_mp) == M_DATA);
18472 	mp->b_rptr = (uchar_t *)ipha - ire_fp_mp_len;
18473 	bcopy(ire_fp_mp->b_rptr, mp->b_rptr, ire_fp_mp_len);
18474 
18475 	UPDATE_OB_PKT_COUNT(ire);
18476 	ire->ire_last_used_time = lbolt;
18477 	BUMP_MIB(&ip_mib, ipOutRequests);
18478 
18479 	if (ILL_DLS_CAPABLE(ill)) {
18480 		/*
18481 		 * Send the packet directly to DLD, where it may be queued
18482 		 * depending on the availability of transmit resources at
18483 		 * the media layer.
18484 		 */
18485 		IP_DLS_ILL_TX(ill, mp);
18486 	} else {
18487 		putnext(ire->ire_stq, mp);
18488 	}
18489 	IRE_REFRELE(ire);
18490 }
18491 
18492 /*
18493  * This handles the case when the receiver has shrunk its win. Per RFC 1122
18494  * if the receiver shrinks the window, i.e. moves the right window to the
18495  * left, the we should not send new data, but should retransmit normally the
18496  * old unacked data between suna and suna + swnd. We might has sent data
18497  * that is now outside the new window, pretend that we didn't send  it.
18498  */
18499 static void
18500 tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_count)
18501 {
18502 	uint32_t	snxt = tcp->tcp_snxt;
18503 	mblk_t		*xmit_tail;
18504 	int32_t		offset;
18505 
18506 	ASSERT(shrunk_count > 0);
18507 
18508 	/* Pretend we didn't send the data outside the window */
18509 	snxt -= shrunk_count;
18510 
18511 	/* Get the mblk and the offset in it per the shrunk window */
18512 	xmit_tail = tcp_get_seg_mp(tcp, snxt, &offset);
18513 
18514 	ASSERT(xmit_tail != NULL);
18515 
18516 	/* Reset all the values per the now shrunk window */
18517 	tcp->tcp_snxt = snxt;
18518 	tcp->tcp_xmit_tail = xmit_tail;
18519 	tcp->tcp_xmit_tail_unsent = xmit_tail->b_wptr - xmit_tail->b_rptr -
18520 	    offset;
18521 	tcp->tcp_unsent += shrunk_count;
18522 
18523 	if (tcp->tcp_suna == tcp->tcp_snxt && tcp->tcp_swnd == 0)
18524 		/*
18525 		 * Make sure the timer is running so that we will probe a zero
18526 		 * window.
18527 		 */
18528 		TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
18529 }
18530 
18531 
18532 /*
18533  * The TCP normal data output path.
18534  * NOTE: the logic of the fast path is duplicated from this function.
18535  */
18536 static void
18537 tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent)
18538 {
18539 	int		len;
18540 	mblk_t		*local_time;
18541 	mblk_t		*mp1;
18542 	uint32_t	snxt;
18543 	int		tail_unsent;
18544 	int		tcpstate;
18545 	int		usable = 0;
18546 	mblk_t		*xmit_tail;
18547 	queue_t		*q = tcp->tcp_wq;
18548 	int32_t		mss;
18549 	int32_t		num_sack_blk = 0;
18550 	int32_t		tcp_hdr_len;
18551 	int32_t		tcp_tcp_hdr_len;
18552 	int		mdt_thres;
18553 	int		rc;
18554 
18555 	tcpstate = tcp->tcp_state;
18556 	if (mp == NULL) {
18557 		/*
18558 		 * tcp_wput_data() with NULL mp should only be called when
18559 		 * there is unsent data.
18560 		 */
18561 		ASSERT(tcp->tcp_unsent > 0);
18562 		/* Really tacky... but we need this for detached closes. */
18563 		len = tcp->tcp_unsent;
18564 		goto data_null;
18565 	}
18566 
18567 #if CCS_STATS
18568 	wrw_stats.tot.count++;
18569 	wrw_stats.tot.bytes += msgdsize(mp);
18570 #endif
18571 	ASSERT(mp->b_datap->db_type == M_DATA);
18572 	/*
18573 	 * Don't allow data after T_ORDREL_REQ or T_DISCON_REQ,
18574 	 * or before a connection attempt has begun.
18575 	 */
18576 	if (tcpstate < TCPS_SYN_SENT || tcpstate > TCPS_CLOSE_WAIT ||
18577 	    (tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) {
18578 		if ((tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) {
18579 #ifdef DEBUG
18580 			cmn_err(CE_WARN,
18581 			    "tcp_wput_data: data after ordrel, %s",
18582 			    tcp_display(tcp, NULL,
18583 			    DISP_ADDR_AND_PORT));
18584 #else
18585 			if (tcp->tcp_debug) {
18586 				(void) strlog(TCP_MOD_ID, 0, 1,
18587 				    SL_TRACE|SL_ERROR,
18588 				    "tcp_wput_data: data after ordrel, %s\n",
18589 				    tcp_display(tcp, NULL,
18590 				    DISP_ADDR_AND_PORT));
18591 			}
18592 #endif /* DEBUG */
18593 		}
18594 		if (tcp->tcp_snd_zcopy_aware &&
18595 		    (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) != 0)
18596 			tcp_zcopy_notify(tcp);
18597 		freemsg(mp);
18598 		if (tcp->tcp_flow_stopped &&
18599 		    TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) {
18600 			tcp_clrqfull(tcp);
18601 		}
18602 		return;
18603 	}
18604 
18605 	/* Strip empties */
18606 	for (;;) {
18607 		ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
18608 		    (uintptr_t)INT_MAX);
18609 		len = (int)(mp->b_wptr - mp->b_rptr);
18610 		if (len > 0)
18611 			break;
18612 		mp1 = mp;
18613 		mp = mp->b_cont;
18614 		freeb(mp1);
18615 		if (!mp) {
18616 			return;
18617 		}
18618 	}
18619 
18620 	/* If we are the first on the list ... */
18621 	if (tcp->tcp_xmit_head == NULL) {
18622 		tcp->tcp_xmit_head = mp;
18623 		tcp->tcp_xmit_tail = mp;
18624 		tcp->tcp_xmit_tail_unsent = len;
18625 	} else {
18626 		/* If tiny tx and room in txq tail, pullup to save mblks. */
18627 		struct datab *dp;
18628 
18629 		mp1 = tcp->tcp_xmit_last;
18630 		if (len < tcp_tx_pull_len &&
18631 		    (dp = mp1->b_datap)->db_ref == 1 &&
18632 		    dp->db_lim - mp1->b_wptr >= len) {
18633 			ASSERT(len > 0);
18634 			ASSERT(!mp1->b_cont);
18635 			if (len == 1) {
18636 				*mp1->b_wptr++ = *mp->b_rptr;
18637 			} else {
18638 				bcopy(mp->b_rptr, mp1->b_wptr, len);
18639 				mp1->b_wptr += len;
18640 			}
18641 			if (mp1 == tcp->tcp_xmit_tail)
18642 				tcp->tcp_xmit_tail_unsent += len;
18643 			mp1->b_cont = mp->b_cont;
18644 			if (tcp->tcp_snd_zcopy_aware &&
18645 			    (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
18646 				mp1->b_datap->db_struioflag |= STRUIO_ZCNOTIFY;
18647 			freeb(mp);
18648 			mp = mp1;
18649 		} else {
18650 			tcp->tcp_xmit_last->b_cont = mp;
18651 		}
18652 		len += tcp->tcp_unsent;
18653 	}
18654 
18655 	/* Tack on however many more positive length mblks we have */
18656 	if ((mp1 = mp->b_cont) != NULL) {
18657 		do {
18658 			int tlen;
18659 			ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
18660 			    (uintptr_t)INT_MAX);
18661 			tlen = (int)(mp1->b_wptr - mp1->b_rptr);
18662 			if (tlen <= 0) {
18663 				mp->b_cont = mp1->b_cont;
18664 				freeb(mp1);
18665 			} else {
18666 				len += tlen;
18667 				mp = mp1;
18668 			}
18669 		} while ((mp1 = mp->b_cont) != NULL);
18670 	}
18671 	tcp->tcp_xmit_last = mp;
18672 	tcp->tcp_unsent = len;
18673 
18674 	if (urgent)
18675 		usable = 1;
18676 
18677 data_null:
18678 	snxt = tcp->tcp_snxt;
18679 	xmit_tail = tcp->tcp_xmit_tail;
18680 	tail_unsent = tcp->tcp_xmit_tail_unsent;
18681 
18682 	/*
18683 	 * Note that tcp_mss has been adjusted to take into account the
18684 	 * timestamp option if applicable.  Because SACK options do not
18685 	 * appear in every TCP segments and they are of variable lengths,
18686 	 * they cannot be included in tcp_mss.  Thus we need to calculate
18687 	 * the actual segment length when we need to send a segment which
18688 	 * includes SACK options.
18689 	 */
18690 	if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
18691 		int32_t	opt_len;
18692 
18693 		num_sack_blk = MIN(tcp->tcp_max_sack_blk,
18694 		    tcp->tcp_num_sack_blk);
18695 		opt_len = num_sack_blk * sizeof (sack_blk_t) + TCPOPT_NOP_LEN *
18696 		    2 + TCPOPT_HEADER_LEN;
18697 		mss = tcp->tcp_mss - opt_len;
18698 		tcp_hdr_len = tcp->tcp_hdr_len + opt_len;
18699 		tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len + opt_len;
18700 	} else {
18701 		mss = tcp->tcp_mss;
18702 		tcp_hdr_len = tcp->tcp_hdr_len;
18703 		tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len;
18704 	}
18705 
18706 	if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet &&
18707 	    (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >= tcp->tcp_rto)) {
18708 		SET_TCP_INIT_CWND(tcp, mss, tcp_slow_start_after_idle);
18709 	}
18710 	if (tcpstate == TCPS_SYN_RCVD) {
18711 		/*
18712 		 * The three-way connection establishment handshake is not
18713 		 * complete yet. We want to queue the data for transmission
18714 		 * after entering ESTABLISHED state (RFC793). A jump to
18715 		 * "done" label effectively leaves data on the queue.
18716 		 */
18717 		goto done;
18718 	} else {
18719 		int usable_r;
18720 
18721 		/*
18722 		 * In the special case when cwnd is zero, which can only
18723 		 * happen if the connection is ECN capable, return now.
18724 		 * New segments is sent using tcp_timer().  The timer
18725 		 * is set in tcp_rput_data().
18726 		 */
18727 		if (tcp->tcp_cwnd == 0) {
18728 			/*
18729 			 * Note that tcp_cwnd is 0 before 3-way handshake is
18730 			 * finished.
18731 			 */
18732 			ASSERT(tcp->tcp_ecn_ok ||
18733 			    tcp->tcp_state < TCPS_ESTABLISHED);
18734 			return;
18735 		}
18736 
18737 		/* NOTE: trouble if xmitting while SYN not acked? */
18738 		usable_r = snxt - tcp->tcp_suna;
18739 		usable_r = tcp->tcp_swnd - usable_r;
18740 
18741 		/*
18742 		 * Check if the receiver has shrunk the window.  If
18743 		 * tcp_wput_data() with NULL mp is called, tcp_fin_sent
18744 		 * cannot be set as there is unsent data, so FIN cannot
18745 		 * be sent out.  Otherwise, we need to take into account
18746 		 * of FIN as it consumes an "invisible" sequence number.
18747 		 */
18748 		ASSERT(tcp->tcp_fin_sent == 0);
18749 		if (usable_r < 0) {
18750 			/*
18751 			 * The receiver has shrunk the window and we have sent
18752 			 * -usable_r date beyond the window, re-adjust.
18753 			 *
18754 			 * If TCP window scaling is enabled, there can be
18755 			 * round down error as the advertised receive window
18756 			 * is actually right shifted n bits.  This means that
18757 			 * the lower n bits info is wiped out.  It will look
18758 			 * like the window is shrunk.  Do a check here to
18759 			 * see if the shrunk amount is actually within the
18760 			 * error in window calculation.  If it is, just
18761 			 * return.  Note that this check is inside the
18762 			 * shrunk window check.  This makes sure that even
18763 			 * though tcp_process_shrunk_swnd() is not called,
18764 			 * we will stop further processing.
18765 			 */
18766 			if ((-usable_r >> tcp->tcp_snd_ws) > 0) {
18767 				tcp_process_shrunk_swnd(tcp, -usable_r);
18768 			}
18769 			return;
18770 		}
18771 
18772 		/* usable = MIN(swnd, cwnd) - unacked_bytes */
18773 		if (tcp->tcp_swnd > tcp->tcp_cwnd)
18774 			usable_r -= tcp->tcp_swnd - tcp->tcp_cwnd;
18775 
18776 		/* usable = MIN(usable, unsent) */
18777 		if (usable_r > len)
18778 			usable_r = len;
18779 
18780 		/* usable = MAX(usable, {1 for urgent, 0 for data}) */
18781 		if (usable_r > 0) {
18782 			usable = usable_r;
18783 		} else {
18784 			/* Bypass all other unnecessary processing. */
18785 			goto done;
18786 		}
18787 	}
18788 
18789 	local_time = (mblk_t *)lbolt;
18790 
18791 	/*
18792 	 * "Our" Nagle Algorithm.  This is not the same as in the old
18793 	 * BSD.  This is more in line with the true intent of Nagle.
18794 	 *
18795 	 * The conditions are:
18796 	 * 1. The amount of unsent data (or amount of data which can be
18797 	 *    sent, whichever is smaller) is less than Nagle limit.
18798 	 * 2. The last sent size is also less than Nagle limit.
18799 	 * 3. There is unack'ed data.
18800 	 * 4. Urgent pointer is not set.  Send urgent data ignoring the
18801 	 *    Nagle algorithm.  This reduces the probability that urgent
18802 	 *    bytes get "merged" together.
18803 	 * 5. The app has not closed the connection.  This eliminates the
18804 	 *    wait time of the receiving side waiting for the last piece of
18805 	 *    (small) data.
18806 	 *
18807 	 * If all are satisified, exit without sending anything.  Note
18808 	 * that Nagle limit can be smaller than 1 MSS.  Nagle limit is
18809 	 * the smaller of 1 MSS and global tcp_naglim_def (default to be
18810 	 * 4095).
18811 	 */
18812 	if (usable < (int)tcp->tcp_naglim &&
18813 	    tcp->tcp_naglim > tcp->tcp_last_sent_len &&
18814 	    snxt != tcp->tcp_suna &&
18815 	    !(tcp->tcp_valid_bits & TCP_URG_VALID) &&
18816 	    !(tcp->tcp_valid_bits & TCP_FSS_VALID)) {
18817 		goto done;
18818 	}
18819 
18820 	if (tcp->tcp_cork) {
18821 		/*
18822 		 * if the tcp->tcp_cork option is set, then we have to force
18823 		 * TCP not to send partial segment (smaller than MSS bytes).
18824 		 * We are calculating the usable now based on full mss and
18825 		 * will save the rest of remaining data for later.
18826 		 */
18827 		if (usable < mss)
18828 			goto done;
18829 		usable = (usable / mss) * mss;
18830 	}
18831 
18832 	/* Update the latest receive window size in TCP header. */
18833 	U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws,
18834 	    tcp->tcp_tcph->th_win);
18835 
18836 	/*
18837 	 * Determine if it's worthwhile to attempt MDT, based on:
18838 	 *
18839 	 * 1. Simple TCP/IP{v4,v6} (no options).
18840 	 * 2. IPSEC/IPQoS processing is not needed for the TCP connection.
18841 	 * 3. If the TCP connection is in ESTABLISHED state.
18842 	 * 4. The TCP is not detached.
18843 	 *
18844 	 * If any of the above conditions have changed during the
18845 	 * connection, stop using MDT and restore the stream head
18846 	 * parameters accordingly.
18847 	 */
18848 	if (tcp->tcp_mdt &&
18849 	    ((tcp->tcp_ipversion == IPV4_VERSION &&
18850 	    tcp->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH) ||
18851 	    (tcp->tcp_ipversion == IPV6_VERSION &&
18852 	    tcp->tcp_ip_hdr_len != IPV6_HDR_LEN) ||
18853 	    tcp->tcp_state != TCPS_ESTABLISHED ||
18854 	    TCP_IS_DETACHED(tcp) || !CONN_IS_MD_FASTPATH(tcp->tcp_connp) ||
18855 	    CONN_IPSEC_OUT_ENCAPSULATED(tcp->tcp_connp) ||
18856 	    IPP_ENABLED(IPP_LOCAL_OUT))) {
18857 		tcp->tcp_connp->conn_mdt_ok = B_FALSE;
18858 		tcp->tcp_mdt = B_FALSE;
18859 
18860 		/* Anything other than detached is considered pathological */
18861 		if (!TCP_IS_DETACHED(tcp)) {
18862 			TCP_STAT(tcp_mdt_conn_halted1);
18863 			(void) tcp_maxpsz_set(tcp, B_TRUE);
18864 		}
18865 	}
18866 
18867 	/* Use MDT if sendable amount is greater than the threshold */
18868 	if (tcp->tcp_mdt &&
18869 	    (mdt_thres = mss << tcp_mdt_smss_threshold, usable > mdt_thres) &&
18870 	    (tail_unsent > mdt_thres || (xmit_tail->b_cont != NULL &&
18871 	    MBLKL(xmit_tail->b_cont) > mdt_thres)) &&
18872 	    (tcp->tcp_valid_bits == 0 ||
18873 	    tcp->tcp_valid_bits == TCP_FSS_VALID)) {
18874 		ASSERT(tcp->tcp_connp->conn_mdt_ok);
18875 		rc = tcp_multisend(q, tcp, mss, tcp_hdr_len, tcp_tcp_hdr_len,
18876 		    num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail,
18877 		    local_time, mdt_thres);
18878 	} else {
18879 		rc = tcp_send(q, tcp, mss, tcp_hdr_len, tcp_tcp_hdr_len,
18880 		    num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail,
18881 		    local_time, INT_MAX);
18882 	}
18883 
18884 	/* Pretend that all we were trying to send really got sent */
18885 	if (rc < 0 && tail_unsent < 0) {
18886 		do {
18887 			xmit_tail = xmit_tail->b_cont;
18888 			xmit_tail->b_prev = local_time;
18889 			ASSERT((uintptr_t)(xmit_tail->b_wptr -
18890 			    xmit_tail->b_rptr) <= (uintptr_t)INT_MAX);
18891 			tail_unsent += (int)(xmit_tail->b_wptr -
18892 			    xmit_tail->b_rptr);
18893 		} while (tail_unsent < 0);
18894 	}
18895 done:;
18896 	tcp->tcp_xmit_tail = xmit_tail;
18897 	tcp->tcp_xmit_tail_unsent = tail_unsent;
18898 	len = tcp->tcp_snxt - snxt;
18899 	if (len) {
18900 		/*
18901 		 * If new data was sent, need to update the notsack
18902 		 * list, which is, afterall, data blocks that have
18903 		 * not been sack'ed by the receiver.  New data is
18904 		 * not sack'ed.
18905 		 */
18906 		if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
18907 			/* len is a negative value. */
18908 			tcp->tcp_pipe -= len;
18909 			tcp_notsack_update(&(tcp->tcp_notsack_list),
18910 			    tcp->tcp_snxt, snxt,
18911 			    &(tcp->tcp_num_notsack_blk),
18912 			    &(tcp->tcp_cnt_notsack_list));
18913 		}
18914 		tcp->tcp_snxt = snxt + tcp->tcp_fin_sent;
18915 		tcp->tcp_rack = tcp->tcp_rnxt;
18916 		tcp->tcp_rack_cnt = 0;
18917 		if ((snxt + len) == tcp->tcp_suna) {
18918 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
18919 		}
18920 	} else if (snxt == tcp->tcp_suna && tcp->tcp_swnd == 0) {
18921 		/*
18922 		 * Didn't send anything. Make sure the timer is running
18923 		 * so that we will probe a zero window.
18924 		 */
18925 		TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
18926 	}
18927 	/* Note that len is the amount we just sent but with a negative sign */
18928 	tcp->tcp_unsent += len;
18929 	if (tcp->tcp_flow_stopped) {
18930 		if (TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) {
18931 			tcp_clrqfull(tcp);
18932 		}
18933 	} else if (TCP_UNSENT_BYTES(tcp) >= tcp->tcp_xmit_hiwater) {
18934 		tcp_setqfull(tcp);
18935 	}
18936 }
18937 
18938 /*
18939  * tcp_fill_header is called by tcp_send() and tcp_multisend() to fill the
18940  * outgoing TCP header with the template header, as well as other
18941  * options such as time-stamp, ECN and/or SACK.
18942  */
18943 static void
18944 tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, int num_sack_blk)
18945 {
18946 	tcph_t *tcp_tmpl, *tcp_h;
18947 	uint32_t *dst, *src;
18948 	int hdrlen;
18949 
18950 	ASSERT(OK_32PTR(rptr));
18951 
18952 	/* Template header */
18953 	tcp_tmpl = tcp->tcp_tcph;
18954 
18955 	/* Header of outgoing packet */
18956 	tcp_h = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len);
18957 
18958 	/* dst and src are opaque 32-bit fields, used for copying */
18959 	dst = (uint32_t *)rptr;
18960 	src = (uint32_t *)tcp->tcp_iphc;
18961 	hdrlen = tcp->tcp_hdr_len;
18962 
18963 	/* Fill time-stamp option if needed */
18964 	if (tcp->tcp_snd_ts_ok) {
18965 		U32_TO_BE32((uint32_t)now,
18966 		    (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 4);
18967 		U32_TO_BE32(tcp->tcp_ts_recent,
18968 		    (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 8);
18969 	} else {
18970 		ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH);
18971 	}
18972 
18973 	/*
18974 	 * Copy the template header; is this really more efficient than
18975 	 * calling bcopy()?  For simple IPv4/TCP, it may be the case,
18976 	 * but perhaps not for other scenarios.
18977 	 */
18978 	dst[0] = src[0];
18979 	dst[1] = src[1];
18980 	dst[2] = src[2];
18981 	dst[3] = src[3];
18982 	dst[4] = src[4];
18983 	dst[5] = src[5];
18984 	dst[6] = src[6];
18985 	dst[7] = src[7];
18986 	dst[8] = src[8];
18987 	dst[9] = src[9];
18988 	if (hdrlen -= 40) {
18989 		hdrlen >>= 2;
18990 		dst += 10;
18991 		src += 10;
18992 		do {
18993 			*dst++ = *src++;
18994 		} while (--hdrlen);
18995 	}
18996 
18997 	/*
18998 	 * Set the ECN info in the TCP header if it is not a zero
18999 	 * window probe.  Zero window probe is only sent in
19000 	 * tcp_wput_data() and tcp_timer().
19001 	 */
19002 	if (tcp->tcp_ecn_ok && !tcp->tcp_zero_win_probe) {
19003 		SET_ECT(tcp, rptr);
19004 
19005 		if (tcp->tcp_ecn_echo_on)
19006 			tcp_h->th_flags[0] |= TH_ECE;
19007 		if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) {
19008 			tcp_h->th_flags[0] |= TH_CWR;
19009 			tcp->tcp_ecn_cwr_sent = B_TRUE;
19010 		}
19011 	}
19012 
19013 	/* Fill in SACK options */
19014 	if (num_sack_blk > 0) {
19015 		uchar_t *wptr = rptr + tcp->tcp_hdr_len;
19016 		sack_blk_t *tmp;
19017 		int32_t	i;
19018 
19019 		wptr[0] = TCPOPT_NOP;
19020 		wptr[1] = TCPOPT_NOP;
19021 		wptr[2] = TCPOPT_SACK;
19022 		wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
19023 		    sizeof (sack_blk_t);
19024 		wptr += TCPOPT_REAL_SACK_LEN;
19025 
19026 		tmp = tcp->tcp_sack_list;
19027 		for (i = 0; i < num_sack_blk; i++) {
19028 			U32_TO_BE32(tmp[i].begin, wptr);
19029 			wptr += sizeof (tcp_seq);
19030 			U32_TO_BE32(tmp[i].end, wptr);
19031 			wptr += sizeof (tcp_seq);
19032 		}
19033 		tcp_h->th_offset_and_rsrvd[0] +=
19034 		    ((num_sack_blk * 2 + 1) << 4);
19035 	}
19036 }
19037 
19038 /*
19039  * tcp_mdt_add_attrs() is called by tcp_multisend() in order to attach
19040  * the destination address and SAP attribute, and if necessary, the
19041  * hardware checksum offload attribute to a Multidata message.
19042  */
19043 static int
19044 tcp_mdt_add_attrs(multidata_t *mmd, const mblk_t *dlmp, const boolean_t hwcksum,
19045     const uint32_t start, const uint32_t stuff, const uint32_t end,
19046     const uint32_t flags)
19047 {
19048 	/* Add global destination address & SAP attribute */
19049 	if (dlmp == NULL || !ip_md_addr_attr(mmd, NULL, dlmp)) {
19050 		ip1dbg(("tcp_mdt_add_attrs: can't add global physical "
19051 		    "destination address+SAP\n"));
19052 
19053 		if (dlmp != NULL)
19054 			TCP_STAT(tcp_mdt_allocfail);
19055 		return (-1);
19056 	}
19057 
19058 	/* Add global hwcksum attribute */
19059 	if (hwcksum &&
19060 	    !ip_md_hcksum_attr(mmd, NULL, start, stuff, end, flags)) {
19061 		ip1dbg(("tcp_mdt_add_attrs: can't add global hardware "
19062 		    "checksum attribute\n"));
19063 
19064 		TCP_STAT(tcp_mdt_allocfail);
19065 		return (-1);
19066 	}
19067 
19068 	return (0);
19069 }
19070 
19071 /*
19072  * Smaller and private version of pdescinfo_t used specifically for TCP,
19073  * which allows for only two payload spans per packet.
19074  */
19075 typedef struct tcp_pdescinfo_s PDESCINFO_STRUCT(2) tcp_pdescinfo_t;
19076 
19077 /*
19078  * tcp_multisend() is called by tcp_wput_data() for Multidata Transmit
19079  * scheme, and returns one the following:
19080  *
19081  * -1 = failed allocation.
19082  *  0 = success; burst count reached, or usable send window is too small,
19083  *      and that we'd rather wait until later before sending again.
19084  */
19085 static int
19086 tcp_multisend(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len,
19087     const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable,
19088     uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time,
19089     const int mdt_thres)
19090 {
19091 	mblk_t		*md_mp_head, *md_mp, *md_pbuf, *md_pbuf_nxt, *md_hbuf;
19092 	multidata_t	*mmd;
19093 	uint_t		obsegs, obbytes, hdr_frag_sz;
19094 	uint_t		cur_hdr_off, cur_pld_off, base_pld_off, first_snxt;
19095 	int		num_burst_seg, max_pld;
19096 	pdesc_t		*pkt;
19097 	tcp_pdescinfo_t	tcp_pkt_info;
19098 	pdescinfo_t	*pkt_info;
19099 	int		pbuf_idx, pbuf_idx_nxt;
19100 	int		seg_len, len, spill, af;
19101 	boolean_t	add_buffer, zcopy, clusterwide;
19102 	boolean_t	rconfirm = B_FALSE;
19103 	boolean_t	done = B_FALSE;
19104 	uint32_t	cksum;
19105 	uint32_t	hwcksum_flags;
19106 	ire_t		*ire;
19107 	ill_t		*ill;
19108 	ipha_t		*ipha;
19109 	ip6_t		*ip6h;
19110 	ipaddr_t	src, dst;
19111 	ill_zerocopy_capab_t *zc_cap = NULL;
19112 	uint16_t	*up;
19113 	int		err;
19114 	conn_t		*connp;
19115 
19116 #ifdef	_BIG_ENDIAN
19117 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 28) & 0x7)
19118 #else
19119 #define	IPVER(ip6h)	((((uint32_t *)ip6h)[0] >> 4) & 0x7)
19120 #endif
19121 
19122 #define	PREP_NEW_MULTIDATA() {			\
19123 	mmd = NULL;				\
19124 	md_mp = md_hbuf = NULL;			\
19125 	cur_hdr_off = 0;			\
19126 	max_pld = tcp->tcp_mdt_max_pld;		\
19127 	pbuf_idx = pbuf_idx_nxt = -1;		\
19128 	add_buffer = B_TRUE;			\
19129 	zcopy = B_FALSE;			\
19130 }
19131 
19132 #define	PREP_NEW_PBUF() {			\
19133 	md_pbuf = md_pbuf_nxt = NULL;		\
19134 	pbuf_idx = pbuf_idx_nxt = -1;		\
19135 	cur_pld_off = 0;			\
19136 	first_snxt = *snxt;			\
19137 	ASSERT(*tail_unsent > 0);		\
19138 	base_pld_off = MBLKL(*xmit_tail) - *tail_unsent; \
19139 }
19140 
19141 	ASSERT(mdt_thres >= mss);
19142 	ASSERT(*usable > 0 && *usable > mdt_thres);
19143 	ASSERT(tcp->tcp_state == TCPS_ESTABLISHED);
19144 	ASSERT(!TCP_IS_DETACHED(tcp));
19145 	ASSERT(tcp->tcp_valid_bits == 0 ||
19146 	    tcp->tcp_valid_bits == TCP_FSS_VALID);
19147 	ASSERT((tcp->tcp_ipversion == IPV4_VERSION &&
19148 	    tcp->tcp_ip_hdr_len == IP_SIMPLE_HDR_LENGTH) ||
19149 	    (tcp->tcp_ipversion == IPV6_VERSION &&
19150 	    tcp->tcp_ip_hdr_len == IPV6_HDR_LEN));
19151 
19152 	connp = tcp->tcp_connp;
19153 	ASSERT(connp != NULL);
19154 	ASSERT(CONN_IS_MD_FASTPATH(connp));
19155 	ASSERT(!CONN_IPSEC_OUT_ENCAPSULATED(connp));
19156 
19157 	/*
19158 	 * Note that tcp will only declare at most 2 payload spans per
19159 	 * packet, which is much lower than the maximum allowable number
19160 	 * of packet spans per Multidata.  For this reason, we use the
19161 	 * privately declared and smaller descriptor info structure, in
19162 	 * order to save some stack space.
19163 	 */
19164 	pkt_info = (pdescinfo_t *)&tcp_pkt_info;
19165 
19166 	af = (tcp->tcp_ipversion == IPV4_VERSION) ? AF_INET : AF_INET6;
19167 	if (af == AF_INET) {
19168 		dst = tcp->tcp_ipha->ipha_dst;
19169 		src = tcp->tcp_ipha->ipha_src;
19170 		ASSERT(!CLASSD(dst));
19171 	}
19172 	ASSERT(af == AF_INET ||
19173 	    !IN6_IS_ADDR_MULTICAST(&tcp->tcp_ip6h->ip6_dst));
19174 
19175 	obsegs = obbytes = 0;
19176 	num_burst_seg = tcp->tcp_snd_burst;
19177 	md_mp_head = NULL;
19178 	PREP_NEW_MULTIDATA();
19179 
19180 	/*
19181 	 * Before we go on further, make sure there is an IRE that we can
19182 	 * use, and that the ILL supports MDT.  Otherwise, there's no point
19183 	 * in proceeding any further, and we should just hand everything
19184 	 * off to the legacy path.
19185 	 */
19186 	mutex_enter(&connp->conn_lock);
19187 	ire = connp->conn_ire_cache;
19188 	ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT));
19189 	if (ire != NULL && ((af == AF_INET && ire->ire_addr == dst) ||
19190 	    (af == AF_INET6 && IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6,
19191 	    &tcp->tcp_ip6h->ip6_dst))) &&
19192 	    !(ire->ire_marks & IRE_MARK_CONDEMNED)) {
19193 		IRE_REFHOLD(ire);
19194 		mutex_exit(&connp->conn_lock);
19195 	} else {
19196 		boolean_t cached = B_FALSE;
19197 		ts_label_t *tsl;
19198 
19199 		/* force a recheck later on */
19200 		tcp->tcp_ire_ill_check_done = B_FALSE;
19201 
19202 		TCP_DBGSTAT(tcp_ire_null1);
19203 		connp->conn_ire_cache = NULL;
19204 		mutex_exit(&connp->conn_lock);
19205 
19206 		/* Release the old ire */
19207 		if (ire != NULL)
19208 			IRE_REFRELE_NOTR(ire);
19209 
19210 		tsl = crgetlabel(CONN_CRED(connp));
19211 		ire = (af == AF_INET) ?
19212 		    ire_cache_lookup(dst, connp->conn_zoneid, tsl) :
19213 		    ire_cache_lookup_v6(&tcp->tcp_ip6h->ip6_dst,
19214 		    connp->conn_zoneid, tsl);
19215 
19216 		if (ire == NULL) {
19217 			TCP_STAT(tcp_ire_null);
19218 			goto legacy_send_no_md;
19219 		}
19220 
19221 		IRE_REFHOLD_NOTR(ire);
19222 		/*
19223 		 * Since we are inside the squeue, there cannot be another
19224 		 * thread in TCP trying to set the conn_ire_cache now. The
19225 		 * check for IRE_MARK_CONDEMNED ensures that an interface
19226 		 * unplumb thread has not yet started cleaning up the conns.
19227 		 * Hence we don't need to grab the conn lock.
19228 		 */
19229 		if (!(connp->conn_state_flags & CONN_CLOSING)) {
19230 			rw_enter(&ire->ire_bucket->irb_lock, RW_READER);
19231 			if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) {
19232 				connp->conn_ire_cache = ire;
19233 				cached = B_TRUE;
19234 			}
19235 			rw_exit(&ire->ire_bucket->irb_lock);
19236 		}
19237 
19238 		/*
19239 		 * We can continue to use the ire but since it was not
19240 		 * cached, we should drop the extra reference.
19241 		 */
19242 		if (!cached)
19243 			IRE_REFRELE_NOTR(ire);
19244 	}
19245 
19246 	ASSERT(ire != NULL);
19247 	ASSERT(af != AF_INET || ire->ire_ipversion == IPV4_VERSION);
19248 	ASSERT(af == AF_INET || !IN6_IS_ADDR_V4MAPPED(&(ire->ire_addr_v6)));
19249 	ASSERT(af == AF_INET || ire->ire_nce != NULL);
19250 	ASSERT(!(ire->ire_type & IRE_BROADCAST));
19251 	/*
19252 	 * If we do support loopback for MDT (which requires modifications
19253 	 * to the receiving paths), the following assertions should go away,
19254 	 * and we would be sending the Multidata to loopback conn later on.
19255 	 */
19256 	ASSERT(!IRE_IS_LOCAL(ire));
19257 	ASSERT(ire->ire_stq != NULL);
19258 
19259 	ill = ire_to_ill(ire);
19260 	ASSERT(ill != NULL);
19261 	ASSERT(!ILL_MDT_CAPABLE(ill) || ill->ill_mdt_capab != NULL);
19262 
19263 	if (!tcp->tcp_ire_ill_check_done) {
19264 		tcp_ire_ill_check(tcp, ire, ill, B_TRUE);
19265 		tcp->tcp_ire_ill_check_done = B_TRUE;
19266 	}
19267 
19268 	/*
19269 	 * If the underlying interface conditions have changed, or if the
19270 	 * new interface does not support MDT, go back to legacy path.
19271 	 */
19272 	if (!ILL_MDT_USABLE(ill) || (ire->ire_flags & RTF_MULTIRT) != 0) {
19273 		/* don't go through this path anymore for this connection */
19274 		TCP_STAT(tcp_mdt_conn_halted2);
19275 		tcp->tcp_mdt = B_FALSE;
19276 		ip1dbg(("tcp_multisend: disabling MDT for connp %p on "
19277 		    "interface %s\n", (void *)connp, ill->ill_name));
19278 		/* IRE will be released prior to returning */
19279 		goto legacy_send_no_md;
19280 	}
19281 
19282 	if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY)
19283 		zc_cap = ill->ill_zerocopy_capab;
19284 
19285 	/*
19286 	 * Check if we can take tcp fast-path. Note that "incomplete"
19287 	 * ire's (where the link-layer for next hop is not resolved
19288 	 * or where the fast-path header in nce_fp_mp is not available
19289 	 * yet) are sent down the legacy (slow) path.
19290 	 * NOTE: We should fix ip_xmit_v4 to handle M_MULTIDATA
19291 	 */
19292 	if (ire->ire_nce && ire->ire_nce->nce_state != ND_REACHABLE) {
19293 		/* IRE will be released prior to returning */
19294 		goto legacy_send_no_md;
19295 	}
19296 
19297 	/* go to legacy path if interface doesn't support zerocopy */
19298 	if (tcp->tcp_snd_zcopy_aware && do_tcpzcopy != 2 &&
19299 	    (zc_cap == NULL || zc_cap->ill_zerocopy_flags == 0)) {
19300 		/* IRE will be released prior to returning */
19301 		goto legacy_send_no_md;
19302 	}
19303 
19304 	/* does the interface support hardware checksum offload? */
19305 	hwcksum_flags = 0;
19306 	if (ILL_HCKSUM_CAPABLE(ill) &&
19307 	    (ill->ill_hcksum_capab->ill_hcksum_txflags &
19308 	    (HCKSUM_INET_FULL_V4 | HCKSUM_INET_FULL_V6 | HCKSUM_INET_PARTIAL |
19309 	    HCKSUM_IPHDRCKSUM)) && dohwcksum) {
19310 		if (ill->ill_hcksum_capab->ill_hcksum_txflags &
19311 		    HCKSUM_IPHDRCKSUM)
19312 			hwcksum_flags = HCK_IPV4_HDRCKSUM;
19313 
19314 		if (ill->ill_hcksum_capab->ill_hcksum_txflags &
19315 		    (HCKSUM_INET_FULL_V4 | HCKSUM_INET_FULL_V6))
19316 			hwcksum_flags |= HCK_FULLCKSUM;
19317 		else if (ill->ill_hcksum_capab->ill_hcksum_txflags &
19318 		    HCKSUM_INET_PARTIAL)
19319 			hwcksum_flags |= HCK_PARTIALCKSUM;
19320 	}
19321 
19322 	/*
19323 	 * Each header fragment consists of the leading extra space,
19324 	 * followed by the TCP/IP header, and the trailing extra space.
19325 	 * We make sure that each header fragment begins on a 32-bit
19326 	 * aligned memory address (tcp_mdt_hdr_head is already 32-bit
19327 	 * aligned in tcp_mdt_update).
19328 	 */
19329 	hdr_frag_sz = roundup((tcp->tcp_mdt_hdr_head + tcp_hdr_len +
19330 	    tcp->tcp_mdt_hdr_tail), 4);
19331 
19332 	/* are we starting from the beginning of data block? */
19333 	if (*tail_unsent == 0) {
19334 		*xmit_tail = (*xmit_tail)->b_cont;
19335 		ASSERT((uintptr_t)MBLKL(*xmit_tail) <= (uintptr_t)INT_MAX);
19336 		*tail_unsent = (int)MBLKL(*xmit_tail);
19337 	}
19338 
19339 	/*
19340 	 * Here we create one or more Multidata messages, each made up of
19341 	 * one header buffer and up to N payload buffers.  This entire
19342 	 * operation is done within two loops:
19343 	 *
19344 	 * The outer loop mostly deals with creating the Multidata message,
19345 	 * as well as the header buffer that gets added to it.  It also
19346 	 * links the Multidata messages together such that all of them can
19347 	 * be sent down to the lower layer in a single putnext call; this
19348 	 * linking behavior depends on the tcp_mdt_chain tunable.
19349 	 *
19350 	 * The inner loop takes an existing Multidata message, and adds
19351 	 * one or more (up to tcp_mdt_max_pld) payload buffers to it.  It
19352 	 * packetizes those buffers by filling up the corresponding header
19353 	 * buffer fragments with the proper IP and TCP headers, and by
19354 	 * describing the layout of each packet in the packet descriptors
19355 	 * that get added to the Multidata.
19356 	 */
19357 	do {
19358 		/*
19359 		 * If usable send window is too small, or data blocks in
19360 		 * transmit list are smaller than our threshold (i.e. app
19361 		 * performs large writes followed by small ones), we hand
19362 		 * off the control over to the legacy path.  Note that we'll
19363 		 * get back the control once it encounters a large block.
19364 		 */
19365 		if (*usable < mss || (*tail_unsent <= mdt_thres &&
19366 		    (*xmit_tail)->b_cont != NULL &&
19367 		    MBLKL((*xmit_tail)->b_cont) <= mdt_thres)) {
19368 			/* send down what we've got so far */
19369 			if (md_mp_head != NULL) {
19370 				tcp_multisend_data(tcp, ire, ill, md_mp_head,
19371 				    obsegs, obbytes, &rconfirm);
19372 			}
19373 			/*
19374 			 * Pass control over to tcp_send(), but tell it to
19375 			 * return to us once a large-size transmission is
19376 			 * possible.
19377 			 */
19378 			TCP_STAT(tcp_mdt_legacy_small);
19379 			if ((err = tcp_send(q, tcp, mss, tcp_hdr_len,
19380 			    tcp_tcp_hdr_len, num_sack_blk, usable, snxt,
19381 			    tail_unsent, xmit_tail, local_time,
19382 			    mdt_thres)) <= 0) {
19383 				/* burst count reached, or alloc failed */
19384 				IRE_REFRELE(ire);
19385 				return (err);
19386 			}
19387 
19388 			/* tcp_send() may have sent everything, so check */
19389 			if (*usable <= 0) {
19390 				IRE_REFRELE(ire);
19391 				return (0);
19392 			}
19393 
19394 			TCP_STAT(tcp_mdt_legacy_ret);
19395 			/*
19396 			 * We may have delivered the Multidata, so make sure
19397 			 * to re-initialize before the next round.
19398 			 */
19399 			md_mp_head = NULL;
19400 			obsegs = obbytes = 0;
19401 			num_burst_seg = tcp->tcp_snd_burst;
19402 			PREP_NEW_MULTIDATA();
19403 
19404 			/* are we starting from the beginning of data block? */
19405 			if (*tail_unsent == 0) {
19406 				*xmit_tail = (*xmit_tail)->b_cont;
19407 				ASSERT((uintptr_t)MBLKL(*xmit_tail) <=
19408 				    (uintptr_t)INT_MAX);
19409 				*tail_unsent = (int)MBLKL(*xmit_tail);
19410 			}
19411 		}
19412 
19413 		/*
19414 		 * max_pld limits the number of mblks in tcp's transmit
19415 		 * queue that can be added to a Multidata message.  Once
19416 		 * this counter reaches zero, no more additional mblks
19417 		 * can be added to it.  What happens afterwards depends
19418 		 * on whether or not we are set to chain the Multidata
19419 		 * messages.  If we are to link them together, reset
19420 		 * max_pld to its original value (tcp_mdt_max_pld) and
19421 		 * prepare to create a new Multidata message which will
19422 		 * get linked to md_mp_head.  Else, leave it alone and
19423 		 * let the inner loop break on its own.
19424 		 */
19425 		if (tcp_mdt_chain && max_pld == 0)
19426 			PREP_NEW_MULTIDATA();
19427 
19428 		/* adding a payload buffer; re-initialize values */
19429 		if (add_buffer)
19430 			PREP_NEW_PBUF();
19431 
19432 		/*
19433 		 * If we don't have a Multidata, either because we just
19434 		 * (re)entered this outer loop, or after we branched off
19435 		 * to tcp_send above, setup the Multidata and header
19436 		 * buffer to be used.
19437 		 */
19438 		if (md_mp == NULL) {
19439 			int md_hbuflen;
19440 			uint32_t start, stuff;
19441 
19442 			/*
19443 			 * Calculate Multidata header buffer size large enough
19444 			 * to hold all of the headers that can possibly be
19445 			 * sent at this moment.  We'd rather over-estimate
19446 			 * the size than running out of space; this is okay
19447 			 * since this buffer is small anyway.
19448 			 */
19449 			md_hbuflen = (howmany(*usable, mss) + 1) * hdr_frag_sz;
19450 
19451 			/*
19452 			 * Start and stuff offset for partial hardware
19453 			 * checksum offload; these are currently for IPv4.
19454 			 * For full checksum offload, they are set to zero.
19455 			 */
19456 			if ((hwcksum_flags & HCK_PARTIALCKSUM)) {
19457 				if (af == AF_INET) {
19458 					start = IP_SIMPLE_HDR_LENGTH;
19459 					stuff = IP_SIMPLE_HDR_LENGTH +
19460 					    TCP_CHECKSUM_OFFSET;
19461 				} else {
19462 					start = IPV6_HDR_LEN;
19463 					stuff = IPV6_HDR_LEN +
19464 					    TCP_CHECKSUM_OFFSET;
19465 				}
19466 			} else {
19467 				start = stuff = 0;
19468 			}
19469 
19470 			/*
19471 			 * Create the header buffer, Multidata, as well as
19472 			 * any necessary attributes (destination address,
19473 			 * SAP and hardware checksum offload) that should
19474 			 * be associated with the Multidata message.
19475 			 */
19476 			ASSERT(cur_hdr_off == 0);
19477 			if ((md_hbuf = allocb(md_hbuflen, BPRI_HI)) == NULL ||
19478 			    ((md_hbuf->b_wptr += md_hbuflen),
19479 			    (mmd = mmd_alloc(md_hbuf, &md_mp,
19480 			    KM_NOSLEEP)) == NULL) || (tcp_mdt_add_attrs(mmd,
19481 			    /* fastpath mblk */
19482 			    ire->ire_nce->nce_res_mp,
19483 			    /* hardware checksum enabled */
19484 			    (hwcksum_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)),
19485 			    /* hardware checksum offsets */
19486 			    start, stuff, 0,
19487 			    /* hardware checksum flag */
19488 			    hwcksum_flags) != 0)) {
19489 legacy_send:
19490 				if (md_mp != NULL) {
19491 					/* Unlink message from the chain */
19492 					if (md_mp_head != NULL) {
19493 						err = (intptr_t)rmvb(md_mp_head,
19494 						    md_mp);
19495 						/*
19496 						 * We can't assert that rmvb
19497 						 * did not return -1, since we
19498 						 * may get here before linkb
19499 						 * happens.  We do, however,
19500 						 * check if we just removed the
19501 						 * only element in the list.
19502 						 */
19503 						if (err == 0)
19504 							md_mp_head = NULL;
19505 					}
19506 					/* md_hbuf gets freed automatically */
19507 					TCP_STAT(tcp_mdt_discarded);
19508 					freeb(md_mp);
19509 				} else {
19510 					/* Either allocb or mmd_alloc failed */
19511 					TCP_STAT(tcp_mdt_allocfail);
19512 					if (md_hbuf != NULL)
19513 						freeb(md_hbuf);
19514 				}
19515 
19516 				/* send down what we've got so far */
19517 				if (md_mp_head != NULL) {
19518 					tcp_multisend_data(tcp, ire, ill,
19519 					    md_mp_head, obsegs, obbytes,
19520 					    &rconfirm);
19521 				}
19522 legacy_send_no_md:
19523 				if (ire != NULL)
19524 					IRE_REFRELE(ire);
19525 				/*
19526 				 * Too bad; let the legacy path handle this.
19527 				 * We specify INT_MAX for the threshold, since
19528 				 * we gave up with the Multidata processings
19529 				 * and let the old path have it all.
19530 				 */
19531 				TCP_STAT(tcp_mdt_legacy_all);
19532 				return (tcp_send(q, tcp, mss, tcp_hdr_len,
19533 				    tcp_tcp_hdr_len, num_sack_blk, usable,
19534 				    snxt, tail_unsent, xmit_tail, local_time,
19535 				    INT_MAX));
19536 			}
19537 
19538 			/* link to any existing ones, if applicable */
19539 			TCP_STAT(tcp_mdt_allocd);
19540 			if (md_mp_head == NULL) {
19541 				md_mp_head = md_mp;
19542 			} else if (tcp_mdt_chain) {
19543 				TCP_STAT(tcp_mdt_linked);
19544 				linkb(md_mp_head, md_mp);
19545 			}
19546 		}
19547 
19548 		ASSERT(md_mp_head != NULL);
19549 		ASSERT(tcp_mdt_chain || md_mp_head->b_cont == NULL);
19550 		ASSERT(md_mp != NULL && mmd != NULL);
19551 		ASSERT(md_hbuf != NULL);
19552 
19553 		/*
19554 		 * Packetize the transmittable portion of the data block;
19555 		 * each data block is essentially added to the Multidata
19556 		 * as a payload buffer.  We also deal with adding more
19557 		 * than one payload buffers, which happens when the remaining
19558 		 * packetized portion of the current payload buffer is less
19559 		 * than MSS, while the next data block in transmit queue
19560 		 * has enough data to make up for one.  This "spillover"
19561 		 * case essentially creates a split-packet, where portions
19562 		 * of the packet's payload fragments may span across two
19563 		 * virtually discontiguous address blocks.
19564 		 */
19565 		seg_len = mss;
19566 		do {
19567 			len = seg_len;
19568 
19569 			ASSERT(len > 0);
19570 			ASSERT(max_pld >= 0);
19571 			ASSERT(!add_buffer || cur_pld_off == 0);
19572 
19573 			/*
19574 			 * First time around for this payload buffer; note
19575 			 * in the case of a spillover, the following has
19576 			 * been done prior to adding the split-packet
19577 			 * descriptor to Multidata, and we don't want to
19578 			 * repeat the process.
19579 			 */
19580 			if (add_buffer) {
19581 				ASSERT(mmd != NULL);
19582 				ASSERT(md_pbuf == NULL);
19583 				ASSERT(md_pbuf_nxt == NULL);
19584 				ASSERT(pbuf_idx == -1 && pbuf_idx_nxt == -1);
19585 
19586 				/*
19587 				 * Have we reached the limit?  We'd get to
19588 				 * this case when we're not chaining the
19589 				 * Multidata messages together, and since
19590 				 * we're done, terminate this loop.
19591 				 */
19592 				if (max_pld == 0)
19593 					break; /* done */
19594 
19595 				if ((md_pbuf = dupb(*xmit_tail)) == NULL) {
19596 					TCP_STAT(tcp_mdt_allocfail);
19597 					goto legacy_send; /* out_of_mem */
19598 				}
19599 
19600 				if (IS_VMLOANED_MBLK(md_pbuf) && !zcopy &&
19601 				    zc_cap != NULL) {
19602 					if (!ip_md_zcopy_attr(mmd, NULL,
19603 					    zc_cap->ill_zerocopy_flags)) {
19604 						freeb(md_pbuf);
19605 						TCP_STAT(tcp_mdt_allocfail);
19606 						/* out_of_mem */
19607 						goto legacy_send;
19608 					}
19609 					zcopy = B_TRUE;
19610 				}
19611 
19612 				md_pbuf->b_rptr += base_pld_off;
19613 
19614 				/*
19615 				 * Add a payload buffer to the Multidata; this
19616 				 * operation must not fail, or otherwise our
19617 				 * logic in this routine is broken.  There
19618 				 * is no memory allocation done by the
19619 				 * routine, so any returned failure simply
19620 				 * tells us that we've done something wrong.
19621 				 *
19622 				 * A failure tells us that either we're adding
19623 				 * the same payload buffer more than once, or
19624 				 * we're trying to add more buffers than
19625 				 * allowed (max_pld calculation is wrong).
19626 				 * None of the above cases should happen, and
19627 				 * we panic because either there's horrible
19628 				 * heap corruption, and/or programming mistake.
19629 				 */
19630 				pbuf_idx = mmd_addpldbuf(mmd, md_pbuf);
19631 				if (pbuf_idx < 0) {
19632 					cmn_err(CE_PANIC, "tcp_multisend: "
19633 					    "payload buffer logic error "
19634 					    "detected for tcp %p mmd %p "
19635 					    "pbuf %p (%d)\n",
19636 					    (void *)tcp, (void *)mmd,
19637 					    (void *)md_pbuf, pbuf_idx);
19638 				}
19639 
19640 				ASSERT(max_pld > 0);
19641 				--max_pld;
19642 				add_buffer = B_FALSE;
19643 			}
19644 
19645 			ASSERT(md_mp_head != NULL);
19646 			ASSERT(md_pbuf != NULL);
19647 			ASSERT(md_pbuf_nxt == NULL);
19648 			ASSERT(pbuf_idx != -1);
19649 			ASSERT(pbuf_idx_nxt == -1);
19650 			ASSERT(*usable > 0);
19651 
19652 			/*
19653 			 * We spillover to the next payload buffer only
19654 			 * if all of the following is true:
19655 			 *
19656 			 *   1. There is not enough data on the current
19657 			 *	payload buffer to make up `len',
19658 			 *   2. We are allowed to send `len',
19659 			 *   3. The next payload buffer length is large
19660 			 *	enough to accomodate `spill'.
19661 			 */
19662 			if ((spill = len - *tail_unsent) > 0 &&
19663 			    *usable >= len &&
19664 			    MBLKL((*xmit_tail)->b_cont) >= spill &&
19665 			    max_pld > 0) {
19666 				md_pbuf_nxt = dupb((*xmit_tail)->b_cont);
19667 				if (md_pbuf_nxt == NULL) {
19668 					TCP_STAT(tcp_mdt_allocfail);
19669 					goto legacy_send; /* out_of_mem */
19670 				}
19671 
19672 				if (IS_VMLOANED_MBLK(md_pbuf_nxt) && !zcopy &&
19673 				    zc_cap != NULL) {
19674 					if (!ip_md_zcopy_attr(mmd, NULL,
19675 					    zc_cap->ill_zerocopy_flags)) {
19676 						freeb(md_pbuf_nxt);
19677 						TCP_STAT(tcp_mdt_allocfail);
19678 						/* out_of_mem */
19679 						goto legacy_send;
19680 					}
19681 					zcopy = B_TRUE;
19682 				}
19683 
19684 				/*
19685 				 * See comments above on the first call to
19686 				 * mmd_addpldbuf for explanation on the panic.
19687 				 */
19688 				pbuf_idx_nxt = mmd_addpldbuf(mmd, md_pbuf_nxt);
19689 				if (pbuf_idx_nxt < 0) {
19690 					panic("tcp_multisend: "
19691 					    "next payload buffer logic error "
19692 					    "detected for tcp %p mmd %p "
19693 					    "pbuf %p (%d)\n",
19694 					    (void *)tcp, (void *)mmd,
19695 					    (void *)md_pbuf_nxt, pbuf_idx_nxt);
19696 				}
19697 
19698 				ASSERT(max_pld > 0);
19699 				--max_pld;
19700 			} else if (spill > 0) {
19701 				/*
19702 				 * If there's a spillover, but the following
19703 				 * xmit_tail couldn't give us enough octets
19704 				 * to reach "len", then stop the current
19705 				 * Multidata creation and let the legacy
19706 				 * tcp_send() path take over.  We don't want
19707 				 * to send the tiny segment as part of this
19708 				 * Multidata for performance reasons; instead,
19709 				 * we let the legacy path deal with grouping
19710 				 * it with the subsequent small mblks.
19711 				 */
19712 				if (*usable >= len &&
19713 				    MBLKL((*xmit_tail)->b_cont) < spill) {
19714 					max_pld = 0;
19715 					break;	/* done */
19716 				}
19717 
19718 				/*
19719 				 * We can't spillover, and we are near
19720 				 * the end of the current payload buffer,
19721 				 * so send what's left.
19722 				 */
19723 				ASSERT(*tail_unsent > 0);
19724 				len = *tail_unsent;
19725 			}
19726 
19727 			/* tail_unsent is negated if there is a spillover */
19728 			*tail_unsent -= len;
19729 			*usable -= len;
19730 			ASSERT(*usable >= 0);
19731 
19732 			if (*usable < mss)
19733 				seg_len = *usable;
19734 			/*
19735 			 * Sender SWS avoidance; see comments in tcp_send();
19736 			 * everything else is the same, except that we only
19737 			 * do this here if there is no more data to be sent
19738 			 * following the current xmit_tail.  We don't check
19739 			 * for 1-byte urgent data because we shouldn't get
19740 			 * here if TCP_URG_VALID is set.
19741 			 */
19742 			if (*usable > 0 && *usable < mss &&
19743 			    ((md_pbuf_nxt == NULL &&
19744 			    (*xmit_tail)->b_cont == NULL) ||
19745 			    (md_pbuf_nxt != NULL &&
19746 			    (*xmit_tail)->b_cont->b_cont == NULL)) &&
19747 			    seg_len < (tcp->tcp_max_swnd >> 1) &&
19748 			    (tcp->tcp_unsent -
19749 			    ((*snxt + len) - tcp->tcp_snxt)) > seg_len &&
19750 			    !tcp->tcp_zero_win_probe) {
19751 				if ((*snxt + len) == tcp->tcp_snxt &&
19752 				    (*snxt + len) == tcp->tcp_suna) {
19753 					TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
19754 				}
19755 				done = B_TRUE;
19756 			}
19757 
19758 			/*
19759 			 * Prime pump for IP's checksumming on our behalf;
19760 			 * include the adjustment for a source route if any.
19761 			 * Do this only for software/partial hardware checksum
19762 			 * offload, as this field gets zeroed out later for
19763 			 * the full hardware checksum offload case.
19764 			 */
19765 			if (!(hwcksum_flags & HCK_FULLCKSUM)) {
19766 				cksum = len + tcp_tcp_hdr_len + tcp->tcp_sum;
19767 				cksum = (cksum >> 16) + (cksum & 0xFFFF);
19768 				U16_TO_ABE16(cksum, tcp->tcp_tcph->th_sum);
19769 			}
19770 
19771 			U32_TO_ABE32(*snxt, tcp->tcp_tcph->th_seq);
19772 			*snxt += len;
19773 
19774 			tcp->tcp_tcph->th_flags[0] = TH_ACK;
19775 			/*
19776 			 * We set the PUSH bit only if TCP has no more buffered
19777 			 * data to be transmitted (or if sender SWS avoidance
19778 			 * takes place), as opposed to setting it for every
19779 			 * last packet in the burst.
19780 			 */
19781 			if (done ||
19782 			    (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) == 0)
19783 				tcp->tcp_tcph->th_flags[0] |= TH_PUSH;
19784 
19785 			/*
19786 			 * Set FIN bit if this is our last segment; snxt
19787 			 * already includes its length, and it will not
19788 			 * be adjusted after this point.
19789 			 */
19790 			if (tcp->tcp_valid_bits == TCP_FSS_VALID &&
19791 			    *snxt == tcp->tcp_fss) {
19792 				if (!tcp->tcp_fin_acked) {
19793 					tcp->tcp_tcph->th_flags[0] |= TH_FIN;
19794 					BUMP_MIB(&tcp_mib, tcpOutControl);
19795 				}
19796 				if (!tcp->tcp_fin_sent) {
19797 					tcp->tcp_fin_sent = B_TRUE;
19798 					/*
19799 					 * tcp state must be ESTABLISHED
19800 					 * in order for us to get here in
19801 					 * the first place.
19802 					 */
19803 					tcp->tcp_state = TCPS_FIN_WAIT_1;
19804 
19805 					/*
19806 					 * Upon returning from this routine,
19807 					 * tcp_wput_data() will set tcp_snxt
19808 					 * to be equal to snxt + tcp_fin_sent.
19809 					 * This is essentially the same as
19810 					 * setting it to tcp_fss + 1.
19811 					 */
19812 				}
19813 			}
19814 
19815 			tcp->tcp_last_sent_len = (ushort_t)len;
19816 
19817 			len += tcp_hdr_len;
19818 			if (tcp->tcp_ipversion == IPV4_VERSION)
19819 				tcp->tcp_ipha->ipha_length = htons(len);
19820 			else
19821 				tcp->tcp_ip6h->ip6_plen = htons(len -
19822 				    ((char *)&tcp->tcp_ip6h[1] -
19823 				    tcp->tcp_iphc));
19824 
19825 			pkt_info->flags = (PDESC_HBUF_REF | PDESC_PBUF_REF);
19826 
19827 			/* setup header fragment */
19828 			PDESC_HDR_ADD(pkt_info,
19829 			    md_hbuf->b_rptr + cur_hdr_off,	/* base */
19830 			    tcp->tcp_mdt_hdr_head,		/* head room */
19831 			    tcp_hdr_len,			/* len */
19832 			    tcp->tcp_mdt_hdr_tail);		/* tail room */
19833 
19834 			ASSERT(pkt_info->hdr_lim - pkt_info->hdr_base ==
19835 			    hdr_frag_sz);
19836 			ASSERT(MBLKIN(md_hbuf,
19837 			    (pkt_info->hdr_base - md_hbuf->b_rptr),
19838 			    PDESC_HDRSIZE(pkt_info)));
19839 
19840 			/* setup first payload fragment */
19841 			PDESC_PLD_INIT(pkt_info);
19842 			PDESC_PLD_SPAN_ADD(pkt_info,
19843 			    pbuf_idx,				/* index */
19844 			    md_pbuf->b_rptr + cur_pld_off,	/* start */
19845 			    tcp->tcp_last_sent_len);		/* len */
19846 
19847 			/* create a split-packet in case of a spillover */
19848 			if (md_pbuf_nxt != NULL) {
19849 				ASSERT(spill > 0);
19850 				ASSERT(pbuf_idx_nxt > pbuf_idx);
19851 				ASSERT(!add_buffer);
19852 
19853 				md_pbuf = md_pbuf_nxt;
19854 				md_pbuf_nxt = NULL;
19855 				pbuf_idx = pbuf_idx_nxt;
19856 				pbuf_idx_nxt = -1;
19857 				cur_pld_off = spill;
19858 
19859 				/* trim out first payload fragment */
19860 				PDESC_PLD_SPAN_TRIM(pkt_info, 0, spill);
19861 
19862 				/* setup second payload fragment */
19863 				PDESC_PLD_SPAN_ADD(pkt_info,
19864 				    pbuf_idx,			/* index */
19865 				    md_pbuf->b_rptr,		/* start */
19866 				    spill);			/* len */
19867 
19868 				if ((*xmit_tail)->b_next == NULL) {
19869 					/*
19870 					 * Store the lbolt used for RTT
19871 					 * estimation. We can only record one
19872 					 * timestamp per mblk so we do it when
19873 					 * we reach the end of the payload
19874 					 * buffer.  Also we only take a new
19875 					 * timestamp sample when the previous
19876 					 * timed data from the same mblk has
19877 					 * been ack'ed.
19878 					 */
19879 					(*xmit_tail)->b_prev = local_time;
19880 					(*xmit_tail)->b_next =
19881 					    (mblk_t *)(uintptr_t)first_snxt;
19882 				}
19883 
19884 				first_snxt = *snxt - spill;
19885 
19886 				/*
19887 				 * Advance xmit_tail; usable could be 0 by
19888 				 * the time we got here, but we made sure
19889 				 * above that we would only spillover to
19890 				 * the next data block if usable includes
19891 				 * the spilled-over amount prior to the
19892 				 * subtraction.  Therefore, we are sure
19893 				 * that xmit_tail->b_cont can't be NULL.
19894 				 */
19895 				ASSERT((*xmit_tail)->b_cont != NULL);
19896 				*xmit_tail = (*xmit_tail)->b_cont;
19897 				ASSERT((uintptr_t)MBLKL(*xmit_tail) <=
19898 				    (uintptr_t)INT_MAX);
19899 				*tail_unsent = (int)MBLKL(*xmit_tail) - spill;
19900 			} else {
19901 				cur_pld_off += tcp->tcp_last_sent_len;
19902 			}
19903 
19904 			/*
19905 			 * Fill in the header using the template header, and
19906 			 * add options such as time-stamp, ECN and/or SACK,
19907 			 * as needed.
19908 			 */
19909 			tcp_fill_header(tcp, pkt_info->hdr_rptr,
19910 			    (clock_t)local_time, num_sack_blk);
19911 
19912 			/* take care of some IP header businesses */
19913 			if (af == AF_INET) {
19914 				ipha = (ipha_t *)pkt_info->hdr_rptr;
19915 
19916 				ASSERT(OK_32PTR((uchar_t *)ipha));
19917 				ASSERT(PDESC_HDRL(pkt_info) >=
19918 				    IP_SIMPLE_HDR_LENGTH);
19919 				ASSERT(ipha->ipha_version_and_hdr_length ==
19920 				    IP_SIMPLE_HDR_VERSION);
19921 
19922 				/*
19923 				 * Assign ident value for current packet; see
19924 				 * related comments in ip_wput_ire() about the
19925 				 * contract private interface with clustering
19926 				 * group.
19927 				 */
19928 				clusterwide = B_FALSE;
19929 				if (cl_inet_ipident != NULL) {
19930 					ASSERT(cl_inet_isclusterwide != NULL);
19931 					if ((*cl_inet_isclusterwide)(IPPROTO_IP,
19932 					    AF_INET,
19933 					    (uint8_t *)(uintptr_t)src)) {
19934 						ipha->ipha_ident =
19935 						    (*cl_inet_ipident)
19936 						    (IPPROTO_IP, AF_INET,
19937 						    (uint8_t *)(uintptr_t)src,
19938 						    (uint8_t *)(uintptr_t)dst);
19939 						clusterwide = B_TRUE;
19940 					}
19941 				}
19942 
19943 				if (!clusterwide) {
19944 					ipha->ipha_ident = (uint16_t)
19945 					    atomic_add_32_nv(
19946 						&ire->ire_ident, 1);
19947 				}
19948 #ifndef _BIG_ENDIAN
19949 				ipha->ipha_ident = (ipha->ipha_ident << 8) |
19950 				    (ipha->ipha_ident >> 8);
19951 #endif
19952 			} else {
19953 				ip6h = (ip6_t *)pkt_info->hdr_rptr;
19954 
19955 				ASSERT(OK_32PTR((uchar_t *)ip6h));
19956 				ASSERT(IPVER(ip6h) == IPV6_VERSION);
19957 				ASSERT(ip6h->ip6_nxt == IPPROTO_TCP);
19958 				ASSERT(PDESC_HDRL(pkt_info) >=
19959 				    (IPV6_HDR_LEN + TCP_CHECKSUM_OFFSET +
19960 				    TCP_CHECKSUM_SIZE));
19961 				ASSERT(tcp->tcp_ipversion == IPV6_VERSION);
19962 
19963 				if (tcp->tcp_ip_forward_progress) {
19964 					rconfirm = B_TRUE;
19965 					tcp->tcp_ip_forward_progress = B_FALSE;
19966 				}
19967 			}
19968 
19969 			/* at least one payload span, and at most two */
19970 			ASSERT(pkt_info->pld_cnt > 0 && pkt_info->pld_cnt < 3);
19971 
19972 			/* add the packet descriptor to Multidata */
19973 			if ((pkt = mmd_addpdesc(mmd, pkt_info, &err,
19974 			    KM_NOSLEEP)) == NULL) {
19975 				/*
19976 				 * Any failure other than ENOMEM indicates
19977 				 * that we have passed in invalid pkt_info
19978 				 * or parameters to mmd_addpdesc, which must
19979 				 * not happen.
19980 				 *
19981 				 * EINVAL is a result of failure on boundary
19982 				 * checks against the pkt_info contents.  It
19983 				 * should not happen, and we panic because
19984 				 * either there's horrible heap corruption,
19985 				 * and/or programming mistake.
19986 				 */
19987 				if (err != ENOMEM) {
19988 					cmn_err(CE_PANIC, "tcp_multisend: "
19989 					    "pdesc logic error detected for "
19990 					    "tcp %p mmd %p pinfo %p (%d)\n",
19991 					    (void *)tcp, (void *)mmd,
19992 					    (void *)pkt_info, err);
19993 				}
19994 				TCP_STAT(tcp_mdt_addpdescfail);
19995 				goto legacy_send; /* out_of_mem */
19996 			}
19997 			ASSERT(pkt != NULL);
19998 
19999 			/* calculate IP header and TCP checksums */
20000 			if (af == AF_INET) {
20001 				/* calculate pseudo-header checksum */
20002 				cksum = (dst >> 16) + (dst & 0xFFFF) +
20003 				    (src >> 16) + (src & 0xFFFF);
20004 
20005 				/* offset for TCP header checksum */
20006 				up = IPH_TCPH_CHECKSUMP(ipha,
20007 				    IP_SIMPLE_HDR_LENGTH);
20008 			} else {
20009 				up = (uint16_t *)&ip6h->ip6_src;
20010 
20011 				/* calculate pseudo-header checksum */
20012 				cksum = up[0] + up[1] + up[2] + up[3] +
20013 				    up[4] + up[5] + up[6] + up[7] +
20014 				    up[8] + up[9] + up[10] + up[11] +
20015 				    up[12] + up[13] + up[14] + up[15];
20016 
20017 				/* Fold the initial sum */
20018 				cksum = (cksum & 0xffff) + (cksum >> 16);
20019 
20020 				up = (uint16_t *)(((uchar_t *)ip6h) +
20021 				    IPV6_HDR_LEN + TCP_CHECKSUM_OFFSET);
20022 			}
20023 
20024 			if (hwcksum_flags & HCK_FULLCKSUM) {
20025 				/* clear checksum field for hardware */
20026 				*up = 0;
20027 			} else if (hwcksum_flags & HCK_PARTIALCKSUM) {
20028 				uint32_t sum;
20029 
20030 				/* pseudo-header checksumming */
20031 				sum = *up + cksum + IP_TCP_CSUM_COMP;
20032 				sum = (sum & 0xFFFF) + (sum >> 16);
20033 				*up = (sum & 0xFFFF) + (sum >> 16);
20034 			} else {
20035 				/* software checksumming */
20036 				TCP_STAT(tcp_out_sw_cksum);
20037 				TCP_STAT_UPDATE(tcp_out_sw_cksum_bytes,
20038 				    tcp->tcp_hdr_len + tcp->tcp_last_sent_len);
20039 				*up = IP_MD_CSUM(pkt, tcp->tcp_ip_hdr_len,
20040 				    cksum + IP_TCP_CSUM_COMP);
20041 				if (*up == 0)
20042 					*up = 0xFFFF;
20043 			}
20044 
20045 			/* IPv4 header checksum */
20046 			if (af == AF_INET) {
20047 				ipha->ipha_fragment_offset_and_flags |=
20048 				    (uint32_t)htons(ire->ire_frag_flag);
20049 
20050 				if (hwcksum_flags & HCK_IPV4_HDRCKSUM) {
20051 					ipha->ipha_hdr_checksum = 0;
20052 				} else {
20053 					IP_HDR_CKSUM(ipha, cksum,
20054 					    ((uint32_t *)ipha)[0],
20055 					    ((uint16_t *)ipha)[4]);
20056 				}
20057 			}
20058 
20059 			/* advance header offset */
20060 			cur_hdr_off += hdr_frag_sz;
20061 
20062 			obbytes += tcp->tcp_last_sent_len;
20063 			++obsegs;
20064 		} while (!done && *usable > 0 && --num_burst_seg > 0 &&
20065 		    *tail_unsent > 0);
20066 
20067 		if ((*xmit_tail)->b_next == NULL) {
20068 			/*
20069 			 * Store the lbolt used for RTT estimation. We can only
20070 			 * record one timestamp per mblk so we do it when we
20071 			 * reach the end of the payload buffer. Also we only
20072 			 * take a new timestamp sample when the previous timed
20073 			 * data from the same mblk has been ack'ed.
20074 			 */
20075 			(*xmit_tail)->b_prev = local_time;
20076 			(*xmit_tail)->b_next = (mblk_t *)(uintptr_t)first_snxt;
20077 		}
20078 
20079 		ASSERT(*tail_unsent >= 0);
20080 		if (*tail_unsent > 0) {
20081 			/*
20082 			 * We got here because we broke out of the above
20083 			 * loop due to of one of the following cases:
20084 			 *
20085 			 *   1. len < adjusted MSS (i.e. small),
20086 			 *   2. Sender SWS avoidance,
20087 			 *   3. max_pld is zero.
20088 			 *
20089 			 * We are done for this Multidata, so trim our
20090 			 * last payload buffer (if any) accordingly.
20091 			 */
20092 			if (md_pbuf != NULL)
20093 				md_pbuf->b_wptr -= *tail_unsent;
20094 		} else if (*usable > 0) {
20095 			*xmit_tail = (*xmit_tail)->b_cont;
20096 			ASSERT((uintptr_t)MBLKL(*xmit_tail) <=
20097 			    (uintptr_t)INT_MAX);
20098 			*tail_unsent = (int)MBLKL(*xmit_tail);
20099 			add_buffer = B_TRUE;
20100 		}
20101 	} while (!done && *usable > 0 && num_burst_seg > 0 &&
20102 	    (tcp_mdt_chain || max_pld > 0));
20103 
20104 	/* send everything down */
20105 	tcp_multisend_data(tcp, ire, ill, md_mp_head, obsegs, obbytes,
20106 	    &rconfirm);
20107 
20108 #undef PREP_NEW_MULTIDATA
20109 #undef PREP_NEW_PBUF
20110 #undef IPVER
20111 
20112 	IRE_REFRELE(ire);
20113 	return (0);
20114 }
20115 
20116 /*
20117  * A wrapper function for sending one or more Multidata messages down to
20118  * the module below ip; this routine does not release the reference of the
20119  * IRE (caller does that).  This routine is analogous to tcp_send_data().
20120  */
20121 static void
20122 tcp_multisend_data(tcp_t *tcp, ire_t *ire, const ill_t *ill, mblk_t *md_mp_head,
20123     const uint_t obsegs, const uint_t obbytes, boolean_t *rconfirm)
20124 {
20125 	uint64_t delta;
20126 	nce_t *nce;
20127 
20128 	ASSERT(ire != NULL && ill != NULL);
20129 	ASSERT(ire->ire_stq != NULL);
20130 	ASSERT(md_mp_head != NULL);
20131 	ASSERT(rconfirm != NULL);
20132 
20133 	/* adjust MIBs and IRE timestamp */
20134 	TCP_RECORD_TRACE(tcp, md_mp_head, TCP_TRACE_SEND_PKT);
20135 	tcp->tcp_obsegs += obsegs;
20136 	UPDATE_MIB(&tcp_mib, tcpOutDataSegs, obsegs);
20137 	UPDATE_MIB(&tcp_mib, tcpOutDataBytes, obbytes);
20138 	TCP_STAT_UPDATE(tcp_mdt_pkt_out, obsegs);
20139 
20140 	if (tcp->tcp_ipversion == IPV4_VERSION) {
20141 		TCP_STAT_UPDATE(tcp_mdt_pkt_out_v4, obsegs);
20142 		UPDATE_MIB(&ip_mib, ipOutRequests, obsegs);
20143 	} else {
20144 		TCP_STAT_UPDATE(tcp_mdt_pkt_out_v6, obsegs);
20145 		UPDATE_MIB(&ip6_mib, ipv6OutRequests, obsegs);
20146 	}
20147 
20148 	ire->ire_ob_pkt_count += obsegs;
20149 	if (ire->ire_ipif != NULL)
20150 		atomic_add_32(&ire->ire_ipif->ipif_ob_pkt_count, obsegs);
20151 	ire->ire_last_used_time = lbolt;
20152 
20153 	/* send it down */
20154 	putnext(ire->ire_stq, md_mp_head);
20155 
20156 	/* we're done for TCP/IPv4 */
20157 	if (tcp->tcp_ipversion == IPV4_VERSION)
20158 		return;
20159 
20160 	nce = ire->ire_nce;
20161 
20162 	ASSERT(nce != NULL);
20163 	ASSERT(!(nce->nce_flags & (NCE_F_NONUD|NCE_F_PERMANENT)));
20164 	ASSERT(nce->nce_state != ND_INCOMPLETE);
20165 
20166 	/* reachability confirmation? */
20167 	if (*rconfirm) {
20168 		nce->nce_last = TICK_TO_MSEC(lbolt64);
20169 		if (nce->nce_state != ND_REACHABLE) {
20170 			mutex_enter(&nce->nce_lock);
20171 			nce->nce_state = ND_REACHABLE;
20172 			nce->nce_pcnt = ND_MAX_UNICAST_SOLICIT;
20173 			mutex_exit(&nce->nce_lock);
20174 			(void) untimeout(nce->nce_timeout_id);
20175 			if (ip_debug > 2) {
20176 				/* ip1dbg */
20177 				pr_addr_dbg("tcp_multisend_data: state "
20178 				    "for %s changed to REACHABLE\n",
20179 				    AF_INET6, &ire->ire_addr_v6);
20180 			}
20181 		}
20182 		/* reset transport reachability confirmation */
20183 		*rconfirm = B_FALSE;
20184 	}
20185 
20186 	delta =  TICK_TO_MSEC(lbolt64) - nce->nce_last;
20187 	ip1dbg(("tcp_multisend_data: delta = %" PRId64
20188 	    " ill_reachable_time = %d \n", delta, ill->ill_reachable_time));
20189 
20190 	if (delta > (uint64_t)ill->ill_reachable_time) {
20191 		mutex_enter(&nce->nce_lock);
20192 		switch (nce->nce_state) {
20193 		case ND_REACHABLE:
20194 		case ND_STALE:
20195 			/*
20196 			 * ND_REACHABLE is identical to ND_STALE in this
20197 			 * specific case. If reachable time has expired for
20198 			 * this neighbor (delta is greater than reachable
20199 			 * time), conceptually, the neighbor cache is no
20200 			 * longer in REACHABLE state, but already in STALE
20201 			 * state.  So the correct transition here is to
20202 			 * ND_DELAY.
20203 			 */
20204 			nce->nce_state = ND_DELAY;
20205 			mutex_exit(&nce->nce_lock);
20206 			NDP_RESTART_TIMER(nce, delay_first_probe_time);
20207 			if (ip_debug > 3) {
20208 				/* ip2dbg */
20209 				pr_addr_dbg("tcp_multisend_data: state "
20210 				    "for %s changed to DELAY\n",
20211 				    AF_INET6, &ire->ire_addr_v6);
20212 			}
20213 			break;
20214 		case ND_DELAY:
20215 		case ND_PROBE:
20216 			mutex_exit(&nce->nce_lock);
20217 			/* Timers have already started */
20218 			break;
20219 		case ND_UNREACHABLE:
20220 			/*
20221 			 * ndp timer has detected that this nce is
20222 			 * unreachable and initiated deleting this nce
20223 			 * and all its associated IREs. This is a race
20224 			 * where we found the ire before it was deleted
20225 			 * and have just sent out a packet using this
20226 			 * unreachable nce.
20227 			 */
20228 			mutex_exit(&nce->nce_lock);
20229 			break;
20230 		default:
20231 			ASSERT(0);
20232 		}
20233 	}
20234 }
20235 
20236 /*
20237  * tcp_send() is called by tcp_wput_data() for non-Multidata transmission
20238  * scheme, and returns one of the following:
20239  *
20240  * -1 = failed allocation.
20241  *  0 = success; burst count reached, or usable send window is too small,
20242  *      and that we'd rather wait until later before sending again.
20243  *  1 = success; we are called from tcp_multisend(), and both usable send
20244  *      window and tail_unsent are greater than the MDT threshold, and thus
20245  *      Multidata Transmit should be used instead.
20246  */
20247 static int
20248 tcp_send(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len,
20249     const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable,
20250     uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time,
20251     const int mdt_thres)
20252 {
20253 	int num_burst_seg = tcp->tcp_snd_burst;
20254 
20255 	for (;;) {
20256 		struct datab	*db;
20257 		tcph_t		*tcph;
20258 		uint32_t	sum;
20259 		mblk_t		*mp, *mp1;
20260 		uchar_t		*rptr;
20261 		int		len;
20262 
20263 		/*
20264 		 * If we're called by tcp_multisend(), and the amount of
20265 		 * sendable data as well as the size of current xmit_tail
20266 		 * is beyond the MDT threshold, return to the caller and
20267 		 * let the large data transmit be done using MDT.
20268 		 */
20269 		if (*usable > 0 && *usable > mdt_thres &&
20270 		    (*tail_unsent > mdt_thres || (*tail_unsent == 0 &&
20271 		    MBLKL((*xmit_tail)->b_cont) > mdt_thres))) {
20272 			ASSERT(tcp->tcp_mdt);
20273 			return (1);	/* success; do large send */
20274 		}
20275 
20276 		if (num_burst_seg-- == 0)
20277 			break;		/* success; burst count reached */
20278 
20279 		len = mss;
20280 		if (len > *usable) {
20281 			len = *usable;
20282 			if (len <= 0) {
20283 				/* Terminate the loop */
20284 				break;	/* success; too small */
20285 			}
20286 			/*
20287 			 * Sender silly-window avoidance.
20288 			 * Ignore this if we are going to send a
20289 			 * zero window probe out.
20290 			 *
20291 			 * TODO: force data into microscopic window?
20292 			 *	==> (!pushed || (unsent > usable))
20293 			 */
20294 			if (len < (tcp->tcp_max_swnd >> 1) &&
20295 			    (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) > len &&
20296 			    !((tcp->tcp_valid_bits & TCP_URG_VALID) &&
20297 			    len == 1) && (! tcp->tcp_zero_win_probe)) {
20298 				/*
20299 				 * If the retransmit timer is not running
20300 				 * we start it so that we will retransmit
20301 				 * in the case when the the receiver has
20302 				 * decremented the window.
20303 				 */
20304 				if (*snxt == tcp->tcp_snxt &&
20305 				    *snxt == tcp->tcp_suna) {
20306 					/*
20307 					 * We are not supposed to send
20308 					 * anything.  So let's wait a little
20309 					 * bit longer before breaking SWS
20310 					 * avoidance.
20311 					 *
20312 					 * What should the value be?
20313 					 * Suggestion: MAX(init rexmit time,
20314 					 * tcp->tcp_rto)
20315 					 */
20316 					TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
20317 				}
20318 				break;	/* success; too small */
20319 			}
20320 		}
20321 
20322 		tcph = tcp->tcp_tcph;
20323 
20324 		*usable -= len; /* Approximate - can be adjusted later */
20325 		if (*usable > 0)
20326 			tcph->th_flags[0] = TH_ACK;
20327 		else
20328 			tcph->th_flags[0] = (TH_ACK | TH_PUSH);
20329 
20330 		/*
20331 		 * Prime pump for IP's checksumming on our behalf
20332 		 * Include the adjustment for a source route if any.
20333 		 */
20334 		sum = len + tcp_tcp_hdr_len + tcp->tcp_sum;
20335 		sum = (sum >> 16) + (sum & 0xFFFF);
20336 		U16_TO_ABE16(sum, tcph->th_sum);
20337 
20338 		U32_TO_ABE32(*snxt, tcph->th_seq);
20339 
20340 		/*
20341 		 * Branch off to tcp_xmit_mp() if any of the VALID bits is
20342 		 * set.  For the case when TCP_FSS_VALID is the only valid
20343 		 * bit (normal active close), branch off only when we think
20344 		 * that the FIN flag needs to be set.  Note for this case,
20345 		 * that (snxt + len) may not reflect the actual seg_len,
20346 		 * as len may be further reduced in tcp_xmit_mp().  If len
20347 		 * gets modified, we will end up here again.
20348 		 */
20349 		if (tcp->tcp_valid_bits != 0 &&
20350 		    (tcp->tcp_valid_bits != TCP_FSS_VALID ||
20351 		    ((*snxt + len) == tcp->tcp_fss))) {
20352 			uchar_t		*prev_rptr;
20353 			uint32_t	prev_snxt = tcp->tcp_snxt;
20354 
20355 			if (*tail_unsent == 0) {
20356 				ASSERT((*xmit_tail)->b_cont != NULL);
20357 				*xmit_tail = (*xmit_tail)->b_cont;
20358 				prev_rptr = (*xmit_tail)->b_rptr;
20359 				*tail_unsent = (int)((*xmit_tail)->b_wptr -
20360 				    (*xmit_tail)->b_rptr);
20361 			} else {
20362 				prev_rptr = (*xmit_tail)->b_rptr;
20363 				(*xmit_tail)->b_rptr = (*xmit_tail)->b_wptr -
20364 				    *tail_unsent;
20365 			}
20366 			mp = tcp_xmit_mp(tcp, *xmit_tail, len, NULL, NULL,
20367 			    *snxt, B_FALSE, (uint32_t *)&len, B_FALSE);
20368 			/* Restore tcp_snxt so we get amount sent right. */
20369 			tcp->tcp_snxt = prev_snxt;
20370 			if (prev_rptr == (*xmit_tail)->b_rptr) {
20371 				/*
20372 				 * If the previous timestamp is still in use,
20373 				 * don't stomp on it.
20374 				 */
20375 				if ((*xmit_tail)->b_next == NULL) {
20376 					(*xmit_tail)->b_prev = local_time;
20377 					(*xmit_tail)->b_next =
20378 					    (mblk_t *)(uintptr_t)(*snxt);
20379 				}
20380 			} else
20381 				(*xmit_tail)->b_rptr = prev_rptr;
20382 
20383 			if (mp == NULL)
20384 				return (-1);
20385 			mp1 = mp->b_cont;
20386 
20387 			tcp->tcp_last_sent_len = (ushort_t)len;
20388 			while (mp1->b_cont) {
20389 				*xmit_tail = (*xmit_tail)->b_cont;
20390 				(*xmit_tail)->b_prev = local_time;
20391 				(*xmit_tail)->b_next =
20392 				    (mblk_t *)(uintptr_t)(*snxt);
20393 				mp1 = mp1->b_cont;
20394 			}
20395 			*snxt += len;
20396 			*tail_unsent = (*xmit_tail)->b_wptr - mp1->b_wptr;
20397 			BUMP_LOCAL(tcp->tcp_obsegs);
20398 			BUMP_MIB(&tcp_mib, tcpOutDataSegs);
20399 			UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len);
20400 			TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT);
20401 			tcp_send_data(tcp, q, mp);
20402 			continue;
20403 		}
20404 
20405 		*snxt += len;	/* Adjust later if we don't send all of len */
20406 		BUMP_MIB(&tcp_mib, tcpOutDataSegs);
20407 		UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len);
20408 
20409 		if (*tail_unsent) {
20410 			/* Are the bytes above us in flight? */
20411 			rptr = (*xmit_tail)->b_wptr - *tail_unsent;
20412 			if (rptr != (*xmit_tail)->b_rptr) {
20413 				*tail_unsent -= len;
20414 				tcp->tcp_last_sent_len = (ushort_t)len;
20415 				len += tcp_hdr_len;
20416 				if (tcp->tcp_ipversion == IPV4_VERSION)
20417 					tcp->tcp_ipha->ipha_length = htons(len);
20418 				else
20419 					tcp->tcp_ip6h->ip6_plen =
20420 					    htons(len -
20421 					    ((char *)&tcp->tcp_ip6h[1] -
20422 					    tcp->tcp_iphc));
20423 				mp = dupb(*xmit_tail);
20424 				if (!mp)
20425 					return (-1);	/* out_of_mem */
20426 				mp->b_rptr = rptr;
20427 				/*
20428 				 * If the old timestamp is no longer in use,
20429 				 * sample a new timestamp now.
20430 				 */
20431 				if ((*xmit_tail)->b_next == NULL) {
20432 					(*xmit_tail)->b_prev = local_time;
20433 					(*xmit_tail)->b_next =
20434 					    (mblk_t *)(uintptr_t)(*snxt-len);
20435 				}
20436 				goto must_alloc;
20437 			}
20438 		} else {
20439 			*xmit_tail = (*xmit_tail)->b_cont;
20440 			ASSERT((uintptr_t)((*xmit_tail)->b_wptr -
20441 			    (*xmit_tail)->b_rptr) <= (uintptr_t)INT_MAX);
20442 			*tail_unsent = (int)((*xmit_tail)->b_wptr -
20443 			    (*xmit_tail)->b_rptr);
20444 		}
20445 
20446 		(*xmit_tail)->b_prev = local_time;
20447 		(*xmit_tail)->b_next = (mblk_t *)(uintptr_t)(*snxt - len);
20448 
20449 		*tail_unsent -= len;
20450 		tcp->tcp_last_sent_len = (ushort_t)len;
20451 
20452 		len += tcp_hdr_len;
20453 		if (tcp->tcp_ipversion == IPV4_VERSION)
20454 			tcp->tcp_ipha->ipha_length = htons(len);
20455 		else
20456 			tcp->tcp_ip6h->ip6_plen = htons(len -
20457 			    ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc));
20458 
20459 		mp = dupb(*xmit_tail);
20460 		if (!mp)
20461 			return (-1);	/* out_of_mem */
20462 
20463 		len = tcp_hdr_len;
20464 		/*
20465 		 * There are four reasons to allocate a new hdr mblk:
20466 		 *  1) The bytes above us are in use by another packet
20467 		 *  2) We don't have good alignment
20468 		 *  3) The mblk is being shared
20469 		 *  4) We don't have enough room for a header
20470 		 */
20471 		rptr = mp->b_rptr - len;
20472 		if (!OK_32PTR(rptr) ||
20473 		    ((db = mp->b_datap), db->db_ref != 2) ||
20474 		    rptr < db->db_base) {
20475 			/* NOTE: we assume allocb returns an OK_32PTR */
20476 
20477 		must_alloc:;
20478 			mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH +
20479 			    tcp_wroff_xtra, BPRI_MED);
20480 			if (!mp1) {
20481 				freemsg(mp);
20482 				return (-1);	/* out_of_mem */
20483 			}
20484 			mp1->b_cont = mp;
20485 			mp = mp1;
20486 			/* Leave room for Link Level header */
20487 			len = tcp_hdr_len;
20488 			rptr = &mp->b_rptr[tcp_wroff_xtra];
20489 			mp->b_wptr = &rptr[len];
20490 		}
20491 
20492 		/*
20493 		 * Fill in the header using the template header, and add
20494 		 * options such as time-stamp, ECN and/or SACK, as needed.
20495 		 */
20496 		tcp_fill_header(tcp, rptr, (clock_t)local_time, num_sack_blk);
20497 
20498 		mp->b_rptr = rptr;
20499 
20500 		if (*tail_unsent) {
20501 			int spill = *tail_unsent;
20502 
20503 			mp1 = mp->b_cont;
20504 			if (!mp1)
20505 				mp1 = mp;
20506 
20507 			/*
20508 			 * If we're a little short, tack on more mblks until
20509 			 * there is no more spillover.
20510 			 */
20511 			while (spill < 0) {
20512 				mblk_t *nmp;
20513 				int nmpsz;
20514 
20515 				nmp = (*xmit_tail)->b_cont;
20516 				nmpsz = MBLKL(nmp);
20517 
20518 				/*
20519 				 * Excess data in mblk; can we split it?
20520 				 * If MDT is enabled for the connection,
20521 				 * keep on splitting as this is a transient
20522 				 * send path.
20523 				 */
20524 				if (!tcp->tcp_mdt && (spill + nmpsz > 0)) {
20525 					/*
20526 					 * Don't split if stream head was
20527 					 * told to break up larger writes
20528 					 * into smaller ones.
20529 					 */
20530 					if (tcp->tcp_maxpsz > 0)
20531 						break;
20532 
20533 					/*
20534 					 * Next mblk is less than SMSS/2
20535 					 * rounded up to nearest 64-byte;
20536 					 * let it get sent as part of the
20537 					 * next segment.
20538 					 */
20539 					if (tcp->tcp_localnet &&
20540 					    !tcp->tcp_cork &&
20541 					    (nmpsz < roundup((mss >> 1), 64)))
20542 						break;
20543 				}
20544 
20545 				*xmit_tail = nmp;
20546 				ASSERT((uintptr_t)nmpsz <= (uintptr_t)INT_MAX);
20547 				/* Stash for rtt use later */
20548 				(*xmit_tail)->b_prev = local_time;
20549 				(*xmit_tail)->b_next =
20550 				    (mblk_t *)(uintptr_t)(*snxt - len);
20551 				mp1->b_cont = dupb(*xmit_tail);
20552 				mp1 = mp1->b_cont;
20553 
20554 				spill += nmpsz;
20555 				if (mp1 == NULL) {
20556 					*tail_unsent = spill;
20557 					freemsg(mp);
20558 					return (-1);	/* out_of_mem */
20559 				}
20560 			}
20561 
20562 			/* Trim back any surplus on the last mblk */
20563 			if (spill >= 0) {
20564 				mp1->b_wptr -= spill;
20565 				*tail_unsent = spill;
20566 			} else {
20567 				/*
20568 				 * We did not send everything we could in
20569 				 * order to remain within the b_cont limit.
20570 				 */
20571 				*usable -= spill;
20572 				*snxt += spill;
20573 				tcp->tcp_last_sent_len += spill;
20574 				UPDATE_MIB(&tcp_mib, tcpOutDataBytes, spill);
20575 				/*
20576 				 * Adjust the checksum
20577 				 */
20578 				tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len);
20579 				sum += spill;
20580 				sum = (sum >> 16) + (sum & 0xFFFF);
20581 				U16_TO_ABE16(sum, tcph->th_sum);
20582 				if (tcp->tcp_ipversion == IPV4_VERSION) {
20583 					sum = ntohs(
20584 					    ((ipha_t *)rptr)->ipha_length) +
20585 					    spill;
20586 					((ipha_t *)rptr)->ipha_length =
20587 					    htons(sum);
20588 				} else {
20589 					sum = ntohs(
20590 					    ((ip6_t *)rptr)->ip6_plen) +
20591 					    spill;
20592 					((ip6_t *)rptr)->ip6_plen =
20593 					    htons(sum);
20594 				}
20595 				*tail_unsent = 0;
20596 			}
20597 		}
20598 		if (tcp->tcp_ip_forward_progress) {
20599 			ASSERT(tcp->tcp_ipversion == IPV6_VERSION);
20600 			*(uint32_t *)mp->b_rptr  |= IP_FORWARD_PROG;
20601 			tcp->tcp_ip_forward_progress = B_FALSE;
20602 		}
20603 
20604 		TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT);
20605 		tcp_send_data(tcp, q, mp);
20606 		BUMP_LOCAL(tcp->tcp_obsegs);
20607 	}
20608 
20609 	return (0);
20610 }
20611 
20612 /* Unlink and return any mblk that looks like it contains a MDT info */
20613 static mblk_t *
20614 tcp_mdt_info_mp(mblk_t *mp)
20615 {
20616 	mblk_t	*prev_mp;
20617 
20618 	for (;;) {
20619 		prev_mp = mp;
20620 		/* no more to process? */
20621 		if ((mp = mp->b_cont) == NULL)
20622 			break;
20623 
20624 		switch (DB_TYPE(mp)) {
20625 		case M_CTL:
20626 			if (*(uint32_t *)mp->b_rptr != MDT_IOC_INFO_UPDATE)
20627 				continue;
20628 			ASSERT(prev_mp != NULL);
20629 			prev_mp->b_cont = mp->b_cont;
20630 			mp->b_cont = NULL;
20631 			return (mp);
20632 		default:
20633 			break;
20634 		}
20635 	}
20636 	return (mp);
20637 }
20638 
20639 /* MDT info update routine, called when IP notifies us about MDT */
20640 static void
20641 tcp_mdt_update(tcp_t *tcp, ill_mdt_capab_t *mdt_capab, boolean_t first)
20642 {
20643 	boolean_t prev_state;
20644 
20645 	/*
20646 	 * IP is telling us to abort MDT on this connection?  We know
20647 	 * this because the capability is only turned off when IP
20648 	 * encounters some pathological cases, e.g. link-layer change
20649 	 * where the new driver doesn't support MDT, or in situation
20650 	 * where MDT usage on the link-layer has been switched off.
20651 	 * IP would not have sent us the initial MDT_IOC_INFO_UPDATE
20652 	 * if the link-layer doesn't support MDT, and if it does, it
20653 	 * will indicate that the feature is to be turned on.
20654 	 */
20655 	prev_state = tcp->tcp_mdt;
20656 	tcp->tcp_mdt = (mdt_capab->ill_mdt_on != 0);
20657 	if (!tcp->tcp_mdt && !first) {
20658 		TCP_STAT(tcp_mdt_conn_halted3);
20659 		ip1dbg(("tcp_mdt_update: disabling MDT for connp %p\n",
20660 		    (void *)tcp->tcp_connp));
20661 	}
20662 
20663 	/*
20664 	 * We currently only support MDT on simple TCP/{IPv4,IPv6},
20665 	 * so disable MDT otherwise.  The checks are done here
20666 	 * and in tcp_wput_data().
20667 	 */
20668 	if (tcp->tcp_mdt &&
20669 	    (tcp->tcp_ipversion == IPV4_VERSION &&
20670 	    tcp->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH) ||
20671 	    (tcp->tcp_ipversion == IPV6_VERSION &&
20672 	    tcp->tcp_ip_hdr_len != IPV6_HDR_LEN))
20673 		tcp->tcp_mdt = B_FALSE;
20674 
20675 	if (tcp->tcp_mdt) {
20676 		if (mdt_capab->ill_mdt_version != MDT_VERSION_2) {
20677 			cmn_err(CE_NOTE, "tcp_mdt_update: unknown MDT "
20678 			    "version (%d), expected version is %d",
20679 			    mdt_capab->ill_mdt_version, MDT_VERSION_2);
20680 			tcp->tcp_mdt = B_FALSE;
20681 			return;
20682 		}
20683 
20684 		/*
20685 		 * We need the driver to be able to handle at least three
20686 		 * spans per packet in order for tcp MDT to be utilized.
20687 		 * The first is for the header portion, while the rest are
20688 		 * needed to handle a packet that straddles across two
20689 		 * virtually non-contiguous buffers; a typical tcp packet
20690 		 * therefore consists of only two spans.  Note that we take
20691 		 * a zero as "don't care".
20692 		 */
20693 		if (mdt_capab->ill_mdt_span_limit > 0 &&
20694 		    mdt_capab->ill_mdt_span_limit < 3) {
20695 			tcp->tcp_mdt = B_FALSE;
20696 			return;
20697 		}
20698 
20699 		/* a zero means driver wants default value */
20700 		tcp->tcp_mdt_max_pld = MIN(mdt_capab->ill_mdt_max_pld,
20701 		    tcp_mdt_max_pbufs);
20702 		if (tcp->tcp_mdt_max_pld == 0)
20703 			tcp->tcp_mdt_max_pld = tcp_mdt_max_pbufs;
20704 
20705 		/* ensure 32-bit alignment */
20706 		tcp->tcp_mdt_hdr_head = roundup(MAX(tcp_mdt_hdr_head_min,
20707 		    mdt_capab->ill_mdt_hdr_head), 4);
20708 		tcp->tcp_mdt_hdr_tail = roundup(MAX(tcp_mdt_hdr_tail_min,
20709 		    mdt_capab->ill_mdt_hdr_tail), 4);
20710 
20711 		if (!first && !prev_state) {
20712 			TCP_STAT(tcp_mdt_conn_resumed2);
20713 			ip1dbg(("tcp_mdt_update: reenabling MDT for connp %p\n",
20714 			    (void *)tcp->tcp_connp));
20715 		}
20716 	}
20717 }
20718 
20719 static void
20720 tcp_ire_ill_check(tcp_t *tcp, ire_t *ire, ill_t *ill, boolean_t check_mdt)
20721 {
20722 	conn_t *connp = tcp->tcp_connp;
20723 
20724 	ASSERT(ire != NULL);
20725 
20726 	/*
20727 	 * We may be in the fastpath here, and although we essentially do
20728 	 * similar checks as in ip_bind_connected{_v6}/ip_mdinfo_return,
20729 	 * we try to keep things as brief as possible.  After all, these
20730 	 * are only best-effort checks, and we do more thorough ones prior
20731 	 * to calling tcp_multisend().
20732 	 */
20733 	if (ip_multidata_outbound && check_mdt &&
20734 	    !(ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) &&
20735 	    ill != NULL && ILL_MDT_CAPABLE(ill) &&
20736 	    !CONN_IPSEC_OUT_ENCAPSULATED(connp) &&
20737 	    !(ire->ire_flags & RTF_MULTIRT) &&
20738 	    !IPP_ENABLED(IPP_LOCAL_OUT) &&
20739 	    CONN_IS_MD_FASTPATH(connp)) {
20740 		/* Remember the result */
20741 		connp->conn_mdt_ok = B_TRUE;
20742 
20743 		ASSERT(ill->ill_mdt_capab != NULL);
20744 		if (!ill->ill_mdt_capab->ill_mdt_on) {
20745 			/*
20746 			 * If MDT has been previously turned off in the past,
20747 			 * and we currently can do MDT (due to IPQoS policy
20748 			 * removal, etc.) then enable it for this interface.
20749 			 */
20750 			ill->ill_mdt_capab->ill_mdt_on = 1;
20751 			ip1dbg(("tcp_ire_ill_check: connp %p enables MDT for "
20752 			    "interface %s\n", (void *)connp, ill->ill_name));
20753 		}
20754 		tcp_mdt_update(tcp, ill->ill_mdt_capab, B_TRUE);
20755 	}
20756 
20757 	/*
20758 	 * The goal is to reduce the number of generated tcp segments by
20759 	 * setting the maxpsz multiplier to 0; this will have an affect on
20760 	 * tcp_maxpsz_set().  With this behavior, tcp will pack more data
20761 	 * into each packet, up to SMSS bytes.  Doing this reduces the number
20762 	 * of outbound segments and incoming ACKs, thus allowing for better
20763 	 * network and system performance.  In contrast the legacy behavior
20764 	 * may result in sending less than SMSS size, because the last mblk
20765 	 * for some packets may have more data than needed to make up SMSS,
20766 	 * and the legacy code refused to "split" it.
20767 	 *
20768 	 * We apply the new behavior on following situations:
20769 	 *
20770 	 *   1) Loopback connections,
20771 	 *   2) Connections in which the remote peer is not on local subnet,
20772 	 *   3) Local subnet connections over the bge interface (see below).
20773 	 *
20774 	 * Ideally, we would like this behavior to apply for interfaces other
20775 	 * than bge.  However, doing so would negatively impact drivers which
20776 	 * perform dynamic mapping and unmapping of DMA resources, which are
20777 	 * increased by setting the maxpsz multiplier to 0 (more mblks per
20778 	 * packet will be generated by tcp).  The bge driver does not suffer
20779 	 * from this, as it copies the mblks into pre-mapped buffers, and
20780 	 * therefore does not require more I/O resources than before.
20781 	 *
20782 	 * Otherwise, this behavior is present on all network interfaces when
20783 	 * the destination endpoint is non-local, since reducing the number
20784 	 * of packets in general is good for the network.
20785 	 *
20786 	 * TODO We need to remove this hard-coded conditional for bge once
20787 	 *	a better "self-tuning" mechanism, or a way to comprehend
20788 	 *	the driver transmit strategy is devised.  Until the solution
20789 	 *	is found and well understood, we live with this hack.
20790 	 */
20791 	if (!tcp_static_maxpsz &&
20792 	    (tcp->tcp_loopback || !tcp->tcp_localnet ||
20793 	    (ill->ill_name_length > 3 && bcmp(ill->ill_name, "bge", 3) == 0))) {
20794 		/* override the default value */
20795 		tcp->tcp_maxpsz = 0;
20796 
20797 		ip3dbg(("tcp_ire_ill_check: connp %p tcp_maxpsz %d on "
20798 		    "interface %s\n", (void *)connp, tcp->tcp_maxpsz,
20799 		    ill != NULL ? ill->ill_name : ipif_loopback_name));
20800 	}
20801 
20802 	/* set the stream head parameters accordingly */
20803 	(void) tcp_maxpsz_set(tcp, B_TRUE);
20804 }
20805 
20806 /* tcp_wput_flush is called by tcp_wput_nondata to handle M_FLUSH messages. */
20807 static void
20808 tcp_wput_flush(tcp_t *tcp, mblk_t *mp)
20809 {
20810 	uchar_t	fval = *mp->b_rptr;
20811 	mblk_t	*tail;
20812 	queue_t	*q = tcp->tcp_wq;
20813 
20814 	/* TODO: How should flush interact with urgent data? */
20815 	if ((fval & FLUSHW) && tcp->tcp_xmit_head &&
20816 	    !(tcp->tcp_valid_bits & TCP_URG_VALID)) {
20817 		/*
20818 		 * Flush only data that has not yet been put on the wire.  If
20819 		 * we flush data that we have already transmitted, life, as we
20820 		 * know it, may come to an end.
20821 		 */
20822 		tail = tcp->tcp_xmit_tail;
20823 		tail->b_wptr -= tcp->tcp_xmit_tail_unsent;
20824 		tcp->tcp_xmit_tail_unsent = 0;
20825 		tcp->tcp_unsent = 0;
20826 		if (tail->b_wptr != tail->b_rptr)
20827 			tail = tail->b_cont;
20828 		if (tail) {
20829 			mblk_t **excess = &tcp->tcp_xmit_head;
20830 			for (;;) {
20831 				mblk_t *mp1 = *excess;
20832 				if (mp1 == tail)
20833 					break;
20834 				tcp->tcp_xmit_tail = mp1;
20835 				tcp->tcp_xmit_last = mp1;
20836 				excess = &mp1->b_cont;
20837 			}
20838 			*excess = NULL;
20839 			tcp_close_mpp(&tail);
20840 			if (tcp->tcp_snd_zcopy_aware)
20841 				tcp_zcopy_notify(tcp);
20842 		}
20843 		/*
20844 		 * We have no unsent data, so unsent must be less than
20845 		 * tcp_xmit_lowater, so re-enable flow.
20846 		 */
20847 		if (tcp->tcp_flow_stopped) {
20848 			tcp_clrqfull(tcp);
20849 		}
20850 	}
20851 	/*
20852 	 * TODO: you can't just flush these, you have to increase rwnd for one
20853 	 * thing.  For another, how should urgent data interact?
20854 	 */
20855 	if (fval & FLUSHR) {
20856 		*mp->b_rptr = fval & ~FLUSHW;
20857 		/* XXX */
20858 		qreply(q, mp);
20859 		return;
20860 	}
20861 	freemsg(mp);
20862 }
20863 
20864 /*
20865  * tcp_wput_iocdata is called by tcp_wput_nondata to handle all M_IOCDATA
20866  * messages.
20867  */
20868 static void
20869 tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp)
20870 {
20871 	mblk_t	*mp1;
20872 	STRUCT_HANDLE(strbuf, sb);
20873 	uint16_t port;
20874 	queue_t 	*q = tcp->tcp_wq;
20875 	in6_addr_t	v6addr;
20876 	ipaddr_t	v4addr;
20877 	uint32_t	flowinfo = 0;
20878 	int		addrlen;
20879 
20880 	/* Make sure it is one of ours. */
20881 	switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
20882 	case TI_GETMYNAME:
20883 	case TI_GETPEERNAME:
20884 		break;
20885 	default:
20886 		CALL_IP_WPUT(tcp->tcp_connp, q, mp);
20887 		return;
20888 	}
20889 	switch (mi_copy_state(q, mp, &mp1)) {
20890 	case -1:
20891 		return;
20892 	case MI_COPY_CASE(MI_COPY_IN, 1):
20893 		break;
20894 	case MI_COPY_CASE(MI_COPY_OUT, 1):
20895 		/* Copy out the strbuf. */
20896 		mi_copyout(q, mp);
20897 		return;
20898 	case MI_COPY_CASE(MI_COPY_OUT, 2):
20899 		/* All done. */
20900 		mi_copy_done(q, mp, 0);
20901 		return;
20902 	default:
20903 		mi_copy_done(q, mp, EPROTO);
20904 		return;
20905 	}
20906 	/* Check alignment of the strbuf */
20907 	if (!OK_32PTR(mp1->b_rptr)) {
20908 		mi_copy_done(q, mp, EINVAL);
20909 		return;
20910 	}
20911 
20912 	STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag,
20913 	    (void *)mp1->b_rptr);
20914 	addrlen = tcp->tcp_family == AF_INET ? sizeof (sin_t) : sizeof (sin6_t);
20915 
20916 	if (STRUCT_FGET(sb, maxlen) < addrlen) {
20917 		mi_copy_done(q, mp, EINVAL);
20918 		return;
20919 	}
20920 	switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) {
20921 	case TI_GETMYNAME:
20922 		if (tcp->tcp_family == AF_INET) {
20923 			if (tcp->tcp_ipversion == IPV4_VERSION) {
20924 				v4addr = tcp->tcp_ipha->ipha_src;
20925 			} else {
20926 				/* can't return an address in this case */
20927 				v4addr = 0;
20928 			}
20929 		} else {
20930 			/* tcp->tcp_family == AF_INET6 */
20931 			if (tcp->tcp_ipversion == IPV4_VERSION) {
20932 				IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src,
20933 				    &v6addr);
20934 			} else {
20935 				v6addr = tcp->tcp_ip6h->ip6_src;
20936 			}
20937 		}
20938 		port = tcp->tcp_lport;
20939 		break;
20940 	case TI_GETPEERNAME:
20941 		if (tcp->tcp_family == AF_INET) {
20942 			if (tcp->tcp_ipversion == IPV4_VERSION) {
20943 				IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_remote_v6,
20944 				    v4addr);
20945 			} else {
20946 				/* can't return an address in this case */
20947 				v4addr = 0;
20948 			}
20949 		} else {
20950 			/* tcp->tcp_family == AF_INET6) */
20951 			v6addr = tcp->tcp_remote_v6;
20952 			if (tcp->tcp_ipversion == IPV6_VERSION) {
20953 				/*
20954 				 * No flowinfo if tcp->tcp_ipversion is v4.
20955 				 *
20956 				 * flowinfo was already initialized to zero
20957 				 * where it was declared above, so only
20958 				 * set it if ipversion is v6.
20959 				 */
20960 				flowinfo = tcp->tcp_ip6h->ip6_vcf &
20961 				    ~IPV6_VERS_AND_FLOW_MASK;
20962 			}
20963 		}
20964 		port = tcp->tcp_fport;
20965 		break;
20966 	default:
20967 		mi_copy_done(q, mp, EPROTO);
20968 		return;
20969 	}
20970 	mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE);
20971 	if (!mp1)
20972 		return;
20973 
20974 	if (tcp->tcp_family == AF_INET) {
20975 		sin_t *sin;
20976 
20977 		STRUCT_FSET(sb, len, (int)sizeof (sin_t));
20978 		sin = (sin_t *)mp1->b_rptr;
20979 		mp1->b_wptr = (uchar_t *)&sin[1];
20980 		*sin = sin_null;
20981 		sin->sin_family = AF_INET;
20982 		sin->sin_addr.s_addr = v4addr;
20983 		sin->sin_port = port;
20984 	} else {
20985 		/* tcp->tcp_family == AF_INET6 */
20986 		sin6_t *sin6;
20987 
20988 		STRUCT_FSET(sb, len, (int)sizeof (sin6_t));
20989 		sin6 = (sin6_t *)mp1->b_rptr;
20990 		mp1->b_wptr = (uchar_t *)&sin6[1];
20991 		*sin6 = sin6_null;
20992 		sin6->sin6_family = AF_INET6;
20993 		sin6->sin6_flowinfo = flowinfo;
20994 		sin6->sin6_addr = v6addr;
20995 		sin6->sin6_port = port;
20996 	}
20997 	/* Copy out the address */
20998 	mi_copyout(q, mp);
20999 }
21000 
21001 /*
21002  * tcp_wput_ioctl is called by tcp_wput_nondata() to handle all M_IOCTL
21003  * messages.
21004  */
21005 /* ARGSUSED */
21006 static void
21007 tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2)
21008 {
21009 	conn_t 	*connp = (conn_t *)arg;
21010 	tcp_t	*tcp = connp->conn_tcp;
21011 	queue_t	*q = tcp->tcp_wq;
21012 	struct iocblk	*iocp;
21013 
21014 	ASSERT(DB_TYPE(mp) == M_IOCTL);
21015 	/*
21016 	 * Try and ASSERT the minimum possible references on the
21017 	 * conn early enough. Since we are executing on write side,
21018 	 * the connection is obviously not detached and that means
21019 	 * there is a ref each for TCP and IP. Since we are behind
21020 	 * the squeue, the minimum references needed are 3. If the
21021 	 * conn is in classifier hash list, there should be an
21022 	 * extra ref for that (we check both the possibilities).
21023 	 */
21024 	ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) ||
21025 	    (connp->conn_fanout == NULL && connp->conn_ref >= 3));
21026 
21027 	iocp = (struct iocblk *)mp->b_rptr;
21028 	switch (iocp->ioc_cmd) {
21029 	case TCP_IOC_DEFAULT_Q:
21030 		/* Wants to be the default wq. */
21031 		if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) {
21032 			iocp->ioc_error = EPERM;
21033 			iocp->ioc_count = 0;
21034 			mp->b_datap->db_type = M_IOCACK;
21035 			qreply(q, mp);
21036 			return;
21037 		}
21038 		tcp_def_q_set(tcp, mp);
21039 		return;
21040 	case _SIOCSOCKFALLBACK:
21041 		/*
21042 		 * Either sockmod is about to be popped and the socket
21043 		 * would now be treated as a plain stream, or a module
21044 		 * is about to be pushed so we could no longer use read-
21045 		 * side synchronous streams for fused loopback tcp.
21046 		 * Drain any queued data and disable direct sockfs
21047 		 * interface from now on.
21048 		 */
21049 		if (!tcp->tcp_issocket) {
21050 			DB_TYPE(mp) = M_IOCNAK;
21051 			iocp->ioc_error = EINVAL;
21052 		} else {
21053 #ifdef	_ILP32
21054 			tcp->tcp_acceptor_id = (t_uscalar_t)RD(q);
21055 #else
21056 			tcp->tcp_acceptor_id = tcp->tcp_connp->conn_dev;
21057 #endif
21058 			/*
21059 			 * Insert this socket into the acceptor hash.
21060 			 * We might need it for T_CONN_RES message
21061 			 */
21062 			tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp);
21063 
21064 			if (tcp->tcp_fused) {
21065 				/*
21066 				 * This is a fused loopback tcp; disable
21067 				 * read-side synchronous streams interface
21068 				 * and drain any queued data.  It is okay
21069 				 * to do this for non-synchronous streams
21070 				 * fused tcp as well.
21071 				 */
21072 				tcp_fuse_disable_pair(tcp, B_FALSE);
21073 			}
21074 			tcp->tcp_issocket = B_FALSE;
21075 			TCP_STAT(tcp_sock_fallback);
21076 
21077 			DB_TYPE(mp) = M_IOCACK;
21078 			iocp->ioc_error = 0;
21079 		}
21080 		iocp->ioc_count = 0;
21081 		iocp->ioc_rval = 0;
21082 		qreply(q, mp);
21083 		return;
21084 	}
21085 	CALL_IP_WPUT(connp, q, mp);
21086 }
21087 
21088 /*
21089  * This routine is called by tcp_wput() to handle all TPI requests.
21090  */
21091 /* ARGSUSED */
21092 static void
21093 tcp_wput_proto(void *arg, mblk_t *mp, void *arg2)
21094 {
21095 	conn_t 	*connp = (conn_t *)arg;
21096 	tcp_t	*tcp = connp->conn_tcp;
21097 	union T_primitives *tprim = (union T_primitives *)mp->b_rptr;
21098 	uchar_t *rptr;
21099 	t_scalar_t type;
21100 	int len;
21101 	cred_t *cr = DB_CREDDEF(mp, tcp->tcp_cred);
21102 
21103 	/*
21104 	 * Try and ASSERT the minimum possible references on the
21105 	 * conn early enough. Since we are executing on write side,
21106 	 * the connection is obviously not detached and that means
21107 	 * there is a ref each for TCP and IP. Since we are behind
21108 	 * the squeue, the minimum references needed are 3. If the
21109 	 * conn is in classifier hash list, there should be an
21110 	 * extra ref for that (we check both the possibilities).
21111 	 */
21112 	ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) ||
21113 	    (connp->conn_fanout == NULL && connp->conn_ref >= 3));
21114 
21115 	rptr = mp->b_rptr;
21116 	ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
21117 	if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) {
21118 		type = ((union T_primitives *)rptr)->type;
21119 		if (type == T_EXDATA_REQ) {
21120 			uint32_t msize = msgdsize(mp->b_cont);
21121 
21122 			len = msize - 1;
21123 			if (len < 0) {
21124 				freemsg(mp);
21125 				return;
21126 			}
21127 			/*
21128 			 * Try to force urgent data out on the wire.
21129 			 * Even if we have unsent data this will
21130 			 * at least send the urgent flag.
21131 			 * XXX does not handle more flag correctly.
21132 			 */
21133 			len += tcp->tcp_unsent;
21134 			len += tcp->tcp_snxt;
21135 			tcp->tcp_urg = len;
21136 			tcp->tcp_valid_bits |= TCP_URG_VALID;
21137 
21138 			/* Bypass tcp protocol for fused tcp loopback */
21139 			if (tcp->tcp_fused && tcp_fuse_output(tcp, mp, msize))
21140 				return;
21141 		} else if (type != T_DATA_REQ) {
21142 			goto non_urgent_data;
21143 		}
21144 		/* TODO: options, flags, ... from user */
21145 		/* Set length to zero for reclamation below */
21146 		tcp_wput_data(tcp, mp->b_cont, B_TRUE);
21147 		freeb(mp);
21148 		return;
21149 	} else {
21150 		if (tcp->tcp_debug) {
21151 			(void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
21152 			    "tcp_wput_proto, dropping one...");
21153 		}
21154 		freemsg(mp);
21155 		return;
21156 	}
21157 
21158 non_urgent_data:
21159 
21160 	switch ((int)tprim->type) {
21161 	case T_SSL_PROXY_BIND_REQ:	/* an SSL proxy endpoint bind request */
21162 		/*
21163 		 * save the kssl_ent_t from the next block, and convert this
21164 		 * back to a normal bind_req.
21165 		 */
21166 		if (mp->b_cont != NULL) {
21167 		    ASSERT(MBLKL(mp->b_cont) >= sizeof (kssl_ent_t));
21168 
21169 			if (tcp->tcp_kssl_ent != NULL) {
21170 				kssl_release_ent(tcp->tcp_kssl_ent, NULL,
21171 				    KSSL_NO_PROXY);
21172 				tcp->tcp_kssl_ent = NULL;
21173 			}
21174 			bcopy(mp->b_cont->b_rptr, &tcp->tcp_kssl_ent,
21175 			    sizeof (kssl_ent_t));
21176 			kssl_hold_ent(tcp->tcp_kssl_ent);
21177 			freemsg(mp->b_cont);
21178 			mp->b_cont = NULL;
21179 		}
21180 		tprim->type = T_BIND_REQ;
21181 
21182 	/* FALLTHROUGH */
21183 	case O_T_BIND_REQ:	/* bind request */
21184 	case T_BIND_REQ:	/* new semantics bind request */
21185 		tcp_bind(tcp, mp);
21186 		break;
21187 	case T_UNBIND_REQ:	/* unbind request */
21188 		tcp_unbind(tcp, mp);
21189 		break;
21190 	case O_T_CONN_RES:	/* old connection response XXX */
21191 	case T_CONN_RES:	/* connection response */
21192 		tcp_accept(tcp, mp);
21193 		break;
21194 	case T_CONN_REQ:	/* connection request */
21195 		tcp_connect(tcp, mp);
21196 		break;
21197 	case T_DISCON_REQ:	/* disconnect request */
21198 		tcp_disconnect(tcp, mp);
21199 		break;
21200 	case T_CAPABILITY_REQ:
21201 		tcp_capability_req(tcp, mp);	/* capability request */
21202 		break;
21203 	case T_INFO_REQ:	/* information request */
21204 		tcp_info_req(tcp, mp);
21205 		break;
21206 	case T_SVR4_OPTMGMT_REQ:	/* manage options req */
21207 		/* Only IP is allowed to return meaningful value */
21208 		(void) svr4_optcom_req(tcp->tcp_wq, mp, cr, &tcp_opt_obj);
21209 		break;
21210 	case T_OPTMGMT_REQ:
21211 		/*
21212 		 * Note:  no support for snmpcom_req() through new
21213 		 * T_OPTMGMT_REQ. See comments in ip.c
21214 		 */
21215 		/* Only IP is allowed to return meaningful value */
21216 		(void) tpi_optcom_req(tcp->tcp_wq, mp, cr, &tcp_opt_obj);
21217 		break;
21218 
21219 	case T_UNITDATA_REQ:	/* unitdata request */
21220 		tcp_err_ack(tcp, mp, TNOTSUPPORT, 0);
21221 		break;
21222 	case T_ORDREL_REQ:	/* orderly release req */
21223 		freemsg(mp);
21224 
21225 		if (tcp->tcp_fused)
21226 			tcp_unfuse(tcp);
21227 
21228 		if (tcp_xmit_end(tcp) != 0) {
21229 			/*
21230 			 * We were crossing FINs and got a reset from
21231 			 * the other side. Just ignore it.
21232 			 */
21233 			if (tcp->tcp_debug) {
21234 				(void) strlog(TCP_MOD_ID, 0, 1,
21235 				    SL_ERROR|SL_TRACE,
21236 				    "tcp_wput_proto, T_ORDREL_REQ out of "
21237 				    "state %s",
21238 				    tcp_display(tcp, NULL,
21239 				    DISP_ADDR_AND_PORT));
21240 			}
21241 		}
21242 		break;
21243 	case T_ADDR_REQ:
21244 		tcp_addr_req(tcp, mp);
21245 		break;
21246 	default:
21247 		if (tcp->tcp_debug) {
21248 			(void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
21249 			    "tcp_wput_proto, bogus TPI msg, type %d",
21250 			    tprim->type);
21251 		}
21252 		/*
21253 		 * We used to M_ERROR.  Sending TNOTSUPPORT gives the user
21254 		 * to recover.
21255 		 */
21256 		tcp_err_ack(tcp, mp, TNOTSUPPORT, 0);
21257 		break;
21258 	}
21259 }
21260 
21261 /*
21262  * The TCP write service routine should never be called...
21263  */
21264 /* ARGSUSED */
21265 static void
21266 tcp_wsrv(queue_t *q)
21267 {
21268 	TCP_STAT(tcp_wsrv_called);
21269 }
21270 
21271 /* Non overlapping byte exchanger */
21272 static void
21273 tcp_xchg(uchar_t *a, uchar_t *b, int len)
21274 {
21275 	uchar_t	uch;
21276 
21277 	while (len-- > 0) {
21278 		uch = a[len];
21279 		a[len] = b[len];
21280 		b[len] = uch;
21281 	}
21282 }
21283 
21284 /*
21285  * Send out a control packet on the tcp connection specified.  This routine
21286  * is typically called where we need a simple ACK or RST generated.
21287  */
21288 static void
21289 tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, uint32_t ack, int ctl)
21290 {
21291 	uchar_t		*rptr;
21292 	tcph_t		*tcph;
21293 	ipha_t		*ipha = NULL;
21294 	ip6_t		*ip6h = NULL;
21295 	uint32_t	sum;
21296 	int		tcp_hdr_len;
21297 	int		tcp_ip_hdr_len;
21298 	mblk_t		*mp;
21299 
21300 	/*
21301 	 * Save sum for use in source route later.
21302 	 */
21303 	ASSERT(tcp != NULL);
21304 	sum = tcp->tcp_tcp_hdr_len + tcp->tcp_sum;
21305 	tcp_hdr_len = tcp->tcp_hdr_len;
21306 	tcp_ip_hdr_len = tcp->tcp_ip_hdr_len;
21307 
21308 	/* If a text string is passed in with the request, pass it to strlog. */
21309 	if (str != NULL && tcp->tcp_debug) {
21310 		(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
21311 		    "tcp_xmit_ctl: '%s', seq 0x%x, ack 0x%x, ctl 0x%x",
21312 		    str, seq, ack, ctl);
21313 	}
21314 	mp = allocb(tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra,
21315 	    BPRI_MED);
21316 	if (mp == NULL) {
21317 		return;
21318 	}
21319 	rptr = &mp->b_rptr[tcp_wroff_xtra];
21320 	mp->b_rptr = rptr;
21321 	mp->b_wptr = &rptr[tcp_hdr_len];
21322 	bcopy(tcp->tcp_iphc, rptr, tcp_hdr_len);
21323 
21324 	if (tcp->tcp_ipversion == IPV4_VERSION) {
21325 		ipha = (ipha_t *)rptr;
21326 		ipha->ipha_length = htons(tcp_hdr_len);
21327 	} else {
21328 		ip6h = (ip6_t *)rptr;
21329 		ASSERT(tcp != NULL);
21330 		ip6h->ip6_plen = htons(tcp->tcp_hdr_len -
21331 		    ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc));
21332 	}
21333 	tcph = (tcph_t *)&rptr[tcp_ip_hdr_len];
21334 	tcph->th_flags[0] = (uint8_t)ctl;
21335 	if (ctl & TH_RST) {
21336 		BUMP_MIB(&tcp_mib, tcpOutRsts);
21337 		BUMP_MIB(&tcp_mib, tcpOutControl);
21338 		/*
21339 		 * Don't send TSopt w/ TH_RST packets per RFC 1323.
21340 		 */
21341 		if (tcp->tcp_snd_ts_ok &&
21342 		    tcp->tcp_state > TCPS_SYN_SENT) {
21343 			mp->b_wptr = &rptr[tcp_hdr_len - TCPOPT_REAL_TS_LEN];
21344 			*(mp->b_wptr) = TCPOPT_EOL;
21345 			if (tcp->tcp_ipversion == IPV4_VERSION) {
21346 				ipha->ipha_length = htons(tcp_hdr_len -
21347 				    TCPOPT_REAL_TS_LEN);
21348 			} else {
21349 				ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) -
21350 				    TCPOPT_REAL_TS_LEN);
21351 			}
21352 			tcph->th_offset_and_rsrvd[0] -= (3 << 4);
21353 			sum -= TCPOPT_REAL_TS_LEN;
21354 		}
21355 	}
21356 	if (ctl & TH_ACK) {
21357 		if (tcp->tcp_snd_ts_ok) {
21358 			U32_TO_BE32(lbolt,
21359 			    (char *)tcph+TCP_MIN_HEADER_LENGTH+4);
21360 			U32_TO_BE32(tcp->tcp_ts_recent,
21361 			    (char *)tcph+TCP_MIN_HEADER_LENGTH+8);
21362 		}
21363 
21364 		/* Update the latest receive window size in TCP header. */
21365 		U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws,
21366 		    tcph->th_win);
21367 		tcp->tcp_rack = ack;
21368 		tcp->tcp_rack_cnt = 0;
21369 		BUMP_MIB(&tcp_mib, tcpOutAck);
21370 	}
21371 	BUMP_LOCAL(tcp->tcp_obsegs);
21372 	U32_TO_BE32(seq, tcph->th_seq);
21373 	U32_TO_BE32(ack, tcph->th_ack);
21374 	/*
21375 	 * Include the adjustment for a source route if any.
21376 	 */
21377 	sum = (sum >> 16) + (sum & 0xFFFF);
21378 	U16_TO_BE16(sum, tcph->th_sum);
21379 	TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT);
21380 	tcp_send_data(tcp, tcp->tcp_wq, mp);
21381 }
21382 
21383 /*
21384  * If this routine returns B_TRUE, TCP can generate a RST in response
21385  * to a segment.  If it returns B_FALSE, TCP should not respond.
21386  */
21387 static boolean_t
21388 tcp_send_rst_chk(void)
21389 {
21390 	clock_t	now;
21391 
21392 	/*
21393 	 * TCP needs to protect itself from generating too many RSTs.
21394 	 * This can be a DoS attack by sending us random segments
21395 	 * soliciting RSTs.
21396 	 *
21397 	 * What we do here is to have a limit of tcp_rst_sent_rate RSTs
21398 	 * in each 1 second interval.  In this way, TCP still generate
21399 	 * RSTs in normal cases but when under attack, the impact is
21400 	 * limited.
21401 	 */
21402 	if (tcp_rst_sent_rate_enabled != 0) {
21403 		now = lbolt;
21404 		/* lbolt can wrap around. */
21405 		if ((tcp_last_rst_intrvl > now) ||
21406 		    (TICK_TO_MSEC(now - tcp_last_rst_intrvl) > 1*SECONDS)) {
21407 			tcp_last_rst_intrvl = now;
21408 			tcp_rst_cnt = 1;
21409 		} else if (++tcp_rst_cnt > tcp_rst_sent_rate) {
21410 			return (B_FALSE);
21411 		}
21412 	}
21413 	return (B_TRUE);
21414 }
21415 
21416 /*
21417  * Send down the advice IP ioctl to tell IP to mark an IRE temporary.
21418  */
21419 static void
21420 tcp_ip_ire_mark_advice(tcp_t *tcp)
21421 {
21422 	mblk_t *mp;
21423 	ipic_t *ipic;
21424 
21425 	if (tcp->tcp_ipversion == IPV4_VERSION) {
21426 		mp = tcp_ip_advise_mblk(&tcp->tcp_ipha->ipha_dst, IP_ADDR_LEN,
21427 		    &ipic);
21428 	} else {
21429 		mp = tcp_ip_advise_mblk(&tcp->tcp_ip6h->ip6_dst, IPV6_ADDR_LEN,
21430 		    &ipic);
21431 	}
21432 	if (mp == NULL)
21433 		return;
21434 	ipic->ipic_ire_marks |= IRE_MARK_TEMPORARY;
21435 	CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp);
21436 }
21437 
21438 /*
21439  * Return an IP advice ioctl mblk and set ipic to be the pointer
21440  * to the advice structure.
21441  */
21442 static mblk_t *
21443 tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic)
21444 {
21445 	struct iocblk *ioc;
21446 	mblk_t *mp, *mp1;
21447 
21448 	mp = allocb(sizeof (ipic_t) + addr_len, BPRI_HI);
21449 	if (mp == NULL)
21450 		return (NULL);
21451 	bzero(mp->b_rptr, sizeof (ipic_t) + addr_len);
21452 	*ipic = (ipic_t *)mp->b_rptr;
21453 	(*ipic)->ipic_cmd = IP_IOC_IRE_ADVISE_NO_REPLY;
21454 	(*ipic)->ipic_addr_offset = sizeof (ipic_t);
21455 
21456 	bcopy(addr, *ipic + 1, addr_len);
21457 
21458 	(*ipic)->ipic_addr_length = addr_len;
21459 	mp->b_wptr = &mp->b_rptr[sizeof (ipic_t) + addr_len];
21460 
21461 	mp1 = mkiocb(IP_IOCTL);
21462 	if (mp1 == NULL) {
21463 		freemsg(mp);
21464 		return (NULL);
21465 	}
21466 	mp1->b_cont = mp;
21467 	ioc = (struct iocblk *)mp1->b_rptr;
21468 	ioc->ioc_count = sizeof (ipic_t) + addr_len;
21469 
21470 	return (mp1);
21471 }
21472 
21473 /*
21474  * Generate a reset based on an inbound packet for which there is no active
21475  * tcp state that we can find.
21476  *
21477  * IPSEC NOTE : Try to send the reply with the same protection as it came
21478  * in.  We still have the ipsec_mp that the packet was attached to. Thus
21479  * the packet will go out at the same level of protection as it came in by
21480  * converting the IPSEC_IN to IPSEC_OUT.
21481  */
21482 static void
21483 tcp_xmit_early_reset(char *str, mblk_t *mp, uint32_t seq,
21484     uint32_t ack, int ctl, uint_t ip_hdr_len, zoneid_t zoneid)
21485 {
21486 	ipha_t		*ipha = NULL;
21487 	ip6_t		*ip6h = NULL;
21488 	ushort_t	len;
21489 	tcph_t		*tcph;
21490 	int		i;
21491 	mblk_t		*ipsec_mp;
21492 	boolean_t	mctl_present;
21493 	ipic_t		*ipic;
21494 	ipaddr_t	v4addr;
21495 	in6_addr_t	v6addr;
21496 	int		addr_len;
21497 	void		*addr;
21498 	queue_t		*q = tcp_g_q;
21499 	tcp_t		*tcp = Q_TO_TCP(q);
21500 	cred_t		*cr;
21501 	mblk_t		*nmp;
21502 
21503 	if (!tcp_send_rst_chk()) {
21504 		tcp_rst_unsent++;
21505 		freemsg(mp);
21506 		return;
21507 	}
21508 
21509 	if (mp->b_datap->db_type == M_CTL) {
21510 		ipsec_mp = mp;
21511 		mp = mp->b_cont;
21512 		mctl_present = B_TRUE;
21513 	} else {
21514 		ipsec_mp = mp;
21515 		mctl_present = B_FALSE;
21516 	}
21517 
21518 	if (str && q && tcp_dbg) {
21519 		(void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
21520 		    "tcp_xmit_early_reset: '%s', seq 0x%x, ack 0x%x, "
21521 		    "flags 0x%x",
21522 		    str, seq, ack, ctl);
21523 	}
21524 	if (mp->b_datap->db_ref != 1) {
21525 		mblk_t *mp1 = copyb(mp);
21526 		freemsg(mp);
21527 		mp = mp1;
21528 		if (!mp) {
21529 			if (mctl_present)
21530 				freeb(ipsec_mp);
21531 			return;
21532 		} else {
21533 			if (mctl_present) {
21534 				ipsec_mp->b_cont = mp;
21535 			} else {
21536 				ipsec_mp = mp;
21537 			}
21538 		}
21539 	} else if (mp->b_cont) {
21540 		freemsg(mp->b_cont);
21541 		mp->b_cont = NULL;
21542 	}
21543 	/*
21544 	 * We skip reversing source route here.
21545 	 * (for now we replace all IP options with EOL)
21546 	 */
21547 	if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
21548 		ipha = (ipha_t *)mp->b_rptr;
21549 		for (i = IP_SIMPLE_HDR_LENGTH; i < (int)ip_hdr_len; i++)
21550 			mp->b_rptr[i] = IPOPT_EOL;
21551 		/*
21552 		 * Make sure that src address isn't flagrantly invalid.
21553 		 * Not all broadcast address checking for the src address
21554 		 * is possible, since we don't know the netmask of the src
21555 		 * addr.  No check for destination address is done, since
21556 		 * IP will not pass up a packet with a broadcast dest
21557 		 * address to TCP.  Similar checks are done below for IPv6.
21558 		 */
21559 		if (ipha->ipha_src == 0 || ipha->ipha_src == INADDR_BROADCAST ||
21560 		    CLASSD(ipha->ipha_src)) {
21561 			freemsg(ipsec_mp);
21562 			BUMP_MIB(&ip_mib, ipInDiscards);
21563 			return;
21564 		}
21565 	} else {
21566 		ip6h = (ip6_t *)mp->b_rptr;
21567 
21568 		if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) ||
21569 		    IN6_IS_ADDR_MULTICAST(&ip6h->ip6_src)) {
21570 			freemsg(ipsec_mp);
21571 			BUMP_MIB(&ip6_mib, ipv6InDiscards);
21572 			return;
21573 		}
21574 
21575 		/* Remove any extension headers assuming partial overlay */
21576 		if (ip_hdr_len > IPV6_HDR_LEN) {
21577 			uint8_t *to;
21578 
21579 			to = mp->b_rptr + ip_hdr_len - IPV6_HDR_LEN;
21580 			ovbcopy(ip6h, to, IPV6_HDR_LEN);
21581 			mp->b_rptr += ip_hdr_len - IPV6_HDR_LEN;
21582 			ip_hdr_len = IPV6_HDR_LEN;
21583 			ip6h = (ip6_t *)mp->b_rptr;
21584 			ip6h->ip6_nxt = IPPROTO_TCP;
21585 		}
21586 	}
21587 	tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len];
21588 	if (tcph->th_flags[0] & TH_RST) {
21589 		freemsg(ipsec_mp);
21590 		return;
21591 	}
21592 	tcph->th_offset_and_rsrvd[0] = (5 << 4);
21593 	len = ip_hdr_len + sizeof (tcph_t);
21594 	mp->b_wptr = &mp->b_rptr[len];
21595 	if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
21596 		ipha->ipha_length = htons(len);
21597 		/* Swap addresses */
21598 		v4addr = ipha->ipha_src;
21599 		ipha->ipha_src = ipha->ipha_dst;
21600 		ipha->ipha_dst = v4addr;
21601 		ipha->ipha_ident = 0;
21602 		ipha->ipha_ttl = (uchar_t)tcp_ipv4_ttl;
21603 		addr_len = IP_ADDR_LEN;
21604 		addr = &v4addr;
21605 	} else {
21606 		/* No ip6i_t in this case */
21607 		ip6h->ip6_plen = htons(len - IPV6_HDR_LEN);
21608 		/* Swap addresses */
21609 		v6addr = ip6h->ip6_src;
21610 		ip6h->ip6_src = ip6h->ip6_dst;
21611 		ip6h->ip6_dst = v6addr;
21612 		ip6h->ip6_hops = (uchar_t)tcp_ipv6_hoplimit;
21613 		addr_len = IPV6_ADDR_LEN;
21614 		addr = &v6addr;
21615 	}
21616 	tcp_xchg(tcph->th_fport, tcph->th_lport, 2);
21617 	U32_TO_BE32(ack, tcph->th_ack);
21618 	U32_TO_BE32(seq, tcph->th_seq);
21619 	U16_TO_BE16(0, tcph->th_win);
21620 	U16_TO_BE16(sizeof (tcph_t), tcph->th_sum);
21621 	tcph->th_flags[0] = (uint8_t)ctl;
21622 	if (ctl & TH_RST) {
21623 		BUMP_MIB(&tcp_mib, tcpOutRsts);
21624 		BUMP_MIB(&tcp_mib, tcpOutControl);
21625 	}
21626 
21627 	/* IP trusts us to set up labels when required. */
21628 	if (is_system_labeled() && (cr = DB_CRED(mp)) != NULL &&
21629 	    crgetlabel(cr) != NULL) {
21630 		int err, adjust;
21631 
21632 		if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION)
21633 			err = tsol_check_label(cr, &mp, &adjust,
21634 			    tcp->tcp_connp->conn_mac_exempt);
21635 		else
21636 			err = tsol_check_label_v6(cr, &mp, &adjust,
21637 			    tcp->tcp_connp->conn_mac_exempt);
21638 		if (mctl_present)
21639 			ipsec_mp->b_cont = mp;
21640 		else
21641 			ipsec_mp = mp;
21642 		if (err != 0) {
21643 			freemsg(ipsec_mp);
21644 			return;
21645 		}
21646 		if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
21647 			ipha = (ipha_t *)mp->b_rptr;
21648 			adjust += ntohs(ipha->ipha_length);
21649 			ipha->ipha_length = htons(adjust);
21650 		} else {
21651 			ip6h = (ip6_t *)mp->b_rptr;
21652 		}
21653 	}
21654 
21655 	if (mctl_present) {
21656 		ipsec_in_t *ii = (ipsec_in_t *)ipsec_mp->b_rptr;
21657 
21658 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
21659 		if (!ipsec_in_to_out(ipsec_mp, ipha, ip6h)) {
21660 			return;
21661 		}
21662 	}
21663 	if (zoneid == ALL_ZONES)
21664 		zoneid = GLOBAL_ZONEID;
21665 
21666 	/* Add the zoneid so ip_output routes it properly */
21667 	if ((nmp = ip_prepend_zoneid(ipsec_mp, zoneid)) == NULL) {
21668 		freemsg(ipsec_mp);
21669 		return;
21670 	}
21671 	ipsec_mp = nmp;
21672 
21673 	/*
21674 	 * NOTE:  one might consider tracing a TCP packet here, but
21675 	 * this function has no active TCP state and no tcp structure
21676 	 * that has a trace buffer.  If we traced here, we would have
21677 	 * to keep a local trace buffer in tcp_record_trace().
21678 	 *
21679 	 * TSol note: The mblk that contains the incoming packet was
21680 	 * reused by tcp_xmit_listener_reset, so it already contains
21681 	 * the right credentials and we don't need to call mblk_setcred.
21682 	 * Also the conn's cred is not right since it is associated
21683 	 * with tcp_g_q.
21684 	 */
21685 	CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, ipsec_mp);
21686 
21687 	/*
21688 	 * Tell IP to mark the IRE used for this destination temporary.
21689 	 * This way, we can limit our exposure to DoS attack because IP
21690 	 * creates an IRE for each destination.  If there are too many,
21691 	 * the time to do any routing lookup will be extremely long.  And
21692 	 * the lookup can be in interrupt context.
21693 	 *
21694 	 * Note that in normal circumstances, this marking should not
21695 	 * affect anything.  It would be nice if only 1 message is
21696 	 * needed to inform IP that the IRE created for this RST should
21697 	 * not be added to the cache table.  But there is currently
21698 	 * not such communication mechanism between TCP and IP.  So
21699 	 * the best we can do now is to send the advice ioctl to IP
21700 	 * to mark the IRE temporary.
21701 	 */
21702 	if ((mp = tcp_ip_advise_mblk(addr, addr_len, &ipic)) != NULL) {
21703 		ipic->ipic_ire_marks |= IRE_MARK_TEMPORARY;
21704 		CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp);
21705 	}
21706 }
21707 
21708 /*
21709  * Initiate closedown sequence on an active connection.  (May be called as
21710  * writer.)  Return value zero for OK return, non-zero for error return.
21711  */
21712 static int
21713 tcp_xmit_end(tcp_t *tcp)
21714 {
21715 	ipic_t	*ipic;
21716 	mblk_t	*mp;
21717 
21718 	if (tcp->tcp_state < TCPS_SYN_RCVD ||
21719 	    tcp->tcp_state > TCPS_CLOSE_WAIT) {
21720 		/*
21721 		 * Invalid state, only states TCPS_SYN_RCVD,
21722 		 * TCPS_ESTABLISHED and TCPS_CLOSE_WAIT are valid
21723 		 */
21724 		return (-1);
21725 	}
21726 
21727 	tcp->tcp_fss = tcp->tcp_snxt + tcp->tcp_unsent;
21728 	tcp->tcp_valid_bits |= TCP_FSS_VALID;
21729 	/*
21730 	 * If there is nothing more unsent, send the FIN now.
21731 	 * Otherwise, it will go out with the last segment.
21732 	 */
21733 	if (tcp->tcp_unsent == 0) {
21734 		mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL,
21735 		    tcp->tcp_fss, B_FALSE, NULL, B_FALSE);
21736 
21737 		if (mp) {
21738 			TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT);
21739 			tcp_send_data(tcp, tcp->tcp_wq, mp);
21740 		} else {
21741 			/*
21742 			 * Couldn't allocate msg.  Pretend we got it out.
21743 			 * Wait for rexmit timeout.
21744 			 */
21745 			tcp->tcp_snxt = tcp->tcp_fss + 1;
21746 			TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
21747 		}
21748 
21749 		/*
21750 		 * If needed, update tcp_rexmit_snxt as tcp_snxt is
21751 		 * changed.
21752 		 */
21753 		if (tcp->tcp_rexmit && tcp->tcp_rexmit_nxt == tcp->tcp_fss) {
21754 			tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
21755 		}
21756 	} else {
21757 		/*
21758 		 * If tcp->tcp_cork is set, then the data will not get sent,
21759 		 * so we have to check that and unset it first.
21760 		 */
21761 		if (tcp->tcp_cork)
21762 			tcp->tcp_cork = B_FALSE;
21763 		tcp_wput_data(tcp, NULL, B_FALSE);
21764 	}
21765 
21766 	/*
21767 	 * If TCP does not get enough samples of RTT or tcp_rtt_updates
21768 	 * is 0, don't update the cache.
21769 	 */
21770 	if (tcp_rtt_updates == 0 || tcp->tcp_rtt_update < tcp_rtt_updates)
21771 		return (0);
21772 
21773 	/*
21774 	 * NOTE: should not update if source routes i.e. if tcp_remote if
21775 	 * different from the destination.
21776 	 */
21777 	if (tcp->tcp_ipversion == IPV4_VERSION) {
21778 		if (tcp->tcp_remote !=  tcp->tcp_ipha->ipha_dst) {
21779 			return (0);
21780 		}
21781 		mp = tcp_ip_advise_mblk(&tcp->tcp_ipha->ipha_dst, IP_ADDR_LEN,
21782 		    &ipic);
21783 	} else {
21784 		if (!(IN6_ARE_ADDR_EQUAL(&tcp->tcp_remote_v6,
21785 		    &tcp->tcp_ip6h->ip6_dst))) {
21786 			return (0);
21787 		}
21788 		mp = tcp_ip_advise_mblk(&tcp->tcp_ip6h->ip6_dst, IPV6_ADDR_LEN,
21789 		    &ipic);
21790 	}
21791 
21792 	/* Record route attributes in the IRE for use by future connections. */
21793 	if (mp == NULL)
21794 		return (0);
21795 
21796 	/*
21797 	 * We do not have a good algorithm to update ssthresh at this time.
21798 	 * So don't do any update.
21799 	 */
21800 	ipic->ipic_rtt = tcp->tcp_rtt_sa;
21801 	ipic->ipic_rtt_sd = tcp->tcp_rtt_sd;
21802 
21803 	CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp);
21804 	return (0);
21805 }
21806 
21807 /*
21808  * Generate a "no listener here" RST in response to an "unknown" segment.
21809  * Note that we are reusing the incoming mp to construct the outgoing
21810  * RST.
21811  */
21812 void
21813 tcp_xmit_listeners_reset(mblk_t *mp, uint_t ip_hdr_len, zoneid_t zoneid)
21814 {
21815 	uchar_t		*rptr;
21816 	uint32_t	seg_len;
21817 	tcph_t		*tcph;
21818 	uint32_t	seg_seq;
21819 	uint32_t	seg_ack;
21820 	uint_t		flags;
21821 	mblk_t		*ipsec_mp;
21822 	ipha_t 		*ipha;
21823 	ip6_t 		*ip6h;
21824 	boolean_t	mctl_present = B_FALSE;
21825 	boolean_t	check = B_TRUE;
21826 	boolean_t	policy_present;
21827 
21828 	TCP_STAT(tcp_no_listener);
21829 
21830 	ipsec_mp = mp;
21831 
21832 	if (mp->b_datap->db_type == M_CTL) {
21833 		ipsec_in_t *ii;
21834 
21835 		mctl_present = B_TRUE;
21836 		mp = mp->b_cont;
21837 
21838 		ii = (ipsec_in_t *)ipsec_mp->b_rptr;
21839 		ASSERT(ii->ipsec_in_type == IPSEC_IN);
21840 		if (ii->ipsec_in_dont_check) {
21841 			check = B_FALSE;
21842 			if (!ii->ipsec_in_secure) {
21843 				freeb(ipsec_mp);
21844 				mctl_present = B_FALSE;
21845 				ipsec_mp = mp;
21846 			}
21847 		}
21848 	}
21849 
21850 	if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) {
21851 		policy_present = ipsec_inbound_v4_policy_present;
21852 		ipha = (ipha_t *)mp->b_rptr;
21853 		ip6h = NULL;
21854 	} else {
21855 		policy_present = ipsec_inbound_v6_policy_present;
21856 		ipha = NULL;
21857 		ip6h = (ip6_t *)mp->b_rptr;
21858 	}
21859 
21860 	if (check && policy_present) {
21861 		/*
21862 		 * The conn_t parameter is NULL because we already know
21863 		 * nobody's home.
21864 		 */
21865 		ipsec_mp = ipsec_check_global_policy(
21866 			ipsec_mp, (conn_t *)NULL, ipha, ip6h, mctl_present);
21867 		if (ipsec_mp == NULL)
21868 			return;
21869 	}
21870 	if (is_system_labeled() && !tsol_can_reply_error(mp)) {
21871 		DTRACE_PROBE2(
21872 		    tx__ip__log__error__nolistener__tcp,
21873 		    char *, "Could not reply with RST to mp(1)",
21874 		    mblk_t *, mp);
21875 		ip2dbg(("tcp_xmit_listeners_reset: not permitted to reply\n"));
21876 		freemsg(ipsec_mp);
21877 		return;
21878 	}
21879 
21880 	rptr = mp->b_rptr;
21881 
21882 	tcph = (tcph_t *)&rptr[ip_hdr_len];
21883 	seg_seq = BE32_TO_U32(tcph->th_seq);
21884 	seg_ack = BE32_TO_U32(tcph->th_ack);
21885 	flags = tcph->th_flags[0];
21886 
21887 	seg_len = msgdsize(mp) - (TCP_HDR_LENGTH(tcph) + ip_hdr_len);
21888 	if (flags & TH_RST) {
21889 		freemsg(ipsec_mp);
21890 	} else if (flags & TH_ACK) {
21891 		tcp_xmit_early_reset("no tcp, reset",
21892 		    ipsec_mp, seg_ack, 0, TH_RST, ip_hdr_len, zoneid);
21893 	} else {
21894 		if (flags & TH_SYN) {
21895 			seg_len++;
21896 		} else {
21897 			/*
21898 			 * Here we violate the RFC.  Note that a normal
21899 			 * TCP will never send a segment without the ACK
21900 			 * flag, except for RST or SYN segment.  This
21901 			 * segment is neither.  Just drop it on the
21902 			 * floor.
21903 			 */
21904 			freemsg(ipsec_mp);
21905 			tcp_rst_unsent++;
21906 			return;
21907 		}
21908 
21909 		tcp_xmit_early_reset("no tcp, reset/ack",
21910 		    ipsec_mp, 0, seg_seq + seg_len,
21911 		    TH_RST | TH_ACK, ip_hdr_len, zoneid);
21912 	}
21913 }
21914 
21915 /*
21916  * tcp_xmit_mp is called to return a pointer to an mblk chain complete with
21917  * ip and tcp header ready to pass down to IP.  If the mp passed in is
21918  * non-NULL, then up to max_to_send bytes of data will be dup'ed off that
21919  * mblk. (If sendall is not set the dup'ing will stop at an mblk boundary
21920  * otherwise it will dup partial mblks.)
21921  * Otherwise, an appropriate ACK packet will be generated.  This
21922  * routine is not usually called to send new data for the first time.  It
21923  * is mostly called out of the timer for retransmits, and to generate ACKs.
21924  *
21925  * If offset is not NULL, the returned mblk chain's first mblk's b_rptr will
21926  * be adjusted by *offset.  And after dupb(), the offset and the ending mblk
21927  * of the original mblk chain will be returned in *offset and *end_mp.
21928  */
21929 static mblk_t *
21930 tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, int32_t *offset,
21931     mblk_t **end_mp, uint32_t seq, boolean_t sendall, uint32_t *seg_len,
21932     boolean_t rexmit)
21933 {
21934 	int	data_length;
21935 	int32_t	off = 0;
21936 	uint_t	flags;
21937 	mblk_t	*mp1;
21938 	mblk_t	*mp2;
21939 	uchar_t	*rptr;
21940 	tcph_t	*tcph;
21941 	int32_t	num_sack_blk = 0;
21942 	int32_t	sack_opt_len = 0;
21943 
21944 	/* Allocate for our maximum TCP header + link-level */
21945 	mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra,
21946 	    BPRI_MED);
21947 	if (!mp1)
21948 		return (NULL);
21949 	data_length = 0;
21950 
21951 	/*
21952 	 * Note that tcp_mss has been adjusted to take into account the
21953 	 * timestamp option if applicable.  Because SACK options do not
21954 	 * appear in every TCP segments and they are of variable lengths,
21955 	 * they cannot be included in tcp_mss.  Thus we need to calculate
21956 	 * the actual segment length when we need to send a segment which
21957 	 * includes SACK options.
21958 	 */
21959 	if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
21960 		num_sack_blk = MIN(tcp->tcp_max_sack_blk,
21961 		    tcp->tcp_num_sack_blk);
21962 		sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
21963 		    TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
21964 		if (max_to_send + sack_opt_len > tcp->tcp_mss)
21965 			max_to_send -= sack_opt_len;
21966 	}
21967 
21968 	if (offset != NULL) {
21969 		off = *offset;
21970 		/* We use offset as an indicator that end_mp is not NULL. */
21971 		*end_mp = NULL;
21972 	}
21973 	for (mp2 = mp1; mp && data_length != max_to_send; mp = mp->b_cont) {
21974 		/* This could be faster with cooperation from downstream */
21975 		if (mp2 != mp1 && !sendall &&
21976 		    data_length + (int)(mp->b_wptr - mp->b_rptr) >
21977 		    max_to_send)
21978 			/*
21979 			 * Don't send the next mblk since the whole mblk
21980 			 * does not fit.
21981 			 */
21982 			break;
21983 		mp2->b_cont = dupb(mp);
21984 		mp2 = mp2->b_cont;
21985 		if (!mp2) {
21986 			freemsg(mp1);
21987 			return (NULL);
21988 		}
21989 		mp2->b_rptr += off;
21990 		ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
21991 		    (uintptr_t)INT_MAX);
21992 
21993 		data_length += (int)(mp2->b_wptr - mp2->b_rptr);
21994 		if (data_length > max_to_send) {
21995 			mp2->b_wptr -= data_length - max_to_send;
21996 			data_length = max_to_send;
21997 			off = mp2->b_wptr - mp->b_rptr;
21998 			break;
21999 		} else {
22000 			off = 0;
22001 		}
22002 	}
22003 	if (offset != NULL) {
22004 		*offset = off;
22005 		*end_mp = mp;
22006 	}
22007 	if (seg_len != NULL) {
22008 		*seg_len = data_length;
22009 	}
22010 
22011 	/* Update the latest receive window size in TCP header. */
22012 	U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws,
22013 	    tcp->tcp_tcph->th_win);
22014 
22015 	rptr = mp1->b_rptr + tcp_wroff_xtra;
22016 	mp1->b_rptr = rptr;
22017 	mp1->b_wptr = rptr + tcp->tcp_hdr_len + sack_opt_len;
22018 	bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len);
22019 	tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len];
22020 	U32_TO_ABE32(seq, tcph->th_seq);
22021 
22022 	/*
22023 	 * Use tcp_unsent to determine if the PUSH bit should be used assumes
22024 	 * that this function was called from tcp_wput_data. Thus, when called
22025 	 * to retransmit data the setting of the PUSH bit may appear some
22026 	 * what random in that it might get set when it should not. This
22027 	 * should not pose any performance issues.
22028 	 */
22029 	if (data_length != 0 && (tcp->tcp_unsent == 0 ||
22030 	    tcp->tcp_unsent == data_length)) {
22031 		flags = TH_ACK | TH_PUSH;
22032 	} else {
22033 		flags = TH_ACK;
22034 	}
22035 
22036 	if (tcp->tcp_ecn_ok) {
22037 		if (tcp->tcp_ecn_echo_on)
22038 			flags |= TH_ECE;
22039 
22040 		/*
22041 		 * Only set ECT bit and ECN_CWR if a segment contains new data.
22042 		 * There is no TCP flow control for non-data segments, and
22043 		 * only data segment is transmitted reliably.
22044 		 */
22045 		if (data_length > 0 && !rexmit) {
22046 			SET_ECT(tcp, rptr);
22047 			if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) {
22048 				flags |= TH_CWR;
22049 				tcp->tcp_ecn_cwr_sent = B_TRUE;
22050 			}
22051 		}
22052 	}
22053 
22054 	if (tcp->tcp_valid_bits) {
22055 		uint32_t u1;
22056 
22057 		if ((tcp->tcp_valid_bits & TCP_ISS_VALID) &&
22058 		    seq == tcp->tcp_iss) {
22059 			uchar_t	*wptr;
22060 
22061 			/*
22062 			 * If TCP_ISS_VALID and the seq number is tcp_iss,
22063 			 * TCP can only be in SYN-SENT, SYN-RCVD or
22064 			 * FIN-WAIT-1 state.  It can be FIN-WAIT-1 if
22065 			 * our SYN is not ack'ed but the app closes this
22066 			 * TCP connection.
22067 			 */
22068 			ASSERT(tcp->tcp_state == TCPS_SYN_SENT ||
22069 			    tcp->tcp_state == TCPS_SYN_RCVD ||
22070 			    tcp->tcp_state == TCPS_FIN_WAIT_1);
22071 
22072 			/*
22073 			 * Tack on the MSS option.  It is always needed
22074 			 * for both active and passive open.
22075 			 *
22076 			 * MSS option value should be interface MTU - MIN
22077 			 * TCP/IP header according to RFC 793 as it means
22078 			 * the maximum segment size TCP can receive.  But
22079 			 * to get around some broken middle boxes/end hosts
22080 			 * out there, we allow the option value to be the
22081 			 * same as the MSS option size on the peer side.
22082 			 * In this way, the other side will not send
22083 			 * anything larger than they can receive.
22084 			 *
22085 			 * Note that for SYN_SENT state, the ndd param
22086 			 * tcp_use_smss_as_mss_opt has no effect as we
22087 			 * don't know the peer's MSS option value. So
22088 			 * the only case we need to take care of is in
22089 			 * SYN_RCVD state, which is done later.
22090 			 */
22091 			wptr = mp1->b_wptr;
22092 			wptr[0] = TCPOPT_MAXSEG;
22093 			wptr[1] = TCPOPT_MAXSEG_LEN;
22094 			wptr += 2;
22095 			u1 = tcp->tcp_if_mtu -
22096 			    (tcp->tcp_ipversion == IPV4_VERSION ?
22097 			    IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) -
22098 			    TCP_MIN_HEADER_LENGTH;
22099 			U16_TO_BE16(u1, wptr);
22100 			mp1->b_wptr = wptr + 2;
22101 			/* Update the offset to cover the additional word */
22102 			tcph->th_offset_and_rsrvd[0] += (1 << 4);
22103 
22104 			/*
22105 			 * Note that the following way of filling in
22106 			 * TCP options are not optimal.  Some NOPs can
22107 			 * be saved.  But there is no need at this time
22108 			 * to optimize it.  When it is needed, we will
22109 			 * do it.
22110 			 */
22111 			switch (tcp->tcp_state) {
22112 			case TCPS_SYN_SENT:
22113 				flags = TH_SYN;
22114 
22115 				if (tcp->tcp_snd_ts_ok) {
22116 					uint32_t llbolt = (uint32_t)lbolt;
22117 
22118 					wptr = mp1->b_wptr;
22119 					wptr[0] = TCPOPT_NOP;
22120 					wptr[1] = TCPOPT_NOP;
22121 					wptr[2] = TCPOPT_TSTAMP;
22122 					wptr[3] = TCPOPT_TSTAMP_LEN;
22123 					wptr += 4;
22124 					U32_TO_BE32(llbolt, wptr);
22125 					wptr += 4;
22126 					ASSERT(tcp->tcp_ts_recent == 0);
22127 					U32_TO_BE32(0L, wptr);
22128 					mp1->b_wptr += TCPOPT_REAL_TS_LEN;
22129 					tcph->th_offset_and_rsrvd[0] +=
22130 					    (3 << 4);
22131 				}
22132 
22133 				/*
22134 				 * Set up all the bits to tell other side
22135 				 * we are ECN capable.
22136 				 */
22137 				if (tcp->tcp_ecn_ok) {
22138 					flags |= (TH_ECE | TH_CWR);
22139 				}
22140 				break;
22141 			case TCPS_SYN_RCVD:
22142 				flags |= TH_SYN;
22143 
22144 				/*
22145 				 * Reset the MSS option value to be SMSS
22146 				 * We should probably add back the bytes
22147 				 * for timestamp option and IPsec.  We
22148 				 * don't do that as this is a workaround
22149 				 * for broken middle boxes/end hosts, it
22150 				 * is better for us to be more cautious.
22151 				 * They may not take these things into
22152 				 * account in their SMSS calculation.  Thus
22153 				 * the peer's calculated SMSS may be smaller
22154 				 * than what it can be.  This should be OK.
22155 				 */
22156 				if (tcp_use_smss_as_mss_opt) {
22157 					u1 = tcp->tcp_mss;
22158 					U16_TO_BE16(u1, wptr);
22159 				}
22160 
22161 				/*
22162 				 * If the other side is ECN capable, reply
22163 				 * that we are also ECN capable.
22164 				 */
22165 				if (tcp->tcp_ecn_ok)
22166 					flags |= TH_ECE;
22167 				break;
22168 			default:
22169 				/*
22170 				 * The above ASSERT() makes sure that this
22171 				 * must be FIN-WAIT-1 state.  Our SYN has
22172 				 * not been ack'ed so retransmit it.
22173 				 */
22174 				flags |= TH_SYN;
22175 				break;
22176 			}
22177 
22178 			if (tcp->tcp_snd_ws_ok) {
22179 				wptr = mp1->b_wptr;
22180 				wptr[0] =  TCPOPT_NOP;
22181 				wptr[1] =  TCPOPT_WSCALE;
22182 				wptr[2] =  TCPOPT_WS_LEN;
22183 				wptr[3] = (uchar_t)tcp->tcp_rcv_ws;
22184 				mp1->b_wptr += TCPOPT_REAL_WS_LEN;
22185 				tcph->th_offset_and_rsrvd[0] += (1 << 4);
22186 			}
22187 
22188 			if (tcp->tcp_snd_sack_ok) {
22189 				wptr = mp1->b_wptr;
22190 				wptr[0] = TCPOPT_NOP;
22191 				wptr[1] = TCPOPT_NOP;
22192 				wptr[2] = TCPOPT_SACK_PERMITTED;
22193 				wptr[3] = TCPOPT_SACK_OK_LEN;
22194 				mp1->b_wptr += TCPOPT_REAL_SACK_OK_LEN;
22195 				tcph->th_offset_and_rsrvd[0] += (1 << 4);
22196 			}
22197 
22198 			/* allocb() of adequate mblk assures space */
22199 			ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
22200 			    (uintptr_t)INT_MAX);
22201 			u1 = (int)(mp1->b_wptr - mp1->b_rptr);
22202 			/*
22203 			 * Get IP set to checksum on our behalf
22204 			 * Include the adjustment for a source route if any.
22205 			 */
22206 			u1 += tcp->tcp_sum;
22207 			u1 = (u1 >> 16) + (u1 & 0xFFFF);
22208 			U16_TO_BE16(u1, tcph->th_sum);
22209 			BUMP_MIB(&tcp_mib, tcpOutControl);
22210 		}
22211 		if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
22212 		    (seq + data_length) == tcp->tcp_fss) {
22213 			if (!tcp->tcp_fin_acked) {
22214 				flags |= TH_FIN;
22215 				BUMP_MIB(&tcp_mib, tcpOutControl);
22216 			}
22217 			if (!tcp->tcp_fin_sent) {
22218 				tcp->tcp_fin_sent = B_TRUE;
22219 				switch (tcp->tcp_state) {
22220 				case TCPS_SYN_RCVD:
22221 				case TCPS_ESTABLISHED:
22222 					tcp->tcp_state = TCPS_FIN_WAIT_1;
22223 					break;
22224 				case TCPS_CLOSE_WAIT:
22225 					tcp->tcp_state = TCPS_LAST_ACK;
22226 					break;
22227 				}
22228 				if (tcp->tcp_suna == tcp->tcp_snxt)
22229 					TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
22230 				tcp->tcp_snxt = tcp->tcp_fss + 1;
22231 			}
22232 		}
22233 		/*
22234 		 * Note the trick here.  u1 is unsigned.  When tcp_urg
22235 		 * is smaller than seq, u1 will become a very huge value.
22236 		 * So the comparison will fail.  Also note that tcp_urp
22237 		 * should be positive, see RFC 793 page 17.
22238 		 */
22239 		u1 = tcp->tcp_urg - seq + TCP_OLD_URP_INTERPRETATION;
22240 		if ((tcp->tcp_valid_bits & TCP_URG_VALID) && u1 != 0 &&
22241 		    u1 < (uint32_t)(64 * 1024)) {
22242 			flags |= TH_URG;
22243 			BUMP_MIB(&tcp_mib, tcpOutUrg);
22244 			U32_TO_ABE16(u1, tcph->th_urp);
22245 		}
22246 	}
22247 	tcph->th_flags[0] = (uchar_t)flags;
22248 	tcp->tcp_rack = tcp->tcp_rnxt;
22249 	tcp->tcp_rack_cnt = 0;
22250 
22251 	if (tcp->tcp_snd_ts_ok) {
22252 		if (tcp->tcp_state != TCPS_SYN_SENT) {
22253 			uint32_t llbolt = (uint32_t)lbolt;
22254 
22255 			U32_TO_BE32(llbolt,
22256 			    (char *)tcph+TCP_MIN_HEADER_LENGTH+4);
22257 			U32_TO_BE32(tcp->tcp_ts_recent,
22258 			    (char *)tcph+TCP_MIN_HEADER_LENGTH+8);
22259 		}
22260 	}
22261 
22262 	if (num_sack_blk > 0) {
22263 		uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len;
22264 		sack_blk_t *tmp;
22265 		int32_t	i;
22266 
22267 		wptr[0] = TCPOPT_NOP;
22268 		wptr[1] = TCPOPT_NOP;
22269 		wptr[2] = TCPOPT_SACK;
22270 		wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
22271 		    sizeof (sack_blk_t);
22272 		wptr += TCPOPT_REAL_SACK_LEN;
22273 
22274 		tmp = tcp->tcp_sack_list;
22275 		for (i = 0; i < num_sack_blk; i++) {
22276 			U32_TO_BE32(tmp[i].begin, wptr);
22277 			wptr += sizeof (tcp_seq);
22278 			U32_TO_BE32(tmp[i].end, wptr);
22279 			wptr += sizeof (tcp_seq);
22280 		}
22281 		tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1) << 4);
22282 	}
22283 	ASSERT((uintptr_t)(mp1->b_wptr - rptr) <= (uintptr_t)INT_MAX);
22284 	data_length += (int)(mp1->b_wptr - rptr);
22285 	if (tcp->tcp_ipversion == IPV4_VERSION) {
22286 		((ipha_t *)rptr)->ipha_length = htons(data_length);
22287 	} else {
22288 		ip6_t *ip6 = (ip6_t *)(rptr +
22289 		    (((ip6_t *)rptr)->ip6_nxt == IPPROTO_RAW ?
22290 		    sizeof (ip6i_t) : 0));
22291 
22292 		ip6->ip6_plen = htons(data_length -
22293 		    ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc));
22294 	}
22295 
22296 	/*
22297 	 * Prime pump for IP
22298 	 * Include the adjustment for a source route if any.
22299 	 */
22300 	data_length -= tcp->tcp_ip_hdr_len;
22301 	data_length += tcp->tcp_sum;
22302 	data_length = (data_length >> 16) + (data_length & 0xFFFF);
22303 	U16_TO_ABE16(data_length, tcph->th_sum);
22304 	if (tcp->tcp_ip_forward_progress) {
22305 		ASSERT(tcp->tcp_ipversion == IPV6_VERSION);
22306 		*(uint32_t *)mp1->b_rptr  |= IP_FORWARD_PROG;
22307 		tcp->tcp_ip_forward_progress = B_FALSE;
22308 	}
22309 	return (mp1);
22310 }
22311 
22312 /* This function handles the push timeout. */
22313 void
22314 tcp_push_timer(void *arg)
22315 {
22316 	conn_t	*connp = (conn_t *)arg;
22317 	tcp_t *tcp = connp->conn_tcp;
22318 
22319 	TCP_DBGSTAT(tcp_push_timer_cnt);
22320 
22321 	ASSERT(tcp->tcp_listener == NULL);
22322 
22323 	/*
22324 	 * We need to plug synchronous streams during our drain to prevent
22325 	 * a race with tcp_fuse_rrw() or tcp_fusion_rinfop().
22326 	 */
22327 	TCP_FUSE_SYNCSTR_PLUG_DRAIN(tcp);
22328 	tcp->tcp_push_tid = 0;
22329 	if ((tcp->tcp_rcv_list != NULL) &&
22330 	    (tcp_rcv_drain(tcp->tcp_rq, tcp) == TH_ACK_NEEDED))
22331 		tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
22332 	TCP_FUSE_SYNCSTR_UNPLUG_DRAIN(tcp);
22333 }
22334 
22335 /*
22336  * This function handles delayed ACK timeout.
22337  */
22338 static void
22339 tcp_ack_timer(void *arg)
22340 {
22341 	conn_t	*connp = (conn_t *)arg;
22342 	tcp_t *tcp = connp->conn_tcp;
22343 	mblk_t *mp;
22344 
22345 	TCP_DBGSTAT(tcp_ack_timer_cnt);
22346 
22347 	tcp->tcp_ack_tid = 0;
22348 
22349 	if (tcp->tcp_fused)
22350 		return;
22351 
22352 	/*
22353 	 * Do not send ACK if there is no outstanding unack'ed data.
22354 	 */
22355 	if (tcp->tcp_rnxt == tcp->tcp_rack) {
22356 		return;
22357 	}
22358 
22359 	if ((tcp->tcp_rnxt - tcp->tcp_rack) > tcp->tcp_mss) {
22360 		/*
22361 		 * Make sure we don't allow deferred ACKs to result in
22362 		 * timer-based ACKing.  If we have held off an ACK
22363 		 * when there was more than an mss here, and the timer
22364 		 * goes off, we have to worry about the possibility
22365 		 * that the sender isn't doing slow-start, or is out
22366 		 * of step with us for some other reason.  We fall
22367 		 * permanently back in the direction of
22368 		 * ACK-every-other-packet as suggested in RFC 1122.
22369 		 */
22370 		if (tcp->tcp_rack_abs_max > 2)
22371 			tcp->tcp_rack_abs_max--;
22372 		tcp->tcp_rack_cur_max = 2;
22373 	}
22374 	mp = tcp_ack_mp(tcp);
22375 
22376 	if (mp != NULL) {
22377 		TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT);
22378 		BUMP_LOCAL(tcp->tcp_obsegs);
22379 		BUMP_MIB(&tcp_mib, tcpOutAck);
22380 		BUMP_MIB(&tcp_mib, tcpOutAckDelayed);
22381 		tcp_send_data(tcp, tcp->tcp_wq, mp);
22382 	}
22383 }
22384 
22385 
22386 /* Generate an ACK-only (no data) segment for a TCP endpoint */
22387 static mblk_t *
22388 tcp_ack_mp(tcp_t *tcp)
22389 {
22390 	uint32_t	seq_no;
22391 
22392 	/*
22393 	 * There are a few cases to be considered while setting the sequence no.
22394 	 * Essentially, we can come here while processing an unacceptable pkt
22395 	 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
22396 	 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
22397 	 * If we are here for a zero window probe, stick with suna. In all
22398 	 * other cases, we check if suna + swnd encompasses snxt and set
22399 	 * the sequence number to snxt, if so. If snxt falls outside the
22400 	 * window (the receiver probably shrunk its window), we will go with
22401 	 * suna + swnd, otherwise the sequence no will be unacceptable to the
22402 	 * receiver.
22403 	 */
22404 	if (tcp->tcp_zero_win_probe) {
22405 		seq_no = tcp->tcp_suna;
22406 	} else if (tcp->tcp_state == TCPS_SYN_RCVD) {
22407 		ASSERT(tcp->tcp_swnd == 0);
22408 		seq_no = tcp->tcp_snxt;
22409 	} else {
22410 		seq_no = SEQ_GT(tcp->tcp_snxt,
22411 		    (tcp->tcp_suna + tcp->tcp_swnd)) ?
22412 		    (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
22413 	}
22414 
22415 	if (tcp->tcp_valid_bits) {
22416 		/*
22417 		 * For the complex case where we have to send some
22418 		 * controls (FIN or SYN), let tcp_xmit_mp do it.
22419 		 */
22420 		return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
22421 		    NULL, B_FALSE));
22422 	} else {
22423 		/* Generate a simple ACK */
22424 		int	data_length;
22425 		uchar_t	*rptr;
22426 		tcph_t	*tcph;
22427 		mblk_t	*mp1;
22428 		int32_t	tcp_hdr_len;
22429 		int32_t	tcp_tcp_hdr_len;
22430 		int32_t	num_sack_blk = 0;
22431 		int32_t sack_opt_len;
22432 
22433 		/*
22434 		 * Allocate space for TCP + IP headers
22435 		 * and link-level header
22436 		 */
22437 		if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
22438 			num_sack_blk = MIN(tcp->tcp_max_sack_blk,
22439 			    tcp->tcp_num_sack_blk);
22440 			sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
22441 			    TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
22442 			tcp_hdr_len = tcp->tcp_hdr_len + sack_opt_len;
22443 			tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len + sack_opt_len;
22444 		} else {
22445 			tcp_hdr_len = tcp->tcp_hdr_len;
22446 			tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len;
22447 		}
22448 		mp1 = allocb(tcp_hdr_len + tcp_wroff_xtra, BPRI_MED);
22449 		if (!mp1)
22450 			return (NULL);
22451 
22452 		/* Update the latest receive window size in TCP header. */
22453 		U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws,
22454 		    tcp->tcp_tcph->th_win);
22455 		/* copy in prototype TCP + IP header */
22456 		rptr = mp1->b_rptr + tcp_wroff_xtra;
22457 		mp1->b_rptr = rptr;
22458 		mp1->b_wptr = rptr + tcp_hdr_len;
22459 		bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len);
22460 
22461 		tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len];
22462 
22463 		/* Set the TCP sequence number. */
22464 		U32_TO_ABE32(seq_no, tcph->th_seq);
22465 
22466 		/* Set up the TCP flag field. */
22467 		tcph->th_flags[0] = (uchar_t)TH_ACK;
22468 		if (tcp->tcp_ecn_echo_on)
22469 			tcph->th_flags[0] |= TH_ECE;
22470 
22471 		tcp->tcp_rack = tcp->tcp_rnxt;
22472 		tcp->tcp_rack_cnt = 0;
22473 
22474 		/* fill in timestamp option if in use */
22475 		if (tcp->tcp_snd_ts_ok) {
22476 			uint32_t llbolt = (uint32_t)lbolt;
22477 
22478 			U32_TO_BE32(llbolt,
22479 			    (char *)tcph+TCP_MIN_HEADER_LENGTH+4);
22480 			U32_TO_BE32(tcp->tcp_ts_recent,
22481 			    (char *)tcph+TCP_MIN_HEADER_LENGTH+8);
22482 		}
22483 
22484 		/* Fill in SACK options */
22485 		if (num_sack_blk > 0) {
22486 			uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len;
22487 			sack_blk_t *tmp;
22488 			int32_t	i;
22489 
22490 			wptr[0] = TCPOPT_NOP;
22491 			wptr[1] = TCPOPT_NOP;
22492 			wptr[2] = TCPOPT_SACK;
22493 			wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
22494 			    sizeof (sack_blk_t);
22495 			wptr += TCPOPT_REAL_SACK_LEN;
22496 
22497 			tmp = tcp->tcp_sack_list;
22498 			for (i = 0; i < num_sack_blk; i++) {
22499 				U32_TO_BE32(tmp[i].begin, wptr);
22500 				wptr += sizeof (tcp_seq);
22501 				U32_TO_BE32(tmp[i].end, wptr);
22502 				wptr += sizeof (tcp_seq);
22503 			}
22504 			tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1)
22505 			    << 4);
22506 		}
22507 
22508 		if (tcp->tcp_ipversion == IPV4_VERSION) {
22509 			((ipha_t *)rptr)->ipha_length = htons(tcp_hdr_len);
22510 		} else {
22511 			/* Check for ip6i_t header in sticky hdrs */
22512 			ip6_t *ip6 = (ip6_t *)(rptr +
22513 			    (((ip6_t *)rptr)->ip6_nxt == IPPROTO_RAW ?
22514 			    sizeof (ip6i_t) : 0));
22515 
22516 			ip6->ip6_plen = htons(tcp_hdr_len -
22517 			    ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc));
22518 		}
22519 
22520 		/*
22521 		 * Prime pump for checksum calculation in IP.  Include the
22522 		 * adjustment for a source route if any.
22523 		 */
22524 		data_length = tcp_tcp_hdr_len + tcp->tcp_sum;
22525 		data_length = (data_length >> 16) + (data_length & 0xFFFF);
22526 		U16_TO_ABE16(data_length, tcph->th_sum);
22527 
22528 		if (tcp->tcp_ip_forward_progress) {
22529 			ASSERT(tcp->tcp_ipversion == IPV6_VERSION);
22530 			*(uint32_t *)mp1->b_rptr  |= IP_FORWARD_PROG;
22531 			tcp->tcp_ip_forward_progress = B_FALSE;
22532 		}
22533 		return (mp1);
22534 	}
22535 }
22536 
22537 /*
22538  * To create a temporary tcp structure for inserting into bind hash list.
22539  * The parameter is assumed to be in network byte order, ready for use.
22540  */
22541 /* ARGSUSED */
22542 static tcp_t *
22543 tcp_alloc_temp_tcp(in_port_t port)
22544 {
22545 	conn_t	*connp;
22546 	tcp_t	*tcp;
22547 
22548 	connp = ipcl_conn_create(IPCL_TCPCONN, KM_SLEEP);
22549 	if (connp == NULL)
22550 		return (NULL);
22551 
22552 	tcp = connp->conn_tcp;
22553 
22554 	/*
22555 	 * Only initialize the necessary info in those structures.  Note
22556 	 * that since INADDR_ANY is all 0, we do not need to set
22557 	 * tcp_bound_source to INADDR_ANY here.
22558 	 */
22559 	tcp->tcp_state = TCPS_BOUND;
22560 	tcp->tcp_lport = port;
22561 	tcp->tcp_exclbind = 1;
22562 	tcp->tcp_reserved_port = 1;
22563 
22564 	/* Just for place holding... */
22565 	tcp->tcp_ipversion = IPV4_VERSION;
22566 
22567 	return (tcp);
22568 }
22569 
22570 /*
22571  * To remove a port range specified by lo_port and hi_port from the
22572  * reserved port ranges.  This is one of the three public functions of
22573  * the reserved port interface.  Note that a port range has to be removed
22574  * as a whole.  Ports in a range cannot be removed individually.
22575  *
22576  * Params:
22577  *	in_port_t lo_port: the beginning port of the reserved port range to
22578  *		be deleted.
22579  *	in_port_t hi_port: the ending port of the reserved port range to
22580  *		be deleted.
22581  *
22582  * Return:
22583  *	B_TRUE if the deletion is successful, B_FALSE otherwise.
22584  */
22585 boolean_t
22586 tcp_reserved_port_del(in_port_t lo_port, in_port_t hi_port)
22587 {
22588 	int	i, j;
22589 	int	size;
22590 	tcp_t	**temp_tcp_array;
22591 	tcp_t	*tcp;
22592 
22593 	rw_enter(&tcp_reserved_port_lock, RW_WRITER);
22594 
22595 	/* First make sure that the port ranage is indeed reserved. */
22596 	for (i = 0; i < tcp_reserved_port_array_size; i++) {
22597 		if (tcp_reserved_port[i].lo_port == lo_port) {
22598 			hi_port = tcp_reserved_port[i].hi_port;
22599 			temp_tcp_array = tcp_reserved_port[i].temp_tcp_array;
22600 			break;
22601 		}
22602 	}
22603 	if (i == tcp_reserved_port_array_size) {
22604 		rw_exit(&tcp_reserved_port_lock);
22605 		return (B_FALSE);
22606 	}
22607 
22608 	/*
22609 	 * Remove the range from the array.  This simple loop is possible
22610 	 * because port ranges are inserted in ascending order.
22611 	 */
22612 	for (j = i; j < tcp_reserved_port_array_size - 1; j++) {
22613 		tcp_reserved_port[j].lo_port = tcp_reserved_port[j+1].lo_port;
22614 		tcp_reserved_port[j].hi_port = tcp_reserved_port[j+1].hi_port;
22615 		tcp_reserved_port[j].temp_tcp_array =
22616 		    tcp_reserved_port[j+1].temp_tcp_array;
22617 	}
22618 
22619 	/* Remove all the temporary tcp structures. */
22620 	size = hi_port - lo_port + 1;
22621 	while (size > 0) {
22622 		tcp = temp_tcp_array[size - 1];
22623 		ASSERT(tcp != NULL);
22624 		tcp_bind_hash_remove(tcp);
22625 		CONN_DEC_REF(tcp->tcp_connp);
22626 		size--;
22627 	}
22628 	kmem_free(temp_tcp_array, (hi_port - lo_port + 1) * sizeof (tcp_t *));
22629 	tcp_reserved_port_array_size--;
22630 	rw_exit(&tcp_reserved_port_lock);
22631 	return (B_TRUE);
22632 }
22633 
22634 /*
22635  * Macro to remove temporary tcp structure from the bind hash list.  The
22636  * first parameter is the list of tcp to be removed.  The second parameter
22637  * is the number of tcps in the array.
22638  */
22639 #define	TCP_TMP_TCP_REMOVE(tcp_array, num) \
22640 { \
22641 	while ((num) > 0) { \
22642 		tcp_t *tcp = (tcp_array)[(num) - 1]; \
22643 		tf_t *tbf; \
22644 		tcp_t *tcpnext; \
22645 		tbf = &tcp_bind_fanout[TCP_BIND_HASH(tcp->tcp_lport)]; \
22646 		mutex_enter(&tbf->tf_lock); \
22647 		tcpnext = tcp->tcp_bind_hash; \
22648 		if (tcpnext) { \
22649 			tcpnext->tcp_ptpbhn = \
22650 				tcp->tcp_ptpbhn; \
22651 		} \
22652 		*tcp->tcp_ptpbhn = tcpnext; \
22653 		mutex_exit(&tbf->tf_lock); \
22654 		kmem_free(tcp, sizeof (tcp_t)); \
22655 		(tcp_array)[(num) - 1] = NULL; \
22656 		(num)--; \
22657 	} \
22658 }
22659 
22660 /*
22661  * The public interface for other modules to call to reserve a port range
22662  * in TCP.  The caller passes in how large a port range it wants.  TCP
22663  * will try to find a range and return it via lo_port and hi_port.  This is
22664  * used by NCA's nca_conn_init.
22665  * NCA can only be used in the global zone so this only affects the global
22666  * zone's ports.
22667  *
22668  * Params:
22669  *	int size: the size of the port range to be reserved.
22670  *	in_port_t *lo_port (referenced): returns the beginning port of the
22671  *		reserved port range added.
22672  *	in_port_t *hi_port (referenced): returns the ending port of the
22673  *		reserved port range added.
22674  *
22675  * Return:
22676  *	B_TRUE if the port reservation is successful, B_FALSE otherwise.
22677  */
22678 boolean_t
22679 tcp_reserved_port_add(int size, in_port_t *lo_port, in_port_t *hi_port)
22680 {
22681 	tcp_t		*tcp;
22682 	tcp_t		*tmp_tcp;
22683 	tcp_t		**temp_tcp_array;
22684 	tf_t		*tbf;
22685 	in_port_t	net_port;
22686 	in_port_t	port;
22687 	int32_t		cur_size;
22688 	int		i, j;
22689 	boolean_t	used;
22690 	tcp_rport_t 	tmp_ports[TCP_RESERVED_PORTS_ARRAY_MAX_SIZE];
22691 	zoneid_t	zoneid = GLOBAL_ZONEID;
22692 
22693 	/* Sanity check. */
22694 	if (size <= 0 || size > TCP_RESERVED_PORTS_RANGE_MAX) {
22695 		return (B_FALSE);
22696 	}
22697 
22698 	rw_enter(&tcp_reserved_port_lock, RW_WRITER);
22699 	if (tcp_reserved_port_array_size == TCP_RESERVED_PORTS_ARRAY_MAX_SIZE) {
22700 		rw_exit(&tcp_reserved_port_lock);
22701 		return (B_FALSE);
22702 	}
22703 
22704 	/*
22705 	 * Find the starting port to try.  Since the port ranges are ordered
22706 	 * in the reserved port array, we can do a simple search here.
22707 	 */
22708 	*lo_port = TCP_SMALLEST_RESERVED_PORT;
22709 	*hi_port = TCP_LARGEST_RESERVED_PORT;
22710 	for (i = 0; i < tcp_reserved_port_array_size;
22711 	    *lo_port = tcp_reserved_port[i].hi_port + 1, i++) {
22712 		if (tcp_reserved_port[i].lo_port - *lo_port >= size) {
22713 			*hi_port = tcp_reserved_port[i].lo_port - 1;
22714 			break;
22715 		}
22716 	}
22717 	/* No available port range. */
22718 	if (i == tcp_reserved_port_array_size && *hi_port - *lo_port < size) {
22719 		rw_exit(&tcp_reserved_port_lock);
22720 		return (B_FALSE);
22721 	}
22722 
22723 	temp_tcp_array = kmem_zalloc(size * sizeof (tcp_t *), KM_NOSLEEP);
22724 	if (temp_tcp_array == NULL) {
22725 		rw_exit(&tcp_reserved_port_lock);
22726 		return (B_FALSE);
22727 	}
22728 
22729 	/* Go thru the port range to see if some ports are already bound. */
22730 	for (port = *lo_port, cur_size = 0;
22731 	    cur_size < size && port <= *hi_port;
22732 	    cur_size++, port++) {
22733 		used = B_FALSE;
22734 		net_port = htons(port);
22735 		tbf = &tcp_bind_fanout[TCP_BIND_HASH(net_port)];
22736 		mutex_enter(&tbf->tf_lock);
22737 		for (tcp = tbf->tf_tcp; tcp != NULL;
22738 		    tcp = tcp->tcp_bind_hash) {
22739 			if (IPCL_ZONE_MATCH(tcp->tcp_connp, zoneid) &&
22740 			    net_port == tcp->tcp_lport) {
22741 				/*
22742 				 * A port is already bound.  Search again
22743 				 * starting from port + 1.  Release all
22744 				 * temporary tcps.
22745 				 */
22746 				mutex_exit(&tbf->tf_lock);
22747 				TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size);
22748 				*lo_port = port + 1;
22749 				cur_size = -1;
22750 				used = B_TRUE;
22751 				break;
22752 			}
22753 		}
22754 		if (!used) {
22755 			if ((tmp_tcp = tcp_alloc_temp_tcp(net_port)) == NULL) {
22756 				/*
22757 				 * Allocation failure.  Just fail the request.
22758 				 * Need to remove all those temporary tcp
22759 				 * structures.
22760 				 */
22761 				mutex_exit(&tbf->tf_lock);
22762 				TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size);
22763 				rw_exit(&tcp_reserved_port_lock);
22764 				kmem_free(temp_tcp_array,
22765 				    (hi_port - lo_port + 1) *
22766 				    sizeof (tcp_t *));
22767 				return (B_FALSE);
22768 			}
22769 			temp_tcp_array[cur_size] = tmp_tcp;
22770 			tcp_bind_hash_insert(tbf, tmp_tcp, B_TRUE);
22771 			mutex_exit(&tbf->tf_lock);
22772 		}
22773 	}
22774 
22775 	/*
22776 	 * The current range is not large enough.  We can actually do another
22777 	 * search if this search is done between 2 reserved port ranges.  But
22778 	 * for first release, we just stop here and return saying that no port
22779 	 * range is available.
22780 	 */
22781 	if (cur_size < size) {
22782 		TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size);
22783 		rw_exit(&tcp_reserved_port_lock);
22784 		kmem_free(temp_tcp_array, size * sizeof (tcp_t *));
22785 		return (B_FALSE);
22786 	}
22787 	*hi_port = port - 1;
22788 
22789 	/*
22790 	 * Insert range into array in ascending order.  Since this function
22791 	 * must not be called often, we choose to use the simplest method.
22792 	 * The above array should not consume excessive stack space as
22793 	 * the size must be very small.  If in future releases, we find
22794 	 * that we should provide more reserved port ranges, this function
22795 	 * has to be modified to be more efficient.
22796 	 */
22797 	if (tcp_reserved_port_array_size == 0) {
22798 		tcp_reserved_port[0].lo_port = *lo_port;
22799 		tcp_reserved_port[0].hi_port = *hi_port;
22800 		tcp_reserved_port[0].temp_tcp_array = temp_tcp_array;
22801 	} else {
22802 		for (i = 0, j = 0; i < tcp_reserved_port_array_size; i++, j++) {
22803 			if (*lo_port < tcp_reserved_port[i].lo_port && i == j) {
22804 				tmp_ports[j].lo_port = *lo_port;
22805 				tmp_ports[j].hi_port = *hi_port;
22806 				tmp_ports[j].temp_tcp_array = temp_tcp_array;
22807 				j++;
22808 			}
22809 			tmp_ports[j].lo_port = tcp_reserved_port[i].lo_port;
22810 			tmp_ports[j].hi_port = tcp_reserved_port[i].hi_port;
22811 			tmp_ports[j].temp_tcp_array =
22812 			    tcp_reserved_port[i].temp_tcp_array;
22813 		}
22814 		if (j == i) {
22815 			tmp_ports[j].lo_port = *lo_port;
22816 			tmp_ports[j].hi_port = *hi_port;
22817 			tmp_ports[j].temp_tcp_array = temp_tcp_array;
22818 		}
22819 		bcopy(tmp_ports, tcp_reserved_port, sizeof (tmp_ports));
22820 	}
22821 	tcp_reserved_port_array_size++;
22822 	rw_exit(&tcp_reserved_port_lock);
22823 	return (B_TRUE);
22824 }
22825 
22826 /*
22827  * Check to see if a port is in any reserved port range.
22828  *
22829  * Params:
22830  *	in_port_t port: the port to be verified.
22831  *
22832  * Return:
22833  *	B_TRUE is the port is inside a reserved port range, B_FALSE otherwise.
22834  */
22835 boolean_t
22836 tcp_reserved_port_check(in_port_t port)
22837 {
22838 	int i;
22839 
22840 	rw_enter(&tcp_reserved_port_lock, RW_READER);
22841 	for (i = 0; i < tcp_reserved_port_array_size; i++) {
22842 		if (port >= tcp_reserved_port[i].lo_port ||
22843 		    port <= tcp_reserved_port[i].hi_port) {
22844 			rw_exit(&tcp_reserved_port_lock);
22845 			return (B_TRUE);
22846 		}
22847 	}
22848 	rw_exit(&tcp_reserved_port_lock);
22849 	return (B_FALSE);
22850 }
22851 
22852 /*
22853  * To list all reserved port ranges.  This is the function to handle
22854  * ndd tcp_reserved_port_list.
22855  */
22856 /* ARGSUSED */
22857 static int
22858 tcp_reserved_port_list(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
22859 {
22860 	int i;
22861 
22862 	rw_enter(&tcp_reserved_port_lock, RW_READER);
22863 	if (tcp_reserved_port_array_size > 0)
22864 		(void) mi_mpprintf(mp, "The following ports are reserved:");
22865 	else
22866 		(void) mi_mpprintf(mp, "No port is reserved.");
22867 	for (i = 0; i < tcp_reserved_port_array_size; i++) {
22868 		(void) mi_mpprintf(mp, "%d-%d",
22869 		    tcp_reserved_port[i].lo_port, tcp_reserved_port[i].hi_port);
22870 	}
22871 	rw_exit(&tcp_reserved_port_lock);
22872 	return (0);
22873 }
22874 
22875 /*
22876  * Hash list insertion routine for tcp_t structures.
22877  * Inserts entries with the ones bound to a specific IP address first
22878  * followed by those bound to INADDR_ANY.
22879  */
22880 static void
22881 tcp_bind_hash_insert(tf_t *tbf, tcp_t *tcp, int caller_holds_lock)
22882 {
22883 	tcp_t	**tcpp;
22884 	tcp_t	*tcpnext;
22885 
22886 	if (tcp->tcp_ptpbhn != NULL) {
22887 		ASSERT(!caller_holds_lock);
22888 		tcp_bind_hash_remove(tcp);
22889 	}
22890 	tcpp = &tbf->tf_tcp;
22891 	if (!caller_holds_lock) {
22892 		mutex_enter(&tbf->tf_lock);
22893 	} else {
22894 		ASSERT(MUTEX_HELD(&tbf->tf_lock));
22895 	}
22896 	tcpnext = tcpp[0];
22897 	if (tcpnext) {
22898 		/*
22899 		 * If the new tcp bound to the INADDR_ANY address
22900 		 * and the first one in the list is not bound to
22901 		 * INADDR_ANY we skip all entries until we find the
22902 		 * first one bound to INADDR_ANY.
22903 		 * This makes sure that applications binding to a
22904 		 * specific address get preference over those binding to
22905 		 * INADDR_ANY.
22906 		 */
22907 		if (V6_OR_V4_INADDR_ANY(tcp->tcp_bound_source_v6) &&
22908 		    !V6_OR_V4_INADDR_ANY(tcpnext->tcp_bound_source_v6)) {
22909 			while ((tcpnext = tcpp[0]) != NULL &&
22910 			    !V6_OR_V4_INADDR_ANY(tcpnext->tcp_bound_source_v6))
22911 				tcpp = &(tcpnext->tcp_bind_hash);
22912 			if (tcpnext)
22913 				tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash;
22914 		} else
22915 			tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash;
22916 	}
22917 	tcp->tcp_bind_hash = tcpnext;
22918 	tcp->tcp_ptpbhn = tcpp;
22919 	tcpp[0] = tcp;
22920 	if (!caller_holds_lock)
22921 		mutex_exit(&tbf->tf_lock);
22922 }
22923 
22924 /*
22925  * Hash list removal routine for tcp_t structures.
22926  */
22927 static void
22928 tcp_bind_hash_remove(tcp_t *tcp)
22929 {
22930 	tcp_t	*tcpnext;
22931 	kmutex_t *lockp;
22932 
22933 	if (tcp->tcp_ptpbhn == NULL)
22934 		return;
22935 
22936 	/*
22937 	 * Extract the lock pointer in case there are concurrent
22938 	 * hash_remove's for this instance.
22939 	 */
22940 	ASSERT(tcp->tcp_lport != 0);
22941 	lockp = &tcp_bind_fanout[TCP_BIND_HASH(tcp->tcp_lport)].tf_lock;
22942 
22943 	ASSERT(lockp != NULL);
22944 	mutex_enter(lockp);
22945 	if (tcp->tcp_ptpbhn) {
22946 		tcpnext = tcp->tcp_bind_hash;
22947 		if (tcpnext) {
22948 			tcpnext->tcp_ptpbhn = tcp->tcp_ptpbhn;
22949 			tcp->tcp_bind_hash = NULL;
22950 		}
22951 		*tcp->tcp_ptpbhn = tcpnext;
22952 		tcp->tcp_ptpbhn = NULL;
22953 	}
22954 	mutex_exit(lockp);
22955 }
22956 
22957 
22958 /*
22959  * Hash list lookup routine for tcp_t structures.
22960  * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF.
22961  */
22962 static tcp_t *
22963 tcp_acceptor_hash_lookup(t_uscalar_t id)
22964 {
22965 	tf_t	*tf;
22966 	tcp_t	*tcp;
22967 
22968 	tf = &tcp_acceptor_fanout[TCP_ACCEPTOR_HASH(id)];
22969 	mutex_enter(&tf->tf_lock);
22970 	for (tcp = tf->tf_tcp; tcp != NULL;
22971 	    tcp = tcp->tcp_acceptor_hash) {
22972 		if (tcp->tcp_acceptor_id == id) {
22973 			CONN_INC_REF(tcp->tcp_connp);
22974 			mutex_exit(&tf->tf_lock);
22975 			return (tcp);
22976 		}
22977 	}
22978 	mutex_exit(&tf->tf_lock);
22979 	return (NULL);
22980 }
22981 
22982 
22983 /*
22984  * Hash list insertion routine for tcp_t structures.
22985  */
22986 void
22987 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp)
22988 {
22989 	tf_t	*tf;
22990 	tcp_t	**tcpp;
22991 	tcp_t	*tcpnext;
22992 
22993 	tf = &tcp_acceptor_fanout[TCP_ACCEPTOR_HASH(id)];
22994 
22995 	if (tcp->tcp_ptpahn != NULL)
22996 		tcp_acceptor_hash_remove(tcp);
22997 	tcpp = &tf->tf_tcp;
22998 	mutex_enter(&tf->tf_lock);
22999 	tcpnext = tcpp[0];
23000 	if (tcpnext)
23001 		tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash;
23002 	tcp->tcp_acceptor_hash = tcpnext;
23003 	tcp->tcp_ptpahn = tcpp;
23004 	tcpp[0] = tcp;
23005 	tcp->tcp_acceptor_lockp = &tf->tf_lock;	/* For tcp_*_hash_remove */
23006 	mutex_exit(&tf->tf_lock);
23007 }
23008 
23009 /*
23010  * Hash list removal routine for tcp_t structures.
23011  */
23012 static void
23013 tcp_acceptor_hash_remove(tcp_t *tcp)
23014 {
23015 	tcp_t	*tcpnext;
23016 	kmutex_t *lockp;
23017 
23018 	/*
23019 	 * Extract the lock pointer in case there are concurrent
23020 	 * hash_remove's for this instance.
23021 	 */
23022 	lockp = tcp->tcp_acceptor_lockp;
23023 
23024 	if (tcp->tcp_ptpahn == NULL)
23025 		return;
23026 
23027 	ASSERT(lockp != NULL);
23028 	mutex_enter(lockp);
23029 	if (tcp->tcp_ptpahn) {
23030 		tcpnext = tcp->tcp_acceptor_hash;
23031 		if (tcpnext) {
23032 			tcpnext->tcp_ptpahn = tcp->tcp_ptpahn;
23033 			tcp->tcp_acceptor_hash = NULL;
23034 		}
23035 		*tcp->tcp_ptpahn = tcpnext;
23036 		tcp->tcp_ptpahn = NULL;
23037 	}
23038 	mutex_exit(lockp);
23039 	tcp->tcp_acceptor_lockp = NULL;
23040 }
23041 
23042 /* ARGSUSED */
23043 static int
23044 tcp_host_param_setvalue(queue_t *q, mblk_t *mp, char *value, caddr_t cp, int af)
23045 {
23046 	int error = 0;
23047 	int retval;
23048 	char *end;
23049 
23050 	tcp_hsp_t *hsp;
23051 	tcp_hsp_t *hspprev;
23052 
23053 	ipaddr_t addr = 0;		/* Address we're looking for */
23054 	in6_addr_t v6addr;		/* Address we're looking for */
23055 	uint32_t hash;			/* Hash of that address */
23056 
23057 	/*
23058 	 * If the following variables are still zero after parsing the input
23059 	 * string, the user didn't specify them and we don't change them in
23060 	 * the HSP.
23061 	 */
23062 
23063 	ipaddr_t mask = 0;		/* Subnet mask */
23064 	in6_addr_t v6mask;
23065 	long sendspace = 0;		/* Send buffer size */
23066 	long recvspace = 0;		/* Receive buffer size */
23067 	long timestamp = 0;	/* Originate TCP TSTAMP option, 1 = yes */
23068 	boolean_t delete = B_FALSE;	/* User asked to delete this HSP */
23069 
23070 	rw_enter(&tcp_hsp_lock, RW_WRITER);
23071 
23072 	/* Parse and validate address */
23073 	if (af == AF_INET) {
23074 		retval = inet_pton(af, value, &addr);
23075 		if (retval == 1)
23076 			IN6_IPADDR_TO_V4MAPPED(addr, &v6addr);
23077 	} else if (af == AF_INET6) {
23078 		retval = inet_pton(af, value, &v6addr);
23079 	} else {
23080 		error = EINVAL;
23081 		goto done;
23082 	}
23083 	if (retval == 0) {
23084 		error = EINVAL;
23085 		goto done;
23086 	}
23087 
23088 	while ((*value) && *value != ' ')
23089 		value++;
23090 
23091 	/* Parse individual keywords, set variables if found */
23092 	while (*value) {
23093 		/* Skip leading blanks */
23094 
23095 		while (*value == ' ' || *value == '\t')
23096 			value++;
23097 
23098 		/* If at end of string, we're done */
23099 
23100 		if (!*value)
23101 			break;
23102 
23103 		/* We have a word, figure out what it is */
23104 
23105 		if (strncmp("mask", value, 4) == 0) {
23106 			value += 4;
23107 			while (*value == ' ' || *value == '\t')
23108 				value++;
23109 			/* Parse subnet mask */
23110 			if (af == AF_INET) {
23111 				retval = inet_pton(af, value, &mask);
23112 				if (retval == 1) {
23113 					V4MASK_TO_V6(mask, v6mask);
23114 				}
23115 			} else if (af == AF_INET6) {
23116 				retval = inet_pton(af, value, &v6mask);
23117 			}
23118 			if (retval != 1) {
23119 				error = EINVAL;
23120 				goto done;
23121 			}
23122 			while ((*value) && *value != ' ')
23123 				value++;
23124 		} else if (strncmp("sendspace", value, 9) == 0) {
23125 			value += 9;
23126 
23127 			if (ddi_strtol(value, &end, 0, &sendspace) != 0 ||
23128 			    sendspace < TCP_XMIT_HIWATER ||
23129 			    sendspace >= (1L<<30)) {
23130 				error = EINVAL;
23131 				goto done;
23132 			}
23133 			value = end;
23134 		} else if (strncmp("recvspace", value, 9) == 0) {
23135 			value += 9;
23136 
23137 			if (ddi_strtol(value, &end, 0, &recvspace) != 0 ||
23138 			    recvspace < TCP_RECV_HIWATER ||
23139 			    recvspace >= (1L<<30)) {
23140 				error = EINVAL;
23141 				goto done;
23142 			}
23143 			value = end;
23144 		} else if (strncmp("timestamp", value, 9) == 0) {
23145 			value += 9;
23146 
23147 			if (ddi_strtol(value, &end, 0, &timestamp) != 0 ||
23148 			    timestamp < 0 || timestamp > 1) {
23149 				error = EINVAL;
23150 				goto done;
23151 			}
23152 
23153 			/*
23154 			 * We increment timestamp so we know it's been set;
23155 			 * this is undone when we put it in the HSP
23156 			 */
23157 			timestamp++;
23158 			value = end;
23159 		} else if (strncmp("delete", value, 6) == 0) {
23160 			value += 6;
23161 			delete = B_TRUE;
23162 		} else {
23163 			error = EINVAL;
23164 			goto done;
23165 		}
23166 	}
23167 
23168 	/* Hash address for lookup */
23169 
23170 	hash = TCP_HSP_HASH(addr);
23171 
23172 	if (delete) {
23173 		/*
23174 		 * Note that deletes don't return an error if the thing
23175 		 * we're trying to delete isn't there.
23176 		 */
23177 		if (tcp_hsp_hash == NULL)
23178 			goto done;
23179 		hsp = tcp_hsp_hash[hash];
23180 
23181 		if (hsp) {
23182 			if (IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6,
23183 			    &v6addr)) {
23184 				tcp_hsp_hash[hash] = hsp->tcp_hsp_next;
23185 				mi_free((char *)hsp);
23186 			} else {
23187 				hspprev = hsp;
23188 				while ((hsp = hsp->tcp_hsp_next) != NULL) {
23189 					if (IN6_ARE_ADDR_EQUAL(
23190 					    &hsp->tcp_hsp_addr_v6, &v6addr)) {
23191 						hspprev->tcp_hsp_next =
23192 						    hsp->tcp_hsp_next;
23193 						mi_free((char *)hsp);
23194 						break;
23195 					}
23196 					hspprev = hsp;
23197 				}
23198 			}
23199 		}
23200 	} else {
23201 		/*
23202 		 * We're adding/modifying an HSP.  If we haven't already done
23203 		 * so, allocate the hash table.
23204 		 */
23205 
23206 		if (!tcp_hsp_hash) {
23207 			tcp_hsp_hash = (tcp_hsp_t **)
23208 			    mi_zalloc(sizeof (tcp_hsp_t *) * TCP_HSP_HASH_SIZE);
23209 			if (!tcp_hsp_hash) {
23210 				error = EINVAL;
23211 				goto done;
23212 			}
23213 		}
23214 
23215 		/* Get head of hash chain */
23216 
23217 		hsp = tcp_hsp_hash[hash];
23218 
23219 		/* Try to find pre-existing hsp on hash chain */
23220 		/* Doesn't handle CIDR prefixes. */
23221 		while (hsp) {
23222 			if (IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, &v6addr))
23223 				break;
23224 			hsp = hsp->tcp_hsp_next;
23225 		}
23226 
23227 		/*
23228 		 * If we didn't, create one with default values and put it
23229 		 * at head of hash chain
23230 		 */
23231 
23232 		if (!hsp) {
23233 			hsp = (tcp_hsp_t *)mi_zalloc(sizeof (tcp_hsp_t));
23234 			if (!hsp) {
23235 				error = EINVAL;
23236 				goto done;
23237 			}
23238 			hsp->tcp_hsp_next = tcp_hsp_hash[hash];
23239 			tcp_hsp_hash[hash] = hsp;
23240 		}
23241 
23242 		/* Set values that the user asked us to change */
23243 
23244 		hsp->tcp_hsp_addr_v6 = v6addr;
23245 		if (IN6_IS_ADDR_V4MAPPED(&v6addr))
23246 			hsp->tcp_hsp_vers = IPV4_VERSION;
23247 		else
23248 			hsp->tcp_hsp_vers = IPV6_VERSION;
23249 		hsp->tcp_hsp_subnet_v6 = v6mask;
23250 		if (sendspace > 0)
23251 			hsp->tcp_hsp_sendspace = sendspace;
23252 		if (recvspace > 0)
23253 			hsp->tcp_hsp_recvspace = recvspace;
23254 		if (timestamp > 0)
23255 			hsp->tcp_hsp_tstamp = timestamp - 1;
23256 	}
23257 
23258 done:
23259 	rw_exit(&tcp_hsp_lock);
23260 	return (error);
23261 }
23262 
23263 /* Set callback routine passed to nd_load by tcp_param_register. */
23264 /* ARGSUSED */
23265 static int
23266 tcp_host_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr)
23267 {
23268 	return (tcp_host_param_setvalue(q, mp, value, cp, AF_INET));
23269 }
23270 /* ARGSUSED */
23271 static int
23272 tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
23273     cred_t *cr)
23274 {
23275 	return (tcp_host_param_setvalue(q, mp, value, cp, AF_INET6));
23276 }
23277 
23278 /* TCP host parameters report triggered via the Named Dispatch mechanism. */
23279 /* ARGSUSED */
23280 static int
23281 tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr)
23282 {
23283 	tcp_hsp_t *hsp;
23284 	int i;
23285 	char addrbuf[INET6_ADDRSTRLEN], subnetbuf[INET6_ADDRSTRLEN];
23286 
23287 	rw_enter(&tcp_hsp_lock, RW_READER);
23288 	(void) mi_mpprintf(mp,
23289 	    "Hash HSP     " MI_COL_HDRPAD_STR
23290 	    "Address         Subnet Mask     Send       Receive    TStamp");
23291 	if (tcp_hsp_hash) {
23292 		for (i = 0; i < TCP_HSP_HASH_SIZE; i++) {
23293 			hsp = tcp_hsp_hash[i];
23294 			while (hsp) {
23295 				if (hsp->tcp_hsp_vers == IPV4_VERSION) {
23296 					(void) inet_ntop(AF_INET,
23297 					    &hsp->tcp_hsp_addr,
23298 					    addrbuf, sizeof (addrbuf));
23299 					(void) inet_ntop(AF_INET,
23300 					    &hsp->tcp_hsp_subnet,
23301 					    subnetbuf, sizeof (subnetbuf));
23302 				} else {
23303 					(void) inet_ntop(AF_INET6,
23304 					    &hsp->tcp_hsp_addr_v6,
23305 					    addrbuf, sizeof (addrbuf));
23306 					(void) inet_ntop(AF_INET6,
23307 					    &hsp->tcp_hsp_subnet_v6,
23308 					    subnetbuf, sizeof (subnetbuf));
23309 				}
23310 				(void) mi_mpprintf(mp,
23311 				    " %03d " MI_COL_PTRFMT_STR
23312 				    "%s %s %010d %010d      %d",
23313 				    i,
23314 				    (void *)hsp,
23315 				    addrbuf,
23316 				    subnetbuf,
23317 				    hsp->tcp_hsp_sendspace,
23318 				    hsp->tcp_hsp_recvspace,
23319 				    hsp->tcp_hsp_tstamp);
23320 
23321 				hsp = hsp->tcp_hsp_next;
23322 			}
23323 		}
23324 	}
23325 	rw_exit(&tcp_hsp_lock);
23326 	return (0);
23327 }
23328 
23329 
23330 /* Data for fast netmask macro used by tcp_hsp_lookup */
23331 
23332 static ipaddr_t netmasks[] = {
23333 	IN_CLASSA_NET, IN_CLASSA_NET, IN_CLASSB_NET,
23334 	IN_CLASSC_NET | IN_CLASSD_NET  /* Class C,D,E */
23335 };
23336 
23337 #define	netmask(addr) (netmasks[(ipaddr_t)(addr) >> 30])
23338 
23339 /*
23340  * XXX This routine should go away and instead we should use the metrics
23341  * associated with the routes to determine the default sndspace and rcvspace.
23342  */
23343 static tcp_hsp_t *
23344 tcp_hsp_lookup(ipaddr_t addr)
23345 {
23346 	tcp_hsp_t *hsp = NULL;
23347 
23348 	/* Quick check without acquiring the lock. */
23349 	if (tcp_hsp_hash == NULL)
23350 		return (NULL);
23351 
23352 	rw_enter(&tcp_hsp_lock, RW_READER);
23353 
23354 	/* This routine finds the best-matching HSP for address addr. */
23355 
23356 	if (tcp_hsp_hash) {
23357 		int i;
23358 		ipaddr_t srchaddr;
23359 		tcp_hsp_t *hsp_net;
23360 
23361 		/* We do three passes: host, network, and subnet. */
23362 
23363 		srchaddr = addr;
23364 
23365 		for (i = 1; i <= 3; i++) {
23366 			/* Look for exact match on srchaddr */
23367 
23368 			hsp = tcp_hsp_hash[TCP_HSP_HASH(srchaddr)];
23369 			while (hsp) {
23370 				if (hsp->tcp_hsp_vers == IPV4_VERSION &&
23371 				    hsp->tcp_hsp_addr == srchaddr)
23372 					break;
23373 				hsp = hsp->tcp_hsp_next;
23374 			}
23375 			ASSERT(hsp == NULL ||
23376 			    hsp->tcp_hsp_vers == IPV4_VERSION);
23377 
23378 			/*
23379 			 * If this is the first pass:
23380 			 *   If we found a match, great, return it.
23381 			 *   If not, search for the network on the second pass.
23382 			 */
23383 
23384 			if (i == 1)
23385 				if (hsp)
23386 					break;
23387 				else
23388 				{
23389 					srchaddr = addr & netmask(addr);
23390 					continue;
23391 				}
23392 
23393 			/*
23394 			 * If this is the second pass:
23395 			 *   If we found a match, but there's a subnet mask,
23396 			 *    save the match but try again using the subnet
23397 			 *    mask on the third pass.
23398 			 *   Otherwise, return whatever we found.
23399 			 */
23400 
23401 			if (i == 2) {
23402 				if (hsp && hsp->tcp_hsp_subnet) {
23403 					hsp_net = hsp;
23404 					srchaddr = addr & hsp->tcp_hsp_subnet;
23405 					continue;
23406 				} else {
23407 					break;
23408 				}
23409 			}
23410 
23411 			/*
23412 			 * This must be the third pass.  If we didn't find
23413 			 * anything, return the saved network HSP instead.
23414 			 */
23415 
23416 			if (!hsp)
23417 				hsp = hsp_net;
23418 		}
23419 	}
23420 
23421 	rw_exit(&tcp_hsp_lock);
23422 	return (hsp);
23423 }
23424 
23425 /*
23426  * XXX Equally broken as the IPv4 routine. Doesn't handle longest
23427  * match lookup.
23428  */
23429 static tcp_hsp_t *
23430 tcp_hsp_lookup_ipv6(in6_addr_t *v6addr)
23431 {
23432 	tcp_hsp_t *hsp = NULL;
23433 
23434 	/* Quick check without acquiring the lock. */
23435 	if (tcp_hsp_hash == NULL)
23436 		return (NULL);
23437 
23438 	rw_enter(&tcp_hsp_lock, RW_READER);
23439 
23440 	/* This routine finds the best-matching HSP for address addr. */
23441 
23442 	if (tcp_hsp_hash) {
23443 		int i;
23444 		in6_addr_t v6srchaddr;
23445 		tcp_hsp_t *hsp_net;
23446 
23447 		/* We do three passes: host, network, and subnet. */
23448 
23449 		v6srchaddr = *v6addr;
23450 
23451 		for (i = 1; i <= 3; i++) {
23452 			/* Look for exact match on srchaddr */
23453 
23454 			hsp = tcp_hsp_hash[TCP_HSP_HASH(
23455 			    V4_PART_OF_V6(v6srchaddr))];
23456 			while (hsp) {
23457 				if (hsp->tcp_hsp_vers == IPV6_VERSION &&
23458 				    IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6,
23459 				    &v6srchaddr))
23460 					break;
23461 				hsp = hsp->tcp_hsp_next;
23462 			}
23463 
23464 			/*
23465 			 * If this is the first pass:
23466 			 *   If we found a match, great, return it.
23467 			 *   If not, search for the network on the second pass.
23468 			 */
23469 
23470 			if (i == 1)
23471 				if (hsp)
23472 					break;
23473 				else {
23474 					/* Assume a 64 bit mask */
23475 					v6srchaddr.s6_addr32[0] =
23476 					    v6addr->s6_addr32[0];
23477 					v6srchaddr.s6_addr32[1] =
23478 					    v6addr->s6_addr32[1];
23479 					v6srchaddr.s6_addr32[2] = 0;
23480 					v6srchaddr.s6_addr32[3] = 0;
23481 					continue;
23482 				}
23483 
23484 			/*
23485 			 * If this is the second pass:
23486 			 *   If we found a match, but there's a subnet mask,
23487 			 *    save the match but try again using the subnet
23488 			 *    mask on the third pass.
23489 			 *   Otherwise, return whatever we found.
23490 			 */
23491 
23492 			if (i == 2) {
23493 				ASSERT(hsp == NULL ||
23494 				    hsp->tcp_hsp_vers == IPV6_VERSION);
23495 				if (hsp &&
23496 				    !IN6_IS_ADDR_UNSPECIFIED(
23497 				    &hsp->tcp_hsp_subnet_v6)) {
23498 					hsp_net = hsp;
23499 					V6_MASK_COPY(*v6addr,
23500 					    hsp->tcp_hsp_subnet_v6, v6srchaddr);
23501 					continue;
23502 				} else {
23503 					break;
23504 				}
23505 			}
23506 
23507 			/*
23508 			 * This must be the third pass.  If we didn't find
23509 			 * anything, return the saved network HSP instead.
23510 			 */
23511 
23512 			if (!hsp)
23513 				hsp = hsp_net;
23514 		}
23515 	}
23516 
23517 	rw_exit(&tcp_hsp_lock);
23518 	return (hsp);
23519 }
23520 
23521 /*
23522  * Type three generator adapted from the random() function in 4.4 BSD:
23523  */
23524 
23525 /*
23526  * Copyright (c) 1983, 1993
23527  *	The Regents of the University of California.  All rights reserved.
23528  *
23529  * Redistribution and use in source and binary forms, with or without
23530  * modification, are permitted provided that the following conditions
23531  * are met:
23532  * 1. Redistributions of source code must retain the above copyright
23533  *    notice, this list of conditions and the following disclaimer.
23534  * 2. Redistributions in binary form must reproduce the above copyright
23535  *    notice, this list of conditions and the following disclaimer in the
23536  *    documentation and/or other materials provided with the distribution.
23537  * 3. All advertising materials mentioning features or use of this software
23538  *    must display the following acknowledgement:
23539  *	This product includes software developed by the University of
23540  *	California, Berkeley and its contributors.
23541  * 4. Neither the name of the University nor the names of its contributors
23542  *    may be used to endorse or promote products derived from this software
23543  *    without specific prior written permission.
23544  *
23545  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23546  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23547  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23548  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23549  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23550  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23551  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23552  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23553  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23554  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
23555  * SUCH DAMAGE.
23556  */
23557 
23558 /* Type 3 -- x**31 + x**3 + 1 */
23559 #define	DEG_3		31
23560 #define	SEP_3		3
23561 
23562 
23563 /* Protected by tcp_random_lock */
23564 static int tcp_randtbl[DEG_3 + 1];
23565 
23566 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1];
23567 static int *tcp_random_rptr = &tcp_randtbl[1];
23568 
23569 static int *tcp_random_state = &tcp_randtbl[1];
23570 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1];
23571 
23572 kmutex_t tcp_random_lock;
23573 
23574 void
23575 tcp_random_init(void)
23576 {
23577 	int i;
23578 	hrtime_t hrt;
23579 	time_t wallclock;
23580 	uint64_t result;
23581 
23582 	/*
23583 	 * Use high-res timer and current time for seed.  Gethrtime() returns
23584 	 * a longlong, which may contain resolution down to nanoseconds.
23585 	 * The current time will either be a 32-bit or a 64-bit quantity.
23586 	 * XOR the two together in a 64-bit result variable.
23587 	 * Convert the result to a 32-bit value by multiplying the high-order
23588 	 * 32-bits by the low-order 32-bits.
23589 	 */
23590 
23591 	hrt = gethrtime();
23592 	(void) drv_getparm(TIME, &wallclock);
23593 	result = (uint64_t)wallclock ^ (uint64_t)hrt;
23594 	mutex_enter(&tcp_random_lock);
23595 	tcp_random_state[0] = ((result >> 32) & 0xffffffff) *
23596 	    (result & 0xffffffff);
23597 
23598 	for (i = 1; i < DEG_3; i++)
23599 		tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1]
23600 			+ 12345;
23601 	tcp_random_fptr = &tcp_random_state[SEP_3];
23602 	tcp_random_rptr = &tcp_random_state[0];
23603 	mutex_exit(&tcp_random_lock);
23604 	for (i = 0; i < 10 * DEG_3; i++)
23605 		(void) tcp_random();
23606 }
23607 
23608 /*
23609  * tcp_random: Return a random number in the range [1 - (128K + 1)].
23610  * This range is selected to be approximately centered on TCP_ISS / 2,
23611  * and easy to compute. We get this value by generating a 32-bit random
23612  * number, selecting out the high-order 17 bits, and then adding one so
23613  * that we never return zero.
23614  */
23615 int
23616 tcp_random(void)
23617 {
23618 	int i;
23619 
23620 	mutex_enter(&tcp_random_lock);
23621 	*tcp_random_fptr += *tcp_random_rptr;
23622 
23623 	/*
23624 	 * The high-order bits are more random than the low-order bits,
23625 	 * so we select out the high-order 17 bits and add one so that
23626 	 * we never return zero.
23627 	 */
23628 	i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1;
23629 	if (++tcp_random_fptr >= tcp_random_end_ptr) {
23630 		tcp_random_fptr = tcp_random_state;
23631 		++tcp_random_rptr;
23632 	} else if (++tcp_random_rptr >= tcp_random_end_ptr)
23633 		tcp_random_rptr = tcp_random_state;
23634 
23635 	mutex_exit(&tcp_random_lock);
23636 	return (i);
23637 }
23638 
23639 /*
23640  * XXX This will go away when TPI is extended to send
23641  * info reqs to sockfs/timod .....
23642  * Given a queue, set the max packet size for the write
23643  * side of the queue below stream head.  This value is
23644  * cached on the stream head.
23645  * Returns 1 on success, 0 otherwise.
23646  */
23647 static int
23648 setmaxps(queue_t *q, int maxpsz)
23649 {
23650 	struct stdata	*stp;
23651 	queue_t		*wq;
23652 	stp = STREAM(q);
23653 
23654 	/*
23655 	 * At this point change of a queue parameter is not allowed
23656 	 * when a multiplexor is sitting on top.
23657 	 */
23658 	if (stp->sd_flag & STPLEX)
23659 		return (0);
23660 
23661 	claimstr(stp->sd_wrq);
23662 	wq = stp->sd_wrq->q_next;
23663 	ASSERT(wq != NULL);
23664 	(void) strqset(wq, QMAXPSZ, 0, maxpsz);
23665 	releasestr(stp->sd_wrq);
23666 	return (1);
23667 }
23668 
23669 static int
23670 tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, int *do_disconnectp,
23671     int *t_errorp, int *sys_errorp)
23672 {
23673 	int error;
23674 	int is_absreq_failure;
23675 	t_scalar_t *opt_lenp;
23676 	t_scalar_t opt_offset;
23677 	int prim_type;
23678 	struct T_conn_req *tcreqp;
23679 	struct T_conn_res *tcresp;
23680 	cred_t *cr;
23681 
23682 	cr = DB_CREDDEF(mp, tcp->tcp_cred);
23683 
23684 	prim_type = ((union T_primitives *)mp->b_rptr)->type;
23685 	ASSERT(prim_type == T_CONN_REQ || prim_type == O_T_CONN_RES ||
23686 	    prim_type == T_CONN_RES);
23687 
23688 	switch (prim_type) {
23689 	case T_CONN_REQ:
23690 		tcreqp = (struct T_conn_req *)mp->b_rptr;
23691 		opt_offset = tcreqp->OPT_offset;
23692 		opt_lenp = (t_scalar_t *)&tcreqp->OPT_length;
23693 		break;
23694 	case O_T_CONN_RES:
23695 	case T_CONN_RES:
23696 		tcresp = (struct T_conn_res *)mp->b_rptr;
23697 		opt_offset = tcresp->OPT_offset;
23698 		opt_lenp = (t_scalar_t *)&tcresp->OPT_length;
23699 		break;
23700 	}
23701 
23702 	*t_errorp = 0;
23703 	*sys_errorp = 0;
23704 	*do_disconnectp = 0;
23705 
23706 	error = tpi_optcom_buf(tcp->tcp_wq, mp, opt_lenp,
23707 	    opt_offset, cr, &tcp_opt_obj,
23708 	    NULL, &is_absreq_failure);
23709 
23710 	switch (error) {
23711 	case  0:		/* no error */
23712 		ASSERT(is_absreq_failure == 0);
23713 		return (0);
23714 	case ENOPROTOOPT:
23715 		*t_errorp = TBADOPT;
23716 		break;
23717 	case EACCES:
23718 		*t_errorp = TACCES;
23719 		break;
23720 	default:
23721 		*t_errorp = TSYSERR; *sys_errorp = error;
23722 		break;
23723 	}
23724 	if (is_absreq_failure != 0) {
23725 		/*
23726 		 * The connection request should get the local ack
23727 		 * T_OK_ACK and then a T_DISCON_IND.
23728 		 */
23729 		*do_disconnectp = 1;
23730 	}
23731 	return (-1);
23732 }
23733 
23734 /*
23735  * Split this function out so that if the secret changes, I'm okay.
23736  *
23737  * Initialize the tcp_iss_cookie and tcp_iss_key.
23738  */
23739 
23740 #define	PASSWD_SIZE 16  /* MUST be multiple of 4 */
23741 
23742 static void
23743 tcp_iss_key_init(uint8_t *phrase, int len)
23744 {
23745 	struct {
23746 		int32_t current_time;
23747 		uint32_t randnum;
23748 		uint16_t pad;
23749 		uint8_t ether[6];
23750 		uint8_t passwd[PASSWD_SIZE];
23751 	} tcp_iss_cookie;
23752 	time_t t;
23753 
23754 	/*
23755 	 * Start with the current absolute time.
23756 	 */
23757 	(void) drv_getparm(TIME, &t);
23758 	tcp_iss_cookie.current_time = t;
23759 
23760 	/*
23761 	 * XXX - Need a more random number per RFC 1750, not this crap.
23762 	 * OTOH, if what follows is pretty random, then I'm in better shape.
23763 	 */
23764 	tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random());
23765 	tcp_iss_cookie.pad = 0x365c;  /* Picked from HMAC pad values. */
23766 
23767 	/*
23768 	 * The cpu_type_info is pretty non-random.  Ugggh.  It does serve
23769 	 * as a good template.
23770 	 */
23771 	bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd,
23772 	    min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info)));
23773 
23774 	/*
23775 	 * The pass-phrase.  Normally this is supplied by user-called NDD.
23776 	 */
23777 	bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len));
23778 
23779 	/*
23780 	 * See 4010593 if this section becomes a problem again,
23781 	 * but the local ethernet address is useful here.
23782 	 */
23783 	(void) localetheraddr(NULL,
23784 	    (struct ether_addr *)&tcp_iss_cookie.ether);
23785 
23786 	/*
23787 	 * Hash 'em all together.  The MD5Final is called per-connection.
23788 	 */
23789 	mutex_enter(&tcp_iss_key_lock);
23790 	MD5Init(&tcp_iss_key);
23791 	MD5Update(&tcp_iss_key, (uchar_t *)&tcp_iss_cookie,
23792 	    sizeof (tcp_iss_cookie));
23793 	mutex_exit(&tcp_iss_key_lock);
23794 }
23795 
23796 /*
23797  * Set the RFC 1948 pass phrase
23798  */
23799 /* ARGSUSED */
23800 static int
23801 tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp,
23802     cred_t *cr)
23803 {
23804 	/*
23805 	 * Basically, value contains a new pass phrase.  Pass it along!
23806 	 */
23807 	tcp_iss_key_init((uint8_t *)value, strlen(value));
23808 	return (0);
23809 }
23810 
23811 /* ARGSUSED */
23812 static int
23813 tcp_sack_info_constructor(void *buf, void *cdrarg, int kmflags)
23814 {
23815 	bzero(buf, sizeof (tcp_sack_info_t));
23816 	return (0);
23817 }
23818 
23819 /* ARGSUSED */
23820 static int
23821 tcp_iphc_constructor(void *buf, void *cdrarg, int kmflags)
23822 {
23823 	bzero(buf, TCP_MAX_COMBINED_HEADER_LENGTH);
23824 	return (0);
23825 }
23826 
23827 void
23828 tcp_ddi_init(void)
23829 {
23830 	int i;
23831 
23832 	/* Initialize locks */
23833 	rw_init(&tcp_hsp_lock, NULL, RW_DEFAULT, NULL);
23834 	mutex_init(&tcp_g_q_lock, NULL, MUTEX_DEFAULT, NULL);
23835 	mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL);
23836 	mutex_init(&tcp_iss_key_lock, NULL, MUTEX_DEFAULT, NULL);
23837 	mutex_init(&tcp_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
23838 	rw_init(&tcp_reserved_port_lock, NULL, RW_DEFAULT, NULL);
23839 
23840 	for (i = 0; i < A_CNT(tcp_bind_fanout); i++) {
23841 		mutex_init(&tcp_bind_fanout[i].tf_lock, NULL,
23842 		    MUTEX_DEFAULT, NULL);
23843 	}
23844 
23845 	for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) {
23846 		mutex_init(&tcp_acceptor_fanout[i].tf_lock, NULL,
23847 		    MUTEX_DEFAULT, NULL);
23848 	}
23849 
23850 	/* TCP's IPsec code calls the packet dropper. */
23851 	ip_drop_register(&tcp_dropper, "TCP IPsec policy enforcement");
23852 
23853 	if (!tcp_g_nd) {
23854 		if (!tcp_param_register(tcp_param_arr, A_CNT(tcp_param_arr))) {
23855 			nd_free(&tcp_g_nd);
23856 		}
23857 	}
23858 
23859 	/*
23860 	 * Note: To really walk the device tree you need the devinfo
23861 	 * pointer to your device which is only available after probe/attach.
23862 	 * The following is safe only because it uses ddi_root_node()
23863 	 */
23864 	tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr,
23865 	    tcp_opt_obj.odb_opt_arr_cnt);
23866 
23867 	tcp_timercache = kmem_cache_create("tcp_timercache",
23868 	    sizeof (tcp_timer_t) + sizeof (mblk_t), 0,
23869 	    NULL, NULL, NULL, NULL, NULL, 0);
23870 
23871 	tcp_sack_info_cache = kmem_cache_create("tcp_sack_info_cache",
23872 	    sizeof (tcp_sack_info_t), 0,
23873 	    tcp_sack_info_constructor, NULL, NULL, NULL, NULL, 0);
23874 
23875 	tcp_iphc_cache = kmem_cache_create("tcp_iphc_cache",
23876 	    TCP_MAX_COMBINED_HEADER_LENGTH, 0,
23877 	    tcp_iphc_constructor, NULL, NULL, NULL, NULL, 0);
23878 
23879 	tcp_squeue_wput_proc = tcp_squeue_switch(tcp_squeue_wput);
23880 	tcp_squeue_close_proc = tcp_squeue_switch(tcp_squeue_close);
23881 
23882 	ip_squeue_init(tcp_squeue_add);
23883 
23884 	/* Initialize the random number generator */
23885 	tcp_random_init();
23886 
23887 	/*
23888 	 * Initialize RFC 1948 secret values.  This will probably be reset once
23889 	 * by the boot scripts.
23890 	 *
23891 	 * Use NULL name, as the name is caught by the new lockstats.
23892 	 *
23893 	 * Initialize with some random, non-guessable string, like the global
23894 	 * T_INFO_ACK.
23895 	 */
23896 
23897 	tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack,
23898 	    sizeof (tcp_g_t_info_ack));
23899 
23900 	if ((tcp_kstat = kstat_create(TCP_MOD_NAME, 0, "tcpstat",
23901 		"net", KSTAT_TYPE_NAMED,
23902 		sizeof (tcp_statistics) / sizeof (kstat_named_t),
23903 		KSTAT_FLAG_VIRTUAL)) != NULL) {
23904 		tcp_kstat->ks_data = &tcp_statistics;
23905 		kstat_install(tcp_kstat);
23906 	}
23907 
23908 	tcp_kstat_init();
23909 }
23910 
23911 void
23912 tcp_ddi_destroy(void)
23913 {
23914 	int i;
23915 
23916 	nd_free(&tcp_g_nd);
23917 
23918 	for (i = 0; i < A_CNT(tcp_bind_fanout); i++) {
23919 		mutex_destroy(&tcp_bind_fanout[i].tf_lock);
23920 	}
23921 
23922 	for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) {
23923 		mutex_destroy(&tcp_acceptor_fanout[i].tf_lock);
23924 	}
23925 
23926 	mutex_destroy(&tcp_iss_key_lock);
23927 	rw_destroy(&tcp_hsp_lock);
23928 	mutex_destroy(&tcp_g_q_lock);
23929 	mutex_destroy(&tcp_random_lock);
23930 	mutex_destroy(&tcp_epriv_port_lock);
23931 	rw_destroy(&tcp_reserved_port_lock);
23932 
23933 	ip_drop_unregister(&tcp_dropper);
23934 
23935 	kmem_cache_destroy(tcp_timercache);
23936 	kmem_cache_destroy(tcp_sack_info_cache);
23937 	kmem_cache_destroy(tcp_iphc_cache);
23938 
23939 	tcp_kstat_fini();
23940 }
23941 
23942 /*
23943  * Generate ISS, taking into account NDD changes may happen halfway through.
23944  * (If the iss is not zero, set it.)
23945  */
23946 
23947 static void
23948 tcp_iss_init(tcp_t *tcp)
23949 {
23950 	MD5_CTX context;
23951 	struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg;
23952 	uint32_t answer[4];
23953 
23954 	tcp_iss_incr_extra += (ISS_INCR >> 1);
23955 	tcp->tcp_iss = tcp_iss_incr_extra;
23956 	switch (tcp_strong_iss) {
23957 	case 2:
23958 		mutex_enter(&tcp_iss_key_lock);
23959 		context = tcp_iss_key;
23960 		mutex_exit(&tcp_iss_key_lock);
23961 		arg.ports = tcp->tcp_ports;
23962 		if (tcp->tcp_ipversion == IPV4_VERSION) {
23963 			IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src,
23964 			    &arg.src);
23965 			IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_dst,
23966 			    &arg.dst);
23967 		} else {
23968 			arg.src = tcp->tcp_ip6h->ip6_src;
23969 			arg.dst = tcp->tcp_ip6h->ip6_dst;
23970 		}
23971 		MD5Update(&context, (uchar_t *)&arg, sizeof (arg));
23972 		MD5Final((uchar_t *)answer, &context);
23973 		tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3];
23974 		/*
23975 		 * Now that we've hashed into a unique per-connection sequence
23976 		 * space, add a random increment per strong_iss == 1.  So I
23977 		 * guess we'll have to...
23978 		 */
23979 		/* FALLTHRU */
23980 	case 1:
23981 		tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random();
23982 		break;
23983 	default:
23984 		tcp->tcp_iss += (uint32_t)gethrestime_sec() * ISS_INCR;
23985 		break;
23986 	}
23987 	tcp->tcp_valid_bits = TCP_ISS_VALID;
23988 	tcp->tcp_fss = tcp->tcp_iss - 1;
23989 	tcp->tcp_suna = tcp->tcp_iss;
23990 	tcp->tcp_snxt = tcp->tcp_iss + 1;
23991 	tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
23992 	tcp->tcp_csuna = tcp->tcp_snxt;
23993 }
23994 
23995 /*
23996  * Exported routine for extracting active tcp connection status.
23997  *
23998  * This is used by the Solaris Cluster Networking software to
23999  * gather a list of connections that need to be forwarded to
24000  * specific nodes in the cluster when configuration changes occur.
24001  *
24002  * The callback is invoked for each tcp_t structure. Returning
24003  * non-zero from the callback routine terminates the search.
24004  */
24005 int
24006 cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg)
24007 {
24008 	tcp_t *tcp;
24009 	cl_tcp_info_t	cl_tcpi;
24010 	connf_t	*connfp;
24011 	conn_t	*connp;
24012 	int	i;
24013 
24014 	ASSERT(callback != NULL);
24015 
24016 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
24017 
24018 		connfp = &ipcl_globalhash_fanout[i];
24019 		connp = NULL;
24020 
24021 		while ((connp =
24022 		    ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) {
24023 
24024 			tcp = connp->conn_tcp;
24025 			cl_tcpi.cl_tcpi_version = CL_TCPI_V1;
24026 			cl_tcpi.cl_tcpi_ipversion = tcp->tcp_ipversion;
24027 			cl_tcpi.cl_tcpi_state = tcp->tcp_state;
24028 			cl_tcpi.cl_tcpi_lport = tcp->tcp_lport;
24029 			cl_tcpi.cl_tcpi_fport = tcp->tcp_fport;
24030 			/*
24031 			 * The macros tcp_laddr and tcp_faddr give the IPv4
24032 			 * addresses. They are copied implicitly below as
24033 			 * mapped addresses.
24034 			 */
24035 			cl_tcpi.cl_tcpi_laddr_v6 = tcp->tcp_ip_src_v6;
24036 			if (tcp->tcp_ipversion == IPV4_VERSION) {
24037 				cl_tcpi.cl_tcpi_faddr =
24038 				    tcp->tcp_ipha->ipha_dst;
24039 			} else {
24040 				cl_tcpi.cl_tcpi_faddr_v6 =
24041 				    tcp->tcp_ip6h->ip6_dst;
24042 			}
24043 
24044 			/*
24045 			 * If the callback returns non-zero
24046 			 * we terminate the traversal.
24047 			 */
24048 			if ((*callback)(&cl_tcpi, arg) != 0) {
24049 				CONN_DEC_REF(tcp->tcp_connp);
24050 				return (1);
24051 			}
24052 		}
24053 	}
24054 
24055 	return (0);
24056 }
24057 
24058 /*
24059  * Macros used for accessing the different types of sockaddr
24060  * structures inside a tcp_ioc_abort_conn_t.
24061  */
24062 #define	TCP_AC_V4LADDR(acp) ((sin_t *)&(acp)->ac_local)
24063 #define	TCP_AC_V4RADDR(acp) ((sin_t *)&(acp)->ac_remote)
24064 #define	TCP_AC_V4LOCAL(acp) (TCP_AC_V4LADDR(acp)->sin_addr.s_addr)
24065 #define	TCP_AC_V4REMOTE(acp) (TCP_AC_V4RADDR(acp)->sin_addr.s_addr)
24066 #define	TCP_AC_V4LPORT(acp) (TCP_AC_V4LADDR(acp)->sin_port)
24067 #define	TCP_AC_V4RPORT(acp) (TCP_AC_V4RADDR(acp)->sin_port)
24068 #define	TCP_AC_V6LADDR(acp) ((sin6_t *)&(acp)->ac_local)
24069 #define	TCP_AC_V6RADDR(acp) ((sin6_t *)&(acp)->ac_remote)
24070 #define	TCP_AC_V6LOCAL(acp) (TCP_AC_V6LADDR(acp)->sin6_addr)
24071 #define	TCP_AC_V6REMOTE(acp) (TCP_AC_V6RADDR(acp)->sin6_addr)
24072 #define	TCP_AC_V6LPORT(acp) (TCP_AC_V6LADDR(acp)->sin6_port)
24073 #define	TCP_AC_V6RPORT(acp) (TCP_AC_V6RADDR(acp)->sin6_port)
24074 
24075 /*
24076  * Return the correct error code to mimic the behavior
24077  * of a connection reset.
24078  */
24079 #define	TCP_AC_GET_ERRCODE(state, err) {	\
24080 		switch ((state)) {		\
24081 		case TCPS_SYN_SENT:		\
24082 		case TCPS_SYN_RCVD:		\
24083 			(err) = ECONNREFUSED;	\
24084 			break;			\
24085 		case TCPS_ESTABLISHED:		\
24086 		case TCPS_FIN_WAIT_1:		\
24087 		case TCPS_FIN_WAIT_2:		\
24088 		case TCPS_CLOSE_WAIT:		\
24089 			(err) = ECONNRESET;	\
24090 			break;			\
24091 		case TCPS_CLOSING:		\
24092 		case TCPS_LAST_ACK:		\
24093 		case TCPS_TIME_WAIT:		\
24094 			(err) = 0;		\
24095 			break;			\
24096 		default:			\
24097 			(err) = ENXIO;		\
24098 		}				\
24099 	}
24100 
24101 /*
24102  * Check if a tcp structure matches the info in acp.
24103  */
24104 #define	TCP_AC_ADDR_MATCH(acp, tcp)					\
24105 	(((acp)->ac_local.ss_family == AF_INET) ?		\
24106 	((TCP_AC_V4LOCAL((acp)) == INADDR_ANY ||		\
24107 	TCP_AC_V4LOCAL((acp)) == (tcp)->tcp_ip_src) &&	\
24108 	(TCP_AC_V4REMOTE((acp)) == INADDR_ANY ||		\
24109 	TCP_AC_V4REMOTE((acp)) == (tcp)->tcp_remote) &&	\
24110 	(TCP_AC_V4LPORT((acp)) == 0 ||				\
24111 	TCP_AC_V4LPORT((acp)) == (tcp)->tcp_lport) &&		\
24112 	(TCP_AC_V4RPORT((acp)) == 0 ||				\
24113 	TCP_AC_V4RPORT((acp)) == (tcp)->tcp_fport) &&		\
24114 	(acp)->ac_start <= (tcp)->tcp_state &&	\
24115 	(acp)->ac_end >= (tcp)->tcp_state) :		\
24116 	((IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL((acp))) ||	\
24117 	IN6_ARE_ADDR_EQUAL(&TCP_AC_V6LOCAL((acp)),		\
24118 	&(tcp)->tcp_ip_src_v6)) &&				\
24119 	(IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE((acp))) ||	\
24120 	IN6_ARE_ADDR_EQUAL(&TCP_AC_V6REMOTE((acp)),		\
24121 	&(tcp)->tcp_remote_v6)) &&				\
24122 	(TCP_AC_V6LPORT((acp)) == 0 ||				\
24123 	TCP_AC_V6LPORT((acp)) == (tcp)->tcp_lport) &&		\
24124 	(TCP_AC_V6RPORT((acp)) == 0 ||				\
24125 	TCP_AC_V6RPORT((acp)) == (tcp)->tcp_fport) &&		\
24126 	(acp)->ac_start <= (tcp)->tcp_state &&	\
24127 	(acp)->ac_end >= (tcp)->tcp_state))
24128 
24129 #define	TCP_AC_MATCH(acp, tcp)					\
24130 	(((acp)->ac_zoneid == ALL_ZONES ||			\
24131 	(acp)->ac_zoneid == tcp->tcp_connp->conn_zoneid) ?	\
24132 	TCP_AC_ADDR_MATCH(acp, tcp) : 0)
24133 
24134 /*
24135  * Build a message containing a tcp_ioc_abort_conn_t structure
24136  * which is filled in with information from acp and tp.
24137  */
24138 static mblk_t *
24139 tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *acp, tcp_t *tp)
24140 {
24141 	mblk_t *mp;
24142 	tcp_ioc_abort_conn_t *tacp;
24143 
24144 	mp = allocb(sizeof (uint32_t) + sizeof (*acp), BPRI_LO);
24145 	if (mp == NULL)
24146 		return (NULL);
24147 
24148 	mp->b_datap->db_type = M_CTL;
24149 
24150 	*((uint32_t *)mp->b_rptr) = TCP_IOC_ABORT_CONN;
24151 	tacp = (tcp_ioc_abort_conn_t *)((uchar_t *)mp->b_rptr +
24152 		sizeof (uint32_t));
24153 
24154 	tacp->ac_start = acp->ac_start;
24155 	tacp->ac_end = acp->ac_end;
24156 	tacp->ac_zoneid = acp->ac_zoneid;
24157 
24158 	if (acp->ac_local.ss_family == AF_INET) {
24159 		tacp->ac_local.ss_family = AF_INET;
24160 		tacp->ac_remote.ss_family = AF_INET;
24161 		TCP_AC_V4LOCAL(tacp) = tp->tcp_ip_src;
24162 		TCP_AC_V4REMOTE(tacp) = tp->tcp_remote;
24163 		TCP_AC_V4LPORT(tacp) = tp->tcp_lport;
24164 		TCP_AC_V4RPORT(tacp) = tp->tcp_fport;
24165 	} else {
24166 		tacp->ac_local.ss_family = AF_INET6;
24167 		tacp->ac_remote.ss_family = AF_INET6;
24168 		TCP_AC_V6LOCAL(tacp) = tp->tcp_ip_src_v6;
24169 		TCP_AC_V6REMOTE(tacp) = tp->tcp_remote_v6;
24170 		TCP_AC_V6LPORT(tacp) = tp->tcp_lport;
24171 		TCP_AC_V6RPORT(tacp) = tp->tcp_fport;
24172 	}
24173 	mp->b_wptr = (uchar_t *)mp->b_rptr + sizeof (uint32_t) + sizeof (*acp);
24174 	return (mp);
24175 }
24176 
24177 /*
24178  * Print a tcp_ioc_abort_conn_t structure.
24179  */
24180 static void
24181 tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *acp)
24182 {
24183 	char lbuf[128];
24184 	char rbuf[128];
24185 	sa_family_t af;
24186 	in_port_t lport, rport;
24187 	ushort_t logflags;
24188 
24189 	af = acp->ac_local.ss_family;
24190 
24191 	if (af == AF_INET) {
24192 		(void) inet_ntop(af, (const void *)&TCP_AC_V4LOCAL(acp),
24193 				lbuf, 128);
24194 		(void) inet_ntop(af, (const void *)&TCP_AC_V4REMOTE(acp),
24195 				rbuf, 128);
24196 		lport = ntohs(TCP_AC_V4LPORT(acp));
24197 		rport = ntohs(TCP_AC_V4RPORT(acp));
24198 	} else {
24199 		(void) inet_ntop(af, (const void *)&TCP_AC_V6LOCAL(acp),
24200 				lbuf, 128);
24201 		(void) inet_ntop(af, (const void *)&TCP_AC_V6REMOTE(acp),
24202 				rbuf, 128);
24203 		lport = ntohs(TCP_AC_V6LPORT(acp));
24204 		rport = ntohs(TCP_AC_V6RPORT(acp));
24205 	}
24206 
24207 	logflags = SL_TRACE | SL_NOTE;
24208 	/*
24209 	 * Don't print this message to the console if the operation was done
24210 	 * to a non-global zone.
24211 	 */
24212 	if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES)
24213 		logflags |= SL_CONSOLE;
24214 	(void) strlog(TCP_MOD_ID, 0, 1, logflags,
24215 		"TCP_IOC_ABORT_CONN: local = %s:%d, remote = %s:%d, "
24216 		"start = %d, end = %d\n", lbuf, lport, rbuf, rport,
24217 		acp->ac_start, acp->ac_end);
24218 }
24219 
24220 /*
24221  * Called inside tcp_rput when a message built using
24222  * tcp_ioctl_abort_build_msg is put into a queue.
24223  * Note that when we get here there is no wildcard in acp any more.
24224  */
24225 static void
24226 tcp_ioctl_abort_handler(tcp_t *tcp, mblk_t *mp)
24227 {
24228 	tcp_ioc_abort_conn_t *acp;
24229 
24230 	acp = (tcp_ioc_abort_conn_t *)(mp->b_rptr + sizeof (uint32_t));
24231 	if (tcp->tcp_state <= acp->ac_end) {
24232 		/*
24233 		 * If we get here, we are already on the correct
24234 		 * squeue. This ioctl follows the following path
24235 		 * tcp_wput -> tcp_wput_ioctl -> tcp_ioctl_abort_conn
24236 		 * ->tcp_ioctl_abort->squeue_fill (if on a
24237 		 * different squeue)
24238 		 */
24239 		int errcode;
24240 
24241 		TCP_AC_GET_ERRCODE(tcp->tcp_state, errcode);
24242 		(void) tcp_clean_death(tcp, errcode, 26);
24243 	}
24244 	freemsg(mp);
24245 }
24246 
24247 /*
24248  * Abort all matching connections on a hash chain.
24249  */
24250 static int
24251 tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *acp, int index, int *count,
24252     boolean_t exact)
24253 {
24254 	int nmatch, err = 0;
24255 	tcp_t *tcp;
24256 	MBLKP mp, last, listhead = NULL;
24257 	conn_t	*tconnp;
24258 	connf_t	*connfp = &ipcl_conn_fanout[index];
24259 
24260 startover:
24261 	nmatch = 0;
24262 
24263 	mutex_enter(&connfp->connf_lock);
24264 	for (tconnp = connfp->connf_head; tconnp != NULL;
24265 	    tconnp = tconnp->conn_next) {
24266 		tcp = tconnp->conn_tcp;
24267 		if (TCP_AC_MATCH(acp, tcp)) {
24268 			CONN_INC_REF(tcp->tcp_connp);
24269 			mp = tcp_ioctl_abort_build_msg(acp, tcp);
24270 			if (mp == NULL) {
24271 				err = ENOMEM;
24272 				CONN_DEC_REF(tcp->tcp_connp);
24273 				break;
24274 			}
24275 			mp->b_prev = (mblk_t *)tcp;
24276 
24277 			if (listhead == NULL) {
24278 				listhead = mp;
24279 				last = mp;
24280 			} else {
24281 				last->b_next = mp;
24282 				last = mp;
24283 			}
24284 			nmatch++;
24285 			if (exact)
24286 				break;
24287 		}
24288 
24289 		/* Avoid holding lock for too long. */
24290 		if (nmatch >= 500)
24291 			break;
24292 	}
24293 	mutex_exit(&connfp->connf_lock);
24294 
24295 	/* Pass mp into the correct tcp */
24296 	while ((mp = listhead) != NULL) {
24297 		listhead = listhead->b_next;
24298 		tcp = (tcp_t *)mp->b_prev;
24299 		mp->b_next = mp->b_prev = NULL;
24300 		squeue_fill(tcp->tcp_connp->conn_sqp, mp,
24301 		    tcp_input, tcp->tcp_connp, SQTAG_TCP_ABORT_BUCKET);
24302 	}
24303 
24304 	*count += nmatch;
24305 	if (nmatch >= 500 && err == 0)
24306 		goto startover;
24307 	return (err);
24308 }
24309 
24310 /*
24311  * Abort all connections that matches the attributes specified in acp.
24312  */
24313 static int
24314 tcp_ioctl_abort(tcp_ioc_abort_conn_t *acp)
24315 {
24316 	sa_family_t af;
24317 	uint32_t  ports;
24318 	uint16_t *pports;
24319 	int err = 0, count = 0;
24320 	boolean_t exact = B_FALSE; /* set when there is no wildcard */
24321 	int index = -1;
24322 	ushort_t logflags;
24323 
24324 	af = acp->ac_local.ss_family;
24325 
24326 	if (af == AF_INET) {
24327 		if (TCP_AC_V4REMOTE(acp) != INADDR_ANY &&
24328 		    TCP_AC_V4LPORT(acp) != 0 && TCP_AC_V4RPORT(acp) != 0) {
24329 			pports = (uint16_t *)&ports;
24330 			pports[1] = TCP_AC_V4LPORT(acp);
24331 			pports[0] = TCP_AC_V4RPORT(acp);
24332 			exact = (TCP_AC_V4LOCAL(acp) != INADDR_ANY);
24333 		}
24334 	} else {
24335 		if (!IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE(acp)) &&
24336 		    TCP_AC_V6LPORT(acp) != 0 && TCP_AC_V6RPORT(acp) != 0) {
24337 			pports = (uint16_t *)&ports;
24338 			pports[1] = TCP_AC_V6LPORT(acp);
24339 			pports[0] = TCP_AC_V6RPORT(acp);
24340 			exact = !IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL(acp));
24341 		}
24342 	}
24343 
24344 	/*
24345 	 * For cases where remote addr, local port, and remote port are non-
24346 	 * wildcards, tcp_ioctl_abort_bucket will only be called once.
24347 	 */
24348 	if (index != -1) {
24349 		err = tcp_ioctl_abort_bucket(acp, index,
24350 			    &count, exact);
24351 	} else {
24352 		/*
24353 		 * loop through all entries for wildcard case
24354 		 */
24355 		for (index = 0; index < ipcl_conn_fanout_size; index++) {
24356 			err = tcp_ioctl_abort_bucket(acp, index,
24357 			    &count, exact);
24358 			if (err != 0)
24359 				break;
24360 		}
24361 	}
24362 
24363 	logflags = SL_TRACE | SL_NOTE;
24364 	/*
24365 	 * Don't print this message to the console if the operation was done
24366 	 * to a non-global zone.
24367 	 */
24368 	if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES)
24369 		logflags |= SL_CONSOLE;
24370 	(void) strlog(TCP_MOD_ID, 0, 1, logflags, "TCP_IOC_ABORT_CONN: "
24371 	    "aborted %d connection%c\n", count, ((count > 1) ? 's' : ' '));
24372 	if (err == 0 && count == 0)
24373 		err = ENOENT;
24374 	return (err);
24375 }
24376 
24377 /*
24378  * Process the TCP_IOC_ABORT_CONN ioctl request.
24379  */
24380 static void
24381 tcp_ioctl_abort_conn(queue_t *q, mblk_t *mp)
24382 {
24383 	int	err;
24384 	IOCP    iocp;
24385 	MBLKP   mp1;
24386 	sa_family_t laf, raf;
24387 	tcp_ioc_abort_conn_t *acp;
24388 	zone_t *zptr;
24389 	zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid;
24390 
24391 	iocp = (IOCP)mp->b_rptr;
24392 
24393 	if ((mp1 = mp->b_cont) == NULL ||
24394 	    iocp->ioc_count != sizeof (tcp_ioc_abort_conn_t)) {
24395 		err = EINVAL;
24396 		goto out;
24397 	}
24398 
24399 	/* check permissions */
24400 	if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) {
24401 		err = EPERM;
24402 		goto out;
24403 	}
24404 
24405 	if (mp1->b_cont != NULL) {
24406 		freemsg(mp1->b_cont);
24407 		mp1->b_cont = NULL;
24408 	}
24409 
24410 	acp = (tcp_ioc_abort_conn_t *)mp1->b_rptr;
24411 	laf = acp->ac_local.ss_family;
24412 	raf = acp->ac_remote.ss_family;
24413 
24414 	/* check that a zone with the supplied zoneid exists */
24415 	if (acp->ac_zoneid != GLOBAL_ZONEID && acp->ac_zoneid != ALL_ZONES) {
24416 		zptr = zone_find_by_id(zoneid);
24417 		if (zptr != NULL) {
24418 			zone_rele(zptr);
24419 		} else {
24420 			err = EINVAL;
24421 			goto out;
24422 		}
24423 	}
24424 
24425 	if (acp->ac_start < TCPS_SYN_SENT || acp->ac_end > TCPS_TIME_WAIT ||
24426 	    acp->ac_start > acp->ac_end || laf != raf ||
24427 	    (laf != AF_INET && laf != AF_INET6)) {
24428 		err = EINVAL;
24429 		goto out;
24430 	}
24431 
24432 	tcp_ioctl_abort_dump(acp);
24433 	err = tcp_ioctl_abort(acp);
24434 
24435 out:
24436 	if (mp1 != NULL) {
24437 		freemsg(mp1);
24438 		mp->b_cont = NULL;
24439 	}
24440 
24441 	if (err != 0)
24442 		miocnak(q, mp, 0, err);
24443 	else
24444 		miocack(q, mp, 0, 0);
24445 }
24446 
24447 /*
24448  * tcp_time_wait_processing() handles processing of incoming packets when
24449  * the tcp is in the TIME_WAIT state.
24450  * A TIME_WAIT tcp that has an associated open TCP stream is never put
24451  * on the time wait list.
24452  */
24453 void
24454 tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, uint32_t seg_seq,
24455     uint32_t seg_ack, int seg_len, tcph_t *tcph)
24456 {
24457 	int32_t		bytes_acked;
24458 	int32_t		gap;
24459 	int32_t		rgap;
24460 	tcp_opt_t	tcpopt;
24461 	uint_t		flags;
24462 	uint32_t	new_swnd = 0;
24463 	conn_t		*connp;
24464 
24465 	BUMP_LOCAL(tcp->tcp_ibsegs);
24466 	TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT);
24467 
24468 	flags = (unsigned int)tcph->th_flags[0] & 0xFF;
24469 	new_swnd = BE16_TO_U16(tcph->th_win) <<
24470 	    ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws);
24471 	if (tcp->tcp_snd_ts_ok) {
24472 		if (!tcp_paws_check(tcp, tcph, &tcpopt)) {
24473 			tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
24474 			    tcp->tcp_rnxt, TH_ACK);
24475 			goto done;
24476 		}
24477 	}
24478 	gap = seg_seq - tcp->tcp_rnxt;
24479 	rgap = tcp->tcp_rwnd - (gap + seg_len);
24480 	if (gap < 0) {
24481 		BUMP_MIB(&tcp_mib, tcpInDataDupSegs);
24482 		UPDATE_MIB(&tcp_mib, tcpInDataDupBytes,
24483 		    (seg_len > -gap ? -gap : seg_len));
24484 		seg_len += gap;
24485 		if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
24486 			if (flags & TH_RST) {
24487 				goto done;
24488 			}
24489 			if ((flags & TH_FIN) && seg_len == -1) {
24490 				/*
24491 				 * When TCP receives a duplicate FIN in
24492 				 * TIME_WAIT state, restart the 2 MSL timer.
24493 				 * See page 73 in RFC 793. Make sure this TCP
24494 				 * is already on the TIME_WAIT list. If not,
24495 				 * just restart the timer.
24496 				 */
24497 				if (TCP_IS_DETACHED(tcp)) {
24498 					tcp_time_wait_remove(tcp, NULL);
24499 					tcp_time_wait_append(tcp);
24500 					TCP_DBGSTAT(tcp_rput_time_wait);
24501 				} else {
24502 					ASSERT(tcp != NULL);
24503 					TCP_TIMER_RESTART(tcp,
24504 					    tcp_time_wait_interval);
24505 				}
24506 				tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
24507 				    tcp->tcp_rnxt, TH_ACK);
24508 				goto done;
24509 			}
24510 			flags |=  TH_ACK_NEEDED;
24511 			seg_len = 0;
24512 			goto process_ack;
24513 		}
24514 
24515 		/* Fix seg_seq, and chew the gap off the front. */
24516 		seg_seq = tcp->tcp_rnxt;
24517 	}
24518 
24519 	if ((flags & TH_SYN) && gap > 0 && rgap < 0) {
24520 		/*
24521 		 * Make sure that when we accept the connection, pick
24522 		 * an ISS greater than (tcp_snxt + ISS_INCR/2) for the
24523 		 * old connection.
24524 		 *
24525 		 * The next ISS generated is equal to tcp_iss_incr_extra
24526 		 * + ISS_INCR/2 + other components depending on the
24527 		 * value of tcp_strong_iss.  We pre-calculate the new
24528 		 * ISS here and compare with tcp_snxt to determine if
24529 		 * we need to make adjustment to tcp_iss_incr_extra.
24530 		 *
24531 		 * The above calculation is ugly and is a
24532 		 * waste of CPU cycles...
24533 		 */
24534 		uint32_t new_iss = tcp_iss_incr_extra;
24535 		int32_t adj;
24536 
24537 		switch (tcp_strong_iss) {
24538 		case 2: {
24539 			/* Add time and MD5 components. */
24540 			uint32_t answer[4];
24541 			struct {
24542 				uint32_t ports;
24543 				in6_addr_t src;
24544 				in6_addr_t dst;
24545 			} arg;
24546 			MD5_CTX context;
24547 
24548 			mutex_enter(&tcp_iss_key_lock);
24549 			context = tcp_iss_key;
24550 			mutex_exit(&tcp_iss_key_lock);
24551 			arg.ports = tcp->tcp_ports;
24552 			/* We use MAPPED addresses in tcp_iss_init */
24553 			arg.src = tcp->tcp_ip_src_v6;
24554 			if (tcp->tcp_ipversion == IPV4_VERSION) {
24555 				IN6_IPADDR_TO_V4MAPPED(
24556 					tcp->tcp_ipha->ipha_dst,
24557 					    &arg.dst);
24558 			} else {
24559 				arg.dst =
24560 				    tcp->tcp_ip6h->ip6_dst;
24561 			}
24562 			MD5Update(&context, (uchar_t *)&arg,
24563 			    sizeof (arg));
24564 			MD5Final((uchar_t *)answer, &context);
24565 			answer[0] ^= answer[1] ^ answer[2] ^ answer[3];
24566 			new_iss += (gethrtime() >> ISS_NSEC_SHT) + answer[0];
24567 			break;
24568 		}
24569 		case 1:
24570 			/* Add time component and min random (i.e. 1). */
24571 			new_iss += (gethrtime() >> ISS_NSEC_SHT) + 1;
24572 			break;
24573 		default:
24574 			/* Add only time component. */
24575 			new_iss += (uint32_t)gethrestime_sec() * ISS_INCR;
24576 			break;
24577 		}
24578 		if ((adj = (int32_t)(tcp->tcp_snxt - new_iss)) > 0) {
24579 			/*
24580 			 * New ISS not guaranteed to be ISS_INCR/2
24581 			 * ahead of the current tcp_snxt, so add the
24582 			 * difference to tcp_iss_incr_extra.
24583 			 */
24584 			tcp_iss_incr_extra += adj;
24585 		}
24586 		/*
24587 		 * If tcp_clean_death() can not perform the task now,
24588 		 * drop the SYN packet and let the other side re-xmit.
24589 		 * Otherwise pass the SYN packet back in, since the
24590 		 * old tcp state has been cleaned up or freed.
24591 		 */
24592 		if (tcp_clean_death(tcp, 0, 27) == -1)
24593 			goto done;
24594 		/*
24595 		 * We will come back to tcp_rput_data
24596 		 * on the global queue. Packets destined
24597 		 * for the global queue will be checked
24598 		 * with global policy. But the policy for
24599 		 * this packet has already been checked as
24600 		 * this was destined for the detached
24601 		 * connection. We need to bypass policy
24602 		 * check this time by attaching a dummy
24603 		 * ipsec_in with ipsec_in_dont_check set.
24604 		 */
24605 		if ((connp = ipcl_classify(mp, tcp->tcp_connp->conn_zoneid)) !=
24606 		    NULL) {
24607 			TCP_STAT(tcp_time_wait_syn_success);
24608 			tcp_reinput(connp, mp, tcp->tcp_connp->conn_sqp);
24609 			return;
24610 		}
24611 		goto done;
24612 	}
24613 
24614 	/*
24615 	 * rgap is the amount of stuff received out of window.  A negative
24616 	 * value is the amount out of window.
24617 	 */
24618 	if (rgap < 0) {
24619 		BUMP_MIB(&tcp_mib, tcpInDataPastWinSegs);
24620 		UPDATE_MIB(&tcp_mib, tcpInDataPastWinBytes, -rgap);
24621 		/* Fix seg_len and make sure there is something left. */
24622 		seg_len += rgap;
24623 		if (seg_len <= 0) {
24624 			if (flags & TH_RST) {
24625 				goto done;
24626 			}
24627 			flags |=  TH_ACK_NEEDED;
24628 			seg_len = 0;
24629 			goto process_ack;
24630 		}
24631 	}
24632 	/*
24633 	 * Check whether we can update tcp_ts_recent.  This test is
24634 	 * NOT the one in RFC 1323 3.4.  It is from Braden, 1993, "TCP
24635 	 * Extensions for High Performance: An Update", Internet Draft.
24636 	 */
24637 	if (tcp->tcp_snd_ts_ok &&
24638 	    TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
24639 	    SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
24640 		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
24641 		tcp->tcp_last_rcv_lbolt = lbolt64;
24642 	}
24643 
24644 	if (seg_seq != tcp->tcp_rnxt && seg_len > 0) {
24645 		/* Always ack out of order packets */
24646 		flags |= TH_ACK_NEEDED;
24647 		seg_len = 0;
24648 	} else if (seg_len > 0) {
24649 		BUMP_MIB(&tcp_mib, tcpInClosed);
24650 		BUMP_MIB(&tcp_mib, tcpInDataInorderSegs);
24651 		UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, seg_len);
24652 	}
24653 	if (flags & TH_RST) {
24654 		(void) tcp_clean_death(tcp, 0, 28);
24655 		goto done;
24656 	}
24657 	if (flags & TH_SYN) {
24658 		tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
24659 		    TH_RST|TH_ACK);
24660 		/*
24661 		 * Do not delete the TCP structure if it is in
24662 		 * TIME_WAIT state.  Refer to RFC 1122, 4.2.2.13.
24663 		 */
24664 		goto done;
24665 	}
24666 process_ack:
24667 	if (flags & TH_ACK) {
24668 		bytes_acked = (int)(seg_ack - tcp->tcp_suna);
24669 		if (bytes_acked <= 0) {
24670 			if (bytes_acked == 0 && seg_len == 0 &&
24671 			    new_swnd == tcp->tcp_swnd)
24672 				BUMP_MIB(&tcp_mib, tcpInDupAck);
24673 		} else {
24674 			/* Acks something not sent */
24675 			flags |= TH_ACK_NEEDED;
24676 		}
24677 	}
24678 	if (flags & TH_ACK_NEEDED) {
24679 		/*
24680 		 * Time to send an ack for some reason.
24681 		 */
24682 		tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
24683 		    tcp->tcp_rnxt, TH_ACK);
24684 	}
24685 done:
24686 	if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) {
24687 		DB_CKSUMSTART(mp) = 0;
24688 		mp->b_datap->db_struioflag &= ~STRUIO_EAGER;
24689 		TCP_STAT(tcp_time_wait_syn_fail);
24690 	}
24691 	freemsg(mp);
24692 }
24693 
24694 /*
24695  * Allocate a T_SVR4_OPTMGMT_REQ.
24696  * The caller needs to increment tcp_drop_opt_ack_cnt when sending these so
24697  * that tcp_rput_other can drop the acks.
24698  */
24699 static mblk_t *
24700 tcp_setsockopt_mp(int level, int cmd, char *opt, int optlen)
24701 {
24702 	mblk_t *mp;
24703 	struct T_optmgmt_req *tor;
24704 	struct opthdr *oh;
24705 	uint_t size;
24706 	char *optptr;
24707 
24708 	size = sizeof (*tor) + sizeof (*oh) + optlen;
24709 	mp = allocb(size, BPRI_MED);
24710 	if (mp == NULL)
24711 		return (NULL);
24712 
24713 	mp->b_wptr += size;
24714 	mp->b_datap->db_type = M_PROTO;
24715 	tor = (struct T_optmgmt_req *)mp->b_rptr;
24716 	tor->PRIM_type = T_SVR4_OPTMGMT_REQ;
24717 	tor->MGMT_flags = T_NEGOTIATE;
24718 	tor->OPT_length = sizeof (*oh) + optlen;
24719 	tor->OPT_offset = (t_scalar_t)sizeof (*tor);
24720 
24721 	oh = (struct opthdr *)&tor[1];
24722 	oh->level = level;
24723 	oh->name = cmd;
24724 	oh->len = optlen;
24725 	if (optlen != 0) {
24726 		optptr = (char *)&oh[1];
24727 		bcopy(opt, optptr, optlen);
24728 	}
24729 	return (mp);
24730 }
24731 
24732 /*
24733  * TCP Timers Implementation.
24734  */
24735 timeout_id_t
24736 tcp_timeout(conn_t *connp, void (*f)(void *), clock_t tim)
24737 {
24738 	mblk_t *mp;
24739 	tcp_timer_t *tcpt;
24740 	tcp_t *tcp = connp->conn_tcp;
24741 
24742 	ASSERT(connp->conn_sqp != NULL);
24743 
24744 	TCP_DBGSTAT(tcp_timeout_calls);
24745 
24746 	if (tcp->tcp_timercache == NULL) {
24747 		mp = tcp_timermp_alloc(KM_NOSLEEP | KM_PANIC);
24748 	} else {
24749 		TCP_DBGSTAT(tcp_timeout_cached_alloc);
24750 		mp = tcp->tcp_timercache;
24751 		tcp->tcp_timercache = mp->b_next;
24752 		mp->b_next = NULL;
24753 		ASSERT(mp->b_wptr == NULL);
24754 	}
24755 
24756 	CONN_INC_REF(connp);
24757 	tcpt = (tcp_timer_t *)mp->b_rptr;
24758 	tcpt->connp = connp;
24759 	tcpt->tcpt_proc = f;
24760 	tcpt->tcpt_tid = timeout(tcp_timer_callback, mp, tim);
24761 	return ((timeout_id_t)mp);
24762 }
24763 
24764 static void
24765 tcp_timer_callback(void *arg)
24766 {
24767 	mblk_t *mp = (mblk_t *)arg;
24768 	tcp_timer_t *tcpt;
24769 	conn_t	*connp;
24770 
24771 	tcpt = (tcp_timer_t *)mp->b_rptr;
24772 	connp = tcpt->connp;
24773 	squeue_fill(connp->conn_sqp, mp,
24774 	    tcp_timer_handler, connp, SQTAG_TCP_TIMER);
24775 }
24776 
24777 static void
24778 tcp_timer_handler(void *arg, mblk_t *mp, void *arg2)
24779 {
24780 	tcp_timer_t *tcpt;
24781 	conn_t *connp = (conn_t *)arg;
24782 	tcp_t *tcp = connp->conn_tcp;
24783 
24784 	tcpt = (tcp_timer_t *)mp->b_rptr;
24785 	ASSERT(connp == tcpt->connp);
24786 	ASSERT((squeue_t *)arg2 == connp->conn_sqp);
24787 
24788 	/*
24789 	 * If the TCP has reached the closed state, don't proceed any
24790 	 * further. This TCP logically does not exist on the system.
24791 	 * tcpt_proc could for example access queues, that have already
24792 	 * been qprocoff'ed off. Also see comments at the start of tcp_input
24793 	 */
24794 	if (tcp->tcp_state != TCPS_CLOSED) {
24795 		(*tcpt->tcpt_proc)(connp);
24796 	} else {
24797 		tcp->tcp_timer_tid = 0;
24798 	}
24799 	tcp_timer_free(connp->conn_tcp, mp);
24800 }
24801 
24802 /*
24803  * There is potential race with untimeout and the handler firing at the same
24804  * time. The mblock may be freed by the handler while we are trying to use
24805  * it. But since both should execute on the same squeue, this race should not
24806  * occur.
24807  */
24808 clock_t
24809 tcp_timeout_cancel(conn_t *connp, timeout_id_t id)
24810 {
24811 	mblk_t	*mp = (mblk_t *)id;
24812 	tcp_timer_t *tcpt;
24813 	clock_t delta;
24814 
24815 	TCP_DBGSTAT(tcp_timeout_cancel_reqs);
24816 
24817 	if (mp == NULL)
24818 		return (-1);
24819 
24820 	tcpt = (tcp_timer_t *)mp->b_rptr;
24821 	ASSERT(tcpt->connp == connp);
24822 
24823 	delta = untimeout(tcpt->tcpt_tid);
24824 
24825 	if (delta >= 0) {
24826 		TCP_DBGSTAT(tcp_timeout_canceled);
24827 		tcp_timer_free(connp->conn_tcp, mp);
24828 		CONN_DEC_REF(connp);
24829 	}
24830 
24831 	return (delta);
24832 }
24833 
24834 /*
24835  * Allocate space for the timer event. The allocation looks like mblk, but it is
24836  * not a proper mblk. To avoid confusion we set b_wptr to NULL.
24837  *
24838  * Dealing with failures: If we can't allocate from the timer cache we try
24839  * allocating from dblock caches using allocb_tryhard(). In this case b_wptr
24840  * points to b_rptr.
24841  * If we can't allocate anything using allocb_tryhard(), we perform a last
24842  * attempt and use kmem_alloc_tryhard(). In this case we set b_wptr to -1 and
24843  * save the actual allocation size in b_datap.
24844  */
24845 mblk_t *
24846 tcp_timermp_alloc(int kmflags)
24847 {
24848 	mblk_t *mp = (mblk_t *)kmem_cache_alloc(tcp_timercache,
24849 	    kmflags & ~KM_PANIC);
24850 
24851 	if (mp != NULL) {
24852 		mp->b_next = mp->b_prev = NULL;
24853 		mp->b_rptr = (uchar_t *)(&mp[1]);
24854 		mp->b_wptr = NULL;
24855 		mp->b_datap = NULL;
24856 		mp->b_queue = NULL;
24857 	} else if (kmflags & KM_PANIC) {
24858 		/*
24859 		 * Failed to allocate memory for the timer. Try allocating from
24860 		 * dblock caches.
24861 		 */
24862 		TCP_STAT(tcp_timermp_allocfail);
24863 		mp = allocb_tryhard(sizeof (tcp_timer_t));
24864 		if (mp == NULL) {
24865 			size_t size = 0;
24866 			/*
24867 			 * Memory is really low. Try tryhard allocation.
24868 			 */
24869 			TCP_STAT(tcp_timermp_allocdblfail);
24870 			mp = kmem_alloc_tryhard(sizeof (mblk_t) +
24871 			    sizeof (tcp_timer_t), &size, kmflags);
24872 			mp->b_rptr = (uchar_t *)(&mp[1]);
24873 			mp->b_next = mp->b_prev = NULL;
24874 			mp->b_wptr = (uchar_t *)-1;
24875 			mp->b_datap = (dblk_t *)size;
24876 			mp->b_queue = NULL;
24877 		}
24878 		ASSERT(mp->b_wptr != NULL);
24879 	}
24880 	TCP_DBGSTAT(tcp_timermp_alloced);
24881 
24882 	return (mp);
24883 }
24884 
24885 /*
24886  * Free per-tcp timer cache.
24887  * It can only contain entries from tcp_timercache.
24888  */
24889 void
24890 tcp_timermp_free(tcp_t *tcp)
24891 {
24892 	mblk_t *mp;
24893 
24894 	while ((mp = tcp->tcp_timercache) != NULL) {
24895 		ASSERT(mp->b_wptr == NULL);
24896 		tcp->tcp_timercache = tcp->tcp_timercache->b_next;
24897 		kmem_cache_free(tcp_timercache, mp);
24898 	}
24899 }
24900 
24901 /*
24902  * Free timer event. Put it on the per-tcp timer cache if there is not too many
24903  * events there already (currently at most two events are cached).
24904  * If the event is not allocated from the timer cache, free it right away.
24905  */
24906 static void
24907 tcp_timer_free(tcp_t *tcp, mblk_t *mp)
24908 {
24909 	mblk_t *mp1 = tcp->tcp_timercache;
24910 
24911 	if (mp->b_wptr != NULL) {
24912 		/*
24913 		 * This allocation is not from a timer cache, free it right
24914 		 * away.
24915 		 */
24916 		if (mp->b_wptr != (uchar_t *)-1)
24917 			freeb(mp);
24918 		else
24919 			kmem_free(mp, (size_t)mp->b_datap);
24920 	} else if (mp1 == NULL || mp1->b_next == NULL) {
24921 		/* Cache this timer block for future allocations */
24922 		mp->b_rptr = (uchar_t *)(&mp[1]);
24923 		mp->b_next = mp1;
24924 		tcp->tcp_timercache = mp;
24925 	} else {
24926 		kmem_cache_free(tcp_timercache, mp);
24927 		TCP_DBGSTAT(tcp_timermp_freed);
24928 	}
24929 }
24930 
24931 /*
24932  * End of TCP Timers implementation.
24933  */
24934 
24935 /*
24936  * tcp_{set,clr}qfull() functions are used to either set or clear QFULL
24937  * on the specified backing STREAMS q. Note, the caller may make the
24938  * decision to call based on the tcp_t.tcp_flow_stopped value which
24939  * when check outside the q's lock is only an advisory check ...
24940  */
24941 
24942 void
24943 tcp_setqfull(tcp_t *tcp)
24944 {
24945 	queue_t *q = tcp->tcp_wq;
24946 
24947 	if (!(q->q_flag & QFULL)) {
24948 		mutex_enter(QLOCK(q));
24949 		if (!(q->q_flag & QFULL)) {
24950 			/* still need to set QFULL */
24951 			q->q_flag |= QFULL;
24952 			tcp->tcp_flow_stopped = B_TRUE;
24953 			mutex_exit(QLOCK(q));
24954 			TCP_STAT(tcp_flwctl_on);
24955 		} else {
24956 			mutex_exit(QLOCK(q));
24957 		}
24958 	}
24959 }
24960 
24961 void
24962 tcp_clrqfull(tcp_t *tcp)
24963 {
24964 	queue_t *q = tcp->tcp_wq;
24965 
24966 	if (q->q_flag & QFULL) {
24967 		mutex_enter(QLOCK(q));
24968 		if (q->q_flag & QFULL) {
24969 			q->q_flag &= ~QFULL;
24970 			tcp->tcp_flow_stopped = B_FALSE;
24971 			mutex_exit(QLOCK(q));
24972 			if (q->q_flag & QWANTW)
24973 				qbackenable(q, 0);
24974 		} else {
24975 			mutex_exit(QLOCK(q));
24976 		}
24977 	}
24978 }
24979 
24980 /*
24981  * TCP Kstats implementation
24982  */
24983 static void
24984 tcp_kstat_init(void)
24985 {
24986 	tcp_named_kstat_t template = {
24987 		{ "rtoAlgorithm",	KSTAT_DATA_INT32, 0 },
24988 		{ "rtoMin",		KSTAT_DATA_INT32, 0 },
24989 		{ "rtoMax",		KSTAT_DATA_INT32, 0 },
24990 		{ "maxConn",		KSTAT_DATA_INT32, 0 },
24991 		{ "activeOpens",	KSTAT_DATA_UINT32, 0 },
24992 		{ "passiveOpens",	KSTAT_DATA_UINT32, 0 },
24993 		{ "attemptFails",	KSTAT_DATA_UINT32, 0 },
24994 		{ "estabResets",	KSTAT_DATA_UINT32, 0 },
24995 		{ "currEstab",		KSTAT_DATA_UINT32, 0 },
24996 		{ "inSegs",		KSTAT_DATA_UINT32, 0 },
24997 		{ "outSegs",		KSTAT_DATA_UINT32, 0 },
24998 		{ "retransSegs",	KSTAT_DATA_UINT32, 0 },
24999 		{ "connTableSize",	KSTAT_DATA_INT32, 0 },
25000 		{ "outRsts",		KSTAT_DATA_UINT32, 0 },
25001 		{ "outDataSegs",	KSTAT_DATA_UINT32, 0 },
25002 		{ "outDataBytes",	KSTAT_DATA_UINT32, 0 },
25003 		{ "retransBytes",	KSTAT_DATA_UINT32, 0 },
25004 		{ "outAck",		KSTAT_DATA_UINT32, 0 },
25005 		{ "outAckDelayed",	KSTAT_DATA_UINT32, 0 },
25006 		{ "outUrg",		KSTAT_DATA_UINT32, 0 },
25007 		{ "outWinUpdate",	KSTAT_DATA_UINT32, 0 },
25008 		{ "outWinProbe",	KSTAT_DATA_UINT32, 0 },
25009 		{ "outControl",		KSTAT_DATA_UINT32, 0 },
25010 		{ "outFastRetrans",	KSTAT_DATA_UINT32, 0 },
25011 		{ "inAckSegs",		KSTAT_DATA_UINT32, 0 },
25012 		{ "inAckBytes",		KSTAT_DATA_UINT32, 0 },
25013 		{ "inDupAck",		KSTAT_DATA_UINT32, 0 },
25014 		{ "inAckUnsent",	KSTAT_DATA_UINT32, 0 },
25015 		{ "inDataInorderSegs",	KSTAT_DATA_UINT32, 0 },
25016 		{ "inDataInorderBytes",	KSTAT_DATA_UINT32, 0 },
25017 		{ "inDataUnorderSegs",	KSTAT_DATA_UINT32, 0 },
25018 		{ "inDataUnorderBytes",	KSTAT_DATA_UINT32, 0 },
25019 		{ "inDataDupSegs",	KSTAT_DATA_UINT32, 0 },
25020 		{ "inDataDupBytes",	KSTAT_DATA_UINT32, 0 },
25021 		{ "inDataPartDupSegs",	KSTAT_DATA_UINT32, 0 },
25022 		{ "inDataPartDupBytes",	KSTAT_DATA_UINT32, 0 },
25023 		{ "inDataPastWinSegs",	KSTAT_DATA_UINT32, 0 },
25024 		{ "inDataPastWinBytes",	KSTAT_DATA_UINT32, 0 },
25025 		{ "inWinProbe",		KSTAT_DATA_UINT32, 0 },
25026 		{ "inWinUpdate",	KSTAT_DATA_UINT32, 0 },
25027 		{ "inClosed",		KSTAT_DATA_UINT32, 0 },
25028 		{ "rttUpdate",		KSTAT_DATA_UINT32, 0 },
25029 		{ "rttNoUpdate",	KSTAT_DATA_UINT32, 0 },
25030 		{ "timRetrans",		KSTAT_DATA_UINT32, 0 },
25031 		{ "timRetransDrop",	KSTAT_DATA_UINT32, 0 },
25032 		{ "timKeepalive",	KSTAT_DATA_UINT32, 0 },
25033 		{ "timKeepaliveProbe",	KSTAT_DATA_UINT32, 0 },
25034 		{ "timKeepaliveDrop",	KSTAT_DATA_UINT32, 0 },
25035 		{ "listenDrop",		KSTAT_DATA_UINT32, 0 },
25036 		{ "listenDropQ0",	KSTAT_DATA_UINT32, 0 },
25037 		{ "halfOpenDrop",	KSTAT_DATA_UINT32, 0 },
25038 		{ "outSackRetransSegs",	KSTAT_DATA_UINT32, 0 },
25039 		{ "connTableSize6",	KSTAT_DATA_INT32, 0 }
25040 	};
25041 
25042 	tcp_mibkp = kstat_create(TCP_MOD_NAME, 0, TCP_MOD_NAME,
25043 	    "mib2", KSTAT_TYPE_NAMED, NUM_OF_FIELDS(tcp_named_kstat_t), 0);
25044 
25045 	if (tcp_mibkp == NULL)
25046 		return;
25047 
25048 	template.rtoAlgorithm.value.ui32 = 4;
25049 	template.rtoMin.value.ui32 = tcp_rexmit_interval_min;
25050 	template.rtoMax.value.ui32 = tcp_rexmit_interval_max;
25051 	template.maxConn.value.i32 = -1;
25052 
25053 	bcopy(&template, tcp_mibkp->ks_data, sizeof (template));
25054 
25055 	tcp_mibkp->ks_update = tcp_kstat_update;
25056 
25057 	kstat_install(tcp_mibkp);
25058 }
25059 
25060 static void
25061 tcp_kstat_fini(void)
25062 {
25063 
25064 	if (tcp_mibkp != NULL) {
25065 		kstat_delete(tcp_mibkp);
25066 		tcp_mibkp = NULL;
25067 	}
25068 }
25069 
25070 static int
25071 tcp_kstat_update(kstat_t *kp, int rw)
25072 {
25073 	tcp_named_kstat_t	*tcpkp;
25074 	tcp_t			*tcp;
25075 	connf_t			*connfp;
25076 	conn_t			*connp;
25077 	int 			i;
25078 
25079 	if (!kp || !kp->ks_data)
25080 		return (EIO);
25081 
25082 	if (rw == KSTAT_WRITE)
25083 		return (EACCES);
25084 
25085 	tcpkp = (tcp_named_kstat_t *)kp->ks_data;
25086 
25087 	tcpkp->currEstab.value.ui32 = 0;
25088 
25089 	for (i = 0; i < CONN_G_HASH_SIZE; i++) {
25090 		connfp = &ipcl_globalhash_fanout[i];
25091 		connp = NULL;
25092 		while ((connp =
25093 		    ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) {
25094 			tcp = connp->conn_tcp;
25095 			switch (tcp_snmp_state(tcp)) {
25096 			case MIB2_TCP_established:
25097 			case MIB2_TCP_closeWait:
25098 				tcpkp->currEstab.value.ui32++;
25099 				break;
25100 			}
25101 		}
25102 	}
25103 
25104 	tcpkp->activeOpens.value.ui32 = tcp_mib.tcpActiveOpens;
25105 	tcpkp->passiveOpens.value.ui32 = tcp_mib.tcpPassiveOpens;
25106 	tcpkp->attemptFails.value.ui32 = tcp_mib.tcpAttemptFails;
25107 	tcpkp->estabResets.value.ui32 = tcp_mib.tcpEstabResets;
25108 	tcpkp->inSegs.value.ui32 = tcp_mib.tcpInSegs;
25109 	tcpkp->outSegs.value.ui32 = tcp_mib.tcpOutSegs;
25110 	tcpkp->retransSegs.value.ui32 =	tcp_mib.tcpRetransSegs;
25111 	tcpkp->connTableSize.value.i32 = tcp_mib.tcpConnTableSize;
25112 	tcpkp->outRsts.value.ui32 = tcp_mib.tcpOutRsts;
25113 	tcpkp->outDataSegs.value.ui32 = tcp_mib.tcpOutDataSegs;
25114 	tcpkp->outDataBytes.value.ui32 = tcp_mib.tcpOutDataBytes;
25115 	tcpkp->retransBytes.value.ui32 = tcp_mib.tcpRetransBytes;
25116 	tcpkp->outAck.value.ui32 = tcp_mib.tcpOutAck;
25117 	tcpkp->outAckDelayed.value.ui32 = tcp_mib.tcpOutAckDelayed;
25118 	tcpkp->outUrg.value.ui32 = tcp_mib.tcpOutUrg;
25119 	tcpkp->outWinUpdate.value.ui32 = tcp_mib.tcpOutWinUpdate;
25120 	tcpkp->outWinProbe.value.ui32 = tcp_mib.tcpOutWinProbe;
25121 	tcpkp->outControl.value.ui32 = tcp_mib.tcpOutControl;
25122 	tcpkp->outFastRetrans.value.ui32 = tcp_mib.tcpOutFastRetrans;
25123 	tcpkp->inAckSegs.value.ui32 = tcp_mib.tcpInAckSegs;
25124 	tcpkp->inAckBytes.value.ui32 = tcp_mib.tcpInAckBytes;
25125 	tcpkp->inDupAck.value.ui32 = tcp_mib.tcpInDupAck;
25126 	tcpkp->inAckUnsent.value.ui32 = tcp_mib.tcpInAckUnsent;
25127 	tcpkp->inDataInorderSegs.value.ui32 = tcp_mib.tcpInDataInorderSegs;
25128 	tcpkp->inDataInorderBytes.value.ui32 = tcp_mib.tcpInDataInorderBytes;
25129 	tcpkp->inDataUnorderSegs.value.ui32 = tcp_mib.tcpInDataUnorderSegs;
25130 	tcpkp->inDataUnorderBytes.value.ui32 = tcp_mib.tcpInDataUnorderBytes;
25131 	tcpkp->inDataDupSegs.value.ui32 = tcp_mib.tcpInDataDupSegs;
25132 	tcpkp->inDataDupBytes.value.ui32 = tcp_mib.tcpInDataDupBytes;
25133 	tcpkp->inDataPartDupSegs.value.ui32 = tcp_mib.tcpInDataPartDupSegs;
25134 	tcpkp->inDataPartDupBytes.value.ui32 = tcp_mib.tcpInDataPartDupBytes;
25135 	tcpkp->inDataPastWinSegs.value.ui32 = tcp_mib.tcpInDataPastWinSegs;
25136 	tcpkp->inDataPastWinBytes.value.ui32 = tcp_mib.tcpInDataPastWinBytes;
25137 	tcpkp->inWinProbe.value.ui32 = tcp_mib.tcpInWinProbe;
25138 	tcpkp->inWinUpdate.value.ui32 = tcp_mib.tcpInWinUpdate;
25139 	tcpkp->inClosed.value.ui32 = tcp_mib.tcpInClosed;
25140 	tcpkp->rttNoUpdate.value.ui32 = tcp_mib.tcpRttNoUpdate;
25141 	tcpkp->rttUpdate.value.ui32 = tcp_mib.tcpRttUpdate;
25142 	tcpkp->timRetrans.value.ui32 = tcp_mib.tcpTimRetrans;
25143 	tcpkp->timRetransDrop.value.ui32 = tcp_mib.tcpTimRetransDrop;
25144 	tcpkp->timKeepalive.value.ui32 = tcp_mib.tcpTimKeepalive;
25145 	tcpkp->timKeepaliveProbe.value.ui32 = tcp_mib.tcpTimKeepaliveProbe;
25146 	tcpkp->timKeepaliveDrop.value.ui32 = tcp_mib.tcpTimKeepaliveDrop;
25147 	tcpkp->listenDrop.value.ui32 = tcp_mib.tcpListenDrop;
25148 	tcpkp->listenDropQ0.value.ui32 = tcp_mib.tcpListenDropQ0;
25149 	tcpkp->halfOpenDrop.value.ui32 = tcp_mib.tcpHalfOpenDrop;
25150 	tcpkp->outSackRetransSegs.value.ui32 = tcp_mib.tcpOutSackRetransSegs;
25151 	tcpkp->connTableSize6.value.i32 = tcp_mib.tcp6ConnTableSize;
25152 
25153 	return (0);
25154 }
25155 
25156 void
25157 tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp)
25158 {
25159 	uint16_t	hdr_len;
25160 	ipha_t		*ipha;
25161 	uint8_t		*nexthdrp;
25162 	tcph_t		*tcph;
25163 
25164 	/* Already has an eager */
25165 	if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) {
25166 		TCP_STAT(tcp_reinput_syn);
25167 		squeue_enter(connp->conn_sqp, mp, connp->conn_recv,
25168 		    connp, SQTAG_TCP_REINPUT_EAGER);
25169 		return;
25170 	}
25171 
25172 	switch (IPH_HDR_VERSION(mp->b_rptr)) {
25173 	case IPV4_VERSION:
25174 		ipha = (ipha_t *)mp->b_rptr;
25175 		hdr_len = IPH_HDR_LENGTH(ipha);
25176 		break;
25177 	case IPV6_VERSION:
25178 		if (!ip_hdr_length_nexthdr_v6(mp, (ip6_t *)mp->b_rptr,
25179 		    &hdr_len, &nexthdrp)) {
25180 			CONN_DEC_REF(connp);
25181 			freemsg(mp);
25182 			return;
25183 		}
25184 		break;
25185 	}
25186 
25187 	tcph = (tcph_t *)&mp->b_rptr[hdr_len];
25188 	if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) {
25189 		mp->b_datap->db_struioflag |= STRUIO_EAGER;
25190 		DB_CKSUMSTART(mp) = (intptr_t)sqp;
25191 	}
25192 
25193 	squeue_fill(connp->conn_sqp, mp, connp->conn_recv, connp,
25194 	    SQTAG_TCP_REINPUT);
25195 }
25196 
25197 static squeue_func_t
25198 tcp_squeue_switch(int val)
25199 {
25200 	squeue_func_t rval = squeue_fill;
25201 
25202 	switch (val) {
25203 	case 1:
25204 		rval = squeue_enter_nodrain;
25205 		break;
25206 	case 2:
25207 		rval = squeue_enter;
25208 		break;
25209 	default:
25210 		break;
25211 	}
25212 	return (rval);
25213 }
25214 
25215 static void
25216 tcp_squeue_add(squeue_t *sqp)
25217 {
25218 	tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc(
25219 		sizeof (tcp_squeue_priv_t), KM_SLEEP);
25220 
25221 	*squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait;
25222 	tcp_time_wait->tcp_time_wait_tid = timeout(tcp_time_wait_collector,
25223 	    sqp, TCP_TIME_WAIT_DELAY);
25224 	if (tcp_free_list_max_cnt == 0) {
25225 		int tcp_ncpus = ((boot_max_ncpus == -1) ?
25226 			max_ncpus : boot_max_ncpus);
25227 
25228 		/*
25229 		 * Limit number of entries to 1% of availble memory / tcp_ncpus
25230 		 */
25231 		tcp_free_list_max_cnt = (freemem * PAGESIZE) /
25232 			(tcp_ncpus * sizeof (tcp_t) * 100);
25233 	}
25234 	tcp_time_wait->tcp_free_list_cnt = 0;
25235 }
25236