1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright (c) 2011, Joyent Inc. All rights reserved.
  25  * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
  26  */
  27 /* Copyright (c) 1990 Mentat Inc. */
  28 
  29 #include <sys/types.h>
  30 #include <sys/stream.h>
  31 #include <sys/strsun.h>
  32 #include <sys/strsubr.h>
  33 #include <sys/stropts.h>
  34 #include <sys/strlog.h>
  35 #define _SUN_TPI_VERSION 2
  36 #include <sys/tihdr.h>
  37 #include <sys/timod.h>
  38 #include <sys/ddi.h>
  39 #include <sys/sunddi.h>
  40 #include <sys/suntpi.h>
  41 #include <sys/xti_inet.h>
  42 #include <sys/cmn_err.h>
  43 #include <sys/debug.h>
  44 #include <sys/sdt.h>
  45 #include <sys/vtrace.h>
  46 #include <sys/kmem.h>
  47 #include <sys/ethernet.h>
  48 #include <sys/cpuvar.h>
  49 #include <sys/dlpi.h>
  50 #include <sys/pattr.h>
  51 #include <sys/policy.h>
  52 #include <sys/priv.h>
  53 #include <sys/zone.h>
  54 #include <sys/sunldi.h>
  55 
  56 #include <sys/errno.h>
  57 #include <sys/signal.h>
  58 #include <sys/socket.h>
  59 #include <sys/socketvar.h>
  60 #include <sys/sockio.h>
  61 #include <sys/isa_defs.h>
  62 #include <sys/md5.h>
  63 #include <sys/random.h>
  64 #include <sys/uio.h>
  65 #include <sys/systm.h>
  66 #include <netinet/in.h>
  67 #include <netinet/tcp.h>
  68 #include <netinet/ip6.h>
  69 #include <netinet/icmp6.h>
  70 #include <net/if.h>
  71 #include <net/route.h>
  72 #include <inet/ipsec_impl.h>
  73 
  74 #include <inet/common.h>
  75 #include <inet/ip.h>
  76 #include <inet/ip_impl.h>
  77 #include <inet/ip6.h>
  78 #include <inet/ip_ndp.h>
  79 #include <inet/proto_set.h>
  80 #include <inet/mib2.h>
  81 #include <inet/optcom.h>
  82 #include <inet/snmpcom.h>
  83 #include <inet/kstatcom.h>
  84 #include <inet/tcp.h>
  85 #include <inet/tcp_impl.h>
  86 #include <inet/tcp_cluster.h>
  87 #include <inet/udp_impl.h>
  88 #include <net/pfkeyv2.h>
  89 #include <inet/ipdrop.h>
  90 
  91 #include <inet/ipclassifier.h>
  92 #include <inet/ip_ire.h>
  93 #include <inet/ip_ftable.h>
  94 #include <inet/ip_if.h>
  95 #include <inet/ipp_common.h>
  96 #include <inet/ip_rts.h>
  97 #include <inet/ip_netinfo.h>
  98 #include <sys/squeue_impl.h>
  99 #include <sys/squeue.h>
 100 #include <sys/tsol/label.h>
 101 #include <sys/tsol/tnet.h>
 102 #include <rpc/pmap_prot.h>
 103 #include <sys/callo.h>
 104 
 105 /*
 106  * TCP Notes: aka FireEngine Phase I (PSARC 2002/433)
 107  *
 108  * (Read the detailed design doc in PSARC case directory)
 109  *
 110  * The entire tcp state is contained in tcp_t and conn_t structure
 111  * which are allocated in tandem using ipcl_conn_create() and passing
 112  * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect
 113  * the references on the tcp_t. The tcp_t structure is never compressed
 114  * and packets always land on the correct TCP perimeter from the time
 115  * eager is created till the time tcp_t dies (as such the old mentat
 116  * TCP global queue is not used for detached state and no IPSEC checking
 117  * is required). The global queue is still allocated to send out resets
 118  * for connection which have no listeners and IP directly calls
 119  * tcp_xmit_listeners_reset() which does any policy check.
 120  *
 121  * Protection and Synchronisation mechanism:
 122  *
 123  * The tcp data structure does not use any kind of lock for protecting
 124  * its state but instead uses 'squeues' for mutual exclusion from various
 125  * read and write side threads. To access a tcp member, the thread should
 126  * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS,
 127  * or SQ_NODRAIN). Since the squeues allow a direct function call, caller
 128  * can pass any tcp function having prototype of edesc_t as argument
 129  * (different from traditional STREAMs model where packets come in only
 130  * designated entry points). The list of functions that can be directly
 131  * called via squeue are listed before the usual function prototype.
 132  *
 133  * Referencing:
 134  *
 135  * TCP is MT-Hot and we use a reference based scheme to make sure that the
 136  * tcp structure doesn't disappear when its needed. When the application
 137  * creates an outgoing connection or accepts an incoming connection, we
 138  * start out with 2 references on 'conn_ref'. One for TCP and one for IP.
 139  * The IP reference is just a symbolic reference since ip_tcpclose()
 140  * looks at tcp structure after tcp_close_output() returns which could
 141  * have dropped the last TCP reference. So as long as the connection is
 142  * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the
 143  * conn_t. The classifier puts its own reference when the connection is
 144  * inserted in listen or connected hash. Anytime a thread needs to enter
 145  * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr
 146  * on write side or by doing a classify on read side and then puts a
 147  * reference on the conn before doing squeue_enter/tryenter/fill. For
 148  * read side, the classifier itself puts the reference under fanout lock
 149  * to make sure that tcp can't disappear before it gets processed. The
 150  * squeue will drop this reference automatically so the called function
 151  * doesn't have to do a DEC_REF.
 152  *
 153  * Opening a new connection:
 154  *
 155  * The outgoing connection open is pretty simple. tcp_open() does the
 156  * work in creating the conn/tcp structure and initializing it. The
 157  * squeue assignment is done based on the CPU the application
 158  * is running on. So for outbound connections, processing is always done
 159  * on application CPU which might be different from the incoming CPU
 160  * being interrupted by the NIC. An optimal way would be to figure out
 161  * the NIC <-> CPU binding at listen time, and assign the outgoing
 162  * connection to the squeue attached to the CPU that will be interrupted
 163  * for incoming packets (we know the NIC based on the bind IP address).
 164  * This might seem like a problem if more data is going out but the
 165  * fact is that in most cases the transmit is ACK driven transmit where
 166  * the outgoing data normally sits on TCP's xmit queue waiting to be
 167  * transmitted.
 168  *
 169  * Accepting a connection:
 170  *
 171  * This is a more interesting case because of various races involved in
 172  * establishing a eager in its own perimeter. Read the meta comment on
 173  * top of tcp_input_listener(). But briefly, the squeue is picked by
 174  * ip_fanout based on the ring or the sender (if loopback).
 175  *
 176  * Closing a connection:
 177  *
 178  * The close is fairly straight forward. tcp_close() calls tcp_close_output()
 179  * via squeue to do the close and mark the tcp as detached if the connection
 180  * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its
 181  * reference but tcp_close() drop IP's reference always. So if tcp was
 182  * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP
 183  * and 1 because it is in classifier's connected hash. This is the condition
 184  * we use to determine that its OK to clean up the tcp outside of squeue
 185  * when time wait expires (check the ref under fanout and conn_lock and
 186  * if it is 2, remove it from fanout hash and kill it).
 187  *
 188  * Although close just drops the necessary references and marks the
 189  * tcp_detached state, tcp_close needs to know the tcp_detached has been
 190  * set (under squeue) before letting the STREAM go away (because a
 191  * inbound packet might attempt to go up the STREAM while the close
 192  * has happened and tcp_detached is not set). So a special lock and
 193  * flag is used along with a condition variable (tcp_closelock, tcp_closed,
 194  * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked
 195  * tcp_detached.
 196  *
 197  * Special provisions and fast paths:
 198  *
 199  * We make special provisions for sockfs by marking tcp_issocket
 200  * whenever we have only sockfs on top of TCP. This allows us to skip
 201  * putting the tcp in acceptor hash since a sockfs listener can never
 202  * become acceptor and also avoid allocating a tcp_t for acceptor STREAM
 203  * since eager has already been allocated and the accept now happens
 204  * on acceptor STREAM. There is a big blob of comment on top of
 205  * tcp_input_listener explaining the new accept. When socket is POP'd,
 206  * sockfs sends us an ioctl to mark the fact and we go back to old
 207  * behaviour. Once tcp_issocket is unset, its never set for the
 208  * life of that connection.
 209  *
 210  * IPsec notes :
 211  *
 212  * Since a packet is always executed on the correct TCP perimeter
 213  * all IPsec processing is defered to IP including checking new
 214  * connections and setting IPSEC policies for new connection. The
 215  * only exception is tcp_xmit_listeners_reset() which is called
 216  * directly from IP and needs to policy check to see if TH_RST
 217  * can be sent out.
 218  */
 219 
 220 /*
 221  * Values for squeue switch:
 222  * 1: SQ_NODRAIN
 223  * 2: SQ_PROCESS
 224  * 3: SQ_FILL
 225  */
 226 int tcp_squeue_wput = 2;        /* /etc/systems */
 227 int tcp_squeue_flag;
 228 
 229 /*
 230  * To prevent memory hog, limit the number of entries in tcp_free_list
 231  * to 1% of available memory / number of cpus
 232  */
 233 uint_t tcp_free_list_max_cnt = 0;
 234 
 235 #define TCP_XMIT_LOWATER        4096
 236 #define TCP_XMIT_HIWATER        49152
 237 #define TCP_RECV_LOWATER        2048
 238 #define TCP_RECV_HIWATER        128000
 239 
 240 #define TIDUSZ  4096    /* transport interface data unit size */
 241 
 242 /*
 243  * Size of acceptor hash list.  It has to be a power of 2 for hashing.
 244  */
 245 #define TCP_ACCEPTOR_FANOUT_SIZE                512
 246 
 247 #ifdef  _ILP32
 248 #define TCP_ACCEPTOR_HASH(accid)                                        \
 249                 (((uint_t)(accid) >> 8) & (TCP_ACCEPTOR_FANOUT_SIZE - 1))
 250 #else
 251 #define TCP_ACCEPTOR_HASH(accid)                                        \
 252                 ((uint_t)(accid) & (TCP_ACCEPTOR_FANOUT_SIZE - 1))
 253 #endif  /* _ILP32 */
 254 
 255 /*
 256  * Minimum number of connections which can be created per listener.  Used
 257  * when the listener connection count is in effect.
 258  */
 259 static uint32_t tcp_min_conn_listener = 2;
 260 
 261 uint32_t tcp_early_abort = 30;
 262 
 263 /* TCP Timer control structure */
 264 typedef struct tcpt_s {
 265         pfv_t   tcpt_pfv;       /* The routine we are to call */
 266         tcp_t   *tcpt_tcp;      /* The parameter we are to pass in */
 267 } tcpt_t;
 268 
 269 /*
 270  * Functions called directly via squeue having a prototype of edesc_t.
 271  */
 272 void            tcp_input_listener(void *arg, mblk_t *mp, void *arg2,
 273     ip_recv_attr_t *ira);
 274 void            tcp_input_data(void *arg, mblk_t *mp, void *arg2,
 275     ip_recv_attr_t *ira);
 276 static void     tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2,
 277     ip_recv_attr_t *dummy);
 278 
 279 
 280 /* Prototype for TCP functions */
 281 static void     tcp_random_init(void);
 282 int             tcp_random(void);
 283 static int      tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp,
 284                     in_port_t dstport, uint_t srcid);
 285 static int      tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp,
 286                     in_port_t dstport, uint32_t flowinfo,
 287                     uint_t srcid, uint32_t scope_id);
 288 static void     tcp_iss_init(tcp_t *tcp);
 289 static void     tcp_reinit(tcp_t *tcp);
 290 static void     tcp_reinit_values(tcp_t *tcp);
 291 
 292 static void     tcp_wsrv(queue_t *q);
 293 static void     tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa);
 294 static void     tcp_update_zcopy(tcp_t *tcp);
 295 static void     tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t,
 296     ixa_notify_arg_t);
 297 static void     *tcp_stack_init(netstackid_t stackid, netstack_t *ns);
 298 static void     tcp_stack_fini(netstackid_t stackid, void *arg);
 299 
 300 static int      tcp_squeue_switch(int);
 301 
 302 static int      tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t);
 303 static int      tcp_openv4(queue_t *, dev_t *, int, int, cred_t *);
 304 static int      tcp_openv6(queue_t *, dev_t *, int, int, cred_t *);
 305 
 306 static void     tcp_squeue_add(squeue_t *);
 307 
 308 struct module_info tcp_rinfo =  {
 309         TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER
 310 };
 311 
 312 static struct module_info tcp_winfo =  {
 313         TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16
 314 };
 315 
 316 /*
 317  * Entry points for TCP as a device. The normal case which supports
 318  * the TCP functionality.
 319  * We have separate open functions for the /dev/tcp and /dev/tcp6 devices.
 320  */
 321 struct qinit tcp_rinitv4 = {
 322         NULL, (pfi_t)tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo
 323 };
 324 
 325 struct qinit tcp_rinitv6 = {
 326         NULL, (pfi_t)tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo
 327 };
 328 
 329 struct qinit tcp_winit = {
 330         (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
 331 };
 332 
 333 /* Initial entry point for TCP in socket mode. */
 334 struct qinit tcp_sock_winit = {
 335         (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
 336 };
 337 
 338 /* TCP entry point during fallback */
 339 struct qinit tcp_fallback_sock_winit = {
 340         (pfi_t)tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo
 341 };
 342 
 343 /*
 344  * Entry points for TCP as a acceptor STREAM opened by sockfs when doing
 345  * an accept. Avoid allocating data structures since eager has already
 346  * been created.
 347  */
 348 struct qinit tcp_acceptor_rinit = {
 349         NULL, (pfi_t)tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo
 350 };
 351 
 352 struct qinit tcp_acceptor_winit = {
 353         (pfi_t)tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo
 354 };
 355 
 356 /* For AF_INET aka /dev/tcp */
 357 struct streamtab tcpinfov4 = {
 358         &tcp_rinitv4, &tcp_winit
 359 };
 360 
 361 /* For AF_INET6 aka /dev/tcp6 */
 362 struct streamtab tcpinfov6 = {
 363         &tcp_rinitv6, &tcp_winit
 364 };
 365 
 366 /*
 367  * Following assumes TPI alignment requirements stay along 32 bit
 368  * boundaries
 369  */
 370 #define ROUNDUP32(x) \
 371         (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1))
 372 
 373 /* Template for response to info request. */
 374 struct T_info_ack tcp_g_t_info_ack = {
 375         T_INFO_ACK,             /* PRIM_type */
 376         0,                      /* TSDU_size */
 377         T_INFINITE,             /* ETSDU_size */
 378         T_INVALID,              /* CDATA_size */
 379         T_INVALID,              /* DDATA_size */
 380         sizeof (sin_t),         /* ADDR_size */
 381         0,                      /* OPT_size - not initialized here */
 382         TIDUSZ,                 /* TIDU_size */
 383         T_COTS_ORD,             /* SERV_type */
 384         TCPS_IDLE,              /* CURRENT_state */
 385         (XPG4_1|EXPINLINE)      /* PROVIDER_flag */
 386 };
 387 
 388 struct T_info_ack tcp_g_t_info_ack_v6 = {
 389         T_INFO_ACK,             /* PRIM_type */
 390         0,                      /* TSDU_size */
 391         T_INFINITE,             /* ETSDU_size */
 392         T_INVALID,              /* CDATA_size */
 393         T_INVALID,              /* DDATA_size */
 394         sizeof (sin6_t),        /* ADDR_size */
 395         0,                      /* OPT_size - not initialized here */
 396         TIDUSZ,         /* TIDU_size */
 397         T_COTS_ORD,             /* SERV_type */
 398         TCPS_IDLE,              /* CURRENT_state */
 399         (XPG4_1|EXPINLINE)      /* PROVIDER_flag */
 400 };
 401 
 402 /*
 403  * TCP tunables related declarations. Definitions are in tcp_tunables.c
 404  */
 405 extern mod_prop_info_t tcp_propinfo_tbl[];
 406 extern int tcp_propinfo_count;
 407 
 408 #define IS_VMLOANED_MBLK(mp) \
 409         (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0)
 410 
 411 uint32_t do_tcpzcopy = 1;               /* 0: disable, 1: enable, 2: force */
 412 
 413 /*
 414  * Forces all connections to obey the value of the tcps_maxpsz_multiplier
 415  * tunable settable via NDD.  Otherwise, the per-connection behavior is
 416  * determined dynamically during tcp_set_destination(), which is the default.
 417  */
 418 boolean_t tcp_static_maxpsz = B_FALSE;
 419 
 420 /*
 421  * If the receive buffer size is changed, this function is called to update
 422  * the upper socket layer on the new delayed receive wake up threshold.
 423  */
 424 static void
 425 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh)
 426 {
 427         uint32_t default_threshold = SOCKET_RECVHIWATER >> 3;
 428 
 429         if (IPCL_IS_NONSTR(tcp->tcp_connp)) {
 430                 conn_t *connp = tcp->tcp_connp;
 431                 struct sock_proto_props sopp;
 432 
 433                 /*
 434                  * only increase rcvthresh upto default_threshold
 435                  */
 436                 if (new_rcvthresh > default_threshold)
 437                         new_rcvthresh = default_threshold;
 438 
 439                 sopp.sopp_flags = SOCKOPT_RCVTHRESH;
 440                 sopp.sopp_rcvthresh = new_rcvthresh;
 441 
 442                 (*connp->conn_upcalls->su_set_proto_props)
 443                     (connp->conn_upper_handle, &sopp);
 444         }
 445 }
 446 
 447 /*
 448  * Figure out the value of window scale opton.  Note that the rwnd is
 449  * ASSUMED to be rounded up to the nearest MSS before the calculation.
 450  * We cannot find the scale value and then do a round up of tcp_rwnd
 451  * because the scale value may not be correct after that.
 452  *
 453  * Set the compiler flag to make this function inline.
 454  */
 455 void
 456 tcp_set_ws_value(tcp_t *tcp)
 457 {
 458         int i;
 459         uint32_t rwnd = tcp->tcp_rwnd;
 460 
 461         for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT;
 462             i++, rwnd >>= 1)
 463                 ;
 464         tcp->tcp_rcv_ws = i;
 465 }
 466 
 467 /*
 468  * Remove cached/latched IPsec references.
 469  */
 470 void
 471 tcp_ipsec_cleanup(tcp_t *tcp)
 472 {
 473         conn_t          *connp = tcp->tcp_connp;
 474 
 475         ASSERT(connp->conn_flags & IPCL_TCPCONN);
 476 
 477         if (connp->conn_latch != NULL) {
 478                 IPLATCH_REFRELE(connp->conn_latch);
 479                 connp->conn_latch = NULL;
 480         }
 481         if (connp->conn_latch_in_policy != NULL) {
 482                 IPPOL_REFRELE(connp->conn_latch_in_policy);
 483                 connp->conn_latch_in_policy = NULL;
 484         }
 485         if (connp->conn_latch_in_action != NULL) {
 486                 IPACT_REFRELE(connp->conn_latch_in_action);
 487                 connp->conn_latch_in_action = NULL;
 488         }
 489         if (connp->conn_policy != NULL) {
 490                 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack);
 491                 connp->conn_policy = NULL;
 492         }
 493 }
 494 
 495 /*
 496  * Cleaup before placing on free list.
 497  * Disassociate from the netstack/tcp_stack_t since the freelist
 498  * is per squeue and not per netstack.
 499  */
 500 void
 501 tcp_cleanup(tcp_t *tcp)
 502 {
 503         mblk_t          *mp;
 504         conn_t          *connp = tcp->tcp_connp;
 505         tcp_stack_t     *tcps = tcp->tcp_tcps;
 506         netstack_t      *ns = tcps->tcps_netstack;
 507         mblk_t          *tcp_rsrv_mp;
 508 
 509         tcp_bind_hash_remove(tcp);
 510 
 511         /* Cleanup that which needs the netstack first */
 512         tcp_ipsec_cleanup(tcp);
 513         ixa_cleanup(connp->conn_ixa);
 514 
 515         if (connp->conn_ht_iphc != NULL) {
 516                 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
 517                 connp->conn_ht_iphc = NULL;
 518                 connp->conn_ht_iphc_allocated = 0;
 519                 connp->conn_ht_iphc_len = 0;
 520                 connp->conn_ht_ulp = NULL;
 521                 connp->conn_ht_ulp_len = 0;
 522                 tcp->tcp_ipha = NULL;
 523                 tcp->tcp_ip6h = NULL;
 524                 tcp->tcp_tcpha = NULL;
 525         }
 526 
 527         /* We clear any IP_OPTIONS and extension headers */
 528         ip_pkt_free(&connp->conn_xmit_ipp);
 529 
 530         tcp_free(tcp);
 531 
 532         /*
 533          * Since we will bzero the entire structure, we need to
 534          * remove it and reinsert it in global hash list. We
 535          * know the walkers can't get to this conn because we
 536          * had set CONDEMNED flag earlier and checked reference
 537          * under conn_lock so walker won't pick it and when we
 538          * go the ipcl_globalhash_remove() below, no walker
 539          * can get to it.
 540          */
 541         ipcl_globalhash_remove(connp);
 542 
 543         /* Save some state */
 544         mp = tcp->tcp_timercache;
 545 
 546         tcp_rsrv_mp = tcp->tcp_rsrv_mp;
 547 
 548         if (connp->conn_cred != NULL) {
 549                 crfree(connp->conn_cred);
 550                 connp->conn_cred = NULL;
 551         }
 552         ipcl_conn_cleanup(connp);
 553         connp->conn_flags = IPCL_TCPCONN;
 554 
 555         /*
 556          * Now it is safe to decrement the reference counts.
 557          * This might be the last reference on the netstack
 558          * in which case it will cause the freeing of the IP Instance.
 559          */
 560         connp->conn_netstack = NULL;
 561         connp->conn_ixa->ixa_ipst = NULL;
 562         netstack_rele(ns);
 563         ASSERT(tcps != NULL);
 564         tcp->tcp_tcps = NULL;
 565 
 566         bzero(tcp, sizeof (tcp_t));
 567 
 568         /* restore the state */
 569         tcp->tcp_timercache = mp;
 570 
 571         tcp->tcp_rsrv_mp = tcp_rsrv_mp;
 572 
 573         tcp->tcp_connp = connp;
 574 
 575         ASSERT(connp->conn_tcp == tcp);
 576         ASSERT(connp->conn_flags & IPCL_TCPCONN);
 577         connp->conn_state_flags = CONN_INCIPIENT;
 578         ASSERT(connp->conn_proto == IPPROTO_TCP);
 579         ASSERT(connp->conn_ref == 1);
 580 }
 581 
 582 /*
 583  * Adapt to the information, such as rtt and rtt_sd, provided from the
 584  * DCE and IRE maintained by IP.
 585  *
 586  * Checks for multicast and broadcast destination address.
 587  * Returns zero if ok; an errno on failure.
 588  *
 589  * Note that the MSS calculation here is based on the info given in
 590  * the DCE and IRE.  We do not do any calculation based on TCP options.  They
 591  * will be handled in tcp_input_data() when TCP knows which options to use.
 592  *
 593  * Note on how TCP gets its parameters for a connection.
 594  *
 595  * When a tcp_t structure is allocated, it gets all the default parameters.
 596  * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd,
 597  * spipe, rpipe, ... from the route metrics.  Route metric overrides the
 598  * default.
 599  *
 600  * An incoming SYN with a multicast or broadcast destination address is dropped
 601  * in ip_fanout_v4/v6.
 602  *
 603  * An incoming SYN with a multicast or broadcast source address is always
 604  * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in
 605  * conn_connect.
 606  * The same logic in tcp_set_destination also serves to
 607  * reject an attempt to connect to a broadcast or multicast (destination)
 608  * address.
 609  */
 610 int
 611 tcp_set_destination(tcp_t *tcp)
 612 {
 613         uint32_t        mss_max;
 614         uint32_t        mss;
 615         boolean_t       tcp_detached = TCP_IS_DETACHED(tcp);
 616         conn_t          *connp = tcp->tcp_connp;
 617         tcp_stack_t     *tcps = tcp->tcp_tcps;
 618         iulp_t          uinfo;
 619         int             error;
 620         uint32_t        flags;
 621 
 622         flags = IPDF_LSO | IPDF_ZCOPY;
 623         /*
 624          * Make sure we have a dce for the destination to avoid dce_ident
 625          * contention for connected sockets.
 626          */
 627         flags |= IPDF_UNIQUE_DCE;
 628 
 629         if (!tcps->tcps_ignore_path_mtu)
 630                 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
 631 
 632         /* Use conn_lock to satify ASSERT; tcp is already serialized */
 633         mutex_enter(&connp->conn_lock);
 634         error = conn_connect(connp, &uinfo, flags);
 635         mutex_exit(&connp->conn_lock);
 636         if (error != 0)
 637                 return (error);
 638 
 639         error = tcp_build_hdrs(tcp);
 640         if (error != 0)
 641                 return (error);
 642 
 643         tcp->tcp_localnet = uinfo.iulp_localnet;
 644 
 645         if (uinfo.iulp_rtt != 0) {
 646                 clock_t rto;
 647 
 648                 tcp->tcp_rtt_sa = uinfo.iulp_rtt;
 649                 tcp->tcp_rtt_sd = uinfo.iulp_rtt_sd;
 650                 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
 651                     tcps->tcps_rexmit_interval_extra +
 652                     (tcp->tcp_rtt_sa >> 5);
 653 
 654                 TCP_SET_RTO(tcp, rto);
 655         }
 656         if (uinfo.iulp_ssthresh != 0)
 657                 tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh;
 658         else
 659                 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
 660         if (uinfo.iulp_spipe > 0) {
 661                 connp->conn_sndbuf = MIN(uinfo.iulp_spipe,
 662                     tcps->tcps_max_buf);
 663                 if (tcps->tcps_snd_lowat_fraction != 0) {
 664                         connp->conn_sndlowat = connp->conn_sndbuf /
 665                             tcps->tcps_snd_lowat_fraction;
 666                 }
 667                 (void) tcp_maxpsz_set(tcp, B_TRUE);
 668         }
 669         /*
 670          * Note that up till now, acceptor always inherits receive
 671          * window from the listener.  But if there is a metrics
 672          * associated with a host, we should use that instead of
 673          * inheriting it from listener. Thus we need to pass this
 674          * info back to the caller.
 675          */
 676         if (uinfo.iulp_rpipe > 0) {
 677                 tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe,
 678                     tcps->tcps_max_buf);
 679         }
 680 
 681         if (uinfo.iulp_rtomax > 0) {
 682                 tcp->tcp_second_timer_threshold =
 683                     uinfo.iulp_rtomax;
 684         }
 685 
 686         /*
 687          * Use the metric option settings, iulp_tstamp_ok and
 688          * iulp_wscale_ok, only for active open. What this means
 689          * is that if the other side uses timestamp or window
 690          * scale option, TCP will also use those options. That
 691          * is for passive open.  If the application sets a
 692          * large window, window scale is enabled regardless of
 693          * the value in iulp_wscale_ok.  This is the behavior
 694          * since 2.6.  So we keep it.
 695          * The only case left in passive open processing is the
 696          * check for SACK.
 697          * For ECN, it should probably be like SACK.  But the
 698          * current value is binary, so we treat it like the other
 699          * cases.  The metric only controls active open.For passive
 700          * open, the ndd param, tcp_ecn_permitted, controls the
 701          * behavior.
 702          */
 703         if (!tcp_detached) {
 704                 /*
 705                  * The if check means that the following can only
 706                  * be turned on by the metrics only IRE, but not off.
 707                  */
 708                 if (uinfo.iulp_tstamp_ok)
 709                         tcp->tcp_snd_ts_ok = B_TRUE;
 710                 if (uinfo.iulp_wscale_ok)
 711                         tcp->tcp_snd_ws_ok = B_TRUE;
 712                 if (uinfo.iulp_sack == 2)
 713                         tcp->tcp_snd_sack_ok = B_TRUE;
 714                 if (uinfo.iulp_ecn_ok)
 715                         tcp->tcp_ecn_ok = B_TRUE;
 716         } else {
 717                 /*
 718                  * Passive open.
 719                  *
 720                  * As above, the if check means that SACK can only be
 721                  * turned on by the metric only IRE.
 722                  */
 723                 if (uinfo.iulp_sack > 0) {
 724                         tcp->tcp_snd_sack_ok = B_TRUE;
 725                 }
 726         }
 727 
 728         /*
 729          * XXX Note that currently, iulp_mtu can be as small as 68
 730          * because of PMTUd.  So tcp_mss may go to negative if combined
 731          * length of all those options exceeds 28 bytes.  But because
 732          * of the tcp_mss_min check below, we may not have a problem if
 733          * tcp_mss_min is of a reasonable value.  The default is 1 so
 734          * the negative problem still exists.  And the check defeats PMTUd.
 735          * In fact, if PMTUd finds that the MSS should be smaller than
 736          * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min
 737          * value.
 738          *
 739          * We do not deal with that now.  All those problems related to
 740          * PMTUd will be fixed later.
 741          */
 742         ASSERT(uinfo.iulp_mtu != 0);
 743         mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu;
 744 
 745         /* Sanity check for MSS value. */
 746         if (connp->conn_ipversion == IPV4_VERSION)
 747                 mss_max = tcps->tcps_mss_max_ipv4;
 748         else
 749                 mss_max = tcps->tcps_mss_max_ipv6;
 750 
 751         if (tcp->tcp_ipsec_overhead == 0)
 752                 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp);
 753 
 754         mss -= tcp->tcp_ipsec_overhead;
 755 
 756         if (mss < tcps->tcps_mss_min)
 757                 mss = tcps->tcps_mss_min;
 758         if (mss > mss_max)
 759                 mss = mss_max;
 760 
 761         /* Note that this is the maximum MSS, excluding all options. */
 762         tcp->tcp_mss = mss;
 763 
 764         /*
 765          * Update the tcp connection with LSO capability.
 766          */
 767         tcp_update_lso(tcp, connp->conn_ixa);
 768 
 769         /*
 770          * Initialize the ISS here now that we have the full connection ID.
 771          * The RFC 1948 method of initial sequence number generation requires
 772          * knowledge of the full connection ID before setting the ISS.
 773          */
 774         tcp_iss_init(tcp);
 775 
 776         tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local);
 777 
 778         /*
 779          * Make sure that conn is not marked incipient
 780          * for incoming connections. A blind
 781          * removal of incipient flag is cheaper than
 782          * check and removal.
 783          */
 784         mutex_enter(&connp->conn_lock);
 785         connp->conn_state_flags &= ~CONN_INCIPIENT;
 786         mutex_exit(&connp->conn_lock);
 787         return (0);
 788 }
 789 
 790 /*
 791  * tcp_clean_death / tcp_close_detached must not be called more than once
 792  * on a tcp. Thus every function that potentially calls tcp_clean_death
 793  * must check for the tcp state before calling tcp_clean_death.
 794  * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper,
 795  * tcp_timer_handler, all check for the tcp state.
 796  */
 797 /* ARGSUSED */
 798 void
 799 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2,
 800     ip_recv_attr_t *dummy)
 801 {
 802         tcp_t   *tcp = ((conn_t *)arg)->conn_tcp;
 803 
 804         freemsg(mp);
 805         if (tcp->tcp_state > TCPS_BOUND)
 806                 (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT);
 807 }
 808 
 809 /*
 810  * We are dying for some reason.  Try to do it gracefully.  (May be called
 811  * as writer.)
 812  *
 813  * Return -1 if the structure was not cleaned up (if the cleanup had to be
 814  * done by a service procedure).
 815  * TBD - Should the return value distinguish between the tcp_t being
 816  * freed and it being reinitialized?
 817  */
 818 int
 819 tcp_clean_death(tcp_t *tcp, int err)
 820 {
 821         mblk_t  *mp;
 822         queue_t *q;
 823         conn_t  *connp = tcp->tcp_connp;
 824         tcp_stack_t     *tcps = tcp->tcp_tcps;
 825 
 826         if (tcp->tcp_fused)
 827                 tcp_unfuse(tcp);
 828 
 829         if (tcp->tcp_linger_tid != 0 &&
 830             TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
 831                 tcp_stop_lingering(tcp);
 832         }
 833 
 834         ASSERT(tcp != NULL);
 835         ASSERT((connp->conn_family == AF_INET &&
 836             connp->conn_ipversion == IPV4_VERSION) ||
 837             (connp->conn_family == AF_INET6 &&
 838             (connp->conn_ipversion == IPV4_VERSION ||
 839             connp->conn_ipversion == IPV6_VERSION)));
 840 
 841         if (TCP_IS_DETACHED(tcp)) {
 842                 if (tcp->tcp_hard_binding) {
 843                         /*
 844                          * Its an eager that we are dealing with. We close the
 845                          * eager but in case a conn_ind has already gone to the
 846                          * listener, let tcp_accept_finish() send a discon_ind
 847                          * to the listener and drop the last reference. If the
 848                          * listener doesn't even know about the eager i.e. the
 849                          * conn_ind hasn't gone up, blow away the eager and drop
 850                          * the last reference as well. If the conn_ind has gone
 851                          * up, state should be BOUND. tcp_accept_finish
 852                          * will figure out that the connection has received a
 853                          * RST and will send a DISCON_IND to the application.
 854                          */
 855                         tcp_closei_local(tcp);
 856                         if (!tcp->tcp_tconnind_started) {
 857                                 CONN_DEC_REF(connp);
 858                         } else {
 859                                 tcp->tcp_state = TCPS_BOUND;
 860                                 DTRACE_TCP6(state__change, void, NULL,
 861                                     ip_xmit_attr_t *, connp->conn_ixa,
 862                                     void, NULL, tcp_t *, tcp, void, NULL,
 863                                     int32_t, TCPS_CLOSED);
 864                         }
 865                 } else {
 866                         tcp_close_detached(tcp);
 867                 }
 868                 return (0);
 869         }
 870 
 871         TCP_STAT(tcps, tcp_clean_death_nondetached);
 872 
 873         /*
 874          * The connection is dead.  Decrement listener connection counter if
 875          * necessary.
 876          */
 877         if (tcp->tcp_listen_cnt != NULL)
 878                 TCP_DECR_LISTEN_CNT(tcp);
 879 
 880         /*
 881          * When a connection is moved to TIME_WAIT state, the connection
 882          * counter is already decremented.  So no need to decrement here
 883          * again.  See SET_TIME_WAIT() macro.
 884          */
 885         if (tcp->tcp_state >= TCPS_ESTABLISHED &&
 886             tcp->tcp_state < TCPS_TIME_WAIT) {
 887                 TCPS_CONN_DEC(tcps);
 888         }
 889 
 890         q = connp->conn_rq;
 891 
 892         /* Trash all inbound data */
 893         if (!IPCL_IS_NONSTR(connp)) {
 894                 ASSERT(q != NULL);
 895                 flushq(q, FLUSHALL);
 896         }
 897 
 898         /*
 899          * If we are at least part way open and there is error
 900          * (err==0 implies no error)
 901          * notify our client by a T_DISCON_IND.
 902          */
 903         if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) {
 904                 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
 905                     !TCP_IS_SOCKET(tcp)) {
 906                         /*
 907                          * Send M_FLUSH according to TPI. Because sockets will
 908                          * (and must) ignore FLUSHR we do that only for TPI
 909                          * endpoints and sockets in STREAMS mode.
 910                          */
 911                         (void) putnextctl1(q, M_FLUSH, FLUSHR);
 912                 }
 913                 if (connp->conn_debug) {
 914                         (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
 915                             "tcp_clean_death: discon err %d", err);
 916                 }
 917                 if (IPCL_IS_NONSTR(connp)) {
 918                         /* Direct socket, use upcall */
 919                         (*connp->conn_upcalls->su_disconnected)(
 920                             connp->conn_upper_handle, tcp->tcp_connid, err);
 921                 } else {
 922                         mp = mi_tpi_discon_ind(NULL, err, 0);
 923                         if (mp != NULL) {
 924                                 putnext(q, mp);
 925                         } else {
 926                                 if (connp->conn_debug) {
 927                                         (void) strlog(TCP_MOD_ID, 0, 1,
 928                                             SL_ERROR|SL_TRACE,
 929                                             "tcp_clean_death, sending M_ERROR");
 930                                 }
 931                                 (void) putnextctl1(q, M_ERROR, EPROTO);
 932                         }
 933                 }
 934                 if (tcp->tcp_state <= TCPS_SYN_RCVD) {
 935                         /* SYN_SENT or SYN_RCVD */
 936                         TCPS_BUMP_MIB(tcps, tcpAttemptFails);
 937                 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) {
 938                         /* ESTABLISHED or CLOSE_WAIT */
 939                         TCPS_BUMP_MIB(tcps, tcpEstabResets);
 940                 }
 941         }
 942 
 943         /*
 944          * ESTABLISHED non-STREAMS eagers are not 'detached' because
 945          * an upper handle is obtained when the SYN-ACK comes in. So it
 946          * should receive the 'disconnected' upcall, but tcp_reinit should
 947          * not be called since this is an eager.
 948          */
 949         if (tcp->tcp_listener != NULL && IPCL_IS_NONSTR(connp)) {
 950                 tcp_closei_local(tcp);
 951                 tcp->tcp_state = TCPS_BOUND;
 952                 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
 953                     connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
 954                     int32_t, TCPS_CLOSED);
 955                 return (0);
 956         }
 957 
 958         tcp_reinit(tcp);
 959         if (IPCL_IS_NONSTR(connp))
 960                 (void) tcp_do_unbind(connp);
 961 
 962         return (-1);
 963 }
 964 
 965 /*
 966  * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout
 967  * to expire, stop the wait and finish the close.
 968  */
 969 void
 970 tcp_stop_lingering(tcp_t *tcp)
 971 {
 972         clock_t delta = 0;
 973         tcp_stack_t     *tcps = tcp->tcp_tcps;
 974         conn_t          *connp = tcp->tcp_connp;
 975 
 976         tcp->tcp_linger_tid = 0;
 977         if (tcp->tcp_state > TCPS_LISTEN) {
 978                 tcp_acceptor_hash_remove(tcp);
 979                 mutex_enter(&tcp->tcp_non_sq_lock);
 980                 if (tcp->tcp_flow_stopped) {
 981                         tcp_clrqfull(tcp);
 982                 }
 983                 mutex_exit(&tcp->tcp_non_sq_lock);
 984 
 985                 if (tcp->tcp_timer_tid != 0) {
 986                         delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid);
 987                         tcp->tcp_timer_tid = 0;
 988                 }
 989                 /*
 990                  * Need to cancel those timers which will not be used when
 991                  * TCP is detached.  This has to be done before the conn_wq
 992                  * is cleared.
 993                  */
 994                 tcp_timers_stop(tcp);
 995 
 996                 tcp->tcp_detached = B_TRUE;
 997                 connp->conn_rq = NULL;
 998                 connp->conn_wq = NULL;
 999 
1000                 if (tcp->tcp_state == TCPS_TIME_WAIT) {
1001                         tcp_time_wait_append(tcp);
1002                         TCP_DBGSTAT(tcps, tcp_detach_time_wait);
1003                         goto finish;
1004                 }
1005 
1006                 /*
1007                  * If delta is zero the timer event wasn't executed and was
1008                  * successfully canceled. In this case we need to restart it
1009                  * with the minimal delta possible.
1010                  */
1011                 if (delta >= 0) {
1012                         tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer,
1013                             delta ? delta : 1);
1014                 }
1015         } else {
1016                 tcp_closei_local(tcp);
1017                 CONN_DEC_REF(connp);
1018         }
1019 finish:
1020         tcp->tcp_detached = B_TRUE;
1021         connp->conn_rq = NULL;
1022         connp->conn_wq = NULL;
1023 
1024         /* Signal closing thread that it can complete close */
1025         mutex_enter(&tcp->tcp_closelock);
1026         tcp->tcp_closed = 1;
1027         cv_signal(&tcp->tcp_closecv);
1028         mutex_exit(&tcp->tcp_closelock);
1029 
1030         /* If we have an upper handle (socket), release it */
1031         if (IPCL_IS_NONSTR(connp)) {
1032                 ASSERT(connp->conn_upper_handle != NULL);
1033                 (*connp->conn_upcalls->su_closed)(connp->conn_upper_handle);
1034                 connp->conn_upper_handle = NULL;
1035                 connp->conn_upcalls = NULL;
1036         }
1037 }
1038 
1039 void
1040 tcp_close_common(conn_t *connp, int flags)
1041 {
1042         tcp_t           *tcp = connp->conn_tcp;
1043         mblk_t          *mp = &tcp->tcp_closemp;
1044         boolean_t       conn_ioctl_cleanup_reqd = B_FALSE;
1045         mblk_t          *bp;
1046 
1047         ASSERT(connp->conn_ref >= 2);
1048 
1049         /*
1050          * Mark the conn as closing. ipsq_pending_mp_add will not
1051          * add any mp to the pending mp list, after this conn has
1052          * started closing.
1053          */
1054         mutex_enter(&connp->conn_lock);
1055         connp->conn_state_flags |= CONN_CLOSING;
1056         if (connp->conn_oper_pending_ill != NULL)
1057                 conn_ioctl_cleanup_reqd = B_TRUE;
1058         CONN_INC_REF_LOCKED(connp);
1059         mutex_exit(&connp->conn_lock);
1060         tcp->tcp_closeflags = (uint8_t)flags;
1061         ASSERT(connp->conn_ref >= 3);
1062 
1063         /*
1064          * tcp_closemp_used is used below without any protection of a lock
1065          * as we don't expect any one else to use it concurrently at this
1066          * point otherwise it would be a major defect.
1067          */
1068 
1069         if (mp->b_prev == NULL)
1070                 tcp->tcp_closemp_used = B_TRUE;
1071         else
1072                 cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: "
1073                     "connp %p tcp %p\n", (void *)connp, (void *)tcp);
1074 
1075         TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15);
1076 
1077         /*
1078          * Cleanup any queued ioctls here. This must be done before the wq/rq
1079          * are re-written by tcp_close_output().
1080          */
1081         if (conn_ioctl_cleanup_reqd)
1082                 conn_ioctl_cleanup(connp);
1083 
1084         /*
1085          * As CONN_CLOSING is set, no further ioctls should be passed down to
1086          * IP for this conn (see the guards in tcp_ioctl, tcp_wput_ioctl and
1087          * tcp_wput_iocdata). If the ioctl was queued on an ipsq,
1088          * conn_ioctl_cleanup should have found it and removed it. If the ioctl
1089          * was still in flight at the time, we wait for it here. See comments
1090          * for CONN_INC_IOCTLREF in ip.h for details.
1091          */
1092         mutex_enter(&connp->conn_lock);
1093         while (connp->conn_ioctlref > 0)
1094                 cv_wait(&connp->conn_cv, &connp->conn_lock);
1095         ASSERT(connp->conn_ioctlref == 0);
1096         ASSERT(connp->conn_oper_pending_ill == NULL);
1097         mutex_exit(&connp->conn_lock);
1098 
1099         SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp,
1100             NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE);
1101 
1102         /*
1103          * For non-STREAMS sockets, the normal case is that the conn makes
1104          * an upcall when it's finally closed, so there is no need to wait
1105          * in the protocol. But in case of SO_LINGER the thread sleeps here
1106          * so it can properly deal with the thread being interrupted.
1107          */
1108         if (IPCL_IS_NONSTR(connp) && connp->conn_linger == 0)
1109                 goto nowait;
1110 
1111         mutex_enter(&tcp->tcp_closelock);
1112         while (!tcp->tcp_closed) {
1113                 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) {
1114                         /*
1115                          * The cv_wait_sig() was interrupted. We now do the
1116                          * following:
1117                          *
1118                          * 1) If the endpoint was lingering, we allow this
1119                          * to be interrupted by cancelling the linger timeout
1120                          * and closing normally.
1121                          *
1122                          * 2) Revert to calling cv_wait()
1123                          *
1124                          * We revert to using cv_wait() to avoid an
1125                          * infinite loop which can occur if the calling
1126                          * thread is higher priority than the squeue worker
1127                          * thread and is bound to the same cpu.
1128                          */
1129                         if (connp->conn_linger && connp->conn_lingertime > 0) {
1130                                 mutex_exit(&tcp->tcp_closelock);
1131                                 /* Entering squeue, bump ref count. */
1132                                 CONN_INC_REF(connp);
1133                                 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL);
1134                                 SQUEUE_ENTER_ONE(connp->conn_sqp, bp,
1135                                     tcp_linger_interrupted, connp, NULL,
1136                                     tcp_squeue_flag, SQTAG_IP_TCP_CLOSE);
1137                                 mutex_enter(&tcp->tcp_closelock);
1138                         }
1139                         break;
1140                 }
1141         }
1142         while (!tcp->tcp_closed)
1143                 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock);
1144         mutex_exit(&tcp->tcp_closelock);
1145 
1146         /*
1147          * In the case of listener streams that have eagers in the q or q0
1148          * we wait for the eagers to drop their reference to us. conn_rq and
1149          * conn_wq of the eagers point to our queues. By waiting for the
1150          * refcnt to drop to 1, we are sure that the eagers have cleaned
1151          * up their queue pointers and also dropped their references to us.
1152          *
1153          * For non-STREAMS sockets we do not have to wait here; the
1154          * listener will instead make a su_closed upcall when the last
1155          * reference is dropped.
1156          */
1157         if (tcp->tcp_wait_for_eagers && !IPCL_IS_NONSTR(connp)) {
1158                 mutex_enter(&connp->conn_lock);
1159                 while (connp->conn_ref != 1) {
1160                         cv_wait(&connp->conn_cv, &connp->conn_lock);
1161                 }
1162                 mutex_exit(&connp->conn_lock);
1163         }
1164 
1165 nowait:
1166         connp->conn_cpid = NOPID;
1167 }
1168 
1169 /*
1170  * Called by tcp_close() routine via squeue when lingering is
1171  * interrupted by a signal.
1172  */
1173 
1174 /* ARGSUSED */
1175 static void
1176 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
1177 {
1178         conn_t  *connp = (conn_t *)arg;
1179         tcp_t   *tcp = connp->conn_tcp;
1180 
1181         freeb(mp);
1182         if (tcp->tcp_linger_tid != 0 &&
1183             TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
1184                 tcp_stop_lingering(tcp);
1185                 tcp->tcp_client_errno = EINTR;
1186         }
1187 }
1188 
1189 /*
1190  * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp.
1191  * Some stream heads get upset if they see these later on as anything but NULL.
1192  */
1193 void
1194 tcp_close_mpp(mblk_t **mpp)
1195 {
1196         mblk_t  *mp;
1197 
1198         if ((mp = *mpp) != NULL) {
1199                 do {
1200                         mp->b_next = NULL;
1201                         mp->b_prev = NULL;
1202                 } while ((mp = mp->b_cont) != NULL);
1203 
1204                 mp = *mpp;
1205                 *mpp = NULL;
1206                 freemsg(mp);
1207         }
1208 }
1209 
1210 /* Do detached close. */
1211 void
1212 tcp_close_detached(tcp_t *tcp)
1213 {
1214         if (tcp->tcp_fused)
1215                 tcp_unfuse(tcp);
1216 
1217         /*
1218          * Clustering code serializes TCP disconnect callbacks and
1219          * cluster tcp list walks by blocking a TCP disconnect callback
1220          * if a cluster tcp list walk is in progress. This ensures
1221          * accurate accounting of TCPs in the cluster code even though
1222          * the TCP list walk itself is not atomic.
1223          */
1224         tcp_closei_local(tcp);
1225         CONN_DEC_REF(tcp->tcp_connp);
1226 }
1227 
1228 /*
1229  * The tcp_t is going away. Remove it from all lists and set it
1230  * to TCPS_CLOSED. The freeing up of memory is deferred until
1231  * tcp_inactive. This is needed since a thread in tcp_rput might have
1232  * done a CONN_INC_REF on this structure before it was removed from the
1233  * hashes.
1234  */
1235 void
1236 tcp_closei_local(tcp_t *tcp)
1237 {
1238         conn_t          *connp = tcp->tcp_connp;
1239         tcp_stack_t     *tcps = tcp->tcp_tcps;
1240         int32_t         oldstate;
1241 
1242         if (!TCP_IS_SOCKET(tcp))
1243                 tcp_acceptor_hash_remove(tcp);
1244 
1245         TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs);
1246         tcp->tcp_ibsegs = 0;
1247         TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs);
1248         tcp->tcp_obsegs = 0;
1249 
1250         /*
1251          * This can be called via tcp_time_wait_processing() if TCP gets a
1252          * SYN with sequence number outside the TIME-WAIT connection's
1253          * window.  So we need to check for TIME-WAIT state here as the
1254          * connection counter is already decremented.  See SET_TIME_WAIT()
1255          * macro
1256          */
1257         if (tcp->tcp_state >= TCPS_ESTABLISHED &&
1258             tcp->tcp_state < TCPS_TIME_WAIT) {
1259                 TCPS_CONN_DEC(tcps);
1260         }
1261 
1262         /*
1263          * If we are an eager connection hanging off a listener that
1264          * hasn't formally accepted the connection yet, get off his
1265          * list and blow off any data that we have accumulated.
1266          */
1267         if (tcp->tcp_listener != NULL) {
1268                 tcp_t   *listener = tcp->tcp_listener;
1269                 mutex_enter(&listener->tcp_eager_lock);
1270                 /*
1271                  * tcp_tconnind_started == B_TRUE means that the
1272                  * conn_ind has already gone to listener. At
1273                  * this point, eager will be closed but we
1274                  * leave it in listeners eager list so that
1275                  * if listener decides to close without doing
1276                  * accept, we can clean this up. In tcp_tli_accept
1277                  * we take care of the case of accept on closed
1278                  * eager.
1279                  */
1280                 if (!tcp->tcp_tconnind_started) {
1281                         tcp_eager_unlink(tcp);
1282                         mutex_exit(&listener->tcp_eager_lock);
1283                         /*
1284                          * We don't want to have any pointers to the
1285                          * listener queue, after we have released our
1286                          * reference on the listener
1287                          */
1288                         ASSERT(tcp->tcp_detached);
1289                         connp->conn_rq = NULL;
1290                         connp->conn_wq = NULL;
1291                         CONN_DEC_REF(listener->tcp_connp);
1292                 } else {
1293                         mutex_exit(&listener->tcp_eager_lock);
1294                 }
1295         }
1296 
1297         /* Stop all the timers */
1298         tcp_timers_stop(tcp);
1299 
1300         if (tcp->tcp_state == TCPS_LISTEN) {
1301                 if (tcp->tcp_ip_addr_cache) {
1302                         kmem_free((void *)tcp->tcp_ip_addr_cache,
1303                             IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t));
1304                         tcp->tcp_ip_addr_cache = NULL;
1305                 }
1306         }
1307 
1308         /* Decrement listerner connection counter if necessary. */
1309         if (tcp->tcp_listen_cnt != NULL)
1310                 TCP_DECR_LISTEN_CNT(tcp);
1311 
1312         mutex_enter(&tcp->tcp_non_sq_lock);
1313         if (tcp->tcp_flow_stopped)
1314                 tcp_clrqfull(tcp);
1315         mutex_exit(&tcp->tcp_non_sq_lock);
1316 
1317         tcp_bind_hash_remove(tcp);
1318         /*
1319          * If the tcp_time_wait_collector (which runs outside the squeue)
1320          * is trying to remove this tcp from the time wait list, we will
1321          * block in tcp_time_wait_remove while trying to acquire the
1322          * tcp_time_wait_lock. The logic in tcp_time_wait_collector also
1323          * requires the ipcl_hash_remove to be ordered after the
1324          * tcp_time_wait_remove for the refcnt checks to work correctly.
1325          */
1326         if (tcp->tcp_state == TCPS_TIME_WAIT)
1327                 (void) tcp_time_wait_remove(tcp, NULL);
1328         CL_INET_DISCONNECT(connp);
1329         ipcl_hash_remove(connp);
1330         oldstate = tcp->tcp_state;
1331         tcp->tcp_state = TCPS_CLOSED;
1332         /* Need to probe before ixa_cleanup() is called */
1333         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1334             connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
1335             int32_t, oldstate);
1336         ixa_cleanup(connp->conn_ixa);
1337 
1338         /*
1339          * Mark the conn as CONDEMNED
1340          */
1341         mutex_enter(&connp->conn_lock);
1342         connp->conn_state_flags |= CONN_CONDEMNED;
1343         mutex_exit(&connp->conn_lock);
1344 
1345         ASSERT(tcp->tcp_time_wait_next == NULL);
1346         ASSERT(tcp->tcp_time_wait_prev == NULL);
1347         ASSERT(tcp->tcp_time_wait_expire == 0);
1348 
1349         tcp_ipsec_cleanup(tcp);
1350 }
1351 
1352 /*
1353  * tcp is dying (called from ipcl_conn_destroy and error cases).
1354  * Free the tcp_t in either case.
1355  */
1356 void
1357 tcp_free(tcp_t *tcp)
1358 {
1359         mblk_t          *mp;
1360         conn_t          *connp = tcp->tcp_connp;
1361 
1362         ASSERT(tcp != NULL);
1363         ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL);
1364 
1365         connp->conn_rq = NULL;
1366         connp->conn_wq = NULL;
1367 
1368         tcp_close_mpp(&tcp->tcp_xmit_head);
1369         tcp_close_mpp(&tcp->tcp_reass_head);
1370         if (tcp->tcp_rcv_list != NULL) {
1371                 /* Free b_next chain */
1372                 tcp_close_mpp(&tcp->tcp_rcv_list);
1373         }
1374         if ((mp = tcp->tcp_urp_mp) != NULL) {
1375                 freemsg(mp);
1376         }
1377         if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
1378                 freemsg(mp);
1379         }
1380 
1381         if (tcp->tcp_fused_sigurg_mp != NULL) {
1382                 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1383                 freeb(tcp->tcp_fused_sigurg_mp);
1384                 tcp->tcp_fused_sigurg_mp = NULL;
1385         }
1386 
1387         if (tcp->tcp_ordrel_mp != NULL) {
1388                 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1389                 freeb(tcp->tcp_ordrel_mp);
1390                 tcp->tcp_ordrel_mp = NULL;
1391         }
1392 
1393         TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp);
1394         bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
1395 
1396         if (tcp->tcp_hopopts != NULL) {
1397                 mi_free(tcp->tcp_hopopts);
1398                 tcp->tcp_hopopts = NULL;
1399                 tcp->tcp_hopoptslen = 0;
1400         }
1401         ASSERT(tcp->tcp_hopoptslen == 0);
1402         if (tcp->tcp_dstopts != NULL) {
1403                 mi_free(tcp->tcp_dstopts);
1404                 tcp->tcp_dstopts = NULL;
1405                 tcp->tcp_dstoptslen = 0;
1406         }
1407         ASSERT(tcp->tcp_dstoptslen == 0);
1408         if (tcp->tcp_rthdrdstopts != NULL) {
1409                 mi_free(tcp->tcp_rthdrdstopts);
1410                 tcp->tcp_rthdrdstopts = NULL;
1411                 tcp->tcp_rthdrdstoptslen = 0;
1412         }
1413         ASSERT(tcp->tcp_rthdrdstoptslen == 0);
1414         if (tcp->tcp_rthdr != NULL) {
1415                 mi_free(tcp->tcp_rthdr);
1416                 tcp->tcp_rthdr = NULL;
1417                 tcp->tcp_rthdrlen = 0;
1418         }
1419         ASSERT(tcp->tcp_rthdrlen == 0);
1420 
1421         /*
1422          * Following is really a blowing away a union.
1423          * It happens to have exactly two members of identical size
1424          * the following code is enough.
1425          */
1426         tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
1427 
1428         /*
1429          * If this is a non-STREAM socket still holding on to an upper
1430          * handle, release it. As a result of fallback we might also see
1431          * STREAMS based conns with upper handles, in which case there is
1432          * nothing to do other than clearing the field.
1433          */
1434         if (connp->conn_upper_handle != NULL) {
1435                 if (IPCL_IS_NONSTR(connp)) {
1436                         (*connp->conn_upcalls->su_closed)(
1437                             connp->conn_upper_handle);
1438                         tcp->tcp_detached = B_TRUE;
1439                 }
1440                 connp->conn_upper_handle = NULL;
1441                 connp->conn_upcalls = NULL;
1442         }
1443 }
1444 
1445 /*
1446  * tcp_get_conn/tcp_free_conn
1447  *
1448  * tcp_get_conn is used to get a clean tcp connection structure.
1449  * It tries to reuse the connections put on the freelist by the
1450  * time_wait_collector failing which it goes to kmem_cache. This
1451  * way has two benefits compared to just allocating from and
1452  * freeing to kmem_cache.
1453  * 1) The time_wait_collector can free (which includes the cleanup)
1454  * outside the squeue. So when the interrupt comes, we have a clean
1455  * connection sitting in the freelist. Obviously, this buys us
1456  * performance.
1457  *
1458  * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener
1459  * has multiple disadvantages - tying up the squeue during alloc.
1460  * But allocating the conn/tcp in IP land is also not the best since
1461  * we can't check the 'q' and 'q0' which are protected by squeue and
1462  * blindly allocate memory which might have to be freed here if we are
1463  * not allowed to accept the connection. By using the freelist and
1464  * putting the conn/tcp back in freelist, we don't pay a penalty for
1465  * allocating memory without checking 'q/q0' and freeing it if we can't
1466  * accept the connection.
1467  *
1468  * Care should be taken to put the conn back in the same squeue's freelist
1469  * from which it was allocated. Best results are obtained if conn is
1470  * allocated from listener's squeue and freed to the same. Time wait
1471  * collector will free up the freelist is the connection ends up sitting
1472  * there for too long.
1473  */
1474 void *
1475 tcp_get_conn(void *arg, tcp_stack_t *tcps)
1476 {
1477         tcp_t                   *tcp = NULL;
1478         conn_t                  *connp = NULL;
1479         squeue_t                *sqp = (squeue_t *)arg;
1480         tcp_squeue_priv_t       *tcp_time_wait;
1481         netstack_t              *ns;
1482         mblk_t                  *tcp_rsrv_mp = NULL;
1483 
1484         tcp_time_wait =
1485             *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP));
1486 
1487         mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
1488         tcp = tcp_time_wait->tcp_free_list;
1489         ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0));
1490         if (tcp != NULL) {
1491                 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next;
1492                 tcp_time_wait->tcp_free_list_cnt--;
1493                 mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1494                 tcp->tcp_time_wait_next = NULL;
1495                 connp = tcp->tcp_connp;
1496                 connp->conn_flags |= IPCL_REUSED;
1497 
1498                 ASSERT(tcp->tcp_tcps == NULL);
1499                 ASSERT(connp->conn_netstack == NULL);
1500                 ASSERT(tcp->tcp_rsrv_mp != NULL);
1501                 ns = tcps->tcps_netstack;
1502                 netstack_hold(ns);
1503                 connp->conn_netstack = ns;
1504                 connp->conn_ixa->ixa_ipst = ns->netstack_ip;
1505                 tcp->tcp_tcps = tcps;
1506                 ipcl_globalhash_insert(connp);
1507 
1508                 connp->conn_ixa->ixa_notify_cookie = tcp;
1509                 ASSERT(connp->conn_ixa->ixa_notify == tcp_notify);
1510                 connp->conn_recv = tcp_input_data;
1511                 ASSERT(connp->conn_recvicmp == tcp_icmp_input);
1512                 ASSERT(connp->conn_verifyicmp == tcp_verifyicmp);
1513                 return ((void *)connp);
1514         }
1515         mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1516         /*
1517          * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until
1518          * this conn_t/tcp_t is freed at ipcl_conn_destroy().
1519          */
1520         tcp_rsrv_mp = allocb(0, BPRI_HI);
1521         if (tcp_rsrv_mp == NULL)
1522                 return (NULL);
1523 
1524         if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP,
1525             tcps->tcps_netstack)) == NULL) {
1526                 freeb(tcp_rsrv_mp);
1527                 return (NULL);
1528         }
1529 
1530         tcp = connp->conn_tcp;
1531         tcp->tcp_rsrv_mp = tcp_rsrv_mp;
1532         mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL);
1533 
1534         tcp->tcp_tcps = tcps;
1535 
1536         connp->conn_recv = tcp_input_data;
1537         connp->conn_recvicmp = tcp_icmp_input;
1538         connp->conn_verifyicmp = tcp_verifyicmp;
1539 
1540         /*
1541          * Register tcp_notify to listen to capability changes detected by IP.
1542          * This upcall is made in the context of the call to conn_ip_output
1543          * thus it is inside the squeue.
1544          */
1545         connp->conn_ixa->ixa_notify = tcp_notify;
1546         connp->conn_ixa->ixa_notify_cookie = tcp;
1547 
1548         return ((void *)connp);
1549 }
1550 
1551 /*
1552  * Handle connect to IPv4 destinations, including connections for AF_INET6
1553  * sockets connecting to IPv4 mapped IPv6 destinations.
1554  * Returns zero if OK, a positive errno, or a negative TLI error.
1555  */
1556 static int
1557 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport,
1558     uint_t srcid)
1559 {
1560         ipaddr_t        dstaddr = *dstaddrp;
1561         uint16_t        lport;
1562         conn_t          *connp = tcp->tcp_connp;
1563         tcp_stack_t     *tcps = tcp->tcp_tcps;
1564         int             error;
1565 
1566         ASSERT(connp->conn_ipversion == IPV4_VERSION);
1567 
1568         /* Check for attempt to connect to INADDR_ANY */
1569         if (dstaddr == INADDR_ANY)  {
1570                 /*
1571                  * SunOS 4.x and 4.3 BSD allow an application
1572                  * to connect a TCP socket to INADDR_ANY.
1573                  * When they do this, the kernel picks the
1574                  * address of one interface and uses it
1575                  * instead.  The kernel usually ends up
1576                  * picking the address of the loopback
1577                  * interface.  This is an undocumented feature.
1578                  * However, we provide the same thing here
1579                  * in order to have source and binary
1580                  * compatibility with SunOS 4.x.
1581                  * Update the T_CONN_REQ (sin/sin6) since it is used to
1582                  * generate the T_CONN_CON.
1583                  */
1584                 dstaddr = htonl(INADDR_LOOPBACK);
1585                 *dstaddrp = dstaddr;
1586         }
1587 
1588         /* Handle __sin6_src_id if socket not bound to an IP address */
1589         if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) {
1590                 ip_srcid_find_id(srcid, &connp->conn_laddr_v6,
1591                     IPCL_ZONEID(connp), tcps->tcps_netstack);
1592                 connp->conn_saddr_v6 = connp->conn_laddr_v6;
1593         }
1594 
1595         IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6);
1596         connp->conn_fport = dstport;
1597 
1598         /*
1599          * At this point the remote destination address and remote port fields
1600          * in the tcp-four-tuple have been filled in the tcp structure. Now we
1601          * have to see which state tcp was in so we can take appropriate action.
1602          */
1603         if (tcp->tcp_state == TCPS_IDLE) {
1604                 /*
1605                  * We support a quick connect capability here, allowing
1606                  * clients to transition directly from IDLE to SYN_SENT
1607                  * tcp_bindi will pick an unused port, insert the connection
1608                  * in the bind hash and transition to BOUND state.
1609                  */
1610                 lport = tcp_update_next_port(tcps->tcps_next_port_to_try,
1611                     tcp, B_TRUE);
1612                 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE,
1613                     B_FALSE, B_FALSE);
1614                 if (lport == 0)
1615                         return (-TNOADDR);
1616         }
1617 
1618         /*
1619          * Lookup the route to determine a source address and the uinfo.
1620          * Setup TCP parameters based on the metrics/DCE.
1621          */
1622         error = tcp_set_destination(tcp);
1623         if (error != 0)
1624                 return (error);
1625 
1626         /*
1627          * Don't let an endpoint connect to itself.
1628          */
1629         if (connp->conn_faddr_v4 == connp->conn_laddr_v4 &&
1630             connp->conn_fport == connp->conn_lport)
1631                 return (-TBADADDR);
1632 
1633         tcp->tcp_state = TCPS_SYN_SENT;
1634 
1635         return (ipcl_conn_insert_v4(connp));
1636 }
1637 
1638 /*
1639  * Handle connect to IPv6 destinations.
1640  * Returns zero if OK, a positive errno, or a negative TLI error.
1641  */
1642 static int
1643 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport,
1644     uint32_t flowinfo, uint_t srcid, uint32_t scope_id)
1645 {
1646         uint16_t        lport;
1647         conn_t          *connp = tcp->tcp_connp;
1648         tcp_stack_t     *tcps = tcp->tcp_tcps;
1649         int             error;
1650 
1651         ASSERT(connp->conn_family == AF_INET6);
1652 
1653         /*
1654          * If we're here, it means that the destination address is a native
1655          * IPv6 address.  Return an error if conn_ipversion is not IPv6.  A
1656          * reason why it might not be IPv6 is if the socket was bound to an
1657          * IPv4-mapped IPv6 address.
1658          */
1659         if (connp->conn_ipversion != IPV6_VERSION)
1660                 return (-TBADADDR);
1661 
1662         /*
1663          * Interpret a zero destination to mean loopback.
1664          * Update the T_CONN_REQ (sin/sin6) since it is used to
1665          * generate the T_CONN_CON.
1666          */
1667         if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp))
1668                 *dstaddrp = ipv6_loopback;
1669 
1670         /* Handle __sin6_src_id if socket not bound to an IP address */
1671         if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
1672                 ip_srcid_find_id(srcid, &connp->conn_laddr_v6,
1673                     IPCL_ZONEID(connp), tcps->tcps_netstack);
1674                 connp->conn_saddr_v6 = connp->conn_laddr_v6;
1675         }
1676 
1677         /*
1678          * Take care of the scope_id now.
1679          */
1680         if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) {
1681                 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1682                 connp->conn_ixa->ixa_scopeid = scope_id;
1683         } else {
1684                 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
1685         }
1686 
1687         connp->conn_flowinfo = flowinfo;
1688         connp->conn_faddr_v6 = *dstaddrp;
1689         connp->conn_fport = dstport;
1690 
1691         /*
1692          * At this point the remote destination address and remote port fields
1693          * in the tcp-four-tuple have been filled in the tcp structure. Now we
1694          * have to see which state tcp was in so we can take appropriate action.
1695          */
1696         if (tcp->tcp_state == TCPS_IDLE) {
1697                 /*
1698                  * We support a quick connect capability here, allowing
1699                  * clients to transition directly from IDLE to SYN_SENT
1700                  * tcp_bindi will pick an unused port, insert the connection
1701                  * in the bind hash and transition to BOUND state.
1702                  */
1703                 lport = tcp_update_next_port(tcps->tcps_next_port_to_try,
1704                     tcp, B_TRUE);
1705                 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE,
1706                     B_FALSE, B_FALSE);
1707                 if (lport == 0)
1708                         return (-TNOADDR);
1709         }
1710 
1711         /*
1712          * Lookup the route to determine a source address and the uinfo.
1713          * Setup TCP parameters based on the metrics/DCE.
1714          */
1715         error = tcp_set_destination(tcp);
1716         if (error != 0)
1717                 return (error);
1718 
1719         /*
1720          * Don't let an endpoint connect to itself.
1721          */
1722         if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) &&
1723             connp->conn_fport == connp->conn_lport)
1724                 return (-TBADADDR);
1725 
1726         tcp->tcp_state = TCPS_SYN_SENT;
1727 
1728         return (ipcl_conn_insert_v6(connp));
1729 }
1730 
1731 /*
1732  * Disconnect
1733  * Note that unlike other functions this returns a positive tli error
1734  * when it fails; it never returns an errno.
1735  */
1736 static int
1737 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum)
1738 {
1739         conn_t          *lconnp;
1740         tcp_stack_t     *tcps = tcp->tcp_tcps;
1741         conn_t          *connp = tcp->tcp_connp;
1742 
1743         /*
1744          * Right now, upper modules pass down a T_DISCON_REQ to TCP,
1745          * when the stream is in BOUND state. Do not send a reset,
1746          * since the destination IP address is not valid, and it can
1747          * be the initialized value of all zeros (broadcast address).
1748          */
1749         if (tcp->tcp_state <= TCPS_BOUND) {
1750                 if (connp->conn_debug) {
1751                         (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
1752                             "tcp_disconnect: bad state, %d", tcp->tcp_state);
1753                 }
1754                 return (TOUTSTATE);
1755         } else if (tcp->tcp_state >= TCPS_ESTABLISHED) {
1756                 TCPS_CONN_DEC(tcps);
1757         }
1758 
1759         if (seqnum == -1 || tcp->tcp_conn_req_max == 0) {
1760 
1761                 /*
1762                  * According to TPI, for non-listeners, ignore seqnum
1763                  * and disconnect.
1764                  * Following interpretation of -1 seqnum is historical
1765                  * and implied TPI ? (TPI only states that for T_CONN_IND,
1766                  * a valid seqnum should not be -1).
1767                  *
1768                  *      -1 means disconnect everything
1769                  *      regardless even on a listener.
1770                  */
1771 
1772                 int old_state = tcp->tcp_state;
1773                 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1774 
1775                 /*
1776                  * The connection can't be on the tcp_time_wait_head list
1777                  * since it is not detached.
1778                  */
1779                 ASSERT(tcp->tcp_time_wait_next == NULL);
1780                 ASSERT(tcp->tcp_time_wait_prev == NULL);
1781                 ASSERT(tcp->tcp_time_wait_expire == 0);
1782                 /*
1783                  * If it used to be a listener, check to make sure no one else
1784                  * has taken the port before switching back to LISTEN state.
1785                  */
1786                 if (connp->conn_ipversion == IPV4_VERSION) {
1787                         lconnp = ipcl_lookup_listener_v4(connp->conn_lport,
1788                             connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst);
1789                 } else {
1790                         uint_t ifindex = 0;
1791 
1792                         if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)
1793                                 ifindex = connp->conn_ixa->ixa_scopeid;
1794 
1795                         /* Allow conn_bound_if listeners? */
1796                         lconnp = ipcl_lookup_listener_v6(connp->conn_lport,
1797                             &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp),
1798                             ipst);
1799                 }
1800                 if (tcp->tcp_conn_req_max && lconnp == NULL) {
1801                         tcp->tcp_state = TCPS_LISTEN;
1802                         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1803                             connp->conn_ixa, void, NULL, tcp_t *, tcp, void,
1804                             NULL, int32_t, old_state);
1805                 } else if (old_state > TCPS_BOUND) {
1806                         tcp->tcp_conn_req_max = 0;
1807                         tcp->tcp_state = TCPS_BOUND;
1808                         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1809                             connp->conn_ixa, void, NULL, tcp_t *, tcp, void,
1810                             NULL, int32_t, old_state);
1811 
1812                         /*
1813                          * If this end point is not going to become a listener,
1814                          * decrement the listener connection count if
1815                          * necessary.  Note that we do not do this if it is
1816                          * going to be a listner (the above if case) since
1817                          * then it may remove the counter struct.
1818                          */
1819                         if (tcp->tcp_listen_cnt != NULL)
1820                                 TCP_DECR_LISTEN_CNT(tcp);
1821                 }
1822                 if (lconnp != NULL)
1823                         CONN_DEC_REF(lconnp);
1824                 switch (old_state) {
1825                 case TCPS_SYN_SENT:
1826                 case TCPS_SYN_RCVD:
1827                         TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1828                         break;
1829                 case TCPS_ESTABLISHED:
1830                 case TCPS_CLOSE_WAIT:
1831                         TCPS_BUMP_MIB(tcps, tcpEstabResets);
1832                         break;
1833                 }
1834 
1835                 if (tcp->tcp_fused)
1836                         tcp_unfuse(tcp);
1837 
1838                 mutex_enter(&tcp->tcp_eager_lock);
1839                 if ((tcp->tcp_conn_req_cnt_q0 != 0) ||
1840                     (tcp->tcp_conn_req_cnt_q != 0)) {
1841                         tcp_eager_cleanup(tcp, 0);
1842                 }
1843                 mutex_exit(&tcp->tcp_eager_lock);
1844 
1845                 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt,
1846                     tcp->tcp_rnxt, TH_RST | TH_ACK);
1847 
1848                 tcp_reinit(tcp);
1849 
1850                 return (0);
1851         } else if (!tcp_eager_blowoff(tcp, seqnum)) {
1852                 return (TBADSEQ);
1853         }
1854         return (0);
1855 }
1856 
1857 /*
1858  * Our client hereby directs us to reject the connection request
1859  * that tcp_input_listener() marked with 'seqnum'.  Rejection consists
1860  * of sending the appropriate RST, not an ICMP error.
1861  */
1862 void
1863 tcp_disconnect(tcp_t *tcp, mblk_t *mp)
1864 {
1865         t_scalar_t seqnum;
1866         int     error;
1867         conn_t  *connp = tcp->tcp_connp;
1868 
1869         ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
1870         if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) {
1871                 tcp_err_ack(tcp, mp, TPROTO, 0);
1872                 return;
1873         }
1874         seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number;
1875         error = tcp_disconnect_common(tcp, seqnum);
1876         if (error != 0)
1877                 tcp_err_ack(tcp, mp, error, 0);
1878         else {
1879                 if (tcp->tcp_state >= TCPS_ESTABLISHED) {
1880                         /* Send M_FLUSH according to TPI */
1881                         (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW);
1882                 }
1883                 mp = mi_tpi_ok_ack_alloc(mp);
1884                 if (mp != NULL)
1885                         putnext(connp->conn_rq, mp);
1886         }
1887 }
1888 
1889 /*
1890  * Handle reinitialization of a tcp structure.
1891  * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE.
1892  */
1893 static void
1894 tcp_reinit(tcp_t *tcp)
1895 {
1896         mblk_t          *mp;
1897         tcp_stack_t     *tcps = tcp->tcp_tcps;
1898         conn_t          *connp  = tcp->tcp_connp;
1899         int32_t         oldstate;
1900 
1901         /* tcp_reinit should never be called for detached tcp_t's */
1902         ASSERT(tcp->tcp_listener == NULL);
1903         ASSERT((connp->conn_family == AF_INET &&
1904             connp->conn_ipversion == IPV4_VERSION) ||
1905             (connp->conn_family == AF_INET6 &&
1906             (connp->conn_ipversion == IPV4_VERSION ||
1907             connp->conn_ipversion == IPV6_VERSION)));
1908 
1909         /* Cancel outstanding timers */
1910         tcp_timers_stop(tcp);
1911 
1912         /*
1913          * Reset everything in the state vector, after updating global
1914          * MIB data from instance counters.
1915          */
1916         TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs);
1917         tcp->tcp_ibsegs = 0;
1918         TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs);
1919         tcp->tcp_obsegs = 0;
1920 
1921         tcp_close_mpp(&tcp->tcp_xmit_head);
1922         if (tcp->tcp_snd_zcopy_aware)
1923                 tcp_zcopy_notify(tcp);
1924         tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL;
1925         tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0;
1926         mutex_enter(&tcp->tcp_non_sq_lock);
1927         if (tcp->tcp_flow_stopped &&
1928             TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) {
1929                 tcp_clrqfull(tcp);
1930         }
1931         mutex_exit(&tcp->tcp_non_sq_lock);
1932         tcp_close_mpp(&tcp->tcp_reass_head);
1933         tcp->tcp_reass_tail = NULL;
1934         if (tcp->tcp_rcv_list != NULL) {
1935                 /* Free b_next chain */
1936                 tcp_close_mpp(&tcp->tcp_rcv_list);
1937                 tcp->tcp_rcv_last_head = NULL;
1938                 tcp->tcp_rcv_last_tail = NULL;
1939                 tcp->tcp_rcv_cnt = 0;
1940         }
1941         tcp->tcp_rcv_last_tail = NULL;
1942 
1943         if ((mp = tcp->tcp_urp_mp) != NULL) {
1944                 freemsg(mp);
1945                 tcp->tcp_urp_mp = NULL;
1946         }
1947         if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
1948                 freemsg(mp);
1949                 tcp->tcp_urp_mark_mp = NULL;
1950         }
1951         if (tcp->tcp_fused_sigurg_mp != NULL) {
1952                 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1953                 freeb(tcp->tcp_fused_sigurg_mp);
1954                 tcp->tcp_fused_sigurg_mp = NULL;
1955         }
1956         if (tcp->tcp_ordrel_mp != NULL) {
1957                 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1958                 freeb(tcp->tcp_ordrel_mp);
1959                 tcp->tcp_ordrel_mp = NULL;
1960         }
1961 
1962         /*
1963          * Following is a union with two members which are
1964          * identical types and size so the following cleanup
1965          * is enough.
1966          */
1967         tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
1968 
1969         CL_INET_DISCONNECT(connp);
1970 
1971         /*
1972          * The connection can't be on the tcp_time_wait_head list
1973          * since it is not detached.
1974          */
1975         ASSERT(tcp->tcp_time_wait_next == NULL);
1976         ASSERT(tcp->tcp_time_wait_prev == NULL);
1977         ASSERT(tcp->tcp_time_wait_expire == 0);
1978 
1979         /*
1980          * Reset/preserve other values
1981          */
1982         tcp_reinit_values(tcp);
1983         ipcl_hash_remove(connp);
1984         /* Note that ixa_cred gets cleared in ixa_cleanup */
1985         ixa_cleanup(connp->conn_ixa);
1986         tcp_ipsec_cleanup(tcp);
1987 
1988         connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
1989         connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
1990         oldstate = tcp->tcp_state;
1991 
1992         if (tcp->tcp_conn_req_max != 0) {
1993                 /*
1994                  * This is the case when a TLI program uses the same
1995                  * transport end point to accept a connection.  This
1996                  * makes the TCP both a listener and acceptor.  When
1997                  * this connection is closed, we need to set the state
1998                  * back to TCPS_LISTEN.  Make sure that the eager list
1999                  * is reinitialized.
2000                  *
2001                  * Note that this stream is still bound to the four
2002                  * tuples of the previous connection in IP.  If a new
2003                  * SYN with different foreign address comes in, IP will
2004                  * not find it and will send it to the global queue.  In
2005                  * the global queue, TCP will do a tcp_lookup_listener()
2006                  * to find this stream.  This works because this stream
2007                  * is only removed from connected hash.
2008                  *
2009                  */
2010                 tcp->tcp_state = TCPS_LISTEN;
2011                 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
2012                 tcp->tcp_eager_next_drop_q0 = tcp;
2013                 tcp->tcp_eager_prev_drop_q0 = tcp;
2014                 /*
2015                  * Initially set conn_recv to tcp_input_listener_unbound to try
2016                  * to pick a good squeue for the listener when the first SYN
2017                  * arrives. tcp_input_listener_unbound sets it to
2018                  * tcp_input_listener on that first SYN.
2019                  */
2020                 connp->conn_recv = tcp_input_listener_unbound;
2021 
2022                 connp->conn_proto = IPPROTO_TCP;
2023                 connp->conn_faddr_v6 = ipv6_all_zeros;
2024                 connp->conn_fport = 0;
2025 
2026                 (void) ipcl_bind_insert(connp);
2027         } else {
2028                 tcp->tcp_state = TCPS_BOUND;
2029         }
2030 
2031         /*
2032          * Initialize to default values
2033          */
2034         tcp_init_values(tcp, NULL);
2035 
2036         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2037             connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
2038             int32_t, oldstate);
2039 
2040         ASSERT(tcp->tcp_ptpbhn != NULL);
2041         tcp->tcp_rwnd = connp->conn_rcvbuf;
2042         tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ?
2043             tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4;
2044 }
2045 
2046 /*
2047  * Force values to zero that need be zero.
2048  * Do not touch values asociated with the BOUND or LISTEN state
2049  * since the connection will end up in that state after the reinit.
2050  * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t
2051  * structure!
2052  */
2053 static void
2054 tcp_reinit_values(tcp)
2055         tcp_t *tcp;
2056 {
2057         tcp_stack_t     *tcps = tcp->tcp_tcps;
2058         conn_t          *connp = tcp->tcp_connp;
2059 
2060 #ifndef lint
2061 #define DONTCARE(x)
2062 #define PRESERVE(x)
2063 #else
2064 #define DONTCARE(x)     ((x) = (x))
2065 #define PRESERVE(x)     ((x) = (x))
2066 #endif  /* lint */
2067 
2068         PRESERVE(tcp->tcp_bind_hash_port);
2069         PRESERVE(tcp->tcp_bind_hash);
2070         PRESERVE(tcp->tcp_ptpbhn);
2071         PRESERVE(tcp->tcp_acceptor_hash);
2072         PRESERVE(tcp->tcp_ptpahn);
2073 
2074         /* Should be ASSERT NULL on these with new code! */
2075         ASSERT(tcp->tcp_time_wait_next == NULL);
2076         ASSERT(tcp->tcp_time_wait_prev == NULL);
2077         ASSERT(tcp->tcp_time_wait_expire == 0);
2078         PRESERVE(tcp->tcp_state);
2079         PRESERVE(connp->conn_rq);
2080         PRESERVE(connp->conn_wq);
2081 
2082         ASSERT(tcp->tcp_xmit_head == NULL);
2083         ASSERT(tcp->tcp_xmit_last == NULL);
2084         ASSERT(tcp->tcp_unsent == 0);
2085         ASSERT(tcp->tcp_xmit_tail == NULL);
2086         ASSERT(tcp->tcp_xmit_tail_unsent == 0);
2087 
2088         tcp->tcp_snxt = 0;                   /* Displayed in mib */
2089         tcp->tcp_suna = 0;                   /* Displayed in mib */
2090         tcp->tcp_swnd = 0;
2091         DONTCARE(tcp->tcp_cwnd);     /* Init in tcp_process_options */
2092 
2093         ASSERT(tcp->tcp_ibsegs == 0);
2094         ASSERT(tcp->tcp_obsegs == 0);
2095 
2096         if (connp->conn_ht_iphc != NULL) {
2097                 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
2098                 connp->conn_ht_iphc = NULL;
2099                 connp->conn_ht_iphc_allocated = 0;
2100                 connp->conn_ht_iphc_len = 0;
2101                 connp->conn_ht_ulp = NULL;
2102                 connp->conn_ht_ulp_len = 0;
2103                 tcp->tcp_ipha = NULL;
2104                 tcp->tcp_ip6h = NULL;
2105                 tcp->tcp_tcpha = NULL;
2106         }
2107 
2108         /* We clear any IP_OPTIONS and extension headers */
2109         ip_pkt_free(&connp->conn_xmit_ipp);
2110 
2111         DONTCARE(tcp->tcp_naglim);           /* Init in tcp_init_values */
2112         DONTCARE(tcp->tcp_ipha);
2113         DONTCARE(tcp->tcp_ip6h);
2114         DONTCARE(tcp->tcp_tcpha);
2115         tcp->tcp_valid_bits = 0;
2116 
2117         DONTCARE(tcp->tcp_timer_backoff);    /* Init in tcp_init_values */
2118         DONTCARE(tcp->tcp_last_recv_time);   /* Init in tcp_init_values */
2119         tcp->tcp_last_rcv_lbolt = 0;
2120 
2121         tcp->tcp_init_cwnd = 0;
2122 
2123         tcp->tcp_urp_last_valid = 0;
2124         tcp->tcp_hard_binding = 0;
2125 
2126         tcp->tcp_fin_acked = 0;
2127         tcp->tcp_fin_rcvd = 0;
2128         tcp->tcp_fin_sent = 0;
2129         tcp->tcp_ordrel_done = 0;
2130 
2131         tcp->tcp_detached = 0;
2132 
2133         tcp->tcp_snd_ws_ok = B_FALSE;
2134         tcp->tcp_snd_ts_ok = B_FALSE;
2135         tcp->tcp_zero_win_probe = 0;
2136 
2137         tcp->tcp_loopback = 0;
2138         tcp->tcp_localnet = 0;
2139         tcp->tcp_syn_defense = 0;
2140         tcp->tcp_set_timer = 0;
2141 
2142         tcp->tcp_active_open = 0;
2143         tcp->tcp_rexmit = B_FALSE;
2144         tcp->tcp_xmit_zc_clean = B_FALSE;
2145 
2146         tcp->tcp_snd_sack_ok = B_FALSE;
2147         tcp->tcp_hwcksum = B_FALSE;
2148 
2149         DONTCARE(tcp->tcp_maxpsz_multiplier);        /* Init in tcp_init_values */
2150 
2151         tcp->tcp_conn_def_q0 = 0;
2152         tcp->tcp_ip_forward_progress = B_FALSE;
2153         tcp->tcp_ecn_ok = B_FALSE;
2154 
2155         tcp->tcp_cwr = B_FALSE;
2156         tcp->tcp_ecn_echo_on = B_FALSE;
2157         tcp->tcp_is_wnd_shrnk = B_FALSE;
2158 
2159         TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp);
2160         bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
2161 
2162         tcp->tcp_rcv_ws = 0;
2163         tcp->tcp_snd_ws = 0;
2164         tcp->tcp_ts_recent = 0;
2165         tcp->tcp_rnxt = 0;                   /* Displayed in mib */
2166         DONTCARE(tcp->tcp_rwnd);             /* Set in tcp_reinit() */
2167         tcp->tcp_initial_pmtu = 0;
2168 
2169         ASSERT(tcp->tcp_reass_head == NULL);
2170         ASSERT(tcp->tcp_reass_tail == NULL);
2171 
2172         tcp->tcp_cwnd_cnt = 0;
2173 
2174         ASSERT(tcp->tcp_rcv_list == NULL);
2175         ASSERT(tcp->tcp_rcv_last_head == NULL);
2176         ASSERT(tcp->tcp_rcv_last_tail == NULL);
2177         ASSERT(tcp->tcp_rcv_cnt == 0);
2178 
2179         DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */
2180         DONTCARE(tcp->tcp_cwnd_max);         /* Init in tcp_init_values */
2181         tcp->tcp_csuna = 0;
2182 
2183         tcp->tcp_rto = 0;                    /* Displayed in MIB */
2184         DONTCARE(tcp->tcp_rtt_sa);           /* Init in tcp_init_values */
2185         DONTCARE(tcp->tcp_rtt_sd);           /* Init in tcp_init_values */
2186         tcp->tcp_rtt_update = 0;
2187 
2188         DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
2189         DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
2190 
2191         tcp->tcp_rack = 0;                   /* Displayed in mib */
2192         tcp->tcp_rack_cnt = 0;
2193         tcp->tcp_rack_cur_max = 0;
2194         tcp->tcp_rack_abs_max = 0;
2195 
2196         tcp->tcp_max_swnd = 0;
2197 
2198         ASSERT(tcp->tcp_listener == NULL);
2199 
2200         DONTCARE(tcp->tcp_irs);                      /* tcp_valid_bits cleared */
2201         DONTCARE(tcp->tcp_iss);                      /* tcp_valid_bits cleared */
2202         DONTCARE(tcp->tcp_fss);                      /* tcp_valid_bits cleared */
2203         DONTCARE(tcp->tcp_urg);                      /* tcp_valid_bits cleared */
2204 
2205         ASSERT(tcp->tcp_conn_req_cnt_q == 0);
2206         ASSERT(tcp->tcp_conn_req_cnt_q0 == 0);
2207         PRESERVE(tcp->tcp_conn_req_max);
2208         PRESERVE(tcp->tcp_conn_req_seqnum);
2209 
2210         DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */
2211         DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */
2212         DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */
2213         DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */
2214 
2215         DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */
2216         ASSERT(tcp->tcp_urp_mp == NULL);
2217         ASSERT(tcp->tcp_urp_mark_mp == NULL);
2218         ASSERT(tcp->tcp_fused_sigurg_mp == NULL);
2219 
2220         ASSERT(tcp->tcp_eager_next_q == NULL);
2221         ASSERT(tcp->tcp_eager_last_q == NULL);
2222         ASSERT((tcp->tcp_eager_next_q0 == NULL &&
2223             tcp->tcp_eager_prev_q0 == NULL) ||
2224             tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0);
2225         ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL);
2226 
2227         ASSERT((tcp->tcp_eager_next_drop_q0 == NULL &&
2228             tcp->tcp_eager_prev_drop_q0 == NULL) ||
2229             tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0);
2230 
2231         DONTCARE(tcp->tcp_ka_rinterval);     /* Init in tcp_init_values */
2232         DONTCARE(tcp->tcp_ka_abort_thres);   /* Init in tcp_init_values */
2233         DONTCARE(tcp->tcp_ka_cnt);           /* Init in tcp_init_values */
2234 
2235         tcp->tcp_client_errno = 0;
2236 
2237         DONTCARE(connp->conn_sum);           /* Init in tcp_init_values */
2238 
2239         connp->conn_faddr_v6 = ipv6_all_zeros;       /* Displayed in MIB */
2240 
2241         PRESERVE(connp->conn_bound_addr_v6);
2242         tcp->tcp_last_sent_len = 0;
2243         tcp->tcp_dupack_cnt = 0;
2244 
2245         connp->conn_fport = 0;                       /* Displayed in MIB */
2246         PRESERVE(connp->conn_lport);
2247 
2248         PRESERVE(tcp->tcp_acceptor_lockp);
2249 
2250         ASSERT(tcp->tcp_ordrel_mp == NULL);
2251         PRESERVE(tcp->tcp_acceptor_id);
2252         DONTCARE(tcp->tcp_ipsec_overhead);
2253 
2254         PRESERVE(connp->conn_family);
2255         /* Remove any remnants of mapped address binding */
2256         if (connp->conn_family == AF_INET6) {
2257                 connp->conn_ipversion = IPV6_VERSION;
2258                 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
2259         } else {
2260                 connp->conn_ipversion = IPV4_VERSION;
2261                 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
2262         }
2263 
2264         connp->conn_bound_if = 0;
2265         connp->conn_recv_ancillary.crb_all = 0;
2266         tcp->tcp_recvifindex = 0;
2267         tcp->tcp_recvhops = 0;
2268         tcp->tcp_closed = 0;
2269         if (tcp->tcp_hopopts != NULL) {
2270                 mi_free(tcp->tcp_hopopts);
2271                 tcp->tcp_hopopts = NULL;
2272                 tcp->tcp_hopoptslen = 0;
2273         }
2274         ASSERT(tcp->tcp_hopoptslen == 0);
2275         if (tcp->tcp_dstopts != NULL) {
2276                 mi_free(tcp->tcp_dstopts);
2277                 tcp->tcp_dstopts = NULL;
2278                 tcp->tcp_dstoptslen = 0;
2279         }
2280         ASSERT(tcp->tcp_dstoptslen == 0);
2281         if (tcp->tcp_rthdrdstopts != NULL) {
2282                 mi_free(tcp->tcp_rthdrdstopts);
2283                 tcp->tcp_rthdrdstopts = NULL;
2284                 tcp->tcp_rthdrdstoptslen = 0;
2285         }
2286         ASSERT(tcp->tcp_rthdrdstoptslen == 0);
2287         if (tcp->tcp_rthdr != NULL) {
2288                 mi_free(tcp->tcp_rthdr);
2289                 tcp->tcp_rthdr = NULL;
2290                 tcp->tcp_rthdrlen = 0;
2291         }
2292         ASSERT(tcp->tcp_rthdrlen == 0);
2293 
2294         /* Reset fusion-related fields */
2295         tcp->tcp_fused = B_FALSE;
2296         tcp->tcp_unfusable = B_FALSE;
2297         tcp->tcp_fused_sigurg = B_FALSE;
2298         tcp->tcp_loopback_peer = NULL;
2299 
2300         tcp->tcp_lso = B_FALSE;
2301 
2302         tcp->tcp_in_ack_unsent = 0;
2303         tcp->tcp_cork = B_FALSE;
2304         tcp->tcp_tconnind_started = B_FALSE;
2305 
2306         PRESERVE(tcp->tcp_squeue_bytes);
2307 
2308         tcp->tcp_closemp_used = B_FALSE;
2309 
2310         PRESERVE(tcp->tcp_rsrv_mp);
2311         PRESERVE(tcp->tcp_rsrv_mp_lock);
2312 
2313 #ifdef DEBUG
2314         DONTCARE(tcp->tcmp_stk[0]);
2315 #endif
2316 
2317         PRESERVE(tcp->tcp_connid);
2318 
2319         ASSERT(tcp->tcp_listen_cnt == NULL);
2320         ASSERT(tcp->tcp_reass_tid == 0);
2321 
2322 #undef  DONTCARE
2323 #undef  PRESERVE
2324 }
2325 
2326 /*
2327  * Initialize the various fields in tcp_t.  If parent (the listener) is non
2328  * NULL, certain values will be inheritted from it.
2329  */
2330 void
2331 tcp_init_values(tcp_t *tcp, tcp_t *parent)
2332 {
2333         tcp_stack_t     *tcps = tcp->tcp_tcps;
2334         conn_t          *connp = tcp->tcp_connp;
2335         clock_t         rto;
2336 
2337         ASSERT((connp->conn_family == AF_INET &&
2338             connp->conn_ipversion == IPV4_VERSION) ||
2339             (connp->conn_family == AF_INET6 &&
2340             (connp->conn_ipversion == IPV4_VERSION ||
2341             connp->conn_ipversion == IPV6_VERSION)));
2342 
2343         if (parent == NULL) {
2344                 tcp->tcp_naglim = tcps->tcps_naglim_def;
2345 
2346                 tcp->tcp_rto_initial = tcps->tcps_rexmit_interval_initial;
2347                 tcp->tcp_rto_min = tcps->tcps_rexmit_interval_min;
2348                 tcp->tcp_rto_max = tcps->tcps_rexmit_interval_max;
2349 
2350                 tcp->tcp_first_ctimer_threshold =
2351                     tcps->tcps_ip_notify_cinterval;
2352                 tcp->tcp_second_ctimer_threshold =
2353                     tcps->tcps_ip_abort_cinterval;
2354                 tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval;
2355                 tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval;
2356 
2357                 tcp->tcp_fin_wait_2_flush_interval =
2358                     tcps->tcps_fin_wait_2_flush_interval;
2359 
2360                 tcp->tcp_ka_interval = tcps->tcps_keepalive_interval;
2361                 tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval;
2362                 tcp->tcp_ka_cnt = 0;
2363                 tcp->tcp_ka_rinterval = 0;
2364 
2365                 /*
2366                  * Default value of tcp_init_cwnd is 0, so no need to set here
2367                  * if parent is NULL.  But we need to inherit it from parent.
2368                  */
2369         } else {
2370                 /* Inherit various TCP parameters from the parent. */
2371                 tcp->tcp_naglim = parent->tcp_naglim;
2372 
2373                 tcp->tcp_rto_initial = parent->tcp_rto_initial;
2374                 tcp->tcp_rto_min = parent->tcp_rto_min;
2375                 tcp->tcp_rto_max = parent->tcp_rto_max;
2376 
2377                 tcp->tcp_first_ctimer_threshold =
2378                     parent->tcp_first_ctimer_threshold;
2379                 tcp->tcp_second_ctimer_threshold =
2380                     parent->tcp_second_ctimer_threshold;
2381                 tcp->tcp_first_timer_threshold =
2382                     parent->tcp_first_timer_threshold;
2383                 tcp->tcp_second_timer_threshold =
2384                     parent->tcp_second_timer_threshold;
2385 
2386                 tcp->tcp_fin_wait_2_flush_interval =
2387                     parent->tcp_fin_wait_2_flush_interval;
2388 
2389                 tcp->tcp_ka_interval = parent->tcp_ka_interval;
2390                 tcp->tcp_ka_abort_thres = parent->tcp_ka_abort_thres;
2391                 tcp->tcp_ka_cnt = parent->tcp_ka_cnt;
2392                 tcp->tcp_ka_rinterval = parent->tcp_ka_rinterval;
2393 
2394                 tcp->tcp_init_cwnd = parent->tcp_init_cwnd;
2395         }
2396 
2397         /*
2398          * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO
2399          * will be close to tcp_rexmit_interval_initial.  By doing this, we
2400          * allow the algorithm to adjust slowly to large fluctuations of RTT
2401          * during first few transmissions of a connection as seen in slow
2402          * links.
2403          */
2404         tcp->tcp_rtt_sa = tcp->tcp_rto_initial << 2;
2405         tcp->tcp_rtt_sd = tcp->tcp_rto_initial >> 1;
2406         rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
2407             tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) +
2408             tcps->tcps_conn_grace_period;
2409         TCP_SET_RTO(tcp, rto);
2410 
2411         tcp->tcp_timer_backoff = 0;
2412         tcp->tcp_ms_we_have_waited = 0;
2413         tcp->tcp_last_recv_time = ddi_get_lbolt();
2414         tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_;
2415         tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
2416         tcp->tcp_snd_burst = TCP_CWND_INFINITE;
2417 
2418         tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier;
2419 
2420         /* NOTE:  ISS is now set in tcp_set_destination(). */
2421 
2422         /* Reset fusion-related fields */
2423         tcp->tcp_fused = B_FALSE;
2424         tcp->tcp_unfusable = B_FALSE;
2425         tcp->tcp_fused_sigurg = B_FALSE;
2426         tcp->tcp_loopback_peer = NULL;
2427 
2428         /* We rebuild the header template on the next connect/conn_request */
2429 
2430         connp->conn_mlp_type = mlptSingle;
2431 
2432         /*
2433          * Init the window scale to the max so tcp_rwnd_set() won't pare
2434          * down tcp_rwnd. tcp_set_destination() will set the right value later.
2435          */
2436         tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT;
2437         tcp->tcp_rwnd = connp->conn_rcvbuf;
2438 
2439         tcp->tcp_cork = B_FALSE;
2440         /*
2441          * Init the tcp_debug option if it wasn't already set.  This value
2442          * determines whether TCP
2443          * calls strlog() to print out debug messages.  Doing this
2444          * initialization here means that this value is not inherited thru
2445          * tcp_reinit().
2446          */
2447         if (!connp->conn_debug)
2448                 connp->conn_debug = tcps->tcps_dbg;
2449 }
2450 
2451 /*
2452  * Update the TCP connection according to change of PMTU.
2453  *
2454  * Path MTU might have changed by either increase or decrease, so need to
2455  * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny
2456  * or negative MSS, since tcp_mss_set() will do it.
2457  */
2458 void
2459 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only)
2460 {
2461         uint32_t        pmtu;
2462         int32_t         mss;
2463         conn_t          *connp = tcp->tcp_connp;
2464         ip_xmit_attr_t  *ixa = connp->conn_ixa;
2465         iaflags_t       ixaflags;
2466 
2467         if (tcp->tcp_tcps->tcps_ignore_path_mtu)
2468                 return;
2469 
2470         if (tcp->tcp_state < TCPS_ESTABLISHED)
2471                 return;
2472 
2473         /*
2474          * Always call ip_get_pmtu() to make sure that IP has updated
2475          * ixa_flags properly.
2476          */
2477         pmtu = ip_get_pmtu(ixa);
2478         ixaflags = ixa->ixa_flags;
2479 
2480         /*
2481          * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and
2482          * IPsec overhead if applied. Make sure to use the most recent
2483          * IPsec information.
2484          */
2485         mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp);
2486 
2487         /*
2488          * Nothing to change, so just return.
2489          */
2490         if (mss == tcp->tcp_mss)
2491                 return;
2492 
2493         /*
2494          * Currently, for ICMP errors, only PMTU decrease is handled.
2495          */
2496         if (mss > tcp->tcp_mss && decrease_only)
2497                 return;
2498 
2499         DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss);
2500 
2501         /*
2502          * Update ixa_fragsize and ixa_pmtu.
2503          */
2504         ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu;
2505 
2506         /*
2507          * Adjust MSS and all relevant variables.
2508          */
2509         tcp_mss_set(tcp, mss);
2510 
2511         /*
2512          * If the PMTU is below the min size maintained by IP, then ip_get_pmtu
2513          * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP
2514          * has a (potentially different) min size we do the same. Make sure to
2515          * clear IXAF_DONTFRAG, which is used by IP to decide whether to
2516          * fragment the packet.
2517          *
2518          * LSO over IPv6 can not be fragmented. So need to disable LSO
2519          * when IPv6 fragmentation is needed.
2520          */
2521         if (mss < tcp->tcp_tcps->tcps_mss_min)
2522                 ixaflags |= IXAF_PMTU_TOO_SMALL;
2523 
2524         if (ixaflags & IXAF_PMTU_TOO_SMALL)
2525                 ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF);
2526 
2527         if ((connp->conn_ipversion == IPV4_VERSION) &&
2528             !(ixaflags & IXAF_PMTU_IPV4_DF)) {
2529                 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0;
2530         }
2531         ixa->ixa_flags = ixaflags;
2532 }
2533 
2534 int
2535 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk)
2536 {
2537         conn_t  *connp = tcp->tcp_connp;
2538         queue_t *q = connp->conn_rq;
2539         int32_t mss = tcp->tcp_mss;
2540         int     maxpsz;
2541 
2542         if (TCP_IS_DETACHED(tcp))
2543                 return (mss);
2544         if (tcp->tcp_fused) {
2545                 maxpsz = tcp_fuse_maxpsz(tcp);
2546                 mss = INFPSZ;
2547         } else if (tcp->tcp_maxpsz_multiplier == 0) {
2548                 /*
2549                  * Set the sd_qn_maxpsz according to the socket send buffer
2550                  * size, and sd_maxblk to INFPSZ (-1).  This will essentially
2551                  * instruct the stream head to copyin user data into contiguous
2552                  * kernel-allocated buffers without breaking it up into smaller
2553                  * chunks.  We round up the buffer size to the nearest SMSS.
2554                  */
2555                 maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss);
2556                 mss = INFPSZ;
2557         } else {
2558                 /*
2559                  * Set sd_qn_maxpsz to approx half the (receivers) buffer
2560                  * (and a multiple of the mss).  This instructs the stream
2561                  * head to break down larger than SMSS writes into SMSS-
2562                  * size mblks, up to tcp_maxpsz_multiplier mblks at a time.
2563                  */
2564                 maxpsz = tcp->tcp_maxpsz_multiplier * mss;
2565                 if (maxpsz > connp->conn_sndbuf / 2) {
2566                         maxpsz = connp->conn_sndbuf / 2;
2567                         /* Round up to nearest mss */
2568                         maxpsz = MSS_ROUNDUP(maxpsz, mss);
2569                 }
2570         }
2571 
2572         (void) proto_set_maxpsz(q, connp, maxpsz);
2573         if (!(IPCL_IS_NONSTR(connp)))
2574                 connp->conn_wq->q_maxpsz = maxpsz;
2575         if (set_maxblk)
2576                 (void) proto_set_tx_maxblk(q, connp, mss);
2577         return (mss);
2578 }
2579 
2580 /* For /dev/tcp aka AF_INET open */
2581 static int
2582 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2583 {
2584         return (tcp_open(q, devp, flag, sflag, credp, B_FALSE));
2585 }
2586 
2587 /* For /dev/tcp6 aka AF_INET6 open */
2588 static int
2589 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2590 {
2591         return (tcp_open(q, devp, flag, sflag, credp, B_TRUE));
2592 }
2593 
2594 conn_t *
2595 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket,
2596     int *errorp)
2597 {
2598         tcp_t           *tcp = NULL;
2599         conn_t          *connp;
2600         zoneid_t        zoneid;
2601         tcp_stack_t     *tcps;
2602         squeue_t        *sqp;
2603 
2604         ASSERT(errorp != NULL);
2605         /*
2606          * Find the proper zoneid and netstack.
2607          */
2608         /*
2609          * Special case for install: miniroot needs to be able to
2610          * access files via NFS as though it were always in the
2611          * global zone.
2612          */
2613         if (credp == kcred && nfs_global_client_only != 0) {
2614                 zoneid = GLOBAL_ZONEID;
2615                 tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)->
2616                     netstack_tcp;
2617                 ASSERT(tcps != NULL);
2618         } else {
2619                 netstack_t *ns;
2620                 int err;
2621 
2622                 if ((err = secpolicy_basic_net_access(credp)) != 0) {
2623                         *errorp = err;
2624                         return (NULL);
2625                 }
2626 
2627                 ns = netstack_find_by_cred(credp);
2628                 ASSERT(ns != NULL);
2629                 tcps = ns->netstack_tcp;
2630                 ASSERT(tcps != NULL);
2631 
2632                 /*
2633                  * For exclusive stacks we set the zoneid to zero
2634                  * to make TCP operate as if in the global zone.
2635                  */
2636                 if (tcps->tcps_netstack->netstack_stackid !=
2637                     GLOBAL_NETSTACKID)
2638                         zoneid = GLOBAL_ZONEID;
2639                 else
2640                         zoneid = crgetzoneid(credp);
2641         }
2642 
2643         sqp = IP_SQUEUE_GET((uint_t)gethrtime());
2644         connp = (conn_t *)tcp_get_conn(sqp, tcps);
2645         /*
2646          * Both tcp_get_conn and netstack_find_by_cred incremented refcnt,
2647          * so we drop it by one.
2648          */
2649         netstack_rele(tcps->tcps_netstack);
2650         if (connp == NULL) {
2651                 *errorp = ENOSR;
2652                 return (NULL);
2653         }
2654         ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
2655 
2656         connp->conn_sqp = sqp;
2657         connp->conn_initial_sqp = connp->conn_sqp;
2658         connp->conn_ixa->ixa_sqp = connp->conn_sqp;
2659         tcp = connp->conn_tcp;
2660 
2661         /*
2662          * Besides asking IP to set the checksum for us, have conn_ip_output
2663          * to do the following checks when necessary:
2664          *
2665          * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid
2666          * IXAF_VERIFY_PMTU: verify PMTU changes
2667          * IXAF_VERIFY_LSO: verify LSO capability changes
2668          */
2669         connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
2670             IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO;
2671 
2672         if (!tcps->tcps_dev_flow_ctl)
2673                 connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
2674 
2675         if (isv6) {
2676                 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT;
2677                 connp->conn_ipversion = IPV6_VERSION;
2678                 connp->conn_family = AF_INET6;
2679                 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
2680                 connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit;
2681         } else {
2682                 connp->conn_ipversion = IPV4_VERSION;
2683                 connp->conn_family = AF_INET;
2684                 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
2685                 connp->conn_default_ttl = tcps->tcps_ipv4_ttl;
2686         }
2687         connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
2688 
2689         crhold(credp);
2690         connp->conn_cred = credp;
2691         connp->conn_cpid = curproc->p_pid;
2692         connp->conn_open_time = ddi_get_lbolt64();
2693 
2694         /* Cache things in the ixa without any refhold */
2695         ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
2696         connp->conn_ixa->ixa_cred = credp;
2697         connp->conn_ixa->ixa_cpid = connp->conn_cpid;
2698 
2699         connp->conn_zoneid = zoneid;
2700         /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
2701         connp->conn_ixa->ixa_zoneid = zoneid;
2702         connp->conn_mlp_type = mlptSingle;
2703         ASSERT(connp->conn_netstack == tcps->tcps_netstack);
2704         ASSERT(tcp->tcp_tcps == tcps);
2705 
2706         /*
2707          * If the caller has the process-wide flag set, then default to MAC
2708          * exempt mode.  This allows read-down to unlabeled hosts.
2709          */
2710         if (getpflags(NET_MAC_AWARE, credp) != 0)
2711                 connp->conn_mac_mode = CONN_MAC_AWARE;
2712 
2713         connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
2714 
2715         if (issocket) {
2716                 tcp->tcp_issocket = 1;
2717         }
2718 
2719         connp->conn_rcvbuf = tcps->tcps_recv_hiwat;
2720         connp->conn_sndbuf = tcps->tcps_xmit_hiwat;
2721         connp->conn_sndlowat = tcps->tcps_xmit_lowat;
2722         connp->conn_so_type = SOCK_STREAM;
2723         connp->conn_wroff = connp->conn_ht_iphc_allocated +
2724             tcps->tcps_wroff_xtra;
2725 
2726         SOCK_CONNID_INIT(tcp->tcp_connid);
2727         /* DTrace ignores this - it isn't a tcp:::state-change */
2728         tcp->tcp_state = TCPS_IDLE;
2729         tcp_init_values(tcp, NULL);
2730         return (connp);
2731 }
2732 
2733 static int
2734 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
2735     boolean_t isv6)
2736 {
2737         tcp_t           *tcp = NULL;
2738         conn_t          *connp = NULL;
2739         int             err;
2740         vmem_t          *minor_arena = NULL;
2741         dev_t           conn_dev;
2742         boolean_t       issocket;
2743 
2744         if (q->q_ptr != NULL)
2745                 return (0);
2746 
2747         if (sflag == MODOPEN)
2748                 return (EINVAL);
2749 
2750         if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
2751             ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
2752                 minor_arena = ip_minor_arena_la;
2753         } else {
2754                 /*
2755                  * Either minor numbers in the large arena were exhausted
2756                  * or a non socket application is doing the open.
2757                  * Try to allocate from the small arena.
2758                  */
2759                 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) {
2760                         return (EBUSY);
2761                 }
2762                 minor_arena = ip_minor_arena_sa;
2763         }
2764 
2765         ASSERT(minor_arena != NULL);
2766 
2767         *devp = makedevice(getmajor(*devp), (minor_t)conn_dev);
2768 
2769         if (flag & SO_FALLBACK) {
2770                 /*
2771                  * Non streams socket needs a stream to fallback to
2772                  */
2773                 RD(q)->q_ptr = (void *)conn_dev;
2774                 WR(q)->q_qinfo = &tcp_fallback_sock_winit;
2775                 WR(q)->q_ptr = (void *)minor_arena;
2776                 qprocson(q);
2777                 return (0);
2778         } else if (flag & SO_ACCEPTOR) {
2779                 q->q_qinfo = &tcp_acceptor_rinit;
2780                 /*
2781                  * the conn_dev and minor_arena will be subsequently used by
2782                  * tcp_tli_accept() and tcp_tpi_close_accept() to figure out
2783                  * the minor device number for this connection from the q_ptr.
2784                  */
2785                 RD(q)->q_ptr = (void *)conn_dev;
2786                 WR(q)->q_qinfo = &tcp_acceptor_winit;
2787                 WR(q)->q_ptr = (void *)minor_arena;
2788                 qprocson(q);
2789                 return (0);
2790         }
2791 
2792         issocket = flag & SO_SOCKSTR;
2793         connp = tcp_create_common(credp, isv6, issocket, &err);
2794 
2795         if (connp == NULL) {
2796                 inet_minor_free(minor_arena, conn_dev);
2797                 q->q_ptr = WR(q)->q_ptr = NULL;
2798                 return (err);
2799         }
2800 
2801         connp->conn_rq = q;
2802         connp->conn_wq = WR(q);
2803         q->q_ptr = WR(q)->q_ptr = connp;
2804 
2805         connp->conn_dev = conn_dev;
2806         connp->conn_minor_arena = minor_arena;
2807 
2808         ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6);
2809         ASSERT(WR(q)->q_qinfo == &tcp_winit);
2810 
2811         tcp = connp->conn_tcp;
2812 
2813         if (issocket) {
2814                 WR(q)->q_qinfo = &tcp_sock_winit;
2815         } else {
2816 #ifdef  _ILP32
2817                 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q);
2818 #else
2819                 tcp->tcp_acceptor_id = conn_dev;
2820 #endif  /* _ILP32 */
2821                 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp);
2822         }
2823 
2824         /*
2825          * Put the ref for TCP. Ref for IP was already put
2826          * by ipcl_conn_create. Also Make the conn_t globally
2827          * visible to walkers
2828          */
2829         mutex_enter(&connp->conn_lock);
2830         CONN_INC_REF_LOCKED(connp);
2831         ASSERT(connp->conn_ref == 2);
2832         connp->conn_state_flags &= ~CONN_INCIPIENT;
2833         mutex_exit(&connp->conn_lock);
2834 
2835         qprocson(q);
2836         return (0);
2837 }
2838 
2839 /*
2840  * Build/update the tcp header template (in conn_ht_iphc) based on
2841  * conn_xmit_ipp. The headers include ip6_t, any extension
2842  * headers, and the maximum size tcp header (to avoid reallocation
2843  * on the fly for additional tcp options).
2844  *
2845  * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}.
2846  * Returns failure if can't allocate memory.
2847  */
2848 int
2849 tcp_build_hdrs(tcp_t *tcp)
2850 {
2851         tcp_stack_t     *tcps = tcp->tcp_tcps;
2852         conn_t          *connp = tcp->tcp_connp;
2853         char            buf[TCP_MAX_HDR_LENGTH];
2854         uint_t          buflen;
2855         uint_t          ulplen = TCP_MIN_HEADER_LENGTH;
2856         uint_t          extralen = TCP_MAX_TCP_OPTIONS_LENGTH;
2857         tcpha_t         *tcpha;
2858         uint32_t        cksum;
2859         int             error;
2860 
2861         /*
2862          * We might be called after the connection is set up, and we might
2863          * have TS options already in the TCP header. Thus we  save any
2864          * existing tcp header.
2865          */
2866         buflen = connp->conn_ht_ulp_len;
2867         if (buflen != 0) {
2868                 bcopy(connp->conn_ht_ulp, buf, buflen);
2869                 extralen -= buflen - ulplen;
2870                 ulplen = buflen;
2871         }
2872 
2873         /* Grab lock to satisfy ASSERT; TCP is serialized using squeue */
2874         mutex_enter(&connp->conn_lock);
2875         error = conn_build_hdr_template(connp, ulplen, extralen,
2876             &connp->conn_laddr_v6, &connp->conn_faddr_v6, connp->conn_flowinfo);
2877         mutex_exit(&connp->conn_lock);
2878         if (error != 0)
2879                 return (error);
2880 
2881         /*
2882          * Any routing header/option has been massaged. The checksum difference
2883          * is stored in conn_sum for later use.
2884          */
2885         tcpha = (tcpha_t *)connp->conn_ht_ulp;
2886         tcp->tcp_tcpha = tcpha;
2887 
2888         /* restore any old tcp header */
2889         if (buflen != 0) {
2890                 bcopy(buf, connp->conn_ht_ulp, buflen);
2891         } else {
2892                 tcpha->tha_sum = 0;
2893                 tcpha->tha_urp = 0;
2894                 tcpha->tha_ack = 0;
2895                 tcpha->tha_offset_and_reserved = (5 << 4);
2896                 tcpha->tha_lport = connp->conn_lport;
2897                 tcpha->tha_fport = connp->conn_fport;
2898         }
2899 
2900         /*
2901          * IP wants our header length in the checksum field to
2902          * allow it to perform a single pseudo-header+checksum
2903          * calculation on behalf of TCP.
2904          * Include the adjustment for a source route once IP_OPTIONS is set.
2905          */
2906         cksum = sizeof (tcpha_t) + connp->conn_sum;
2907         cksum = (cksum >> 16) + (cksum & 0xFFFF);
2908         ASSERT(cksum < 0x10000);
2909         tcpha->tha_sum = htons(cksum);
2910 
2911         if (connp->conn_ipversion == IPV4_VERSION)
2912                 tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc;
2913         else
2914                 tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc;
2915 
2916         if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra >
2917             connp->conn_wroff) {
2918                 connp->conn_wroff = connp->conn_ht_iphc_allocated +
2919                     tcps->tcps_wroff_xtra;
2920                 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2921                     connp->conn_wroff);
2922         }
2923         return (0);
2924 }
2925 
2926 /*
2927  * tcp_rwnd_set() is called to adjust the receive window to a desired value.
2928  * We do not allow the receive window to shrink.  After setting rwnd,
2929  * set the flow control hiwat of the stream.
2930  *
2931  * This function is called in 2 cases:
2932  *
2933  * 1) Before data transfer begins, in tcp_input_listener() for accepting a
2934  *    connection (passive open) and in tcp_input_data() for active connect.
2935  *    This is called after tcp_mss_set() when the desired MSS value is known.
2936  *    This makes sure that our window size is a mutiple of the other side's
2937  *    MSS.
2938  * 2) Handling SO_RCVBUF option.
2939  *
2940  * It is ASSUMED that the requested size is a multiple of the current MSS.
2941  *
2942  * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the
2943  * user requests so.
2944  */
2945 int
2946 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd)
2947 {
2948         uint32_t        mss = tcp->tcp_mss;
2949         uint32_t        old_max_rwnd;
2950         uint32_t        max_transmittable_rwnd;
2951         boolean_t       tcp_detached = TCP_IS_DETACHED(tcp);
2952         tcp_stack_t     *tcps = tcp->tcp_tcps;
2953         conn_t          *connp = tcp->tcp_connp;
2954 
2955         /*
2956          * Insist on a receive window that is at least
2957          * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid
2958          * funny TCP interactions of Nagle algorithm, SWS avoidance
2959          * and delayed acknowledgement.
2960          */
2961         rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss);
2962 
2963         if (tcp->tcp_fused) {
2964                 size_t sth_hiwat;
2965                 tcp_t *peer_tcp = tcp->tcp_loopback_peer;
2966 
2967                 ASSERT(peer_tcp != NULL);
2968                 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd);
2969                 if (!tcp_detached) {
2970                         (void) proto_set_rx_hiwat(connp->conn_rq, connp,
2971                             sth_hiwat);
2972                         tcp_set_recv_threshold(tcp, sth_hiwat >> 3);
2973                 }
2974 
2975                 /* Caller could have changed tcp_rwnd; update tha_win */
2976                 if (tcp->tcp_tcpha != NULL) {
2977                         tcp->tcp_tcpha->tha_win =
2978                             htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2979                 }
2980                 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
2981                         tcp->tcp_cwnd_max = rwnd;
2982 
2983                 /*
2984                  * In the fusion case, the maxpsz stream head value of
2985                  * our peer is set according to its send buffer size
2986                  * and our receive buffer size; since the latter may
2987                  * have changed we need to update the peer's maxpsz.
2988                  */
2989                 (void) tcp_maxpsz_set(peer_tcp, B_TRUE);
2990                 return (sth_hiwat);
2991         }
2992 
2993         if (tcp_detached)
2994                 old_max_rwnd = tcp->tcp_rwnd;
2995         else
2996                 old_max_rwnd = connp->conn_rcvbuf;
2997 
2998 
2999         /*
3000          * If window size info has already been exchanged, TCP should not
3001          * shrink the window.  Shrinking window is doable if done carefully.
3002          * We may add that support later.  But so far there is not a real
3003          * need to do that.
3004          */
3005         if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) {
3006                 /* MSS may have changed, do a round up again. */
3007                 rwnd = MSS_ROUNDUP(old_max_rwnd, mss);
3008         }
3009 
3010         /*
3011          * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check
3012          * can be applied even before the window scale option is decided.
3013          */
3014         max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws;
3015         if (rwnd > max_transmittable_rwnd) {
3016                 rwnd = max_transmittable_rwnd -
3017                     (max_transmittable_rwnd % mss);
3018                 if (rwnd < mss)
3019                         rwnd = max_transmittable_rwnd;
3020                 /*
3021                  * If we're over the limit we may have to back down tcp_rwnd.
3022                  * The increment below won't work for us. So we set all three
3023                  * here and the increment below will have no effect.
3024                  */
3025                 tcp->tcp_rwnd = old_max_rwnd = rwnd;
3026         }
3027         if (tcp->tcp_localnet) {
3028                 tcp->tcp_rack_abs_max =
3029                     MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2);
3030         } else {
3031                 /*
3032                  * For a remote host on a different subnet (through a router),
3033                  * we ack every other packet to be conforming to RFC1122.
3034                  * tcp_deferred_acks_max is default to 2.
3035                  */
3036                 tcp->tcp_rack_abs_max =
3037                     MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2);
3038         }
3039         if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max)
3040                 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
3041         else
3042                 tcp->tcp_rack_cur_max = 0;
3043         /*
3044          * Increment the current rwnd by the amount the maximum grew (we
3045          * can not overwrite it since we might be in the middle of a
3046          * connection.)
3047          */
3048         tcp->tcp_rwnd += rwnd - old_max_rwnd;
3049         connp->conn_rcvbuf = rwnd;
3050 
3051         /* Are we already connected? */
3052         if (tcp->tcp_tcpha != NULL) {
3053                 tcp->tcp_tcpha->tha_win =
3054                     htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
3055         }
3056 
3057         if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
3058                 tcp->tcp_cwnd_max = rwnd;
3059 
3060         if (tcp_detached)
3061                 return (rwnd);
3062 
3063         tcp_set_recv_threshold(tcp, rwnd >> 3);
3064 
3065         (void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd);
3066         return (rwnd);
3067 }
3068 
3069 int
3070 tcp_do_unbind(conn_t *connp)
3071 {
3072         tcp_t *tcp = connp->conn_tcp;
3073         int32_t oldstate;
3074 
3075         switch (tcp->tcp_state) {
3076         case TCPS_BOUND:
3077         case TCPS_LISTEN:
3078                 break;
3079         default:
3080                 return (-TOUTSTATE);
3081         }
3082 
3083         /*
3084          * Need to clean up all the eagers since after the unbind, segments
3085          * will no longer be delivered to this listener stream.
3086          */
3087         mutex_enter(&tcp->tcp_eager_lock);
3088         if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) {
3089                 tcp_eager_cleanup(tcp, 0);
3090         }
3091         mutex_exit(&tcp->tcp_eager_lock);
3092 
3093         /* Clean up the listener connection counter if necessary. */
3094         if (tcp->tcp_listen_cnt != NULL)
3095                 TCP_DECR_LISTEN_CNT(tcp);
3096         connp->conn_laddr_v6 = ipv6_all_zeros;
3097         connp->conn_saddr_v6 = ipv6_all_zeros;
3098         tcp_bind_hash_remove(tcp);
3099         oldstate = tcp->tcp_state;
3100         tcp->tcp_state = TCPS_IDLE;
3101         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3102             connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3103             int32_t, oldstate);
3104 
3105         ip_unbind(connp);
3106         bzero(&connp->conn_ports, sizeof (connp->conn_ports));
3107 
3108         return (0);
3109 }
3110 
3111 /*
3112  * Collect protocol properties to send to the upper handle.
3113  */
3114 void
3115 tcp_get_proto_props(tcp_t *tcp, struct sock_proto_props *sopp)
3116 {
3117         conn_t *connp = tcp->tcp_connp;
3118 
3119         sopp->sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF;
3120         sopp->sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE);
3121 
3122         sopp->sopp_rxhiwat = tcp->tcp_fused ?
3123             tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) :
3124             connp->conn_rcvbuf;
3125         /*
3126          * Determine what write offset value to use depending on SACK and
3127          * whether the endpoint is fused or not.
3128          */
3129         if (tcp->tcp_fused) {
3130                 ASSERT(tcp->tcp_loopback);
3131                 ASSERT(tcp->tcp_loopback_peer != NULL);
3132                 /*
3133                  * For fused tcp loopback, set the stream head's write
3134                  * offset value to zero since we won't be needing any room
3135                  * for TCP/IP headers.  This would also improve performance
3136                  * since it would reduce the amount of work done by kmem.
3137                  * Non-fused tcp loopback case is handled separately below.
3138                  */
3139                 sopp->sopp_wroff = 0;
3140                 /*
3141                  * Update the peer's transmit parameters according to
3142                  * our recently calculated high water mark value.
3143                  */
3144                 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE);
3145         } else if (tcp->tcp_snd_sack_ok) {
3146                 sopp->sopp_wroff = connp->conn_ht_iphc_allocated +
3147                     (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra);
3148         } else {
3149                 sopp->sopp_wroff = connp->conn_ht_iphc_len +
3150                     (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra);
3151         }
3152 
3153         if (tcp->tcp_loopback) {
3154                 sopp->sopp_flags |= SOCKOPT_LOOPBACK;
3155                 sopp->sopp_loopback = B_TRUE;
3156         }
3157 }
3158 
3159 /*
3160  * Check the usability of ZEROCOPY. It's instead checking the flag set by IP.
3161  */
3162 boolean_t
3163 tcp_zcopy_check(tcp_t *tcp)
3164 {
3165         conn_t          *connp = tcp->tcp_connp;
3166         ip_xmit_attr_t  *ixa = connp->conn_ixa;
3167         boolean_t       zc_enabled = B_FALSE;
3168         tcp_stack_t     *tcps = tcp->tcp_tcps;
3169 
3170         if (do_tcpzcopy == 2)
3171                 zc_enabled = B_TRUE;
3172         else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB))
3173                 zc_enabled = B_TRUE;
3174 
3175         tcp->tcp_snd_zcopy_on = zc_enabled;
3176         if (!TCP_IS_DETACHED(tcp)) {
3177                 if (zc_enabled) {
3178                         ixa->ixa_flags |= IXAF_VERIFY_ZCOPY;
3179                         (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3180                             ZCVMSAFE);
3181                         TCP_STAT(tcps, tcp_zcopy_on);
3182                 } else {
3183                         ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY;
3184                         (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3185                             ZCVMUNSAFE);
3186                         TCP_STAT(tcps, tcp_zcopy_off);
3187                 }
3188         }
3189         return (zc_enabled);
3190 }
3191 
3192 /*
3193  * Backoff from a zero-copy message by copying data to a new allocated
3194  * message and freeing the original desballoca'ed segmapped message.
3195  *
3196  * This function is called by following two callers:
3197  * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free
3198  *    the origial desballoca'ed message and notify sockfs. This is in re-
3199  *    transmit state.
3200  * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need
3201  *    to be copied to new message.
3202  */
3203 mblk_t *
3204 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist)
3205 {
3206         mblk_t          *nbp;
3207         mblk_t          *head = NULL;
3208         mblk_t          *tail = NULL;
3209         tcp_stack_t     *tcps = tcp->tcp_tcps;
3210 
3211         ASSERT(bp != NULL);
3212         while (bp != NULL) {
3213                 if (IS_VMLOANED_MBLK(bp)) {
3214                         TCP_STAT(tcps, tcp_zcopy_backoff);
3215                         if ((nbp = copyb(bp)) == NULL) {
3216                                 tcp->tcp_xmit_zc_clean = B_FALSE;
3217                                 if (tail != NULL)
3218                                         tail->b_cont = bp;
3219                                 return ((head == NULL) ? bp : head);
3220                         }
3221 
3222                         if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) {
3223                                 if (fix_xmitlist)
3224                                         tcp_zcopy_notify(tcp);
3225                                 else
3226                                         nbp->b_datap->db_struioflag |=
3227                                             STRUIO_ZCNOTIFY;
3228                         }
3229                         nbp->b_cont = bp->b_cont;
3230 
3231                         /*
3232                          * Copy saved information and adjust tcp_xmit_tail
3233                          * if needed.
3234                          */
3235                         if (fix_xmitlist) {
3236                                 nbp->b_prev = bp->b_prev;
3237                                 nbp->b_next = bp->b_next;
3238 
3239                                 if (tcp->tcp_xmit_tail == bp)
3240                                         tcp->tcp_xmit_tail = nbp;
3241                         }
3242 
3243                         /* Free the original message. */
3244                         bp->b_prev = NULL;
3245                         bp->b_next = NULL;
3246                         freeb(bp);
3247 
3248                         bp = nbp;
3249                 }
3250 
3251                 if (head == NULL) {
3252                         head = bp;
3253                 }
3254                 if (tail == NULL) {
3255                         tail = bp;
3256                 } else {
3257                         tail->b_cont = bp;
3258                         tail = bp;
3259                 }
3260 
3261                 /* Move forward. */
3262                 bp = bp->b_cont;
3263         }
3264 
3265         if (fix_xmitlist) {
3266                 tcp->tcp_xmit_last = tail;
3267                 tcp->tcp_xmit_zc_clean = B_TRUE;
3268         }
3269 
3270         return (head);
3271 }
3272 
3273 void
3274 tcp_zcopy_notify(tcp_t *tcp)
3275 {
3276         struct stdata   *stp;
3277         conn_t          *connp;
3278 
3279         if (tcp->tcp_detached)
3280                 return;
3281         connp = tcp->tcp_connp;
3282         if (IPCL_IS_NONSTR(connp)) {
3283                 (*connp->conn_upcalls->su_zcopy_notify)
3284                     (connp->conn_upper_handle);
3285                 return;
3286         }
3287         stp = STREAM(connp->conn_rq);
3288         mutex_enter(&stp->sd_lock);
3289         stp->sd_flag |= STZCNOTIFY;
3290         cv_broadcast(&stp->sd_zcopy_wait);
3291         mutex_exit(&stp->sd_lock);
3292 }
3293 
3294 /*
3295  * Update the TCP connection according to change of LSO capability.
3296  */
3297 static void
3298 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa)
3299 {
3300         /*
3301          * We check against IPv4 header length to preserve the old behavior
3302          * of only enabling LSO when there are no IP options.
3303          * But this restriction might not be necessary at all. Before removing
3304          * it, need to verify how LSO is handled for source routing case, with
3305          * which IP does software checksum.
3306          *
3307          * For IPv6, whenever any extension header is needed, LSO is supressed.
3308          */
3309         if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ?
3310             IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN))
3311                 return;
3312 
3313         /*
3314          * Either the LSO capability newly became usable, or it has changed.
3315          */
3316         if (ixa->ixa_flags & IXAF_LSO_CAPAB) {
3317                 ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab;
3318 
3319                 ASSERT(lsoc->ill_lso_max > 0);
3320                 tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lsoc->ill_lso_max);
3321 
3322                 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso,
3323                     boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max);
3324 
3325                 /*
3326                  * If LSO to be enabled, notify the STREAM header with larger
3327                  * data block.
3328                  */
3329                 if (!tcp->tcp_lso)
3330                         tcp->tcp_maxpsz_multiplier = 0;
3331 
3332                 tcp->tcp_lso = B_TRUE;
3333                 TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled);
3334         } else { /* LSO capability is not usable any more. */
3335                 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso,
3336                     boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max);
3337 
3338                 /*
3339                  * If LSO to be disabled, notify the STREAM header with smaller
3340                  * data block. And need to restore fragsize to PMTU.
3341                  */
3342                 if (tcp->tcp_lso) {
3343                         tcp->tcp_maxpsz_multiplier =
3344                             tcp->tcp_tcps->tcps_maxpsz_multiplier;
3345                         ixa->ixa_fragsize = ixa->ixa_pmtu;
3346                         tcp->tcp_lso = B_FALSE;
3347                         TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled);
3348                 }
3349         }
3350 
3351         (void) tcp_maxpsz_set(tcp, B_TRUE);
3352 }
3353 
3354 /*
3355  * Update the TCP connection according to change of ZEROCOPY capability.
3356  */
3357 static void
3358 tcp_update_zcopy(tcp_t *tcp)
3359 {
3360         conn_t          *connp = tcp->tcp_connp;
3361         tcp_stack_t     *tcps = tcp->tcp_tcps;
3362 
3363         if (tcp->tcp_snd_zcopy_on) {
3364                 tcp->tcp_snd_zcopy_on = B_FALSE;
3365                 if (!TCP_IS_DETACHED(tcp)) {
3366                         (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3367                             ZCVMUNSAFE);
3368                         TCP_STAT(tcps, tcp_zcopy_off);
3369                 }
3370         } else {
3371                 tcp->tcp_snd_zcopy_on = B_TRUE;
3372                 if (!TCP_IS_DETACHED(tcp)) {
3373                         (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3374                             ZCVMSAFE);
3375                         TCP_STAT(tcps, tcp_zcopy_on);
3376                 }
3377         }
3378 }
3379 
3380 /*
3381  * Notify function registered with ip_xmit_attr_t. It's called in the squeue
3382  * so it's safe to update the TCP connection.
3383  */
3384 /* ARGSUSED1 */
3385 static void
3386 tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype,
3387     ixa_notify_arg_t narg)
3388 {
3389         tcp_t           *tcp = (tcp_t *)arg;
3390         conn_t          *connp = tcp->tcp_connp;
3391 
3392         switch (ntype) {
3393         case IXAN_LSO:
3394                 tcp_update_lso(tcp, connp->conn_ixa);
3395                 break;
3396         case IXAN_PMTU:
3397                 tcp_update_pmtu(tcp, B_FALSE);
3398                 break;
3399         case IXAN_ZCOPY:
3400                 tcp_update_zcopy(tcp);
3401                 break;
3402         default:
3403                 break;
3404         }
3405 }
3406 
3407 /*
3408  * The TCP write service routine should never be called...
3409  */
3410 /* ARGSUSED */
3411 static void
3412 tcp_wsrv(queue_t *q)
3413 {
3414         tcp_stack_t     *tcps = Q_TO_TCP(q)->tcp_tcps;
3415 
3416         TCP_STAT(tcps, tcp_wsrv_called);
3417 }
3418 
3419 /*
3420  * Hash list lookup routine for tcp_t structures.
3421  * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF.
3422  */
3423 tcp_t *
3424 tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *tcps)
3425 {
3426         tf_t    *tf;
3427         tcp_t   *tcp;
3428 
3429         tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)];
3430         mutex_enter(&tf->tf_lock);
3431         for (tcp = tf->tf_tcp; tcp != NULL;
3432             tcp = tcp->tcp_acceptor_hash) {
3433                 if (tcp->tcp_acceptor_id == id) {
3434                         CONN_INC_REF(tcp->tcp_connp);
3435                         mutex_exit(&tf->tf_lock);
3436                         return (tcp);
3437                 }
3438         }
3439         mutex_exit(&tf->tf_lock);
3440         return (NULL);
3441 }
3442 
3443 /*
3444  * Hash list insertion routine for tcp_t structures.
3445  */
3446 void
3447 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp)
3448 {
3449         tf_t    *tf;
3450         tcp_t   **tcpp;
3451         tcp_t   *tcpnext;
3452         tcp_stack_t     *tcps = tcp->tcp_tcps;
3453 
3454         tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)];
3455 
3456         if (tcp->tcp_ptpahn != NULL)
3457                 tcp_acceptor_hash_remove(tcp);
3458         tcpp = &tf->tf_tcp;
3459         mutex_enter(&tf->tf_lock);
3460         tcpnext = tcpp[0];
3461         if (tcpnext)
3462                 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash;
3463         tcp->tcp_acceptor_hash = tcpnext;
3464         tcp->tcp_ptpahn = tcpp;
3465         tcpp[0] = tcp;
3466         tcp->tcp_acceptor_lockp = &tf->tf_lock;       /* For tcp_*_hash_remove */
3467         mutex_exit(&tf->tf_lock);
3468 }
3469 
3470 /*
3471  * Hash list removal routine for tcp_t structures.
3472  */
3473 void
3474 tcp_acceptor_hash_remove(tcp_t *tcp)
3475 {
3476         tcp_t   *tcpnext;
3477         kmutex_t *lockp;
3478 
3479         /*
3480          * Extract the lock pointer in case there are concurrent
3481          * hash_remove's for this instance.
3482          */
3483         lockp = tcp->tcp_acceptor_lockp;
3484 
3485         if (tcp->tcp_ptpahn == NULL)
3486                 return;
3487 
3488         ASSERT(lockp != NULL);
3489         mutex_enter(lockp);
3490         if (tcp->tcp_ptpahn) {
3491                 tcpnext = tcp->tcp_acceptor_hash;
3492                 if (tcpnext) {
3493                         tcpnext->tcp_ptpahn = tcp->tcp_ptpahn;
3494                         tcp->tcp_acceptor_hash = NULL;
3495                 }
3496                 *tcp->tcp_ptpahn = tcpnext;
3497                 tcp->tcp_ptpahn = NULL;
3498         }
3499         mutex_exit(lockp);
3500         tcp->tcp_acceptor_lockp = NULL;
3501 }
3502 
3503 /*
3504  * Type three generator adapted from the random() function in 4.4 BSD:
3505  */
3506 
3507 /*
3508  * Copyright (c) 1983, 1993
3509  *      The Regents of the University of California.  All rights reserved.
3510  *
3511  * Redistribution and use in source and binary forms, with or without
3512  * modification, are permitted provided that the following conditions
3513  * are met:
3514  * 1. Redistributions of source code must retain the above copyright
3515  *    notice, this list of conditions and the following disclaimer.
3516  * 2. Redistributions in binary form must reproduce the above copyright
3517  *    notice, this list of conditions and the following disclaimer in the
3518  *    documentation and/or other materials provided with the distribution.
3519  * 3. All advertising materials mentioning features or use of this software
3520  *    must display the following acknowledgement:
3521  *      This product includes software developed by the University of
3522  *      California, Berkeley and its contributors.
3523  * 4. Neither the name of the University nor the names of its contributors
3524  *    may be used to endorse or promote products derived from this software
3525  *    without specific prior written permission.
3526  *
3527  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
3528  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
3529  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
3530  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
3531  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
3532  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
3533  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3534  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
3535  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
3536  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
3537  * SUCH DAMAGE.
3538  */
3539 
3540 /* Type 3 -- x**31 + x**3 + 1 */
3541 #define DEG_3           31
3542 #define SEP_3           3
3543 
3544 
3545 /* Protected by tcp_random_lock */
3546 static int tcp_randtbl[DEG_3 + 1];
3547 
3548 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1];
3549 static int *tcp_random_rptr = &tcp_randtbl[1];
3550 
3551 static int *tcp_random_state = &tcp_randtbl[1];
3552 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1];
3553 
3554 kmutex_t tcp_random_lock;
3555 
3556 void
3557 tcp_random_init(void)
3558 {
3559         int i;
3560         hrtime_t hrt;
3561         time_t wallclock;
3562         uint64_t result;
3563 
3564         /*
3565          * Use high-res timer and current time for seed.  Gethrtime() returns
3566          * a longlong, which may contain resolution down to nanoseconds.
3567          * The current time will either be a 32-bit or a 64-bit quantity.
3568          * XOR the two together in a 64-bit result variable.
3569          * Convert the result to a 32-bit value by multiplying the high-order
3570          * 32-bits by the low-order 32-bits.
3571          */
3572 
3573         hrt = gethrtime();
3574         (void) drv_getparm(TIME, &wallclock);
3575         result = (uint64_t)wallclock ^ (uint64_t)hrt;
3576         mutex_enter(&tcp_random_lock);
3577         tcp_random_state[0] = ((result >> 32) & 0xffffffff) *
3578             (result & 0xffffffff);
3579 
3580         for (i = 1; i < DEG_3; i++)
3581                 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1]
3582                     + 12345;
3583         tcp_random_fptr = &tcp_random_state[SEP_3];
3584         tcp_random_rptr = &tcp_random_state[0];
3585         mutex_exit(&tcp_random_lock);
3586         for (i = 0; i < 10 * DEG_3; i++)
3587                 (void) tcp_random();
3588 }
3589 
3590 /*
3591  * tcp_random: Return a random number in the range [1 - (128K + 1)].
3592  * This range is selected to be approximately centered on TCP_ISS / 2,
3593  * and easy to compute. We get this value by generating a 32-bit random
3594  * number, selecting out the high-order 17 bits, and then adding one so
3595  * that we never return zero.
3596  */
3597 int
3598 tcp_random(void)
3599 {
3600         int i;
3601 
3602         mutex_enter(&tcp_random_lock);
3603         *tcp_random_fptr += *tcp_random_rptr;
3604 
3605         /*
3606          * The high-order bits are more random than the low-order bits,
3607          * so we select out the high-order 17 bits and add one so that
3608          * we never return zero.
3609          */
3610         i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1;
3611         if (++tcp_random_fptr >= tcp_random_end_ptr) {
3612                 tcp_random_fptr = tcp_random_state;
3613                 ++tcp_random_rptr;
3614         } else if (++tcp_random_rptr >= tcp_random_end_ptr)
3615                 tcp_random_rptr = tcp_random_state;
3616 
3617         mutex_exit(&tcp_random_lock);
3618         return (i);
3619 }
3620 
3621 /*
3622  * Split this function out so that if the secret changes, I'm okay.
3623  *
3624  * Initialize the tcp_iss_cookie and tcp_iss_key.
3625  */
3626 
3627 #define PASSWD_SIZE 16  /* MUST be multiple of 4 */
3628 
3629 void
3630 tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *tcps)
3631 {
3632         struct {
3633                 int32_t current_time;
3634                 uint32_t randnum;
3635                 uint16_t pad;
3636                 uint8_t ether[6];
3637                 uint8_t passwd[PASSWD_SIZE];
3638         } tcp_iss_cookie;
3639         time_t t;
3640 
3641         /*
3642          * Start with the current absolute time.
3643          */
3644         (void) drv_getparm(TIME, &t);
3645         tcp_iss_cookie.current_time = t;
3646 
3647         /*
3648          * XXX - Need a more random number per RFC 1750, not this crap.
3649          * OTOH, if what follows is pretty random, then I'm in better shape.
3650          */
3651         tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random());
3652         tcp_iss_cookie.pad = 0x365c;  /* Picked from HMAC pad values. */
3653 
3654         /*
3655          * The cpu_type_info is pretty non-random.  Ugggh.  It does serve
3656          * as a good template.
3657          */
3658         bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd,
3659             min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info)));
3660 
3661         /*
3662          * The pass-phrase.  Normally this is supplied by user-called NDD.
3663          */
3664         bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len));
3665 
3666         /*
3667          * See 4010593 if this section becomes a problem again,
3668          * but the local ethernet address is useful here.
3669          */
3670         (void) localetheraddr(NULL,
3671             (struct ether_addr *)&tcp_iss_cookie.ether);
3672 
3673         /*
3674          * Hash 'em all together.  The MD5Final is called per-connection.
3675          */
3676         mutex_enter(&tcps->tcps_iss_key_lock);
3677         MD5Init(&tcps->tcps_iss_key);
3678         MD5Update(&tcps->tcps_iss_key, (uchar_t *)&tcp_iss_cookie,
3679             sizeof (tcp_iss_cookie));
3680         mutex_exit(&tcps->tcps_iss_key_lock);
3681 }
3682 
3683 /*
3684  * Called by IP when IP is loaded into the kernel
3685  */
3686 void
3687 tcp_ddi_g_init(void)
3688 {
3689         tcp_timercache = kmem_cache_create("tcp_timercache",
3690             sizeof (tcp_timer_t) + sizeof (mblk_t), 0,
3691             NULL, NULL, NULL, NULL, NULL, 0);
3692 
3693         tcp_notsack_blk_cache = kmem_cache_create("tcp_notsack_blk_cache",
3694             sizeof (notsack_blk_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
3695 
3696         mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL);
3697 
3698         /* Initialize the random number generator */
3699         tcp_random_init();
3700 
3701         /* A single callback independently of how many netstacks we have */
3702         ip_squeue_init(tcp_squeue_add);
3703 
3704         tcp_g_kstat = tcp_g_kstat_init(&tcp_g_statistics);
3705 
3706         tcp_squeue_flag = tcp_squeue_switch(tcp_squeue_wput);
3707 
3708         /*
3709          * We want to be informed each time a stack is created or
3710          * destroyed in the kernel, so we can maintain the
3711          * set of tcp_stack_t's.
3712          */
3713         netstack_register(NS_TCP, tcp_stack_init, NULL, tcp_stack_fini);
3714 }
3715 
3716 
3717 #define INET_NAME       "ip"
3718 
3719 /*
3720  * Initialize the TCP stack instance.
3721  */
3722 static void *
3723 tcp_stack_init(netstackid_t stackid, netstack_t *ns)
3724 {
3725         tcp_stack_t     *tcps;
3726         int             i;
3727         int             error = 0;
3728         major_t         major;
3729         size_t          arrsz;
3730 
3731         tcps = (tcp_stack_t *)kmem_zalloc(sizeof (*tcps), KM_SLEEP);
3732         tcps->tcps_netstack = ns;
3733 
3734         /* Initialize locks */
3735         mutex_init(&tcps->tcps_iss_key_lock, NULL, MUTEX_DEFAULT, NULL);
3736         mutex_init(&tcps->tcps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
3737 
3738         tcps->tcps_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS;
3739         tcps->tcps_g_epriv_ports[0] = ULP_DEF_EPRIV_PORT1;
3740         tcps->tcps_g_epriv_ports[1] = ULP_DEF_EPRIV_PORT2;
3741         tcps->tcps_min_anonpriv_port = 512;
3742 
3743         tcps->tcps_bind_fanout = kmem_zalloc(sizeof (tf_t) *
3744             TCP_BIND_FANOUT_SIZE, KM_SLEEP);
3745         tcps->tcps_acceptor_fanout = kmem_zalloc(sizeof (tf_t) *
3746             TCP_ACCEPTOR_FANOUT_SIZE, KM_SLEEP);
3747 
3748         for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) {
3749                 mutex_init(&tcps->tcps_bind_fanout[i].tf_lock, NULL,
3750                     MUTEX_DEFAULT, NULL);
3751         }
3752 
3753         for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) {
3754                 mutex_init(&tcps->tcps_acceptor_fanout[i].tf_lock, NULL,
3755                     MUTEX_DEFAULT, NULL);
3756         }
3757 
3758         /* TCP's IPsec code calls the packet dropper. */
3759         ip_drop_register(&tcps->tcps_dropper, "TCP IPsec policy enforcement");
3760 
3761         arrsz = tcp_propinfo_count * sizeof (mod_prop_info_t);
3762         tcps->tcps_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz,
3763             KM_SLEEP);
3764         bcopy(tcp_propinfo_tbl, tcps->tcps_propinfo_tbl, arrsz);
3765 
3766         /*
3767          * Note: To really walk the device tree you need the devinfo
3768          * pointer to your device which is only available after probe/attach.
3769          * The following is safe only because it uses ddi_root_node()
3770          */
3771         tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr,
3772             tcp_opt_obj.odb_opt_arr_cnt);
3773 
3774         /*
3775          * Initialize RFC 1948 secret values.  This will probably be reset once
3776          * by the boot scripts.
3777          *
3778          * Use NULL name, as the name is caught by the new lockstats.
3779          *
3780          * Initialize with some random, non-guessable string, like the global
3781          * T_INFO_ACK.
3782          */
3783 
3784         tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack,
3785             sizeof (tcp_g_t_info_ack), tcps);
3786 
3787         tcps->tcps_kstat = tcp_kstat2_init(stackid);
3788         tcps->tcps_mibkp = tcp_kstat_init(stackid);
3789 
3790         major = mod_name_to_major(INET_NAME);
3791         error = ldi_ident_from_major(major, &tcps->tcps_ldi_ident);
3792         ASSERT(error == 0);
3793         tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL);
3794         ASSERT(tcps->tcps_ixa_cleanup_mp != NULL);
3795         cv_init(&tcps->tcps_ixa_cleanup_cv, NULL, CV_DEFAULT, NULL);
3796         mutex_init(&tcps->tcps_ixa_cleanup_lock, NULL, MUTEX_DEFAULT, NULL);
3797 
3798         mutex_init(&tcps->tcps_reclaim_lock, NULL, MUTEX_DEFAULT, NULL);
3799         tcps->tcps_reclaim = B_FALSE;
3800         tcps->tcps_reclaim_tid = 0;
3801         tcps->tcps_reclaim_period = tcps->tcps_rexmit_interval_max;
3802 
3803         /*
3804          * ncpus is the current number of CPUs, which can be bigger than
3805          * boot_ncpus.  But we don't want to use ncpus to allocate all the
3806          * tcp_stats_cpu_t at system boot up time since it will be 1.  While
3807          * we handle adding CPU in tcp_cpu_update(), it will be slow if
3808          * there are many CPUs as we will be adding them 1 by 1.
3809          *
3810          * Note that tcps_sc_cnt never decreases and the tcps_sc[x] pointers
3811          * are not freed until the stack is going away.  So there is no need
3812          * to grab a lock to access the per CPU tcps_sc[x] pointer.
3813          */
3814         mutex_enter(&cpu_lock);
3815         tcps->tcps_sc_cnt = MAX(ncpus, boot_ncpus);
3816         mutex_exit(&cpu_lock);
3817         tcps->tcps_sc = kmem_zalloc(max_ncpus  * sizeof (tcp_stats_cpu_t *),
3818             KM_SLEEP);
3819         for (i = 0; i < tcps->tcps_sc_cnt; i++) {
3820                 tcps->tcps_sc[i] = kmem_zalloc(sizeof (tcp_stats_cpu_t),
3821                     KM_SLEEP);
3822         }
3823 
3824         mutex_init(&tcps->tcps_listener_conf_lock, NULL, MUTEX_DEFAULT, NULL);
3825         list_create(&tcps->tcps_listener_conf, sizeof (tcp_listener_t),
3826             offsetof(tcp_listener_t, tl_link));
3827 
3828         return (tcps);
3829 }
3830 
3831 /*
3832  * Called when the IP module is about to be unloaded.
3833  */
3834 void
3835 tcp_ddi_g_destroy(void)
3836 {
3837         tcp_g_kstat_fini(tcp_g_kstat);
3838         tcp_g_kstat = NULL;
3839         bzero(&tcp_g_statistics, sizeof (tcp_g_statistics));
3840 
3841         mutex_destroy(&tcp_random_lock);
3842 
3843         kmem_cache_destroy(tcp_timercache);
3844         kmem_cache_destroy(tcp_notsack_blk_cache);
3845 
3846         netstack_unregister(NS_TCP);
3847 }
3848 
3849 /*
3850  * Free the TCP stack instance.
3851  */
3852 static void
3853 tcp_stack_fini(netstackid_t stackid, void *arg)
3854 {
3855         tcp_stack_t *tcps = (tcp_stack_t *)arg;
3856         int i;
3857 
3858         freeb(tcps->tcps_ixa_cleanup_mp);
3859         tcps->tcps_ixa_cleanup_mp = NULL;
3860         cv_destroy(&tcps->tcps_ixa_cleanup_cv);
3861         mutex_destroy(&tcps->tcps_ixa_cleanup_lock);
3862 
3863         /*
3864          * Set tcps_reclaim to false tells tcp_reclaim_timer() not to restart
3865          * the timer.
3866          */
3867         mutex_enter(&tcps->tcps_reclaim_lock);
3868         tcps->tcps_reclaim = B_FALSE;
3869         mutex_exit(&tcps->tcps_reclaim_lock);
3870         if (tcps->tcps_reclaim_tid != 0)
3871                 (void) untimeout(tcps->tcps_reclaim_tid);
3872         mutex_destroy(&tcps->tcps_reclaim_lock);
3873 
3874         tcp_listener_conf_cleanup(tcps);
3875 
3876         for (i = 0; i < tcps->tcps_sc_cnt; i++)
3877                 kmem_free(tcps->tcps_sc[i], sizeof (tcp_stats_cpu_t));
3878         kmem_free(tcps->tcps_sc, max_ncpus * sizeof (tcp_stats_cpu_t *));
3879 
3880         kmem_free(tcps->tcps_propinfo_tbl,
3881             tcp_propinfo_count * sizeof (mod_prop_info_t));
3882         tcps->tcps_propinfo_tbl = NULL;
3883 
3884         for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) {
3885                 ASSERT(tcps->tcps_bind_fanout[i].tf_tcp == NULL);
3886                 mutex_destroy(&tcps->tcps_bind_fanout[i].tf_lock);
3887         }
3888 
3889         for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) {
3890                 ASSERT(tcps->tcps_acceptor_fanout[i].tf_tcp == NULL);
3891                 mutex_destroy(&tcps->tcps_acceptor_fanout[i].tf_lock);
3892         }
3893 
3894         kmem_free(tcps->tcps_bind_fanout, sizeof (tf_t) * TCP_BIND_FANOUT_SIZE);
3895         tcps->tcps_bind_fanout = NULL;
3896 
3897         kmem_free(tcps->tcps_acceptor_fanout, sizeof (tf_t) *
3898             TCP_ACCEPTOR_FANOUT_SIZE);
3899         tcps->tcps_acceptor_fanout = NULL;
3900 
3901         mutex_destroy(&tcps->tcps_iss_key_lock);
3902         mutex_destroy(&tcps->tcps_epriv_port_lock);
3903 
3904         ip_drop_unregister(&tcps->tcps_dropper);
3905 
3906         tcp_kstat2_fini(stackid, tcps->tcps_kstat);
3907         tcps->tcps_kstat = NULL;
3908 
3909         tcp_kstat_fini(stackid, tcps->tcps_mibkp);
3910         tcps->tcps_mibkp = NULL;
3911 
3912         ldi_ident_release(tcps->tcps_ldi_ident);
3913         kmem_free(tcps, sizeof (*tcps));
3914 }
3915 
3916 /*
3917  * Generate ISS, taking into account NDD changes may happen halfway through.
3918  * (If the iss is not zero, set it.)
3919  */
3920 
3921 static void
3922 tcp_iss_init(tcp_t *tcp)
3923 {
3924         MD5_CTX context;
3925         struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg;
3926         uint32_t answer[4];
3927         tcp_stack_t     *tcps = tcp->tcp_tcps;
3928         conn_t          *connp = tcp->tcp_connp;
3929 
3930         tcps->tcps_iss_incr_extra += (tcps->tcps_iss_incr >> 1);
3931         tcp->tcp_iss = tcps->tcps_iss_incr_extra;
3932         switch (tcps->tcps_strong_iss) {
3933         case 2:
3934                 mutex_enter(&tcps->tcps_iss_key_lock);
3935                 context = tcps->tcps_iss_key;
3936                 mutex_exit(&tcps->tcps_iss_key_lock);
3937                 arg.ports = connp->conn_ports;
3938                 arg.src = connp->conn_laddr_v6;
3939                 arg.dst = connp->conn_faddr_v6;
3940                 MD5Update(&context, (uchar_t *)&arg, sizeof (arg));
3941                 MD5Final((uchar_t *)answer, &context);
3942                 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3];
3943                 /*
3944                  * Now that we've hashed into a unique per-connection sequence
3945                  * space, add a random increment per strong_iss == 1.  So I
3946                  * guess we'll have to...
3947                  */
3948                 /* FALLTHRU */
3949         case 1:
3950                 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random();
3951                 break;
3952         default:
3953                 tcp->tcp_iss += (uint32_t)gethrestime_sec() *
3954                     tcps->tcps_iss_incr;
3955                 break;
3956         }
3957         tcp->tcp_valid_bits = TCP_ISS_VALID;
3958         tcp->tcp_fss = tcp->tcp_iss - 1;
3959         tcp->tcp_suna = tcp->tcp_iss;
3960         tcp->tcp_snxt = tcp->tcp_iss + 1;
3961         tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3962         tcp->tcp_csuna = tcp->tcp_snxt;
3963 }
3964 
3965 /*
3966  * tcp_{set,clr}qfull() functions are used to either set or clear QFULL
3967  * on the specified backing STREAMS q. Note, the caller may make the
3968  * decision to call based on the tcp_t.tcp_flow_stopped value which
3969  * when check outside the q's lock is only an advisory check ...
3970  */
3971 void
3972 tcp_setqfull(tcp_t *tcp)
3973 {
3974         tcp_stack_t     *tcps = tcp->tcp_tcps;
3975         conn_t  *connp = tcp->tcp_connp;
3976 
3977         if (tcp->tcp_closed)
3978                 return;
3979 
3980         conn_setqfull(connp, &tcp->tcp_flow_stopped);
3981         if (tcp->tcp_flow_stopped)
3982                 TCP_STAT(tcps, tcp_flwctl_on);
3983 }
3984 
3985 void
3986 tcp_clrqfull(tcp_t *tcp)
3987 {
3988         conn_t  *connp = tcp->tcp_connp;
3989 
3990         if (tcp->tcp_closed)
3991                 return;
3992         conn_clrqfull(connp, &tcp->tcp_flow_stopped);
3993 }
3994 
3995 static int
3996 tcp_squeue_switch(int val)
3997 {
3998         int rval = SQ_FILL;
3999 
4000         switch (val) {
4001         case 1:
4002                 rval = SQ_NODRAIN;
4003                 break;
4004         case 2:
4005                 rval = SQ_PROCESS;
4006                 break;
4007         default:
4008                 break;
4009         }
4010         return (rval);
4011 }
4012 
4013 /*
4014  * This is called once for each squeue - globally for all stack
4015  * instances.
4016  */
4017 static void
4018 tcp_squeue_add(squeue_t *sqp)
4019 {
4020         tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc(
4021             sizeof (tcp_squeue_priv_t), KM_SLEEP);
4022 
4023         *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait;
4024         if (tcp_free_list_max_cnt == 0) {
4025                 int tcp_ncpus = ((boot_max_ncpus == -1) ?
4026                     max_ncpus : boot_max_ncpus);
4027 
4028                 /*
4029                  * Limit number of entries to 1% of availble memory / tcp_ncpus
4030                  */
4031                 tcp_free_list_max_cnt = (freemem * PAGESIZE) /
4032                     (tcp_ncpus * sizeof (tcp_t) * 100);
4033         }
4034         tcp_time_wait->tcp_free_list_cnt = 0;
4035 }
4036 /*
4037  * Return unix error is tli error is TSYSERR, otherwise return a negative
4038  * tli error.
4039  */
4040 int
4041 tcp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
4042     boolean_t bind_to_req_port_only)
4043 {
4044         int error;
4045         tcp_t *tcp = connp->conn_tcp;
4046 
4047         if (tcp->tcp_state >= TCPS_BOUND) {
4048                 if (connp->conn_debug) {
4049                         (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4050                             "tcp_bind: bad state, %d", tcp->tcp_state);
4051                 }
4052                 return (-TOUTSTATE);
4053         }
4054 
4055         error = tcp_bind_check(connp, sa, len, cr, bind_to_req_port_only);
4056         if (error != 0)
4057                 return (error);
4058 
4059         ASSERT(tcp->tcp_state == TCPS_BOUND);
4060         tcp->tcp_conn_req_max = 0;
4061         return (0);
4062 }
4063 
4064 /*
4065  * If the return value from this function is positive, it's a UNIX error.
4066  * Otherwise, if it's negative, then the absolute value is a TLI error.
4067  * the TPI routine tcp_tpi_connect() is a wrapper function for this.
4068  */
4069 int
4070 tcp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
4071     cred_t *cr, pid_t pid)
4072 {
4073         tcp_t           *tcp = connp->conn_tcp;
4074         sin_t           *sin = (sin_t *)sa;
4075         sin6_t          *sin6 = (sin6_t *)sa;
4076         ipaddr_t        *dstaddrp;
4077         in_port_t       dstport;
4078         uint_t          srcid;
4079         int             error;
4080         uint32_t        mss;
4081         mblk_t          *syn_mp;
4082         tcp_stack_t     *tcps = tcp->tcp_tcps;
4083         int32_t         oldstate;
4084         ip_xmit_attr_t  *ixa = connp->conn_ixa;
4085 
4086         oldstate = tcp->tcp_state;
4087 
4088         switch (len) {
4089         default:
4090                 /*
4091                  * Should never happen
4092                  */
4093                 return (EINVAL);
4094 
4095         case sizeof (sin_t):
4096                 sin = (sin_t *)sa;
4097                 if (sin->sin_port == 0) {
4098                         return (-TBADADDR);
4099                 }
4100                 if (connp->conn_ipv6_v6only) {
4101                         return (EAFNOSUPPORT);
4102                 }
4103                 break;
4104 
4105         case sizeof (sin6_t):
4106                 sin6 = (sin6_t *)sa;
4107                 if (sin6->sin6_port == 0) {
4108                         return (-TBADADDR);
4109                 }
4110                 break;
4111         }
4112         /*
4113          * If we're connecting to an IPv4-mapped IPv6 address, we need to
4114          * make sure that the conn_ipversion is IPV4_VERSION.  We
4115          * need to this before we call tcp_bindi() so that the port lookup
4116          * code will look for ports in the correct port space (IPv4 and
4117          * IPv6 have separate port spaces).
4118          */
4119         if (connp->conn_family == AF_INET6 &&
4120             connp->conn_ipversion == IPV6_VERSION &&
4121             IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
4122                 if (connp->conn_ipv6_v6only)
4123                         return (EADDRNOTAVAIL);
4124 
4125                 connp->conn_ipversion = IPV4_VERSION;
4126         }
4127 
4128         switch (tcp->tcp_state) {
4129         case TCPS_LISTEN:
4130                 /*
4131                  * Listening sockets are not allowed to issue connect().
4132                  */
4133                 if (IPCL_IS_NONSTR(connp))
4134                         return (EOPNOTSUPP);
4135                 /* FALLTHRU */
4136         case TCPS_IDLE:
4137                 /*
4138                  * We support quick connect, refer to comments in
4139                  * tcp_connect_*()
4140                  */
4141                 /* FALLTHRU */
4142         case TCPS_BOUND:
4143                 break;
4144         default:
4145                 return (-TOUTSTATE);
4146         }
4147 
4148         /*
4149          * We update our cred/cpid based on the caller of connect
4150          */
4151         if (connp->conn_cred != cr) {
4152                 crhold(cr);
4153                 crfree(connp->conn_cred);
4154                 connp->conn_cred = cr;
4155         }
4156         connp->conn_cpid = pid;
4157 
4158         /* Cache things in the ixa without any refhold */
4159         ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4160         ixa->ixa_cred = cr;
4161         ixa->ixa_cpid = pid;
4162         if (is_system_labeled()) {
4163                 /* We need to restart with a label based on the cred */
4164                 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
4165         }
4166 
4167         if (connp->conn_family == AF_INET6) {
4168                 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
4169                         error = tcp_connect_ipv6(tcp, &sin6->sin6_addr,
4170                             sin6->sin6_port, sin6->sin6_flowinfo,
4171                             sin6->__sin6_src_id, sin6->sin6_scope_id);
4172                 } else {
4173                         /*
4174                          * Destination adress is mapped IPv6 address.
4175                          * Source bound address should be unspecified or
4176                          * IPv6 mapped address as well.
4177                          */
4178                         if (!IN6_IS_ADDR_UNSPECIFIED(
4179                             &connp->conn_bound_addr_v6) &&
4180                             !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) {
4181                                 return (EADDRNOTAVAIL);
4182                         }
4183                         dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr));
4184                         dstport = sin6->sin6_port;
4185                         srcid = sin6->__sin6_src_id;
4186                         error = tcp_connect_ipv4(tcp, dstaddrp, dstport,
4187                             srcid);
4188                 }
4189         } else {
4190                 dstaddrp = &sin->sin_addr.s_addr;
4191                 dstport = sin->sin_port;
4192                 srcid = 0;
4193                 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, srcid);
4194         }
4195 
4196         if (error != 0)
4197                 goto connect_failed;
4198 
4199         CL_INET_CONNECT(connp, B_TRUE, error);
4200         if (error != 0)
4201                 goto connect_failed;
4202 
4203         /* connect succeeded */
4204         TCPS_BUMP_MIB(tcps, tcpActiveOpens);
4205         tcp->tcp_active_open = 1;
4206 
4207         /*
4208          * tcp_set_destination() does not adjust for TCP/IP header length.
4209          */
4210         mss = tcp->tcp_mss - connp->conn_ht_iphc_len;
4211 
4212         /*
4213          * Just make sure our rwnd is at least rcvbuf * MSS large, and round up
4214          * to the nearest MSS.
4215          *
4216          * We do the round up here because we need to get the interface MTU
4217          * first before we can do the round up.
4218          */
4219         tcp->tcp_rwnd = connp->conn_rcvbuf;
4220         tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss),
4221             tcps->tcps_recv_hiwat_minmss * mss);
4222         connp->conn_rcvbuf = tcp->tcp_rwnd;
4223         tcp_set_ws_value(tcp);
4224         tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
4225         if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always)
4226                 tcp->tcp_snd_ws_ok = B_TRUE;
4227 
4228         /*
4229          * Set tcp_snd_ts_ok to true
4230          * so that tcp_xmit_mp will
4231          * include the timestamp
4232          * option in the SYN segment.
4233          */
4234         if (tcps->tcps_tstamp_always ||
4235             (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) {
4236                 tcp->tcp_snd_ts_ok = B_TRUE;
4237         }
4238 
4239         /*
4240          * Note that tcp_snd_sack_ok can be set in tcp_set_destination() if
4241          * the SACK metric is set.  So here we just check the per stack SACK
4242          * permitted param.
4243          */
4244         if (tcps->tcps_sack_permitted == 2) {
4245                 ASSERT(tcp->tcp_num_sack_blk == 0);
4246                 ASSERT(tcp->tcp_notsack_list == NULL);
4247                 tcp->tcp_snd_sack_ok = B_TRUE;
4248         }
4249 
4250         /*
4251          * Should we use ECN?  Note that the current
4252          * default value (SunOS 5.9) of tcp_ecn_permitted
4253          * is 1.  The reason for doing this is that there
4254          * are equipments out there that will drop ECN
4255          * enabled IP packets.  Setting it to 1 avoids
4256          * compatibility problems.
4257          */
4258         if (tcps->tcps_ecn_permitted == 2)
4259                 tcp->tcp_ecn_ok = B_TRUE;
4260 
4261         /* Trace change from BOUND -> SYN_SENT here */
4262         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4263             connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
4264             int32_t, TCPS_BOUND);
4265 
4266         TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4267         syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL,
4268             tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
4269         if (syn_mp != NULL) {
4270                 /*
4271                  * We must bump the generation before sending the syn
4272                  * to ensure that we use the right generation in case
4273                  * this thread issues a "connected" up call.
4274                  */
4275                 SOCK_CONNID_BUMP(tcp->tcp_connid);
4276                 /*
4277                  * DTrace sending the first SYN as a
4278                  * tcp:::connect-request event.
4279                  */
4280                 DTRACE_TCP5(connect__request, mblk_t *, NULL,
4281                     ip_xmit_attr_t *, connp->conn_ixa,
4282                     void_ip_t *, syn_mp->b_rptr, tcp_t *, tcp,
4283                     tcph_t *,
4284                     &syn_mp->b_rptr[connp->conn_ixa->ixa_ip_hdr_length]);
4285                 tcp_send_data(tcp, syn_mp);
4286         }
4287 
4288         if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
4289                 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
4290         return (0);
4291 
4292 connect_failed:
4293         connp->conn_faddr_v6 = ipv6_all_zeros;
4294         connp->conn_fport = 0;
4295         tcp->tcp_state = oldstate;
4296         if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
4297                 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
4298         return (error);
4299 }
4300 
4301 int
4302 tcp_do_listen(conn_t *connp, struct sockaddr *sa, socklen_t len,
4303     int backlog, cred_t *cr, boolean_t bind_to_req_port_only)
4304 {
4305         tcp_t           *tcp = connp->conn_tcp;
4306         int             error = 0;
4307         tcp_stack_t     *tcps = tcp->tcp_tcps;
4308         int32_t         oldstate;
4309 
4310         /* All Solaris components should pass a cred for this operation. */
4311         ASSERT(cr != NULL);
4312 
4313         if (tcp->tcp_state >= TCPS_BOUND) {
4314                 if ((tcp->tcp_state == TCPS_BOUND ||
4315                     tcp->tcp_state == TCPS_LISTEN) && backlog > 0) {
4316                         /*
4317                          * Handle listen() increasing backlog.
4318                          * This is more "liberal" then what the TPI spec
4319                          * requires but is needed to avoid a t_unbind
4320                          * when handling listen() since the port number
4321                          * might be "stolen" between the unbind and bind.
4322                          */
4323                         goto do_listen;
4324                 }
4325                 if (connp->conn_debug) {
4326                         (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4327                             "tcp_listen: bad state, %d", tcp->tcp_state);
4328                 }
4329                 return (-TOUTSTATE);
4330         } else {
4331                 if (sa == NULL) {
4332                         sin6_t  addr;
4333                         sin_t *sin;
4334                         sin6_t *sin6;
4335 
4336                         ASSERT(IPCL_IS_NONSTR(connp));
4337                         /* Do an implicit bind: Request for a generic port. */
4338                         if (connp->conn_family == AF_INET) {
4339                                 len = sizeof (sin_t);
4340                                 sin = (sin_t *)&addr;
4341                                 *sin = sin_null;
4342                                 sin->sin_family = AF_INET;
4343                         } else {
4344                                 ASSERT(connp->conn_family == AF_INET6);
4345                                 len = sizeof (sin6_t);
4346                                 sin6 = (sin6_t *)&addr;
4347                                 *sin6 = sin6_null;
4348                                 sin6->sin6_family = AF_INET6;
4349                         }
4350                         sa = (struct sockaddr *)&addr;
4351                 }
4352 
4353                 error = tcp_bind_check(connp, sa, len, cr,
4354                     bind_to_req_port_only);
4355                 if (error)
4356                         return (error);
4357                 /* Fall through and do the fanout insertion */
4358         }
4359 
4360 do_listen:
4361         ASSERT(tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN);
4362         tcp->tcp_conn_req_max = backlog;
4363         if (tcp->tcp_conn_req_max) {
4364                 if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min)
4365                         tcp->tcp_conn_req_max = tcps->tcps_conn_req_min;
4366                 if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q)
4367                         tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q;
4368                 /*
4369                  * If this is a listener, do not reset the eager list
4370                  * and other stuffs.  Note that we don't check if the
4371                  * existing eager list meets the new tcp_conn_req_max
4372                  * requirement.
4373                  */
4374                 if (tcp->tcp_state != TCPS_LISTEN) {
4375                         tcp->tcp_state = TCPS_LISTEN;
4376                         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4377                             connp->conn_ixa, void, NULL, tcp_t *, tcp,
4378                             void, NULL, int32_t, TCPS_BOUND);
4379                         /* Initialize the chain. Don't need the eager_lock */
4380                         tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
4381                         tcp->tcp_eager_next_drop_q0 = tcp;
4382                         tcp->tcp_eager_prev_drop_q0 = tcp;
4383                         tcp->tcp_second_ctimer_threshold =
4384                             tcps->tcps_ip_abort_linterval;
4385                 }
4386         }
4387 
4388         /*
4389          * We need to make sure that the conn_recv is set to a non-null
4390          * value before we insert the conn into the classifier table.
4391          * This is to avoid a race with an incoming packet which does an
4392          * ipcl_classify().
4393          * We initially set it to tcp_input_listener_unbound to try to
4394          * pick a good squeue for the listener when the first SYN arrives.
4395          * tcp_input_listener_unbound sets it to tcp_input_listener on that
4396          * first SYN.
4397          */
4398         connp->conn_recv = tcp_input_listener_unbound;
4399 
4400         /* Insert the listener in the classifier table */
4401         error = ip_laddr_fanout_insert(connp);
4402         if (error != 0) {
4403                 /* Undo the bind - release the port number */
4404                 oldstate = tcp->tcp_state;
4405                 tcp->tcp_state = TCPS_IDLE;
4406                 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4407                     connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
4408                     int32_t, oldstate);
4409                 connp->conn_bound_addr_v6 = ipv6_all_zeros;
4410 
4411                 connp->conn_laddr_v6 = ipv6_all_zeros;
4412                 connp->conn_saddr_v6 = ipv6_all_zeros;
4413                 connp->conn_ports = 0;
4414 
4415                 if (connp->conn_anon_port) {
4416                         zone_t          *zone;
4417 
4418                         zone = crgetzone(cr);
4419                         connp->conn_anon_port = B_FALSE;
4420                         (void) tsol_mlp_anon(zone, connp->conn_mlp_type,
4421                             connp->conn_proto, connp->conn_lport, B_FALSE);
4422                 }
4423                 connp->conn_mlp_type = mlptSingle;
4424 
4425                 tcp_bind_hash_remove(tcp);
4426                 return (error);
4427         } else {
4428                 /*
4429                  * If there is a connection limit, allocate and initialize
4430                  * the counter struct.  Note that since listen can be called
4431                  * multiple times, the struct may have been allready allocated.
4432                  */
4433                 if (!list_is_empty(&tcps->tcps_listener_conf) &&
4434                     tcp->tcp_listen_cnt == NULL) {
4435                         tcp_listen_cnt_t *tlc;
4436                         uint32_t ratio;
4437 
4438                         ratio = tcp_find_listener_conf(tcps,
4439                             ntohs(connp->conn_lport));
4440                         if (ratio != 0) {
4441                                 uint32_t mem_ratio, tot_buf;
4442 
4443                                 tlc = kmem_alloc(sizeof (tcp_listen_cnt_t),
4444                                     KM_SLEEP);
4445                                 /*
4446                                  * Calculate the connection limit based on
4447                                  * the configured ratio and maxusers.  Maxusers
4448                                  * are calculated based on memory size,
4449                                  * ~ 1 user per MB.  Note that the conn_rcvbuf
4450                                  * and conn_sndbuf may change after a
4451                                  * connection is accepted.  So what we have
4452                                  * is only an approximation.
4453                                  */
4454                                 if ((tot_buf = connp->conn_rcvbuf +
4455                                     connp->conn_sndbuf) < MB) {
4456                                         mem_ratio = MB / tot_buf;
4457                                         tlc->tlc_max = maxusers / ratio *
4458                                             mem_ratio;
4459                                 } else {
4460                                         mem_ratio = tot_buf / MB;
4461                                         tlc->tlc_max = maxusers / ratio /
4462                                             mem_ratio;
4463                                 }
4464                                 /* At least we should allow two connections! */
4465                                 if (tlc->tlc_max <= tcp_min_conn_listener)
4466                                         tlc->tlc_max = tcp_min_conn_listener;
4467                                 tlc->tlc_cnt = 1;
4468                                 tlc->tlc_drop = 0;
4469                                 tcp->tcp_listen_cnt = tlc;
4470                         }
4471                 }
4472         }
4473         return (error);
4474 }